I am trying to setup machine authentication via peapv0. I have
authentication working if I use a regular username and password stored
in /etc/samba/smbpasswd. When I check the "authenticate as computer" box
in the windows XP supplicant and run radiusd in debug mode, windows
sends the machine username as host\machinename.
I setup a host\ realm to strip off the host part but then I noticed that
all machine accounts in /etc/smbpasswd are in full capitalization
regardless of the capitalization of the machine name. For instance. The
machine name of the computer is cc20000 but the machine account is
stored in smbpasswd as CC20000! So I manipulated the entry to be lower
case to see if that would authenticate the machine. Nope, Freeradius
reads the last value in the machine account entry in the smbpasswd file
as the account control entry (which is correct) and the mschap module
says the account is disabled or a special account (which it is) and
fails authentication.
My question is... can I authenticate machines using the passwd module
and the smbpasswd file? I cannot use the ntlm_auth method. I am running
freeradius on the same server as the domain controller and for some
reason ntlm_auth cannot find a domain controller when run on the same
machine. It can if ran on a separate box. Running freeradius on a
separate box is not an option so I must use /etc/smbpasswd.
Thanks! -Josh
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
