On [Tue, 03.01.2012 09:19], Phil Mayers wrote:
On 01/02/2012 11:45 PM, Thorsten Scherf wrote:
Hey,
this is a comprehension question. When I have a ldap directory to
authenticate users with pam_ldap when they login to their local
workstations, how can I secure network access with radius?! I mean,
isn't that a chicken egg problem? How would I be able to talk to the
ldap server before I sucessfully authenticated against Radius? For sure
I do miss something, would be great if somebody could enlighten me. :)
If you want to use the login credentials to speak 802.1x, it can't be
done currently, as far as I know; you would need some kind of PAM
module that spoke to the system 802.1x supplicant. As far as I'm
aware, there is no such module.
I tried a combination of pam_radius_auth and pam_unix, that worked ok. I
guess the same can be done with pam_ldap as well, needs some testing,
though.
This can be done under Windows.
Alternatively, you could just use a "machine-specific" account to
perform 802.1x. This can be done today with NetworkManager and a
"system" connection profile. This eliminates the chicken/egg issue.
When I check the 802.1x settings in NM, I don't see where I can
configure a machine account, only user-accounts which is fine. Am I
missing something?
Mabye the whole question should be more general. Can you give me an
example, how a desktop/notebook system (Linux or Windows based) with
centralized user management (ldap/krb5/ad) has to configured in order to
benefit from 802.1x benefits like dynamic vlan assignments and things
like that?!
Cheers,
Thorsten
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
