On 03/01/12 09:42, Thorsten Scherf wrote:
I tried a combination of pam_radius_auth and pam_unix, that worked ok. I
guess the same can be done with pam_ldap as well, needs some testing,
though.
Sorry, I am confused.
By "secure network access" I assumed you meant "how can I use the login
credentials to login to the network with 802.1x" - is this correct?
Neither pam_radius_auth nor pam_ldap will do that.
This can be done under Windows.
Alternatively, you could just use a "machine-specific" account to
perform 802.1x. This can be done today with NetworkManager and a
"system" connection profile. This eliminates the chicken/egg issue.
When I check the 802.1x settings in NM, I don't see where I can
configure a machine account, only user-accounts which is fine. Am I
missing something?
"Machine account" is a term specific to Windows domain authentication.
If you want a "machine account" for Linux, you'll have to create a
normal account and put the credentials in a "system" NetworkManager
connection definition.
Mabye the whole question should be more general. Can you give me an
example, how a desktop/notebook system (Linux or Windows based) with
centralized user management (ldap/krb5/ad) has to configured in order to
benefit from 802.1x benefits like dynamic vlan assignments and things
like that?!
No sorry, that's a huge and very vague question that doesn't make a lot
of sense. You'll need to do some research yourself, or ask more specific
questions.
It's also not FreeRADIUS-specific.
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
