Re: Authentication using LDAP for 802.1x

2013-06-19 Thread A . L . M . Buxey
Hi, > He he he... if I recall correctly I came up with something like: yes, thats the one. quoted as 'most evil unlang ever' if I recall have used it on many occasions...does the job well > ...as the EAP module was updated to return "ok" on identity/mschap > responses. Yet another reason to upgr

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread Phil Mayers
On 19/06/13 15:32, Olivier Beytrison wrote: On 19.06.2013 16:02, a.l.m.bu...@lboro.ac.uk wrote: Hi, Some other comments - Upgrade from 2.1.12 to 2.2.x, as there are security issues pre 2.2.x. Save yourself some round trip packets by setting default_eap_type = ttls in eap.conf Save yourself

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread Olivier Beytrison
On 19.06.2013 16:02, a.l.m.bu...@lboro.ac.uk wrote: > Hi, > >> Some other comments - >> >> Upgrade from 2.1.12 to 2.2.x, as there are security issues pre >> 2.2.x. >> >> Save yourself some round trip packets by setting default_eap_type >> = ttls in eap.conf >> >> Save yourself some LDAP lookups by

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread A . L . M . Buxey
Hi, > Some other comments - > > Upgrade from 2.1.12 to 2.2.x, as there are security issues pre > 2.2.x. > > Save yourself some round trip packets by setting default_eap_type > = ttls in eap.conf > > Save yourself some LDAP lookups by removing ldap from the outer. ..and save some more hits to L

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread Olivier Beytrison
On 19.06.2013 14:58, a.l.m.bu...@lboro.ac.uk wrote: > Hi, > >> I will make it short and easy. >> >> You can't do LDAP authentication with 802.1x. EAP needs the password of >> the user in cleartext. if it's not in your ldap, you're screwed. > > ..EAP-TTLS/PAP ? ;-) yeah. ok. missed this one :p I

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread Matthew Newton
On Wed, Jun 19, 2013 at 02:49:21PM +0200, Olivier Beytrison wrote: > On 19.06.2013 14:11, Marco Streich wrote: > > We have deployed FreeRADIUS on OS X before, but our > > configuration was rather ugly. What we would do is > > authenticate users locally, having the machine attached to our > > OpenDi

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread Phil Mayers
On 19/06/13 13:11, Marco Streich wrote: When I run radtest from my laptop, the authentication is successful: radtest does not send eap. Download the wpa_supplicant sources and compile eapol_test to test EAP. WARNING: No "known good" password was found in LDAP. Are you sure that the user

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread A . L . M . Buxey
Hi, > I will make it short and easy. > > You can't do LDAP authentication with 802.1x. EAP needs the password of > the user in cleartext. if it's not in your ldap, you're screwed. ..EAP-TTLS/PAP ? ;-) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Re: Authentication using LDAP for 802.1x

2013-06-19 Thread Olivier Beytrison
On 19.06.2013 14:11, Marco Streich wrote: > Hi all > > We have deployed FreeRADIUS on OS X before, but our configuration was rather > ugly. What we would do is authenticate users locally, having the machine > attached to our OpenDirectory server directly using the Connect Network > Account Serv

Authentication using LDAP for 802.1x

2013-06-19 Thread Marco Streich
Hi all We have deployed FreeRADIUS on OS X before, but our configuration was rather ugly. What we would do is authenticate users locally, having the machine attached to our OpenDirectory server directly using the Connect Network Account Server functionality provided by OS X. I have seen this q