Nethserver-freeradius integration module

Feature
, , ,
82

Agreed, that most people find certificate handling complicated…
The same is also valid for IT itself… :slight_smile:

Personally, I find that OPNsense does a good job of managing it’s certificates and what it presents where…
No need for an “App” to do this simple job!

My 2 cents
Andy

1 Like
83

I am looking for a universal way/tool/mehod to deal with certs in windows and linux environments…

84

What do you mean by “deal with”? And what kind of certs? Are you wanting to run a local certificate authority? If so, that looks like one tool that would do the job. Step-CA is another. But do you need a local CA at all?

85

Forgive me my ignorance, I am not sure atm if I need it really…

86

Found another interesting Software for certificate lifecycle management - Dogtag

This one can maybe run under Nethserver?

87

Dogtag Setup - User Guide

89

The migration to NS8 also has to be done for my server and freeradius is a requirement.
My plan is to install freeradius under base system the same way, which is possible without a doubt.

@Andy_Wismer Can anyone tell me:

  1. is ntlm_auth tool still available inside the Samba’s Nethserver container?
  2. is LDAP bind possible inside the container (like it was in Nethserver 7)?
90

Hi @kellerman

  1. I’ll need to verify when at home.
  2. AFAIK: Yes, but I need to test it myself.

My 2 cents
Andy

1 Like
91

LDAP binds work. I did the migration of the DC and ldap still works the old way.
Ntlm_auth is also still there. Radius integration should work! :slight_smile: Only now the command should be executed trough runagent.

I have many other things to fix after migration, so yeah, I will try this, but not quite now.

3 Likes
92

Update.
So far I have good success with configuring freeradius. The configuration looks good.

EDIT:
Disabled certificate verification for freeradius and it started talking. I will document everything when I am finished.

2 Likes
93

I have configured 3 authentication methods that are commonly used. And that I use.

  • PEAP MSCHAPv2 via ntlm_auth
  • EAP TLS
  • PAP authentication via LDAP bind

They all now work just like before.

One problem I encountered is - when running radiusd manually, if works flawlessly. But when it is run as systemd service, then
runagent -m samba1 podman exec samba-dc ntml_auth
exits with 1. Both ways it runs as root. Any ideas?

94

Is it possible to get it working on NS8?

95

I think it’s possible, I gave it a try but it didn’t start correctly. I used this image: https://hub.docker.com/r/freeradius/freeradius-server/

Maybe I need to use an own image or another one…to be continued…

1 Like