You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: doc/antora/modules/howto/pages/datastores/ad/index.adoc
+4-2Lines changed: 4 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -2,14 +2,16 @@
2
2
3
3
Microsoft Active Directory (AD) is a directory service that stores and manages user accounts, credentials, and other network resources within a domain. The AD server receives and processes access requests from the FreeRADIUS server. AD provides a centralized location for managing authentications and access by:
4
4
5
+
The services manage network activities by:
6
+
5
7
* authenticating users by verifying their identity and credentials, and
6
-
* authorizating resource access to that user by applying policies to restrict access to data.
8
+
* authorizating resource use by applying policies to restrict access to data.
7
9
8
10
== What is it?
9
11
10
12
When FreeRADIUS is integrated with Active Directory, the AD server functions as an “authentication oracle.” FreeRADIUS doesn’t store user credentials internally, but instead, passes these credentials to AD for verification.
11
13
12
-
For PAP and MS-CHAP based authentications, FreeRADIUS uses tools such as Samba, including winbind, and the `ntlm_auth` helper program to communicate with the AD server.
14
+
For MS-CHAP based authentications, FreeRADIUS uses tools such as Samba, including winbind and the `ntlm_auth` helper program to communicate with the AD server.
13
15
14
16
=== FreeRADIUS Active Directory Authentication Process
Some deployments use Active Directory services to use in mschap based authentications. The RADIUS server must alreay be up and running and basic authentication works (pap/chap). For a freeRADIUS server to fully leverage the AD server and relevant services, the RADIUS server must first be configured and then joined to the domain (or samba realm).
4
+
5
+
6
+
== Configuration of variables
7
+
8
+
Requires the following variables to be set by the including template:
9
+
10
+
- orch_minion: First orchestrator minion
11
+
- orch: Hostname of the orchestrator
12
+
- orch_fqdn: FQDN of the orchestrator
13
+
- host_exam: Example RADIUS authentication server hostname
14
+
- netbios_exam: Example netbios name for auth server host
15
+
- realm: Samba realm
16
+
- workgroup: Samba workgroup
17
+
- domains: List of domains mapping to the Kerberos realm
18
+
- dcs: List of AD domain controllers
19
+
- preferred: A preferred domain controller.
20
+
Default: No preference ("password server = *")
21
+
- admin: DC acting as the Kerberos master. Default: First entry in dcs.
22
+
- join_user: User privileged to perform domain joins. Optional.
23
+
- join_server: DC to use for the join operation. Optional.
It is normal to receive an error message about failure to update DNS.
131
+
====
132
+
133
+
== Restart the winbind service:
134
+
135
+
radius-auth1# systemctl stop winbind
136
+
radius-auth1# systemctl start winbind
137
+
138
+
A description of how to test and troubleshoot winbind is provided in the
139
+
[Operations and troubleshooting guide](/doc/html/ops/operations.html) document.
140
+
141
+
Authentication must be achieved using the `wbinfo` tool before FreeRADIUS will
142
+
be able to successfully authenticate users performing a MS-CHAPv2 based method.
143
+
144
+
If there are going to be password changes with freeradius ("your password has expired" - type - scenarios) You should probably also configure in /mods-available/mschap:
With the settings above it works correctly, so even if it is unnecessary, it doesn't break anything. It hasn't been tested without this option while denying ntlmv1 overall on the AD DC, but it is thought that it will work without it.
== Configuring Authentication with Active Directory (AD)
2
2
3
-
The main steps to integrate FreeRADIUS authentication with Active Directoryare:
3
+
Once the PAP authentication test has been successful, the next step for sites using Active Directory is to configure the system to perform user authentication against Active Directory. The clear-text passwords are unavailable through Active Directory, so we have to use Samba, and the ntlm_auth helper program. In this configuration, we are using Active Directory as an authentication oracle, and not as an LDAP database.
4
4
5
-
. Install and configure Samba by editing the `smb.conf` file.
6
-
. Configure FreeRADIUS by editing the relevent modules such as `ntlm_auth` and ms-chap.
7
-
. Join the FreeRADIUS server to the Active Directory domain.
8
-
. Configure Samba to authenticate against Active Directory and test authentications using `winbind` and `ntlm`.
9
-
. Configure FreeRADIUS to use the `ntlm_auth` module for authentication.
5
+
Using ntlm_auth for PAP authentication may not work on recent versions of Samba and Active Directory. If so, just skip to the next section.
10
6
11
-
After the PAP authentication has been successful, the next step for sites using Active Directory is to configure the system to perform user authentication against Active Directory. The clear-text passwords are unavailable through Active Directory, so we use Samba, and the `ntlm_auth` helper program. In this configuration, we are using Active Directory as an authentication oracle, and not as an LDAP database.
7
+
Once Samba has been installed on your system, you should edit the smb.conf file, and configure the [global] section to point to your NT server, including hostname and NT domain.
12
8
13
-
Samba uses the SMB protocol along with the winbind module to authenticate users against Active Directory. Users are verified using either the PAP or MS-CHAP authentication methods.
14
-
15
-
Using `ntlm_auth` for PAP authentication may not work on recent versions of Samba and Active Directory. If you have this issue, proceed to the xref:datastores/ad/configure_ntlm_mschap.adoc[Configuring ntlm] section.
16
-
17
-
== Configuring Samba
18
-
19
-
Once Samba has been installed on your system, edit the `smb.conf` file, and update the [global] section to point to your NT server, including hostname and NT domain.
20
-
21
-
=== Configure `/opt/samba/etc/smb.conf` file
22
-
23
-
The example snippet shown below needs to be modified with your site parameters which includes updating the workgroup, security, and realm fields.
24
-
25
-
```
26
9
# workgroup = NT-Domain-Name
27
10
workgroup = MYDOMAIN
28
11
...
@@ -33,64 +16,74 @@ The example snippet shown below needs to be modified with your site parameters w
33
16
password server = nt-server-hostname.company.com
34
17
...
35
18
realm = realm.company.com
36
-
```
19
+
For Samba 4, you also have to set the ntlm authconfiguration variable. It should be set to either yes, or to mschapv2-and-ntlmv2-only. This configuration needs to be set all participating Samba members, and also on (Samba4) AD-DC servers.
37
20
38
-
Next, update the ntlm authconfiguration variable for Samba 4 to set the authentication protocol used between the FreeRADIUS and AD servers. This variable can be set to either `yes` or to `mschapv2-and-ntlmv2-only`. This configuration needs to be added to all participating Samba members, and also on (Samba4) AD Domain Controller (DC) servers.
39
-
```
40
21
ntlm auth = mschapv2-and-ntlmv2-only
41
22
...
42
-
```
43
-
=== Configure `/etc/krb5.conf` file
44
-
45
-
Edit the `/etc/krb5.conf` file by adding an entry to point to the AD server.
23
+
You may also have to edit the /etc/krb5.conf file, to add an entry that points to the Active Directory Server. This is often not necessary, as Samba can just "figure it out" when Active Directory is also the main DNS server.
46
24
47
-
```
48
25
[realms]
49
26
...
50
27
realm.company.com = {
51
28
kdc = nt-server-hostname.company.com
52
29
}
53
30
...
54
-
```
55
31
56
-
If the Active Directory server is also the main DNS server, this previous step isn't necessary. Samba resolves the name from a local dns lookup and therefore may require setting `libdefaults` in the `/etc/krb5.conf` file:
32
+
== Start the Samba and Kerberos servers, and as root join the domain:
57
33
58
-
```
59
-
[libdefaults]
60
-
default_realm = realm.company.com
61
-
dns_lookup_realm = false
62
-
dns_lookup_kdc = true
63
-
```
34
+
$ net join -U Administrator
35
+
Enter the administrator password at the prompt.
64
36
65
-
After all file updates are complete, start the Samba and Kerberos servers.
37
+
Next, verify that a user in the domain can be authenticated:
66
38
67
-
== Join the domain as root:
39
+
$ wbinfo -a user%password
40
+
You should see a number of lines of text, followed by authentication succeeded. The next step is to try the same login with the ntlm_auth program, which is what FreeRADIUS will be using:
68
41
69
-
From a terminal window on the FreeRADIUS server, enter the command:
If all goes well, you should see authentication succeeding (NT_STATUS_OK). You may also see the NT_KEY output, which is needed in order for FreeRADIUS to perform MS-CHAP authentication.
72
45
73
-
Enter the administrator password at the prompt.
46
+
== Configuring FreeRADIUS to use ntlm_auth
47
+
Once you have verified that Samba is installed and working correctly, and that the ntlm_auth program works, you can proceed with configuring FreeRADIUS to use ntlm_auth. For initial testing, we will be using the exec module, and will run the exact command line used above.
74
48
75
-
== Verify user authentication
49
+
Create or edit the ntlm_auth module configuration. In version 2, this file should be saved as raddb/modules/ntlm_auth. In version 3, it should be saved as raddb/mods-enabled/ntlm_auth. The contents of the file are below, with the fields to edit in bold.
76
50
77
-
Authentication must be achieved using the `wbinfo` tool before FreeRADIUS will
78
-
be able to successfully authenticate users performing a MS-CHAPv2 based method.
51
+
exec ntlm_auth {
52
+
wait = yes
53
+
program = "/path/to/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
54
+
}
55
+
This configuration tells the server to run the ntlm_auth program with the user name and password obtained from the Access-Request. You will also have to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file:
79
56
80
-
.Example winbind
81
-
```
82
-
$ wbinfo -a user%password
83
-
```
57
+
authenticate {
58
+
...
59
+
ntlm_auth
60
+
...
61
+
}
62
+
and add the following text for testing purposes only to the top of the users file. In version 3, the "users" file has moved to raddb/mods-config/files/authorize.
84
63
85
-
If authentication using winbind works, you'll see a number of lines of text, followed by an authentication succeeded message.
64
+
DEFAULT Auth-Type = ntlm_auth
65
+
This configuration says "for all users, if the authenticate method has not been set, set it to use the ntlm_auth program".
86
66
87
-
The next step is to try the same login with the ntlm_auth program, which is what FreeRADIUS will be using:
67
+
Start the server using radiusd -X, and wait for the debugging text to stop scrolling by. If all goes well, you should see the following text:
In another terminal window on the same machine, type the following command:
71
+
72
+
$ radtest user password localhost 0 testing123
73
+
If all goes well, you should see the server returning an Access-Accept message, and the window with radtest should print text similar to the following:
74
+
75
+
rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, length=20
76
+
This text means that authentication succeeded. A few lines above this text, the debug output will also show the exact command line used to run ntlm_auth.
77
+
78
+
== Configuring FreeRADIUS to use ntlm_auth for MS-CHAP
79
+
Once you have the previous steps working, configuring FreeRADIUS to use ntlm_auth for MS-CHAP is simple. First, delete the testing entry used above from the users file, as leaving it in will break other authentication types. Then, find the mschap module in raddb/modules/mschap file, and look for the line containing ntlm_auth = . It is commented out by default, and should be uncommented, and edited to be as follows. As before, update the fields in bold to match your local configuration.
Start the server and use radtest to send an MS-CHAP authentication request. You will need to have version 2.1.10 or later for this to work:
83
+
84
+
$ radtest -t mschap bob hello localhost 0 testing123
85
+
If everything goes well, you should see the server returning an Access-Accept message as above.
93
86
94
-
If authentication using `ntlm` works, you'll see authentication succeeding (NT_STATUS_OK). You may also see the `NT_KEY` output, which is needed in order for FreeRADIUS to perform MS-CHAP authentication.
87
+
If it does not work, double-check the password you entered on the supplicant against the password in Active Directory. If it still does not work, it might be a bug in Samba. Change your version of Samba, either by installing a fixed version, or by repeatedly down-grading it (and testing) until it works.
95
88
96
-
Your next step is to configure FreeRADIUS to use xref:datastores/ad/ntlm_mschap.adoc[ntlm with MS-CHAP] to perform all user authentications.
89
+
If it does not work, then it is possible to test authentication with just the ntlm_auth command-line. Look at the FreeRADIUS debug output, and see the arguments passed to ntlm_auth. Copy and paste them to a command-line, and then use that command line for testing. This limited test is often simpler and faster than running a complex test with a full RADIUS server. When this limited test passes, then authentication with FreeRADIUS will work, too.
0 commit comments