poptop_ads_howto_9.htm 3.5 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162
  1. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
  2. "http://www.w3.org/TR/html4/loose.dtd">
  3. <html>
  4. <head>
  5. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
  6. <title>Poptop MSCHAP2 ADS Howto</title>
  7. </head>
  8. <body>
  9. <p><strong>15. Freeradius</strong></p>
  10. <p>Firstly, for Fedora 8, add user radiusd to group wbpriv.</p>
  11. <blockquote>
  12. <pre>[root@pptp ~]# usermod -G wbpriv radiusd</pre>
  13. </blockquote>
  14. <p>For Fedora 4 / 5 / 6, change the permission of the winbind_privileged directory. </p>
  15. <blockquote>
  16. <pre>[root@pptp ~]# chgrp radiusd /var/cache/samba/winbindd_privileged/</pre>
  17. </blockquote>
  18. <p>Secondly, we will need to modify the freeradius configuration file. Fortunately, we have only to change a few lines. </p>
  19. <hr>
  20. <a name="mschap2"></a><strong>15.1 Configure Freeradius for MSCHAPv2
  21. </strong>
  22. <p>Edit /etc/raddb/radiusd.conf to enable MSCAHP2. Open the file and locate the module section and then the mschap subsection.</p>
  23. <blockquote>
  24. <pre>modules {<br>
  25. ....[snip]....<br>
  26. mschap {
  27. use_mppe = yes
  28. require_encryption = yes
  29. require_strong = yes
  30. ntlm_auth = &quot;/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}&quot;<br> }<br>
  31. ....[snip]....<br>
  32. }
  33. </pre>
  34. </blockquote>
  35. <p>The mschap option in the authorize and authenticate sections is enabled by default. If they are not, enable them accordingly. Save the file. </p>
  36. <p>The radius server has a secret key for security. The default key for freeradius is testing123. It is a good idea to change it for obvious security reasons. The key is in /etc/raddb/clients.conf. </p>
  37. <blockquote>
  38. <pre>client 127.0.0.1 {<br> #<br> # The shared secret use to &quot;encrypt&quot; and &quot;sign&quot; packets between<br> # the NAS and FreeRADIUS. You MUST change this secret from the<br> # default, otherwise it's not a secret any more!<br> #<br> # The secret can be any string, up to 32 characters in length.<br> #<br> secret = testing123
  39. ....[snip]....
  40. </pre>
  41. </blockquote>
  42. <p><strong>Note</strong>: if you change the secret key, you must modify the /etc/radiusclient-ng/servers so that they match each other.
  43. </p>
  44. <p>Refer to <a href="poptop_ads_howto_a6.htm">Appendix 6</a> for information on Fedora 4 / 5 / 6.</p>
  45. <hr>
  46. <p><strong><a name="access"></a>15.2 PPTP Access Control </strong></p>
  47. <p>The above configuration allows everyone with a valid userID in the AD to connect to the pptpd server. If you want to restrict access to a group of users, you can create a group, say VPN_Allowed, in the AD. Add users to the group and modify the ntml_auth line in /etc/raddb/radius.conf to include the parameter &quot;--require-membership-of=EXAMPLE+VPN_Allowed&quot;. </p>
  48. <p>In the example, I split the line into multiple lines for clarity. It should be one continuous line in the configuration file. </p>
  49. <blockquote>
  50. <pre>ntlm_auth = &quot;/usr/bin/ntlm_auth --request-nt-key
  51. --username=%{Stripped-User-Name:-%{User-Name:-None}}
  52. --challenge=%{mschap:Challenge:-00}
  53. --nt-response=%{mschap:NT-Response:-00}
  54. --require-membership-of=EXAMPLE+VPN_Allowed&quot;</pre>
  55. </blockquote><p></p>
  56. <hr>
  57. <a href="poptop_ads_howto_10.htm">Next</a> &nbsp;&nbsp;<a href="poptop_ads_howto_8.htm">Previous</a>&nbsp;&nbsp;<a href="poptop_ads_howto_1.htm#toc">Content</a><p>&nbsp; </p>
  58. </body>
  59. </html>