On 8 Feb 2018, at 05:04, barrykfl--- via FreeIPA-users <freeipa-users@lists.fedorahosted.org> wrote:

I have some confuse in the following sample:

https://firstyear.id.au/blog/html/2015/07/06/FreeIPA:_Giving_permissions_to_service_accounts..html

host.ipa.example.net.au   > if I have a cluster of ldap  should I only need config install in one server only or two?

In this case, you’re setting up the service account for your RADIUS server. If you only have one RADIUS server, then only one account is necessary. The number of LDAP servers is irrelevant for this step.


if two then I may need change another host to  host1.ipa.example.net.au    host2.ipa.example.net.au   etc

I’m not really sure what you mean, but pay attention to the host names in the LDAP user string, you’ll need to change them to your domain.

I’m replying to your second email here: You seem to be confusing authentication *of the RADIUS server* with authentication of your users *to* the RADIUS server.

In order for your users to authenticate using MSCHAPv2, you’ll need to access the ipaNTHash attribute of that user on the LDAP server. That contains a hash of the user’s password. Since the hashing algorithm is pretty weak, access to that attribute is restricted by default. In order to access it, you’ll have to give the RADIUS service permission to do so (that is what that blog post is all about).

So, your RADIUS server will have to authenticate to the LDAP server to retrieve the user’s hash, and one way to do it is setting a password for the RADIUS service. (Another way would be with Kerberos/GSSAPI)

So yeah, you’ll have to set up a password for your radius service.


--
Aljaž Srebrnič a.k.a g5pw
My public key:  https://g5pw.me/key
Key fingerprint = 2109 8131 60CA 01AF 75EC  01BF E140 E1EE A54E E677