any steps for IPA relate to keybros
or it is only can do in windows ad ?
2018年2月8日 下午4:38 於 "Aljaž Srebrnič" <a2piratesoft(a)gmail.com> 寫道：
On 8 Feb 2018, at 05:04, barrykfl--- via FreeIPA-users <
I have some confuse in the following sample:
host.ipa.example.net.au > if I have a cluster of ldap should I only
need config install in one server only or two?
In this case, you’re setting up the service account for your RADIUS
server. If you only have one RADIUS server, then only one account is
necessary. The number of LDAP servers is irrelevant for this step.
if two then I may need change another host to host1.ipa.example.net.au
I’m not really sure what you mean, but pay attention to the host names in
the LDAP user string, you’ll need to change them to your domain.
I’m replying to your second email here: You seem to be confusing
authentication *of the RADIUS server* with authentication of your users
*to* the RADIUS server.
In order for your users to authenticate using MSCHAPv2, you’ll need to
access the ipaNTHash attribute of that user on the LDAP server. That
contains a hash of the user’s password. Since the hashing algorithm is
pretty weak, access to that attribute is restricted by default. In order to
access it, you’ll have to give the RADIUS service permission to do so (that
is what that blog post is all about).
So, your RADIUS server will have to authenticate to the LDAP server to
retrieve the user’s hash, and one way to do it is setting a password for
the RADIUS service. (Another way would be with Kerberos/GSSAPI)
So yeah, you’ll have to set up a password for your radius service.
Aljaž Srebrnič a.k.a g5pw
My public key: https://g5pw.me/key
Key fingerprint = 2109 8131 60CA 01AF 75EC 01BF E140 E1EE A54E E677