freeRADIUS and openldap on FreeBSD

radiusd.confの編集

# vi /usr/local/etc/raddb/radiusd.conf

        ldap {
                server = "localhost"
                basedn = "o=Makioka Hp,c=JP"
                authtype = "MS-CHAP"
                filter = "(uid=%u)"
                start_tls = no
                dictionary_mapping = ${raddbdir}/ldap.attrmap
                ldap_connections_number = 5
                password_header = "{CLEAR}"
                password_attribute = userPassword
                timeout = 4
                timelimit = 3
                net_timeout = 1
        }

authorizeとauthenticate

authorize {
        files
# この順番は重要
        ldap
# mschapは最後に
        mschap
}


authenticate {
        mschap
}

# vi radiusd.conf

DEFAULT Auth-Type := Local
              Fall-Through = 1 

radtestしてみる

# radiusd -X

別の windowで LDAP server に登録してあるuserをテストします

$ radtest nob "*******" makioka.y-min.or.jp 1 hogehoge
Sending Access-Request of id 227 to 211.10.195.185:1812
        User-Name = "nob"
        User-Password = "*****************************"
        NAS-IP-Address = makioka.y-min.or.jp
        NAS-Port-Id = "1"
rad_recv: Access-Accept packet from host 211.10.195.185:1812, id=227, length=20
となればOK。

Auth-Type

# vi /usr/local/etc/raddb/users

DEFAULT        Auth-Type := MS-CHAP
               Fall-Through = 1