☰

FreeRadius：使用活动目录进行身份验证

tag-icon • tag-icon linux active-directory radius
FreeRadius：使用活动目录进行身份验证

我需要在 RHEL 6.5 服务器上设置具有活动目录身份验证的 Radius 服务器。我一直在关注本指南。

根据指南，我进行了必要的配置，如下所示：

/etc/samba/smb.conf：

[global]
        workgroup = WORKGROUP-NAME-HERE
        security = ads
        password server = PASSWORD-SERVER-HERE
        realm = REALM-HERE
        printing = cups
        printcap name = cups
        ...
        ...

/etc/krb5.conf：

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = REALM-HERE
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true

[realms]
 REALM-HERE = {
 kdc = PASSWORD-SERVER-HERE
 }

然后就成功加入域了。

/etc/raddb/modules/ntlm_auth：

exec ntlm_auth {
        wait = yes
        program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN-HERE --username=%{mschap:User-Name} --password=%{User-Password}"
}

/etc/raddb/sites-enabled/default & /etc/raddb/sites-enabled/内部模块：

...
...
authenticate {
        ntlm_auth
...
...

在完成所有这些配置之后，我确保samba和winbind正在运行。

但是，当我执行后radiusd -X，它显示以下错误：

rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory
rlm_eap_tls: Error reading certificate file /etc/raddb/certs/server.pem
rlm_eap: Failed to initialize type tls
/etc/raddb/eap.conf[17]: Instantiation failed for module "eap"
/etc/raddb/sites-enabled/default[313]: Failed to load module "eap".
/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section.

我哪里错了？

答案1

注释掉文件make_cert_command = "${certdir}/bootstrap"中的行/etc/raddb/eap.conf更正了错误。

相关内容