Freeradius Active Directory Integration

This document explains how to use Freeradius 2 with Microsoft Active Directory as an authentication server.
At the time of writing this document, the software used was:
* Microsoft Windows Server 2003 R2 SP2
* Alpine 2.0.2
* freeradius-2.1.10-r7
* freeradius-postgresql-2.1.10-r7
== Join the domain ==
Install samba, and kerberos
Edit /etc/samba/smb.conf. Replace tags "<...>" with appropriate values for your environment:
 [global]
 workgroup = <MYWORKGROUP>
 #change the netbios name as desired
 netbios name = RADIUS
 realm = <MYREALM>
 server string = 
 security = ads
 encrypt passwords = yes
 password server = <DCNAME>.<MYDOMAIN>
 log file = /var/log/samba/%m.log
 max log size = 0
 socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
 preferred master = False
 local master = No
 domain master = False
 dns proxy = No
 # use uids from 10000 to 20000 for domain users
 idmap uid = 10000-20000
 # use gids from 10000 to 20000 for domain groups
 idmap gid = 10000-20000
 # allow enumeration of winbind users and groups
 winbind enum users = yes
 winbind enum groups = yes
 winbind use default domain = yes
 # If you don't use SMB signing 
 # change the following setting to "no"
 client use spnego = yes
Edit /etc/krb5.conf. Replace tags "<...>" with values appropriate to your environment. Make sure you retain upper/lower case when replacing tags:
 [libdefaults]
 default_realm = <MYREALM>
 [realms]
 <MYREALM> = {
 kdc = <DCNAME>.<MYDOMAIN>
 default_domain = <MYDOMAIN>
 }
 [domain_realm]
 .<mydomain> = .<MYREALM>
 <mydomain> = <MYREALM>
Change /etc/conf.d/samba in:
 daemon_list="winbindd"
Set autostart:
 # rc-update add samba default
Join domain:
 # net ads join -S <DCNAME>.<MYDOMAIN> -U Administrator
You should get a message that you have joined the domain.
Start winbind:
 # rc-service samba start
Check that AD integration works:
 # wbinfo -u
You should get the list of all your domain users.
== Configure Freeradius ==
Install freeradius-postgres
 # apk add freeradius-postgres
Edit /etc/raddb/sql.conf to match the settings of your postgresql server:
 server = "<fqdn>"
 login = "<username>"
 password = "<password>"
PostgreSQL can be configured using the scripts found in /etc/raddb/sql/postgres/*.sql.
In addition to the scripts above, you should run the following statements against the radius database (replace "<user>" with user of radius DB):
 GRANT USAGE ON SEQUENCE radpostauth_id_seq TO <user>;
 GRANT USAGE ON SEQUENCE radacct_radacctid_seq TO <user>;
Create/Edit /etc/raddb/modules/ntlm_auth. Replace "MYDOMAIN" with your domain name:
 exec ntlm_auth {
 wait = yes
 program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"
 }
You have to list ntlm_auth in the authenticate sections of each of the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file:
 authenticate {
 ...
 ntlm_auth
 ...
 }
Add the following text to the top of the users file:
 DEFAULT Auth-Type = ntlm_auth
Find the mschap module in /etc/raddb/modules/mschap file, and look for the line containing ntlm_auth = . It is commented out by default.
It should be uncommented and edited as follows (replace "MYDOMAIN" with your domain name):
 ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
Configure your clients by editing /etc/raddb/clients.conf.
Start radius in debug mode in order to check that everything works:
 # radiusd -X
If everything is ok, press Ctrl^C and set it for autostart:
 # rc-update add freeradius default
 # rc-service freeradius start
Accounting into SQL is not enabled by default. In /etc/raddb/sites-enabled/default remove the comment from "sql" under section accounting:
 accounting {
 ...
 sql
 ...
 }
Category:Networking
Category:SQL