[General Topics] tiptel170:
1. create certs:

/etc/raddb/certs/

ca.cnf, client.cnf, inner-server.cnf and server.cnf must be adapted according to your own system specifications.

In the files *.cnf at communName must be entered a FQDN, except in the ca.cnf, server.cnf, inner-server.cnf and client.cnf must be entered in each case another name,

but this must be resolvable with the server.

Execute

./bootstrap

2. /etc/raddb/radius.conf adjust the file paths

prefix = /usr
exec_prefix = /usr
sysconfdir = /etc
localstatedir = /var
sbindir = /usr/sbin
logdir = ${localstatedir}/log/radius
raddbdir = ${sysconfdir}/raddb
radacctdir = ${logdir}/radacct

#
# name of the running server. See also the "-n" command-line option.
name = radiusd

# Location of config and logfiles.
confdir = ${raddbdir}
modconfdir = ${confdir}/mods-config
certdir = ${confdir}/certs
cadir = ${confdir}/certs
run_dir = ${localstatedir}/run/${name}

db_dir = ${localstatedir}/lib/radiusd

3. /etc/raddb/mods-available/eap comment out these lines and paste the password from /etc/raddb/certs/ca.cnf into this file.

eaþ {
....
pwd {
group = 19
server_id = servername.domain.home
fragment_size = 1020
virtual_server = "inner-tunnel"
}

tls-config tls-common {
...
private_key_password = whatyouwant
private_key_file = ${certdir}/server.key
certificate_file = ${certdir}/server.pem
ca_file = ${cadir}/ca.pem
dh_file = ${certdir}/dh
random_file = /dev/urandom
ca_path = ${cadir}
tls_min_version = "1.0"
tls_max_version = "1.3"
...
}

/etc/raddb/mods-available/ntlm_auth

exec ntlm_auth {
wait = yes
program = "/usr/bin/ntlm_auth --request-nt-key --domain=SMB01 --username=%{mschap:User-Name} --password=%{User-Password}"
}

** --domain=SMB01 -> change accordingly

4. change permissions to allow the Radius server to read the pipe file.

usermod -a -G root radiusd
chown root:root /var/lib/samba/winbindd_privileged/

5. in the /etc/raddb.bck/mods-available/mschap add these lines.

mschap {

....
require_encryption = yes
require_strong = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-SMB01} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}
winbind_domain = "%{mschap:NT-Domain}"
.....
}

** }:-SMB01} -> modify accordingly.

6. /etc/raddb/sites-available/default

authenticate {
...
ntlm_auth
...
}

7. /etc/raddb/sites-available/inner-tunnel and default

authenticate {
...
ntlm_auth
Auth-type LDAP {
ldap
}
...
}

8. /etc/raddb/sites-available/ldap

ldap {
server = '192.168.0.1' }
base_filter = "(objectclass=posixAccount)"
base_dn = 'ou=myserver,dc=home,dc=net'
identity = 'cn=manager,dc=home,dc=net
password = Secret
...
}

9. it is very important that the user has been stored in the ldap database as a unix user and also as a windows user and so has the password, otherwise the ntlm authentication will not work!

Create new:

smbldap-useradd -am [username]
smbldap-passwd -su [username]

Change:

smbldap-usermod -a [username]
smbldap-passwd -su [username]

Settings for Android clients 9, 10 and 11 (Lineage OS)

1. install the certificates:

- Transfer the certificates client.pem, client.p12, client.csr, ca.der, ca.key and ca.pem to the tablet or phone.

- Settings -> Wireless networks -> Advanced WLAN settings -> Advanced -> Select Install certificates.

-> Select the file client.p12 and enter the password from the client.cnf, in the pulldown menu - Wifi - select, then a long number and letter combination appears in the name field, this then

change this to a meaningful name.

-> Afterwards select the ca.pem and assign a name.

2. select the WLan where the tablet / cell phone should log in.

- First delete the old connection of the WLan to avoid possible errors.

- Method EAP: PEAP, Login for phase 2: MSCHAPV2, CA Certificate: ( here from step 1, select the name from the ca.pem file ), Online Certificate Status: Not validate, Domain ( from the server.cnf, commonName )

enter the server name ( FQD ), it must be resolvable in the network,

- Identity: username - the one stored in the central user database.

- Anonymous identity, remain here in this case free - do not enter anything.

- Password: is clear, from the user database.

3. save or connect antipen, then the mobile device should be able to log in to the WLan.

Important for Android 11: The ca.pem file, will be deleted after the 3 failed attempt from the system again, then you have to import the ca.pem again into the system!

Check:

radtest user password 192.168.0.1 1812 pwd from the clients.conf

radtest -t mschap user password 192.168.0.1 1812 pwd from the clients.conf

ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user --password=password