LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 10-07-2009, 05:59 PM   #1
Carlo1973
LQ Newbie
 
Registered: Mar 2007
Posts: 14

Rep: Reputation: 1
Need help and advice on a server configuration I dont even know is possible


Hi there everyone,

I was toying with the idea of making one of my old computers into a Radius server (using FreeRadius) to act as authentication for my wireless router.

That idea was simple enough. Then I started over thinking. Not good.


Now I want to not only have that system act as a Radius server, but also as a sort of domain controller, with roaming profiles for my windows and linux boxes.

I have no idea to where to even start on this. I have a Dlink 655 Wireless Extreme N Router that is connected to my broadband connection.

The server - although it has 2 nic's, will only use one. It will not be used to assign IP addresses as all the NAT work is being handled by the router.

I want the desktops to authenticate to the server apon log-in, and authenticate against FreeRadius for network access. When a Desktop log's in, it will retrieve it's roaming profile from the server.

Will this even work or am I making this way to complicated than it needs to be?

I've worked with setting up servers with NAT on the OUTSIDE of routers using the router as an Access point, but never in reverse so I'm on some shakey ground here.

I'm using Ubuntu 9.04 as the OS on the server.

Any suggestions, assistance, or feedback is welcome.

Thanks

Carlo
 
Old 10-08-2009, 08:02 AM   #2
kbp
Senior Member
 
Registered: Aug 2009
Posts: 3,758

Rep: Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643Reputation: 643
Nothing wrong with making it complicated when you're doing it for fun mate, just remember that at the end you want it easy to manage.

If I was giving this a go I'd probably start with FreeIPA as the "domain controller", you may need to customise it to support roaming profiles for Windows and Linux (depending on how you do it) as they wouldn't be compatible being separate operating systems.

Radius is a great tool for authenticating logins to network equipment but I wouldn't require it just for network access. Then again you may be able to integrate it with FreeIPA and so require anyone to authenticate before getting internet access...

Anyway.. good luck..

cheers,

kbp
 
Old 10-11-2009, 03:12 PM   #3
Carlo1973
LQ Newbie
 
Registered: Mar 2007
Posts: 14

Original Poster
Rep: Reputation: 1
Thumbs up Thank you for the advice!

Quote:
Originally Posted by kbp View Post
Nothing wrong with making it complicated when you're doing it for fun mate, just remember that at the end you want it easy to manage.

If I was giving this a go I'd probably start with FreeIPA as the "domain controller", you may need to customise it to support roaming profiles for Windows and Linux (depending on how you do it) as they wouldn't be compatible being separate operating systems.

Radius is a great tool for authenticating logins to network equipment but I wouldn't require it just for network access. Then again you may be able to integrate it with FreeIPA and so require anyone to authenticate before getting internet access...

Anyway.. good luck..

cheers,

kbp
Wow thanks for the advice! Sorry it took me awhile to get back. Been working 10 hour shifts at the help desk of our company - last thing I want to do is stare at another monitor when I get home LOL

I was originally thinking of using Samba as the DC, authenticating against LDAP. Using Samba, I should be able to set up a network drive that can store both Linux and Windows roaming profiles (Theory LOL - I've never tried it lol). The hope is that with having Samba authenticate against LDAP, and that FreeRadius also authenticates against LDAP, that I could have a one stop shop, where the server authenticates at login, giving access to the internet, network shares, and roaming profiles.

I honestly never heard of FreeIPA. I took a look at it today online and it looks like it will do the job nicely without all the messy re-working of scripts. It seems to authenticate against LDAP, and there appears to be a plugin for FreeRadius to use it for authentication as well. If it can make use of Samba, that would be the cat's meow.

Again thank you for pointing this out to me! I'm testing everything in a VMWare environment before going live. So much easier than lugging my server from my basement - up 2 flight of stairs to my office to do the work and then back down to hook up for testing lol (no monitor for my server LOL)
 
Old 10-12-2009, 01:18 PM   #4
Carlo1973
LQ Newbie
 
Registered: Mar 2007
Posts: 14

Original Poster
Rep: Reputation: 1
Unhappy

After doing some extensive research on the issue, it is do-able but extremly complicated and I"m not 100% convinced that it would be worth it trying to configure it to work the way I had envisioned it

From what I can tell, the options are this:

a) Remove the domain authentication level thus removing any ability for roaming profiles, but able to remain secure through a radius server
b) remove the radius server, and go through a complicated set of hurdles to creat a wireless bootstrap profile for the windows machines (however I only found guides for vista - not xp)

There doesn't appear to be a win/win situation here.

The way I wanted it however should work absolutly fine with a complete linux network as long as they have built in wireless drivers, just because of the way linux loads that information as it is booting up. It seems to prepare the connection prior to loging in (the wireless frame work is established, it has a network list in memory, just needs to be told what to do or what to connect to). Windows doesn't do this. It boots its video drivers, and sound drivers, and even LAN drivers durring boot, but wireless drivers don't appear to be loaded or initialised untill after login.

Here is an excerpt from something I found on the net.

Quote:
Wireless client computers running Microsoft® Windows Vista™ can use a temporary wireless profile to obtain connectivity to a secure wireless network and join the Active Directory domain. This temporary wireless profile, known as a bootstrap wireless profile, requires the connecting user to manually specify their domain user account credentials and does not validate the certificate of the Remote Authentication Dial-in User Service (RADIUS) server. After joining the domain, the wireless client uses a new wireless profile that automatically leverages the credentials of the computer and user account and validates the credentials of the RADIUS server. This article describes three methods of configuring a bootstrap wireless network profile
http://technet.microsoft.com/en-us/l.../bb727033.aspx
http://computerguidetips.blogspot.co...ss-client.html


And from here it gets complicated LOL

The articles are based on creating the bootstrap via another windows machine running Active Directory. I could not find a single article that described a method of creating one when utilising linux as the DC or as a Radius server.

Anyone else up for a challenge? LOL I was doing trying to do it for fun, but this is starting to get to be a bit much. Plus my wife is getting mad at me cause in the process I've made it so her laptop can't connect to the internet (LOL) So I think I might have to abandon this idea for another day. I had heard that apparently Windows 7 is going to work more like Linux and pre-load the wireless drivers before loging in, but thats only rumors so I have no idea if its true or not. I've never beta tested it so I wont speculate on it. Again - this may be something someone who has the time and inclination can try out.
 
  


Reply

Tags
bootstrap, controller, dc, directory, domain, freeradius, ldap, linux, nat, network, openldap, pdc, profile, radius, roaming, router, samba, security, vista, windows, wireless, xp


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
amanda configuration and setting advice conandor Solaris / OpenSolaris 4 10-20-2008 01:01 AM
AdHoc Gateway Configuration Advice tntcoder Linux - Networking 6 07-17-2007 06:44 PM
seeking advice on best mail server configuration clau_bolson Linux - Server 5 03-05-2007 11:59 AM
Firewall Configuration but I dont know where to stick it! suerevans Linux - Security 4 04-23-2004 04:45 AM
Sendmail configuration with DynDns... need advice verbal Linux - Software 4 04-16-2004 06:11 PM


All times are GMT -5. The time now is 07:54 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration