samir wrote:
You can make YubiRADIUS to validate only OTP as first factor please make changes to the freeradius configuration as per the steps below:
1. ssh to YubiRADIUS VA and follow the steps below
# cd /etc/freeradius/sites-available
2. Comment entries in "default" and "inner-tunnel" file:
# vim default
comment "ldap" from "authorize" section
# ldap
Comment pap entry as shown below from "authenticate" section:
authenticate {
Auth-Type PAP {
perl
# pap
}
# vim inner-tunnel
comment "ldap" from "authorize" section
# ldap
Comment pap entery as shown below:
authenticate {
Auth-Type PAP {
perl
# pap
}
3. Restart the freeradius using following command:
# /etc/init.d/freeradius restart
1. ssh to YubiRADIUS VA and follow the steps below
# cd /etc/freeradius/sites-available
2. Comment entries in "default" and "inner-tunnel" file:
# vim default
comment "ldap" from "authorize" section
# ldap
Comment pap entry as shown below from "authenticate" section:
authenticate {
Auth-Type PAP {
perl
# pap
}
# vim inner-tunnel
comment "ldap" from "authorize" section
# ldap
Comment pap entery as shown below:
authenticate {
Auth-Type PAP {
perl
# pap
}
3. Restart the freeradius using following command:
# /etc/init.d/freeradius restart
Hi samir,
thank you for your answer. I have a problem with your supposed changes. In my "default" and "inner-tunnel" files the "ldap" at "authenticate" is already commented. Also there is no "pap" at Auth-Type PAP:
authenticate {
#
# PAP authentication, when a back-end database listed
# in the 'authorize' section supplies a password. The
# password can be clear-text, or encrypted.
####inner-tunnel:
Auth-Type PAP {
perl
}
#
# Most people want CHAP authentication
# A back-end database listed in the 'authorize' section
# MUST supply a CLEAR TEXT password. Encrypted passwords
# won't work.
Auth-Type CHAP {
chap
}
#
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
#
# Pluggable Authentication Modules.
# pam
#
# See 'man getpwent' for information on how the 'unix'
# module checks the users password. Note that packets
# containing CHAP-Password attributes CANNOT be authenticated
# against /etc/passwd! See the FAQ for details.
#
# unix
# Uncomment it if you want to use ldap for authentication
#
# Note that this means "check plain-text password against
# the ldap database", which means that EAP won't work,
# as it does not supply a plain-text password.
#
# Allow EAP authentication.
# eap
Auth-Type EAP{
eap
}
perl
}
Is this all i have to change? Attached a screen of my "general config". Needs something to be changed?
| Attachments: |
File comment: generalConfig generalConfig.png [ 19.12 KiB | Viewed 3932 times ] |