Re: Radius replacement

Derrick MacPherson <[email protected]> wrote:

> ntlm_auth can access the info, I've got squid doing so using:
> 
> auth_param ntlm program /usr/local/bin/ntlm_auth \
> --helper-protocol=squid-2.5-ntlmssp --require-\
> membership-of=S-1-5-21-1058564242-1277044956-825688854-1337\
>  Domain Group (2)
> 
> auth_param basic program /usr/local/bin/ntlm_auth \
> --helper-protocol=squid-2.5-basic
> 
> Is there a way for gnu-radius to interpert that data?

Yes, you can use filters[1] to do so. You will have to use
ntlm-server-1 helper protocol and install a wrapper around ntlm_auth.
In general, the (untested) configuration will look like that:

1. Filter script (/usr/local/bin/ntlm-filter):

#! /bin/sh

NTLM_OPTIONS=--require-membership-of=\
  S-1-5-21-1058564242-1277044956-825688854-1337

while read USER PASS
do
	echo "Username: $USER"
	echo "Password: $PASS"
	echo "."
done |
 ntlm_auth --helper-protocol=ntlm-server-1 $NTLM_OPTIONS |
 (status=No
 message=""
 while read RESULT REST
 do
	case $RESULT in
	Authenticated:)
		status=$REST;;
	Authentication-Error:)
		message=$REST;;	
	.)	if [ $status = Yes ]; then
		   echo 0
		elif [ -n "$message" ]; then
		   echo "1 Reply-Message = \"$message\""
		else
		   echo 1
		fi
		status=No
		message=""
		;;
	 esac
 done)

# End of ntlm-filter  	    

2. raddb/config file:

filters {
	filter ntlm {
	       exec-path "/usr/local/bin/ntlm-filter";
	       error-log "ntml-filter.log";
	       auth {
		    input-format "%C{User-Name} %C{User-Password}"
		    wait-reply yes;
	       };
	};       	    		 
};

3. raddb/users file:

DEFAULT	  Auth-Type = Accept
	  Exec-Program-Wait = "|ntlm"

Notice that this is only a framework, since I have not got any windows
machines to test it on, so you may need to tailor it to your needs.
As usual, feel free to write if you encounter any problems.

Regards,
Sergey

[1] For a detailed description of filters, please see
http://www.gnu.org/software/radius/manual/html_node/radius_102.html#SEC192