Ubuntu 14.04 - 16.04 - 18.04 - 20.04 LTS Server - Freeradius mit AD-Anbindung

sudo su
Kennwort: (wurde bei der Installation vergeben)

apt-get install krb5-user samba samba-common-bin winbind ntp freeradius make

/etc/init.d/samba stop
/etc/init.d/winbind stop
/etc/init.d/ntp stop

server 192.168.10.100

ntpdate dc.firma.de

/etc/init.d/ntp start

ntpq -p
date

cp smb.conf smb.conf.bak

[global]
          workgroup = FIRMA (Arbeitsgruppen Name; in aller Regel Domänen-Name ohne Suffix)
          realm = FIRMA.DE (Domänen-Name)
          netbios name = DEBIAN (NETBIOS-Name des Debian Servers; max. 15 Zeichen lang!)
          security = ADS (Active Directory soll die Authentisierung stellen)
          idmap uid = 10000-20000 (Range der UIDs für das Mapping von AD-RIDs auf UIDs)
          idmap gid = 10000-20000 (Range der GIDs für das Mapping von AD-RIDs auf GIDs)
          template shell = /bin/bash (Shell die der Benutzer nach der Anmeldung bekommt)
          winbind use default domain = yes (User muss kein Prefix bei der Anmeldung angeben)

# Example configuration of GNU Name Service Switch functionality.
# If you have the `glibc-doc-reference' and `info' packages installed, try:  
# `info libc "Name Service Switch"' for information about this file.  
passwd: compat winbind
group: compat winbind
shadow: compat
hosts: files dns
networks: files
protocols: db files
services: db files
ethers: db files
rpc: db files
netgroup: nis

[libdefaults]
Default_realm = FIRMA.DE
#The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
[realms]
     FIRMA.DE = {
          kdc = dc.firma.de
          admin_server = dc.firma.de
          }
[domain_realm]
     .firma.de = FIRMA.DE
[login]
krb4_convert = true
krb4_get_tickets = false

net ads join -U Administrator

/etc/init.d/samba start
/etc/init.d/winbind start

wbinfo –t (zeigt an ob das RPC trust secret passt)
wbinfo -a Administrator%Passwort (zeigt an ob sich AD-User Administrator über winbind authentisieren kann)
wbinfo –u (zeigt die Active Directory Benutzer an)
wbinfo –g (zeigt die Active Directory Gruppen an)

reboot
update-rc.d samba defaults
update-rc.d ntp defaults
update-rc.d winbind defaults

[certificate_authority]
countryName = DE
stateOrProvinceName = Radius
localityName = Frankfurt
organizationName = Firma-Meier
emailAddress = admin@meier.de
commonName = "Mein Radiustest"   

./bootstrap

make client.pem

cp server.key server.pem ca.key /etc/freeradius/certs

client localhost {
...
  secret = SUPERGEHEIMNIS (aus den Zertifikaten)
...

client 192.168.10.0/24 {
  secret = SUPERGEHEIMNIS
  shortname = WLAN
}
...

## EAP-TLS
...
tls {
...
private_key_password = SUPERGEHEIMNIS
...
random_file = /dev/urandom
...

mschap {
...
require_encryption = yes
...
require_strong = yes
...
with_ntdomain_hack = yes
...
ntlm_auth = "usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"  
...
}

...
program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}"  
}

program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --require-membership-of=MYDOMAIN\\WLAN --username=%{mschap:User-Name} --password=%{User-Password}"  

program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --require-membership-of=MYDOMAIN\WLAN --username=%{mschap:User-Name} --password=%{User-Password}"  

...
authenticate {
  ...
  ntlm_auth
  ...

...
authenticate {
  ...
  ntlm_auth
  ..

DEFAULT Auth-Type = ntlm_auth
...

freeradius -XXX

Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on command file /var/run/radiusd/radiusd.sock
Listening on proxy address * port 1814
Ready to process requests.

service freeradius stop
usermod -a -G winbindd_priv freerad
chown root:winbindd_priv /var/lib/samba/winbindd_privileged/
service freeradius start

sudo systemctl enable freeradius.service