<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content="text/html; charset=GB2312" http-equiv=Content-Type>
<STYLE>
BLOCKQUOTE {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px; MARGIN-LEFT: 2em
}
OL {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
UL {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
P {
MARGIN-BOTTOM: 0px; MARGIN-TOP: 0px
}
BODY {
FONT-SIZE: 10.5pt; FONT-FAMILY: 宋体; COLOR: #000080; LINE-HEIGHT: 1.5
}
</STYLE>
<META name=GENERATOR content="MSHTML 11.00.10570.1001"></HEAD>
<BODY style="MARGIN: 10px">
<DIV>This is my case:</DIV>
<DIV>PAP backend is pam_ldap or FreeRADIUS, which can integrate to Windows AD by
LDAP or winbind.</DIV>
<DIV>EAP-MSCHAPv2 backend is FreeRADIUS.</DIV>
<DIV> </DIV>
<DIV>
<DIV>XAuth-PSK(PAP):</DIV>
<DIV>iOS: IPSec</DIV>
<DIV>Android: IPSec XAuth PSK</DIV>
<DIV> </DIV>
<DIV>EAP-MSCHAPv2(MSCHAPv2):</DIV>
<DIV>Windows 7+: IKEv2+EAP-MSCHAPv2</DIV></DIV>
<DIV> </DIV>
<DIV>#-----------------------------------------</DIV>
<DIV> </DIV>
<DIV>
<DIV>conn XAuth-PSK</DIV>
<DIV> keyexchange=ikev1</DIV>
<DIV> ike=aes128-sha1-modp1024</DIV>
<DIV> esp=aes128-sha1</DIV>
<DIV> dpdaction=clear</DIV>
<DIV> rekey=no</DIV>
<DIV> left=%any</DIV>
<DIV> leftauth=psk</DIV>
<DIV> leftsubnet=0.0.0.0/0</DIV>
<DIV> #leftfirewall=yes</DIV>
<DIV> right=%any</DIV>
<DIV> rightauth=psk</DIV>
<DIV> rightauth2=xauth</DIV>
<DIV> #rightauth2=xauth-radius | xauth-generic | xauth-pam | xauth-eap</DIV>
<DIV> rightsourceip=192.168.3.0/24</DIV>
<DIV> auto=add</DIV>
<DIV> </DIV>
<DIV>conn EAP-MSCHAPv2</DIV>
<DIV> keyexchange=ikev2</DIV>
<DIV> ike=aes256-sha256-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024!</DIV>
<DIV> esp=aes256-sha256,aes128-sha1,3des-sha1!</DIV>
<DIV> dpdaction=clear</DIV>
<DIV> rekey=no</DIV>
<DIV> leftid=@vpn.mydomain.com</DIV>
<DIV> left=%any</DIV>
<DIV> leftauth=pubkey</DIV>
<DIV> leftcert=vpn-server.cert.pem</DIV>
<DIV> leftsendcert=always</DIV>
<DIV> leftsubnet=0.0.0.0/0</DIV>
<DIV> #leftfirewall=yes</DIV>
<DIV> right=%any</DIV>
<DIV> #rightauth=eap-mschapv2</DIV>
<DIV> rightauth=eap-radius</DIV>
<DIV> rightsendcert=never</DIV>
<DIV> rightsourceip=192.168.3.0/24</DIV>
<DIV> eap_identity=%any</DIV>
<DIV> auto=add</DIV></DIV>
<DIV> </DIV>
<DIV>
<DIV>############################################################</DIV>
<DIV># /usr/local/strongswan/etc/strongswan.d/charon/xauth-pam.conf</DIV>
<DIV>############################################################</DIV>
<DIV> </DIV>
<DIV>pam_service = ldap</DIV>
<DIV> </DIV>
<DIV>#----------------------------------------------------------</DIV>
<DIV> </DIV>
<DIV>yum install pam_ldap -y</DIV>
<DIV> </DIV>
<DIV>vi /etc/pam_ldap.conf</DIV>
<DIV>host ldap.example.com</DIV>
<DIV>base dc=example,dc=com</DIV>
<DIV>binddn CN=user1,CN=users,DC=example,DC=com</DIV>
<DIV>bindpw user1-password</DIV>
<DIV>scope sub</DIV>
<DIV>#pam_groupdn cn=group1,ou=groups,dc=example,dc=com</DIV>
<DIV>#pam_min_uid 0</DIV>
<DIV>#pam_max_uid 0</DIV>
<DIV># RFC 2307 (AD) mappings</DIV>
<DIV>nss_map_objectclass posixAccount user</DIV>
<DIV>nss_map_objectclass shadowAccount user</DIV>
<DIV>nss_map_attribute uid sAMAccountName</DIV>
<DIV>nss_map_attribute homeDirectory unixHomeDirectory</DIV>
<DIV>nss_map_attribute shadowLastChange pwdLastSet</DIV>
<DIV>nss_map_objectclass posixGroup group</DIV>
<DIV>nss_map_attribute uniqueMember member</DIV>
<DIV>pam_login_attribute sAMAccountName</DIV>
<DIV>pam_filter &(objectClass=user)(!(userAccountControl=514))</DIV>
<DIV>pam_password ad</DIV>
<DIV>referrals no</DIV>
<DIV># 注：binddn/bindpw/pam_filter不加引号或括号，即便有空格</DIV>
<DIV> </DIV>
<DIV>vi /etc/pam.d/ldap</DIV>
<DIV>#%PAM-1.0</DIV>
<DIV>auth sufficient pam_ldap.so</DIV>
<DIV>account sufficient pam_ldap.so</DIV>
<DIV>password sufficient pam_ldap.so</DIV>
<DIV>#auth sufficient pam_unix.so</DIV>
<DIV>#account sufficient pam_unix.so</DIV>
<DIV>#password sufficient pam_unix.so</DIV>
<DIV># 注：启用unix模块可同时认证系统账号。</DIV>
<DIV> </DIV>
<DIV>############################################################</DIV>
<DIV># /usr/local/strongswan/etc/strongswan.d/charon/eap-radius.conf</DIV>
<DIV>############################################################</DIV>
<DIV> </DIV>
<DIV>eap-radius {</DIV>
<DIV> accounting = yes</DIV>
<DIV> load = yes</DIV>
<DIV> </DIV>
<DIV> servers {</DIV>
<DIV> localhost {</DIV>
<DIV> address = 127.0.0.1</DIV>
<DIV> auth_port = 1812</DIV>
<DIV> acct_port = 1813</DIV>
<DIV> sockets = 10</DIV>
<DIV> secret = radiuspsk</DIV>
<DIV> nas_identifier = StrongSwan</DIV>
<DIV> }</DIV>
<DIV> }</DIV>
<DIV>}</DIV></DIV>
<DIV> </DIV>
<HR style="HEIGHT: 1px; WIDTH: 210px" align=left color=#b5c4df SIZE=1>
<DIV><SPAN>JWD</SPAN></DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0cm; PADDING-TOP: 3pt; PADDING-LEFT: 0cm; BORDER-LEFT: medium none; PADDING-RIGHT: 0cm">
<DIV
style="FONT-SIZE: 12px; BACKGROUND: #efefef; COLOR: #000000; PADDING-BOTTOM: 8px; PADDING-TOP: 8px; PADDING-LEFT: 8px; PADDING-RIGHT: 8px">
<DIV><B>From:</B> <A href="mailto:M.Roos@f1-outsourcing.eu">Marc
Roos</A></DIV>
<DIV><B>Date:</B> 2018-01-28 06:30</DIV>
<DIV><B>To:</B> <A href="mailto:users@lists.strongswan.org">users</A></DIV>
<DIV><B>Subject:</B> [strongSwan] Authentication against Active
Directory?</DIV></DIV></DIV>
<DIV>
<DIV> </DIV>
<DIV>Authenticating users against an Active Directory or Windows domain is </DIV>
<DIV>still not possible? Or maybe via a workaround like adding a linux samba </DIV>
<DIV>server to a domain?</DIV>
<DIV> </DIV>
<DIV>https://wiki.strongswan.org/issues/2320</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV> </DIV></DIV></BODY></HTML>