Shell access required for RADIUS authentication?

Question

Hello all,
A customer of mine has a fleet of modern Mac laptops, all accessing 3 AFP file servers. Access to those file servers is governed by a Snow Leopard Open Directory Master. Pretty simple.
I’ve been tasked with introducing RADIUS authentication to the WLAN there. The WAPs are all Airport Extremes, so again the setup is pretty simple.
But in testing, I see that users can authenticate to the RADIUS WLAN only if I give those user accounts shell access in Open Directory. If a user’s account has a login shell set to None (our previous default), then any RADIUS authentication attempt produces the following log error:
Auth: [unix] [USERNAME]: invalid shell [/dev/null]
If I switch that user’s login shell to (for example) /bin/bash, then restart RADIUS, that user authenticates successfully thereafter.
Is this expected behavior? Is there an alternative to giving everyone shell access?
Thanks for any info,
Brandon White
System Administrator
www.technico.us

Answer 1

Hi Peter,
have a look at the RADIUS implementation CookBook (www.vasco.com/novell)
chris
> We use Vasco tokens for two things: Checkpoint Firewall-1 VPN
> authentication, and iChain 2.2 RADIUS authentication. The current
> RADIUS.NLM that we use is from the iChain authentication CD.
>
> The only problem I can think of to mention is the "Unknown RADIUS client"
> error that we got after NW6 SP5. That was solved by the latest NMAS
patches
> and an upgrade from eDir 8.6.2 to 8.7.3.
>
>
> "Peter van de Meerendonk" <[email protected]>
wrote in
> message news:JNiQd.595$[email protected]..
> > > Well, just let me cover my hiney a little. We did have extremely bad
> > > results with Activcard ACO000 tokens, but that is an old product from
> > about
> > > 3-4 years ago. I have no knowledge of the current Activcard tokens.
> > >
> > OK, but the licensing policy makes activcard a costly alternative.
we've
> got
> > a good deal on RSA, and are negociating a deal on Vasco. eventually we
> might
> > need 250+ tokens.
> >
> > I am very interested in configuration details of your setup. do you use
> the
> > tokens only for checkpoint authentication, or for novell
authentication as
> > well?
> >
> >
> >
>
>