Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We currently have an old RSA token - Radius environment we want to replace

Would this architecture be possible?

(this works, there are examples on the internet) Linux server Google Authentication Fee radius server

Now the new part: User list would get pulled from active directory, on the linux server the google authenticatior token would be (manually generated)

Or should we just create the users with the same name manually?

share|improve this question

Yes, this should be possible with totpcgi and freeradius, though we've not done it against AD but FreeIPA. We use this setup on our Cisco VPN appliances and users authenticate with their username and password+token (i.e. the same behaviour as RSA tokens).

I'd love to have more input on how well it works for others, especially if someone can provide documentation on how to drop-replace RSA infrastructure with totpcgi in a heterogeneous Linux-Windows environment. :) Our primary goal thus far has been implementing it for Linux servers.

share|improve this answer
Not to dig up an old post but why ask a new question when this is what I want to know as well. We're trying to use totpcgi on top of freeradius connected with our AD. Using the LDAP is all good except as per best practice our DC's are NOT CA's this leads to a problem in the config file. Do you know if there are extra options available to setup on config or is it just expected that your LDAP server is also a CA? – MoSiAc Jun 24 '13 at 19:58
@MoSiAc It's best if you ask this on and we'll be glad to help you out. – mricon Jun 25 '13 at 1:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.