Error with AD/freeradius config

Gary Gatten Ggatten at waddell.com
Thu Jul 14 18:28:23 CEST 2011


Where do you have the ntlm_auth "command" specified?  You "can" put it in numerous/various FR conf files; I think mine is in radiusd.conf, but I forget.  And, what IS that command?  It should be essentially the same command you execute to test SAMBA with outside the FR environment.

I can help more after lunch if needed.  Well, helping "more" assumed I've helped "some" already - which is a big assumption huh!?

G


-----Original Message-----
From: freeradius-users-bounces+ggatten=waddell.com at lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com at lists.freeradius.org] On Behalf Of Edge
Sent: Thursday, July 14, 2011 11:18 AM
To: freeradius-users at lists.freeradius.org
Subject: Re: Error with AD/freeradius config

Thanks for the quick reply Gary

I changed the /usr/local/etc/raddb/sites-enabled/default file to

        #  MSCHAP authentication.
        Auth-Type MS-CHAP {
                mschap
        }

        #  ntlm authentication.

                ntlm_auth

        #

I also changed the /usr/local/etc/raddb/sites-enabled/inner-tunnel file to

        #  MSCHAP authentication.
        Auth-Type MS-CHAP {
                mschap
        }

        #
        #  NTLM authentication.
                ntlm_auth
        #  Pluggable Authentication Modules.

I can confirm that the top of my users file has the following entry..

DEFAULT     Auth-Type = ntlm_auth

The debug file is still giving the same output..


rad_recv: Access-Request packet from host 127.0.0.1 port 46984, id=103,
length=60
        User-Name = "xxxxxxxx"
        User-Password = "xxxxxxx"
        NAS-IP-Address = xxx.xxx.xxx.xxx
        NAS-Port = 0
# Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user.  Authentication
may fail because of this.
++[pap] returns noop
ERROR: No authenticate method (Auth-Type) found for the request: Rejecting
the user
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject]     expand: %{User-Name} -> xxxxxxx
 attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 17 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 17
Sending Access-Reject of id 103 to 127.0.0.1 port 46984
Waking up in 4.9 seconds.
Cleaning up request 17 ID 103 with timestamp +95119
Ready to process requests.

-----Original Message-----
From: freeradius-users-bounces+edgedemon=hotmail.com at lists.freeradius.org
[mailto:freeradius-users-bounces+edgedemon=hotmail.com at lists.freeradius.org]
On Behalf Of freeradius-users-request at lists.freeradius.org
Sent: 14 July 2011 16:19
To: freeradius-users at lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 75, Issue 49

Send Freeradius-Users mailing list submissions to
        freeradius-users at lists.freeradius.org

To subscribe or unsubscribe via the World Wide Web, visit
        http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
        freeradius-users-request at lists.freeradius.org

You can reach the person managing the list at
        freeradius-users-owner at lists.freeradius.org

When replying, please edit your Subject line so it is more specific than
"Re: Contents of Freeradius-Users digest..."


Today's Topics:

   1. Re: Error with AD/freeradius config (Phil Mayers)
   2. Re: SoH - FR 2.1.11 (Phil Mayers)
   3. RE: Error with AD/freeradius config (Gary Gatten)


----------------------------------------------------------------------

Message: 1
Date: Thu, 14 Jul 2011 16:13:28 +0100
From: Phil Mayers <p.mayers at imperial.ac.uk>
Subject: Re: Error with AD/freeradius config
To: freeradius-users at lists.freeradius.org
Message-ID: <4E1F0798.3000608 at imperial.ac.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

On 14/07/11 16:04, Edge wrote:

> My /sites-enabled/default file - I have just copied the authentication
> section as everything else in the file is at default settings

Not necessary or helpful. Full debug (which you didn't provide; you trimmed
the start) is what's needed.

>
> rad_recv: Access-Request packet from host 127.0.0.1 port 44992,
> id=218,
> length=60
>
> User-Name = "xxxxxxxx"
>
> User-Password = "xxxxxxxxx"
>
> NAS-IP-Address = xxx.xxx.xxx.xxx
>
> NAS-Port = 0

This is not an MSCHAP request. It's a PAP request, probably from radtest or
radclient.

You need to test with EAP. Either use "eapol_test" from the wpa_supplicant
source, or use "radtest -t mschap" and direct the request to the "testing"
port of the inner-tunnel virtual server.


------------------------------

Message: 2
Date: Thu, 14 Jul 2011 16:14:48 +0100
From: Phil Mayers <p.mayers at imperial.ac.uk>
Subject: Re: SoH - FR 2.1.11
To: freeradius-users at lists.freeradius.org
Message-ID: <4E1F07E8.6060004 at imperial.ac.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed

On 14/07/11 15:59, Palmer J.D.F. wrote:
> Thanks Phil&  Arran,
>
> I keep starting reply emails and another arrives before I get to send
> them.

Hehe.

>
> I've tried array hack, that fails even with 'firewall' as the condition.
> if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /firewall/), where as if
> (SoH-MS-Windows-Health-Status =~ /firewall/) is satisfied.

Really? Hmm, that's odd. I'll take a look.


------------------------------

Message: 3
Date: Thu, 14 Jul 2011 10:18:56 -0500
From: Gary Gatten <Ggatten at waddell.com>
Subject: RE: Error with AD/freeradius config
To: "'FreeRadius users mailing list'"
        <freeradius-users at lists.freeradius.org>
Message-ID:

<23289_1310656737_4E1F08E1_23289_66_1_D9B37353831173459FDAA836D3B43499C52186
02 at WADPMBXV0.waddell.com>

Content-Type: text/plain; charset="us-ascii"

I don't think you need braces and such, this is not as much an auth type as
a method

Try just a single line that reads: ntlm_auth

Also, I actually had to set my default auth-type to ntlm_auth.  You know the
part where it says "...for testing only..".  in the users file?  But, I had
to leave it in or it would never call ntlm_auth and hence to logins would
work.

G




________________________________
From: freeradius-users-bounces+ggatten=waddell.com at lists.freeradius.org
[mailto:freeradius-users-bounces+ggatten=waddell.com at lists.freeradius.org]
On Behalf Of Edge
Sent: Thursday, July 14, 2011 10:05 AM
To: freeradius-users at lists.freeradius.org
Subject: Error with AD/freeradius config


Im following the AD config guide over at deployingradius.com and think I
have an error in one of the config files, I suspect Im not using the right
syntax, or another really simple error .



Fresh install of the latest freeradius version on ubuntu - not the packaged
version, built from source

PAP is working

I have configured and tested samba and ntlm_auth - both working fine



The deployingradius guide then states



<You will also have to list ntlm_auth in the authenticate sections of each
the raddb/sites-enabled/default file, and of the
raddb/sites-enabled/inner-tunnel file:>



This is where I have hit problems.....



ERROR: No authenticate method (Auth-Type) found for the request:



The above error makes me think I have amended the config files incorrectly.
I have copied the /usr/local/etc/raddb/sites-enabled/default and
/usr/local/etc/raddb/sites-enabled/inner-tunnel files below and at the end
the radius debug information Can someone have a look at them and tell me
where I have gone wrong? I just didn't understand what format the entry had
to take, so copied the existing entries in both files. If you search for
ntlm_auth it will take you straight to the areas I have changed..

Many thanks



My /sites-enabled/default file - I have just copied the authentication
section as everything else in the file is at default settings



#  Authentication.

#

#

#  This section lists which modules are available for authentication.

#  Note that it does NOT mean 'try each module in order'.  It means

#  that a module from the 'authorize' section adds a configuration

#  attribute 'Auth-Type := FOO'.  That authentication type is then

#  used to pick the apropriate module from the list below.

#



#  In general, you SHOULD NOT set the Auth-Type attribute.  The server

#  will figure it out on its own, and will do the right thing.  The

#  most common side effect of erroneously setting the Auth-Type

#  attribute is that one authentication method will work, but the

#  others will not.

#

#  The common reasons to set the Auth-Type attribute by hand

#  is to either forcibly reject the user (Auth-Type := Reject),

#  or to or forcibly accept the user (Auth-Type := Accept).

#

#  Note that Auth-Type := Accept will NOT work with EAP.

#

#  Please do not put "unlang" configurations into the "authenticate"

#  section.  Put them in the "post-auth" section instead.  That's what

#  the post-auth section is for.

#

authenticate {

        #

        #  PAP authentication, when a back-end database listed

        #  in the 'authorize' section supplies a password.  The

        #  password can be clear-text, or encrypted.

        Auth-Type PAP {

                pap

        }



        #

        #  Most people want CHAP authentication

        #  A back-end database listed in the 'authorize' section

        #  MUST supply a CLEAR TEXT password.  Encrypted passwords

        #  won't work.

        Auth-Type CHAP {

                chap

        }



        #

        #  MSCHAP authentication.

        Auth-Type MS-CHAP {

                mschap

        }



        #  ntlm authentication.



        Auth-Type ntlm_auth {

                ntlm_auth

        }



        #  If you have a Cisco SIP server authenticating against

        #  FreeRADIUS, uncomment the following line, and the 'digest'

        #  line in the 'authorize' section.

        digest



        #

        #  Pluggable Authentication Modules.

#       pam



        #

        #  See 'man getpwent' for information on how the 'unix'

        #  module checks the users password.  Note that packets

        #  containing CHAP-Password attributes CANNOT be authenticated

        #  against /etc/passwd!  See the FAQ for details.

        #

        #  For normal "crypt" authentication, the "pap" module should

        #  be used instead of the "unix" module.  The "unix" module should

        #  be used for authentication ONLY for compatibility with legacy

        #  FreeRADIUS configurations.

        #

        unix



        # Uncomment it if you want to use ldap for authentication

        #

        # Note that this means "check plain-text password against

        # the ldap database", which means that EAP won't work,

        # as it does not supply a plain-text password.

#       Auth-Type LDAP {

#               ldap

#       }



        #

        #  Allow EAP authentication.

        eap



        #

        #  The older configurations sent a number of attributes in

        #  Access-Challenge packets, which wasn't strictly correct.

        #  If you want to filter out these attributes, uncomment

       #  the following lines.

        #

#       Auth-Type eap {

#               eap {

#                       handled = 1

#               }

#               if (handled && (Response-Packet-Type == Access-Challenge)) {

#                       attr_filter.access_challenge.post-auth

#                       handled  # override the "updated" code from
attr_filter

#               }

#       }

}





My / sites-enabled/inner-tunnel file - again, I have just copied the section
I have added to...





#  Authentication.

#

#

#  This section lists which modules are available for authentication.

#  Note that it does NOT mean 'try each module in order'.  It means

#  that a module from the 'authorize' section adds a configuration

#  attribute 'Auth-Type := FOO'.  That authentication type is then

#  used to pick the apropriate module from the list below.

#



#  In general, you SHOULD NOT set the Auth-Type attribute.  The server

#  will figure it out on its own, and will do the right thing.  The

#  most common side effect of erroneously setting the Auth-Type

#  attribute is that one authentication method will work, but the

#  others will not.

#

#  The common reasons to set the Auth-Type attribute by hand

#  is to either forcibly reject the user, or forcibly accept him.

#

authenticate {

        #

        #  PAP authentication, when a back-end database listed

        #  in the 'authorize' section supplies a password.  The

        #  password can be clear-text, or encrypted.

        Auth-Type PAP {

                pap

        }





        #

        #  Most people want CHAP authentication

        #  A back-end database listed in the 'authorize' section

        #  MUST supply a CLEAR TEXT password.  Encrypted passwords

        #  won't work.

        Auth-Type CHAP {

                chap

        }





        #  MSCHAP authentication.

        Auth-Type MS-CHAP {

                mschap

        }



        #

        #  NTLM authentication.

        Auth-Type ntlm_auth {

                ntlm_auth

        }

        #  Pluggable Authentication Modules.

#       pam



        #

        #  See 'man getpwent' for information on how the 'unix'

        #  module checks the users password.  Note that packets

        #  containing CHAP-Password attributes CANNOT be authenticated

        #  against /etc/passwd!  See the FAQ for details.

        #

        unix



        # Uncomment it if you want to use ldap for authentication

        #

        # Note that this means "check plain-text password against

        # the ldap database", which means that EAP won't work,

        # as it does not supply a plain-text password.

#       Auth-Type LDAP {

#               ldap

#       }



        #

        #  Allow EAP authentication.

        eap

}











My debug output is as follows



rad_recv: Access-Request packet from host 127.0.0.1 port 44992, id=218,
length=60

        User-Name = "xxxxxxxx"

        User-Password = "xxxxxxxxx"

        NAS-IP-Address = xxx.xxx.xxx.xxx

        NAS-Port = 0

# Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default

+- entering group authorize {...}

++[preprocess] returns ok

++[chap] returns noop

++[mschap] returns noop

++[digest] returns noop

[suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL

[suffix] No such realm "NULL"

++[suffix] returns noop

[eap] No EAP-Message, not doing EAP

++[eap] returns noop

++[files] returns noop

++[expiration] returns noop

++[logintime] returns noop

[pap] WARNING! No "known good" password found for the user.  Authentication
may fail because of this.

++[pap] returns noop

ERROR: No authenticate method (Auth-Type) found for the request: Rejecting
the user

Failed to authenticate the user.

Using Post-Auth-Type Reject

# Executing group from file /usr/local/etc/raddb/sites-enabled/default

+- entering group REJECT {...}

[attr_filter.access_reject]     expand: %{User-Name} -> xxxxxxxxxx

attr_filter: Matched entry DEFAULT at line 11

++[attr_filter.access_reject] returns updated

Delaying reject of request 16 for 1 seconds

Going to the next request

Waking up in 0.9 seconds.

Sending delayed reject for request 16

Sending Access-Reject of id 218 to 127.0.0.1 port 44992

Waking up in 4.9 seconds.

Cleaning up request 16 ID 218 with timestamp +84526

Ready to process requests.





Many thanks








<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in
0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the
intended recipient  and may contain information that is privileged and/or
confidential.
 If you are not the intended recipient, you are hereby notified that  any
review, use, dissemination, disclosure or copying of this email  and its
attachments, if any, is strictly prohibited.  If you have  received this
email in error, please immediately notify the sender by  return email and
delete this email from your system."
</font>

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freeradius.org/pipermail/freeradius-users/attachments/2011071
4/1f2253c2/attachment.html>

------------------------------

-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html


End of Freeradius-Users Digest, Vol 75, Issue 49
************************************************

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html





<font size="1">
<div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'>
</div>
"This email is intended to be reviewed by only the intended recipient
 and may contain information that is privileged and/or confidential.
 If you are not the intended recipient, you are hereby notified that
 any review, use, dissemination, disclosure or copying of this email
 and its attachments, if any, is strictly prohibited.  If you have
 received this email in error, please immediately notify the sender by
 return email and delete this email from your system."
</font>





More information about the Freeradius-Users mailing list