<div>Thanks for lead Ivan. I was able to make it work by changing radiusd.conf </div>
<div> </div>
<div>I add module </div>files {<br> usersfile = ${confdir}/users<br> acctusersfile = ${confdir}/acct_users<br> preproxy_usersfile = ${confdir}/preproxy_users<br><br> compat = no<br>
}
<div> </div>
<div>and on authorize { </div>
<div> ....</div>
<div> files</div>
<div>....</div>
<div> </div>
<div>Thanks also Nicolas. </div>
<div><br> </div>
<div class="gmail_quote">2008/4/30 Ivan Kalik <<a href="mailto:tnt@kalik.net">tnt@kalik.net</a>>:<br>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">I am afraid your radiusd.conf is seriously butchered. fiels module and<br>quite a few others are missing. It should be before detail but you have<br>
deleted it.<br>
<div>
<div></div>
<div class="Wj3C7c"><br>Ivan Kalik<br>Kalik Informatika ISP<br><br><br>Dana 30/4/2008, "rmp dmd" <<a href="mailto:rmp.dmd1229@gmail.com">rmp.dmd1229@gmail.com</a>> pi¹e:<br><br>>Hi,<br>><br>>I checked around and see this<br>
><br>>The *MS-CHAP-Use-NTLM-Auth := 0*, will tell that freeradius with aduser1<br>>will not be preprocessed by the ntlm_auth auxiliary program, this is, will<br>>not request the key to compare credentials against the Active Directory,<br>
>instead, will compare against the users file of the freeradius configuration<br>>directory.<br>><br>>I also read that It is important to verify that the line on radiusd.conf:<br>><br>>authorize {<br>>....<br>
>files<br>>....<br>>}<br>><br>>It was not on my radiusd.conf so I add it and restart radiusd but now it's<br>>has errors<br>><br>>Wed Apr 30 15:15:52 2008 : Info: rlm_eap_tls: Loading the certificate file<br>
>as a chain<br>>Wed Apr 30 15:15:52 2008 : Error: ERROR: Cannot find a configuration entry<br>>for module "files".<br>>Wed Apr 30 15:15:52 2008 : Error: radiusd.conf[111] Unknown module "files".<br>
>Wed Apr 30 15:15:52 2008 : Error: radiusd.conf[108] Failed to parse<br>>authorize section.<br>><br>>Is there something else that should be configured?<br>><br>>Here's the complete radiusd.conf<br>><br>
>##<br>>## radiusd.conf -- FreeRADIUS server configuration file.<br>>##<br>><br>>prefix = /usr<br>>exec_prefix = ${prefix}<br>>sysconfdir = /etc<br>>localstatedir = /var<br>>sbindir = ${exec_prefix}/sbin<br>
>logdir = ${localstatedir}/log/radius<br>>raddbdir = ${sysconfdir}/raddb<br>>radacctdir = ${logdir}/radacct<br>>confdir = ${raddbdir}<br>>run_dir = ${localstatedir}/run/radiusd<br>>log_file = ${logdir}/radius.log<br>
>libdir = /usr/lib/freeradius<br>>pidfile = ${run_dir}/radiusd.pid<br>>user = radiusd<br>>group = radiusd<br>>max_request_time = 30<br>>delete_blocked_requests = no<br>>cleanup_delay = 5<br>>max_requests = 1024<br>
>bind_address = *<br>>port = 0<br>>hostname_lookups = no<br>>allow_core_dumps = no<br>>regular_expressions = yes<br>>extended_expressions = yes<br>>log_stripped_names = no<br>>log_auth = yes<br>
>log_auth_badpass = no<br>>log_auth_goodpass = no<br>>usercollide = no<br>>lower_user = no<br>>lower_pass = no<br>>nospace_user = no<br>>nospace_pass = no<br>>checkrad = ${sbindir}/checkrad<br>><br>
><br>>security {<br>> max_attributes = 200<br>> reject_delay = 1<br>> status_server = no<br>>}<br>><br>>proxy_requests = yes<br>>$INCLUDE ${confdir}/proxy.conf<br>><br>
># Client configuration is defined in "clients.conf".<br>>$INCLUDE ${confdir}/clients.conf<br>><br>># To enable SNMP querying of the server, set the value of the<br>># 'snmp' attribute to 'yes'<br>
>snmp = no<br>>$INCLUDE ${confdir}/snmp.conf<br>><br>>thread pool {<br>> start_servers = 5<br>> max_servers = 32<br>> min_spare_servers = 3<br>> max_spare_servers = 10<br>
> max_requests_per_server = 0<br>>}<br>><br>>modules {<br>> detail {<br>> detailfile =<br>>${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d<br>> detailperm = 0600<br>
> }<br>><br>> mschap {<br>> authtype = MS-CHAP<br>> use_mppe = yes<br>> require_encryption = yes<br>> require_strong = yes<br>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key<br>>--username=%{Stripped-User-Name:-%{User-Name:-None}}<br>>--challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"<br>
> }<br>><br>> eap {<br>> default_eap_type = ttls<br>> timer_expire = 60<br>> ignore_unknown_eap_types = no<br>> cisco_accounting_username_bug = no<br>
><br>> tls {<br>> private_key_file =<br>>${raddbdir}/certs/ttls-server-echowlan.key<br>> certificate_file =<br>>${raddbdir}/certs/ttls-server-echowlan.crt<br>
> CA_file = ${raddbdir}/certs/ca.crt<br>> dh_file = ${raddbdir}/certs/dh2048.pem<br>> random_file = /dev/urandom<br>> }<br>><br>
> ttls {<br>> default_eap_type = mschapv2<br>> copy_request_to_tunnel = no<br>> use_tunneled_reply = no<br>> }<br>
> peap {<br>> default_eap_type = mschapv2<br>> }<br>> mschapv2 {<br>> }<br>> }<br>>}<br>><br>>authorize {<br>
> mschap<br>> eap<br>>}<br>><br>>authenticate {<br>> Auth-Type MS-CHAP {<br>> mschap<br>> }<br>> eap<br>>}<br>><br>>accounting {<br>> detail}<br>
><br>>post-auth {<br>>}<br>><br>><br>><br>><br>><br>><br>>Here's the<br>>On Wed, Apr 30, 2008 at 12:52 PM, rmp dmd <<a href="mailto:rmp.dmd1229@gmail.com">rmp.dmd1229@gmail.com</a>> wrote:<br>
><br>>> Thanks.<br>>><br>>> I put it on users<br>>> aduser1 MS-CHAP-Use-NTLM-Auth := 0, Auth-Type := Reject<br>>> restart radius: /etc/init.d/radiusd restart<br>>> test but user aduser1 can still log to our VPN.<br>
>><br>>> On Wed, Apr 30, 2008 at 12:47 PM, Nicolas Goutte <<br>>> <a href="mailto:nicolas.goutte@extragroup.de">nicolas.goutte@extragroup.de</a>> wrote:<br>>><br>>> ><br>>> > Am 30.04.2008 um 18:41 schrieb rmp dmd:<br>
>> ><br>>> > thanks for the reply.<br>>> ><br>>> > Just to confirm.<br>>> ><br>>> > I add that line also on ~/raddb/users?<br>>> ><br>>> > Sorry to not have mentioned. I'm new on radius.<br>
>> ><br>>> ><br>>> > As far as I understand: yes.<br>>> ><br>>> > The line looks like an user entry.<br>>> ><br>>> > Have a nice day!<br>>> ><br>>> ><br>
>> ><br>>> > Thanks again!<br>>> > Roehl<br>>> ><br>>> > 2008/4/30 Ivan Kalik <<a href="mailto:tnt@kalik.net">tnt@kalik.net</a>>:<br>>> ><br>>> > > To stop a valid AD account from being authenticated you need to avoid<br>
>> > > ntlm_auth:<br>>> > ><br>>> > > testuser MS-CHAP-Use-NTLM-Auth := 0, Auth-Type := Reject<br>>> > ><br>>> > > Ivan Kalik<br>>> > > Kalik Informatika ISP<br>
>> > ><br>>> > ><br></div></div>>> > > Dana 30/4/2008, "rmp dmd" <<a href="mailto:rmp.dmd1229@gmail.com">rmp.dmd1229@gmail.com</a>> pi�e:<br>
<div>
<div></div>
<div class="Wj3C7c">>> > ><br>>> > > >Hi,<br>>> > > ><br>>> > > >We have a wireless network that uses freeRadius integrated with AD<br>>> > > for<br>>> > > >authentication. There are some test user accounts on AD that I would<br>
>> > > like<br>>> > > >to deny access on our Wireless and VPN.<br>>> > > ><br>>> > > >I have tried "How do I deny access to a specific user, or group of<br>>> > > users" on<br>
>> > > >FAQ but it is not working. I'm guessing that this is not the<br>>> > > correct<br>>> > > >method.<br>>> > > ><br>>> > > >Please help me on how to set-up correctly.<br>
>> > > ><br>>> > > >Thanks!<br>>> > > >Roehl<br>>> > > ><br>>> > > ><br>>> > ><br>>> > > -<br>>> > > List info/subscribe/unsubscribe? See<br>
>> > > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>>> > ><br>>> ><br>>> > -<br>>> > List info/subscribe/unsubscribe? See<br>
>> > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>>> ><br>>> ><br>>> > Nicolas Goutte<br>>> ><br>>> ><br>
>> > extragroup GmbH - Karlsruhe<br>>> > Waldstr. 49<br>>> > 76133 Karlsruhe<br>>> > Germany<br>>> ><br>>> > Geschäftsführer: Stephan Mönninghoff, Hans Martin Kern, Tilman Haerdle<br>
>> > Registergericht: Amtsgericht Münster / HRB: 5624<br>>> > Steuer Nr.: 337/5903/0421 / UstID: DE 204607841<br>>> ><br>>> ><br>>> ><br>>> ><br>>> > -<br>>> > List info/subscribe/unsubscribe? See<br>
>> > <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>>> ><br>>><br>>><br>><br>><br><br>-<br>List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br>