<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Sep 27, 2013 at 6:34 AM, Alan DeKok <span dir="ltr"><<a href="mailto:aland@deployingradius.com" target="_blank">aland@deployingradius.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">Don wrote:<br>
> I tried one of these inside "gtc" sub-section of eap.conf, that don't<br>
> seem to work:<br>
> auth_type = ntlm_auth<br>
<br>
</div> Setting that *should* be one step of a working configuration.<br></blockquote><div><br></div><div>Ok, thank you for confirming that the above is one step towards working configuration.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
> or<br>
> ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key<br>
> --domain=MYDOMAIN --username=%{User-Name} --password=%{User-Password}"<br>
<br>
</div> Set where? You have been *very* vague about what you're doing. Is it<br>
a secret?<br></blockquote><div><br></div><div>Nothing secret, as I said I tried both configuration (one at a time) inside "gtc" sub-section of eap.conf.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
> Though I haven't tried replacing User-Password with Cleartext-Password.<br>
<br>
</div> Don't do that. Trying random things is *always* a bad idea.<br></blockquote><div><br></div><div>Thank you for confirming again. I won't change it in this case.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
> Do I have to place this under "gtc" sub-section inside inner-eap?<br>
<br>
</div> No. You have to configure the ntlm_auth module, and the ntlm_auth<br>
sub-section of the "authenticate" section. All of that is documented in<br>
the <a href="http://deployingradius.com" target="_blank">deployingradius.com</a> page.<br>
<div class="im"><br>
> See my comment earlier. Did I place the configuration at the right<br>
> sub-section?<br>
<br>
</div> I have no idea. You've been careful to say as little as possible, in<br>
a manner which is as confusing as possible.<br></blockquote><div><br></div><div>The two configurations mentioned earlier, I tried it both inside "gtc" sub-section of eap.conf.</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
> Yes, I saw the ntlm_auth configuration under modules/mschap and<br>
> modules/ntlm_auth. As stated in my first email, I am able to configure<br>
> freeRadius to authenticate against our Active Directory using<br>
> EAP-MSCHAPv2 (ntlm_auth) and I am looking to see if using EAP-GTC will<br>
> work as well.<br>
<br>
</div> It WILL work. Just set "auth_type = ntlm_auth" in the gtc<br>
configuration. As I said.<br></blockquote><div><br></div><div>I did that, but that didn't work. Perhaps I didn't configure the ntlm_auth module though there is modules/ntlm_auth created when I configured EAP-MSCHAPv2 with ntlm_auth.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
> As I mentioned earlier, I tried both auth_type = ntlm_auth nor ntlm_auth<br>
> = "/usr/bin/ntlm_auth ..." command execution, but that don't work.<br>
<br>
</div> So... rather than following instruction,s you're trying random things.<br>
<br>
How about running it in debugging mode, as suggested in the FAQ, "man"<br>
page, web pages, and daily on this list?<br>
<br>
The reason we recommend it is that IT WORKS. If you're trying random<br>
nonsense, you're wasting your time, and ours.<br></blockquote><div><br></div><div>So far I have tried adding two configurations inside "gtc" sub-section of eap.conf. Nothing else was touched. I did run in debug mode (with -XX) and I will capture the error later.</div>
<div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
> The reason I am asking the question of multiple challenges because I am<br>
> currently evaluating another vendor solution for multi-factor<br>
> authentication thru EAP-PEAP/TLS with EAP-GTC and the solution prompts 2<br>
> additional inputs during authentication. Here is the<br>
> link: <a href="https://www.duosecurity.com/docs/netmotion" target="_blank">https://www.duosecurity.com/docs/netmotion</a>. I thought if they can<br>
> do it, freeRadius can do it as well.<br>
<br>
</div> The issue is the EAP-GTC specification, and the clients. Last I<br>
recall, it didn't support multiple challenge-responses.<br>
<br>
If it does, then it's possible to upgrade FreeRADIUS to do it. As<br>
always,<br></blockquote><div> </div><div>My understanding about RADIUS is that client sends AccessRequest and wait for either: AccessReject, AccessAccept, or AccessChallenge. If it gets AccessChallenge and later gets another AccessChallenge again, it will response, until it gets AccessAccept or AccessReject. The client that I am using is NetMotion Mobility XE.</div>
<div><br></div><div>Thank you once again for your response. Apologize if I am wasting your time, not my intention.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5">-<br>
List info/subscribe/unsubscribe? See <a href="http://www.freeradius.org/list/users.html" target="_blank">http://www.freeradius.org/list/users.html</a><br>
</div></div></blockquote></div><br></div></div>