November 2005 - Freeradius-Users - lists.freeradius.org

www.freeradius.de - Forum
by Konne 23 Nov '05

23 Nov '05

hi, i found a freeradius forum for germans... http://www.freeradius.de ciao Konne

1 0

RE: Freeradius How to integrate Active Directory [AD IntegrationWindowsXP NTLM Tutorial]
by King, Michael 23 Nov '05

23 Nov '05

Thank you. I'm a relative new Debian addict, so I was unaware of the repercussions. I learned something today, time to go home. :-) I'll throw that into my notes. Based on the list activity in the last few days, I'm hoping to reformat, and make clearer my notes. Seems there is a need for it. Someone mentioned setting up a Wiki. I'd actually prefer that, since people can fix my mistakes. :-) > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > I don't recommend this method to the Debian users, because it > confuses dpkg about the files installed on the system and > it's not possible to uninstall the files later. I think it's > a lot better to build FreeRADIUS from sources using dpkg-buildpackage. > > $ tar zxf freeradius-1.0.5.tar.gz > $ cd freeradius-1.0.5 > $ fakeroot dpkg-buildpackage -b -uc > $ sudo dpkg -i ../freeradius_1.0.5-0_i386.deb > >

1 0

multiple 'users' files possible?
by Arne Götje (高盛華) 23 Nov '05

23 Nov '05

Hi list, is it possible with freeradius to use multiple 'users' files for authentication? For example having users devided by department and different administrators are allowed to edit only their own users file? My customer requests to use text files instead of a database... I know that a database would be the more professional solution... *sigh* Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

3 6

RE: tool for testing machine authentication
by Gunther 23 Nov '05

23 Nov '05

Johan Ramm-Ericson wrote: >Hi, >having just recently succesfully setup freeradius and being somewhat >frustrated with the documentation, I >felt there may be someway I could contribute to improve it. A while back there was a thread on the mailinglist to the effect of setting up a Wiki. Has this seen any progression? If not, I'll be glad to put >in some effort to get this done. >Also, I'm willing to pitch in on writing the documentation, however my freeradius experience is so recent >that I'd probably only be able to do any good with well-defined tasks... I set up an empty wiki a few weeks ago with the intention to start a FreeRadius wiki. http://s92562228.onlinehome.us/wiki ... it is still empty ... Gunther

1 0

Clients.conf attributes, multiples users files.
by Breuer Nicolas 23 Nov '05

23 Nov '05

Hello all, I wouldlike to have only one instance of freeradiusd but with multiples "users" files. For the moment i've differents process of freeradiusd with multiples users files. I think that it's not possible for the moment but do you think it can be a possible feature for the future ? I think the easiest way is to configure the name of the auth files into the clients.conf NAS1 : file: users NAS2 : file: users2, etc.. With this type of config, we can easily manage multiple type of users/ auth with one radiusd on one port.. Nico

2 1

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by King, Michael 23 Nov '05

23 Nov '05

Hi Robin > -----Original Message----- > > I have one Debian specific error > > rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot > open shared object file: No such file or directory > radiusd.conf[9]: eap: Module instantiation failed. > > it seems that the shared object is not shipped when I did > apt-get install freeradius Ignore the freeRADIUS package. Due to license restrictions, it cannot contain the binaries for OpenSSL. We have to use the source. Download the latest release of freeRADIUS Unzip freeRADIUS Tar -zxvf freeradius-1.0.5.tar.gz Switch to the directory then ./configure --disable-shared make make install You can look at my notes if you want: http://www.mpking.com/articles.php?lng=en&pg=55 These are not a howto, just my notes to myself as I built this config 3 or 4 times in a row. Couple of notes... The krb5.conf and the samba.conf files are not perfect. They don't take advantage of the fact samba can do a DNS lookup for the activedirectory server. Like I said, they're just my notes.

2 1

Cache with proxy
by Romain GAILLEGUE 23 Nov '05

23 Nov '05

Hi, I have recently installed two freeradius servers one in server mode with MySQL authentication and an other in proxy mod. But sometime the connexion between the two servers is broken. I would like to know if it's possible to have a cache on the proxy ? Thanks Romain

2 2

problem to authenticate via peap/mschapv2
by Konne 23 Nov '05

23 Nov '05

hi i like to authenticate with my AD over peap/mschapv2... but i become following error... my clients are windowsXP SP2 with SecureW2... my test accesspoint d-link dwl900+ and freeradius 1.0.5 i dont know why they dont send the User-Password... rad_recv: Access-Request packet from host 192.168.13.10:1226, id=16, length=127 User-Name = "wuser" NAS-IP-Address = 192.168.13.10 NAS-Port = 0 Called-Station-Id = "00-80-C8-15-26-66" Calling-Station-Id = "00-0F-B5-E1-90-E6" NAS-Identifier = "numanu" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000a017775736572 Message-Authenticator = 0xf332a25b2eaf0c9e25c989631c721dc5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "wuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=wireless,dc=my,dc=dom' radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=wireless,dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=CN=wuser,OU=wireless,DC=my,DC=dom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=wuser,OU=wireless,DC=my,DC=dom)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=wireless,dc=my,dc=dom, with filter (&(cn=wireless)(|(&(objectClass=GroupOfNames)(member=CN=wuser,OU=wireless,DC=my,DC=dom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=wuser,OU=wirel ss,DC=my,DC=dom)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=wuser,OU=wireless,DC=my,DC=dom, with filter (objectclass=*) rlm_ldap: performing search in CN=wireless,OU=Groups,DC=my,DC=dom, with filter (cn=wireless) rlm_ldap::ldap_groupcmp: User found in group wireless rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 218 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for wuser radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' radius_xlat: 'ou=wireless,dc=my,dc=dom' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=wireless,dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user wuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 3 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 3 modcall: group Auth-Type returns invalid for request 3 auth: Failed to validate the user. Login incorrect: [wuser] (from client ap port 0 cli 00-0F-B5-E1-90-E6) Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 sec

1 0

Attributes in access-challenge
by MINODIER David RD-RESA-LAN 23 Nov '05

23 Nov '05

Hi all, Is it "normal" that the attributes contained in the access-accept packet are also contained in the Access-Challenge packets sent by Freeradius ? Is there a way to force Freeradius to return the attributes associated to the user in the access-accept packet only ? Many thanks. David

1 0

Re: tool for testing machine authentication
by Johan Ramm-Ericson 23 Nov '05

23 Nov '05

>Date: Tue, 22 Nov 2005 14:20:29 -0500 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: tool for testing machine authentication >To: FreeRadius users mailing list ><freeradius-users(a)lists.freeradius.org> >Message-ID: <20051122192029.228B417127(a)mail.nitros9.org> > >"Brian A. Seklecki" <lavalamp(a)spiritual-machines.org> wrote: >>It is time for someone to step up and start writing some serious >>documentation. > ><sigh> Once again, the generic "someone", meaning "not me". > >Alan DEKok. Hi, having just recently succesfully setup freeradius and being somewhat frustrated with the documentation, I felt there may be someway I could contribute to improve it. A while back there was a thread on the mailinglist to the effect of setting up a Wiki. Has this seen any progression? If not, I'll be glad to put in some effort to get this done. Also, I'm willing to pitch in on writing the documentation, however my freeradius experience is so recent that I'd probably only be able to do any good with well-defined tasks... /johan r-e

2 1