November 2005 - Freeradius-Users - lists.freeradius.org

wireless+freeradius+AD
by Laker Netman 22 Nov '05

22 Nov '05

Hi all. I have been running freeradius for quite a while now to authenticate dial-up users through our Cisco 3660. Additionally, I configured several of our internal devices for AAA. This has all worked quite well and I have been using a MySQL backend. Now I am getting ready to deploy a wireless network in our facility and need to lock it down. My idea is to have our users authenticate and authorize against our active directory. Then, to provide access to guests, just create a bogus wireless user that doesn't exist in the AD, so radius falls back to a different auth method (sql) to let the user at least get on and get an address from our dhcp. I basically have this model working through regular telnet and PPP right now, less the wireless piece. I have successfully set up authentication to AD, but I have some questions and concerns. I have done quite a bit of research on this and read the pertinent files in the /doc folder included with the FR software. So, I hope my questions make sense. First: We do not allow anonymous binding to our AD LDAP. So, for testing to date, I have used "Administrator" and the associated password in the config file. Obviously this is less than ideal :) What is the best or better alternative? Allowing anonymous bind? Creating a bind-only "user" for auth purposes? Am I correct that the NAS passes the username and password to FR in cleartext? Is there any method to send/receive the password between FR and AD encrypted? If I want to use WPA with TKIP (or preferably AES) do I *have* to have a supplicant? Most hosts will be XP, though there is a slim chance I may have to deal with others. Lastly, as I mentioned earlier, I have googles, read, googled, read, a *lot* of info. Is there a CONCISE site anywhere on the web the defines everything needed without leaving out the *one* critical piece that actually makes it work? ;-) Thanks in advance, Laker __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

5 7

help needed for debugging segfault
by Luca Corti 22 Nov '05

22 Nov '05

Hello, I've been banging my head against this for a few days. I've installed freeradius 1.1.0 from cvs and I'm doing EAP-PEAP using ntlm_auth for authentication. freeradius segfaults while sending the access-accept packet. In my first post someone instructed me to enable coredumps in freeradius and post the result. I've compiled freeradius using --enable-developer, set allow_core_dumps = yes in radiusd.conf and used ulimit to remove coredump filesize limit from my shell, but it seems freeradius still doesn't dump core. The radius server is a Debian testing box. The Wi-Fi accesspoint is a D-Link DWL-2100AP. Is there anything else I can do? Is this a freeradius issue or an OS issue? thanks -- Luca Corti PGP Key ID 1F38C091 BOFH excuse of the moment: Sand fleas eating the Internet cables -- Luca Corti PGP Key ID 1F38C091 BOFH excuse of the moment: LBNC (luser brain not connected)

5 5

multiple timespan entries ( Login-Time )
by Seferovic Edvin 22 Nov '05

22 Nov '05

Hi, I would like to allow my users to access the internet only between 0700 and 1430 and between 1530 and 2200 hours. So my Login-Time attribute looks like Wk0700-1430, Wk1530-2200. It is also stored in my LDAP directory... so.. my user wants to connect at 1600 and I get message "Auth: Outside allowed timespan (time allowed Wk0700-1430): username ..." why is freeradius ignoring the second entry? Or should multiple entries look else then that? Regards, Edvin Seferovic

1 0

[Fwd: Re: help needed for debugging segfault]
by Norbert Wegener 22 Nov '05

22 Nov '05

Hello Michael, as you have found the solution of how to make machine authentication work against AD using freeradius and samba: As long as there seems to be a problem with the actual cvs version of freeradius in that area, would it be possible for you, to supply a diff against 1.0.5, so that machine authentication will work? Thanks Norbert Wegener

1 0

authentication by ip address
by Mathias Dörr 22 Nov '05

22 Nov '05

Hello, I have version 1.0.4 installed and trying know to make authorization/ authentication by the remote ip address, instead of username and password. In the main distribution authorization/ authentication is based on username /password. Where is the starting point to get this implemented ? Many thanks Mathias

2 1

RE: wireless+freeradius+AD
by David Antognini 22 Nov '05

22 Nov '05

Yes I too would like some help with this. This what I am trying to do: 1. authenticate via chap (from chillispot) to freeradius, using unix shadow passwords or pam.. I followed the pam directions and it works fine for pap, but not chap.. 2. also, would like to get it to work via AD (kerberos etc.) A doc on this would be very helpful... Dave > On Mon, 21 Nov 2005, King, Michael wrote: > > > > Oh, excellent. I just joined this list hoping to query the > > > members on finding more information on doing > > > wireless+activedirectory+freeradius, > > > unfortunately I could not find any good postings, or web > > > toots/examples. > > > > Hi Robin, Welcome to the club. > > > > > > > I would need to use Microsoft IAS. Is this false ? > > Yes, That particular example used Microsoft IAS, but it is not > > required. > > > > > > > Are people > > > using Active Directory successfully ? > > Yes. Besides myself, there are many people on this list that are. > > > > > I have a linux box that > > > is currently acting as a tacacs server while authenticating > > > using winbind etc, and was hoping to make it a radius server as well. > > > > You are already 3/4 of the way there, since the trickest part of my > > freeradius setup was getting winbind to talk to activedirectory > > > > Depending on your Linux distribution, you will just have to install > > freeradius. (Some distributions like Debian require a -disable-shared) > > > > Go thru the radiusd.conf and the eap.conf files, it's clearly commented > > on what you need to configure. > > > > You'll see a section marked: > > ntlm_auth = "/path/to/ntlm_auth ........(Trimmed) > > > > You might need to modify this to: > > ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > > > Don't hesitate to ask questions. There is a good Howto (unfortuantly, I > > don't have my bookmarks with me) but some others on the list hopefully > > will post it. > > > > Yes winbind kerberos stuff works well, and I got it previously working to > enable TAC_PLUS to do active directory authentication. > > If anyone knows the site with a good howto I would greatly apprecieate it. > > Otherwise I am chugging along. > > I have gotten the windows program NTRadPing to authenticate non CHAP with > a local UNIX account. I am not sure what fields I must enter to get > MS-CHAP to test, or if there is even a difference between CHAP and > MS-CHAP? > > Anyways I fuddled around with a bunch of different combinations and always > get this in the logfile > > Auth: Login incorrect (rlm_chap: Clear text password not available): > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FreeRadius + Windows AD Authentication
by Varun Marwah 22 Nov '05

22 Nov '05

Hi, I still can face a problem of LDAP users with Dialup access not able to authenticate through Radius Server. Attached it the Radiusd.conf file and The Logs. ldap { server = "10.91.0.33" identity = "cn=radiususer,ou=Users,ou=QMHI,dc=india,dc=quark,dc=com" password = Quark_123 basedn = "dc=india,dc=quark,dc=com" filter = "(&(samaccountname=%{user-name}))" #filter = "(SamAccountName=%u)" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # password_header = "{clear}" # # Set: dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # #password_header = "{clear}" # # Set: # password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # # edir_account_policy_check=no # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 40 timelimit = 30 net_timeout = 10 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Logs rad_recv: Access-Request packet from host 10.91.192.115:3072, id=0, length=139 User-Name = "INDIA\\vmarwah" NAS-IP-Address = 10.91.192.115 Called-Station-Id = "0012178026ed" Calling-Station-Id = "0012f0b442e3" NAS-Identifier = "0012178026ed" NAS-Port = 21 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001201494e4449415c766d6172776168 Message-Authenticator = 0x663d5b4e1e084bb62c6db0268f187847 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "INDIA\vmarwah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for INDIA\vmarwah radius_xlat: '(&(samaccountname=INDIA))' radius_xlat: 'dc=india,dc=quark,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.91.0.33:389, authentication 0 rlm_ldap: bind as cn=radiususer,ou=Users,ou=QMHI,dc=india,dc=quark,dc=com/Quark_123 to 10.91.0.33:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=india,dc=quark,dc=com, with filter (&(samaccountname=INDIA)) rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request Please help me out to resolve this............. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, November 21, 2005 11:45 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 7, Issue 79 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Freeradius - LDAP - Active Directory (Konne) 2. RE: wireless+freeradius+AD (King, Michael) 3. Re: 802.1x machine authentication patch help (Jamie Crawford) 4. tool for testing machine authentication (Norbert Wegener) 5. Re: tool for testing machine authentication (Konne) 6. RE: tool for testing machine authentication (Cris Boisvert) 7. Re: tool for testing machine authentication (Robin Mordasiewicz) 8. Re: tool for testing machine authentication (Konne) 9. Cache with proxy (Romain GAILLEGUE) 10. RE: tool for testing machine authentication (Robin Mordasiewicz) ---------------------------------------------------------------------- Message: 1 Date: Mon, 21 Nov 2005 13:03:52 +0100 From: Konne <bridge_stone(a)gmx.net> Subject: Re: Freeradius - LDAP - Active Directory To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4381B7A8.7020303(a)gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed hi i found the problem... *before* basedn = "dc=my,dc=dom" # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 *after, now it goes* basedn = "ou=wireless,dc=my,dc=dom" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf timeout = 40 timelimit = 30 net_timeout = 10 thx ------------------------------ Message: 2 Date: Mon, 21 Nov 2005 09:50:15 -0500 From: "King, Michael" <MKing(a)bridgew.edu> Subject: RE: wireless+freeradius+AD To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <EFB7B6506E9AB147BCC8EF9417E22091046723D4(a)EXCH2.campus.bridgew.edu> Content-Type: text/plain; charset="US-ASCII" > Oh, excellent. I just joined this list hoping to query the > members on finding more information on doing > wireless+activedirectory+freeradius, > unfortunately I could not find any good postings, or web > toots/examples. Hi Robin, Welcome to the club. > I would need to use Microsoft IAS. Is this false ? Yes, That particular example used Microsoft IAS, but it is not required. > Are people > using Active Directory successfully ? Yes. Besides myself, there are many people on this list that are. > I have a linux box that > is currently acting as a tacacs server while authenticating > using winbind etc, and was hoping to make it a radius server as well. You are already 3/4 of the way there, since the trickest part of my freeradius setup was getting winbind to talk to activedirectory Depending on your Linux distribution, you will just have to install freeradius. (Some distributions like Debian require a -disable-shared) Go thru the radiusd.conf and the eap.conf files, it's clearly commented on what you need to configure. You'll see a section marked: ntlm_auth = "/path/to/ntlm_auth ........(Trimmed) You might need to modify this to: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Don't hesitate to ask questions. There is a good Howto (unfortuantly, I don't have my bookmarks with me) but some others on the list hopefully will post it. ------------------------------ Message: 3 Date: Mon, 21 Nov 2005 08:54:11 -0600 From: "Jamie Crawford" <crawford(a)cmsu1.cmsu.edu> Subject: Re: 802.1x machine authentication patch help To: <freeradius-users(a)lists.freeradius.org>, <samba(a)lists.samba.org>, <mgriego(a)utdallas.edu> Message-ID: <s3818b53.061(a)NETMAIL.CMSU.EDU> Content-Type: text/plain; charset=US-ASCII I found my problem. From Andrew Bartlett himself "This is not supported against NT4. Only Samba 3.0.21rc1 and AD support this extra flag." To do machine authentication with freeradius, your workstation (supplicant) and samba server must be a member of a 2000/2003 domain. I had the supplicant and samba server still a member of the nt4 domain. Once I changed this, it worked great. Were still in the middle of a migration from nt4 to 2003 and all accounts still authenticate fine. Thanks for everyones help!!!!!! jamie >>> mgriego(a)utdallas.edu 11/18/2005 12:16:43 PM >>> Make sure you used the rlm_MSchap module from the snapshot, not the rlm_chap module. They're different. --Mike Jamie Crawford wrote: > Hi, > I am trying to get machine authentication working with freeradius. I > have patched the samba code and freeradius code. But am getting this > error when the machine tries to authenticate. I patched the rlm_chap > module by taking last nights cvs snapshot and copying over the rlm_chap > folder overwriting the contents of the same folder in the > freeradius-1.0.5 release and recompiling. I see that it is trying to > pass the username as "host/IS--000031176". I thought the updated > rlm_mschap was suppposed to strip the "host/" part of the username. Do > I need to create a realm to strip the "host/"? > Any help would be appreciated!!! > Thanks, > jamie > > > make clean > > ./configure --configure --with-raddbdir=/etc/radius > --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql > --without-rlm_ldap --without-rlm_krb5 > > make > > make install > > modcall: entering group Auth-Type for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with > NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'User-Name' > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: d3 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=12345ce0768615e > --nt-response=123456f1011a2f799b5d62e04ba > d8bb39719fa48c3d11299e' > Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=123453ce0768615e > --nt-response=12345f1011a2f799b5d62e04bad8bb39719fa48c3d11299e > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 4 Date: Mon, 21 Nov 2005 17:59:14 +0100 From: Norbert Wegener <nw(a)sbs.de> Subject: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4381FCE2.4070209(a)sbs.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Does a tool exist, that lets me test machine account authentication against an AD? Something like an equivalent to radtest? Thanks Norbert Wegener ------------------------------ Message: 5 Date: Mon, 21 Nov 2005 18:11:31 +0100 From: Konne <bridge_stone(a)gmx.net> Subject: Re: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4381FFC3.3010701(a)gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Norbert, i use the programm NTRadTest... on Windows machine and start freeradius with "freeradius -X", for debug bye Norbert Wegener schrieb: > Does a tool exist, that lets me test machine account authentication > against an AD? > Something like an equivalent to radtest? > Thanks > Norbert Wegener > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ Message: 6 Date: Mon, 21 Nov 2005 12:15:10 -0500 From: "Cris Boisvert" <cris(a)usai.net> Subject: RE: tool for testing machine authentication To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <000901c5eebf$22103960$064da8c0@systemadmin> Content-Type: text/plain; charset="us-ascii" NTRADPING It's a windows tool that does exactly what your looking for. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Norbert Wegener Sent: Monday, November 21, 2005 11:59 AM To: FreeRadius users mailing list Subject: tool for testing machine authentication Does a tool exist, that lets me test machine account authentication against an AD? Something like an equivalent to radtest? Thanks Norbert Wegener - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.13.4/176 - Release Date: 11/20/2005 ------------------------------ Message: 7 Date: Mon, 21 Nov 2005 12:13:30 -0500 (EST) From: Robin Mordasiewicz <rmordasiewicz(a)samuelmanutech.com> Subject: Re: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <Pine.LNX.4.58.0511211212510.20094(a)smtcorms02.samuelmanutech.com> Content-Type: TEXT/PLAIN; charset=US-ASCII On Mon, 21 Nov 2005, Konne wrote: > Hi Norbert, > > i use the programm NTRadTest... on Windows machine > and start freeradius with "freeradius -X", for debug > i just did a google on NTRadTest, but found nothing. Where can I download NTRadTest ------------------------------ Message: 8 Date: Mon, 21 Nov 2005 18:23:14 +0100 From: Konne <bridge_stone(a)gmx.net> Subject: Re: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <43820282.8080104(a)gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed hi sorry it was my bug it must be NTRADPING sorry Robin Mordasiewicz schrieb: >On Mon, 21 Nov 2005, Konne wrote: > > > >>Hi Norbert, >> >>i use the programm NTRadTest... on Windows machine >>and start freeradius with "freeradius -X", for debug >> >> >> >i just did a google on NTRadTest, but found nothing. Where can I download >NTRadTest >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > ------------------------------ Message: 9 Date: Mon, 21 Nov 2005 18:55:13 +0100 From: Romain GAILLEGUE <rgaillegue(a)wallix.com> Subject: Cache with proxy To: freeradius-users(a)lists.freeradius.org Message-ID: <1132595713.20382.7.camel@winxp> Content-Type: text/plain Hi, I have recently installed two freeradius servers one in server mode with MySQL authentication and an other in proxy mod. But sometime the connexion between the two servers is broken. I would like to know if it's possible to have a cache on the proxy ? Thanks Romain ------------------------------ Message: 10 Date: Mon, 21 Nov 2005 12:57:53 -0500 (EST) From: Robin Mordasiewicz <rmordasiewicz(a)samuelmanutech.com> Subject: RE: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <Pine.LNX.4.58.0511211256420.20094(a)smtcorms02.samuelmanutech.com> Content-Type: TEXT/PLAIN; charset=US-ASCII On Mon, 21 Nov 2005, Cris Boisvert wrote: > NTRADPING > > It's a windows tool that does exactly what your looking for. > ok that seems to work. I can authenticate using a local unix account. Now I need to find documentation on how to connect my freeradius to AD ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 7, Issue 79 ***********************************************

1 0

help with EAP MD5 wired authentication
by Anup Parkhi 21 Nov '05

21 Nov '05

Hi, I am struggling with EAP-MD5 wired authentication for last couple of days. I checked the web and archives but to no avail. I am using XP supplicant. Tried with Funk's supplicant also but same result. Any help will be highly appreciated. Thanks Anup My users file has following towards the end # On no match, the user is denied access. a User-Password == "a" "test" User-Password == "test" "Administrator" User-Password == "pnbidm123!" aparkhi Auth-Type := System, User-Password == "aparkhi" DEFAULT Auth-Type := Accept Reply-Message = "All users are allowed, Welcome %u." Radiusd.conf has 1. modules section ... pap { encryption_scheme = crypt } # CHAP module # # To authenticate requests containing a CHAP-Password attribute. # chap { authtype = CHAP } ... $INCLUDE ${confdir}/eap.conf mschap { ... } files { ... } ... The console output of radiusd -X -s is Ready to process requests. rad_recv: Access-Request packet from host 10.11.12.107:1024, id=76, length=214 Framed-MTU = 1480 NAS-IP-Address = 10.11.12.107 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "test" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 24 NAS-Port-Type = Ethernet NAS-Port-Id = "24" Called-Station-Id = "00-0f-20-8d-04-c8" Calling-Station-Id = "00-c0-9f-0d-4a-1f" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1010" EAP-Message = 0x020200090174657374 Message-Authenticator = 0xb12214c2d6fb14f33c7cc758ccfb54b7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 76 to 10.11.12.107:1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x0103001604100118f4899111b27fc08900284095e5e2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33fe6026586af730cd367983bb9ea8b6 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, length=249 Framed-MTU = 1480 NAS-IP-Address = 10.11.12.107 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "test" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 24 NAS-Port-Type = Ethernet NAS-Port-Id = "24" Called-Station-Id = "00-0f-20-8d-04-c8" Calling-Station-Id = "00-c0-9f-0d-4a-1f" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1010" State = 0x33fe6026586af730cd367983bb9ea8b6 EAP-Message = 0x0203001a04101c913399463bebf9f6dc2d0af18f0c7974657374 Message-Authenticator = 0x2592cd875d1068f5b16fe7999f451769 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 26 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, length=249 Sending Access-Reject of id 77 to 10.11.12.107:1024 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 76 with timestamp 43826690 Cleaning up request 1 ID 77 with timestamp 43826690 Nothing to do. Sleeping until we see a request.

1 0

RE: CHAP Problems
by Mitchell, Michael J 21 Nov '05

21 Nov '05

There used to be a DEFAULT stanza in the "users" configuration file that set Auth-Type := System which tells the RADIUS server to use /etc/passwd for authentication. This has caused a few issues like this in the past, though I thought it had been resolved for 1.0.5. If is still exists you may have more success if you comment that out. Hope that helps, Mike -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Sent: Tuesday, 22 November 2005 9:13 AM To: freeradius-users(a)lists.freeradius.org Subject: CHAP Problems rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 14 modcall: group authenticate returns invalid for request 14 auth: Failed to validate the user.

2 3

CHAP Problems
by Radius 21 Nov '05

21 Nov '05

I have tried to hire someone to help with my Radius over the last 6 month's but have not been able to get it working correctly. I seem to be getting answers from my MySql database but when a CHAP request comes in, it will not authorize and ells us Auth-Type already set. The database seems to be answering fine from local dialup, but when one comes in from over our Level3 network it errors out and won't allow them to connect. I can provide a major city access number if that will help anyone for testing also. I'm also getting the run time error that it's using my realms file, but there is nothing in that file as instructed. I went to 1.0.5 and things improved a little that we started seeing the response from the MySql database but still nothing in CHAP. I'm sure I'm missing a setting somewhere because of the Auth-Type warning. If someone can actually help get this running that is well versed with FreeRadius please give me a cost or if I need to send the config files I can also do that. Here is my debug print out. Thanks Waking up in 1 seconds... rad_recv: Access-Request packet from host 216.127.146.29:61336, id=16, length=231 User-Name = "awarren(a)surftheusa.com" CHAP-Password = 0x01d84611071bc09d90932c0cb55f287648 NAS-IP-Address = 63.215.26.177 NAS-Port = 404 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 31200 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 49333 Called-Station-Id = "9283774011" Calling-Station-Id = "928-Deleted" NAS-Identifier = "nas3.2az1.Level3.net" Acct-Session-Id = "404029672" NAS-Port-Type = Async Ascend-NAS-Port-Format = 2_4_5_5 Vendor-7005-Attr-12 = 0x4469616c7570555341 Attr-102 = 0x6c33 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 hints: Matched other at 63 modcall[authorize]: module "preprocess" returns ok for request 14 radius_xlat: 'awarren' rlm_sql (sql): sql_set_user escaped user --> 'awarren' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 14 rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP modcall[authorize]: module "chap" returns noop for request 14 rlm_realm: No '@' in User-Name = "awarren", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 205 modcall[authorize]: module "files" returns ok for request 14 modcall: group authorize returns ok for request 14 rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 14 modcall: group authenticate returns invalid for request 14 auth: Failed to validate the user. Login incorrect: [awarren/<CHAP-Password>] (from client usa1 port 404 cli 9287572602) Delaying request 14 for 1 seconds Finished request 14 Going to the next request Sending Access-Reject of id 14 to 216.127.146.30:56516 Waking up in 2 seconds... rad_recv: Access-Request packet from host 216.127.146.30:56516, id=15, length=231 User-Name = "awarren(a)surftheusa.com" CHAP-Password = 0x0103a463bb5007b7eb6f49b6d4176c5386 NAS-IP-Address = 63.215.26.177 NAS-Port = 402 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 31200 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 49333 Called-Station-Id = "9283774011" Calling-Station-Id = "928-deleted" NAS-Identifier = "nas3.2az1.Level3.net" Acct-Session-Id = "404029734" NAS-Port-Type = Async Ascend-NAS-Port-Format = 2_4_5_5 Vendor-7005-Attr-12 = 0x4469616c7570555341 Attr-102 = 0x6c33 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 hints: Matched other at 63 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: 'awarren' rlm_sql (sql): sql_set_user escaped user --> 'awarren' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 7 rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP modcall[authorize]: module "chap" returns noop for request 7 rlm_realm: No '@' in User-Name = "awarren", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 205 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns ok for request 7 rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 7 modcall: group authenticate returns invalid for request 7 auth: Failed to validate the user. Login incorrect: [awarren/<CHAP-Password>] (from client usa1 port 402 cli 9287572602) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 2 seconds...

1 0