November 2005 - Freeradius-Users - lists.freeradius.org

Problem with false errors logging in
by MHumphries＠delcomp.net 21 Nov '05

21 Nov '05

i am having problems with false errors when trying to login. for example when i try to login some clients are getting MPP Attempts and others are getting multiple login errors. however other customers are not getting these errors when connecting thourhg the same NAS box. i have tryed clearing the MYSQL Db radacct table. and that has not done it. frankle i am not an expert in freeradius and do not know where else to turn. if i recreate a new account for the customers that are having problems they can then get in but this ius not an answer just a bandaid. any help would be great thank you very much Michael J. Humphries Network Engineer Delcomp/SOFTEK 1431 N. 26th Street Escanaba, MI 49829 Phone: 906-786-3583, ext 39 Fax: 906-786-4300

1 0

Cisco Pix
by Nicholas Thompson 21 Nov '05

21 Nov '05

I am new to Freeradius and have tried to search the boards for the answer to my question. If it has been asked and answered before I am sorry just point me in the right direction. Presently we use tacacs+ to authenicate users to all of our cisco devices. I have installed freeradius and have it working as the xauth authenication for VPN users. What I would like to do is move everything over to freeradius and have a single authenication system. But what I have not been able to find is how to limit what people can log into. For instance I have users that need to hit the Pix nas for the VPN xauth but I do not what then to be able to telnet to the Pix. Is there a way to authenicate/authorize a user for one part of the nas and not another, also is there a way to use ldap for user authenication from one nas box but use the some other password db from another box? I realize the goal is to have as many people as possible authenicate to one password system but presently this is not yet an option for my company --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0

Postgres and unix sockets
by Miguel 21 Nov '05

21 Nov '05

Hi, how can i configure freeradius to use unix sockets instead of tcp when using postgres for backend? thanks

1 0

RE: wireless+freeradius+AD
by King, Michael 21 Nov '05

21 Nov '05

> Oh, excellent. I just joined this list hoping to query the > members on finding more information on doing > wireless+activedirectory+freeradius, > unfortunately I could not find any good postings, or web > toots/examples. Hi Robin, Welcome to the club. > I would need to use Microsoft IAS. Is this false ? Yes, That particular example used Microsoft IAS, but it is not required. > Are people > using Active Directory successfully ? Yes. Besides myself, there are many people on this list that are. > I have a linux box that > is currently acting as a tacacs server while authenticating > using winbind etc, and was hoping to make it a radius server as well. You are already 3/4 of the way there, since the trickest part of my freeradius setup was getting winbind to talk to activedirectory Depending on your Linux distribution, you will just have to install freeradius. (Some distributions like Debian require a -disable-shared) Go thru the radiusd.conf and the eap.conf files, it's clearly commented on what you need to configure. You'll see a section marked: ntlm_auth = "/path/to/ntlm_auth ........(Trimmed) You might need to modify this to: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Don't hesitate to ask questions. There is a good Howto (unfortuantly, I don't have my bookmarks with me) but some others on the list hopefully will post it.

2 1

Re: 802.1x machine authentication patch help
by Jamie Crawford 21 Nov '05

21 Nov '05

I found my problem. From Andrew Bartlett himself "This is not supported against NT4. Only Samba 3.0.21rc1 and AD support this extra flag." To do machine authentication with freeradius, your workstation (supplicant) and samba server must be a member of a 2000/2003 domain. I had the supplicant and samba server still a member of the nt4 domain. Once I changed this, it worked great. Were still in the middle of a migration from nt4 to 2003 and all accounts still authenticate fine. Thanks for everyones help!!!!!! jamie >>> mgriego(a)utdallas.edu 11/18/2005 12:16:43 PM >>> Make sure you used the rlm_MSchap module from the snapshot, not the rlm_chap module. They're different. --Mike Jamie Crawford wrote: > Hi, > I am trying to get machine authentication working with freeradius. I > have patched the samba code and freeradius code. But am getting this > error when the machine tries to authenticate. I patched the rlm_chap > module by taking last nights cvs snapshot and copying over the rlm_chap > folder overwriting the contents of the same folder in the > freeradius-1.0.5 release and recompiling. I see that it is trying to > pass the username as "host/IS--000031176". I thought the updated > rlm_mschap was suppposed to strip the "host/" part of the username. Do > I need to create a realm to strip the "host/"? > Any help would be appreciated!!! > Thanks, > jamie > > > make clean > > ./configure --configure --with-raddbdir=/etc/radius > --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql > --without-rlm_ldap --without-rlm_krb5 > > make > > make install > > modcall: entering group Auth-Type for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with > NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'User-Name' > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: d3 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=12345ce0768615e > --nt-response=123456f1011a2f799b5d62e04ba > d8bb39719fa48c3d11299e' > Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=123453ce0768615e > --nt-response=12345f1011a2f799b5d62e04bad8bb39719fa48c3d11299e > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius - LDAP - Active Directory
by Konne 21 Nov '05

21 Nov '05

hi at all my system: Debian Sarge 3.1 Kernel 2.6.8 i installed the following software with apt-get apache-ssl 1.3.34-1 php4 php4-mysql mysql 4.1.14 openssl 0.9.8a-3 openldap stable 2.3.11 2005-10-18 [compiled] freeradius 1.0.5-2 freeradius-ldap 1.0.5-2 freeradius-mysql 1.0.5-2 freeradius-krb5 1.0.5-2 ---------------------------- i have a lot of problems with freeradius... i would like to authenticate my users from AP via AD. only the user which is member of a specific group should become access. *my ldap.conf* deref never referrals no i tried to authenticate but i become following error: rad_recv: Access-Request packet from host 192.168.184.26:22381, id=13, length=57 User-Name = "wuser" User-Password = "wuser" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "my.dom" for User-Name = "wuser" rlm_realm: No such realm "my.dom" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=my,dc=dom' radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to myserver.my.dom:389, authentication 0 rlm_ldap: bind as cn=ldapuser,cn=Users,dc=my,dc=dom/ldapuser to myserver.my.dom:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: ldap_search() failed: Operations error rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for wuser radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' radius_xlat: 'dc=my,dc=dom' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to myserver.my.dom:389, authentication 0 rlm_ldap: bind as cn=ldapuser,cn=Users,dc=my,dc=dom/ldapuser to myserver.my.dom:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 13 with timestamp 4381a433 Nothing to do. Sleeping until we see a request. -------------------- *users* DEFAULT Auth-Type = System Fall-Through = 1, Reply-Message = "System Logon" DEFAULT Ldap-Group == "wireless", Auth-Type :=LDAP Fall-Through = Yes, Reply-Message = "LDAP Logon" DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes -------------------- *radiusd.conf* prefix = /usr exec_prefix = /usr sysconfdir = /etc domstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${domstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius user = freerad group = freerad max_requests = 1024 hostname_lookups = no # Core dumps are a bad thing. This should only be set to 'yes' # if you're debugging a problem with the server. # # allowed values: {no, yes} # allow_core_dumps = no log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf modules { pap { encryption_scheme = md5 } chap { authtype = CHAP } unix { cache = no cache_reload = 600 passwd = /etc/passwd # shadow = /etc/shadow # group = /etc/group radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "myserver.my.dom" identity = "cn=ldapuser,cn=Users,dc=my,dc=dom" password = ldapuser basedn = "dc=my,dc=dom" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" filter = "(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person))" start_tls = no #access_attr = "dialupAccess" access_attr = "memberOf" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{Stripped-User-Name:-%{User-Name}} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } authorize { preprocess chap mschap suffix eap files # sql ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp # sql } session { radutmp # sql } post-auth { ldap } pre-proxy { } post-proxy { eap } i would like to connect to my AD from remote w2k3 server. but i receive only following:

1 1

Free RADIUS and ldap config
by Varun Marwah 20 Nov '05

20 Nov '05

Hi, Can anyone help me in providing a documentation as to how to configure freeradius server to fetch user access details from a specific group in lpad server on windows 2003. Also let me know the config details from ldap setting on the radius server. I was able to configure Freeradius config with PEAP. Regards Varun Marwah

1 0

Re: 802.1x machine authentication patch help
by Jamie Crawford 18 Nov '05

18 Nov '05

Hi, I finally got freeradius to strip the host/ and append the $ to the host name, but it still wont validate the workstation. I get "No logon workstation trust account (0xc0000199)" At least now it's narrowed down to the ntlm_auth command. I tried to run the command manually with different workstation accounts, and got the same error. I know I've modified the code correctly by changing: init_id_info2(&ctr.auth.id2, domain, 0x800, /* param_ctrl */ 0xdead, 0xbeef, /* LUID? */ Any suggestions??? Thanks, jamie Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/radius/proxy.conf Config: including file: /etc/radius/clients.conf Config: including file: /etc/radius/snmp.conf Config: including file: /etc/radius/eap.conf Config: including file: /etc/radius/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256000 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth -d 10 --domain=central --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/radius/certs/cert-srv.pem" tls: certificate_file = "/etc/radius/certs/cert-srv.pem" tls: CA_file = "/etc/radius/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/radius/certs/dh" tls: random_file = "/etc/radius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/radius/huntgroups" preprocess: hints = "/etc/radius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/radius/users" files: acctusersfile = "/etc/radius/acct_users" files: preproxy_usersfile = "/etc/radius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 153.91.130.103:1958, id=225, length=149 NAS-IP-Address = 153.91.130.103 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "host/IS--000031176" Calling-Station-Id = "0013ce3ee800" Called-Station-Id = "00118806ad10" NAS-Identifier = "RoamAbout AP" EAP-Message = 0x0201001701686f73742f49532d2d303030303331313736 Message-Authenticator = 0xc8cf79cf435f7182a1d879819491bc89 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/IS--000031176", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "host/IS--000031176", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 59 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 225 to 153.91.130.103:1958 Filter-Id = "enterasys:version=1:policy=faculty_staff" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd7e3797fb8ffa169b236146b069f57b0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 153.91.130.103:1959, id=226, length=224 NAS-IP-Address = 153.91.130.103 NAS-Port-

1 0

Proposed patch for auth.c
by Alain cocconi 18 Nov '05

18 Nov '05

Hello, I've mad a small patch to the rad_authlog function in auth.c The purpose of this patch is to make a pair with the auth log message in it (Auth: login Ok ....). For this I use the Reply-Message attribute. What do you think, is it safe to use this one ? Or should I define a new one ? Thank you Here is the new function : /* * Make sure user/pass are clean * and then log them */ static int rad_authlog(const char *msg, REQUEST *request, int goodpass) { char clean_password[1024]; char clean_username[1024]; char buf[1024]; char msg_log[1024]; VALUE_PAIR *username = NULL; VALUE_PAIR *log_pair; if (!mainconfig.log_auth) { return 0; } /* * Get the correct username based on the configured value */ if (log_stripped_names == 0) { username = pairfind(request->packet->vps, PW_USER_NAME); } else { username = request->username; } /* * Clean up the username */ if (username == NULL) { strcpy(clean_username, "<no User-Name attribute>"); } else { librad_safeprint((char *)username->strvalue, username->length, clean_username, sizeof(clean_username)); } /* * Clean up the password */ if (mainconfig.log_auth_badpass || mainconfig.log_auth_goodpass) { if (!request->password) { strcpy(clean_password, "<no User-Password attribute>"); } else if (request->password->attribute == PW_CHAP_PASSWORD) { strcpy(clean_password, "<CHAP-Password>"); } else { librad_safeprint((char *)request->password->strvalue, request->password->length, clean_password, sizeof(clean_password)); } } if (goodpass) { sprintf(msg_log, "%s: [%s%s%s] (%s)", msg, clean_username, mainconfig.log_auth_goodpass ? "/" : "", mainconfig.log_auth_goodpass ? clean_password : "", auth_name(buf, sizeof(buf), request, 1)); } else { sprintf(msg_log, "%s: [%s%s%s] (%s)", msg, clean_username, mainconfig.log_auth_badpass ? "/" : "", mainconfig.log_auth_badpass ? clean_password : "", auth_name(buf, sizeof(buf), request, 1)); } radlog(L_AUTH, msg_log); log_pair = paircreate(PW_REPLY_MESSAGE, PW_TYPE_STRING); if (log_pair == NULL) { radlog(L_ERR|L_CONS, "no memory"); exit(1); } sprintf((char *)log_pair->strvalue, "%s", msg_log); log_pair->length = strlen((char *)log_pair->strvalue); pairadd(&request->reply->vps, log_pair); return 0; }

2 2

Re: 802.1x machine authentication patch help
by Jamie Crawford 18 Nov '05

18 Nov '05

Sorry for the typo, I meant to type rlm_mschap. Are there only certain files out of the /src/modules/rlm_mschap cvs snapshot that I need to copy over? Thanks, jamie >>> mgriego(a)utdallas.edu 11/18/2005 12:16:43 PM >>> Make sure you used the rlm_MSchap module from the snapshot, not the rlm_chap module. They're different. --Mike Jamie Crawford wrote: > Hi, > I am trying to get machine authentication working with freeradius. I > have patched the samba code and freeradius code. But am getting this > error when the machine tries to authenticate. I patched the rlm_chap > module by taking last nights cvs snapshot and copying over the rlm_chap > folder overwriting the contents of the same folder in the > freeradius-1.0.5 release and recompiling. I see that it is trying to > pass the username as "host/IS--000031176". I thought the updated > rlm_mschap was suppposed to strip the "host/" part of the username. Do > I need to create a realm to strip the "host/"? > Any help would be appreciated!!! > Thanks, > jamie > > > make clean > > ./configure --configure --with-raddbdir=/etc/radius > --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql > --without-rlm_ldap --without-rlm_krb5 > > make > > make install > > modcall: entering group Auth-Type for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with > NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'User-Name' > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: d3 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=ba9273ce0768615e > --nt-response=fd385f1011a2f799b5d62e04ba > d8bb39719fa48c3d11299e' > Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=ba9273ce0768615e > --nt-response=fd385f1011a2f799b5d62e04bad8bb39719fa48c3d11299e > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0