November 2005 - Freeradius-Users - lists.freeradius.org

mysql woes
by Ayres G.J. 30 Nov '05

30 Nov '05

Hello all, I have freeradius-1.0.5 running using mysql, and have some questions I have been unable to resolve or find any answers too. If I have the below entry in my radcheck table, and the appropriate info in the proxy.conf I can log in to my 802.1x network using WPA and EAP fine, and the request is forwarded and accepted. mysql> SELECT * from radcheck; +----+----------+----------------+----+-----------+ | id | UserName | Attribute | op | Value | +----+----------+----------------+----+-----------+ | 1 | gaz1 | proxy-to-realm | := | uwsradius | +----+----------+----------------+----+-----------+ 1 row in set (0.00 sec) This does not result in any of the accounting taking place into the db tho, only the post_auth accouting is done in the radpostauth table. Is this because the connection is proxied? (sqltrace does not contain any attepts to log any accounting except the postauth stuff). I had some experimental entries in my user file that did dynamic VLAN'ing, and now I want to put them into the mysql database. They were : gaz1 NAS-IP-Address==x.x.x.x, Proxy-To-Realm := uwsradius Frame-Type := Framed, Tunnel-Medium-Type:1 := IEEE-802, Tunnel-Type:1 := VLAN, Tunnel-Private-Group-ID:1 := 667 How do I put this information into the mysql database? I have tried creating a group and adding it to radgroupcheck, and adding it as separate lines in radcheck which does not work. (as seen below) I don't get any errors or anything to work with, so I am stuck. +----+-----------+---------------------------+----+----------+ | id | GroupName | Attribute | op | Value | +----+-----------+---------------------------+----+----------+ | 1 | comms | Frame-Type | := | Framed | | 3 | comms | Tunnel-Medium-Type:1 | := | IEEE-802 | | 4 | comms | Tunnel-Type:1 | := | VLAN | | 5 | comms | Tunnel-Private-Group-ID:1 | := | 667 | +----+-----------+---------------------------+----+----------+ 4 rows in set (0.00 sec) Thanks for anyhelp, Gareth. - - - - - - - - - - - - - - - - Gareth Ayres Wireless Network Officer Library & Information Services University of Wales Swansea, Singleton Park, Wales, UK SA2 8PP e-mail: g.j.ayres(a)swansea.ac.uk

1 0

RE: Freeradius How to integrate Active Directory and return group attribute to VPN Concentrator
by Alhagie Puye 30 Nov '05

30 Nov '05

> >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Dusty Doris > >Sent: November 25, 2005 9:43 AM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active > >Directory[ADIntegrationWindowsXP NTLM Tutorial] > > > > > >> So, the question again is if the VPN Concentrator is only sending > >> username and password, do I need ntml_auth or ms-chap? FreeRADIUS > >> doesn't have any usernames and password and will query Active > >> Directory for the actual authentication. > >> > >> Thanks, > >> > > > >If the packet is merely containing plaintext username and > >password, then you can probably just use rlm_ldap against AD > >and hit it directly. Just need to setup a user with read > >access to the directory to do the initial bind with and > >search of the user for authorization. Then the user will be > >authenticated by doing a bind against AD with the > >username/password in the packet. > > > >BTW - I use freeradius w/ ldap for cisco VPN concentrators > >as well, although its openldap instead of AD. To pass back > >the class attribute, you must modify ldap.attrmap and > >specify the reply item of Class to match what you call it in > >the directory. > > > >eg: > > > >replyItem Class radiusClass > > > >Then in the directory, you have > > > >dn: cn=someuser,... > >... > >radiusClass: "OU=myvpngroup;" > > > >So, for AD, you'll need to extend the schema and add an > >attribute for this. Or if you already have something that > >you can use, just modify ldap.attrmap to know what it is. > > Ok, this is the part that's not working for me. I have gotten FreeRADIUS to authenticate and authorize both user and group. Radiusd.conf: filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(memberOf=CN=rptp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" This works fine. However I can't get it to return any replyItems. Has anyone gotten this to work with Active Directory? All the docs I see on the Net refeerence OpenLDAP. I'm sure there is a lot of folks out there running Windows 2000/2003 Active Directory. I have spent a couple of days on this not having much luck. Here are a few questions that would help me a bit. 1) Do I need groupname_attribute to get this to work? 2) What about groupmembership_filter and groupmembership_attribute? My ldap.attrmap looks like this: replyItem Class groupofnames replyItem Class group I think the above is correct. Can some shed some light on this? Here is my debug output when I authenticate.... Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:37372, id=210, length=57 User-Name = "apuye" User-Password = "XXXXXXXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: No '@' in User-Name = "apuye", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(&(sAMAccountName=apuye)(memberOf=CN=rptpcps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))' radius_xlat: 'DC=corp,DC=van,DC=dwave' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 0 rlm_ldap: bind as cn=Alhagie Puye,ou=Information Technology,ou=DataWave Users,dc=corp,dc=van,dc=dwave/XXXXXXXX to huckster.corp.van.dwave:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter (&(sAMAccountName=apuye)(memberOf=CN=rptpcps,OU=Datawave Users,DC=corp,DC=van,DC=dwave)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user apuye authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "apuye" with password "XXXXXXXX" rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 1 rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave/XXXXXXXX to huckster.corp.van.dwave:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user apuye authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 210 to 127.0.0.1:37372 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 210 with timestamp 438d009d Nothing to do. Sleeping until we see a request. The ObjectClass for group is "group". Shouldn't I just be able to use that instead of extending the schema? Any help is greatly appreciated. Thanks in advance > >-Dusty Doris > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1

Configuring RADIUS Users
by Madhuraka Godahewa 30 Nov '05

30 Nov '05

Hi All, I installed freeRADIUS 1.0.5 recently, and configured the server as described in the documentation files. Using 'radtest' I can locally send an access request to the 'radiusd' process and get the access-accept message. Then, in the 'clients.conf', I added a new client entry as follows. < client 10.128.253.10 { secret = Sat429OSAD shortname = localhost nastype = other } > Then, I installed the 'RADIUS Client Test Utility' in the machine (10.128.253.10) which is in the same network. I then sent an access-request to the freeRADIUS Server (10.128.253.110) from that machine. I observed the 'tcpdump port 1812' and saw that the request is coming. But, the 'radiusd' process does not recognize the request and it does not send any message to the client and after a while, a timeout occurs at the client. Does anybody know, where can the problem lie?. Thanking You. -------------------------------------------------------------------------------- Madhuraka Godahewa Telecommunications Engineer Research and Development Unit Electroteks Global Networks (Pvt.) Ltd. Mobile: + 94-777-647055

2 1

RE: Vendor-type length problem
by MINODIER David RD-RESA-LAN 30 Nov '05

30 Nov '05

Again, and again, Thanks so much. What could we do without you Alan ? D/ > -----Message d'origine----- > De : freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] De la > part de Alan DeKok > Envoyé : mardi 29 novembre 2005 18:17 > À : FreeRadius users mailing list > Objet : Re: Vendor-type length problem > > "MINODIER David RD-RESA-LAN" <david.minodier(a)francetelecom.com> wrote: > > Sub-question: First, i'll definitly have a look at the CVS. Can you > > just tell me if (CVS) Freeradius will be able to reply to 1 vendor > > with a vendor-type of 2 octets and the other vendors with a > > vendor-type of 1 octet ? > > Yes. The weird VSA formats are vendor-specific. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

rlm_counter
by Madhvi Gokool 30 Nov '05

30 Nov '05

Hello Freeradius version is 1.0.4 I am using plain text users file. I have implemented counters for each user - the counter should reset at the end of each month. I tested the counter a while ago for a particular user and it worked. I have just implemented counter usage for the rest of the users and got the following error : - Auth: Invalid user (rlm_counter: Maximum monthly usage time reached): [kalc/<CHAP-Password>] (from client as port 257 cli <tel number>) this user's config in the users file was as follows :- kalc Auth-Type = Local, Password = "kalc", Calling-Station-Id = "", , Max-Monthly-Session := 36000 Service-Type = Framed-User, Framed-Protocol = PPP Any idea as to what could have caused this. How can I log when counters roll over? How can I verify the counter usage - how many seconds used and left for each user?? Thanx in advance for your prompt reply. Regds Madhvi

1 0

RE: Configuring RADIUS Users
by Mitchell, Michael J 30 Nov '05

30 Nov '05

> > Does anybody know, where can the problem lie?. > Run the server in debug mode (radiusd -X) and it will tell you why. If you still can't work it out, post the output back here and someone will help you. cheers, Mike

1 0

RE: Freeradius-Users Digest, Vol 7, Issue 115
by Varun Marwah 30 Nov '05

30 Nov '05

Thanks charles schwartz Your documentation and responses really helped. The radius Server is working now properly for all users in LDAP. I need to give access to specific users in a group call RadiusUsers in Windows 2003 LDAP. How can I go about it. The Group is at location: cn=RadiusUsers,ou=Groups,dc=ABC,dc=DEF,dc=com Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, November 30, 2005 4:37 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 7, Issue 115 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: WLAN 802.1x FreeRadius with LDAP (Zoltan Ori) 2. RE: WLAN 802.1x FreeRadius with LDAP (Christian Poessinger) 3. RE: WLAN 802.1x FreeRadius with LDAP (King, Michael) 4. Re: WLAN 802.1x FreeRadius with LDAP (Zoltan Ori) 5. RE: WLAN 802.1x FreeRadius with LDAP (Christian Poessinger) 6. Re: Configuring RADIUS Users (Radius) 7. LDAP, FreeRadius, and Schema (Matt Juszczak) 8. Re: AD authentication (charles schwartz) ---------------------------------------------------------------------- Message: 1 Date: Tue, 29 Nov 2005 13:19:40 -0500 From: Zoltan Ori <z.ori(a)morehead-st.edu> Subject: Re: WLAN 802.1x FreeRadius with LDAP To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200511291319.40875.z.ori(a)morehead-st.edu> Content-Type: text/plain; charset="iso-8859-1" On Tuesday 29 November 2005 11:07, Christian Poessinger wrote: > > You didn't configure a password for the user. > > Yes, I did. I have a userPassword atribute in my LDAP backend, also > it contains a clear text password. I can fully use this account in > the backend for ftp/ssh/http but not with peap/mschapv2 over radius. > You have ntlm_auth in your mschap configuration. You don't want that for LDAP. You don't need anything NT in that module. The default configuration had everything commented out but authtype = MS-CHAP. Start with that and then add what you need. ------------------------------ Message: 2 Date: Tue, 29 Nov 2005 19:56:29 +0100 From: "Christian Poessinger" <christian(a)poessinger.com> Subject: RE: WLAN 802.1x FreeRadius with LDAP To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <000f01c5f516$9c2c4600$370110ac(a)wueI.poessinger.org> Zoltan Ori wrote: > You have ntlm_auth in your mschap configuration. You don't want that > for LDAP. > You don't need anything NT in that module. The default configuration > had everything commented out but authtype = MS-CHAP. Start with that > and then add what you need. Nope, there is everything uncommented. I also tried to add this to the ldap.attrmap file: checkItem LM-Password userPassword checkItem NT-Password userPassword But this hadn't any effect either. ------------------------------ Message: 3 Date: Tue, 29 Nov 2005 14:03:21 -0500 From: "King, Michael" <MKing(a)bridgew.edu> Subject: RE: WLAN 802.1x FreeRadius with LDAP To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <EFB7B6506E9AB147BCC8EF9417E22091075C4118(a)EXCH2.campus.bridgew.edu> Content-Type: text/plain; charset="us-ascii" -----Original Message----- Zoltan Ori wrote: > You have ntlm_auth in your mschap configuration. You don't want that > for LDAP. > You don't need anything NT in that module. The default configuration > had everything commented out but authtype = MS-CHAP. Start with that > and then add what you need. Nope, there is everything uncommented. I also tried to add this to the ldap.attrmap file: Christian, That is what he is saying your problem is, everything is uncommented........ ------------------------------ Message: 4 Date: Tue, 29 Nov 2005 14:08:47 -0500 From: Zoltan Ori <z.ori(a)morehead-st.edu> Subject: Re: WLAN 802.1x FreeRadius with LDAP To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200511291408.47792.z.ori(a)morehead-st.edu> Content-Type: text/plain; charset="iso-8859-1" On Tuesday 29 November 2005 13:56, Christian Poessinger wrote: > Nope, there is everything uncommented. I also tried to add this to the > ldap.attrmap file: > That's the problem everything is uncommented. Comment out ntlm_auth and with_ntdomain_hack. If you have plain text passwords, you aren't authenticating to a Windows domain controller, you don't have windbindd and nmbd running, you don't need want them in your mschap configuration. ------------------------------ Message: 5 Date: Tue, 29 Nov 2005 20:16:56 +0100 From: "Christian Poessinger" <christian(a)poessinger.com> Subject: RE: WLAN 802.1x FreeRadius with LDAP To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <001701c5f519$77c4f070$370110ac(a)wueI.poessinger.org> King, Michael wrote: > Christian, That is what he is saying your problem is, everything is > uncommented........ Sorry, with uncommented i ment that all is commented out. Sorry my fault. ------------------------------ Message: 6 Date: Tue, 29 Nov 2005 13:04:48 -0700 From: "Radius" <radius(a)kingmanaz.net> Subject: Re: Configuring RADIUS Users To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <00e301c5f520$26e2e610$0501a8c0@LockKey> Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response ----- Original Message ----- From: "Christopher Carver" <ccarver(a)pennswoods.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, November 29, 2005 11:04 AM Subject: Re: Configuring RADIUS Users > Madhuraka Godahewa wrote: > >>Hi All, I installed freeRADIUS 1.0.5 recently, and configured the server >>as described in the documentation files. My operating system is SUSE Linux >>9.2. When I run the 'radiusd -X' from the shell, the last four lines of >>the output are as follows. < Listening on authentication >>10.128.253.110:1812 Listening on accounting 10.128.253.110:1813 Listening >>on proxy 10.128.253.110:1814 Ready to process requests. >> 10.128.253.110 is the IP Address given to the Radius Server. Then, I >> created a test account named 'root' with the password 'root'. Then, I ran >> the radtest (from the RADIUS Server itself) and got the following output. >> < Sending Access-Request of id 195 to 10.128.253.110:1812 User-Name = >> "root" User-Password = "root" NAS-IP-Address = rajith-office NAS-Port = >> 1812 rad_recv: Access-Accept packet from host 10.128.253.110:1812, >> id=195, length=20 >>'rajith-office' is the name given to the RADIUS Server. In the debug >>shell, I obtained the following output. < rad_recv: Access-Request packet >>from host 10.128.253.110:1025, id=195, length=56 User-Name = "root" >>User-Password = "root" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 >>Processing the authorize section of radiusd.conf modcall: entering group >>authorize for request 0 modcall[authorize]: module "preprocess" returns ok >>for request 0 modcall[authorize]: module "chap" returns noop for request 0 >>modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: >>No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such >>realm "NULL" modcall[authorize]: module "suffix" returns noop for request >>0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" >>returns noop for request 0 users: Matched root at 153 users: Matched >>DEFAULT at 157 modcall[authorize]: module "files" returns ok for request 0 >>modcall: group authorize returns ok for request 0 rad_check_password: >>Found Auth-Type Local auth: type Local auth: user supplied User-Password >>matches local User-Password Sending Access-Accept of id 195 to >>10.128.253.110:1025 Finished request 0 Going to the next request --- >>Walking the entire request list --- >>Waking up in 6 seconds... --- Walking the entire request list --- >>Cleaning up request 0 ID 195 with timestamp 438c1bca Nothing to do. >>Sleeping until we see a request. >> Now my problem is, when I try to send an access-request (using the Radius >> Test Utility) from another machine (running Windows XP), which is in the >> same network, the server does not says that it receives an >> access-request. Does anybody know, where the problem is? You should be >> seeing something if the requests is even making it to the > radiusd process. Use tcpdump on the server to ensure you are receiving > the request. 'tcpdump port 1812' should do it. If you see nothing, you > have a firewall/network connectivity issue on the server or client. > > Chris Carver > - But root does not allow logins that way if his system is setup not to and most Linux variants do that automatically. You have to "su" to get root access after you log in with regular user. Maybe create a different user and try it. ------------------------------ Message: 7 Date: Tue, 29 Nov 2005 17:13:41 -0500 From: Matt Juszczak <matt(a)atopia.net> Subject: LDAP, FreeRadius, and Schema To: freeradius-users(a)lists.freeradius.org Message-ID: <438CD295.3030604(a)atopia.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi all, I was wondering what everyone uses for an account objectClass? Right now I'm using "Person", which makes the dn: cn=<user>,ou=Radius,dc=mydomain,dc=net However, indexing the cn would index the CN of other OU's as well ... . I'm just wondering what people use. I know "Account" could also be used. Regards, Matt ------------------------------ Message: 8 Date: Tue, 29 Nov 2005 23:50:05 +0100 From: charles schwartz <charles.schwartz(a)umail.univ-metz.fr> Subject: Re: AD authentication To: vmarwah(a)quark.com Cc: freeradius-users(a)lists.freeradius.org Message-ID: <200511292250.jATMo5OS024332(a)umail.univ-metz.fr> Content-Type: text/plain Hi, Here is what I found in your log: [...] Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 [...] Try to troubleshoot winbind. It seems that there may be a permission problem. Regards, Charles > Hi There > > I have configured the Freeradius on Fedora core 3 as per the > documentation > > [root@Radius raddb]# ntlm_auth --request-nt-key --domain=INDIA > --username=checkad > password: > NT_STATUS_OK: Success (0x0) > [root@Radius raddb]# > > When I start the the Radius Server using Radius -X command Starts fine. > > When I give the logon credentials through the wireless laptop the user > doesn't get validated. > > Please help me out. If you need the any config files for your reference, > please let me know.Atached is the log file of output generated. > > Also guide me, as I have already given allow permissions to users with > Dialin Permissions in AD domain. > > > Thanks & Regards > Varun Marwah > CONFIDENTIALITY NOTICE > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and > delete the original transmission, its attachments, and any copies > without reading or saving in any manner. Thank you. > > -----Original Message----- > From: charles schwartz [mailto:charles.schwartz@umail.univ-metz.fr] > Sent: Monday, November 28, 2005 10:51 PM > To: freeradius-users(a)lists.freeradius.org > Cc: Varun Marwah > Subject: Re: AD authentication > > Hi, > > If the wbinfo command does not work, ntlm_auth won't work too. > > > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > This error indicates that something went wrong with the domain access. > Try to troubleshoot by using wbinfo -g or wbinfo -u. > With these commands you should be able to list the users and groups of > your domain. > > There may be a problem with NTLM on your Windows2003 server. > Note thath NTLM was the authentication protocol used by earlier version > of Windows. > It is still supported for backward compatibility, but can be disabled. > By default, Win2k and 2003 use Kerberos for authentication. > > You might have a security policy thats restricts the use of NTLM on your > network. > Check your GPO if NTLM is allowed to be transmitted across the network. > > > Regards, > Charles Schwartz > > > > > > Hi, > > > > > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > > box to get authenticated through users in Windows 2003 AD. > > > > > > > > I used the command net join -U Administrator to add the machine to the > > domain. It gave successful results. Now on typing the command > > > > > > > > wbinfo -a checkad%Quark_123 > > > > > > > > I got the following results:- > > > > > > > > plaintext password authentication failed > > > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > > > error messsage was: No such user > > > > Could not authenticate user checkad%Quark_123 with plaintext password > > > > challenge/response password authentication failed > > > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > > > Could not authenticate user checkad with challenge/response > > > > > > > > Also, on giving the command > > > > > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > > checkad > > > > password: > > > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > (0xc00000da) > > > > [root@Radius etc]# > > > > I get the above stated error. Please help. > > > > Thanks & Regards > > > > Varun Marwah > > > > CONFIDENTIALITY NOTICE > > > > This e-mail transmission and any documents, files, or previous e-mail > > messages appended or attached to it, may contain information that is > > confidential or legally privileged. If you are not the intended > > recipient, or a person responsible for delivering it to the intended > > recipient, you are hereby notified that any disclosure, copying, > > printing, distribution, or use of the information contained or > attached > > to this transmission is STRICTLY PROHIBITED. If you have received this > > transmission in error, please immediately notify the sender by > telephone > > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > > attachments, and any copies without reading or saving in any manner. > > Thank you. > > > > > > > > -- > This message has been scanned for viruses and > dangerous content by Quark Anti Virus, and is > believed to be clean. > ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 7, Issue 115 ************************************************ -- This message has been scanned for viruses and dangerous content by Quark Anti Virus, and is believed to be clean.

1 0

RE: Can not authenticate against Active directory as LDAP server
by Alhagie Puye 30 Nov '05

30 Nov '05

Make sure the password has double-quotes around it. I had to do that to get it working. Have you tried using ldapsearch first to make sure that you are feeding it the correct parameters? Try something like ldapsearch -LLL -h 10.1.1.1 -x -b 'dc=corp,dc=van,dc=com' '(&(memberof=CN=rptpcps,OU=Users,DC=corp,DC=van,DC=com)(samaccountname=a puye))' -D apuye(a)corp.van.com -w yourpassword Change it to match your environment. Hope that helps. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Anup Parkhi > >Sent: November 29, 2005 6:44 PM > >To: freeradius-users(a)lists.freeradius.org > >Subject: Can not authenticate against Active directory as LDAP server > > > >My environment is > > > >FreeRadius: 1.0.5 on RedHat > >Funk Odyssey supplicant. (Tried with XP supplicant also) > >Authenticator: HP procurve switch > >EAP: EAP-MD5 > >Directory: Active directory as LDAP server > > > >I am getting the following error while authenticating users > >in Active directory. Any help is appreciated. I went through > >ldap_how_to.txt and changed my radiusd.conf to tailor for > >active directory but it is still failing. > > > >My configuration sections are > >lldap { > > server = "10.11.12.137" > > identity = > >"cn=Administrator,cn=users,dc=parkhi,dc=net" > > password = mypassword > > basedn = "cn=users,dc=parkhi,dc=net" > > filter = > >"(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" > > # base_filter = "(objectclass=radiusprofile)" > > > > # set this to 'yes' to use TLS encrypted connections > > # to the LDAP database by using the StartTLS extended > > # operation. > > # The StartTLS operation is supposed to be > >used with normal > > # ldap connections instead of using ldaps (port 689) > >connections start_tls = no > > > > # tls_cacertfile = /path/to/cacert.pem > > # tls_cacertdir = /path/to/ca/dir/ > > # tls_certfile = /path/to/radius.crt > > # tls_keyfile = /path/to/radius.key > > # tls_randfile = /path/to/rnd > > # tls_require_cert = "demand" > > > > # default_profile = > >"cn=radprofile,ou=dialup,o=My Org,c=UA" > ># profile_attribute = "radiusProfileDn" > > #access_attr = "dialupAccess" > > > > # Mapping of RADIUS dictionary attributes to LDAP > > # directory attributes. > > dictionary_mapping = ${raddbdir}/ldap.attrmap > > > > ldap_connections_number = 10 > > > > # > > # NOTICE: The password_header directive is > >NOT case insensitive > > # > > # password_header = "{clear}" > > # > > # The server can usually figure this out on > >its own, and pull > > # the correct User-Password or NT-Password > >from the database. > > # > > # Note that NT-Passwords MUST be stored as a > >32-digit hex > > # string, and MUST start off with "0x", such as: > > # > > # 0x000102030405060708090a0b0c0d0e0f > > # > ># Without the leading "0x", NT-Passwords will not work. > > # This goes for NT-Passwords stored in SQL, too. > > # > > password_attribute = User-Password > > # groupname_attribute = cn > > # groupmembership_filter = > >"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obj > >ectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" > > # groupmembership_attribute = radiusGroupName > > timeout = 4 > > timelimit = 3 > > net_timeout = 1 > > compare_check_items = no > > # do_xlat = yes > > # access_attr_used_for_allow = yes > > } > > > >authorize { > > preprocess > > suffix > > files > > ldap > >} > > > >authenticate { > > Auth-Type LDAP { > > ldap > > } > >} > > > > > > > >the console output of radiusd -X > > > > > > > > > > > >Cleaning up request 4 ID 229 with timestamp 438d0d46 Nothing > >to do. Sleeping until we see a request. > >rad_recv: Access-Request packet from host 10.11.12.107:1024, id=230, > >length=214 > > Framed-MTU = 1480 > > NAS-IP-Address = 10.11.12.107 > > NAS-Identifier = "HP ProCurve Switch 2824" > > User-Name = "test" > > Service-Type = Framed-User > > Framed-Protocol = PPP > > NAS-Port = 24 > > NAS-Port-Type = Ethernet > > NAS-Port-Id = "24" > > Called-Station-Id = "00-0f-20-8d-04-c8" > > Calling-Station-Id = "00-c0-9f-0d-4a-1f" > > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > > Tunnel-Type:0 = VLAN > > Tunnel-Medium-Type:0 = IEEE-802 > > Tunnel-Private-Group-Id:0 = "1010" > > EAP-Message = 0x020100090174657374 > > Message-Authenticator = 0xaf12ec64c245045bbf5a5cc4985025de > >Processing the authorize section of radiusd.conf > >modcall: entering group authorize for request 5 > >modcall[authorize]: module "preprocess" returns ok for request 5 > > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > > rlm_realm: No such realm "NULL" > >modcall[authorize]: module "suffix" returns noop for request 5 > > users: Matched test at 66 > >modcall[authorize]: module "files" returns ok for request 5 > >rlm_ldap: - authorize > >rlm_ldap: performing user authorization for test > >radius_xlat: '(sAMAccountName=test)' > >radius_xlat: 'cn=users,dc=parkhi,dc=net' > >rlm_ldap: ldap_get_conn: Checking Id: 0 > >rlm_ldap: ldap_get_conn: Got Id: 0 > >rlm_ldap: performing search in cn=users,dc=parkhi,dc=net, with filter > >(sAMAccou)rlm_ldap: looking for check items in directory... > >rlm_ldap: looking for reply items in directory... > >rlm_ldap: user test authorized to use remote access > >rlm_ldap: ldap_release_conn: Release Id: 0 > >modcall[authorize]: module "ldap" returns ok for request 5 > >rad_check_password: Found Auth-Type LDAP > >auth: type "LDAP" > >Processing the authenticate section of radiusd.conf > >modcall: entering group Auth-Type for request 5 > >rlm_ldap: - authenticate > >rlm_ldap: Attribute "User-Password" is required for authentication. > >modcall[authenticate]: module "ldap" returns invalid for request 5 > >modcall: group Auth-Type returns invalid for request 5 > >auth: Failed to validate the user. > >Delaying request 5 for 1 seconds > >Finished request 5 > > > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Fall-through and different NAS IP Settings
by Curt LeCaptain 30 Nov '05

30 Nov '05

Hello all, I've done a radiusd -X to do some testing and was rather shocked by what happened when I'm attempting to make some changes to make one specific NAS (our DSL group) to have no timeouts. Here's a snippet of my config: DEFAULT Auth-Type = System, NAS-IP-Address == ip.add.re.ss, Simultaneous-Use = 1 Framed-Compression = None, Idle-Timeout = 0, Session-Timeout = 0, Fall-Through = No # DEFAULT Service-Type == Framed-User Service-Type == Framed-User, Framed-Routing = None, Framed-Compression = Van-Jacobsen-TCP-IP, Fall-Through = Yes DEFAULT Framed-Protocol == PPP, Auth-Type = System Framed-Protocol == PPP, Idle-Timeout = 1200, Session-Timeout = 28800, Framed-MTU = 1518, Framed-Compression = Van-Jacobsen-TCP-IP, Filter-Id = "smtpfilter" >From what I understand, if people come from the NAS-IP-Address of ip.add.re.ss, it should be stopping everything, giving them their IP and not continuing on due to the Fall-Through = No. Perhaps I'm getting this wrong, but I'm trying to make it so that those users aren't getting any timeouts. Any thoughts would be very helpful. Thanks, Curt LeCaptain

2 1

Re: AD authentication
by charles schwartz 29 Nov '05

29 Nov '05

Hi, Here is what I found in your log: [...] Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 [...] Try to troubleshoot winbind. It seems that there may be a permission problem. Regards, Charles > Hi There > > I have configured the Freeradius on Fedora core 3 as per the > documentation > > [root@Radius raddb]# ntlm_auth --request-nt-key --domain=INDIA > --username=checkad > password: > NT_STATUS_OK: Success (0x0) > [root@Radius raddb]# > > When I start the the Radius Server using Radius -X command Starts fine. > > When I give the logon credentials through the wireless laptop the user > doesn't get validated. > > Please help me out. If you need the any config files for your reference, > please let me know.Atached is the log file of output generated. > > Also guide me, as I have already given allow permissions to users with > Dialin Permissions in AD domain. > > > Thanks & Regards > Varun Marwah > CONFIDENTIALITY NOTICE > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and > delete the original transmission, its attachments, and any copies > without reading or saving in any manner. Thank you. > > -----Original Message----- > From: charles schwartz [mailto:charles.schwartz@umail.univ-metz.fr] > Sent: Monday, November 28, 2005 10:51 PM > To: freeradius-users(a)lists.freeradius.org > Cc: Varun Marwah > Subject: Re: AD authentication > > Hi, > > If the wbinfo command does not work, ntlm_auth won't work too. > > > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > This error indicates that something went wrong with the domain access. > Try to troubleshoot by using wbinfo -g or wbinfo -u. > With these commands you should be able to list the users and groups of > your domain. > > There may be a problem with NTLM on your Windows2003 server. > Note thath NTLM was the authentication protocol used by earlier version > of Windows. > It is still supported for backward compatibility, but can be disabled. > By default, Win2k and 2003 use Kerberos for authentication. > > You might have a security policy thats restricts the use of NTLM on your > network. > Check your GPO if NTLM is allowed to be transmitted across the network. > > > Regards, > Charles Schwartz > > > > > > Hi, > > > > > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > > box to get authenticated through users in Windows 2003 AD. > > > > > > > > I used the command net join -U Administrator to add the machine to the > > domain. It gave successful results. Now on typing the command > > > > > > > > wbinfo -a checkad%Quark_123 > > > > > > > > I got the following results:- > > > > > > > > plaintext password authentication failed > > > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > > > error messsage was: No such user > > > > Could not authenticate user checkad%Quark_123 with plaintext password > > > > challenge/response password authentication failed > > > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > > > Could not authenticate user checkad with challenge/response > > > > > > > > Also, on giving the command > > > > > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > > checkad > > > > password: > > > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > (0xc00000da) > > > > [root@Radius etc]# > > > > I get the above stated error. Please help. > > > > Thanks & Regards > > > > Varun Marwah > > > > CONFIDENTIALITY NOTICE > > > > This e-mail transmission and any documents, files, or previous e-mail > > messages appended or attached to it, may contain information that is > > confidential or legally privileged. If you are not the intended > > recipient, or a person responsible for delivering it to the intended > > recipient, you are hereby notified that any disclosure, copying, > > printing, distribution, or use of the information contained or > attached > > to this transmission is STRICTLY PROHIBITED. If you have received this > > transmission in error, please immediately notify the sender by > telephone > > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > > attachments, and any copies without reading or saving in any manner. > > Thank you. > > > > > > > > -- > This message has been scanned for viruses and > dangerous content by Quark Anti Virus, and is > believed to be clean. >

1 0