November 2005 - Freeradius-Users - lists.freeradius.org

AD authentication
by Varun Marwah 29 Nov '05

29 Nov '05

Hi There I have configured the Freeradius on Fedora core 3 as per the documentation [root@Radius raddb]# ntlm_auth --request-nt-key --domain=INDIA --username=checkad password: NT_STATUS_OK: Success (0x0) [root@Radius raddb]# When I start the the Radius Server using Radius -X command Starts fine. When I give the logon credentials through the wireless laptop the user doesn't get validated. Please help me out. If you need the any config files for your reference, please let me know.Atached is the log file of output generated. Also guide me, as I have already given allow permissions to users with Dialin Permissions in AD domain. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you. -----Original Message----- From: charles schwartz [mailto:charles.schwartz@umail.univ-metz.fr] Sent: Monday, November 28, 2005 10:51 PM To: freeradius-users(a)lists.freeradius.org Cc: Varun Marwah Subject: Re: AD authentication Hi, If the wbinfo command does not work, ntlm_auth won't work too. > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO This error indicates that something went wrong with the domain access. Try to troubleshoot by using wbinfo -g or wbinfo -u. With these commands you should be able to list the users and groups of your domain. There may be a problem with NTLM on your Windows2003 server. Note thath NTLM was the authentication protocol used by earlier version of Windows. It is still supported for backward compatibility, but can be disabled. By default, Win2k and 2003 use Kerberos for authentication. You might have a security policy thats restricts the use of NTLM on your network. Check your GPO if NTLM is allowed to be transmitted across the network. Regards, Charles Schwartz > Hi, > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > box to get authenticated through users in Windows 2003 AD. > > > > I used the command net join -U Administrator to add the machine to the > domain. It gave successful results. Now on typing the command > > > > wbinfo -a checkad%Quark_123 > > > > I got the following results:- > > > > plaintext password authentication failed > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > error messsage was: No such user > > Could not authenticate user checkad%Quark_123 with plaintext password > > challenge/response password authentication failed > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > Could not authenticate user checkad with challenge/response > > > > Also, on giving the command > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > checkad > > password: > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > [root@Radius etc]# > > I get the above stated error. Please help. > > Thanks & Regards > > Varun Marwah > > CONFIDENTIALITY NOTICE > > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > attachments, and any copies without reading or saving in any manner. > Thank you. > > > -- This message has been scanned for viruses and dangerous content by Quark Anti Virus, and is believed to be clean.

1 0

Redirect to Realm with Username regex
by Armin ranjbar 29 Nov '05

29 Nov '05

Dear all ; Is this possible to redirect users to another realm ( just like @realm ) with username perfix ? for example , redirect any username that start with A1 to a realm and A2's to another ? -- You will overcome the attacks of jealous associates.

2 1

dialupadmin clean_radacct not working
by radius＠pagedata.com 28 Nov '05

28 Nov '05

We have recently installed Freeradius 1.0.5 and dialupadmin on CentOS4.2. We have changed the clean_radacct file so that it will delete the online user entries that are greater than 4 days old instead of 30 in the dialupadmin. However, it does not delete out those entries from the "online users" section of the dialupadmin gui interface. We have tried turning on the debugging to see if we could see an error when we manually run the ./clean_radacct but do not see any errors. >From the command line it appears that it is working. We get the following response: # ./clean_radacct 2005-11-23 17:35:56 DELETE FROM radacct WHERE AcctStopTime IS NULL AND AcctStartTime < '2005-11-23 17:35:56'; Could someone point out what might be wrong or what else to look at so we can correct this? Also, it seems like it takes longer for the information on the page to load for the online users than when we were running freeradius 0.9.5. Does anyone know what we should look at to see what could be causing a problem? Thank you

1 0

FreeRADIUS->Active Directory
by Alhagie Puye 28 Nov '05

28 Nov '05

Hello all, I am still running into problems with this setup. I have made some progress though. First off, my setup is: SSL VPN Client -> Cisco VPN Concentrator -> FreeRadius -> Active Directory I can query Active with the ldapsearch tool. waggawagga raddb # ldapsearch -h w.x.y.z -x -b 'ou=information technology,ou=datawave users,dc=corp,dc=van,dc=dwave' '(samaccountname=apuye)' -D apuye(a)corp.van.dwave -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=information technology,ou=datawave users,dc=corp,dc=van,dc=dwave> with scope sub # filter: (samaccountname=apuye) # requesting: ALL # # Alhagie Puye, Information Technology, DataWave Users, corp.van.dwave dn: CN=Alhagie Puye,OU=Information Technology,OU=Datawave Users,DC=corp,DC=van ,DC=dwave memberOf: CN=itops-folder,OU=SHARED FOLDERS,OU=DataWave Users,DC=corp,DC=van,D C=dwave memberOf: CN=rptpcps,OU=DataWave Users,DC=corp,DC=van,DC=dwave memberOf: CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van, DC=dwave memberOf: CN=datawave,OU=DataWave Users,DC=corp,DC=van,DC=dwave accountExpires: 9223372036854775807 badPasswordTime: 127775870835283171 badPwdCount: 0 codePage: 0 cn: Alhagie Puye countryCode: 0 description: IT Operations displayName: Alhagie Puye givenName: Alhagie homeDirectory: \\server\apuye homeDrive: H: instanceType: 4 lastLogoff: 0 lastLogon: 127776922250294313 logonCount: 173 msNPAllowDialin: TRUE distinguishedName: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users ,DC=corp,DC=van,DC=dwave objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user objectGUID:: oO1UkRu8RkScNIOHmaB/qw== objectSid:: AQUAAAAAAAUVAAAAzSmuLihcKk12fipaZwkAAA== primaryGroupID: 513 profilePath: \\\server1\apuye pwdLastSet: 127771529310887572 name: Alhagie Puye sAMAccountName: apuye sAMAccountType: 805306368 sn: Puye userAccountControl: 512 userParameters:: bTogICAgICAgICAgICAgICAgICAgIGQJICAgICAgICAgICAgICAgICAgICAgI CAgUBAaCAFDdHhDZmdQcmVzZW5045S15pSx5oiw44GiGAgBQ3R4Q2ZnRmxhZ3Mx44Cw44Gm4 6Cy44 C5FggBQ3R4Q2FsbGJhY2vjgLDjgLDjgLDjgLASCAFDdHhTaGFkb3fjhLDjgLDjgLDjgLAoCA FDdHh NYXhDb25uZWN0aW9uVGltZeOAsOOAsOOAsOOAsC4IAUN0eE1heERpc2Nvbm5lY3Rpb25UaW1 l44Cw 44Cw44Cw44CwHAgBQ3R4TWF4SWRsZVRpbWXjgLDjgLDjgLDjgLAiCAFDdHhLZXlib2FyZExh eW91d OOAsOOAsOOAsOOAsCoCAUN0eE1pbkVuY3J5cHRpb25MZXZlbOOEsCACAUN0eFdvcmtEaXJlY 3Rvcn njgLAgAgFDdHhOV0xvZ29uU2VydmVy44CwGAIBQ3R4V0ZIb21lRGly44CwIgIBQ3R4V0ZIb2 1lRGl yRHJpdmXjgLAgAgFDdHhXRlByb2ZpbGVQYXRo44CwIgIBQ3R4SW5pdGlhbFByb2dyYW3jgLA iAgFD dHhDYWxsYmFja051bWJlcuOAsA== userPrincipalName: apuye(a)corp.van.dwave uSNChanged: 7588047 uSNCreated: 5713011 whenChanged: 20051122170851.0Z whenCreated: 20050902184213.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 waggawagga raddb # When I run: Server# radtest apuye password localhost 1 testing123 I get: rad_recv: Access-Request packet from host 127.0.0.1:49732, id=181, length=57 User-Name = "apuye" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "apuye", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(sAMAccountName=apuye)' radius_xlat: 'ou=Information Technology,ou=DataWave Users,dc=corp,dc=van,dc=dwave' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 0 rlm_ldap: bind as cn=apuye,ou=Information Technology,ou=DataWave Users,DC=corp,DC=van,DC=dwave/ to w2kserver.corp.van.dwave:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Information Technology,ou=DataWave Users,dc=corp,dc=van,dc=dwave, with filter (sAMAccountName=apuye) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 My radiusd.conf file looks like this: ldap { server = "w2kserver.corp.van.dwave" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=apuye,ou=Information Technology,ou=DataWave Users,DC=corp,DC=van,DC=dwave" # password = mypass password_attribute = "password" #basedn= "DC=corp,DC=van,DC=dwave" basedn = "ou=Information Technology,ou=DataWave Users,dc=corp,dc=van,dc=dwave" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" #filter = "(SamAccountName=%U)" # base_filter = "(objectclass=radiusprofile)" Any help is greatly appreciated. Does anyone want to share a working ldap section to Active Directory? Thanks in advance Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Proxy radius GTC
by benjo.fr 28 Nov '05

28 Nov '05

Hi, I know proxying for PEAP/EAP-MsChapV2 is ok with FreeRadius. Or, I want to know if proxying for PEAP/EAP-GTC is working too ? Thanks BenjO

2 5

Reid Canavan/FortErie is out of the office
by Reid Canavan 28 Nov '05

28 Nov '05

I will be out of the office starting 11/28/2005 and will not return until 11/30/2005. I will respond to your message when I return.

1 0

How do I strip netbios-style domain name from User-Name?
by Laker Netman 28 Nov '05

28 Nov '05

My FR server is successfully receiving Access-Requests from my wifi AP (XP supplicant) using PEAP/EAP-TLS. However, the received User-Name is formatted "Domain\\User". I have read the docs regarding realms and proxy.conf and believe the following should work: (In radiusd.conf) realm MY-DOMAIN-NAME { format = prefix delimiter = "\\" ignore_default = yes ignore_null = yes } (In proxy.conf) realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } I have also tried "realm MY-DOMAIN-NAME" rather than "DEFAULT" in proxy.conf with no difference. "with_ntdomain_hack" is set to "no" wherever referenced, as it is my understanding using the realms module is the preferred method (?) My ldap filter is: filter = "(sAMAccountName=%u)" and running with "-X" I get the following: rad_recv: Access-Request packet from host 192.168.12.231:2057, id=0, length=156 User-Name = "MY-DOMAIN-NAME\\username" NAS-IP-Address = 192.168.12.231 Called-Station-Id = "000d0b6b9250" Calling-Station-Id = "000e356529b4" NAS-Identifier = "000d0b6b9250" NAS-Port = 56 Framed-MTU = 1400 State = 0x9eafe6f8023c0c59423b42f6c92b96f4 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0xc8ce70994f2aba8a00f4ba8561979c20 ... then ... rlm_ldap: - authorize rlm_ldap: performing user authorization for MY-DOMAIN-NAME\\username radius_xlat: '(sAMAccountName=MY-DOMAIN-NAME)' radius_xlat: 'CN=Users,DC=mydomain,DC=branch,DC=corp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Users,DC=mydomain,DC=branch,DC=corp, with filter (sAMAccountName=MY-DOMAIN-NAME) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed Authenticating via (hard-wired) telnet works as expected and %u contains the username without any domain prefix, of course. A suggestion as to what I may have missed would be appreciated. TIA, Laker __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Re: AD authentication
by charles schwartz 28 Nov '05

28 Nov '05

Hi, If the wbinfo command does not work, ntlm_auth won't work too. > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO This error indicates that something went wrong with the domain access. Try to troubleshoot by using wbinfo -g or wbinfo -u. With these commands you should be able to list the users and groups of your domain. There may be a problem with NTLM on your Windows2003 server. Note thath NTLM was the authentication protocol used by earlier version of Windows. It is still supported for backward compatibility, but can be disabled. By default, Win2k and 2003 use Kerberos for authentication. You might have a security policy thats restricts the use of NTLM on your network. Check your GPO if NTLM is allowed to be transmitted across the network. Regards, Charles Schwartz > Hi, > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > box to get authenticated through users in Windows 2003 AD. > > > > I used the command net join -U Administrator to add the machine to the > domain. It gave successful results. Now on typing the command > > > > wbinfo -a checkad%Quark_123 > > > > I got the following results:- > > > > plaintext password authentication failed > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > error messsage was: No such user > > Could not authenticate user checkad%Quark_123 with plaintext password > > challenge/response password authentication failed > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > Could not authenticate user checkad with challenge/response > > > > Also, on giving the command > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > checkad > > password: > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > [root@Radius etc]# > > I get the above stated error. Please help. > > Thanks & Regards > > Varun Marwah > > CONFIDENTIALITY NOTICE > > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > attachments, and any copies without reading or saving in any manner. > Thank you. > > >

1 0

SQL Mac-Authentication based on Call-Check
by florian broder 28 Nov '05

28 Nov '05

Hello. I'm currently working on my diploma thesis, and I'm sorting some things out at the moment. The task is, to authenticate mac-adresses through a cisco catalyst 6500. A pretty new feature called "mac-authentication-bypass" is available in CatOS and works well with Cisco ACS 4.0 beta. Due to our demands we want to deploy freeradius, with a mysql database. It works like that. The switch sends an Access-Request with the connecting MAC in the Caller-ID Field and Sevice Type is set to "10", hence "Call Ceck". Radius now authenticates the users on a given MAC (Caller ID) instead of a user/password. I haven't set up freeradius yet, but I'm slighty familar with the settings that have to be done. In table "radcheck" I create attribute "Calling-Station-ID" with value "MAC-Address" (f.e. ff-ee-11-22-33-44), this value will be checked against. I also have to edit the sql.conf (user, database etc) and telling radiusd.conf to use sql in the "authorise" section. I'm sticking to the Freeradius MySQL howto by Scott Bartlett for that. :) The only thing I'm currently unaware of is, where I can tell freeradius to use Call-Check together with mysql, I think it's somewhere in sql.conf? Only thing that need to be done IMO is to tell radius, that there is no username and authentication needs to be done on a caller-id basis. Any thoughts? Thanks in advance. Bye Florian

2 5

freeradius 1.0.2 with openssl 0.9.7
by awal.mohamadou 28 Nov '05

28 Nov '05

no need please i've found a howto resolve my problem of certificates. http://www.freeradius.org/doc/EAPTLS.pdf it seems to be a problem of extension files with XPsupplicants.i'll try and see what is hapenning. Awal. Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34/mn) ; tél : 08 92 68 13 50 (0,34/mn)

1 0