December 2005 - Freeradius-Users - lists.freeradius.org

How can i change Configure file.
by Manojkumar Patel 05 Dec '05

05 Dec '05

Hi all I have one problem. I want to pass config parameters in one Config.ini My Config.ini file is like: --no-create --sysconfdir=/home/manoj/RadiusServer --with-logdir=/home/manoj/RadisuServer When I w run config file like ./configure < Config.ini But radius server was configured as default setting. But I want to change default setting. I want to pass all parameter in one file instead of Command line argument. How can I do that requirements ? Thanks & Regard Manoj Patel MBT Ltd-Pune, Next Generation Network (IN) group Phone: (020) 56018100 (Exnt: 2845) Mobile: +91-9881403519 ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

3 2

FW: How can i change Configure file.
by Manojkumar Patel 05 Dec '05

05 Dec '05

Hi I make configuration with following syntex $ xargs ./configure < Config.ini But my FreeRadiussercer is take logfile and sysconfdir as default. Thanks Manoj -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Nicolas Baradakis Sent: Monday, December 05, 2005 5:08 PM To: FreeRadius users mailing list Subject: Re: How can i change Configure file. Manojkumar Patel wrote: > My Config.ini file is like: > --no-create > --sysconfdir=/home/manoj/RadiusServer > --with-logdir=/home/manoj/RadisuServer > When I w run config file like > ./configure < Config.ini > But radius server was configured as default setting. But I want to > change default setting. > I want to pass all parameter in one file instead of Command line > argument. How can I do that requirements ? You could try this command line: $ xargs ./configure < Config.ini And please turn HTML off when posting to a mailing list. http://freeradius.org/list/users.html -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

1 0

RE: Fall-through and different NAS IP Settings
by Jonathan De Graeve 05 Dec '05

05 Dec '05

>> I'm just asking this for my understanding, am I still going to want to >>use Client-IP-Address even though from what I can see here, the NAS-IP- >> Address attribute is appearing within the output of debugging? > I would suggest using Client-IP-Address, unless you know that the >NAS will always send that attribute with that value. > As for why it doesn't match, I'm not sure. Try editing the "users" >file entry to see if you can narrow down the problem. How do you explain this then? I have a NAS that DOESN'T sent NAS-IP-Address attribute to the radius server (only nas-identifier) but all my huntgroups based on NAS-IP-Address work without any problem... Is this then somewhere in the code? If (!NAS-IP-Address && Client-IP-Address) NAS-IP-Address = Client-IP-Address J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be

2 1

Basic Question
by Santy 05 Dec '05

05 Dec '05

Dear all, first of all let me say thanks to those who had make this incredible opensource :). I am new with freeradius and I hope all you guys don't mind to answer my basic question. I want to build system with only for one or 2 users. And I wonder whether : 1. I need database for it(mySQL)? first I thought I won't need it but then I think i might need it for my accounting report. Or can I have it in a simple txt file? 2. I already build the system using 2 computers, one act as NAS and server. The other as client. Is my configuration right? 3. Can I not using EAP? while for now it is enough just authenticate the user from his password. Thanks a lot before and hope you are willing to answer them. SanSar __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Installing a signed SSL certificate
by Laker Netman 04 Dec '05

04 Dec '05

I am considering use of a CA-signed SSL certificate. Comodo (instantssl.com) offers an "Intranet SSL" certificate good on a single, internal host. All of their documentation refers to set up with a web server or for email verification. Would it also work with FR? There signed certificates are returned as ".crt" files, is this the same as the cert-srv.pem referenced in the self-signed tutorial? TIA, Laker. __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

3 3

connection to netowrk problem
by debik 04 Dec '05

04 Dec '05

Hello ! I have configured the freeradius with peap authentication. Then when i try connect to the NAS with username and password the raidus server allow me to log and the connection seems to be ok. Bu when I try to ping some host on my network, theres no response. I am connected but i dont se any network. I could't even ping the NAS who says that I'am connetcetd to him. My configs are: /usr/local/radius/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/radius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/radius/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/radius/etc/raddb/certs/dh" tls: random_file = "/usr/local/radius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/radius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/radius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/radius/etc/raddb/users" files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/radius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. clients.conf mam nastepujacy: client 192.168.0.0/24 { secret = test shortname = Dlink } users Auth-Type :=EAP, User-Password == "password" Service-Type = Frames-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.0.21, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP Any suggestions ???

2 4

How to transfer authentication method from system to mysql?
by darkblue 04 Dec '05

04 Dec '05

Hi experts, I got a problem when using freeradius for authentication network staff to login the network device. we have two type of devices, 3com and cisco, they are have difference VSA,at the same time, the network staff are divided into two group: admin and monitor, the admin have the read/write privilige, the monitor should only have read privilige.So I use such users file: /etc/freeradius/users DEFAULT Auth-Type := System, Group == "admin", Huntgroup-Name == "cisco" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Login-Service = Telnet DEFAULT Auth-Type := System, Group == "monitor", Huntgroup-Name == "cisco" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=1", Login-Service = Telnet DEFAULT Auth-Type := System, Group == "admin", Huntgroup-Name == "3com" Login-Service = Telnet, 3Com-User-Access-Level = 3 DEFAULT Auth-Type := System, Group == "monitor", huntgroup-Name == "3com" Login-Service = Telnet, 3Com-User-Access-Level = 1 and create 4 accounts within debian linux, for example, aaa, bbb, ccc, ddd. aaa and bbb are member of admin group, ccc and ddd are member of monitor group, debian sarge linux group info /etc/group(debian linux) admin:x:1001:aaa,bbb monitor:x:1010:ccc,ddd the /etc/huntgroup: cisco NAS-IP-Address == 192.168.1.1 cisco NAS-IP-Address == 192.168.1.2 cisco NAS-IP-Address == 192.168.1.3 3com NAS-IP-Address == 192.168.1.4 3com NAS-IP-Address == 192.168.1.5 3com NAS-IP-Address == 192.168.1.6 this kind of configuration work just fine. and now, I would like to use mysql for user db backend. So I got two problem. 1. could mysql utilize the huntgroup file? 2. how to transfer this user info , group check and group reply info into mysql? -- He is nothing -- He is nothing

2 1

FreeRadius Billing system
by chris chris 03 Dec '05

03 Dec '05

Hey There was a posting titled Using FreeRadius for a HotSpot with a PrePaid Billing System in the list, where John provided some scripting files, for processing cc. I was unable to get the scripts from the list, since i just now register to the list, can please someone re-post them thanks chris --------------------------------- Yahoo! Personals Skip the bars and set-ups and start using Yahoo! Personals for free

1 0

Re: Freeradius How to integrate ActiveDirectory[ADIntegrationWindowsXP NTLM Tutorial]
by darkblue 03 Dec '05

03 Dec '05

hey, guys I have built up the whole environment, very close to success, but still have a problem when the suppliant create tls tunnel with radius server, the following is the log: rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 55 modcall: group authenticate returns invalid for request 55 auth: Failed to validate the user. any suggestion? I had imported the root.p12 to winxp, copy the whole certs from freeradius's source package to /usr/local/etc/raddb/certs/ 2005/12/3, freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org >: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] (Nicolas Baradakis) > 2. Re: IPv6 Support (Nicolas Baradakis) > 3. EAP/TLS Configuration - Addition (Madhuraka Godahewa) > 4. Re: EAP/TLS Configuration - Addition (Zoltan Ori) > 5. Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] (darkblue) > 6. RE: Freeradius How to integrate Active Directory and return > group attribute to VPN Concentrator (Alhagie Puye) > 7. Re: Configuring a proxied and local authentication (Alan DeKok) > 8. RE: Freeradius How to integrate Active Directory [AD > Integration WindowsXP NTLM Tutorial] (Bohannan, Chad W) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 2 Dec 2005 12:41:39 +0100 > From: Nicolas Baradakis <nbk(a)sitadelle.com > > Subject: Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] > To: darkblue <darkblue2000(a)gmail.com> > Cc: freeradius-users(a)lists.freeradius.org > Message-ID: <20051202114139.GB7382(a)asuka.tech.sitadelle.com> > Content-Type: text/plain; charset=us-ascii > > darkblue wrote: > > > I have upgrade my libs, but when execute dpkg-buildpackage -uc > > -b(under root privilege), some error show out: > > ..... > > /bin/bash: line 1: dpatch: command not found > > make: *** [unpatch] Error 127 > > > > any idea? > > apt-get install dpatch > > -- > Nicolas Baradakis > > > > ------------------------------ > > Message: 2 > Date: Fri, 2 Dec 2005 13:03:14 +0100 > From: Nicolas Baradakis <nbk(a)sitadelle.com> > Subject: Re: IPv6 Support > To: FreeRadius users mailing list > < freeradius-users(a)lists.freeradius.org> > Message-ID: <20051202120314.GC7382(a)asuka.tech.sitadelle.com> > Content-Type: text/plain; charset=us-ascii > > Paulo Alexandre Caceres Ferreira wrote: > > > How I can test IPv6 Freeradius authentication? > > You know any IPv6 RADIUS client to interact with Freeradius and perform > an > > IPv6 authentication? > > There is a program called "radclient" in the FreeRADIUS source tree. > > -- > Nicolas Baradakis > > > ------------------------------ > > Message: 3 > Date: Fri, 02 Dec 2005 19:53:09 -0800 (PST) > From: Madhuraka Godahewa <maduraka(a)electroteks.com> > Subject: EAP/TLS Configuration - Addition > To: FreeRADIUS < freeradius-users(a)lists.freeradius.org> > Message-ID: <1133581989.439116a523cff(a)mail-egn.electroteks.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hi Again, > > This email refers to the earlier email sent with the subject "EAP/TLS > Configuration". > > After having some trouble with the Windows XP and freeRADIUS, I was able > to > connect to the AP. But, in the configuration (Windows XP), I removed the > check > mark at 'Validate Server Certificate'. Then, suddenly, it started working. > > Anybody knows the reason for this? > > > Further, after establishing the connection, I terminated the connection > (by > disabling the network connection). Then, I tried to connect again (by > enabling). But, this time, the user machine connected to the AP > automatically > (without asking for the credentials.). It seems like something has cached > these > entries. > > Anybody knows how to clear this cache? > > > Thanking You., > > > -------------------------------------------------------------------------------- > Madhuraka Godahewa > Telecommunications Engineer > Research and Development Unit > Electroteks Global Networks (Pvt.) Ltd. > > Mobile: + 94-777-647055 > > > ------------------------------ > > Message: 4 > Date: Fri, 2 Dec 2005 08:40:00 -0500 > From: Zoltan Ori <z.ori(a)morehead-st.edu> > Subject: Re: EAP/TLS Configuration - Addition > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: < 200512020840.00682.z.ori(a)morehead-st.edu> > Content-Type: text/plain; charset="iso-8859-1" > > On Friday 02 December 2005 22:53, Madhuraka Godahewa wrote: > > > After having some trouble with the Windows XP and freeRADIUS, I was able > to > > connect to the AP. But, in the configuration (Windows XP), I removed the > > check mark at 'Validate Server Certificate'. Then, suddenly, it started > > working. > > > > Anybody knows the reason for this? > > > > You don't have a copy of the root certificate on the supplicant or have > not > selected to use it? > > > > > Further, after establishing the connection, I terminated the connection > (by > > disabling the network connection). Then, I tried to connect again (by > > enabling). But, this time, the user machine connected to the AP > > automatically (without asking for the credentials.). It seems like > > something has cached these entries. > > > > Anybody knows how to clear this cache? > > > > It's in the registry under HKEY_CURRENT_USER\Software\Microsoft\EAPOL. > > > > ------------------------------ > > Message: 5 > Date: Fri, 2 Dec 2005 23:12:15 +0800 > From: darkblue <darkblue2000(a)gmail.com> > Subject: Re: Freeradius How to integrate Active > Directory[ADIntegrationWindowsXP NTLM Tutorial] > To: freeradius-users(a)lists.freeradius.org > Message-ID: <2c8195ff0512020712m52aac54bl(a)mail.gmail.com > > Content-Type: text/plain; charset=ISO-8859-1 > > thanks > I could not wait to complie from source tarball. > I will try the build deb some time later, anyway, thanks very much. > > 2005/12/2, Nicolas Baradakis < nbk(a)sitadelle.com>: > > darkblue wrote: > > > > > I have upgrade my libs, but when execute dpkg-buildpackage -uc > > > -b(under root privilege), some error show out: > > > ..... > > > /bin/bash: line 1: dpatch: command not found > > > make: *** [unpatch] Error 127 > > > > > > any idea? > > > > apt-get install dpatch > > > > -- > > Nicolas Baradakis > > > > > > > -- > He is nothing > > > > ------------------------------ > > Message: 6 > Date: Fri, 2 Dec 2005 10:50:31 -0500 > From: "Alhagie Puye" < APuye(a)datawave.com> > Subject: RE: Freeradius How to integrate Active Directory and return > group attribute to VPN Concentrator > To: "FreeRadius users mailing list" > < freeradius-users(a)lists.freeradius.org> > Message-ID: > <6B865826E860EF42B3A387A03F39539606D7A0A9(a)EX0004.AllstreamITS.local > > > Content-Type: text/plain; charset="us-ascii" > > > >-----Original Message----- > > >From: freeradius-users-bounces(a)lists.freeradius.org > > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > > >Behalf Of Dusty Doris > > >Sent: November 30, 2005 7:16 AM > > >To: FreeRadius users mailing list > > >Subject: RE: Freeradius How to integrate Active Directory > > >and return group attribute to VPN Concentrator > > > > > >> Radiusd.conf: > > >> > > >> filter = > > >> > > >"(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(membe > > >rOf=CN=rp > > >> tp cps,OU=Datawave Users,DC=corp,DC=van,DC=dwave))" > > >> > > >> This works fine. However I can't get it to return any > > >replyItems. Has > > >> anyone gotten this to work with Active Directory? All the > > >docs I see > > >> on the Net refeerence OpenLDAP. I'm sure there is a lot of > > >folks out > > >> there running Windows 2000/2003 Active Directory. > > >> > > >> I have spent a couple of days on this not having much > > >luck. Here are a > > >> few questions that would help me a bit. > > >> > > >> 1) Do I need groupname_attribute to get this to work? > > >> > > >> 2) What about groupmembership_filter and groupmembership_attribute? > > >> > > >> My ldap.attrmap looks like this: > > >> > > >> replyItem Class groupofnames > > >> replyItem Class group > > >> > > >> I think the above is correct. Can some shed some light on this? > > > > > >Is group and groupofnames something that is an attribute of > > >a user? When freeradius searches for reply items it is > > >searching for attributes of that user. > > > > > >eg: > > > > > >dn: cn=someuser,... > > >group: somegroup > > > > > >Should then add > > > > > >Class = somegroup > > > > > >to the reply items. > > > > > >If you want to make reply items attached to a group, rather > > >than in individual, you will need to set the User-Profile attribute. > > > > > >For example, > > > > > >dn: cn=somegroup,ou=groups,... > > >group: somegroup > > > > > >Then in the users file. > > > > > >DEFAULT Ldap-Group == somegroup, User-Profile := > > >"cn=somegroup,ou=groups,..." > > > > > >You may be able to do this dynamically using xlat or > > >something like huntgroups too. If you want an example, send > > >us an example of a user and group from AD in ldif format and > > >an example of a radius packet that you would expect in the > > >reply and I'll see if I can come up with an idea for ya. > > I'm still waiting for some help with this.....I have sent all the > information that you requested. > I have gotten it to return the group name but it is also returning the > username as well and the username is returned after the group name. Is > there is way to return just the groupname? > I really would like to resolve this issue ones and for all. > > I'm really surprised that there are not folks on the list who have > Active Directory users that they want to use to lock VPN users into > groups on the VPN Concentrator. If really there isn't, I would put a > howto on this when I get it working and post it on the list. > > Here is my latest output: > > rlm_ldap: performing search in CN=itops,OU=Information > Technology,OU=DataWave Users,DC=corp,DC=van,DC=dwave, with filter > (cn=itops) > rlm_ldap::ldap_groupcmp: User found in group itops > rlm_ldap: ldap_release_conn: Release Id: 0 > users: Matched entry DEFAULT at line 163 > modcall[authorize]: module "files" returns ok for request 1 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for apuye > radius_xlat: '(&(sAMAccountName=apuye)(objectclass=user))' > radius_xlat: 'DC=corp,DC=van,DC=dwave' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in DC=corp,DC=van,DC=dwave, with filter > (&(sAMAccountName=apuye)(objectclass=user)) > rlm_ldap: performing search in CN=itops,ou=Information > Technology,ou=Datawave Users,dc=corp,dc=van,dc=dwave, with filter > (objectclass=group) > rlm_ldap: Adding samaccountname as Class, value itops & op=11 > rlm_ldap: looking for check items in directory... > rlm_ldap: looking for reply items in directory... > rlm_ldap: Adding samaccountname as Class, value apuye & op=11 > rlm_ldap: user apuye authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns ok for request 1 > modcall: group authorize returns ok for request 1 > rad_check_password: Found Auth-Type LDAP > auth: type "LDAP" > Processing the authenticate section of radiusd.conf > modcall: entering group Auth-Type for request 1 > rlm_ldap: - authenticate > rlm_ldap: login attempt by "apuye" with password "XXXXXXXXXXX" > rlm_ldap: user DN: CN=Alhagie Puye,OU=Information Technology,OU=DataWave > Users,DC=corp,DC=van,DC=dwave > rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 1 > rlm_ldap: bind as CN=Alhagie Puye,OU=Information Technology,OU=DataWave > Users,DC=corp,DC=van,DC=dwave/XXXXXXXXXX to huckster.corp.van.dwave:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: user apuye authenticated succesfully > modcall[authenticate]: module "ldap" returns ok for request 1 > modcall: group Auth-Type returns ok for request 1 > Sending Access-Accept of id 4 to 10.99.1.50:1031 > Class = 0x6170757965 > Finished request 1 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > --- Walking the entire request list --- > Cleaning up request 1 ID 4 with timestamp 438e98b2 > Nothing to do. Sleeping until we see a request. > > Thanks, > Alhagie. > > > > > > > > > > > >- > > >List info/subscribe/unsubscribe? See > > >http://www.freeradius.org/list/users.html > > > > > > This message (including any attachments) is confidential, may be > privileged and is only intended for the person to whom it is addressed. If > you have received it by mistake please notify the sender by return e-mail > and delete this message from your system. Any unauthorized use or > dissemination of this message in whole or in part is strictly > prohibited. E-mail communications are inherently vulnerable to interception > by unauthorized parties and are susceptible to change. We will use > alternate communication means upon request. > > > > ------------------------------ > > Message: 7 > Date: Fri, 02 Dec 2005 12:16:46 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: Configuring a proxied and local authentication > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: < 20051202171647.EF63016CC1(a)mail.nitros9.org> > > Samuel Degrande <Samuel.Degrande(a)lifl.fr> wrote: > > I don't find a way to add a NAS-Identifier value inside the proxied > > request, so that B server could check it... > > That's because the NAS didn't send it. FreeRADIUS doesn't add one, > so... > > > I tried: > > <username> Proxy-To-Realm := <realm>, NAS-Identifier := <id> > > and > > <username> Proxy-To-Realm := <realm>, NAS-Identifier += <id> > > That won't work in the "users" file. You have to set the > NAS-Identifier in the preproxy_users file. > > > How to configure the A server so that if B rejects the request, then > > A will check in a local user base (through pam) ? > > That's a little harder. The server isn't designed to do that easily. > > Alan DeKok. > > > > ------------------------------ > > Message: 8 > Date: Fri, 2 Dec 2005 12:46:47 -0500 > From: "Bohannan, Chad W" <Chad_Bohannan(a)reyrey.com> > Subject: RE: Freeradius How to integrate Active Directory [AD > Integration WindowsXP NTLM Tutorial] > To: "FreeRadius users mailing list" > < freeradius-users(a)lists.freeradius.org> > Message-ID: > <7EA2A14F52A15A49807388D4A6AD624613619741(a)OH18CL07VE1.reyrey.com > > Content-Type: text/plain; charset="us-ascii" > > We were able to move past this particular problem. For anyone who may > have a similar issue.... > > Port 512 (tcp&udp for EZEC service) need to be allowed in addition to > the standard 137-139, 445, & 389. So if you are running TCP wrappers or > ip tables make certain it is allowed.... > > cheers > > > > -----Original Message----- > From: Bohannan, Chad W > Sent: Thursday, December 01, 2005 11:27 AM > To: 'charles schwartz'; 'FreeRadius users mailing list' > Subject: RE: Freeradius How to integrate Active Directory [AD > Integration WindowsXP NTLM Tutorial] > > > > Hello, > I am attempting to have FR authenticate administrative access > for my Cisco gear against AD. The problem I am having is this. When I > attempt to join the realm <<net ads join -U UID>> the command appears > successful and from the AD side, the system has joined (visable in AD), > however the proccess hangs on the FR side. If I stop the process and > reissue the command, I get the following output and the process again > hangs: > > [2005/12/01 11:08:36, 0] libads/ldap.c:ads_add_machine_acct(1405) > ads_add_machine_acct: Host account for rws-radius01 already exists - > modifying old account > > > <<ntlm_auth --request-nt-key --domain=mydomain --username= \myuid>> > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > > <<wbinfo -a UID%PASSWD>> > > plaintext password authentication failed > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > error messsage was: No such user > Could not authenticate user UID%PASSWD with plaintext password > challenge/response password authentication failed > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > Could not authenticate user UID with challenge/response > > I am sure there is something simple I have overlooked, but I am unable > to find it at this point. Any suggestions would be much appreciated. > > > Chad > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of > charles schwartz > Sent: Tuesday, November 22, 2005 11:28 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius How to integrate Active Directory [AD Integration > WindowsXP NTLM Tutorial] > > > Hi list, > > A lot of people on this list would like to integrate Active Directory > with FreeRADIUS in order to provide a transparent user authentication > login process. > > There are at least 2 ways to integrate AD: LDAP and NTLM. > I've written a tutorial about how to do this with NTLM (winbind, > ntlm_auth). The Windows supplicants are configured to work with PEAP and > MSCHAPv2. > > You can download it from here: > http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf > > Good luck! > > Regards, > Charles Schwartz > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > End of Freeradius-Users Digest, Vol 8, Issue 10 > *********************************************** > -- He is nothing

3 2

acct info for visp authentication
by squirrel＠isot.com 03 Dec '05

03 Dec '05

I get acct info for my local nas, but not getting acct info on visp authentication? I've just upgraded to v1.0.5, but no difference. What does it take to get the acct info for visp authentications? ************************************** Computer problems? ................... ..............http://www.multibyte.net

3 4