May 2005 - Freeradius-Users - lists.freeradius.org

LEAP
by Luis Daniel Lucio Quiroz 02 Jun '05

02 Jun '05

Ehlo We are usign Cisco1200 AP for roaming, but AP needs to auth into radius. Because CISCO it must use LEAP. But it fails on this rlm_eap: EAP/leap rlm_eap: processing type leap rlm_eap_leap: No User-Password or NT-Password configured for this user rlm_eap: Handler failed in EAP/leap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 3 EAP with TLS and PEAP works well. LDAP user exists uid: AP-DATI userrPassword: cisco1234 sambaNTPassword: 3B298390489F668CA3C38047C7FE1266 sambaLMPassword: 8BE57A0FA91F460C19F10A933D4868DC How should I fix this? Regards,

4 6

How to authenticate users against a Windoze AD server with krb5?
by Arne Götje (高盛華) 01 Jun '05

01 Jun '05

Hi list, I'm trying to authenticate users against a Windows AD server using the krb5 module... but due to missing documentation on how to do this, I'm stuck. When I try to get a Kerberos ticket using kinit on the radius machine, it works. But when I try to use the krb5 module, it always gives me a Reject... Is there anywhere a detailed howto available? Google didn't help me much... :( Cheers Arne -- Arne Götje (高盛華) <arne(a)linux.org.tw> PGP/GnuPG key: 1024D/685D1E8C Fingerprint: 2056 F6B7 DEA8 B478 311F 1C34 6E9F D06E 685D 1E8C Key available at wwwkeys.pgp.net. Encrypted e-mail preferred.

3 4

How to? - use/configure winbind/ntlm_auth for Windows authentication
by Pete Flynt 01 Jun '05

01 Jun '05

Hello, I'm trying to set up a FreeRadius solution for a Windows2k AD environnment. The FreeRadius-server is already running right. I can authenticate a testuser with Auth-Type := EAP (username and password stored as cleartext in the users file) Now I want to use FreeRadius to check username/password from the Active Directory Server when a user logs onto the computer. I checked the list already. Some say to use ntlm_auth and winbind, others LDAP, then samba... but nobody is able to explain how to get it working. Is it really as complicated? ntlm_auth seems very simple, returnig 1 if user/pwd is alright and 0 when not. But how can I test this from the command line? Where do I specify the address of the AD-server? When running ntlm_auth -- usage there are too much parameters that are unknown to me. Thanks in advance for any help! Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 1

Certificate creation????
by Andreas Korber 01 Jun '05

01 Jun '05

Hi, What i am doing wrong? The creation of my certificates for EAP/TLS with CA.all or CA.certs always end with an message like this: ----- Country Name (2 letter code) [AU]:State or Province Name (full name) [Some-State]:Locality Name (eg, city) []:Organization Name (eg, company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, section) []:Common Name (eg, YOUR name) []:Email Address []: Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []:An optional company name []:Using configuration from /etc/ssl/openssl.cnf ./demoCA/serial: No such file or directory error while loading serial number 3164:error:02001002:system library:fopen:No such file or directory:bss_file.c:276:fopen('./demoCA/serial','r') 3164:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:278: Failed to do sign certificate radius:/usr/local/etc/raddb/certs # So i looked for the serial file. But it dosn´t exist. I think because of an earlier message: CA certificate filename (or enter to create) unknown option -next_serial usage: x509 args -inform arg - input format - default PEM (one of DER, NET or PEM) -outform arg - output format - default PEM (one of DER, NET or PEM) -keyform arg - private key format - default PEM -CAform arg - CA format - default PEM -CAkeyform arg - CA key format - default PEM -in arg - input file - default stdin -out arg - output file - default stdout -passin arg - private key password source -serial - print serial number value -hash - print hash value -subject - print subject DN -issuer - print issuer DN -email - print email address(es) -startdate - notBefore field -enddate - notAfter field -purpose - print out certificate purposes -dates - both Before and After dates -modulus - print the RSA key modulus -pubkey - output the public key -fingerprint - print the certificate fingerprint -alias - output certificate alias -noout - no certificate output -ocspid - print OCSP hash values for the subject name and public key -trustout - output a "trusted" certificate -clrtrust - clear all trusted purposes -clrreject - clear all rejected purposes -addtrust arg - trust certificate for a given purpose -addreject arg - reject certificate for a given purpose -setalias arg - set certificate alias -days arg - How long till expiry of a signed certificate - def 30 days -checkend arg - check whether the cert expires in the next arg seconds exit 1 if so, 0 if not -signkey arg - self sign cert with arg -x509toreq - output a certification request object -req - input is a certificate request, sign and output. -CA arg - set the CA certificate, must be PEM format. -CAkey arg - set the CA key, must be PEM format missing, it is assumed to be in the CA file. -CAcreateserial - create serial number file if it does not exist -CAserial arg - serial file -set_serial - serial number to use -text - print the certificate in text form -C - print out C code forms -md2/-md5/-sha1/-mdc2 - digest to use -extfile - configuration file with X509V3 extensions to add -extensions - section from config file with X509V3 extensions to add -clrext - delete extensions before signing and input certificate -nameopt arg - various certificate name options -engine e - use engine e, possibly a hardware device. -certopt arg - various certificate text options Can anyone help me plaese??

3 2

Freeradius+mysql error
by Rupak 31 May '05

31 May '05

I configured freeradius it was working well.Now I wanted to make it work with my sql.My distro is redhat9 and I am using the version mysql-3.23.54a-11.rpm.Free radius was working and authenticating user.But after configuring the files to make it work with sql it is not working well.It gave me the following errors.I did exactly that was defined in the resources.Like in the forum section of chillispot.org .Tutorial was posted by barteki. And other sites as well. root@chillispot rlm_sql_mysql]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded SQL Counter Module: Instantiated sqlcounter (noresetcounter) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded SQL rlm_sql (sql): Could not link driver rlm_sql_mysql: file not found rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed. Can any one point me to a correct lane. Thanking you

5 11

Please resend this message to Kim Jones'
by Kim 31 May '05

31 May '05

Please resend this message to Kim Jones' new email address. Thank You. kim(a)omegatechinc.com

3 2

Format of Framed-IPv6-Prefix Attribute
by Seema Sirivara 31 May '05

31 May '05

Hi, Can anybody please let me know the usage format of Framed-IPv6-Prefix attribute. I need to use in a user file record, but radius does not seem to send out the correct address. The attribute is of type octets and hence I cannot specify the Prefix in standard IPv6 address format.. (Ex - 3001::1 etc) I am using FreeRADIUS Version 0.9.3. Thanks, /Seema __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Authenticating Active Directory users via LDAP
by Pete Flynt 31 May '05

31 May '05

Hello, My network environment looks like the following: WinXP client --- Cisco Switch --- FreeRadius Server --- DC(Active Directory) I am able to authenticate the WinXP client with the local users file and EAP. Now I want FreeRadius to lookup the user credentials in Active Directory. I configured the LDAP modules and I am able to access Active directory for username lookup but the authentication fails because of the password that cannot be supplied in cleartext. The problem is, that I must use EAP because of 802.1X between the switch and the WinXP client. How can I solve this issue? I have read somewhere about how to modify FreeRadius source code in order to get EAP working with AD. I would appreciate a simpler solution. Any suggestion? Here is some output of radiusd: rlm_ldap: - authorize rlm_ldap: performing user authorization for pete radius_xlat: '(sAMAccountName=pete)' radius_xlat: 'cn=Users, dc=testdc' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=Users, dc=testdc, with filter (sAMAccountName=pete) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user pete authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Login incorrect: [pete] (from client 192.168.33.44 port 0 cli 00-11-43-5c-77-d6) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Regards, Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

2 1

radius + peap + wifi + mac os x
by Vittore Zen 31 May '05

31 May '05

Hi, I'm using freeradius (+mysql) in a wireless infrastructure with a dozen of linksys WAP54G access point (using AES). Authentication is PEAP with mschapv2. All go right when use Windows clients but no response using Mac Os X clients. Any ideas? Someone says me that MacOsX use a tunnel with md5 nor mschapv2. Note that is server starts with -X no authentication is required from MacOsX client. thanks in advance v.

3 2

Forwarding
by Maxim Hitrov 31 May '05

31 May '05

Hello I have a radius server that receives Access-Requests params from another Server (an application). Application sends an value under one param (Framed-IP-Address), but Radius server are configured to read this value in another param (Calling-Station-Id). So, i need to have something intermediate, that receives value of Framed-IP-Address and sends it to Radius server as Calling-Station-Id. Application and Radius server can't be configured to use the same value in the same request param! Can i use FreeRadius as intermadiate Radius that will change and forward Access-Requests params? Give me some examples, and what i need to read for doing this. Thank you --------------------------------- Do You Yahoo!? Yahoo! Small Business - Try our new Resources site!

2 1