October 2006 - Freeradius-Users - lists.freeradius.org

Active Directory with NTLM_AUTH
by duckeo 13 Oct '06

13 Oct '06

Okay I've been following the Wiki for Active Directory Integration but now I'm stuck. I'm successful at getting the machine to join the AD with Samba3, I have NTLM_AUTH working from the command line to challenge for the user and return successful. Next part is getting FreeRadius to use this information. The end result is that I am using a Dial Up adapter within Windows to talk to radius, so I want the default Windows settings of MSCHAP to work first (means I have to customise the client end less). What (if anything) do I need to do to the users file? I also need to check that the user is a member of a particular group in Active Directory before Access-Accept is sent - do I fall back to LDAP for this? I have had LDAP only working with PAP, but am stuck with getting it to work with MS-CHAP.

1 0

RE: Help: How to authenticate additional attribute
by Garber, Neal 13 Oct '06

13 Oct '06

> I would like to authenticate the client with its location coordinate You didn't provide much information about what a "location coordinate" is and how you would determine whether you would allow/deny access. Is this where the user is located geographically? Do you want them to enter it or should it be derived?

1 0

Help: How to authenticate additional attribute
by Chew, Heng Hui (Andy) FORNATL, SN 12 Oct '06

12 Oct '06

Hi, I am running FreeRadius to authenticate with a WinXP SP2 client using PEAP on WPA2. However, in addition to the normal username and password authentication, I would like to authenticate the client with its location coordinate i.e. the authentication will be based on username, password and location coordinate. I understand that WinXP provides a dialog box that allows me to input the username and password. Can I use the domain field to input the location coordinate? If this is possible, what must be configured or done to the FreeRadius so that it may authenticate this additional attribute? Do I need to modify the source code? Is there anybody who may advice me on this? Thanks. With Regards, Chew Heng Hui Andy

1 0

Help returning multiple values for attrbute (rlm_ldap)
by Owen DeLong 12 Oct '06

12 Oct '06

OK... The suggestion I got here last night allowed me to get basic auth working as desired, however, I have another problem. I need to return in the reply a series of values for a given attribute, such as: dn: uid=foo,ou=people,dc=zone,dc=example,dc=com uid: foo Attribute: first_value Attribute: second_value Attribute: third_value I have LDAP Attribute mapped to Radius-Attribute in the ldap.attrmap. However, when I query the server, I get back: Radius-Attribute: first-value And the second and third values are not returned. Is there a way to make this work? Thanks, Owen

2 2

RE: Any luck with 802.1x authentication using TTLS with MSCHAPv2 ?
by Mak Moussa 12 Oct '06

12 Oct '06

Hi, I would appreciate any insight into the 802.1x authentication using TTLS with MSCHAPv2. Such auth scheme is constantly failing in my wireless setup with FreeRadius. I tried 3 versions v1.0.5, v1.1.2 and v1.1.3 with not much luck. The following authentication schemes worked fine: 1. TTLS w/ MSCHAP from my wireless client to freeradius v1.0.5, v1.1.2, v1.1.3 2. PEAP w/ MSCHAPv2 with same wireless client to same freeradius versions. 3. TTLS w/ MSCHAPv2 from the same wireless setup to an SBR v5.3 The freeradius debug does indicate successful auth and both MPPE keys sent to the client. modcall[authenticate]: module "mschap" returns ok for request 17 modcall: leaving group MS-CHAP (returns ok) for request 17 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 17 modcall: leaving group authenticate (returns ok) for request 17 Sending Access-Accept of id 21 to 172.16.10.254 port 32777 MS-MPPE-Recv-Key = 0x6a72b3417ed819d9e4d3e5fa8867d1d8211c41941fe2035d33f24b906b3b4406 MS-MPPE-Send-Key = 0x29098f385530c131460af68bc229719d9b5b1dea1e70a783f89acac8ea17aa17 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "Moussa" Finished request 17 However, the client debug shows wpa msg 1 was dropped as follows: 22:53:12.156 ++ EAPOL message received 22:53:12.156 Message dequeued 22:53:12.156 [DTL] Received EAPOL packet 00000000: 01 03 00 5F FE 00 89 00 20 00 00 00 00 00 00 00 ..._.... ....... 00000010: 01 1F 74 D9 48 45 D8 28 4E 3C E4 B3 0B D4 59 3D ..t.HE.(N<....Y= 00000020: 04 C0 20 9B 00 3A 81 5D EE 4D 90 F1 96 63 98 7B .. ..:.].M...c.{ 00000030: E5 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00000060: 00 00 00 ... 22:53:12.156 [NRM] Processing EAPOL-Key message 22:53:12.156 [DTL] Received replay counter is 0000000000000001 22:53:12.156 [DTL] EAPOL-Key message version = 1 22:53:12.156 [NRM] Processing EAPOL-Key 4-way handshake message 1 22:53:12.156 [NRM] Setting master session key(s) 22:53:12.156 [ERR] Cannot set master key: authentication not complete or method does not support session keys 22:53:12.156 [ERR] EAPOL-Key pairwise key message 1 discarded: no PMK If I made a freeradius configuration mistake, TTLS with mschap wouldn't work. Any help is very much appreciated. Mak

7 16

RE: windows login using freeradius?
by Garber, Neal 12 Oct '06

12 Oct '06

> if yes, can we guide me to some related materials? http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO

3 2

Securew2
by Alessandro Agostini 12 Oct '06

12 Oct '06

Hi to all, anybody know what's happening to securew2 site? It is down from a few of week ago. Does it disappeared? Thanks A.Agostini

3 2

RE: Securew2
by Garber, Neal 12 Oct '06

12 Oct '06

> anybody know what's happening to securew2 site? > It is down from a few of week ago. They sent an E-mail stating that it moved. Try: http://securew2.alfa-ariss.com/uk/index.htm

1 0

proxy realm
by Nicola Iotti 12 Oct '06

12 Oct '06

Hi all, sorry...another question we use freeradius as proxy. We configured a suffix realm based proxy with delimiter character "/". If there is a username like this : "user/test/server1" (I mean with more than one "/") which one of "/" does freeradius consider as suffix delimiter ? Thank you.

1 0

Dialupadmin Problems
by Andy Dixon 12 Oct '06

12 Oct '06

Hello, I am having problems getting dialupadmin to work on FreeBSD 6.1. If I go to any of the pages (eg add user) I just get a blank screen.. Also, if anyone could point me in the direction of where I can find some information on what needs to go into the tables in a postgres database for RADIUS users, I would be greatful. Thanks

3 7