October 2006 - Freeradius-Users - lists.freeradius.org

freeradius and ntlm_auth howto
by Stieven.Struyf＠komatsu.eu 27 Oct '06

27 Oct '06

All, I am trying to authenticate my wifi users via our AD. I'm finding bits and pieces on the internet to configure things, but no completely usable howto. Can someone of the users look at the ouput below and point me to the correct solution/howto? I setup smb.conf,krb5.conf and freeradius. I joined the server to the domain and tested the connection with ntlm_auth: [root@belx11ke ~]# /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --domain=KMT-EU.KMTG.NET password: NT_STATUS_OK: Success (0x0) [root@belx11ke ~]# rights of the winbind pipe: ls -l /var/cache/samba/winbindd_privileged total 0 srwxrwxrwx 1 root root 0 Oct 25 14:46 pipe below is the debug output of freeradius Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d45552e4b4d54472e4e45545c73737472757966 PEAP: Setting User-Name to KMT-EU.KMTG.NET\sstruyf PEAP: Adding old state with a4 c3 PEAP: Sending tunneled request EAP-Message = 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d45552e4b4d54472e4e45545c73737472757966 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "KMT-EU.KMTG.NET\\sstruyf" State = 0xa4c337a92357e8d90a5f8c64b37d2df1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "KMT-EU.KMTG.NET\sstruyf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "kmt-eu.kmtg.net" returns noop for request 7 rlm_realm: Looking up realm "KMT-EU.KMTG.NET" for User-Name = "KMT-EU.KMTG.NET\sstruyf" rlm_realm: Found realm "KMT-EU.KMTG.NET" rlm_realm: Adding Stripped-User-Name = "sstruyf" rlm_realm: Proxying request from user sstruyf to realm KMT-EU.KMTG.NET rlm_realm: Adding Realm = "KMT-EU.KMTG.NET" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 82 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched sstruyf at 98 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? rlm_mschap: Told to do MS-CHAPv2 for KMT-EU.KMTG.NET\sstruyf with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 95 rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challeng e=7b634e5c9dd73ddc --nt-response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=7b634e5c9dd73ddc --nt-response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. Login incorrect: [KMT-EU.KMTG.NET\\sstruyf/<no User-Password attribute>] (from client localhost port 0) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 7 Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551

5 10

HP-UX and AIX pam_radius problem
by Arthur Caetano 27 Oct '06

27 Oct '06

hi everybody, i have a problem with radius module for PAM. When i compile the source of pam_radius-1.3.16.tar, i got a lot of erros. I applied patch's available in the list, but the problems persists. In the HP-UX enviroments the messages are: begin -------------------- [root] patch_pam_radius> make gcc -z -fPIC -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function 'talk_radius': pam_radius_auth.c:885: warning: passing argument 6 of 'recvfrom' from incompatible pointer type pam_radius_auth.c: In function 'rad_converse': pam_radius_auth.c:1021: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1024: warning: passing argument 2 of 'conv->conv' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_authenticate': pam_radius_auth.c:1076: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1104: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1118: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1151: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_setcred': pam_radius_auth.c:1247: warning: passing argument 3 of 'pam_get_data' from incompatible pointer type pam_radius_auth.c: In function 'pam_private_session': pam_radius_auth.c:1272: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1293: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_chauthtok': pam_radius_auth.c:1379: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1400: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1414: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type gcc -z -fPIC -c md5.c ld -b pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so patch_pam_radius> end ------------------------ Apparently it compels but the pam_radius_auth.so not work, it causes a problem in sshd, follow the error: sshd[20783]: reverse mapping checking getaddrinfo for xxxxx.xxxxx.xxx - POSSIBLE BREAKIN ATTEMPT! I Apply this patch for HP-UX: ======================================================================= Begin output listing from diff -u ======================================================================= diff -u clean/pam_radius-1.3.16/Makefile pam_radius-1.3.16/Makefile --- clean/pam_radius-1.3.16/Makefile 2003-09-19 10:41: 45.000000000 -0400 +++ pam_radius-1.3.16/Makefile 2003-12-23 11:21:26.000000000 -0500 @@ -15,7 +15,10 @@ # # If you're not using GCC, then you'll have to change the CFLAGS. # -CFLAGS = -Wall -fPIC +#CFLAGS = -Wall -fPIC +# Added by jl 12/09/2003 for HP-UX +CFLAGS = +DAportable +DSPA7100 +z +# End Add jl # # On Irix, use this with MIPSPRo C Compiler, and don't forget to export CC=cc # gcc on Irix does not work yet for pam_radius @@ -55,7 +58,10 @@ # gcc -shared pam_radius_auth.o md5.o -lpam -lc -o pam_radius_auth.so # pam_radius_auth.so: pam_radius_auth.o md5.o - ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so +# ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so +# Added by jl 12/09/2003 for HP-UX + ld -b pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so +# End add jl ###################################################################### # diff -u clean/pam_radius-1.3.16/md5.c pam_radius-1.3.16/md5.c --- clean/pam_radius-1.3.16/md5.c 2002-06-28 02:29:21.000000000 -0400 +++ pam_radius-1.3.16/md5.c 2004-01-12 11:58:22.000000000 -0500 @@ -43,6 +43,12 @@ #define HIGHFIRST #endif +/* 01/12/2004 jl - Added for HPUX compiles */ +#ifdef _INCLUDE_HPUX_SOURCE +#define HIGHFIRST +#endif +/* END jl */ + #ifndef HIGHFIRST #define byteReverse(buf, len) /* Nothing */ #else diff -u clean/pam_radius-1.3.16/md5.h pam_radius-1.3.16/md5.h --- clean/pam_radius-1.3.16/md5.h 2003-04-29 16:19:16.000000000 -0400 +++ pam_radius-1.3.16 /md5.h 2003-12-16 11:33:55.000000000 -0500 @@ -15,7 +15,10 @@ #define MD5Transform pra_MD5Transform #include <sys/types.h> -#define uint32 u_int32_t +/* Added by jl */ +/* #define u_int32_t unsigned int */ +/* #define uint32 u_int32_t */ +#define uint32 uint32_t struct MD5Context { uint32 buf[4]; Only in pam_radius-1.3.16: md5.o diff -u clean/pam_radius-1.3.16/pam_radius_auth.c pam_radius-1.3.16 /pam_radius_auth.c --- clean/pam_radius-1.3.16/pam_radius_auth.c 2003-02-27 13:01:07.000000000 -0500 +++ pam_radius-1.3.16/pam_radius_auth.c 2004-01-12 12:00:52.000000000 -0500 @@ -58,6 +58,11 @@ #ifdef sun #include <security/pam_appl.h> #endif +/* Added by jl 12/09/2003 */ +#ifdef _INCLUDE_HPUX_SOURCE +#include <security/pam_appl.h> +#endif +/* End add jl */ #include <security/pam_modules.h> #include "pam_radius_auth.h" diff -u clean/pam_radius-1.3.16/pam_radius_auth.h pam_radius-1.3.16/pam_radius_auth.h --- clean/pam_radius-1.3.16/pam_radius_auth.h 2003-09-19 10:41:32.000000000 -0400 +++ pam_radius-1.3.16/pam_radius_auth.h 2003-12-09 10:20:29.000000000 -0500 @@ -66,6 +66,11 @@ */ #define CONST const #else +/* Added by jl 12/09/2003 */ +#ifdef _INCLUDE_HPUX_SOURCE +#define PAM_EXTERN extern +#endif +/* End add jl */ #define CONST const #endif ======================================================================= End output listing from diff -u ======================================================================= In AIX i applied this modifications in md5.h, md5.c and pam_radius_auth.h - change to the md5.h file. Change line 18 from: #define uint32 u_int32_t to #define uint32 uint32_t - in md5.c, insert to line 38 (before any #include lines) #define __sparc - in pam_radius_auth.h, line 60, insert after the comment section but before "#ifdef sun": #define sun the output for the command cc -z -fPIC -c md5.c -o md5.o it's ok. No errors. the output for the command cc -z -fPIC -c pam_radius_auth.c -o pam_radius_auth.o. the following ones: pam_radius_auth.c: In function `talk_radius': pam_radius_auth.c:880: warning: passing arg 6 of `nrecvfrom' from incompatible pointer type pam_radius_auth.c: In function `rad_converse': pam_radius_auth.c:1016: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1019: warning: passing arg 2 of pointer to function from incompatible pointer type pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1071: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1099: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1113: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1146: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_setcred': pam_radius_auth.c:1242: warning: passing arg 3 of `pam_get_data' from incompatible pointer type pam_radius_auth.c: In function `pam_private_session': pam_radius_auth.c:1267: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1288: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_chauthtok': pam_radius_auth.c:1374: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1395: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1404: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing arg 3 of `pam_get_item' from incompatible pointer type When i try the ld: ld -G md5.o pam_radius_auth.o -o pam_radius_auth.so the following ones occurs: ld: 0711-327 WARNING: Entry point not found: __start ld: 0711-244 ERROR: No csects or exported symbols have been saved. I'm really need of this solution. Somebody can help me, with this problems??? -- Arthur

1 0

RE: freeradius and ntlm_auth howto
by Garber, Neal 27 Oct '06

27 Oct '06

Did you notice the response from ntlm_auth: Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=decc4450c3b83d2c --nt-response=1af36673f68f926b4cc76bf8cd9f440d0c36396981ad345 Exec-Program output: Logon failure (0xc000006d) This indicates an invalid username or password. Try running "/usr/bin/ntlm_auth --username=sstruyf" and entering the same password you used in your previous test when prompted. Is the username correct? Is samba going to the correct domain by default? Did you enter the correct password? If you can't authenticate from the command line, you won't be able to do so from freeradius either.

2 1

Re: openldap+freeradius+Cisco
by jerrrry＠voila.fr 27 Oct '06

27 Oct '06

OK it works fine now with this in the users file: Robert Auth-Type = LDAP service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=1" but it is said in radius.conf not to use Auth-Type = LDAP. so is there an other solution to add this attributes in reply. Thomas > Message du 27/10/06 à 10h27 > De : "jerrrry(a)voila.fr" > A : freeradius-users(a)lists.freeradius.org > Copie à : > Objet : openldap+freeradius+Cisco > > Hi, I'm trying to authenticate and authorize Cisco routers administrators But not the autorization (privilege level). so not when i add "aaa authorization exec default group radiusvrf if-authenticated" to the cisco router to be able to manage privileges with radius. to make it work, i think i need to configure Service-Type and cisco-avpair attributes for each user to get the autorization from the cisco router. I want to configure this attributs in freeradius, not in openldap. So, is it possible to add this attributes to a specific user in the raddb/users file after he has been authenticated by ldap ? or i must do it differently ? in raddb/radiusd.conf: > authorize { > preprocess > files > ldap > } > > authenticate { > Auth-Type PAP { > pap > } > Auth-Type LDAP { > ldap > } > } I tried with a user and a DEFAULT user: raddb/users: > Robert Service-Type = NAS-Prompt-User > cisco-avpair = "shell:priv-lvl=1" > > DEFAULT Service-Type = NAS-Prompt-User > cisco-avpair = "shell:priv-lvl=1" > but this attributs seem not to be send to the routeur. when ldap is authorize in radiusd.conf, the users file is not check anymore ? Thanks for your help Thomas > > [ (pas de nom de fichier) (0.1 Ko) ]

1 0

radius + mysql problem
by balijepalli srikrishnamohan 27 Oct '06

27 Oct '06

Hello all, I am trying to configure freeradius with mysql. I did the relevent changes in radiusd.conf and when i start the server in debug mode, it is giving an error: "rlm_sql (sql): Could not link driver rlm_sql_mysq: file not found rlm_sql (sql): Make sure it (all its dependent libraries) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed." Here are the changes i made in radiusd.conf file: sqltrace=yes uncommented the line sql in Authorize section. commented the line sql in preacct section. uncommented the line sql in accounting section. Created the radius database using the schema in the file db_mysql.sql. Wht can be problem with configuration.Pls clarify any other config changes required. Thanks in advance. Regards, Sri

2 1

RE: Open access
by Jonathan De Graeve 27 Oct '06

27 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Sean > Verzonden: vrijdag 27 oktober 2006 14:20 > Aan: freeradius-users(a)lists.freeradius.org > Onderwerp: Open access > > Hi, > > I want to grant access to any user or password on my backup server. I > found DEFAULT Auth-Type := Accept in the FAQ, however it gives no hint > as to where to put the code. I've been trying various parts of > raddb.conf with no success. > Place it in users - -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98 -----BEGIN PGP SIGNATURE----- Version: 9.5.0 (Build 1202) wsBVAwUBRUIAydjY2X/BrZGJAQixcgf/Vs9sAwHNdeWNqZBlogAZCw2qXBDDg5s6 gcI8WqcqeALhdESu3oSr3AePbmrcDjZjTIqgGlNFY+Ps44xr15aRLk/kY4lPdI9N cN/Ljw1LxqrmvyI2AVHr+ELrakTWj9BYnhaRr4a/brJWgLKapz+7H7lRjPrhoimh eGgH2JgC7x4lkyWB28O/19qUR9qi/M43uSd07YxwegC8VYdtz47x5aA+uQtRt4wS lf3ZV0QHW3THMzhR1YifmDUDSWJW12fMh2D2m14mjI3+dpF005F5lzi9mpLRZ4fx Nse6gFOoEO3S6tWtn8awb0vaQMT9B5qTZl6G0v0ovymBTJP8llbtrA== =vRRD -----END PGP SIGNATURE-----

1 0

Open access
by Sean 27 Oct '06

27 Oct '06

Hi, I want to grant access to any user or password on my backup server. I found DEFAULT Auth-Type := Accept in the FAQ, however it gives no hint as to where to put the code. I've been trying various parts of raddb.conf with no success. Any help appreciated as usual. Sean Bracken

1 0

FW: SIGSEGV SEGV_MAPERR
by Barry A Byrne 27 Oct '06

27 Oct '06

[Apologies, I may have sent this before from the wrong mail-box] Hello I am running the Blastwave packaging of Freeradius 1.0.1 on Solaris 8, sparc. This interfaces with MySQL version 4.0.18-log, built from source. The RADIUS server inexplicably terminates with no core dump or logged messages The tail of a truss log shows bash-2.05# grep SEGV_MAPERR truss.log | wc -l 1766 bash-2.05# tail -20 truss.log 10471/6: 978.8120 Incurred fault #6, FLTBOUNDS %pc = 0xFED714F4 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8121 Received signal #11, SIGSEGV [caught] 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8123 sigprocmask(SIG_SETMASK, 0xFF17CFB8, 0x00000000) = 0 10471/6: 978.8124 sigprocmask(SIG_SETMASK, 0xFF188CE0, 0x00000000) = 0 10471/6: 978.8125 setcontext(0xFE702CD0) 10471/6: 978.8127 Incurred fault #6, FLTBOUNDS %pc = 0xFED714F4 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8128 Received signal #11, SIGSEGV [caught] 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8130 sigprocmask(SIG_SETMASK, 0xFF17CFB8, 0x00000000) = 0 10471/6: 978.8131 sigprocmask(SIG_SETMASK, 0xFF188CE0, 0x00000000) = 0 10471/6: 978.8132 setcontext(0xFE702CD0) 10471/6: 978.8134 Incurred fault #6, FLTBOUNDS %pc = 0xFED714F4 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8135 Received signal #11, SIGSEGV [caught] 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8137 sigprocmask(SIG_SETMASK, 0xFF17CFB8, 0x00000000) = 0 10471/1: 978.8140 _exit(1) It got into a SEGV_MAPERR 1766 times while I had it under truss... This error is superficially similar to the one reported by Terry J Fike Jr in July 2004, but here the server exits voluntarily. Has this problem been encountered before? What further investigation should I do? Thank you, Barry Barry A Byrne Network Applications and Public Services Cable & Wireless

1 0

FR with AD authentication not working
by Karthik R 27 Oct '06

27 Oct '06

Using freeradius v1.1.1 on a RHEL 4 box trying to authenticate users against Windows 2003 Active directory. I was able to bind linux box to Windows domain successfully and able to read the active directory users and groups using wbinfo - u R1\Administrator R1\Guest and wbinfo -g. Using ntlm_auth tool am able to successfully authenticate the users too. -bash-3.00# ntlm_auth --request-nt-key --username=kartthikr password: NT_STATUS_OK: Success (0x0) But while using radtest tool with the same logon credentials as above it rejects the user and here is the log message. But I didnt find logon success failure in AD when i checked event viewer. rad_recv: Access-Request packet from host 127.0.0.1:32927, id=243, length=61 User-Name = "<removed>" User-Password = "<removed>" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "<removed>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 243 to 127.0.0.1 port 32927 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 243 with timestamp 45413139 Nothing to do. Sleeping until we see a request. Here is nss config file: passwd: files winbind shadow: files winbind group: files winbind hosts: files winbind nis dns protocols: files winbind # nis services: files winbind # nis netgroup: files winbind # nis automount: files winbind nis Here is radiusd.conf file: modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } So aint sure what am i missed here, any help will be appreciated.

2 1

openldap+freeradius+Cisco
by jerrrry＠voila.fr 27 Oct '06

27 Oct '06

Hi, I'm trying to authenticate and authorize Cisco routers administrators But not the autorization (privilege level). so not when i add "aaa authorization exec default group radiusvrf if-authenticated" to the cisco router to be able to manage privileges with radius. to make it work, i think i need to configure Service-Type and cisco-avpair attributes for each user to get the autorization from the cisco router. I want to configure this attributs in freeradius, not in openldap. So, is it possible to add this attributes to a specific user in the raddb/users file after he has been authenticated by ldap ? or i must do it differently ? in raddb/radiusd.conf: authorize { preprocess files ldap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } I tried with a user and a DEFAULT user: raddb/users: Robert Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=1" DEFAULT Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=1" but this attributs seem not to be send to the routeur. when ldap is authorize in radiusd.conf, the users file is not check anymore ? Thanks for your help Thomas

1 0