December 2007 - Freeradius-Users - lists.freeradius.org

freeradius and active directory
by Rutger Beyen 20 Dec '07

20 Dec '07

Hello, I'm very glad I found a list like this. I hope some of you can help me with this problem. I want to set up a project with 802.1X, so users accessing my cisco switch first have to log on. I found out that I could use freeradius for this. But what I want to do is verify if the credentials entered by the user (on a WinXP) are correct, by checking with the Active Directory on a Win2003Server. Using Ntlm_auth from the samba server is not an option. I want to access the AD with the ldap protocol for compatibility reasons. Next, I want to place the logged on user is a specific VLAN. So I have to retrieve the user's vlan from the AD. Is there any way to configure freeradius to do so? I would like to base the vlan on the OU of the person in the AD. Can you please provide me with the necessary steps to accomplish this? Thank you very much, Rutger

1 0

Re: Freeradius-Users Digest, Vol 32, Issue 65
by John Ellin 20 Dec '07

20 Dec '07

On December 20, 2007 06:00, freeradius-users-request(a)lists.freeradius.org wrote: > > config is radius + LDAP and worked fine on the old machine but, on the > > new machine it works fine when debugging, but not at all when running as > > a daemon. > > You can run it as a daemon, *and* have extended debugging. Just use > radiusd -xxx. > > > Tried running in debug as radius:radius and still worked, so it doesn't > > appear to be a problem with config directory/file ownership. > > > > Any suggestions would be greatly appreciated... > > Run it as "radiusd -fxxx" from the command line, and see if it works > then. If I run it as -xxx from the command line it works. As soon as I drop the -x it stops working: radiusd -xxx works radiusd -x works radiusd -y doesn't work radiusd doesn't work my default sys V init script has -y. I have changed it to -x and it works, but it is worrying that I didn't have this problem before I moved to the new machine. Also, using -x makes it run in the foreground, whether or not I'm using -f. I'm starting to wonder if the guys at Mandriva have been messing in the code for their distribution... -- Best regards, jona. There's a fine line between being on the leading edge and being in the lunatic fringe. --- Frank Armstrong

2 1

Re: Help w/ pam radius
by Jeff Fishbaugh 20 Dec '07

20 Dec '07

Just thought I would reply to my own thread since I figured it out and probably others can benefit from it.... yes yes yes the variations in distro's PAM implementation will kill you.... that was all it was.... so beware -- knowing your PAM system on your machines is crucial if you don't want to do a lot of head scratching. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug client_id=linux auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so Haven't figured this error out yet... Wed Dec 19 15:50:05 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE _CERT option to allow ...but least I can auth SSH with RADIUS so I am a happy camper. ----- Original Message ----- From: Jeff Fishbaugh To: Jeff Fishbaugh ; freeradius-users(a)lists.freeradius.org Sent: Tuesday, December 18, 2007 5:49 PM Subject: Re: Help w/ pam radius Seems like I am getting closer possibly, but I see an error in radius.log -- could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow. Basically, I go to login to my pam_radius host, user exists in local password file with no pass, user/pass in RADIUS/LDAP, and when I login the SSH session immediately exits and I see the below in radius.log. If I use a login not in the local password file, but it is in RADIUS/LDAP then I get an access denied and no mention of the below error. I am not even starting TLS so why is it even complaining about it??? I am also curious what this means -- rlm_exec: Wait=yes but no output defined. Did you mean output=none? Appreciate any help. Thanks! Tue Dec 18 19:32:48 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Dec 18 19:32:48 2007 : Info: Ready to process requests. Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:35:55 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:36:03 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow ----- Original Message ----- From: Jeff Fishbaugh To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, December 18, 2007 2:13 PM Subject: Help w/ pam radius Hello: I am having trouble getting pam_radius working and was wondering if someone might be of help since I followed the INSTALL instructions as well as a howto (as provided by the Wikid folks) and I am still coming up short getting it working. Here are some of my details - My PAM is such it is by service (Fedora 7 -- 0.99.7.1-5.1)....sshd being what I am most interested in, the default config for it looks like the below on a host I want talking to radius. What does this need to look like in terms of the pam_radius_auth.so related stanzas to get it working? Neither the INSTALL instructions or a howto I found would work. /etc/pam.d/sshd (default below) #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so - My Radius box runs freeradius (freeradius-1.1.7-3.1) with LDAP (fedora-ds) backending it with the user/pass info, got it working for Cisco's but have yet to get PAM working. I just get 'Access denied' -- tried the later with a user defined on the host with no password or with a password and won't work. Pretty simple, no huntgroups or anythig like that just plain and simple binding against LDAP. I think what I am looking for are... 1- Pam configuration on the host (ie- /etc/pam.d/sshd) 2- Pam configuration requirements as far as the radius server is concerned. Be helpful to see what all I might need that I am possibly missing in conf files. Thank you!

2 1

Re: reply from home server
by Дмитрий 20 Dec '07

20 Dec '07

> Edit the source code to update the message that is being printed. > > Alan DeKok. Thanks! Do not prompt where exactly? And why it to not bring at all in the distribution kit?

2 1

Server blown up after move
by John Ellin 20 Dec '07

20 Dec '07

Hi all, Recently had to move free radius 1.1.7 from production server to test/backup server due to failed HD in RAID. config is radius + LDAP and worked fine on the old machine but, on the new machine it works fine when debugging, but not at all when running as a daemon. Output from netstat -l shows that the server is listening on the correct ports on the ('listen'ed) sockets when running as a daemon: [root@nw raddb]# netstat -l | grep radius udp 0 0 nw.4ccompany.com:radius *:* udp 0 0 nw.4ccompany.com:radius *:* udp 0 0 nw.4cco:radius-acct *:* udp 0 0 nw.4cco:radius-acct *:* (doubling up is for lo and eth0) (also tried 'bind_address = *') however output from radtest is: [...] Re-sending Access-Request of id 218 to 192.168.0.16 port 1812 User-Name = "john" User-Password = "removed" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 radclient: no response from server for ID 218 and nothing appearing in radius.log. Using radiusd -X: [root@nw raddb]# radtest john removed 192.168.0.16 0 also_removed Sending Access-Request of id 14 to 192.168.0.16 port 1812 User-Name = "john" User-Password = "removed" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 192.168.0.16:1812, id=14, length=20 Tried running in debug as radius:radius and still worked, so it doesn't appear to be a problem with config directory/file ownership. Any suggestions would be greatly appreciated... Best regards, jona.

3 2

reply from home server
by Дмитрий 20 Dec '07

20 Dec '07

Good afternoon! How to force radius to write from who exactly has not received the answer? tcpdump I see, that inquiries leave, but do not come, and in a broad gully of radius I do not see to whom it sends these inquiries... [oracle@tim6a-aaa0 raddb]$ cat /usr/local/var/log/radius/radius.log | grep Rejecting Sun Dec 2 20:58:18 2007 : Error: Rejecting request 47108 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 20:59:01 2007 : Error: Rejecting request 47114 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 20:59:32 2007 : Error: Rejecting request 47118 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 21:00:05 2007 : Error: Rejecting request 47128 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 21:01:35 2007 : Error: Rejecting request 47137 due to lack of any response from home server tim6a-pdsn0:1645 Sun Dec 2 21:03:28 2007 : Error: Rejecting request 47150 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 5 11:43:15 2007 : Error: Rejecting request 2 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 5 11:45:01 2007 : Error: Rejecting request 15 due to lack of any response from home server localhost:10083 Fri Dec 7 08:20:18 2007 : Error: Rejecting request 5055 due to lack of any response from home server pcf:1812 Fri Dec 7 08:20:59 2007 : Error: Rejecting request 5058 due to lack of any response from home server pcf:1812 Mon Dec 10 12:37:50 2007 : Error: Rejecting request 12 due to lack of any response from home server pcf:1812 Mon Dec 10 12:38:43 2007 : Error: Rejecting request 19 due to lack of any response from home server pcf:1812 Mon Dec 10 12:41:32 2007 : Error: Rejecting request 48 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 19 15:29:37 2007 : Error: Rejecting request 38 due to lack of any response from home server tim6a-pdsn0:1645 Wed Dec 19 15:31:12 2007 : Error: Rejecting request 68 due to lack of any response from home server localhost:11611 Thu Dec 20 10:42:51 2007 : Error: Rejecting request 64 due to lack of any response from home server tim6a-pdsn0:1645 Thu Dec 20 10:45:07 2007 : Error: Rejecting request 107 due to lack of any response from home server tim6a-pdsn0:1645 But home server is not tim6a-pdsn0, home server is another host Сысоев Дмитрий Александрович Сетевой администратор Отдел информационных технологий ЗАО ''Ульяновская Сотовая Связь'' Тел.: +7 (901) 947 17 31 Моб.: +7 (901) 947 02 71 Факс: +7 (8422) 43 51 99

2 1

RE: SALE 70% OFF on Pfizer
by VIAGRA � Official Site 19 Dec '07

19 Dec '07

1 0

Can I get group-name from Active-directory?
by Hangjun He 19 Dec '07

19 Dec '07

FreeRADIUS 1.1.6 + samba-tools + active-directory. Can I get user's group-name by rlm_ldap? How? Following is result of ldap-search.(Using ldap client) # Paul Le, Users, test.com dn: CN=Paul Le,CN=Users,DC=test,DC=com objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user cn: Paul Le sn: Levasseur distinguishedName: CN=Paul Le,CN=Users,DC=test,DC=com instanceType: 4 whenCreated: 20061118204047.0Z whenChanged: 20061120041505.0Z displayName: Paul Levasseur uSNCreated: 53309 memberOf: CN=WirelessUsers,CN=Users,DC=test,DC=com uSNChanged: 61454 name: Paul Levasseur objectGUID:: TWcfmIP0S0KptrqNYMartA== userAccountControl: 512 badPwdCount: 1 codePage: 0 countryCode: 0 badPasswordTime: 128083593151710000 lastLogoff: 0 lastLogon: 0 pwdLastSet: 128084630849843750 primaryGroupID: 513 userParameters:: bTogICAgICAgICAgICAgICAgICAgIGQJICAgICAgICAgICAgICAgICAgICAgI CAg objectSid:: AQUAAAAAAAUVAAAAFhovX/CrURQfMAbsYQQAAA== accountExpires: 9223372036854775807 logonCount: 0 sAMAccountName: paull sAMAccountType: 805306368 msNPAllowDialin: TRUE --------------------------------- 天生购物狂，狂抢购物券，你还等什么！

2 3

problem ./configure and MYSql
by Miha Bièek 19 Dec '07

19 Dec '07

Hi I am having troubles setting freeRadius to work with MySql. I 've studied the FAQ at: http://wiki.freeradius.org/index.php/FAQ#It_says_.22Could_not_link_..._file…, followed the instructions but I still can't get it to work. I'm using mysql-5.0.45-linux-i686-glibc23. I just unpacked it to /usr/local ,added a symbolic refference to it (ln -s /usr/local/mysql-5.0.45-linux-i686-glibc23 mysql) and ran the script to set up the database scripts/mysql_install_db --user=mysql. I didn't bother setting up the radius database but that shouldn't matter at this stage. location of mysql_congig: /usr/local/mysql/bin Other configuration: ubuntu linux 6.06.1 on VMWare Player, the latest version of freeRadius from cvs. //I set the path variable so it has the right path in it: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games:/usr/local/mysql/bin //To make sure: miha@virtubuntu:~/radiusd$ echo $PATH /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/bin/X11:/usr/games:/usr/local/mysql/bin miha@virtubuntu:~/radiusd$ export PATH //the tutorial suggest i should do a export //$PATH, but that doesnt work miha@virtubuntu:~/radiusd$ sudo ./configure | grep mysql_config //it outputs several lines, including unpopular: checking for mysql_config... no configure: WARNING: mysql libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: mysql headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: sql submodule 'mysql' disabled //I also tried to use it with lib dir and include-dir: miha@virtubuntu:~/radiusd$ sudo ./configure --with-mysql-lib-dir=/usr/local/mysql/lib -with-mysql-include-dir=/usr/local/mysql/include | grep mysql_config //Result: checking for mysql_config... no configure: WARNING: mysql headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: sql submodule 'mysql' disabled //so it still doesn't find include dir?? Am I missing something ? Please HELP, i'm running out ideas, time and luck. Is it possible that the problem lies in the compiler ? I installed g++, because i was having troubles with gcc. I can change the OS or Mysql version if that is the problem. The official page says that freeRadius works "out of the box" with MySql. Does anyone know a configuration that works ? Miha Bicek ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

With_nt_domain_hack +XPSup +LDAP
by Dow, Corey 19 Dec '07

19 Dec '07

Hi All, I'm trying to setup an XP supplicant that authenticates through my NAS to an OpenLDAP server. The problem is that the native authentication provided by MS shows the user as MYDOMAIN\\user or MYPC\\user. As a result, the LDAP searches fail to find this user. The radiusd.conf file shows with_nt_domain_hack as a way to strip this. I tried this and it works for MD5 but not for PEAP. With PEAP, there is a notification that the eap identity doesn't match. Can someone point me to how to correctly configure this? The radiusd.conf states to use the realm module instead of with_nt_domain_hack, but I couldn't figure out how to set it up properly. I apologize if this has been covered before. I searched but couldn't find anything definitive. An example would be greatly appreciated. Thanks, Corey Corey Dow Solution Test Center Engineer ProCurve Networking Hewlett-Packard Company 8000 Foothills Blvd. (MS 5549) Roseville, CA 95747 Tel : 1-916-785-8003

2 1