June 2009 - Freeradius-Users - lists.freeradius.org

LDAP Auth
by Dave Rummel 05 Jun '09

05 Jun '09

First off I am totally new to radius...but really love the concept. I have radius working with ldap to authorize the user if they are in the corporate directory, o=lookout. My next step is to filter it by category to the NAS device. I have been looking at quite a few examples, but nothing seems to stick. In order for me to just grasp the concept, I have tried this in the users file, o=lookout is our complete list of all of our users DEFAULT Huntgroup-Name == CiscoAdmin, Ldap-Group == "o=lookout" Fall-Through = no DEFAULT Auth-Type := Reject If I comment out the Reject, the user is able to authenticate to the Cisco Router, as soon as uncomment it out, I get rejected...here is the log file from it. Thu Jun 4 16:15:52 2009 : Info: [ldap] user daverummel authorized to use remote access Thu Jun 4 16:15:52 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Jun 4 16:15:52 2009 : Info: ++[ldap] returns ok Thu Jun 4 16:15:52 2009 : Info: ++[expiration] returns noop Thu Jun 4 16:15:52 2009 : Info: ++[logintime] returns noop Thu Jun 4 16:15:52 2009 : Info: Found Auth-Type = Reject Thu Jun 4 16:15:52 2009 : Info: Auth-Type = Reject, rejecting user Thu Jun 4 16:15:52 2009 : Info: Failed to authenticate the user. Thu Jun 4 16:15:52 2009 : Auth: Login incorrect: [daverummel] (from client R1 port 98 cli 216.103.190.220) Thu Jun 4 16:15:52 2009 : Info: Using Post-Auth-Type Reject Thu Jun 4 16:15:52 2009 : Info: +- entering group REJECT {...} Thu Jun 4 16:15:52 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> daverummel Thu Jun 4 16:15:52 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jun 4 16:15:52 2009 : Info: ++[attr_filter.access_reject] returns updated Thu Jun 4 16:15:52 2009 : Info: Delaying reject of request 0 for 1 seconds Thu Jun 4 16:15:52 2009 : Debug: Going to the next request Thu Jun 4 16:15:52 2009 : Debug: Waking up in 0.9 seconds. Thu Jun 4 16:15:53 2009 : Info: Sending delayed reject for request 0 The line I am really trying to understand is this one, where is this line 11 ? *Thu Jun 4 16:15:52 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 *Thanks for your help Dave

2 1

dealing with 'corrupt' detail file
by A.L.M.Buxey＠lboro.ac.uk 05 Jun '09

05 Jun '09

hi, okay. so i've been preaching that people use eg the buffered-sql virtual machine rather than do accounting DB entries 'live' - therefore giving the admin better FR performance with slower DBs etc... however, I've been approached today by someone who has a rather large detail file (few gigs) that has 'corrupt' records in it... eg entries with no Acct-Status-Type set (broken NAS, duff RADIUS server or possibly attrbute filtering along the path)...anyway, my first though was edit the accouting stanza of buffered-sql so that it looks like if(Acct-Status-Type){ sql } instead of just calling sql and borking over the lack of Accounting status in the packet. but, of course, whilst this stop the bork, it also stops the ingestion of the detail file as it sticks at that point, doesnt flush that entry and move on... so...can anyone info me the magic or steps to bypass this entry in the detail file so it can continue working on it? the code itself seems to need to go through something before flushing the packet.. ..i expect to then be told there are other broken records too - but i hope a simple solution can deal with all sorts.... then I can get them to ensure that the call to detail is protected in the first place so NULL records etc dont even go in. which reminds me...any best practice from the FR community regarding the detail file and the aforementioned protection from duff NAS etc (I've already got, on my list, use Calling-Station-Id instead of NAS-Port for the unique function as many NAS use the same port for every accounting packet :-|) thanks alan

3 7

How use tagged atrributes?
by R.Filatov＠ttk.ru 05 Jun '09

05 Jun '09

Hello! This construction don't work # radiusd -X FreeRADIUS Version 2.1.6, for host x86_64-unknown-linux-gnu, built on Jun 2 2009 at 23:23:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf ..... attr_rewrite add.service-volume { attribute = "ERX-Service-Volume:1" searchfor = "" searchin = "packet" replacewith = "1000" append = no ignore_case = yes new_attribute = no max_matches = 1 } rlm_attr_rewrite: No such attribute ERX-Service-Volume:1 /usr/local/etc/raddb/modules/attr_rewrite[48]: Instantiation failed for module "add.service-volume" /usr/local/etc/raddb/sites-enabled/default[482]: Failed to find module "add.service-volume". /usr/local/etc/raddb/sites-enabled/default[480]: Errors parsing pre-proxy section. Errors initializing modules May be trouble in my /dev/hands? Best Regards Filatov Ruslan

2 2

Re: Building a test tool
by Vinit Karandikar 04 Jun '09

04 Jun '09

> > ------------------------------ > > Message: 4 > Date: Tue, 02 Jun 2009 00:48:56 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Building a test tool > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A245AD8.4050104(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Vinit Karandikar wrote: > >> Not sure how radclient will help, Tim. >> Based on my limited exposure, I get the impression that I can use >> radclient to simulate 1 network element (like the PDSN). >> I'm trying to simulate 10 different ones simultaneously. >> > > So... run 10 copies of radclient. > That requires a separate manual setup for each of 50 test cases which is bound to be error prone. So if I could run 10 copies of radclient in one process (each in a different thread for example), I can write code to co-ordinate what each thread should do for each test case. > >> As mentioned in my initial email, I need the tool to simulate the PDSN, >> the Pre-Paid Server and hosts of other network elements (possibly 10 >> such like the Foreign AAA, the Carrier Exchange and so on...) >> > > What do those do? Send RADIUS packets? If so, radclient can likely > emulate them. > Some of them receive RADIUS packets and send responses (acting as servers). Others initiate the traffic (acting as clients). Can radclient act as a server ? > >> Am I underestimating what the radclient can do ? >> > > It's not clear what you want out of a RADIUS client. > > radclient simulates a RADIUS client by sending packets, and looking > for responses. If you need different functionality, you need to first > define what that functionality is. > Fair enough. Here are 2 cases that describe the functionality that need a radclient-like network element simulation. Hope this illustrates the functionality I mentioned as desired in my original email. In BOTH cases, the AAA server is expected to forward RADIUS requests to a different network element and it behooves a test application to see both ends. In Case 1, the AAA server proxies the Disconnect Request to a different network element based on the location of the subscriber. In Case 2, the AAA server proxies the Access Requests from different network elements to another network element Case 1: ======= Mother Ship AAA PDSN (new) PDSN (old) | | | | | | (1) Access-Request | | | |<----------------------------| | |(2) Access-Request | | | |<----------------------------| | | |(3) Access-Accept | | | |---------------------------->| | | | |(4) Access-Accept | | | |---------------------------->| | | | | | | | Accounting pieces skipped | | | | | | |(5) Disconnect Request | | | |---------------------------->| | | | |(6) Disconnect Request | | | |---------------------------------------------------------->| | |(7) Disconnect ACK | | | |<----------------------------------------------------------| |(8) Disconnect ACK | | | |<----------------------------| | | | | | | | | Accounting pieces skipped | | | | again | | | | | | OR == Case 2: ======= Mother Ship AAA PDSN HA | | | | | | (1) Access-Request | | | |<----------------------------| | |(2) Access-Request | | | |<----------------------------| | | |(3) Access-Accept | | | |---------------------------->| | | | |(4) Access-Accept | | | |---------------------------->| | | | | | | | PDSN communication with HA skipped | | | | | | (5) Access-Request | | | | related to above accept | | | | in order to get more info | | | |<----------------------------------------------------------| |(6) Access-Request | | | |<----------------------------| | | |(7) Access-Accept | | | |---------------------------->| | | | |(8) Access-Accept | | | |---------------------------------------------------------->| | | | | | | Accounting pieces skipped | | | | yet again | | | | | | The point once again is just to ask if a) there is already a tool that can simulate multiple network elements and co-ordinate between them to know when to expect a packet and when to initiate traffic b) there is re-usable software that I can beat into shape to do such a thing. Thanks again, -Vinit > Alan DeKok. > > > ------------------------------ > > > >

2 1

NTLM Auth Help
by Rupert Finnigan 04 Jun '09

04 Jun '09

Hi All, Wander if someone can help me resolve a problem I'm experiencing.... I'm using FreeRADIUS to provide AAA for 802.1X for wireless in a number of sites. It doesn't need to be 100% up all the time, and so I've got one server back in our central site that handles all the requests over our site-to-site VPNs. The users are stored in either AD, or SQL. SQL is fine, and I've modified the queries to suit my environment. My real problem is with the AD.... I can get it to authenticate users no problems, but not machines. I've got three AD domains I have users in that I need to authenticate: WB-UK, WB-US & WB-AU. These are sub-domains of WB-ROOT, which has no users and is there simple to provide trusts etc. All my users can authenticate fine, as the ms-chap module fills in the nt-domain variable and all is good. However, host authentication fails... I need host authentication to facilitate password expiration messages and changes to keep everyone authenticating OK, and not getting locked out. I'm sure that someones dealt with this before, and so I'd be very grateful for feedback and help. What do I need to supply to ntlm_auth for a machine user name, the "host/machine.domain.local" style, or the "$machine$" style? And, is this a problem best solved by setting the ntlm_auth program variable based on unlang checks against an extracted realm? Or, is there another way to make this all behave? I've tryied using Alan's suggested line on the "how-to" on deployingradius.org, but the "if no nt-domain, use a manually entered default" bit seems to confuse host auth. Many thanks in advance for any help offered, Rupes

3 9

RE: Freeradius-Users Digest, Vol 50, Issue 18
by Marco De Magistris 04 Jun '09

04 Jun '09

Hi Nicolas, >Be careful that using MD5 is not possible with all authenfication >methods: >http://deployingradius.com/documents/protocols/compatibility.html >(as you cannot uncrypt a hash) I'm working on Radius Proxy. The method used for Authentication is EAP-TLS. The server is configured with a certificate for EAP-TLS. As Radius Proxy, I need to send the packet, received from Radius Client, towards Radius Server, with a Message-Authenticator (HMAC-MD5). Home_server function: home_server SERVER1 { ... require_message_authenticator = yes secret = <Shared Secret assigned to RAdiusServer> ... } As Radius Proxy, should I define an authentication protocols? Thanks Regards Marco -----Original Message----- From: freeradius-users-bounces+marco.de.magistris=ericsson.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+marco.de.magistris=ericsson.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: giovedì 4 giugno 2009 13.55 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 50, Issue 18 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: dealing with 'corrupt' detail file (Arran Cudbard-Bell) 2. How use tagged atrributes? (R.Filatov(a)ttk.ru) 3. help HMAC-MD5 (Marco De Magistris) 4. Re: help HMAC-MD5 (Nicolas Goutte) ---------------------------------------------------------------------- Message: 1 Date: Thu, 04 Jun 2009 11:34:59 +0100 From: Arran Cudbard-Bell <a.cudbard-bell(a)sussex.ac.uk> Subject: Re: dealing with 'corrupt' detail file To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4A27A353.3050306(a)sussex.ac.uk> Content-Type: text/plain; charset=UTF-8 -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, >>> (I've already got, on my list, use Calling-Station-Id >>> instead of NAS-Port for the unique function as many >>> NAS use the same port for every accounting packet :-|) >> Create a patch, and send it to the list via git format-patch. "Best >> practices" really need to go into the server configuration. Anything >> else is too frustrating for the end users. > > I was hoping to get a small discussion initiated that would > hopefully bring up a few things that people find they have to do > to their configs ...at the end of which we get a nice comprehensive > list of updates needed for the core server configuration (and hopefully > a large number of 'you need to change this or add that' blog/wiki/random > document entries removed across the world) We write out a different detail file per hour. If for whatever reason the account buffer gets to be big, and you have to restart the server, at least you only have to deal with an hours worth of duplicate accounting logs. And just as Alan DeKok suggested: accounting { # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql { invalid = 2 } if (invalid) { ok } } You can log it to a rejects detail file as well, if you want to dissect the packets later. The other (far more difficult) to handle one, is where you're using this to Proxy eduroam Accounting records back to an ORPS. If the administrator of the ORPS has been particularly... obnoxious. Then the ORPS will not send Accounting-Responses, and the packet will be stuck in the detail file indefinitely. Our workaround is: accounting { # # Icky workaround for lack of universal eduroam accounting support # Really need NRPS to manufacture accounting response. # if((Acct-Delay-Time < 600) || (Realm != 'remote.jrs')){ proxy_to_realm } # # Since we're proxying, we don't log anything # locally. Ensure that the accounting section # "succeeds" by forcing an "ok" return. ok } This sucks, because perfectly valid Accounting Requests might be lost if they were received at around the same time as invalid ones. I'd be interested to hear if anyone has a better solution than the above. Thanks, Arran -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.9 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkono1MACgkQcaklux5oVKKh8ACdHgDLbeRIF6wpJY9boGATfybU AiUAoIsSVWWYt6LUETZ6Ky15Out8Fm+w =cShM -----END PGP SIGNATURE----- ------------------------------ Message: 2 Date: Thu, 4 Jun 2009 15:39:12 +0400 From: R.Filatov(a)ttk.ru Subject: How use tagged atrributes? To: <freeradius-users(a)lists.freeradius.org> Message-ID: <OF1C050F6B.AF15FFDD-ONC32575CB.003FFB82-C32575CB.004003A7(a)ttk.ru> Content-Type: text/plain; charset="us-ascii" Hello! This construction don't work # radiusd -X FreeRADIUS Version 2.1.6, for host x86_64-unknown-linux-gnu, built on Jun 2 2009 at 23:23:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf ..... attr_rewrite add.service-volume { attribute = "ERX-Service-Volume:1" searchfor = "" searchin = "packet" replacewith = "1000" append = no ignore_case = yes new_attribute = no max_matches = 1 } rlm_attr_rewrite: No such attribute ERX-Service-Volume:1 /usr/local/etc/raddb/modules/attr_rewrite[48]: Instantiation failed for module "add.service-volume" /usr/local/etc/raddb/sites-enabled/default[482]: Failed to find module "add.service-volume". /usr/local/etc/raddb/sites-enabled/default[480]: Errors parsing pre-proxy section. Errors initializing modules May be trouble in my /dev/hands? Best Regards Filatov Ruslan

1 0

Checkval
by Vik21 04 Jun '09

04 Jun '09

Hello! I am trying to put checkval to work with radgroupcheck however without success. My problem is that in the radcheck if Calling-Station-Id is not met he rejects the user (just like I want it to do) but in the radgroupcheck if the Calling-Station-Id is not met freeradius send an Access-Accept anyway (I want it to reject). My checkval: checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } Part of my radius log: rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-00-33-B1-88 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} expand: %{User-Name} -> vitor33 [sql] sql_set_user escaped user --> 'vitor33' expand: %{User-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_postgresql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "vitor33" [ttls] Got tunneled Access-Accept [eap] Freeing handler rlm_eap_ttls: Freeing handler for user vitor33 ++[eap] returns ok +- entering group post-auth {...} expand: %{User-Name} -> vitor33 [sql] sql_set_user escaped user --> 'vitor33' expand: %{User-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 19 to 192.168.100.2 port 32773 MS-MPPE-Recv-Key = 0x5b81c8ead986cb6408398bc0a2e3bef7457500dd6b8504be9d63a097679ee0d8 MS-MPPE-Send-Key = 0x4da2d778e0ffa8bddaf4e989a5b34e69e29266ff830134df8c2f03ca8d21bbe7 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "vitor33" Finished request 7. My radgroupcheck table: 4;"testgroup";"Simultaneous-Use";":=";"1" 7;"testgroup";"Calling-Station-Id";"==";"00-00-00-00-00-11" My radusergroup table: "admin";"testgroup";0 "vitor33";"testgroup";0 Can anyone help me ? Thanks in advance. edit: If I add the line "Auth-Type := Reject" for the same group in radgroupcheck, freeradius keep send Access-Acept when he should send Access-Reject, right ? -- View this message in context: http://www.nabble.com/Checkval-tp23867006p23867006.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

WiMAX Proxy Authentication with PMIP
by Kiran Kumar 04 Jun '09

04 Jun '09

Hi All, I am trying to test proxy Authentication (Auth Request proxied from Home AAA to Free Radius). Only the authentication is done at the Freeradius and the authorization of the user is done at the H-AAA and in this case I am using PMIP for the Subscriber. My question here is should the HA-RK-Key, HA-RK-SPI, MN-HA-MIP4-Key, MN-HA-MIP4-SPI be sent from the Freeradius, is so how can I include these attributes in Access-Accept? And if I send these values will the Freeradius be able to process and accept the 2nd Access-Request that comes from HA. Currently I am sending these values from the H-AAA, but when the HA Radius Access-Request is proxied to free radius it fails. And I suspect the reason is because I am generating the keys at H-AAA and not at Freeradius. Thanks and Regards, Kiran Kumar.B WiMAX Test Engineer

1 0

help HMAC-MD5
by Marco De Magistris 04 Jun '09

04 Jun '09

Hi all, Sorry, but I'm confused about HMAC-MD5 method. I'm working on Radius Proxy Implementation. The scenario is the following RADIUS Client -> Radius Proxy -> Radius Server. Radius Client sends a Radius Packet towards Radius Proxy (Message-Authenticator not used). Radius Proxy sends the Radius Packet towards Radius Server using HMAC-MD5 method. How to configure RADIUS Proxy? Should I add MD5-Password Attribute? MD5-Password is identical to Shared Secret between Radius Proxy and Radius Server? Thanks in advance Marco

3 2

ntlm_auth, universal principal name, multi-domain active directory, howto?
by freeradius＠tarac.net 04 Jun '09

04 Jun '09

New to freeradius & samba - and first post here. Rather long post so to cut to the heart of the question: Can freeradius be configured to authenticate users against an AD Forest (multi-domain) using universal principal name (UPN) and if so...how? I'm posting here because our only need for samba is freeradius integration to AD - but if I need to go to the Samba community just let me know. The ultimate goal is to have the majority of remote access users authenticate using their universal principal names (UPN) from AD. The path of that authentication however is not direct. RA Appliance --> Freeradius (Proxy) --> Freeradius --> AD There are some instances where we need users to authenticate from a repository other than AD, so Freeradius has been configured against both MySQL (primarily to hold NAS information & accounting info, but could potentially host users) and Openldap. The MySql & Openldap configs are working just fine. We don't really care if we use Samba - integration via LDAP would be fine, but it appears that their is an issue with sending the password in the clear if LDAP is used. If this is inaccurate please let me know. Everything "appears" configured correctly. In fact authentication using the "exec ntlm_auth" configuration referenced in http://deployingradius.com/documents/configuration/active_directory.html works if the username and domain are specified. Once we tried to use the UPN (without domain name) it does not. Going back to the command line for ntlm_auth tests resulted in the following. Using a user account found in DEPT1.COMPANY.NET child domain ntlm_auth --username=user WORKS ntlm_auth --username=user --domain=DEPT1 WORKS ntlm_auth --username=user(a)company.net DOES NOT WORK Using a user account found in DEPT2.COMPANY.NET child domain ntlm_auth --username=user DOES NOT WORK ntlm_auth --username=user --domain=DEPT2 WORKS ntlm_auth --username=user(a)company.net DOES NOT WORK All of the DOES NOT WORK result in the same error. NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) tcpdumps of the ntlm_auth traffic validate that all requests are being sent to one of the domain controllers within DEPT1.COMPANY.NET The internal freeradius host is in the child domain DEPT1.COMPANY.NET based on policy. If moving the server to COMPANY.NET is required that could be considered, however preference is to leave it in DEPT1.COMPANY.NET. Linux Host RHEL 5.2 Freeradius 2.1.6 Samba 3.3.4 Active Directory Multi-Domain Model Native Mode Win2003 Root Domain - company.net Child Domain - dept1.company.net Child Domain - dept2.company.net .. Child Domain - dept9.company.net For the sake of testing we are currently only configured for the root, child domains dept1 and dept2. We do not have admin_server entries because all of the examples reference port 749 which is not running on any of the domain controllers or global catalogs. I am including sanitized copies of the krb5.conf and smb.conf because they seem pertinent to the question. If any of the freeradius config files, nsswitch or some other information is needed just let me know. Thanks Adam krb5.conf --------------------------------- [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = DEPT1.COMPANY.NET dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h forwardable = yes [realms] COMPANY.NET = { kdc = gc01.company.net:88 kdc = gc02.company.net:88 kdc = gc03.company.net:88 } DEPT1.COMPANY.NET = { kdc = dept1-dc01.dept1.company.net:88 kdc = dept1-dc02.dept1.company.net:88 kdc = dept1-dc03.dept1.company.net:88 } DEPT2.COMPANY.NET = { kdc = dept2-dc01.dept2.company.net:88 kdc = dept2-dc02.dept2.company.net:88 kdc = dept3-gc01.dept2.company.net:88 } [domain_realm] .company.net = COMPANY.NET .dept1.company.net = DEPT1.COMPANY.NET .dept2.company.net = DEPT2.COMPANY.NET [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } smb.conf -------------------------------------- [global] workgroup = DEPT1 netbios name = AAA-Server realm = DEPT1.COMPANY.NET security = ADS template shell = /bin/bash idmap uid = 500-10000000 idmap gid = 500-10000000 winbind nested groups = Yes winbind enum users = yes winbind enum groups = yes server string = AAA [homes] comment = Home Directories browseable = no writable = yes

3 2