- Freeradius-Users - lists.freeradius.org

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Hi, It is the whole debug info. I think the problem is we could not get the default domain name "xjtu". Listening on authentication address * port 1812 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.85 port 32807, id=118, length=125 Service-Type = Authorize-Only NAS-Port-Type = Wireless-802.11 User-Name = "hhe" MS-CHAP-Challenge = 0xd764c8cce93255c4478d7aa05d83f3ea MS-CHAP2-Response = 0x9c00a2b7249b043e23cd2866211bff3783d60000000000000000924fed02a24dee7533a7b9af370e858e1b798d9151617838 NAS-IP-Address = 10.155.20.85 +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for hhe [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=hhe) [ldap] expand: OU=Domain Controllers,dc=xjtu,dc=cn -> OU=Domain Controllers,dc=xjtu,dc=cn [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.155.3.250:389, authentication 0 [ldap] bind as hhe(a)xjtu.cn/w2006njh to 10.155.3.250:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in OU=Domain Controllers,dc=xjtu,dc=cn, with filter (sAMAccountName=hhe) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user hhe authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for hhe with NT-Password [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-xjtu} -> --domain= [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=hhe [mschap] mschap2: d7 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=cf5ba32b520debdd [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=924fed02a24dee7533a7b9af370e858e1b798d9151617838 Exec-Program output: No such user (0xc0000064) Exec-Program-Wait: plaintext: No such user (0xc0000064) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.6 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 118 to 10.155.20.85 port 32807 MS-CHAP-Error = "\234E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 118 with timestamp +33 Ready to process requests. --- 10年7月1日，周四, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月1日,周四,下午2:02 John wrote: > "xjtu" is our default domain, for users under this domain will only use > username to authenticate to RADIUS. With 1.1.6, it will get "xjtu" as > domain; But with 2.1.9, it will not, please see the debug info below. You have deleted nearly all of the debug information, including the information we need to help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 5

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

It is debug info when I use freeRADIUS-1.1.6. rad_recv: Access-Request packet from host 10.155.20.85:32790, id=171, length=125 --> Service-Type = Authorize-Only --> NAS-Port-Type = Wireless-802.11 --> User-Name = "hhe" --> MS-CHAP-Challenge = 0x837a4fb32a47a5bda0c24d5e4329fcdc --> MS-CHAP2-Response = 0xe40069bdb5799e2fa75ccc2d53415669f4d900000000000000008cad47a91a94b2a475bda048fda283bf23e702b5129a3164 --> NAS-IP-Address = 10.155.20.85 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modsingle[authorize]: calling chap (rlm_chap) for request 2 modsingle[authorize]: returned from chap (rlm_chap) for request 2 modcall[authorize]: module "chap" returns noop for request 2 modsingle[authorize]: calling mschap (rlm_mschap) for request 2 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 modcall[authorize]: module "mschap" returns ok for request 2 modsingle[authorize]: calling eap (rlm_eap) for request 2 rlm_eap: No EAP-Message, not doing EAP modsingle[authorize]: returned from eap (rlm_eap) for request 2 modcall[authorize]: module "eap" returns noop for request 2 modsingle[authorize]: calling ldap (rlm_ldap) for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for hhe radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '(sAMAccountName=hhe)' radius_xlat: 'dc=xjtu,dc=cn' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: ldap_release_conn: Release Id: 0 modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 modcall[authorize]: module "ldap" returns ok for request 2 modsingle[authorize]: calling ldap (rlm_ldap) for request 2 modsingle[authorize]: calling pap (rlm_pap) for request 2 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modsingle[authorize]: returned from pap (rlm_pap) for request 2 modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 2 modsingle[authenticate]: calling mschap (rlm_mschap) for request 2 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for hhe with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' rlm_mschap: No NT-Domain was found in the User-Name. radius_xlat: '--domain=xjtu' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=hhe' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 83 radius_xlat: '--challenge=cfdb7016e508348d' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=8cad47a91a94b2a475bda048fda283bf23e702b5129a3164' rlm_mschap: adding MS-CHAPv2 MPPE keys modsingle[authenticate]: returned from mschap (rlm_mschap) for request 2 modcall[authenticate]: module "mschap" returns ok for request 2 modcall: leaving group MS-CHAP (returns ok) for request 2 Sending Access-Accept of id 171 to 10.155.20.85 port 32790 --> MS-CHAP2-Success = 0xe4533d41313535304434313643373437413542363236393941394135393532374335424630423438384537 --> MS-MPPE-Recv-Key = 0x6ac9* --> MS-MPPE-Send-Key = 0xcfe2* --> MS-MPPE-Encryption-Policy = 0x00000001 --> MS-MPPE-Encryption-Types = 0x00000006 Finished request 2 --- 10年7月5日，周一, John <elmer_radius(a)yahoo.com.cn> 写道：发件人: John <elmer_radius(a)yahoo.com.cn> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月5日,周一,下午3:06 Yes. You are right. If I use hhe(a)xjtu.cn, it will work. If I use old freeRADIUS-1.1.6, username "hhe" can work well. I think it is because I set default domain name "xjtu" in mschap module (ntlm_auth) . But freeRADIUS-2.1.9 could not work without domain. ---- ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" --- 10年7月2日，周五, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月2日,周五,下午3:45 John wrote: > Hi, > It is the whole debug info. I think the problem is we could not get the > default domain name "xjtu". Because the username does not include the domain. Log in with "hhe(a)xjtu.cn", and it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----下面为附件内容----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Yes. You are right. If I use hhe(a)xjtu.cn, it will work. If I use old freeRADIUS-1.1.6, username "hhe" can work well. I think it is because I set default domain name "xjtu" in mschap module (ntlm_auth) . But freeRADIUS-2.1.9 could not work without domain. ---- ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" --- 10年7月2日，周五, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月2日,周五,下午3:45 John wrote: > Hi, > It is the whole debug info. I think the problem is we could not get the > default domain name "xjtu". Because the username does not include the domain. Log in with "hhe(a)xjtu.cn", and it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

What Next??
by Thomas Reeves 05 Jul '10

05 Jul '10

Greetings, All I have a FreeBSD-based gateway server running pfSense software. This is the only server directly connected to the internet. It distributes (port forwards) all incoming internet requests to about five back-end servers based on static IP address and/or ports. I have a new FreeRADIUS/MySQL server among the five back-end servers. I just completed installation, configuration and testing of this server. I want to authenticate and authorize all incoming http(s) requests before allowing access to any back-end services. However, I seemed to have missed something fundamental about the FreeRADIUS server - what do I do next?? How do I "attach" FreeRADIUS to the inbound TCP stream to accept/reject requests?? Where does the accept/reject response go?? The available documentation did not discuss deployment... Any links or tips would be appreciated. Cheers, Rubix Cube

2 2

the termination of Lost-Carrier
by Spacelee 05 Jul '10

05 Jul '10

e , I want to ask some Termination status some people was terminated because of Session-Timeout some people was terminated because of User-Request some people was terminated because of Lost-Carrier Session-Timeout means he has reached his expiration time User-Request means he request to terminate but what does lost-carrier means? I can't find in freeradius's wiki, but I saw this status in Daloradius and when will the termination be Lost-Carrier? and the user whose termination is Lost-Carrier can't login the next day, the the next next day, he can login again, I don't know why? can somebody figure this out? -- Spacelee

2 4

how to encrypting accounting?
by Fabio Dive 04 Jul '10

04 Jul '10

Hello, yesterday I successful installed freeswitch 1.0.6 with mod_radius_cdr accounting on a remote freeradius 2.1.9 server, freeswitch use freeradius-client 1.1.6 library. I am looking for a way to TLS encrypt accounting messages between Freeswitch and remote Freeradius, actually I can do only clear text accounting with simple shared key auth. Is there a way using configurations files to setup TLS accounting? Do I need to code a bit with freeradius-client library? I keep trying, for the moment many thanks, cheers, Fabio

3 2

Re: FreeRadius + AD + Realms
by Matthew P 04 Jul '10

04 Jul '10

>> In a general regexp language, I guess that could be done with ([\w.-]+)(?=@.*). > Most regexes don't support \w, or (?... constructs. > > Keep it simple: > > if (User-Name =~ /^(.*)(a)(.*)$/) { > # name = %{1} > # realm = %{2} > } Makes sense now :) Thanks. man regex is written mostly descriptive, it's much easier to understand on examples like these, than on "weeknights" :D But I guess I missed to point with doing it this way, because: if (User-Name =~ /(a)mydomain.com/) { if (User-Name =~ /^(.*)(a)(.*)$/) { update request { Stripped-User-Name = %{1} } ldap } } doesn't work ^^ It gives: rlm_ldap - authorize rlmd_ldap: performing user authorization for %{1} ... Also, I tried to apply this directly in the ldap module configuration, different outcome, but also doesn't work. Where did I go wrong? -_- _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

freeradius2 with EAP-TLS and LDAP authorization ?
by Riccardo Veraldi 04 Jul '10

04 Jul '10

Hello, is it possible in some way to use EAP-TLS X509 authentication together with LDAP authorization in freeradius2 ? Actually freeradius2 allows EAP-TLS authentication, but if I wanted to extract the emailAddress or CN field from the X509 certificate and authorize it against my LDAP tree information to allow or disallow WiFi access, is it possible ?? Or the only way to authorize a EAP-TLS X509 user is only thru freeradius2 users file ? thanks Rick

3 5

Freeradius + AD + Cisco authetication
by Jevos, Peter 03 Jul '10

03 Jul '10

Hello friends I was reading few tutorials regarding the Cisco authetication against Freeradius and Windows AD. Actually I'm not really clever, because main tutorial on the main pages is connected with the older version , and there are more version of the Freradius 2.0, a bit different: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO http://deployingradius.com/documents/configuration/active_directory.html http://www.eduroamus.org/node/44 However, I have working and running samba and ntlm: Linux#/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=MYNAME --require-membership-of='DOMAIN+DOMAIN_GROUP' It returns OK. Can somebody please help me how to finish the freeradius configuration ( the NAS server will be cisco ) I know that there should be the entries in users file, eap file, mschap or ntlm_aut modules. But what should be the proper syntax I really don't know My aim should be: 1. authenticate users that belong to some certain domain group , as is showed in the ntlm_auth command above ( for the Cisco vpn client users ) 2. authenticate users to have privilege ( 15 ) access to the router Now I'm using IAS server, and I want to move to the FreeRadius Cisco configuration is solved and works without any problems. What remains is freeradius config Thank you BR Pet

3 7

Re: FreeRadius + AD + Realms
by Matthew P 03 Jul '10

03 Jul '10

Thanks for your help Alan, it really makes a difference when learning about Freeradius configuration. > So... decode the user-name using a regex. You can then use that in > the LDAP configuration. The LDAP user search is configurable for a > *reason*. I forgot to mention that I need the "user" portion of "user(a)mydomain.com" for sql too. "user(a)mydomain.com" only needs to be sent to the home server (in case the user doesn't have "@mydomain.com" or "@mydomain2.com"). In another words, both AD and DB contain usernames, without any realms. I've been reading http://freeradius.org/radiusd/man/unlang.html, and can't seem to figure out how to make the logic - "take everything before @ as a username". So please help. In a general regexp language, I guess that could be done with ([\w.-]+)(?=@.*). > It's an option, but not the only way to do it. > > if (User-Name =~ /(a)mydomain.com/) { > ldap > } > elsif (User-Name =~ /(a)mydomain2.com/) { > sql > } > else { > update control { > Proxy-To-Realm := "other" > } > } Works nicely, thanks for this hint. Matthew _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1