- Freeradius-Users - lists.freeradius.org

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Yes. You are right. If I use hhe(a)xjtu.cn, it will work. If I use old freeRADIUS-1.1.6, username "hhe" can work well. I think it is because I set default domain name "xjtu" in mschap module (ntlm_auth) . But freeRADIUS-2.1.9 could not work without domain. ---- ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" --- 10年7月2日，周五, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月2日,周五,下午3:45 John wrote: > Hi, > It is the whole debug info. I think the problem is we could not get the > default domain name "xjtu". Because the username does not include the domain. Log in with "hhe(a)xjtu.cn", and it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

What Next??
by Thomas Reeves 05 Jul '10

05 Jul '10

Greetings, All I have a FreeBSD-based gateway server running pfSense software. This is the only server directly connected to the internet. It distributes (port forwards) all incoming internet requests to about five back-end servers based on static IP address and/or ports. I have a new FreeRADIUS/MySQL server among the five back-end servers. I just completed installation, configuration and testing of this server. I want to authenticate and authorize all incoming http(s) requests before allowing access to any back-end services. However, I seemed to have missed something fundamental about the FreeRADIUS server - what do I do next?? How do I "attach" FreeRADIUS to the inbound TCP stream to accept/reject requests?? Where does the accept/reject response go?? The available documentation did not discuss deployment... Any links or tips would be appreciated. Cheers, Rubix Cube

2 2

the termination of Lost-Carrier
by Spacelee 05 Jul '10

05 Jul '10

e , I want to ask some Termination status some people was terminated because of Session-Timeout some people was terminated because of User-Request some people was terminated because of Lost-Carrier Session-Timeout means he has reached his expiration time User-Request means he request to terminate but what does lost-carrier means? I can't find in freeradius's wiki, but I saw this status in Daloradius and when will the termination be Lost-Carrier? and the user whose termination is Lost-Carrier can't login the next day, the the next next day, he can login again, I don't know why? can somebody figure this out? -- Spacelee

2 4

how to encrypting accounting?
by Fabio Dive 04 Jul '10

04 Jul '10

Hello, yesterday I successful installed freeswitch 1.0.6 with mod_radius_cdr accounting on a remote freeradius 2.1.9 server, freeswitch use freeradius-client 1.1.6 library. I am looking for a way to TLS encrypt accounting messages between Freeswitch and remote Freeradius, actually I can do only clear text accounting with simple shared key auth. Is there a way using configurations files to setup TLS accounting? Do I need to code a bit with freeradius-client library? I keep trying, for the moment many thanks, cheers, Fabio

3 2

Re: FreeRadius + AD + Realms
by Matthew P 04 Jul '10

04 Jul '10

>> In a general regexp language, I guess that could be done with ([\w.-]+)(?=@.*). > Most regexes don't support \w, or (?... constructs. > > Keep it simple: > > if (User-Name =~ /^(.*)(a)(.*)$/) { > # name = %{1} > # realm = %{2} > } Makes sense now :) Thanks. man regex is written mostly descriptive, it's much easier to understand on examples like these, than on "weeknights" :D But I guess I missed to point with doing it this way, because: if (User-Name =~ /(a)mydomain.com/) { if (User-Name =~ /^(.*)(a)(.*)$/) { update request { Stripped-User-Name = %{1} } ldap } } doesn't work ^^ It gives: rlm_ldap - authorize rlmd_ldap: performing user authorization for %{1} ... Also, I tried to apply this directly in the ldap module configuration, different outcome, but also doesn't work. Where did I go wrong? -_- _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

freeradius2 with EAP-TLS and LDAP authorization ?
by Riccardo Veraldi 04 Jul '10

04 Jul '10

Hello, is it possible in some way to use EAP-TLS X509 authentication together with LDAP authorization in freeradius2 ? Actually freeradius2 allows EAP-TLS authentication, but if I wanted to extract the emailAddress or CN field from the X509 certificate and authorize it against my LDAP tree information to allow or disallow WiFi access, is it possible ?? Or the only way to authorize a EAP-TLS X509 user is only thru freeradius2 users file ? thanks Rick

3 5

Freeradius + AD + Cisco authetication
by Jevos, Peter 03 Jul '10

03 Jul '10

Hello friends I was reading few tutorials regarding the Cisco authetication against Freeradius and Windows AD. Actually I'm not really clever, because main tutorial on the main pages is connected with the older version , and there are more version of the Freradius 2.0, a bit different: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO http://deployingradius.com/documents/configuration/active_directory.html http://www.eduroamus.org/node/44 However, I have working and running samba and ntlm: Linux#/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=MYNAME --require-membership-of='DOMAIN+DOMAIN_GROUP' It returns OK. Can somebody please help me how to finish the freeradius configuration ( the NAS server will be cisco ) I know that there should be the entries in users file, eap file, mschap or ntlm_aut modules. But what should be the proper syntax I really don't know My aim should be: 1. authenticate users that belong to some certain domain group , as is showed in the ntlm_auth command above ( for the Cisco vpn client users ) 2. authenticate users to have privilege ( 15 ) access to the router Now I'm using IAS server, and I want to move to the FreeRadius Cisco configuration is solved and works without any problems. What remains is freeradius config Thank you BR Pet

3 7

Re: FreeRadius + AD + Realms
by Matthew P 03 Jul '10

03 Jul '10

Thanks for your help Alan, it really makes a difference when learning about Freeradius configuration. > So... decode the user-name using a regex. You can then use that in > the LDAP configuration. The LDAP user search is configurable for a > *reason*. I forgot to mention that I need the "user" portion of "user(a)mydomain.com" for sql too. "user(a)mydomain.com" only needs to be sent to the home server (in case the user doesn't have "@mydomain.com" or "@mydomain2.com"). In another words, both AD and DB contain usernames, without any realms. I've been reading http://freeradius.org/radiusd/man/unlang.html, and can't seem to figure out how to make the logic - "take everything before @ as a username". So please help. In a general regexp language, I guess that could be done with ([\w.-]+)(?=@.*). > It's an option, but not the only way to do it. > > if (User-Name =~ /(a)mydomain.com/) { > ldap > } > elsif (User-Name =~ /(a)mydomain2.com/) { > sql > } > else { > update control { > Proxy-To-Realm := "other" > } > } Works nicely, thanks for this hint. Matthew _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

Re: FreeRadius + AD + Realms
by Matthew P 03 Jul '10

03 Jul '10

>> realm mydomain.com { >> auth_pool = active_directory > > You'll need a line: > > nostrip > > To avoid EAP identity issues. This worked, thanks. Preprocess doesn't strip the username in the default server and EAP works. Although, now a new problem arrised - I can't seem to get the (stripped) username in the inner-tunnel with preprocess. So the username stays in the form - "user(a)mydomain.com", but that isn't usable for a LDAP search (on the AD). (btw. if I test without the realm portion of the scenario, like AD is the only source of authentication, it works) > i.e. it doesn't proxy it. > > This *does* work in 2.1.9. So which version are you running? I'm sorry, it was my mistake. I configured proxy_requests = no, because I thought it was ment for a server when it was only proxying requests from other sources (since this option opens a special proxy-ing listening port). Fixed now, proxying to virtual server works. > And why are you creating this complicated configuration? The > "inner-tunnel" virtual server is set up *precisely* for this kind of > authentication. You do EAP in the "default" server. Then, the > "inner-tunnel" server gets the PAP password, and you can configure it to > look the user up in AD there. Because there are realms involved in the scenario. If the realm is "mydomain.com" then radius needs to lookup a user in AD. If the realm is "mydomain2.com" then it needs to consult sql. Otherwise it should proxy the request to a home server. What would be a proper way to do this? I thought setting up a virtual server for every scenario is the way to go? TIA! _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

2 1

FW: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user
by Cesar Ortega 02 Jul '10

02 Jul '10

Hi Alan, I tried using the default users file and the other one that works on the other server but I could not make it. BTW, the working users file is the same, but include DEFAULT Auth-Type := ntlm_auth at the beginning. However, the Freeradius log said: /etc/freeradius/users[3]: Parse error (check) for entry DEFAULT: Unknown value ntlm_auth for attribute Auth-Type Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/innet-tunnel-default[111]: Failed to find module "files". /etc/freeradius/sites-enabled/innet-tunnel-default[34]: Errors parsing authorize section. Cesar > Message: 5 > Date: Fri, 02 Jul 2010 17:20:28 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4C2E03BC.6050104(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Cesar Ortega wrote: > > I managed to install Freeradius with OpenSSL under Debian Lenny and it > > did work like a charm for a while. However, after I did the same process > > of installation in another virtualbox machine, it has not worked > > anymore. The console log report the following error: > > > > [pap] WARNING! No "known good" password found for the user. > > Authentication may fail because of this. > > You did not follow the same installation process. The *other* machine > looks up users in a database, or in the "users" file. This machine is > not configured to look in any database. > > Alan DeKok. Discover the new Windows Vista Learn more! _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 1