- Freeradius-Users - lists.freeradius.org

Dictionary for Acme Packet
by Hadriel Kaplan 22 Nov '09

22 Nov '09

Howdy, Attached is the latest dictionary for Acme Packet, for inclusion in the Freeradius releases. If this is not the right list to send such requests to, please let me know. (I tried to RTFM, and this list seemed to be it) Thanks! -hadriel

2 1

solution---Re: Re: help--- IPsec VPN on radius
by Yagnesh Dave 22 Nov '09

22 Nov '09

Hi All, Found the solution from one of the previous posts. http://lists.cistron.nl/pipermail/freeradius-users/2005-July/msg00273.html I just the did the same, added the below line in the dictionary file at /usr/local/share/freeradius/dictionary VALUE Service-Type outbound 5 Please let me know if this is correct to do. Regards, Dave. On Wed, 18 Nov 2009 16:47:05 +0530 wrote >Hi, > > Found the problem, it is with the service type attribute. > > I am getting this error on the freeradius > > /usr/local/etc/raddb/users[24719]: Parse error (reply) for entry tatablue-vpn.vsnl.net: Unknown value outbound for attribute Service-Type > > How to rectify this problem of "outbound" service type. > > Regards, > Dave > On Wed, 18 Nov 2009 16:22:30 +0530 wrote > >Hi, > > > > > > I am trying to configure this on Free Radius; > > > > > > # setup for IPSec VPDN, > > > ezvpn Password := "cisco" > > > Service-Type = outbound, > > > Cisco-Avpair = "ipsec:tunnel-password=cisco123", > > > Cisco-Avpair="ipsec:tunnel-type*esp", > > > Cisco-Avpair="ipsec:group-lock=1", > > > Cisco-Avpair="ipsec:key-exchange=ike", > > > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > > > > > > > > test@ezvpn Password := "test123" > > > Cisco-Avpair="ipsec:tunnel-type*esp", > > > Cisco-Avpair="ipsec:group-lock=1", > > > Cisco-Avpair="ipsec:key-exchange=ike", > > > Cisco-Avpair="ipsec:addr-pool=hw-pool", > > > > > > Now, When I run the freeRadius, I get this error in the log file > > > > > > /usr/local/etc/raddb/users[24374]: Parse error (reply) for entry ezvpn: Unknown value outbound for attribute Service-Type > > > Errors reading /usr/local/etc/raddb/users > > > > > > > > > Please tell what is the correct config to get it working. > > > > > > Regards, > > > Dave. > > > > > > >

3 3

Creating an NT-Password value with python
by jon michaels 21 Nov '09

21 Nov '09

Hi list, I am trying to figure out how to create an NT-Password hash for the authentication database using python. I found the package python_ntlm which seems to be able to do the job. http://code.google.com/p/python-ntlm/source/browse/trunk/python26/ntlm/ntlm… I think it needs a modification however, because currently the hash returned looks like this: >>> from ntlm.ntlm import create_NT_hashed_password_v1 >>> create_NT_hashed_password_v1('test') '\xdb4mi\x1dz\xccM\xc2b]\xb1\x9f\x9e?R' I then proceed to add the user in mysql: insert into radcheck (username,attribute,value,op) values ('testuser','NT-Password','\xdb4mi\x1dz\xccM\xc2b]\xb1\x9f\x9e?R',':='); Next, when i tried to authenticate using the OSX pptp client, radius debug tells me: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Invalid NT-Password [mschap] Told to do MS-CHAPv2 for passman with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect I suppose the hash i get from the create_NT_hashed_password_v1 function isn't correctly formatted. Can anyone point me in the right direction? Thanks, Jon.

3 5

Freeradius load balancing.
by nick 20 Nov '09

20 Nov '09

At the moment we have a freeradius 1.1.3 server on CentOS which is functioning fine, but due to circumstances, and the devices we are using as NASes, the ip pools are located on the NAS instead of being centralized on the RADIUS server as we'd like it. We'd now like to make things a bit more robust, including a clustered MySQL backend for AAA, and, if possible, load balanced freeradius servers on the front end. We'd also like to use SQL ip pools. I am only unsure about one thing though. If we have a shared pool available via DB, what prevents the two load balanced radius instances from giving out the same ip address? I've been doing a fair bit of googling, but without a whole lot of luck in this respect. Thanks for any info, Nick Warr.

6 6

Failed default PAP in CentOS
by freeradius＠corwyn.net 20 Nov '09

20 Nov '09

CentOS 5.2 installing freeradius from the default base repository freeradius-1.1.3-1.5.el5_4 If I add, to the top of /etc/raddb/users: bob Cleartext-Password := "hello" Then when I attempt to start freeradius I get: /etc/raddb/users[1]: Parse error (check) for entry bob: Unknown attribute "Cleartext-Password" I haven't made any other changes to freeradius other than the rpm install. (full dbug output) [root@ns4 ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" /etc/raddb/users[1]: Parse error (check) for entry bob: Unknown attribute "Cleartext-Password" Errors reading /etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1837] Unknown module "files". radiusd.conf[1773] Failed to parse authorize section. If I remove that line, freeradius appears ok: [root@ns4 ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

3 3

MySql on Freeradius
by Peter Carlstedt 20 Nov '09

20 Nov '09

Hello everyone! I have succeeded in most what i want to accomplice but stupid me forgot that I would also want to be able to administrate the users through a GUI instead of jump into the users.conf file everytime i need to add a new user. Since I want OpenSSL support i need to make my own build which Ubuntu´s own Freeradius release in Synaptic does not seem to have support for. I have tried to find information on the net about how to make a build of Freeradius that works together with MySql. The guides I have read is all about installing with the help of synaptic package manager in ubuntu 9.04 and install freeradius-mysql. A question I have is if that module comes with the build I make when im downloading from Freeradius site? If not do I need it to be able to get mysql work together with freeradius and if I do need it, how can I do a separate installation of it? Or can I use the one I find in Ubuntu´s Synaptic Package Manager? Lots of questions I know, hope you can find the time to answer them. Best regards/ Peter _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

need help authenticating against AD
by Michael Phillips 20 Nov '09

20 Nov '09

Hello All, I need some help authenticating against AD. I have followed directions online as best as I can, but things still aren't working as expected. I'm ultimately hoping to have our VPN users and admins logging into Cisco network equipment authenticate against AD through our FreeRADIUS 2 installation. Today, I have been testing authentication from one of Cisco switches, and I continually receive this basic output: rad_recv: Access-Request packet from host w.x.y.z port 37611, id=147, length=61 User-Name = "mphillips" User-Password = "xxxx" NAS-IP-Address = w.x.y.z NAS-Port = 2000 Thu Nov 19 16:17:34 2009 : Info: +- entering group authorize {...} Thu Nov 19 16:17:34 2009 : Info: ++[preprocess] returns ok Thu Nov 19 16:17:34 2009 : Info: [suffix] No '@' in User-Name = "mphillips", looking up realm NULL Thu Nov 19 16:17:34 2009 : Info: [suffix] No such realm "NULL" Thu Nov 19 16:17:34 2009 : Info: ++[suffix] returns noop Thu Nov 19 16:17:34 2009 : Info: [eap] No EAP-Message, not doing EAP Thu Nov 19 16:17:34 2009 : Info: ++[eap] returns noop Thu Nov 19 16:17:34 2009 : Info: ++[unix] returns updated Thu Nov 19 16:17:34 2009 : Info: ++[files] returns noop Thu Nov 19 16:17:34 2009 : Info: ++[expiration] returns noop Thu Nov 19 16:17:34 2009 : Info: ++[logintime] returns noop Thu Nov 19 16:17:34 2009 : Info: ++[pap] returns updated Thu Nov 19 16:17:34 2009 : Info: Found Auth-Type = PAP Thu Nov 19 16:17:34 2009 : Info: +- entering group PAP {...} Thu Nov 19 16:17:34 2009 : Info: [pap] login attempt with password "xxxx" Thu Nov 19 16:17:34 2009 : Info: [pap] Using CRYPT encryption. Thu Nov 19 16:17:34 2009 : Info: [pap] Passwords don't match Thu Nov 19 16:17:34 2009 : Info: ++[pap] returns reject Thu Nov 19 16:17:34 2009 : Info: Failed to authenticate the user. Thu Nov 19 16:17:34 2009 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [mphillips/xxxx] (from client w.x.y.z port 2000) Thu Nov 19 16:17:34 2009 : Info: Using Post-Auth-Type Reject Thu Nov 19 16:17:34 2009 : Info: +- entering group REJECT {...} Thu Nov 19 16:17:34 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> mphillips Thu Nov 19 16:17:34 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 19 16:17:34 2009 : Info: ++[attr_filter.access_reject] returns updated Thu Nov 19 16:17:34 2009 : Info: Delaying reject of request 5 for 1 seconds Thu Nov 19 16:17:34 2009 : Debug: Going to the next request Thu Nov 19 16:17:34 2009 : Debug: Waking up in 0.9 seconds. Thu Nov 19 16:17:36 2009 : Info: Sending delayed reject for request 5 Sending Access-Reject of id 147 to w.x.y.z port 37611 Thu Nov 19 16:17:36 2009 : Debug: Waking up in 4.6 seconds. Thu Nov 19 16:17:42 2009 : Info: Cleaning up request 5 ID 147 with timestamp +1181 Thu Nov 19 16:17:42 2009 : Debug: Ready to process requests. I can't tell from this output if the RADIUS server is ever even attempting to reach AD. Obviously, if I enter the correct password for my username on the RADIUS server itself, authentication will succeed, but this is not the desired behavior at this time. Any help is greatly appreciated. Michael Phillips _________________________________________________________________ Hotmail: Trusted email with Microsoft's powerful SPAM protection. http://clk.atdmt.com/GBL/go/177141664/direct/01/ http://clk.atdmt.com/GBL/go/177141664/direct/01/

3 4

Module not invoking for CHAP authentication
by shivashankar 20 Nov '09

20 Nov '09

hi, i am using freeradius 2.1.6 and soalris 10. i created one module like rlm_radius. This module does authenticatin using java file which is resideds in Jboss server for PAP authentication it is working fine going to java file and checking the logic.but when i use CHAP authentication is shwoing segment fault see there the debug code Ready to process requests. rad_recv: Access-Request packet from host 10.232.163.145 port 1349, id=27, length=44 User-Name = "moto" User-Password = "shiva" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "moto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop authorize -----------login = 1 [radius] Send Access-Accept. ++[radius] returns handled Sending Access-Accept of id 27 to 10.232.163.145 port 1349 Reply-Message = "This is a challenge" State = 0x30 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 27 with timestamp +2 Ready to process requests. rad_recv: Access-Request packet from host 10.232.163.145 port 1350, id=28, length=45 User-Name = "moto" CHAP-Password = 0x60373d77e7cd68c4d46e937727c380d565 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "moto", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Segmentation Fault (core dumped) root@nms-T1000-03:/ -- View this message in context: http://old.nabble.com/Module-not-invoking-for-CHAP-authentication-tp2643216… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

RE: need help authenticating against AD
by Alan Buxey 20 Nov '09

20 Nov '09

You broke the server and authentication fails - not a suprise. If the server cannot discover the source/type of auth then you need to give it a hint - users file will feed that hint . I think you dont need the unix module --- original message --- From: "Michael Phillips" <mdphilip(a)hotmail.com> Subject: RE: need help authenticating against AD Date: 20th November 2009 Time: 4:25:56 I followed the directions in that link prior to emailing the group. For some reason, it still isn't working as expected. If I put this line at the top of the users file, VPN users and Cisco exec users are able to authenticate with their AD account. DEFAULT Auth-Type = ntlm_auth This is the debug output from a successful auth: rad_recv: Access-Request packet from host w.x.y.z port 1645, id=33, length=86 User-Name = "mphillips" User-Password = "xxxx" NAS-Port = 1 NAS-Port-Id = "tty1" NAS-Port-Type = Virtual Calling-Station-Id = "w.x.y.z" NAS-IP-Address = w.x.y.z +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "mphillips", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = ntlm_auth +- entering group ntlm_auth {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=mphillips [ntlm_auth] expand: --password=%{User-Password} -> --password=xxxx Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok Login OK: [mphillips] (from client Access-Layer-Switch1 port 1 cli w.x.y.z) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 33 to w.x.y.z port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 33 with timestamp +16 Ready to process requests. Technically, this is all I need; this seems like a hacked way of doing things, though and I want to understand the operations of the server better. I commented out the pap and unix modules in ../sites-enabled/inner-tunnel and default and I also removed the DEFAULT line from the top of the users file. Now I get this debug output: rad_recv: Access-Request packet from host w.x.y.z port 1645, id=34, length=86 User-Name = "mphillips" User-Password = "xxxx" NAS-Port = 1 NAS-Port-Id = "tty1" NAS-Port-Type = Virtual Calling-Station-Id = "w.x.y.z" NAS-IP-Address = w.x.y.z +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "mphillips", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [mphillips/xxxx] (from client Access-Layer-Switch1 port 1 cli w.x.y.z) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mphillips attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 34 to 10.200.1.4 port 1645 Waking up in 4.6 seconds. Cleaning up request 0 ID 34 with timestamp +12 Ready to process requests. Thanks for any assistance. -Mike > Date: Thu, 19 Nov 2009 22:30:50 +0000 > Subject: Re: need help authenticating against AD > From: tnt(a)kalik.net > To: freeradius-users(a)lists.freeradius.org > > > I need some help authenticating against AD. I have followed directions > > online as best as I can, but things still aren't working as expected. > > These: > > http://deployingradius.com/documents/configuration/active_directory.html > > > I'm > > ultimately hoping to have our VPN users and admins logging into Cisco > > network equipment authenticate against AD through our FreeRADIUS 2 > > installation. Today, I have been testing authentication from one of Cisco > > switches, and I continually receive this basic output: > > You are not authenticating against AD. You are authenticating against > local system file: > ... > > Thu Nov 19 16:17:34 2009 : Info: ++[unix] returns updated > ... > > Thu Nov 19 16:17:34 2009 : Info: [pap] login attempt with password "xxxx" > > Thu Nov 19 16:17:34 2009 : Info: [pap] Using CRYPT encryption. > > Thu Nov 19 16:17:34 2009 : Info: [pap] Passwords don't match > > ... and the password isn't correct. > > > I can't tell from this output if the RADIUS server is ever even attempting > > to reach AD. > > It isn't. > > > Obviously, if I enter the correct password for my username on > > the RADIUS server itself, authentication will succeed, but this is not the > > desired behavior at this time. > > Comment out unix in authorize then. If you follow the guide this will work > with Auth-Type := ntlm_auth in users file. > > Ivan Kalik > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ Hotmail: Trusted email with Microsoft's powerful SPAM protection. Sign up now.<http://clk.atdmt.com/GBL/go/177141664/direct/01/ http://clk.atdmt.com/GBL/go/177141664/direct/01/>

1 0

Authentication
by kachin Agarwal 20 Nov '09

20 Nov '09

Hi, I m currently using freeradius-server 2.1.7. when i try to authenticate it takes abt 400 millisec to authenticate. i use peap-mschapv2 for authentication. So in 1 sec the number of devices i can authenticate is jus 4 to 5. so wat to do? should i modify anything in the freeradius code to increase the authentication rate. Thanx & Regards, kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1