- Freeradius-Users - lists.freeradius.org

help HMAC-MD5
by Marco De Magistris 04 Jun '09

04 Jun '09

Hi all, Sorry, but I'm confused about HMAC-MD5 method. I'm working on Radius Proxy Implementation. The scenario is the following RADIUS Client -> Radius Proxy -> Radius Server. Radius Client sends a Radius Packet towards Radius Proxy (Message-Authenticator not used). Radius Proxy sends the Radius Packet towards Radius Server using HMAC-MD5 method. How to configure RADIUS Proxy? Should I add MD5-Password Attribute? MD5-Password is identical to Shared Secret between Radius Proxy and Radius Server? Thanks in advance Marco

3 2

ntlm_auth, universal principal name, multi-domain active directory, howto?
by freeradius＠tarac.net 04 Jun '09

04 Jun '09

New to freeradius & samba - and first post here. Rather long post so to cut to the heart of the question: Can freeradius be configured to authenticate users against an AD Forest (multi-domain) using universal principal name (UPN) and if so...how? I'm posting here because our only need for samba is freeradius integration to AD - but if I need to go to the Samba community just let me know. The ultimate goal is to have the majority of remote access users authenticate using their universal principal names (UPN) from AD. The path of that authentication however is not direct. RA Appliance --> Freeradius (Proxy) --> Freeradius --> AD There are some instances where we need users to authenticate from a repository other than AD, so Freeradius has been configured against both MySQL (primarily to hold NAS information & accounting info, but could potentially host users) and Openldap. The MySql & Openldap configs are working just fine. We don't really care if we use Samba - integration via LDAP would be fine, but it appears that their is an issue with sending the password in the clear if LDAP is used. If this is inaccurate please let me know. Everything "appears" configured correctly. In fact authentication using the "exec ntlm_auth" configuration referenced in http://deployingradius.com/documents/configuration/active_directory.html works if the username and domain are specified. Once we tried to use the UPN (without domain name) it does not. Going back to the command line for ntlm_auth tests resulted in the following. Using a user account found in DEPT1.COMPANY.NET child domain ntlm_auth --username=user WORKS ntlm_auth --username=user --domain=DEPT1 WORKS ntlm_auth --username=user(a)company.net DOES NOT WORK Using a user account found in DEPT2.COMPANY.NET child domain ntlm_auth --username=user DOES NOT WORK ntlm_auth --username=user --domain=DEPT2 WORKS ntlm_auth --username=user(a)company.net DOES NOT WORK All of the DOES NOT WORK result in the same error. NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) tcpdumps of the ntlm_auth traffic validate that all requests are being sent to one of the domain controllers within DEPT1.COMPANY.NET The internal freeradius host is in the child domain DEPT1.COMPANY.NET based on policy. If moving the server to COMPANY.NET is required that could be considered, however preference is to leave it in DEPT1.COMPANY.NET. Linux Host RHEL 5.2 Freeradius 2.1.6 Samba 3.3.4 Active Directory Multi-Domain Model Native Mode Win2003 Root Domain - company.net Child Domain - dept1.company.net Child Domain - dept2.company.net .. Child Domain - dept9.company.net For the sake of testing we are currently only configured for the root, child domains dept1 and dept2. We do not have admin_server entries because all of the examples reference port 749 which is not running on any of the domain controllers or global catalogs. I am including sanitized copies of the krb5.conf and smb.conf because they seem pertinent to the question. If any of the freeradius config files, nsswitch or some other information is needed just let me know. Thanks Adam krb5.conf --------------------------------- [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = DEPT1.COMPANY.NET dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h forwardable = yes [realms] COMPANY.NET = { kdc = gc01.company.net:88 kdc = gc02.company.net:88 kdc = gc03.company.net:88 } DEPT1.COMPANY.NET = { kdc = dept1-dc01.dept1.company.net:88 kdc = dept1-dc02.dept1.company.net:88 kdc = dept1-dc03.dept1.company.net:88 } DEPT2.COMPANY.NET = { kdc = dept2-dc01.dept2.company.net:88 kdc = dept2-dc02.dept2.company.net:88 kdc = dept3-gc01.dept2.company.net:88 } [domain_realm] .company.net = COMPANY.NET .dept1.company.net = DEPT1.COMPANY.NET .dept2.company.net = DEPT2.COMPANY.NET [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } smb.conf -------------------------------------- [global] workgroup = DEPT1 netbios name = AAA-Server realm = DEPT1.COMPANY.NET security = ADS template shell = /bin/bash idmap uid = 500-10000000 idmap gid = 500-10000000 winbind nested groups = Yes winbind enum users = yes winbind enum groups = yes server string = AAA [homes] comment = Home Directories browseable = no writable = yes

3 2

chap or pap
by jon jon 04 Jun '09

04 Jun '09

Hi, I have pap authentication working just fine. I want to change auth type to chap. I am using the radius book that is very outdated. Don't really understand why can't chap to work. I looked in the default file and chap auth-type is not commented out, so I am assuming that if pap authentication didn't work then chap would be the next auth type radius would try right. that is why they put pap at the bottom of the file to let the other auth types a try first. I am using mysql backend server with username and cleartext := passwords. Can anyone point me the right direction or tell me to read more:P jon

2 1

Re-compiling modules
by Rupert Finnigan 04 Jun '09

04 Jun '09

Hi All, I'm *attempting* to recompile the rlm_mschap module with a quick mod to hopefully fix my host authentication domain extraction problems. Is this as simple as running make, and copying the resulting files to "/usr/lib" (on my system atleast)?? And if so, is it just the two files I need to copy, the .la and the .so? If this eventually works I'll rebuild my rpms, but I'm looking for a quick way of finding out if this does actually behave as expected. Sorry if this is a bit of an obvious question - I've never really done much C before. Many Thanks, Rupert

2 1

ippools and Pool-Name
by up＠3.am 03 Jun '09

03 Jun '09

Hi: I am trying to configure a server-side IP pool for select pptp users to bypass the NAS's internal pool. The documentation appears sparse, but this is what I've done so far: In raddb/radiusd.conf: ippool users_pool { range-start = 172.16.1.2 range-stop = 172.16.1.253 netmask = 255.255.255.0 cache-size = 251 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes } In raddb/users sometestuser Pool-Name :="users_pool" Framed-Protocol == PPP, Framed-Compression = Van-Jacobson-TCP-IP However, "sometestuser" is simply allocated an IP from the NAS's internal pool, seemingly ignoring this. I also noticed that the files db.ippool and db.ipindex are not being created. Is there something else I'm missing? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 5

checkval module
by Amr el-Saeed 03 Jun '09

03 Jun '09

2 2

Hiding passwords
by John Doppke 03 Jun '09

03 Jun '09

Is there a way to tell freeradius not to include passwords in the log when debugging? -John

2 1

"detail" log files
by Steve Bertrand 03 Jun '09

03 Jun '09

Hi everyone, Can someone swing the clue bat at me, and provide me with information on where I should look to find out how to disable detail log files for specific NASs only? I need to keep the detail files for legacy purposes, but only for specific NASs, and I'd like to disable the rest of them from logging there. Is this possible? Steve

2 2

re: Filtering in sites-enabled default file
by Nick Sparkes 03 Jun '09

03 Jun '09

Hello, I was wandering if anyone can help me. I am trying to set up freeradius 2.1.x In the authorized section of default, we have the following coding: if("%{User-Name}" =~ /\\\\?([^@\\\\]+)@?([-[:alnum:]._]*)?$/) { update request { Realm := "%{2}" } if(!"%{2}" || ("%{2}" == "worc.ac.uk") || ("%{2}" == "worcester.ac.uk") ){ update request { Realm := "worc" } } } else{ update request { Stripped-User-Name := "anonymous" Realm := 'local' } } switch "%{Realm}" { case "worc" { update control { Proxy-To-Realm := "worc" } update request { Realm := "worc" } # Don't do any proxy stuff here, request will be handled later. } case { update control { Proxy-To-Realm := "jrs" } update request { Realm := "jrs" } } } This should check the extension to the user name, if it is worc or Worcester it will use the realm "worc", if it is anonymous, use the "local" realm. Otherwise use the "jrs" realm. Which works fine. There is a problem, as our users are split into 2 separate section, staff & students. Above works fine for staff, as the realm "worc" handles this authentication. But we do need to filter the students & place these in another realm, "student". The staff login id is: Psna1(a)worc.ac.uk Whereas the student login is in the format: Psdn1_03(a)worc.ac.uk Would it be possible to filter on the format of the userid? The student id has `_02 on it. Regards, Nick.

2 1

Stop alive requests in a dead realm
by Santiago Balaguer García 03 Jun '09

03 Jun '09

Hi, I am using freeradius 2.1.3 for my AAA servers. I have a little problem when a third-patner RADIUS is dead. My problem is my freeradius send the following status packect every 2-5 seconds. Sending Access-Request of id 77 to 200.160.126.23 port 1812 User-Name := "" User-Password := "" Service-Type := Authenticate-Only Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 1.0 seconds. Cleaning up request 3 ID 151 with timestamp +723 Waking up in 2.9 seconds. I want to avoid this test because my partner tell me that I send too many trafic ('operator' is the realm name). proxy.conf file -------------- proxy server { default_fallback = yes } home_server localhost { type = auth ipaddr = 127.0.0.1 port = 1812 secret = testing123 require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 } home_server virtual.example.com { virtual_server = virtual.example.com } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm operator { type = radius authhost = 200.160.126.23 :1812 accthost = 200.160.126.23 :1813 secret = my_secret strip } _________________________________________________________________ ¿Quieres ver los mejores videos de MSN? Enciende Messenger TV http://messengertv.msn.com/mkt/es-es/default.htm

2 1