- Freeradius-Users - lists.freeradius.org

Re: include_length and EAP-TTLS
by Gong Cheng 05 Dec '08

05 Dec '08

(sorry i still don't know how to reply into a thread from yahoo web mail) Yeah I agree. All the supplicants I used are ok with that. I just thought I might point it out ... Thanks for your reply Alan. Re: include_length and EAP-TTLS ________________________________ * To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> * Subject: Re: include_length and EAP-TTLS * From: Alan DeKok <aland(a)deployingradius.com> * Date: Fri, 05 Dec 2008 07:58:14 +0100 * In-reply-to: <542789.4743.qm(a)web82103.mail.mud.yahoo.com> * References: <542789.4743.qm(a)web82103.mail.mud.yahoo.com> * Reply-to: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> * User-agent: Thunderbird 2.0.0.18 (Macintosh/20081105) ________________________________ Gong Cheng wrote: > I wonder if this is a small violation of the EAP-TTLS RFC (5281). > > In RFC 5281 http://tools.ietf.org/html/rfc5281#section-9.2.2, it states: > > " .... Fragments other than the first MUST NOT have the L > bit set. ... > " > > while this behavior is configurable in eap.conf: ... > I confess that I only actually SEE the behavior in the now ancient 1.1.6 version, and only took a quick look at the 2.1.0 config file and source code. I apologize if I missed something or this had been brought up before. I don't think it's serious. I don't know why this is a MUST NOT, because it makes very little difference to the protocol. And supplicants that break if the L bit is set on second fragments are badly written. Alan DeKok.

1 0

Re: Proxy - wrong IP
by Jørn Kostøl 05 Dec '08

05 Dec '08

I got it working once I upgraded to 2.1.2. Guess something was wrong with my 2.1.1 install. A pity that it's not possible to have more then one proxy listener as this would be very useful. I guess I'll have to nest multiple freeradius installs in the future when I need to proxy to other networks. Cheers, Jørn Greg Woods wrote: >> You can control this. Read radiusd.conf, and look for the >> documentation in the "listen" section. > > What this means in a nutshell is that there is no direct way to tell > freeradius what source IP address to use when proxying(I'll be happy > if I'm proven wrong on that). Perhaps you could try reading what I said? Or, if you're not running 2.x, .... upgrade. > The only way to accomplish this is to force freeradius to listen on > only a single IP address (which I think is what Alan is suggesting). > This will cause freeradius to use that IP as the source for anything > it sends. I have run into this issue on multihomed servers and it's > the only way I found to solve it. This is documented. It works. It does what I said. Alan DeKok.

2 1

include_length and EAP-TTLS
by Gong Cheng 05 Dec '08

05 Dec '08

I wonder if this is a small violation of the EAP-TTLS RFC (5281). In RFC 5281 http://tools.ietf.org/html/rfc5281#section-9.2.2, it states: " .... Fragments other than the first MUST NOT have the L bit set. ... " while this behavior is configurable in eap.conf: " # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # # include_length = yes " I understand that it is for EAP-TLS (which does not have this restriction) but I think EAP-TTLS is controlled by the same line. (?) I confess that I only actually SEE the behavior in the now ancient 1.1.6 version, and only took a quick look at the 2.1.0 config file and source code. I apologize if I missed something or this had been brought up before. -gong

2 1

usergroup
by sugiarto tjahyono 05 Dec '08

05 Dec '08

Hi All, I have a few problem. i have freeradius version 1.0.5 running with rlm_sql. radcheck : username, attribute, op, value "test1","password","==","testpass" "test2","password","==","testpass" radreply : none radusergroup : "test1","HS1" "test2","HS2" "test2","HS1" radgroupcheck : groupname, attribute, op, value "HS1","Called-Station-Id","==","device1" "HS2","Called-Station-Id","==","device2" radgroupreply : groupname, attribute, op, value,prio "HS1","Framed-Pool","=","pool1",0 "HS2","Framed-Pool","=","pool2",0 the problem is user test1 and test2 can connect and get pool1 but user test2 can't connect and can't get pool2 i already use Fall-Through = Yes in radreply and radgroupreply, but it still not work. when i use freeradius 2.1.1, that setting is work. Does freeradius 1.0.5 doesn't support multiple group or something wrong with my setting? how many group that can be assigned to one user in freeradius 2.1.1?

1 0

Proxy - wrong IP
by Jørn Kostøl 04 Dec '08

04 Dec '08

Hi, My server has two interfaces, A and B. My NAS is on interface A and I'm proxying to another Radius on interface B. My problem is that FreeRadius is sending packets to the Radius at interface B with the IP of interface A (the listening interface to my NAS). I'm running FreeRadius v2.1.1. I've tried to add another listening interface with the IP from interface B, but no difference (shot in the dark really). How can I force FreeRadius to use another IP for the proxying? Cheers, Jørn

3 3

Re: Beating a dead horse, or freeradius 2.1.1 and active directory
by tnt＠kalik.net 04 Dec '08

04 Dec '08

PS. What is the error that you get when you remove quote around ntlm_auth. For users file entry as is in the howto. Ivan Kalik Kalik Informatika ISP

2 4

windows supplicant
by Craig White 04 Dec '08

04 Dec '08

I've been working on this on/off for 2 weeks now and I'm confused. I found on this Windows laptop I've been playing with that I can't connect via the built-in Windows XP SP3 supplicant but one connection I can make is using the Intel ProSet (it's a 2100) but the only way that I've been able to connect is using TTLS. The Intel Pro-Set suggests that my connection is: Security Mode: WPA Encryption Algorithm: TKIP 802.11 Authentication: Open 802.1x Authentication: TTLS (MS-CHAP) and I note that MS-CHAPv2 doesn't work here So I'm now wondering if the problem is my setup of eap.conf the MS-CHAPv2 I am authenticating RRAS from a Windows server and Macintosh and iPhone clients without issue. Craig

1 0

Re: Beating a dead horse, or freeradius 2.1.1 and active directory
by Ben Little 04 Dec '08

04 Dec '08

The how to lists the user account in bold indicating it should be modified to fit my environment. I created a user named rtest in active directory and am using that account for testing I do not think it will matter if I create a user called user to test with but I can. There is an entry in the users file that states (according to the how to this can be used for testing) rtest Auth-type := "ntlm_auth" (Btw this fails unless ntlm_auth is inside quotes which is not shown in the how to) Which doesn't work using radtest. As far as the "warning" where exactly in the how to does it say to disable local auth because I sure didn't see it. This is enabled in the default install apparently because I sure didn't enable it. I appreciate the reply... --- Sent from Blackberry handheld device ----- Original Message ----- From: freeradius-users-bounces+blittle=skylight.com(a)lists.freeradius.org <freeradius-users-bounces+blittle=skylight.com(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Wed Dec 03 18:10:09 2008 Subject: RE: Beating a dead horse, or freeradius 2.1.1 and active directory >Rupert had mentioned in this thread that the switch is sending a PAP request and that it isn't being forwarded to the ntlm_auth module because of that, which makes sense I suppose. I am wondering though is there a way to configure the radius server to forward (or proxy) authentication requests to the KDC for authentication? I think what I'm doing is a little outside of the how-to that has been referenced. > .. > Module: Instantiating ntlm_auth > exec ntlm_auth { > wait = yes > program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=SKYLIGHT --username=%{mschap:User-Name} --password=%{User-Password}" > input_pairs = "request" > shell_escape = yes > } .. >rad_recv: Access-Request packet from host <switch> port 1645, id=46, length=84 > User-Name = "rtest" > User-Password = "<omitted>" > NAS-Port = 2 > NAS-Port-Id = "tty2" > NAS-Port-Type = Virtual > Calling-Station-Id = "<omitted>" > NAS-IP-Address = +- entering group authorize {...} .. >[files] users: Matched entry rtest at line 1 >++[files] returns ok .. >Found Auth-Type = Local >WARNING: Please update your configuration, and remove 'Auth-Type = Local' So, what happened to following the howto? Why is user entry for rtest setting Auth-Type Local and not ntlm_auth? There is nothing like that mentioned in the instructions. Debug is also printing a clear warning that that is wrong. Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Issue with PAP/LDAP authentication after upgrade FR 2.0.5 to FR 2.1.1
by Thibault Le Meur 04 Dec '08

04 Dec '08

Hi Gurus, I've just (auto)updated my FR from 2.0.5 to 2.1.1 and some authentications stop working. For these specific authentications the ldap module is used to retrieve the password from LDAP (hashed with MD5 or CRYPT, ...), and then PAP is used to compare the passwords (auto_header is turned on in the pap module). Before 2.1.1 everything was working. After 2.1.1, I get Authentication Failures because passwords don't match. I've analysed the debug log and I wonder if the auto_header of the pap module is really working! Here is an abstract of the radius debug logs (usernames,passwords, and IP address have been obfuscated): rad_recv: Access-Request packet from host 10.1.1.1 port 54251, id=6, length=94 User-Name = "username" User-Password = "USERPASSWD" NAS-IP-Address = 10.1.1.1 NAS-Port = 6 Service-Type = Dialout-Framed-User Calling-Station-Id = "10.1.1.10" NAS-Identifier = "OpenVpn" NAS-Port-Type = Virtual server mycompany-vpn-perso-ovpn { +- entering group authorize {...} ++[preprocess] returns ok ... [files_mycompany_vpn_perso_ovpn] users: Matched entry DEFAULT at line 2 ... ++[files_mycompany_vpn_perso_ovpn] returns ok ++- entering policy redundant {...} [ldap1] performing user authorization for username [ldap1] expand: %{Stripped-User-Name} -> [ldap1] expand: %{User-Name} -> username [ldap1] expand: (&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(MyCompany-AccountStatus=active)) -> (&(uid=username)(MyCompany-AccountStatus=active)) [ldap1] expand: dc=mycompany, dc=fr -> dc=mycompany, dc=fr .. rlm_ldap: extracted attribute Pool-Name from generic item Pool-Name:=Ovpn_Main_Pool [ldap1] Added User-Password = {MD5}/9sLgyXJRml0Lds4xd6rOg== in check items [ldap1] looking for check items in directory... rlm_ldap: mycompanyNTPassword -> NT-Password == 0xe0b531f2a8a5cb7ecd2b4951b1d79E1d [ldap1] looking for reply items in directory... [ldap1] user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[ldap1] returns ok ++- policy redundant returns ok ... ==> Until this line everything is ok: the userPassword attribute is added to User-Password because I have the line "password_attribute = userPassword" uncommented in my ldap module setup. Note also that I have the password in NT-Hashed format as well, but I don't intend to use it in this particular authentication process. ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group PAP {...} [pap] login attempt with password "USERPASSWD" [pap] Using clear text password "{MD5}/9sLgyXJRml0Lds4xd6rOg==" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. } # server mycompany-vpn-perso-ovpn Using Post-Auth-Type Reject ==> I have no reference to the User-Password attribute in my setup (either in the user "file" or in the radiusprofile taken from the ldap directory. It seems like the ldap module adds the User-Password attribute and then the PAP module decides to change it to Cleartext-Password instead of processing the auto_header feature and setting the MD5-Password. What do you think ? Is there somewhere in my setup where I could have broken the normal FR processing ? Many thanks in advance, Thibault

3 5

Beating a dead horse, or freeradius 2.1.1 and active directory
by Ben Little 04 Dec '08

04 Dec '08

Hello internet pals, I'm attempting to configure freeradius to be used as a AAA mechanism for a bunch of cisco routers and switches, I have freeradius working correctly with local users however it appears that it is completely ignoring the mschap configuration that I've applied, I'm not sure why... when attempting to perform a radtest locally I get the following: lol@id10t$ radiusd -X FreeRADIUS Version 2.1.1, for host i386-redhat-linux-gnu, built on Nov 24 2008 at 10:30:21 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client MR_SWITCHEROONIE { require_message_authenticator = no secret = "SUPER_SEKRAT_KEYZ" nastype = "cisco" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host *.*.*.* port 1645, id=2, length=102 User-Name = "windoze_luser" User-Password = "super sekrat passwordz" NAS-Port = 1 NAS-Port-Id = "tty1" NAS-Port-Type = Virtual Calling-Station-Id = "*.*.*.*" NAS-IP-Address = *.*.*.* +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "windoze_luser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 210 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> windoze_luser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 2 to 192.168.0.200 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 2 with timestamp +9 Ready to process requests. It appears that the mschap is returning noop and not even attempting to authenticate the user, here's what I have done so far... no changes to radiusd.conf (I have read several times that if I touch this file I get smacked like a red headed step child) changes made to /modules/mschap mschap { #use_mppe = no #require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" not really any changes to /sites-enabled/default I've tried adding ntlm_auth to the authenticate section but it doesn't seem to like that...here's the output from that. Module: Checking authenticate {...} for more modules to load /etc/raddb/sites-enabled/default[260]: Failed to find module "ntlm_auth". /etc/raddb/sites-enabled/default[227]: Errors parsing authenticate section. } Errors initializing modules I have read the "how to" on deployingradius.com however, this "how to" appears to be written for a much older version of freeradius since many of the attributes mentioned are no longer contained in radiusd.conf, I've also looked at the freeradius wiki without much luck. I think I have everything configured correctly EXCEPT for freeradius utilizing the module for ntlm_auth. Thanks for any help!

4 15