- Freeradius-Users - lists.freeradius.org

RE: freeradius and active directory
by Josh Howlett 23 Dec '07

23 Dec '07

> Using Ntlm_auth from the samba server is not an option. I > want to access the AD with the ldap protocol for > compatibility reasons. You can't. > Next, I want to place the logged on > user is a specific VLAN. So I have to retrieve the user's > vlan from the AD. Is there any way to configure freeradius to > do so? Yes, see the docs. > Can you please provide me with the necessary steps to accomplish this? Ditto. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxfordshire. OX11 0SG

3 4

Error building rpm
by Jim McIver 22 Dec '07

22 Dec '07

I'm a newbie. I'm trying to build the FreeRadius 1.1.7 rpm for SLES 10 OES so I can interface the Radius with Netware 6.5 eDirectory. I ran rpmbuild -ba SPEC/freeradius.spec and added all the dependencies and ran the command again. It goes along for a while and now I get: Checking for unpackaged file(s): /usr/lib/rpm/check-files /var/tmp/freeradius-1.1.7-build error: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf RPM build errors: Installed (but unpackaged) file(s) found: /etc/raddb/postgresqlippool.conf Any thoughts, or is there an easier way? Thx, -Jim McIver

2 2

Re: reply from home server
by Дмитрий 21 Dec '07

21 Dec '07

> Sure! Send us patch! > > Alan DeKok. In file src/main/request_list.c string 1105 will be: client_name(request->proxy->dst_ipaddr), and string 1106 will be: request->packet->dst_port); Please, send it in cvs. Thanks! Сысоев Дмитрий Александрович Сетевой администратор Отдел информационных технологий ЗАО ''Ульяновская Сотовая Связь'' Тел.: +7 (901) 947 17 31 Моб.: +7 (901) 947 02 71 Факс: +7 (8422) 43 51 99

3 3

Unknown CA
by Gaurav Bandekar 21 Dec '07

21 Dec '07

Hi, I have configured the radius server to authenticate EAP-PEAP-MSCHAPv2 I have followed the steps mentioned in the following link. http://wiki.freeradius.org/WPA_HOWTO But the client is not able to authenticate. I am attaching the radiusd log. The log shows a Unknown CA error. Can anyone help??? Thanks & Regards Gaurav

1 0

How to configure RADIUS server to test EAP-SIM
by Raghavendra. S 21 Dec '07

21 Dec '07

Hi All, I want to use RADIUS server to test EAP-SIM. I would like to know how to configure eap.conf, users, radiusd.conf and clients.conf to support EAP-SIM. Also plz let me know if I have to configure some more files. Actually I want to test wpa supplicant for EAP-SIM. So I need to configure RADIUS server. I am working on snapshot of freeradius, that is * freeradius-snapshot-20051130*. radiusd(after) version-1.1.0. -- Regards & Thanks Raghavendra. S

3 4

Re: freeradius and active directory
by Kenneth Marshall 20 Dec '07

20 Dec '07

On Thu, Dec 20, 2007 at 09:44:25PM +0100, Rutger Beyen wrote: > Hello, > I'm very glad I found a list like this. I hope some of you can help me with > this problem. > > I want to set up a project with 802.1X, so users accessing my cisco switch > first have to log on. I found out that I could use freeradius for this. But > what I want to do is verify if the credentials entered by the user (on a > WinXP) are correct, by checking with the Active Directory on a > Win2003Server. Using Ntlm_auth from the samba server is not an option. I > want to access the AD with the ldap protocol for compatibility reasons. > Next, I want to place the logged on user is a specific VLAN. So I have to > retrieve the user's vlan from the AD. Is there any way to configure > freeradius to do so? I would like to base the vlan on the OU of the person > in the AD. > Can you please provide me with the necessary steps to accomplish this? > > > Thank you very much, > Rutger Rutger, I think that if you do not use ntlm_auth, you will need a 3rd party supplicant for the Windows boxes. You probably will need to use ntlm_auth and also bind to AD using the LDAP protocol to lookup the OU/VLAN. Ken

1 0

freeradius and active directory
by Rutger Beyen 20 Dec '07

20 Dec '07

Hello, I'm very glad I found a list like this. I hope some of you can help me with this problem. I want to set up a project with 802.1X, so users accessing my cisco switch first have to log on. I found out that I could use freeradius for this. But what I want to do is verify if the credentials entered by the user (on a WinXP) are correct, by checking with the Active Directory on a Win2003Server. Using Ntlm_auth from the samba server is not an option. I want to access the AD with the ldap protocol for compatibility reasons. Next, I want to place the logged on user is a specific VLAN. So I have to retrieve the user's vlan from the AD. Is there any way to configure freeradius to do so? I would like to base the vlan on the OU of the person in the AD. Can you please provide me with the necessary steps to accomplish this? Thank you very much, Rutger

1 0

Re: Freeradius-Users Digest, Vol 32, Issue 65
by John Ellin 20 Dec '07

20 Dec '07

On December 20, 2007 06:00, freeradius-users-request(a)lists.freeradius.org wrote: > > config is radius + LDAP and worked fine on the old machine but, on the > > new machine it works fine when debugging, but not at all when running as > > a daemon. > > You can run it as a daemon, *and* have extended debugging. Just use > radiusd -xxx. > > > Tried running in debug as radius:radius and still worked, so it doesn't > > appear to be a problem with config directory/file ownership. > > > > Any suggestions would be greatly appreciated... > > Run it as "radiusd -fxxx" from the command line, and see if it works > then. If I run it as -xxx from the command line it works. As soon as I drop the -x it stops working: radiusd -xxx works radiusd -x works radiusd -y doesn't work radiusd doesn't work my default sys V init script has -y. I have changed it to -x and it works, but it is worrying that I didn't have this problem before I moved to the new machine. Also, using -x makes it run in the foreground, whether or not I'm using -f. I'm starting to wonder if the guys at Mandriva have been messing in the code for their distribution... -- Best regards, jona. There's a fine line between being on the leading edge and being in the lunatic fringe. --- Frank Armstrong

2 1

Re: Help w/ pam radius
by Jeff Fishbaugh 20 Dec '07

20 Dec '07

Just thought I would reply to my own thread since I figured it out and probably others can benefit from it.... yes yes yes the variations in distro's PAM implementation will kill you.... that was all it was.... so beware -- knowing your PAM system on your machines is crucial if you don't want to do a lot of head scratching. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug client_id=linux auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so Haven't figured this error out yet... Wed Dec 19 15:50:05 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE _CERT option to allow ...but least I can auth SSH with RADIUS so I am a happy camper. ----- Original Message ----- From: Jeff Fishbaugh To: Jeff Fishbaugh ; freeradius-users(a)lists.freeradius.org Sent: Tuesday, December 18, 2007 5:49 PM Subject: Re: Help w/ pam radius Seems like I am getting closer possibly, but I see an error in radius.log -- could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow. Basically, I go to login to my pam_radius host, user exists in local password file with no pass, user/pass in RADIUS/LDAP, and when I login the SSH session immediately exits and I see the below in radius.log. If I use a login not in the local password file, but it is in RADIUS/LDAP then I get an access denied and no mention of the below error. I am not even starting TLS so why is it even complaining about it??? I am also curious what this means -- rlm_exec: Wait=yes but no output defined. Did you mean output=none? Appreciate any help. Thanks! Tue Dec 18 19:32:48 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Dec 18 19:32:48 2007 : Info: Ready to process requests. Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:35:55 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:36:03 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow ----- Original Message ----- From: Jeff Fishbaugh To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, December 18, 2007 2:13 PM Subject: Help w/ pam radius Hello: I am having trouble getting pam_radius working and was wondering if someone might be of help since I followed the INSTALL instructions as well as a howto (as provided by the Wikid folks) and I am still coming up short getting it working. Here are some of my details - My PAM is such it is by service (Fedora 7 -- 0.99.7.1-5.1)....sshd being what I am most interested in, the default config for it looks like the below on a host I want talking to radius. What does this need to look like in terms of the pam_radius_auth.so related stanzas to get it working? Neither the INSTALL instructions or a howto I found would work. /etc/pam.d/sshd (default below) #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so - My Radius box runs freeradius (freeradius-1.1.7-3.1) with LDAP (fedora-ds) backending it with the user/pass info, got it working for Cisco's but have yet to get PAM working. I just get 'Access denied' -- tried the later with a user defined on the host with no password or with a password and won't work. Pretty simple, no huntgroups or anythig like that just plain and simple binding against LDAP. I think what I am looking for are... 1- Pam configuration on the host (ie- /etc/pam.d/sshd) 2- Pam configuration requirements as far as the radius server is concerned. Be helpful to see what all I might need that I am possibly missing in conf files. Thank you!

2 1

Re: reply from home server
by Дмитрий 20 Dec '07

20 Dec '07

> Edit the source code to update the message that is being printed. > > Alan DeKok. Thanks! Do not prompt where exactly? And why it to not bring at all in the distribution kit?

2 1