- Freeradius-Users - lists.freeradius.org

PEAP MSCHAP2 Freeradius Active Directory
by fvt3 28 Jun '06

28 Jun '06

Hi, I have a question on configuring freeradius to return vlan attributes base on a user group membership or ou. I have a windows client xp sp2 using peap mschap2 to authenticate off radius. How do I set radius to return a vlan id of 10 if the user belongs to the student group and if the user belongs to the teacher group the user get a vlan id of 20? I have freeradius to authenticate of Active Directory but its only returning one vlan.. DEFAULT NAS-Port-Type == "Wireless-802.11" Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 10, Tunnel-Type = VLAN Do I have add something else in the user file? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 3

RE: PEAP MSCHAP2 Freeradius Active Directory
by Chris Liles 28 Jun '06

28 Jun '06

I thought the ldap module wouldn't work with PEAP and AD unless you store the LM and NT password hashes for each user in AD?! Because you can't get the cleartext password back from AD... I don't think that extending AD to store this info would be difficult, I just think having those hashes updated when I user changes his/her password would be a pain, but I don't know. -- Chris Liles > -----Original Message----- > From: freeradius-users- > bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius- > users-bounces+chris.liles=air2web.com(a)lists.freeradius.org] On Behalf Of > Phil Mayers > Sent: Wednesday, June 28, 2006 4:20 PM > To: FreeRadius users mailing list > Subject: Re: PEAP MSCHAP2 Freeradius Active Directory > > fvt3 wrote: > > Hi, > > > > I have a question on configuring freeradius to return > > vlan attributes base on a user group membership or ou. > > I have a windows client xp sp2 using peap mschap2 to > > authenticate off radius. How do I set radius to > > return a vlan id of 10 if the user belongs to the > > student group and if the user belongs to the teacher > > group the user get a vlan id of 20? I have freeradius > > to authenticate of Active Directory but its only > > returning one vlan.. > > > > DEFAULT NAS-Port-Type == "Wireless-802.11" > > Tunnel-Medium-Type = IEEE-802, > > Tunnel-Private-Group-Id = 10, > > Tunnel-Type = VLAN > > > > Do I have add something else in the user file? > > You will need to configure the LDAP module to fetch groups from ADs LDAP > server. See copious documentation or posts to the list. Broadly, once > the LDAP module is setup correctly: > > DEFAULT NAS-Port-Type == "Wireless-802.11", Ldap-Group == "Students" > Tunnel-Medium-Type = IEEE-802, > Tunnel-Private-Group-Id = 10, > Tunnel-Type = VLAN > > DEFAULT NAS-Port-Type == "Wireless-802.11", Ldap-Group == "Staff" > Tunnel-Medium-Type = IEEE-802, > Tunnel-Private-Group-Id = 20, > Tunnel-Type = VLAN > > Alternatively if you fill AD in from some external system e.g. SQL > database you can pull from there, or dump the groups to a file like so: > > username:groupname > > ...and use the (poorly-named) "passwd" module to add the group. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

Installation on SuSE 10 x64
by Roger Rhody 28 Jun '06

28 Jun '06

Hi, I keep getting the following error when building freeRADIUS on SuSE 10 x64. /usr/lib/libltdl.so: could not read symbols: File in wrong format I have tried to configure with the flag --disable-ltdl-install and without and get the same message each time. Is there something else I need to do to get this built on x64 Linux? Trying to install freeradius-1.1.2. Thank you, Roger Rhody Programmer / Analyst burton + BURTON rrhody(a)burtonandburton.com (706) 548-1588 Notice: This e-mail (including attachments) is covered by the Electronic Communications Privacy Act, 10 U.S.C. 2510-2521, is confidential and may be legally privileged. If you are not the intended recipient, you are hereby notified that any retention, dissemination, distribution, or copy of this communication is strictly prohibited. Please reply to the sender that you have received the message in error and then delete it. Thank you.

1 0

radwho doesnt work - complains about missing radutmp file
by liran tal 28 Jun '06

28 Jun '06

This is the error I'm getting: radwho: Error reading /var/log/freeradius/radutmp: No such file or directory radutmp indeed doesn't exist in /var/log Does anyone know why is freeradius not creating the radutmp file? Thanks.

4 4

Re: Please help !!!
by Kartthik Raghunathan 28 Jun '06

28 Jun '06

Using the same FR, authenticating wireless client sagainst the Active directory using PEAP and TLS and now trying to authenticate the PPTP clients against the Active directory thru Dlink FW. The first part works like charm...and the second one i have issue with and here is the MSCHAP configuration on radiusd.conf mschap { authtype = MS-CHAP use_mppe = no require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Here is the log when pptp client dials into the pptp server (ie. Dlink FW, parameters are configured as MPPE 128 bit encryption and MSCHAPV2). rad_recv: Access-Request packet from host 192.168.0.1:2838, id=68, length=151 User-Name = "TEST\\kartthikr" MS-CHAP2-Response = 0x200038088c81bfc0e2d29944dc15551174ab0000000000000000231accd16d14cd2691a3d4ebc78d51577067db9138eaf627 MS-CHAP-Challenge = 0xfb3fee292c917043d609ddf16c97b78c NAS-Identifier = "Clavister" NAS-Port = 0 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "TEST\kartthikr", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for kartthikr with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: fb radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=kartthikr --domain=TEST --challenge=ee58ce24154980e8 --nt-response=231accd16d14cd2691a3d4ebc78d51577067db9138eaf627' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=kartthikr --domain=TEST --challenge=ee58ce24154980e8 --nt-response=231accd16d14cd2691a3d4ebc78d51577067db9138eaf627 Exec-Program output: NT_KEY: 67F102C088FF660F615D1F9236DF9797 Exec-Program-Wait: plaintext: NT_KEY: 67F102C088FF660F615D1F9236DF9797 Exec-Program: returned: 0 modcall[authenticate]: module "mschap" returns ok for request 0 modcall: leaving group MS-CHAP (returns ok) for request 0 Sending Access-Accept of id 68 to 192.168.0.1 port 2838 MS-CHAP2-Success = 0x20533d36333943444337363042443142463535393941334136453634453645364430343545333138363336 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 68 with timestamp 44a2cf37 Kartthik > I have freeradius setup for wireless client access againt the active > directory and its working good. Now using the same FR trying to > authenticating pptp clients against AD using Dlink firewall. While > the pptp client connect to the dlink fw, getting this error message > "the remote server doesnt support the support the encryption > type". So it's a DLINK problem. > The dlink support guys told that the encryption on the freeradius > server is not correct. Do you guys think this makes sense ? Since you didn't show any of the RADIUS logs, there's no way to tell. > Note: In dlink fw, the mppe encryption has been enabled. Does > freeradius support this encryption type too ? Yes. Alan DeKok. -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

2 1

Fixed IP
by Mahesh S Kudva 28 Jun '06

28 Jun '06

Hi I am running Freeradius on Mac OS X. How do i assign fixed IP address to my wireless clients who are authenticating under Apple BAse stations?? Any suggestions welcome Regards & Thanks ================ Mahesh S Kudva ----------------------------------------------- Robosoft Technologies - Come home to Technology

3 4

RE: mpd+freeradius+AD
by Егоров Сергей 28 Jun '06

28 Jun '06

>This is Framed-IP-Address in radius dialect. Thanks for explaining freeradius basic concepts. I understood, that to assign IP to user I should use users freeradius file. But I couldn't configure it correctly. Now I have only one line in this file DEFAULT Auth-Type := MS-CHAP I've add another string (for user test), but it doesn't correct test Auth-Type := MS-CHAP, Framed-IP-Address = 192.168.10.65, Fall-Through = Yes That should I fix? -----Original Message----- From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] Sent: Monday, June 26, 2006 5:09 PM To: freeradius-users(a)lists.freeradius.org Cc: Егоров Сергей Subject: Re: mpd+freeradius+AD On Monday 26 June 2006 14:04, Егоров Сергей wrote: > Thanks for reply. > > >You can use one of the three firewalls avaliable in the base system(ipfw, > > >ipf and pf), however mpd comes with a small dictionary that uses > > ipfw(8) >and you can easily define some filter bound to an interface > > (bound to a >username) via a radius reply attribute, let filter be a > > pipe(for bandwidth >control) or a packet filtering expression. > > That's fine for filtering vpn users access to local net. But how could I > assign specific IP for specific user in AD? > > > Your questions don't clearly tell where your problem is. > >Active Directory? mpd? or FreeRADIUS? You should define > >them better in order to get help from the list. > > My goal is to replace VPN server, based on win2003, with FreeBSD one. WIN > 2003 can do 1 and 2 in my questions, so I have to realize how to setup this > in mpd + freeradius. I already authenticate users from AD group: > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00} > --require-membership-of=EXAMPLE+VPN_Allowed". > > But I have several vpn groups and need to setup timeouts on each one. setup timeout? This looks like Session-Timeout in radius dialect. > Also > I need to I assign specific IP for specific user in AD. This is Framed-IP-Address in radius dialect. > Looks like > FreeRadius should respond for this. Yes, you have to have basic understanding of what radius is. All of these are very basic setup. I don't know how FreeRADIUS interacts with AD and what info it should get from AD. So, try searching (or asking) for active directory and FreeRADIUS. Keep the mpd part out of it, since it will add unneeded complexity. Or perhaps start from setting up mpd and FreeRADIUS. And then you could add AD. A few suggestions, Nikos

1 0

using radius with samba
by Wutz, Josef 28 Jun '06

28 Jun '06

Hello, I have freeradius version 1.1.2 and a samba installation with version 3.0.23. My Samba works as a Windows NT 4.0 PDC. Now I want that the radius sends authentication requests to the samba. So that I can logon on on the radius server with my samba domain login. What parameter in radiusd.conf I have to change that this function works? Thank you very much for your help Josef

1 0

dial-up admin and authentication time
by Pelusa Vali 27 Jun '06

27 Jun '06

hi list, i have 2 questions, hope could help. 1) trying to use dial-up admin in my wlan, i installed it and created tables, first filled them manually with some users, later filled new users using dial-up interface, but i only can see first user's statistics, any other user, even connected, is not show. any body knows where am i failing?? 2) time of authentication is too long, i guess, i use madwifi and hostapd, first time clients connect authentication could take 5-6 minutes, after 10 minutes they are disconnected (don't know why) and re-authenticated, it takes now, 1-2 minutes. are there any parameter i should change or why is it happening??? thanks for your time and help. _______________________________________________________________ Halloween Humour: What do you call a skeleton that pushes your doorbell? postmaster.co.uk http://www.postmaster.co.uk/cgi-bin/meme/quiz.pl?id=136

1 0

Please help !!!
by Kartthik Raghunathan 27 Jun '06

27 Jun '06

I have freeradius setup for wireless client access againt the active directory and its working good. Now using the same FR trying to authenticating pptp clients against AD using Dlink firewall. While the pptp client connect to the dlink fw, getting this error message "the remote server doesnt support the support the encryption type". The dlink support guys told that the encryption on the freeradius server is not correct. Do you guys think this makes sense ? Note: In dlink fw, the mppe encryption has been enabled. Does freeradius support this encryption type too ? -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

2 1