- Freeradius-Users - lists.freeradius.org

Yet Another AD Question
by Josh 25 May '06

25 May '06

I've crawled the web for info and tried numerous things to get FreeRadius authenticating users with a 2003 Active Directory. I'm currently running FreeRadius (with MySQL) on RHEL4 using the RPMs included with RHEL4: freeradius-1.0.1-3.RHEL4 freeradius-mysql-1.0.1-3.RHEL4 Running radiusd in debug mode (-X) shows a successful bind to the AD server. I then can see rlm_ldap performing a search and then eventually fails: -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= <snip> rlm_ldap: Bind was successful rlm_ldap: performing search in cn=Users,dc=org,dc=my,dc=domain,dc=com, with filter cn=administrator ldap_search put_filter: "cn=administrator" put_filter: default put_simple_filter: "cn=administrator" ldap_send_initial_request ldap_send_server_request ldap_result msgid 2 ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 4 sec, 0 usec), msgid 2 wait4msg continue, msgid 2, all 1 ** Connections: * host: org.my.domain.com port: 389 (default) refcnt: 2 status: Connected last used: Wed May 24 12:14:51 2006 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 2, all 1 ldap_read: message type search-result msgid 2, original id 2 ldap_chase_referrals read1msg: V2 referral chased, mark request completed, id = 2 new result: res_errno: 1, res_error: <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 2 request 2 done res_errno: 1, res_error: <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_err2string rlm_ldap: ldap_search() failed: Operations error ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns fail for request 0 modcall: group authenticate returns fail for request 0 auth: Failed to validate the user. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= I'm not sure if I'm using the wrong ldap search or what. Here's my ldap section of radiusd.conf: server = "org.my.domain.com" ldap_debug = 0xFFFF basedn = "cn=Users,dc=org,dc=my,dc=domain,dc=com" filter = "cn=%u" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 Although I'd like to avoid it, but, would it be easier to install SAMBA on the RHES4 box and connect SAMBA to AD and then connect FreeRadius to SAMBA? I've also come across possible issues with certain versions of openldap and 2003 AD? As soon as this part is working I'll be authenticating wireless users (using Cisco APs) as well. But I think that should run fairly smooth as soon as FreeRadius and AD are talking the same language. I hope there are some Radius/AD gurus out there? Many thanks in advance... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 6

RE: PEAP + AD
by Chris Liles 25 May '06

25 May '06

If you read the FAQ is says that you can't do CHAP with LDAP. [speculation] But I have also read about some guy successfully using OpenLDAP with PEAP because he stored the LM and NT password hashes in the ldap schema along with the clear text password. With AD I suppose you could extend the schema to store these as well, but you'd have to manually update them when a password changes. [/end speculation] In my attempts to use ldap with active directory for PEAP it wouldn't work, so I went samba. It works fine. Radiusd -X and the mailing list are your best friends. :) -- Chris Liles -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Kartthik Raghunathan Sent: Thursday, May 25, 2006 12:17 AM To: freeradius-users(a)lists.freeradius.org Subject: PEAP + AD Am trying to authenticate my windows supplicant (ie. XP with sp2) with peap against the windows 2000 AD. But in the error log i could see "Accept-Reject" error message. So i need a clarification here, is't necessary to get samba on with active directory to do PEAP + AD authentication. sorry for silly q? here ! -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as… - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

nas table
by Santiago Balaguer García 25 May '06

25 May '06

Hi people, I use freeradius 1.0.5 and am getting my nas information from nas table since several months ago. How ever, I realize I have to put DNS in this table because I have DDNS entries. Where must I put the DDNS in this table?? In ipddr I can not because is inet type and a primary key. What can I do?? _________________________________________________________________ ¿Estás pensando en cambiar de coche? Todas los modelos de serie y extras en MSN Motor. http://motor.msn.es/researchcentre/

2 1

PEAP + AD
by Kartthik Raghunathan 25 May '06

25 May '06

Am trying to authenticate my windows supplicant (ie. XP with sp2) with peap against the windows 2000 AD. But in the error log i could see "Accept-Reject" error message. So i need a clarification here, is't necessary to get samba on with active directory to do PEAP + AD authentication. sorry for silly q? here ! -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

2 1

rlm_sqlippool - try sql if not try sql1
by RobertB 25 May '06

25 May '06

Hi All At present it is not possible to do something like: try sql, if not available try sql1. Are there any planes to add this functionality in the future? Regards, Robert

2 1

EAP-SIM compliancy
by Geoffroy Arnoud 25 May '06

25 May '06

Hi all, I have a question regarding EAP-SIM authentication, in the case where authentication is performed by an external AAA system. We already perform LEAP and EAP-TLS authentication against an external AAA system authentication through FreeRADIUS (FreeRADIUS acts as a proxy for EAP authentication). Regarding EAP-SIM, is FreeRADIUS compliant with the latest EAP-SIM version that became a RFC (RFC 4186), in the case where authentication is performed by an external AAA system? Thank you for you answers Geof.

6 10

Error: Unexpected trailing comma in User file
by sumi thra 25 May '06

25 May '06

Hi All, I am getting some error like: Module: Loaded files files: usersfile = "/var/etc/raddb/users" files: acctusersfile = "/var/etc/raddb/acct_users" files: preproxy_usersfile = "/var/etc/raddb/preproxy_users" files: compat = "no" /var/etc/raddb/users[4]: Parse error (check) for entry DEFAULT: Expected end of line or comma Errors reading /var/etc/raddb/users radiusd.conf[201]: files: Module instantiation failed. radiusd.conf[311] Unknown module "files". radiusd.conf[299] Failed to parse authorize section. The users file looks like this.. # WLAN Allow policy for the groups # WLAN Deny policy for the groups DEFAULT Group-Name == "group1", Symbol-Wlan-Index =~ "\`\-\=\\[\]\;\'\,\.\/\~\!\@\#\$\%\^\&\\*\_\+\\{\}\|\:\"\<\>|dksljf\\{\}\\[\]\\{\\{\\{\\{\\{\\{\\{\\{\\{\\{\\{|103|sdhghd|dsfdfd|106|107|108|109|110|111|112|113|114|115|116|117|118|119|120|121|122|123|124|125|126|127|128|129|130|131|132",Auth-Type:=Reject anonymous Anonymous DEFAULT Realm != "NULL" DEFAULT Auth-Type := Reject The dictionary file is defined as : # # dictionary.mine. # VENDOR me 388 # # Vendor Specific Attributes. # # Attribute for Wlan Index of the authenticating mobile unit. ATTRIBUTE Symbol-Wlan-Index 2 String me Please help me in resolving this issue. Thanks Sumi "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

1 0

RE: Using PEAP and WinXP
by King, Michael 25 May '06

25 May '06

> -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of simon(a)434canada.com > Sent: Wednesday, May 24, 2006 3:02 PM > To: freeradius-users(a)lists.freeradius.org > Subject: Using PEAP and WinXP > > Hi, > > I have a question regarding the setup for the WinXP client > when using PEAP. Does one always need to go into the > properties for the AP and configure which servers to connect > to or which root certification authorities are trusted? What > I mean is, whether you produced a server certificate yourself > and imported that CA onto the client machine, or whether you > had a certificate signed by someone like Verisign, you would > need to check the corresponding CA within the list. It's my understanding that this is to prevent a man in the middle attack. Someone could easily setup a rouge AP, with a RADIUS Server. Since your requiring the server to identify itself (Via the Cert) you could detect this, and prevent it.

2 1

could not determine local IP address
by Italo Morellato 24 May '06

24 May '06

Hi, my freeradius work fine with HotSpot but when I check ppp I've one error. Freeradius 1.1.1 Log is paste below... _______________________________________________________ 14:16:43 pppoe,info PPPoE connection established from 00:15:D6:02:03:54 14:16:43 pppoe,ppp,info <pppoe-0>: waiting for call... 14:16:46 radius,debug new request 53:22f code=Access-Request service=ppp called-id=PPPoE 14:16:46 radius,debug sending 53:22f to 10.10.0.3:1812 14:16:46 radius,debug,packet sending Access-Request with id 107 to 10.10.0.3:1812 14:16:46 radius,debug,packet Signature = 0xe32e234bcf749c15d2afd34a9230f93c 14:16:46 radius,debug,packet Service-Type = 2 14:16:46 radius,debug,packet Framed-Protocol = 1 14:16:46 radius,debug,packet NAS-Port = 2336 14:16:46 radius,debug,packet NAS-Port-Type = 15 14:16:46 radius,debug,packet User-Name = "bar.sport" 14:16:46 radius,debug,packet Calling-Station-Id = "00:15:D6:02:03:54" 14:16:46 radius,debug,packet Called-Station-Id = "PPPoE" 14:16:46 radius,debug,packet NAS-Port-Id = "wlan2" 14:16:46 radius,debug,packet User-Password = 0x70717971616c7862 14:16:46 radius,debug,packet NAS-Identifier = "nas1" 14:16:46 radius,debug,packet NAS-IP-Address = 10.10.0.30 14:16:46 radius,debug,packet received Access-Accept with id 107 from 10.10.0.3:1812 14:16:46 radius,debug,packet Signature = 0x1be3b01ec0d51d96708eb74a61ae07dc 14:16:46 radius,debug,packet Framed-Protocol = 1 14:16:46 radius,debug,packet Framed-MTU = 1488 14:16:46 radius,debug,packet Service-Type = 2 14:16:46 radius,debug,packet Framed-IP-Address = 10.0.0.210 14:16:46 radius,debug,packet Framed-IP-Netmask = 255.255.255.0 14:16:46 radius,debug,packet MT-Rate-Limit = "192k/64k 1024k/100k 10/5 15/10" 14:16:46 radius,debug,packet Framed-Route = "10.0.0.210 10.0.0.1 1" 14:16:46 radius,debug received reply for 53:22f 14:16:46 radius,debug new request 53:00 code=Accounting-Request service=ppp called-id=PPPoE 14:16:46 radius,debug sending 53:00 to 10.10.0.3:1813 14:16:46 radius,debug,packet sending Accounting-Request with id 108 to 10.10.0.3:1813 14:16:46 radius,debug,packet Signature = 0xd55b07590e70cb5bda1a1d4b0b164b52 14:16:46 radius,debug,packet Service-Type = 2 14:16:46 radius,debug,packet Framed-Protocol = 1 14:16:46 radius,debug,packet NAS-Port = 2336 14:16:46 radius,debug,packet NAS-Port-Type = 15 14:16:46 radius,debug,packet User-Name = "bar.sport" 14:16:46 radius,debug,packet Calling-Station-Id = "00:15:D6:02:03:54" 14:16:46 radius,debug,packet Called-Station-Id = "PPPoE" 14:16:46 radius,debug,packet NAS-Port-Id = "wlan2" 14:16:46 radius,debug,packet Acct-Session-Id = "81b000bb" 14:16:46 radius,debug,packet Framed-IP-Address = 10.0.0.210 14:16:46 radius,debug,packet Framed-IP-Netmask = 255.255.255.0 14:16:46 radius,debug,packet Acct-Authentic = 1 14:16:46 radius,debug,packet Acct-Status-Type = 1 14:16:46 radius,debug,packet NAS-Identifier = "nas1" 14:16:46 radius,debug,packet NAS-IP-Address = 10.10.0.30 14:16:46 radius,debug,packet Acct-Delay-Time = 0 14:16:46 pppoe,ppp,info <pppoe-bar.sport>: authenticated 14:16:46 radius,debug,packet received Accounting-Response with id 108 from 10.10.0.3:1813 14:16:46 radius,debug,packet Signature = 0x27de569383671ca089573c7ae29f3f82 14:16:46 radius,debug received reply for 53:00 14:16:46 radius,debug request 53:00 processed 14:16:49 pppoe,ppp,info,account bar.sport logged out, 3 84 66 9 9 14:16:49 radius,debug new request 53:00 code=Accounting-Request service=ppp called-id=PPPoE 14:16:49 radius,debug sending 53:00 to 10.10.0.3:1813 14:16:49 radius,debug,packet sending Accounting-Request with id 109 to 10.10.0.3:1813 14:16:49 radius,debug,packet Signature = 0xd9902db18247432350accc014c13615a 14:16:49 radius,debug,packet Service-Type = 2 14:16:49 radius,debug,packet Framed-Protocol = 1 14:16:49 radius,debug,packet NAS-Port = 2336 14:16:49 radius,debug,packet NAS-Port-Type = 15 14:16:49 radius,debug,packet User-Name = "bar.sport" 14:16:49 radius,debug,packet Calling-Station-Id = "00:15:D6:02:03:54" 14:16:49 radius,debug,packet Called-Station-Id = "PPPoE" 14:16:49 radius,debug,packet NAS-Port-Id = "wlan2" 14:16:49 radius,debug,packet Acct-Session-Id = "81b000bb" 14:16:49 radius,debug,packet Framed-IP-Address = 10.0.0.210 14:16:49 radius,debug,packet Framed-IP-Netmask = 255.255.255.0 14:16:49 radius,debug,packet Acct-Authentic = 1 14:16:49 radius,debug,packet Acct-Session-Time = 3 14:16:49 radius,debug,packet Acct-Input-Octets = 84 14:16:49 radius,debug,packet Acct-Input-Gigawords = 0 14:16:49 radius,debug,packet Acct-Input-Packets = 9 14:16:49 radius,debug,packet Acct-Output-Octets = 66 14:16:49 radius,debug,packet Acct-Output-Gigawords = 0 14:16:49 radius,debug,packet Acct-Output-Packets = 9 14:16:49 radius,debug,packet Acct-Status-Type = 2 14:16:49 radius,debug,packet Acct-Terminate-Cause = 9 14:16:49 radius,debug,packet NAS-Identifier = "nas1" 14:16:49 radius,debug,packet NAS-IP-Address = 10.10.0.30 14:16:49 radius,debug,packet Acct-Delay-Time = 0 14:16:49 radius,debug,packet received Accounting-Response with id 109 from 10.10.0.3:1813 14:16:49 radius,debug,packet Signature = 0x10f27bb799de8887cb49f8239f5446de 14:16:49 radius,debug received reply for 53:00 14:16:49 radius,debug request 53:00 processed 14:16:49 pppoe,ppp,info <pppoe-bar.sport>: terminating... - could not determine local IP address 14:16:49 pppoe,ppp,info <pppoe-bar.sport>: disconnected Question: local IP address are determine automatically? Is an error of radiusd.conf? from the log I see accounting terminate successfully (user & password with sql databse) an error occurred with NAS ?? many thanks for any suggestion..

2 2

MAC authentication
by simon＠434canada.com 24 May '06

24 May '06

Hi, I am wondering if it is possible (and if so, how) to set up the clients.conf file to have clients recognized by their MAC address instead of their IP address (or an IP range). Not sure if this is possible, or the proper file to try in, but would love to hear some feedback. Thanks, Simon

2 1