- Freeradius-Users - lists.freeradius.org

RE: with_ntdomain_hack
by Chris Liles 11 May '06

11 May '06

You are right, it was that I was lowercasing the username before authentication... After I turned that off, I am getting further, it still doesn't work and I believe it is because of a problem with "Stripped-User-Name" and ntlm_auth ntlm_auth is getting called with the entire username "DOMAIN\user" and not "user" I don't understand why, as in the config file it says: --username=%{Stripped-User-Name:-%{User-Name:-None}} I didn't edit that part of the ntlm_auth line, just corrected the path.. I know this is a problem because when I use ntlm_auth from the command line I can't use --username=DOMAIN\user I have to use --username=user I hacked up the line to just say %{Stripped-User-Name} but that value must be null or something, because then ntlm_auth gets called with "--username=" Any thoughts as to why I can't get the DOMAIN\ stripped when calling ntlm_auth Thanks! -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309 -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of King, Michael Sent: Wednesday, May 10, 2006 3:39 PM To: FreeRadius users mailing list Subject: RE: with_ntdomain_hack > -----Original Message----- > I can't seem to figure out how to get with_ntdomain_hack set > correctly. > > I am trying to get peap going against active directory with winbind. > > It works if I enter in the username and password from the > windows supplicant prompt, but when I set the supplicant to > send the information automatically it is appending the > domain\ onto the username, and I can't get it to work? > I don't think it's the ntdomain hack that is the problem (It should be on, and I'm only aware of it being located in the radiusd.conf file, just above the ntlm_auth line I'd double check that your Samba config is correct. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Regarding on " radtest "
by raviprakash sunkara 11 May '06

11 May '06

Hi Everybody I'm working on openser + freeradius. Recently Installed both . I had a issue below onw, actual what this means... By Typing '" radtest 444 444 192.168.2.55 1812 radiustest " its shows below one. Sending Access-Request of id 236 to 192.168.2.55 port 1812 User-Name = "444" User-Password = "444" NAS-IP-Address = 255.255.255.255 Re-sending Access-Request of id 236 to 192.168.2.55 port 1812 User-Name = "444" User-Password = "444" NAS-IP-Address = 255.255.255.255 -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com

2 1

Ignoring request from unknown home server
by Jarrid Keller 10 May '06

10 May '06

Hi everyone, I am running freeradius version 1.0.4 on Fedora Core 4. I am trying to authenticate mt VPN users on my Cisco VPN concentrator to my ldap server. I am trying to use my radius server to proxy the authentication requests to the ldap server. After setting the radius server up and trying to authenticate a user, the radius server is giving me the following error. rad_recv: Access-Request packet from host 172.16.1.2:1042, id=10, length=71 Ignoring request from unknown home server 172.16.1.2:1042 I am fairly new to freeradius. What do I need to do to make this work. Any info is greatly appreciated. -Thanks Jarrid Keller

2 1

RE: Wildcards in Username and Passwd
by Jason Montgomery 10 May '06

10 May '06

You are correct about being able to sneeze and break into the network. But luckily all machines with that prefix will be placed into a Ethernet Only VLAN. The Devices with that prefix belong to a Ethernet based phone system (www.3com.com/nbx) so anyone who breaks into that vlan will only be able to see the broadcast Ethernet packets the phones are sending out occasionally. As a extra layer of security the phone system itself will only communicate with phones that have already been configured in its internal mac table list. Thanks for the help Jason -----Original Message----- From: freeradius-users-bounces+jmont=preferredtechnology.com(a)lists.freeradius. org [mailto:freeradius-users-bounces+jmont=preferredtechnology.com@lists.fre eradius.org] On Behalf Of Dennis Skinner Sent: Wednesday, May 10, 2006 3:54 PM To: FreeRadius users mailing list Subject: Re: Wildcards in Username and Passwd Jason Montgomery wrote: > Hello I have a customer who would like to have 100% MAC address lock > down on their network. To do that we are able to have the Ethernet > Switches Send the Device MAC address as the Username and password to the > Radius Server. The question I have is on the radius server is it > possible to set a wildcard so that any device showing "00-E0-BB" as the > MAC Address prefix will automatically be accepted then I can throw the > usual variables back at the port. If this is possible then I can avoid > having to enter 300 Devices into the Radius table. This may give you some ideas: http://wiki.freeradius.org/index.php/Adding%2C_Removing%2C_Modifying_Att ributes_for_further_processing But, I should warn you, that anyone wanting to break into your customers' network can sneeze and have a machine fake a MAC address. Hell, some Cisco equipment even have a builtin command to do it (handy for replacing/upgrading routers without messing up local ARP tables). Hopefully there is some other form of authentication. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius radclient problem and sql dialupadmin question
by Eric Hilden 10 May '06

10 May '06

I have installed FreeRadius (latest version) to my system and all goes well until it gets to the rlm_* files. I have tried specifying the mysql directory at /usr/lib/mysql and it seemed to fix a few of those errors in the make process but then it just errors out. So I blew away that installation because I am really trying to get this working with mysql. This attempt I'm really trying to get working because I think the linker setups up the libs more correctly. Using Suse 10.0 doing a source rpm install and let it do all the magic. It installs everything to the /etc/raddb directory and other default directories, but now I am running into this issue. After the install is done I run "radiusd -x" for a test and everything is working and listening for requests. As soon as a add a user to the users.txt file and run radtest is where I get my errors. After running "*radtest steve testing localhost 1812 testing123"* I get the following. *radclient: dict_init: Couldn't open dictionary "/usr/local/etc/raddb/dictionary: No such file or directory. * I can however use the radclient -d command to switch make it switch directories. I have no idea why it is wanting to push to that directory. The installation put the dictionary in the following. */etc/raddb/dictionary *and */usr/share/freeradius/dictionary. *Is there a way to make it default to the */usr/share/freeradius/dictionary*? After running with the *"radtest -d /usr/share/freeradius/dictionary steve testing localhost 1812 testing123" *I get the accept message request from my test user. Furthermore looking at the file /etc/raddb/dictionary I see* $Include /usr/share/freeradius/dictionary* and looking at */usr/share/freeradius/dictionary *has all the include statements for the rest of the dictionary files. Where am I missing the configuration to change the default setting for where radclient is wanting to look? Why the using Yast configured it look there I have no clue but it seems like an easy fix. *SQL & Dialup Admin* *Questions?* --------------------------- 1.) In all the guides I have found you modify the sql.conf and radiusd.conf files to get it working. In my /etc/raddb directory however I have a mysql.conf file; do I need to use this file instead? 2.)(not really a question) Before hand I was getting all the rlm_*** errors but know using Yast I believe the linker is now having everything work. As what I have changed is the following. In radiusd.conf I changed under authorize and accounting, I uncommented out the sql parts and commented out the files part. And in sql.conf I changed my settings to locahost and my login information. Now when I run radiusd -x and I get ready to accept requests like everything is working with no errors and all my databases have connected. 3.) Dialup Admin problems I am experiencing. I know this isn't dialup admin forums/mailing list but I figured I would find the most help here. Find Users still seems to do nothing even when I create users through Dialup Admin. And when I go to edit users I get the following: Warning: main(password.php3) [function.main]: failed to open stream: No such file or directory in /srv/www/dialup_admin/lib/sql/password_check.php3 on line 2 Fatal error: main() [function.require]: Failed opening required 'password.php3' (include_path='/usr/share/php') in /srv/www/dialup_admin/lib/sql/password_check.php3 on line 2 I'm no php expert but I really couldn't find what would be wrong here? I have no password on dialupadmin currently. 4.) How exactly do I test if Dialup Admin is working correctly? Also is there any documentation someone could point me to with what all the values and fields mean. It seems a bit different than working with the text files. I didn't see a place from secret. So if someone could point me a guide/documention explaining this I would appreciate it. Thank you for your time reading this. Eric

2 2

Wildcards in Username and Passwd
by Jason Montgomery 10 May '06

10 May '06

Hello I have a customer who would like to have 100% MAC address lock down on their network. To do that we are able to have the Ethernet Switches Send the Device MAC address as the Username and password to the Radius Server. The question I have is on the radius server is it possible to set a wildcard so that any device showing "00-E0-BB" as the MAC Address prefix will automatically be accepted then I can throw the usual variables back at the port. If this is possible then I can avoid having to enter 300 Devices into the Radius table. Thanks in Advance Jason Montogmery

2 1

RE: with_ntdomain_hack
by Chris Liles 10 May '06

10 May '06

I changed the username portion to what you suggested and it works :) Thanks! -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309 -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of King, Michael Sent: Wednesday, May 10, 2006 4:12 PM To: FreeRadius users mailing list Subject: RE: with_ntdomain_hack Try this ntlm_auth string (Watch for page breaks in email) ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challeng e} --nt-response=%{mschap:NT-Response} > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Chris Liles > Sent: Wednesday, May 10, 2006 3:51 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > You are right, it was that I was lowercasing the username > before authentication... > After I turned that off, I am getting further, it still > doesn't work and I believe it is because of a problem with > "Stripped-User-Name" and ntlm_auth > > ntlm_auth is getting called with the entire username > "DOMAIN\user" and not "user" I don't understand why, as in > the config file it says: > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > I didn't edit that part of the ntlm_auth line, just corrected > the path.. > I know this is a problem because when I use ntlm_auth from > the command line I can't use --username=DOMAIN\user I have to > use --username=user > > I hacked up the line to just say %{Stripped-User-Name} but > that value must be null or something, because then ntlm_auth > gets called with "--username=" > > Any thoughts as to why I can't get the DOMAIN\ stripped when > calling ntlm_auth > > Thanks! > > -- > Chris Liles > System Analyst > Air2Web, Inc. > 1230 Peachtree St. N.E. > 12th Floor > Atlanta, GA 30309 > > > -----Original Message----- > From: > freeradius-users-bounces+chris.liles=air2web.com(a)lists.freerad > ius.org > [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists > .freeradius.org] On Behalf Of King, Michael > Sent: Wednesday, May 10, 2006 3:39 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > > > > -----Original Message----- > > I can't seem to figure out how to get with_ntdomain_hack set > > correctly. > > > > I am trying to get peap going against active directory with winbind. > > > > It works if I enter in the username and password from the windows > > supplicant prompt, but when I set the supplicant to send the > > information automatically it is appending the domain\ onto the > > username, and I can't get it to work? > > > > > I don't think it's the ntdomain hack that is the problem (It > should be on, and I'm only aware of it being located in the > radiusd.conf file, just above the ntlm_auth line > > I'd double check that your Samba config is correct. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: with_ntdomain_hack
by King, Michael 10 May '06

10 May '06

Try this ntlm_auth string (Watch for page breaks in email) ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challeng e} --nt-response=%{mschap:NT-Response} > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Chris Liles > Sent: Wednesday, May 10, 2006 3:51 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > You are right, it was that I was lowercasing the username > before authentication... > After I turned that off, I am getting further, it still > doesn't work and I believe it is because of a problem with > "Stripped-User-Name" and ntlm_auth > > ntlm_auth is getting called with the entire username > "DOMAIN\user" and not "user" I don't understand why, as in > the config file it says: > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > I didn't edit that part of the ntlm_auth line, just corrected > the path.. > I know this is a problem because when I use ntlm_auth from > the command line I can't use --username=DOMAIN\user I have to > use --username=user > > I hacked up the line to just say %{Stripped-User-Name} but > that value must be null or something, because then ntlm_auth > gets called with "--username=" > > Any thoughts as to why I can't get the DOMAIN\ stripped when > calling ntlm_auth > > Thanks! > > -- > Chris Liles > System Analyst > Air2Web, Inc. > 1230 Peachtree St. N.E. > 12th Floor > Atlanta, GA 30309 > > > -----Original Message----- > From: > freeradius-users-bounces+chris.liles=air2web.com(a)lists.freerad > ius.org > [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists > .freeradius.org] On Behalf Of King, Michael > Sent: Wednesday, May 10, 2006 3:39 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > > > > -----Original Message----- > > I can't seem to figure out how to get with_ntdomain_hack set > > correctly. > > > > I am trying to get peap going against active directory with winbind. > > > > It works if I enter in the username and password from the windows > > supplicant prompt, but when I set the supplicant to send the > > information automatically it is appending the domain\ onto the > > username, and I can't get it to work? > > > > > I don't think it's the ntdomain hack that is the problem (It > should be on, and I'm only aware of it being located in the > radiusd.conf file, just above the ntlm_auth line > > I'd double check that your Samba config is correct. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: with_ntdomain_hack
by King, Michael 10 May '06

10 May '06

> -----Original Message----- > I can't seem to figure out how to get with_ntdomain_hack set > correctly. > > I am trying to get peap going against active directory with winbind. > > It works if I enter in the username and password from the > windows supplicant prompt, but when I set the supplicant to > send the information automatically it is appending the > domain\ onto the username, and I can't get it to work? > I don't think it's the ntdomain hack that is the problem (It should be on, and I'm only aware of it being located in the radiusd.conf file, just above the ntlm_auth line I'd double check that your Samba config is correct.

1 0

with_ntdomain_hack
by Chris Liles 10 May '06

10 May '06

I can't seem to figure out how to get with_ntdomain_hack set correctly. I am trying to get peap going against active directory with winbind. It works if I enter in the username and password from the windows supplicant prompt, but when I set the supplicant to send the information automatically it is appending the domain\ onto the username, and I can't get it to work? Where is the 1 place (or places) to set "with_ntdomain_hack =yes" to get the supplicant's auto settings to work? Thanks! -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309

1 0