- Freeradius-Users - lists.freeradius.org

RE: How do I set up simple AD integration?
by Burton, Steven 12 Apr '06

12 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of King, Michael > Sent: 11 April 2006 16:34 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > You would still need with_ntdomain_hack = yes > > But that isn't your actual problem. > > It never called ntlm_auth > I'd seen that. What I was trying to do (unsuccessfully 'cos I'm ignorant) was to try to find out what triggers ntlm_auth to run. Is there something in another file that sets this up? Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

pam_radius_auth token user
by Josh Restivo 12 Apr '06

12 Apr '06

This question appears in various forums time and time again though I've yet to discover a solution for it under linux. It *must* be a common issue.... The need exists to map users who are successfully authenticated via pam_radius_auth and who do not have a local account to a default 'token user'. FreeBSD's radius/pam module has a simple and obvious 'template_user' directive that suits this precise purpose well. Linux pam_radius_auth lacks this feature. Deploying centralized authentication only to require that all other user info be manually configured on each and every device anyway doesn't make any sense. Nor should it involve a full-blown and often unwieldy NIS (or similar) infrastructure to function. Surely I'm overlooking something.

1 0

Regarding VLAN
by radhika putty 12 Apr '06

12 Apr '06

Hi I tried sending tunneling attributes from Radius server and it shows sending those tunneling attributes.. But the access point doesnt seem to understand it anyway. I had configured both the access point and the switch for this.. What can be the problem --------------------------------- Yahoo! Messenger with Voice. PC-to-Phone calls for ridiculously low rates.

1 0

group definitions in users file
by ho 11 Apr '06

11 Apr '06

Hi folks, my environment: I do AAA with freeradius as a radius-proxy in combination with ms-ias (only for the passwords ;-) )for cisco asa 5540-box, which is similar to a cisco pix firewall. in the future we have many, many entries for users with the same Cisco-AVPairs USER1 Proxy-To-Realm := IAS Service-Type = Framed-User, Framed-Protocoll = PPP, Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq domain", Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq domain", Cisco-AVPair += "ip:inacl# = permit tcp any host A.B.C.D eq 264", Cisco-AVPair += "ip:inacl# = permit tcp any host A.B.C.D eq 443", Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq isakmp", Cisco-AVPair += "ip:inacl# = permit udp any host A.B.C.D eq 2746", Cisco-AVPair += "ip:inacl# = permit esp any host A.B.C.D", Cisco-AVPair += "ip:inacl# = deny tcp any any", Cisco-AVPair += "ip:inacl# = deny udp any any", Fall-Through = 0 Is it possible to group the User entries and than give them the special profile with the AVPairs? If not, what could be another good workaround for this problem? thanks marco

2 1

sql database in freeradius-1.1.1 ???
by ho 11 Apr '06

11 Apr '06

Hi, am i right that the database schemes under e.g. src/modules/rlm_sql/drivers/rlm_sql_mysql/db_mysql.sql are lost in version 1.1.1, which i've downloaded 2 says ago? I've tried a find, but didn't have a match. Can i use the same schema i've downloaded with version 1.0.4? Best regards marco

3 3

Allow linking against OpenSSL? (Was Re: [GENERAL] Debian package for freeradius_postgresql module)
by Tyler MacDonald 11 Apr '06

11 Apr '06

Greetings FreeRadius people, This discussion started on the postgresql's "pgsql-general" mailing list. The problem here is that the freeradius-postgresql package needs to link against libpgsql, which means that it may be indirectly linked against openssl. There is a conflict between OpenSSL's BSD license and the GPL which means that it's not legal to distribute a copy of GPL code that is linked in this way. It appears that several other GPL apps have added a special clause to their license that allows them to be linked against OpenSSL. Could this be done for freeradius/freeradius-postgresql as well? This could pave the way towards enhanced freeradius support in Debian, specifically the addition of freeradius-postgresql to Debian's mainline. For your reference, here is the start of the thread on the pgsql-general list that got us to this point: http://archives.postgresql.org/pgsql-general/2006-04/msg00247.php Thanks, Tyler Tom Lane <tgl(a)sss.pgh.pa.us> wrote: > > I don't think so. I got curious and looked at what's on my Ubuntu > > system: Courier IMAP is GPL with an additional clause that explicitly > > allows linking with OpenSSL; Postfix has an Apache-ish license; Exim > > is GPL and also explicitly allows linking with OpenSSL; Cyrus IMAP is > > BSDish; Apache is non-GPL... I can't think offhand of anything that > > is GPL and links with OpenSSL without an explicit clause permitting > > same. > Hm. So can we lobby freeradius to tweak their license similarly?

5 19

How to implement radius with mysql
by Alejandro Sanchez 11 Apr '06

11 Apr '06

Hello. I am a new user of free radius the version that i use is 1.0.4-1. Anybody knows where can i find help to enable mysql with radius? Thank's Alex. ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of Burton, Steven > Sent: 11 April 2006 16:15 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > > -----Original Message----- > > From: > > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > > ists.freer > > adius.org > > [mailto:freeradius-users-bounces+sburton=shepherd-construction > > .co.uk@lis > > ts.freeradius.org]On Behalf Of King, Michael > > Sent: 11 April 2006 15:40 > > To: FreeRadius users mailing list > > Subject: RE: How do I set up simple AD integration? > > > > > > > > > > Is there a how-to or tutorial for this simple case? I have > > > searched this list and google generally. I have read the > > > articles referred to on the FreeRadius home page and several > > > others and I still can't see how the configuration works. Any > > > and all help gratefully received. > > > > > > Steve. > > > > > > > > > As for the simple how to, they're a few, but none that I > > would consider > > easy to follow. > > > > What your looking for this the following lines: (I have > > two ntlm_auth > > Lines, the original that is commented out, and the one that I > > use. They > > are long, so they will break across lines, but they are not > > that way in > > my config file) > > > > > > # Windows sends us a username in the form of > > # DOMAIN\user, but sends the challenge response > > # based on only the user portion. This hack > > # corrects for that incorrect behavior. > > # > > with_ntdomain_hack = yes > > > > # The module can perform authentication itself, OR > > # use a Windows Domain Controller. This > configuration > > # directive tells the module to call the ntlm_auth > > # program, which will do the authentication, > > and return > > # the NT-Key. Note that you MUST have > "winbindd" and > > # "nmbd" running on the local machine for ntlm_auth > > # to work. See the ntlm_auth program documentation > > # for details. > > # > > # Be VERY careful when editing the following line! > > # > > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > > --nt-response=%{mschap:NT-Response}" > > This stanza is a enclosed with the mschap section, still > nothing ventured.... > I changed the line and unfolded it and ran radiusd -X. The > first request didn't match anything usefull and was rejected > by System. I tried again but ticked the box 'CHAP' on > NTRadPing and got the output: > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "/usr/local/bin/ntlm_auth > --request-nt-key --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, > NAS-IP-Address, Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host > 192.168.50.127:3337, id=18, length=48 > User-Name = "burst01" > CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_chap: Setting 'Auth-Type := CHAP' > modcall[authorize]: module "chap" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type CHAP > auth: type "CHAP" > Processing the authenticate section of radiusd.conf > modcall: entering group CHAP for request 0 > rlm_chap: login attempt by "burst01" with CHAP password > rlm_chap: Could not find clear text password for user burst01 > modcall[authenticate]: module "chap" returns invalid for request 0 > modcall: leaving group CHAP (returns invalid) for request 0 > auth: Failed to validate the user. > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 18 to 192.168.50.127 port 3337 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 18 with timestamp 443bc5b9 > Nothing to do. Sleeping until we see a request. > > I think I'll put a protocol analyser on this (when I've time) > and see what is passing between the PC and RADIUS and what > (if anything) is passing between RADIUS and AD. > A quick look seems to show that the radius server does not contact a DC between the request and the subsequent rejection. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

RE: How do I set up simple AD integration?
by King, Michael 11 Apr '06

11 Apr '06

You would still need with_ntdomain_hack = yes But that isn't your actual problem. It never called ntlm_auth > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Burton, Steven > Sent: Tuesday, April 11, 2006 11:15 AM > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > -----Original Message----- > > From: > > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > > ists.freer > > adius.org > > [mailto:freeradius-users-bounces+sburton=shepherd-construction > > .co.uk@lis > > ts.freeradius.org]On Behalf Of King, Michael > > Sent: 11 April 2006 15:40 > > To: FreeRadius users mailing list > > Subject: RE: How do I set up simple AD integration? > > > > > > > > > > Is there a how-to or tutorial for this simple case? I > have searched > > > this list and google generally. I have read the articles > referred to > > > on the FreeRadius home page and several others and I > still can't see > > > how the configuration works. Any and all help gratefully received. > > > > > > Steve. > > > > > > > > > As for the simple how to, they're a few, but none that I would > > consider easy to follow. > > > > What your looking for this the following lines: (I have two > > ntlm_auth Lines, the original that is commented out, and > the one that > > I use. They are long, so they will break across lines, but > they are > > not that way in my config file) > > > > > > # Windows sends us a username in the form of > > # DOMAIN\user, but sends the challenge response > > # based on only the user portion. This hack > > # corrects for that incorrect behavior. > > # > > with_ntdomain_hack = yes > > > > # The module can perform authentication itself, OR > > # use a Windows Domain Controller. This > configuration > > # directive tells the module to call the ntlm_auth > > # program, which will do the authentication, and > > return > > # the NT-Key. Note that you MUST have > "winbindd" and > > # "nmbd" running on the local machine for ntlm_auth > > # to work. See the ntlm_auth program documentation > > # for details. > > # > > # Be VERY careful when editing the following line! > > # > > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > > --nt-response=%{mschap:NT-Response}" > > This stanza is a enclosed with the mschap section, still > nothing ventured.... > I changed the line and unfolded it and ran radiusd -X. The > first request didn't match anything usefull and was rejected > by System. I tried again but ticked the box 'CHAP' on > NTRadPing and got the output: > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "/usr/local/bin/ntlm_auth > --request-nt-key --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, > NAS-IP-Address, Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host > 192.168.50.127:3337, id=18, length=48 > User-Name = "burst01" > CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_chap: Setting 'Auth-Type := CHAP' > modcall[authorize]: module "chap" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type CHAP > auth: type "CHAP" > Processing the authenticate section of radiusd.conf > modcall: entering group CHAP for request 0 > rlm_chap: login attempt by "burst01" with CHAP password > rlm_chap: Could not find clear text password for user burst01 > modcall[authenticate]: module "chap" returns invalid for request 0 > modcall: leaving group CHAP (returns invalid) for request 0 > auth: Failed to validate the user. > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 18 to 192.168.50.127 port 3337 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 18 with timestamp 443bc5b9 Nothing > to do. Sleeping until we see a request. > > I think I'll put a protocol analyser on this (when I've time) > and see what is passing between the PC and RADIUS and what > (if anything) is passing between RADIUS and AD. > > Steve. > > ______________________________________________________________________ > This email has been scanned by the MessageLabs Email Security System. > For more information please visit > http://www.messagelabs.com/email > ______________________________________________________________________ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of King, Michael > Sent: 11 April 2006 15:40 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > > Is there a how-to or tutorial for this simple case? I have > > searched this list and google generally. I have read the > > articles referred to on the FreeRadius home page and several > > others and I still can't see how the configuration works. Any > > and all help gratefully received. > > > > Steve. > > > > > As for the simple how to, they're a few, but none that I > would consider > easy to follow. > > What your looking for this the following lines: (I have > two ntlm_auth > Lines, the original that is commented out, and the one that I > use. They > are long, so they will break across lines, but they are not > that way in > my config file) > > > # Windows sends us a username in the form of > # DOMAIN\user, but sends the challenge response > # based on only the user portion. This hack > # corrects for that incorrect behavior. > # > with_ntdomain_hack = yes > > # The module can perform authentication itself, OR > # use a Windows Domain Controller. This configuration > # directive tells the module to call the ntlm_auth > # program, which will do the authentication, > and return > # the NT-Key. Note that you MUST have "winbindd" and > # "nmbd" running on the local machine for ntlm_auth > # to work. See the ntlm_auth program documentation > # for details. > # > # Be VERY careful when editing the following line! > # > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > --nt-response=%{mschap:NT-Response}" This stanza is a enclosed with the mschap section, still nothing ventured.... I changed the line and unfolded it and ran radiusd -X. The first request didn't match anything usefull and was rejected by System. I tried again but ticked the box 'CHAP' on NTRadPing and got the output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.50.127:3337, id=18, length=48 User-Name = "burst01" CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "burst01" with CHAP password rlm_chap: Could not find clear text password for user burst01 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 18 to 192.168.50.127 port 3337 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 18 with timestamp 443bc5b9 Nothing to do. Sleeping until we see a request. I think I'll put a protocol analyser on this (when I've time) and see what is passing between the PC and RADIUS and what (if anything) is passing between RADIUS and AD. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2