- Freeradius-Users - lists.freeradius.org

freeradius auth logging (rlm_detail)
by ???????, ?? ???????? 10 Mar '06

10 Mar '06

Hi! Is it possible to log more detailed information about radius response packet for authorization? At the moment it looks like: Packet-Type = Access-Accept Wed Mar 8 10:25:57 2006 Auth-Type = Accept But how can I know, for which request it has responsed? Can I log the "Authenticator"? (Both, in the request and in the response?) ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

1 0

RE: Machine Authecitation with PEAP
by King, Michael 10 Mar '06

10 Mar '06

> -----Original Message----- > If it helps, this the ntlm command (which i think you have correct): > /usr/bin/ntlm_auth --request-nt-key --username=cse-mpr$ > --challenge=4de0a9c09623ab12 > --nt-response=d4b9516b28ba1760f8d31f8ac2b257d74a2439b9e104a102 > > - are you passing the domain correctly? (i dont specify the domain on > the ntlm_auth command line, whereas you have) i have the following in > samba.conf > I didn't have the ntlm_auth line correct. I did have the domain correct. I had this in the radius.conf file ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{msc hap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} BUT, in my notes, and on my working server, I had this: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response= %{mschap:NT-Response}" I removed the :-00 from the NT-Response and the Challenge options, and I also removed the --domain, since I had no idea why it was in there either. I think I only replaced bits and pieces of the default line in the example config, instead of deleting the whole line and pasting in my notes. Thanks, it works great now!

1 0

Re: Machine Authecitation with PEAP
by James J J Hooper 09 Mar '06

09 Mar '06

>>> ------------------------------ >>> >>> Message: 6 >>> Date: Thu, 9 Mar 2006 13:17:48 -0500 >>> From: "King, Michael" <MKing(a)bridgew.edu> >>> Subject: Machine Authecitation with PEAP >>> >>> Has anyone gotten Machine Authentication with PEAP working? >> Yes >>> >>> radius_xlat: '/usr/bin/ntlm_auth --request-nt-key >>> --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 >>> --nt-response=c92c >>> 121419368a6b599e159c9ef21bbc4d98138946d6df29 ' >>> >>> Exec-Program: /usr/bin/ntlm_auth --request-nt-key >>> --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 >>> --nt-response=c92c1 >>> 21419368a6b599e159c9ef21bbc4d98138946d6df29 >>> >>> Exec-Program output: Logon failure (0xc000006d) >>> >>> Exec-Program-Wait: plaintext: Logon failure (0xc000006d) >> >> From my experience this means the credentials the machine is sending are >> wrong or your version of samba is too old - get 3.0.21c (or at least >> 3.0.21a) >I wish it was that easy. I'm using Debian Package of the Testing >release. It's currently at 3.0.21b > >Does it have to anything to do with the host/ getting stripped off? Nope ... --username=boy-it-tel-2528$ is in the correct format If it helps, this the ntlm command (which i think you have correct): /usr/bin/ntlm_auth --request-nt-key --username=cse-mpr$ --challenge=4de0a9c09623ab12 --nt-response=d4b9516b28ba1760f8d31f8ac2b257d74a2439b9e104a102 for the radius packet: NAS-IP-Address = 172.17.51.78 NAS-Port = 50018 Cisco-NAS-Port = "GigabitEthernet0/18" NAS-Port-Type = Ethernet User-Name = "host/cse-mpr.cse.bris.ac.uk" Called-Station-Id = "00-16-C8-7C-A9-12" Calling-Station-Id = "00-07-E9-E7-41-50" Service-Type = Framed-User Framed-MTU = 1500 State = 0x2155356ae073362e26296c9869da2893 EAP-Message = 0x0207006d190017030100629bfa223d9efed1787d6bdeee43082a4a43adaf1792f0bd93acc6fbe8e4b7ee82d8d88380e459496d97435e7225e057fac5dd15e2525bd4ff36ae085cc54c677cc3e3a96d1f7a023f6b49 As far as i can tell the problem is with the windows / samba side of things: - might be a stupid question, but is the computer account properly registered in the domain? - is the account locked ?? - does it work if you try to auth as a user? - if you updated samba recently - have you restarted winbindd? - are you passing the domain correctly? (i dont specify the domain on the ntlm_auth command line, whereas you have) i have the following in samba.conf (the domain is UOB): [global] workgroup = UOB netbios name = IS-RHUBARB security = domain password server = ads.bris.ac.uk realm = ads.bris.ac.uk winbind use default domain = no winbind nested groups = Yes winbind enum users = No winbind enum groups = No remote browse sync = ads.bris.ac.uk where ads.bris.ac.uk is a round robin resolving to the IPs of 11 domain controllers. Regards, James -- James J J Hooper, Information Services University of Bristol --

1 1

Problem compiling Freeradius + MySQL on Solaris 9
by Alan 09 Mar '06

09 Mar '06

I've made symlinks like recommended in the mailing lists. I have also specified the lib, include and base MySQL directory when running the configure script. After running configure I always get the same output. Please help. -- configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. configure: warning: sql submodule 'mysql' disabled -- OS: Solaris 9 (SPARC) MySQL Package: Sunfreeware (mysql-4.0.21-sol9-sparc-local.gz) -- ln -s /usr/local/mysql/lib /usr/lib/mysql ln -s /usr/local/mysql/include/mysql /usr/include/mysql -- ./configure \ --with-mysql-dir-dir=/usr/local/mysql/ \ --with-mysql-include-dir=/usr/local/mysql/include/mysql/ \ --with-mysql-lib-dir=/usr/local/mysql/lib/ -- "/usr/lib/mysql" libdbug.a libheap.a libmerge.a libmyisam.a libmyisammrg.a libmysqlclient.a libmysqlclient.la libmysqlclient.so -> libmysqlclient.so.12.0.0 libmysqlclient.so.10 -> libmysqlclient.so.10.0.0 libmysqlclient.so.10.0.0 libmysqlclient.so.12 -> libmysqlclient.so.12.0.0 libmysqlclient.so.12.0.0 libmysqlclient_r.a libmysqlclient_r.la libmystrings.a libmysys.a libnisam.a libvio.a

2 3

RE: Machine Authecitation with PEAP
by King, Michael 09 Mar '06

09 Mar '06

> -----Original Message----- > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of james > Sent: Thursday, March 09, 2006 3:06 PM > >From my experience this means the credentials the machine is sending > >are > wrong or your version of samba is too old - get 3.0.21c (or at least > 3.0.21a) > > Regards, > James I wish it was that easy. I'm using Debian Package of the Testing release. It's currently at 3.0.21b Does it have to anything to do with the host/ getting stripped off?

1 0

proxy.conf multiples Default realm's
by Vasco Santos 09 Mar '06

09 Mar '06

Hi, I have FF 1.0.1 and I what to put two diferent default realm's biscose I have two diferents companys with very domains names. ex: gric. proxy.conf ex: realm example.com { type = radius authhost = LOCAL accthost = LOCAL } realm NULL { type = radius authhost = LOCAL accthost = LOCAL secret = testing123 } realm DEFAULT { type = radius authhost = radius1.company.com:1600 accthost = radius1.company.com:1601 secret = testing123 } realm DEFAULT { type = radius authhost = radius2.company.com:1600 accthost = radius2.company.com:1601 secret = testing123 } At this point the auth request only go to radius2.company.com if the radius1.company.com its dead, correct? But I need to make this by login failed, incorrect ou server fail. If the login failed (password or username) in radius1.company.com the request need to go to radius2.company.com. I search to solutions for this case and I found someting, a function on radius config file the "authorize". As I make a configurantion for this work to all my realm servers? Please say me all procedures. Note: I still use the old version of realm the realms file, it is possible to config some options on it to my question? Tanks.

2 1

Re: Machine Authecitation with PEAP
by james 09 Mar '06

09 Mar '06

> ------------------------------ > > Message: 6 > Date: Thu, 9 Mar 2006 13:17:48 -0500 > From: "King, Michael" <MKing(a)bridgew.edu> > Subject: Machine Authecitation with PEAP > > Has anyone gotten Machine Authentication with PEAP working? Yes > > radius_xlat: '/usr/bin/ntlm_auth --request-nt-key > --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 > --nt-response=c92c > 121419368a6b599e159c9ef21bbc4d98138946d6df29 ' > > Exec-Program: /usr/bin/ntlm_auth --request-nt-key > --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 > --nt-response=c92c1 > 21419368a6b599e159c9ef21bbc4d98138946d6df29 > > Exec-Program output: Logon failure (0xc000006d) > > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) >From my experience this means the credentials the machine is sending are wrong or your version of samba is too old - get 3.0.21c (or at least 3.0.21a) Regards, James

1 0

Realm
by José Berenguer 09 Mar '06

09 Mar '06

Hello! If I want to assign a VLAN for group the syntax it would be: DEFAULT Ldap-Group == "STUDENT" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "81" but if I want to assign VLAN for domain: DEFAULT Realm == aeiou.com Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = "99" it is this correct?? Thanks!!

1 0

freeradius - slow start
by Victor Melnichenko 09 Mar '06

09 Mar '06

I have some problem with my FreeRADIUS server: it's connect to the MySQL very slow :( What i do: 1. $ cd /usr/local/etc/rc.d/ && ./radiusd.sh restart Stopping radiusd. Waiting for PIDS: 30273. Starting radiusd. Thu Mar 9 17:51:52 2006 : Info: Starting - reading configuration files ... 2. In log file i see next: Thu Mar 9 17:51:52 2006 : Info: Core dumps are enabled. Thu Mar 9 17:51:52 2006 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Mar 9 17:51:52 2006 : Info: rlm_sql (sql): Attempting to connect to radius@127.0.0.1:/radius Thu Mar 9 17:51:52 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu Mar 9 17:51:52 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu Mar 9 17:51:52 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu Mar 9 17:51:52 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu Mar 9 17:51:52 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu Mar 9 17:53:07 2006 : Info: Ready to process requests. Why FreeRADIUS connect to the MySQL at about 75 seconds? -- With Best Regards, Victor V. Melnichenko VVM7-UANIC

2 1

IP address assignment (rlm_ippool)
by Carlo Prestopino 09 Mar '06

09 Mar '06

I want freeRADIUS to assign IP address to authenticated users, so Ive done thefollowing configuration ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 81.174.17.35 range-stop = 81.174.17.63 ...... ...... # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex ...... } Once started, I get back an error from radiusd : rlm_ippool: Failed to open file /etc/raddb/db.ippool: Permission denied radiusd.conf[1468]: main_pool: Module instantiation failed. It seems that the problem is due lack of db.ippool file. I've tried to create it manually, but nothing changed. Is there a way to generate db.ippool file so rlm_ippool can work properly? Thank you in advance, Best Regards, Carlo

2 1