- Freeradius-Users - lists.freeradius.org

Freeradius + Microsoft Active Directory
by Natalia Escalera 25 Feb '06

25 Feb '06

Hello, I am setting up freeradius with Microsoft Active Directory. So far, I am able to connect to the server but not to authenticate a user. Can you please give me a hint of how the configuration files need to be set in order to authenticate the user. Also, what is "3D" used for? (Example: server =3D your.ad.server.org ...) Thank you in advance, Nataly

2 7

Adding A
by squirrel＠isot.com 25 Feb '06

25 Feb '06

I'm trying to add "Ascend-Data-Filter" to mysql using either phpmyadmin or dialup administrator, but it doesn't seem to work. It works fine in users text file as in: username Auth-Type := Local, User-Password == "xxx", Simultaneous-Use := 2 Service-Type = Framed-User, Framed-Protocol = MP, Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip a.b.c.0/20", Ascend-Data-Filter += "ip in forward tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Framed-Compression = Van-Jacobsen-TCP-IP But the dialup administrator allow me to add only one Ascend-Data-Filter item. If I try to add using myphpadmin ************************************** Computer problems? ................... ..............http://www.multibyte.net

2 5

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Dear Alan! > See the FAQ about pointless statements like "it doesn't work". Alan, please, you asked me to try := instead of == . I did and it does not work. Somehow I needed to inform you it did not. > Maybe you could try reading the debug output. Or failing that, >posting it here. I did in my first post. Would you please explain me, why freeradius only process one record, when it does process both while using users file? Is it possible perhaps to make the PAP module understand both CRYPT and plaintext passwords (perhaps by defining two instances of module)? I can in this case keep one record per user, and it will be cleartext for PAP and MS-CHAPv2 when the user is granted services requiring MS-CHAPv2 and CRYPT for all existing users otherwise. >Then those users can't do MS-CHAP. C'mon. This is not an answer... I can't just ignore all of my existing users and I can't make all of them to change their passwords and, as far as I know, I can't extract their passwords from the crypt hash. I really do not want to start hacking freeradius code, but on the other side I really do need to make the new services available to these users. >Stop trying to get both clear & crypted passwords to work for the >same user. Why does it work perfectly as expected when I am doing it in users file? Should not the SQL module perform the same? I am reposting the debug output here, just in case.... rad_recv: Access-Request packet from host 192.168.0.8:1061, id=7, length=45 User-Name = "atest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "atest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 173 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'atest' rlm_sql (sql): sql_set_user escaped user --> 'atest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'atest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'atest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'atest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'atest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "atest" with password Master1 rlm_pap: Using password "Master1" for user atest authentication. rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [atest/Master1] (from client rasdata port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 7 to 192.168.0.8:1061 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 7 with timestamp 4400b816 Nothing to do. Sleeping until we see a request.

2 1

CentOS
by Italo Morellato 25 Feb '06

25 Feb '06

Freeradius 1.1.0 RPM for CentOS 4.2 (smeserver) is possible? Thanks in advance. Italo Morellato

3 2

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 25 Feb '06

25 Feb '06

Dear All! I wonder is somebody has tried to make PAP understand both plaintext and crypted passwords via multiple instances for example? Would this make sense: pap { encryption_scheme = clear } pap papcrypt { encryption_scheme = crypt } in modules configuration and then Auth-Type PAP { pap papcrypt } in authenticate section? Regards Alex.

1 0

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Dear Alan! >You want to use ":=", not "==", both here and in SQL. That will >make it work. > > Alan DeKok. I've tried that already. Same result... DOES NOT work... (AND it works with both == and := when I use users file instead)... With SQL it produces the very same debugging output with both == and := A bug perhaps? Shouldn't users file and radchek table perform the very same way? As for your offer for storing the clear-text for PAP it is not an option for me, since I already have 450 users stored in CRYPT form (for a simple reason of preventing the administration power abuse as much as possible - yes that is, I do not want admin to know and use user passwords). I hate using the clear text passwords for MS-CHAPv2 as well, but I haven't yet figured out how to generete NT-hash for storing the NT-Password instead. Changing passwords for 450 users is a pain, which I want to avoid... By the way, how does one generate this hash? I am running heavily modified by me version of dialup-admin, and I haven't yet implemented the CRYPT function for NT-Hash.

2 1

Re: Freeradius + Microsoft Active Directory
by Kai Geek 25 Feb '06

25 Feb '06

Hello, your password crypt key is used. not become in this ethereal can't recognize. > Auth-Type CHAP { > chap > } > > > Auth-Type MS-CHAP { > mschap > } you must show the full and state this in the file #ls /etc/raddact #vi radius.conf #vi clients.conf best regards, -- Ozgur Karatas CCNA & Network Engineer Linux System Administrator ozgur (at) ozgurkaratas dot com > ----- Original Message ----- > From: "Natalia Escalera" <nescalera(a)gmail.com> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius + Microsoft Active Directory > Date: Sat, 25 Feb 2006 11:53:20 -0600 > > > Hello Mr. DeKok > > Thank you for the fast response. The password is clear-text. We are > using ethereal to debug why we are getting "Operations Error" on the > Search Result. The Operation Errors comment is the following: > "In order to perform this operation a successful bind must be completed." > > The search request on ethereal from Freeradius to the active directory > gives the following: > Message Type: Search Request > Message Length: 96 > Response In: 469 > Base DN: dc=test, dc=prt > Scope: subtree (0x02) > Derefence: Never (0x00) > Size Limit: 0 > Time Limit: 4 > Attributes only: False > Filter: (&(objectclass=person)(sAMAccountName=%u)) > Attribute: uid ????we are not sending this attribute and we do not > know where it is specified on Freeradius > > Here are the settings given for LDAP module on radius.conf and user file: > > #radius.conf > ldap { > server="xxx.xx.xxx.xxx" > > identity ="" # If this is suppose to be the bind dn??? > > password = "mypassword" > basedn ="dc=test,dc=prt" > > #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > filter ="(&(objectclass=person) (sAMAccountName=%u))" > > # set this to 'yes' to use TLS encrypted connections > # to the LDAP database by using the StartTLS extended > # operation. > # The StartTLS operation is supposed to be used with normal > # ldap connections instead of using ldaps (port 689) connections > start_tls = no > > # tls_cacertfile = /path/to/cacert.pem > # tls_cacertdir = /path/to/ca/dir/ > # tls_certfile = /path/to/radius.crt > # tls_keyfile = /path/to/radius.key > # tls_randfile = /path/to/rnd > # tls_require_cert = "demand" > > # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" > # profile_attribute = "radiusProfileDn" > access_attr = "dialupAccess" > > # Mapping of RADIUS dictionary attributes to LDAP > # directory attributes. > dictionary_mapping = ${raddbdir}/ldap.attrmap > > ldap_connections_number = 5 > > > timeout =5 > timelimit =4 > net_timeout =2 > compare_check_items = yes > > } > > authenticate { > > Auth-Type PAP { > pap > } > > > Auth-Type CHAP { > chap > } > > > Auth-Type MS-CHAP { > mschap > } > > > unix > > > > Auth-Type LDAP { > ldap > } > > > eap > } > > #users file > DEFAULT Auth-Type := LDAP > Fall-Through = 1 > > Can you please tell us if there is something wrong or if we are > missing something on the configuration files? > > Thanks in advance, > Nataly > > On 2/25/06, Alan DeKok <aland(a)ox.org> wrote: > > "Natalia Escalera" <nescalera(a)gmail.com> wrote: > > > I am setting up freeradius with Microsoft Active Directory. So far, I > > > am able to connect to the server but not to authenticate a user. Can > > > you please give me a hint of how the configuration files need to be > > > set in order to authenticate the user. > > > > If the RADIUS packets have clear-text passwords, then the normal > > LDAP module should work. If you're using PEAP or MS-CHAP, read > > "radiusd.conf",m and use "ntlm_auth". > > > > > Also, what is "3D" used for? (Example: server =3D your.ad.server.org ...) > > > > Nothing. It's an artifact of stupid mailers. 3D is ASCII for '='. > > > > Alan DeKok. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Hi, Gerry. Thanks for an answer... >I'll bet if you only have a single encrypted entry that will work. > >This is just a guess on my part but give it a shot. > >Gerry Of course it works if I only have a single encrypted problem. This is exactly where my problem is. I do run a bunch of services onsite, some using the PAP passwords (CRYPT form) and some using the MS-CHAPv2 (partly internal and partly accessing the ADS via NTLM). I want the single logon for all services. If say PPPoe is PAP and IPSEC is MS-CHAPv2 I need two entries one with the CRYP-ted password for PAP and one plain or NT-hash for MS-CHAPv2. Everything works when using "users" file. PAP doesn't work when using the mysql backend and there is plain-text record in a database as well. It looks like freeradius does indeed only process first record (by the way I've tried playing with the SQL query for authentication in pursuit of making it to return the crypted password first, but alas it doesn't help). Do you by any chance know WHY it only processes one record and how to make it process two instead? Thanks Alex.

2 1

Stale sessions problem
by Georgi Alexandrov 25 Feb '06

25 Feb '06

Hello, I'm running freeradius 1.1.0 + mysql + dialupadmin on a linux 2.6 box with a pppoe-server runing on the same machine as nas. It works great ;-) But i have a problem with stalled sessions. I have set simultaneous use :=1. I have set "sql" in the session section in radiusd.conf. If a user that somehow failed network connectivity and failed to tell the server "account stop" tries to reconnect back it won't let him because his previous session is stalled. I need a mechanism that will do a check upon connection if the session is stalled, delete it and let the user in or if there is already a real user logged in deny the connecting one. I read from the mailing lists that radzap should do the job but i can't seem to figure out how to integrate it in that setup (the man page explains only the syntax). I also use the ippool module to give (and it should return back too) ip addresses from a given pool range. I need to be sure that it will return an ip to the pool if there's a stalled session detected by the needed mechanism. At the moment radwho and rlm_ippool_tool show about twice or more entries than the number actually used. Please advice ;-) -- regards, Georgi Alexandrov Key Server = http://pgp.mit.edu/ :: KeyID = 37B4B3EE Key Fingerprint = E429 BF93 FA67 44E9 B7D4 F89E F990 01C1 37B4 B3EE

3 8

Assigning ip address through 802.1x
by Manuj 25 Feb '06

25 Feb '06

Hello everybody, Please tell me, do we have any attribute in Free RADIUS to send the ip address to the 802.1x client after the successfull authentication. I know we can do it with the dhcp server but I want to know the attribute in RADIUS server(if any). Thanks for your help. Regards Manuj

2 1