- Freeradius-Users - lists.freeradius.org

RE: FreeRadius cannot Authenticate to Windows AD
by Alhagie Puye 16 Dec '05

16 Dec '05

Put quotes around the password....one thing I learned. That will take you further. I have a working config. So, please let me know if you are still running into problems. P.S. I will be posting a doc on the wiki once I'm done with testing. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Michael Calizo Sent: December 15, 2005 8:26 PM To: Freeradius-Users(a)lists.freeradius.org Subject: FreeRadius cannot Authenticate to Windows AD Hi Guru's, I have installed freeradius and used each LDAP module to authenticate to WINDOWS 2003 AD. The problem is it cant do the authentication, seems that i missed the radius.conf LDAP module configuration which causes the LDAP module to failed when connecting to MSAD. Below is my radius.conf config file. Hoping that you guys can help me, coz i have been googling all day for this config and i can not make this thing work... Thnx in advance.. radius.conf: ldap { server = "oberon.chikka.ph" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=backops,cn=Admin,dc=chikka,dc=ph" password = _bant@3a-@n # password = mypass basedn = "dc=chikka,dc=ph" # filter = "(SamAccountName=%{Stripped-User-Name:-%{User-Name}})" #filter = "(SamAccountName=%U)" #filter = "(SamAccountName=%u)" # base_filter = "(objectclass=radiusprofile)" base_filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(memberOf=Admin,D C=chikka,DC=ph))" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" ictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Here is my the radiusd -X -A LOG... rad_recv: Access-Request packet from host 192.168.1.13:37146, id=42, length=59 User-Name = "myaccount" User-Password = "mypass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "myaccount", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "myaccount" with password "mypass" radius_xlat: '(&(sAMAccountName=myaccount)' radius_xlat: 'dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.1:389, authentication 0 rlm_ldap: bind as cn=backops,cn=Admin,dc=domain,dc=com/passofbackops to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 42 to 192.168.1.13:37146 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 42 with timestamp 43a23bb5 Nothing to do. Sleeping until we see a request. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

3 2

Re: Freeradius-Users Digest, Vol 8, Issue 71 (Away from the office)
by Robert Wills 16 Dec '05

16 Dec '05

I am away from the office, returning on the 9th of January 2006, if you have any urgent problems please forward them to SWRC IT (it(a)bunbury.training.wa.gov.au) Or Call 9780 7314 . See you soon Robert

1 0

several LDAP servers to authenticate ?
by Frank Bonnet 16 Dec '05

16 Dec '05

Hello I actually use freeradius to authenticate wi-fi users thru the chillispot software. Our freeradius server use our LDAP as backend and everything runs well now I would like to know if it is possible to use _several_ LDAP servers with freeradius with a kind of the following mechanism : If the login is not found on our local LDAP server it will be search on the next LDAP server in a list and so on until all LDAP servers have been searched ? Thanks a lot -- Regards Frank

3 2

FreeRadius cannot Authenticate to Windows AD
by Michael Calizo 16 Dec '05

16 Dec '05

Hi Guru's, I have installed freeradius and used each LDAP module to authenticate to WINDOWS 2003 AD. The problem is it cant do the authentication, seems that i missed the radius.conf LDAP module configuration which causes the LDAP module to failed when connecting to MSAD. Below is my radius.conf config file. Hoping that you guys can help me, coz i have been googling all day for this config and i can not make this thing work... Thnx in advance.. radius.conf: ldap { server = "oberon.chikka.ph" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=backops,cn=Admin,dc=chikka,dc=ph" password = _bant@3a-@n # password = mypass basedn = "dc=chikka,dc=ph" # filter = "(SamAccountName=%{Stripped-User-Name:-%{User-Name}})" #filter = "(SamAccountName=%U)" #filter = "(SamAccountName=%u)" # base_filter = "(objectclass=radiusprofile)" base_filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})(memberOf=Admin,DC=chikka,DC=ph))" filter = "(&(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" ictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Here is my the radiusd -X -A LOG... rad_recv: Access-Request packet from host 192.168.1.13:37146, id=42, length=59 User-Name = "myaccount" User-Password = "mypass" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "myaccount", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "myaccount" with password "mypass" radius_xlat: '(&(sAMAccountName=myaccount)' radius_xlat: 'dc=domain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.1.1:389, authentication 0 rlm_ldap: bind as cn=backops,cn=Admin,dc=domain,dc=com/passofbackops to 192.168.1.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 42 to 192.168.1.13:37146 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 42 with timestamp 43a23bb5 Nothing to do. Sleeping until we see a request. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step

1 0

Reply message from the sqlcounter module
by Gunther 16 Dec '05

16 Dec '05

Just added the sqlcounter to my FreeRadius configuration. Stumbled over the "Your maximum never usage time has been reached" reply message for my noresetcounter (refer to doc/rlm_sqlcounter). Changed it to: "Your maximum access time has been reached" for the 'never' case. Here my Q&D solution: Change in freeradius-1.0.5/src/modules/rlm_sqlcounter/rlm_sqlcounter.c diff rlm_sqlcounter.c rlm_sqlcounter.c.ORIG 668,672c668 < if (strcmp(data->reset, "never") == 0) { < snprintf(msg, sizeof(msg), "Your maximum access time has been reached"); < } else { < snprintf(msg, sizeof(msg), "Your maximum %s usage time has been reached", data->reset); < } --- > snprintf(msg, sizeof(msg), "Your maximum %s usage time has been reached", data->reset);

1 0

Checkitems
by Norbert Wegener 16 Dec '05

16 Dec '05

Maybe my last question was unclear this morning. Therefore I would like to rephrase it: Checkitems may be defined via ldap.attrmap e.g. like: checkItem User-Category primaryGroupID Those items, retrieved from an ldapserver and thus not part of the request: Are they supposed to be accessible by following modules? In a case like this in radiusd.conf: authorize { ldap { notfound = return } files } Should the files module have access to to a check item User-Category ? Thanks Norbert Wegener

2 1

problems with freeradius 1.0.5
by Riccardo Veraldi 16 Dec '05

16 Dec '05

hell oI upgraded from freeradius 1.0.2 to 1.0.5 and nothing works anymore I have this error: radiusd.conf[1682] Unknown Auth-Type "Pam" in authenticate section. commenting out pam thne I Got this radiusd.conf[1682] Unknown Auth-Type "System" in authenticate section. and so if I comment out "unix" in the radiusd.conf fiel I get this error: rlm_eap_gtc: Unknown Auth-Type PAP rlm_eap: Failed to initialize type gtc anyone has some hints ?? thank you Rick

3 4

help on rlm_mschap: FAILED: MS-CHAP2-Response is incorrect
by Jie Yang 15 Dec '05

15 Dec '05

Hi, All, When I tried to develop PEAP at client side, i found I am always rejected by the server. The following is the log. what might be wrong? my server config? thanks, Jie Tue Dec 13 19:17:04 2005 : Debug: users: Matched supplicant_cts2@spirentcom. com at 53 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authorize]: returned from files (r lm_files) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authorize]: module "files" returns o k for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group authorize returns updated for r equest 14 Tue Dec 13 19:17:04 2005 : Debug: rad_check_password: Found Auth-Type EAP Tue Dec 13 19:17:04 2005 : Debug: auth: type "EAP" Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group authenticate for reque st 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling eap (rlm_ea p) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Request found, released from the li st Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: EAP/mschapv2 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: processing type mschapv2 Tue Dec 13 19:17:04 2005 : Debug: Processing the authenticate section of radiu sd.conf Tue Dec 13 19:17:04 2005 : Debug: modcall: entering group Auth-Type for request 14 Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: calling mschap (rlm _mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: Told to do MS-CHAPv2 for supplic ant_cts2(a)spirentcom.com with NT-Password Tue Dec 13 19:17:04 2005 : Debug: rlm_mschap: FAILED: MS-CHAP2-Response is inc orrect Tue Dec 13 19:17:04 2005 : Debug: modsingle[authenticate]: returned from mscha p (rlm_mschap) for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall[authenticate]: module "mschap" retur ns reject for request 14 Tue Dec 13 19:17:04 2005 : Debug: modcall: group Auth-Type returns reject for re quest 14 Tue Dec 13 19:17:04 2005 : Debug: rlm_eap: Freeing handler

2 4

radclient ignores 'Group' attribute
by Bill Schoolfield 15 Dec '05

15 Dec '05

Hello, We are switching out a client from cistron radius to FreeRadius with MySQL. To test things out without changes to the NASs, we are proxing certain realms to the new FreeRadius server. Here's our problem; the proxy works fine but the authentication (actually the user lookup) is failing when testing via radclient. The user lookup fails because the 'Group' attribute in the referenced attribute file (-f file) is being ignored (not sent) by radclient. Why is this? Is there a workaround? The Group attribute is defined in the dictionary as: ATTRIBUTE Group 1005 string The attribute file used by radclient looks like: Acct-Session-Id = "6000006B", User-Name = "example(a)examp.com", User-Password = "example", Group = "default", NAS-IP-Address = 127.0.0.1, NAS-Port-Id = 32, NAS-Port-Type = Async, Service-Type = Framed-User, Framed-Protocol = PPP Thanks in advance for your response. Bill

2 2

Need "account valid for" attribute/counter (continuous time)
by Mikhail Zolikoff 15 Dec '05

15 Dec '05

Installation: Debian (sarge) + Freeradius 1.0.2 w/rlm_sqlcounter + MySQL 4.1.11 Hello, everyone! I've been trying to do the following, and I thought that I had it tonight, but I can't seem to get it: I'd like to set a "dropdead date/time" by which a user can log into my Freeradius server. I'm thinking of an attribute or counter that sets or performs the following: login-deadline or account-timeout or last-login-date or last-login-time or account-valid-for I'm not trying to limit how much a user can be logged in per unit of time (daily, monthly, etc.), but instead set the last time the user can possibly login starting from the first time they login. So, if this attribute is set to 86400, from the first time they login they can do whatever they want for a day but then they're done. Basically a continuous counter (or a math operation), whether the user is logged in or not. session-timeout works on a per session basis, so that doesn't work. Max-All-Session works like a prepaid card and only removes time in discontinuous chunks. What I really need is either an attribute or counter (like rlm_sqlcounter or rlm_counter) that can determine whether a user is close to their account deadline and let them pass through or be denied. Any thoughts? I've been banging my head against this for a while and can't seem to figure it out. I've searched just about every website and can't find a darn thing. I can get close, but nothing that takes care of the accounting without some custom programming. Thanks!

2 3