- Freeradius-Users - lists.freeradius.org

What are the advantage and disadvantage about ntlm_auth and LDAP?
by darkblue 05 Dec '05

05 Dec '05

There two type of method to integrate freeradius with AD, ntlm_auth and ldap, with help by experts such as Alan DeKok and Nicolas Baradakis , I had been setup the 802.1x+freeradius+ntlm_auth+AD. and I wonder what are the advantage and disadvantage about ldap and ntlm_auth.LDAP sounds better than ntlm_auth, is that right? -- He is nothing

2 1

EAP-TTLS/PAP and proxying
by Samuel Degrande 05 Dec '05

05 Dec '05

Hello. I have one other question concerning proxying, and once again excuse me if I don't use the good terminology. I use EAP-TTLS/PAP between a 802.1X supplicant and a radius server. I would like to proxy the authentication to an other radius server. So, is it possible to 'decapsulate' the authentication protocol from EAP on the first radius server, and only send user-name/user-password attributes to the central radius server ? (i guess that my question is stupid, but I don't know how to express it in the good way...) thanks -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]

3 2

Free Radius and Squid
by Sean Ali 05 Dec '05

05 Dec '05

Hello, I'm very new to free raduis and would like to know if it will run with squid proxy server. If so how would this work? What I am looking to do is to allow users to access the internet via the transparent squid proxy for limited time sessions. Eg. a user who wishes to use the system would be greeted by a web page asking for a code. The code (which they would get from the system admin) would grant them access for 1 hour. Can this be done using FreeRadius and Squid? Sean.

3 2

FreeRadius Authentication Protocol
by Hamid Salim 05 Dec '05

05 Dec '05

Hi, I have a FreeRadius EAP-TLS working enviornment. Going forward, I would like to avoid installing client certificates on every new mobile client and maintaining the current installs. I think the solution will be EAP-TTLS. However, I would like to get input from the experts about best available option/s. The goal is to authenticate supplicants via FreeRadius without the use of client certificates (server certificate is ok). Any help is appreciated. Regards, Hamid.

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 05 Dec '05

05 Dec '05

Alan, You seem to be one of the most knowledgeable folks on the list. Can you provide any input? All help is appreciated. Chad. From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Bohannan, Chad W Sent: Friday, December 02, 2005 12:51 PM To: FreeRadius users mailing list Subject: RADIUS Auth-Type OK, here is the situation. I have successfully configured RADIUS to authenticate/authorize NAS requests from my Cisco gear so long as the user "Auth-Type= System". I have also managed to get Samba working and have joined the radius server to the AD realm in question. This is confirmed through the following: ntlm_auth --request-nt-key --domain=MYDOMAIN --username=MYUID password:xxxxx NT_STATUS_OK: Success (0x0) wbinfo -a MYUID%MYPASSWD plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user MYUID%MTPASSWD with plaintext password challenge/response password authentication succeeded However, when I edit the /etc/raddb/users file and change the "Auth-Type= System" to "Auth-Type=MSCAP" all authentication attempts fail. Am I specifying the correct auth-type? Have I missed a step? Is there something I can do (debug maybe) that will better assist in identifying the problem? Any and all suggestions are appreciated. I am attempting to have RADIUS proxy authentication requests to AD, then assign attributes if authentication succeeds. Chad

1 0

Accounting proxy to multiple hosts
by Deon van der Merwe 05 Dec '05

05 Dec '05

Hi, I have successfully been running freeradius as an accounting proxy. Next step is to be able to proxy to multiple hosts... actually it will be a proxy to the real RADIUS server and then (what I can only describe as...) replication of the accounting messages to at least 2 other servers. - I only want the response from the real RADIUS server to be sent back to the originator - the responses from the other (replication) servers can be dropped/ignored Is this possible to do? Is there some better options that you might know of?

3 3

FreeRadius and Interim Packets
by Matt 05 Dec '05

05 Dec '05

Does anyone have experience with FreeRadius and Interim packets? Does it work ok? Any problems? How do you enable it?

7 22

SQL Call-Check Authentication (again :( )
by florian broder 05 Dec '05

05 Dec '05

Hi. I'm still having a hard time of implementing the Calling-Station-Id Authentication. Basis is a Cisco Catalyst with "Mac-Authentication-Bypass" turned on. Alan DeKok told me, that I can use sql.conf: # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, -->># Else use hard-coded string "DEFAULT" as the user name.<<-- sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" To tell freeradius, that there is no user-name. Ok, I've done that, but It gives me this error: rad_recv: Access-Request packet from host 192.168.1.222:1038, id=13, length=45 Service-Type = Call-Check Calling-Station-Id = "11-22-33-44-55-66" -->> rlm_sql (sql): zero length username not permitted <<-- That's basically the same packet, the Cisco Switch sends as Auth-Request. Notice, that there is NO user-name in here at all. The fact is also mentioned in the sql Source-Code: /* * They MUST have a user name to do SQL authorization. */ if ((request->username == NULL) || (request->username->length == 0)) { radlog(L_ERR, "rlm_sql (%s): zero length username not permitted\n", inst->config->xlat_name); return RLM_MODULE_INVALID; } Switching to "file-based-Authentication" (in radiusd.conf) it works immediately: rad_recv: Access-Request packet from host 192.168.1.222:1044, id=19, length=45 Service-Type = Call-Check Calling-Station-Id = "11-22-33-44-55-66" Sending Access-Accept of id 19 to 192.168.1.222:1044 Reply-Message = "Hello" So, it's really a limitation in sql, rather that a misconfiguration? Would be nice, if anyone can confirm this! Bye Flo

3 3

(no subject)
by debik 05 Dec '05

05 Dec '05

When i try to authenticate on my Xp client this message is in the log and the Acces-Reject is send modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. Somebody knows what this means ??

1 0

sqltrace.log
by TK Lew 05 Dec '05

05 Dec '05

hi all :: Is it adviseable to turn on the sqltrace.log file under production environment ? Thanks ! BR

2 1