- Freeradius-Users - lists.freeradius.org

RE: AD authentication
by Varun Marwah 29 Nov '05

29 Nov '05

Hi Charles, I already have defined NTLM Security policy for my Domain Controller security settings. But Still getting the same error message. Can you please specify the local domain controller policies with settings which should be enabled for Freeradius server to authenticate. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you. -----Original Message----- From: charles schwartz [mailto:charles.schwartz@umail.univ-metz.fr] Sent: Monday, November 28, 2005 10:51 PM To: freeradius-users(a)lists.freeradius.org Cc: Varun Marwah Subject: Re: AD authentication Hi, If the wbinfo command does not work, ntlm_auth won't work too. > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO This error indicates that something went wrong with the domain access. Try to troubleshoot by using wbinfo -g or wbinfo -u. With these commands you should be able to list the users and groups of your domain. There may be a problem with NTLM on your Windows2003 server. Note thath NTLM was the authentication protocol used by earlier version of Windows. It is still supported for backward compatibility, but can be disabled. By default, Win2k and 2003 use Kerberos for authentication. You might have a security policy thats restricts the use of NTLM on your network. Check your GPO if NTLM is allowed to be transmitted across the network. Regards, Charles Schwartz > Hi, > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > box to get authenticated through users in Windows 2003 AD. > > > > I used the command net join -U Administrator to add the machine to the > domain. It gave successful results. Now on typing the command > > > > wbinfo -a checkad%Quark_123 > > > > I got the following results:- > > > > plaintext password authentication failed > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > error messsage was: No such user > > Could not authenticate user checkad%Quark_123 with plaintext password > > challenge/response password authentication failed > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > Could not authenticate user checkad with challenge/response > > > > Also, on giving the command > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > checkad > > password: > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > [root@Radius etc]# > > I get the above stated error. Please help. > > Thanks & Regards > > Varun Marwah > > CONFIDENTIALITY NOTICE > > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > attachments, and any copies without reading or saving in any manner. > Thank you. > > > -- This message has been scanned for viruses and dangerous content by Quark Anti Virus, and is believed to be clean.

3 2

EAP-TLS problem with Intel PROSet 7.1.4.4
by Michelle Lin 29 Nov '05

29 Nov '05

Hi Experts, I'm new to FreeRadius server. The version I installed on my Linux box (RedHat 9.0) is 1.0.5. I configured this FreeRadius server using EAP_TLS. And the server works fine with following hardware/software setup: NIC card (built in): Intel(R)PRO/Wireless 2200BG Network Connection NIC software: Intel PROSet/Wireless, version 9.0.3.0 AP: DLink wireless router DI-624 Client System: Windows XP However, the same certifcate doesn't work with an older NIC card/NIC software on a different laptop. Here is the info about NIC card and NIC software. This laptop also runs Windows XP. NIC card (built in): Intel (R) PRO/Wireless LAN 2100 3A Mini PCI Adapter NIC software: Intel PROSet, version 7.1.4.4 I got following failure notification after trying to connect to the AP: 802.1x Authentication has failed due to a Challenge Failure. This may have happened because of wrong user credentials. Same certificate works fine with my first laptop. The debugging trace from FreeRADIUS server is in the attached file. Thanks a lot in advance for your help... - michelle __________________________________ Yahoo! Music Unlimited Access over 1 million songs. Try it free. http://music.yahoo.com/unlimited/

2 1

RE: Vendor-type length problem
by MINODIER David RD-RESA-LAN 29 Nov '05

29 Nov '05

Many thanks for such a quick answer ! Sub-question: First, i'll definitly have a look at the CVS. Can you just tell me if (CVS) Freeradius will be able to reply to 1 vendor with a vendor-type of 2 octets and the other vendors with a vendor-type of 1 octet ? Again, thanks so much Alan. > > - can Freeradius encode a vendor-type on 2 octets for 1 specific > > vendor while replying to the client? > > In 1.0.5, no. In the CVS head, yes.

2 1

Vendor-type length problem
by MINODIER David RD-RESA-LAN 29 Nov '05

29 Nov '05

HI all, I have a Radius client (not generic but proprietary) that encodes its vendor-type on *2* octets while the "normal and common" way is to encode the vendor-type on 1 octet (0-255). RFC 2865 says that the actual "vendor-type + length + value" is a string field and : "The String field is one or more octets. The actual format of the information is site or application specific, and a robust implementation SHOULD support the field as undistinguished octets. The codification of the range of allowed usage of this field is outside the scope of this specification." O'Reilley Radius book however says page 28: "vendor type - the vendor type field, which is one octet in length, etc". And the consequent questions: - Is there an RFC that actually defines for good the length of the vendor-type? (I did not manage to find that piece of information) - can Freeradius encode a vendor-type on 2 octets for 1 specific vendor while replying to the client? - if so (I doubt...), how? (configuration? Special dictionary format?) Many thks. David.

2 1

RE: WLAN 802.1x FreeRadius with LDAP
by King, Michael 29 Nov '05

29 Nov '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Christian Poessinger > Sent: Tuesday, November 29, 2005 10:12 AM > To: 'FreeRadius users mailing list' > Subject: RE: WLAN 802.1x FreeRadius with LDAP > > > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/peap > rlm_eap: processing type peap > rlm_eap_peap: Authenticate > rlm_eap_tls: processing TLS > Does PEAP work with LDAP. I think the passwords had to be stored in cleartext?

1 0

Freeradius and Netscreen VPN Authentication
by freeradius 29 Nov '05

29 Nov '05

Greetings, I've been attempting to get freeradius-1.0.2-2 on Fedora core 4 to send the correct authentication information to my Netscreen VPN device. my test user information within the /etc/raddb/users file consists of: freeradius Auth-Type := Accept, Password=abcd1234, Ns-User-Group == Some_Secure_grp --------- When I remove the user-group "Some_Secure_grp" from the following Netscreen configuration line, I'm able to connect if I remove "Ns-User-Group == Some_Secure_grp" from the configuration line from raddb's users file. set ike gateway "GATEWAY-SOME_SECURE_GRP" xauth server "FreeRadius" user-group "Some_Secure_grp" --------- If I attempt to utilize group authentication, I recieve the following information in my event log on the Netscreen device: 2005-11-23 14:31:56 system notif 00767 User freeradius belongs to a different group in the RADIUS server than one allowed in the device --------- If anyone has any ideas, Id greatly appreciate it. Juniper doesn't really have many people on their staff that has in depth experience with freeradius.

1 1

Long SQL queries in attributes
by Pedro Ribeiro 29 Nov '05

29 Nov '05

Hello freeradius-users, I'm having trouble using long (>253 chars) SQL queries in the "users" file. It seems the limitations of attribute size are being applied to SQL queries even before expanding %{...} variables. Example: >DEFAULT NAS-Port-Type == 'Wireless-802.11', Service-Type == 'Login-User', Client-IP-Address != 127.0.0.1 > IPLNet-VLAN = `%{sql:SELECT DISTINCT VLAN FROM alunos.RadiusVLAN AS v,alunos.Bindings AS b WHERE (Realm = '%{Realm}' OR Realm IS NULL) AND (HuntgroupName = '%{HuntgroupName}' OR HuntgroupName IS NULL) AND (User = SUBSTRING_INDEX('%{reply:User-Name}','@',1) AND Domain = '%{Realm}' AND v.CodigoCurso = b.CodigoCurso OR v.CodigoCurso IS NULL) ORDER BY v.CodigoCurso DESC,Realm DESC,HuntgroupName DESC LIMIT 1:-1003}`, > Fall-Through = Yes Is there any way to overcome this limitation ?? TIA. -- Best regards, Pedro mailto:pribeiro-bulk@net.ipl.pt

2 1

rlm_ippool: multiple ip ranges or multiple pools
by Andre Dalle 29 Nov '05

29 Nov '05

Currently using rlm_ippool with great success on freeradius-1.0.4. A single IP range and a single pool associated with all dynamic-IP users. Looking through the code, it looks like we can't have a second ip range associated with a single pool, which would be ideal. Is there a way to associate multiple ranges/pools with a single usergroup? -- André Dalle Harrumph!

3 2

AD authentication
by Varun Marwah 29 Nov '05

29 Nov '05

Hi There I have configured the Freeradius on Fedora core 3 as per the documentation [root@Radius raddb]# ntlm_auth --request-nt-key --domain=INDIA --username=checkad password: NT_STATUS_OK: Success (0x0) [root@Radius raddb]# When I start the the Radius Server using Radius -X command Starts fine. When I give the logon credentials through the wireless laptop the user doesn't get validated. Please help me out. If you need the any config files for your reference, please let me know.Atached is the log file of output generated. Also guide me, as I have already given allow permissions to users with Dialin Permissions in AD domain. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you. -----Original Message----- From: charles schwartz [mailto:charles.schwartz@umail.univ-metz.fr] Sent: Monday, November 28, 2005 10:51 PM To: freeradius-users(a)lists.freeradius.org Cc: Varun Marwah Subject: Re: AD authentication Hi, If the wbinfo command does not work, ntlm_auth won't work too. > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO This error indicates that something went wrong with the domain access. Try to troubleshoot by using wbinfo -g or wbinfo -u. With these commands you should be able to list the users and groups of your domain. There may be a problem with NTLM on your Windows2003 server. Note thath NTLM was the authentication protocol used by earlier version of Windows. It is still supported for backward compatibility, but can be disabled. By default, Win2k and 2003 use Kerberos for authentication. You might have a security policy thats restricts the use of NTLM on your network. Check your GPO if NTLM is allowed to be transmitted across the network. Regards, Charles Schwartz > Hi, > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > box to get authenticated through users in Windows 2003 AD. > > > > I used the command net join -U Administrator to add the machine to the > domain. It gave successful results. Now on typing the command > > > > wbinfo -a checkad%Quark_123 > > > > I got the following results:- > > > > plaintext password authentication failed > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > error messsage was: No such user > > Could not authenticate user checkad%Quark_123 with plaintext password > > challenge/response password authentication failed > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > Could not authenticate user checkad with challenge/response > > > > Also, on giving the command > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > checkad > > password: > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > [root@Radius etc]# > > I get the above stated error. Please help. > > Thanks & Regards > > Varun Marwah > > CONFIDENTIALITY NOTICE > > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > attachments, and any copies without reading or saving in any manner. > Thank you. > > > -- This message has been scanned for viruses and dangerous content by Quark Anti Virus, and is believed to be clean.

1 0

Redirect to Realm with Username regex
by Armin ranjbar 29 Nov '05

29 Nov '05

Dear all ; Is this possible to redirect users to another realm ( just like @realm ) with username perfix ? for example , redirect any username that start with A1 to a realm and A2's to another ? -- You will overcome the attacks of jealous associates.

2 1