- Freeradius-Users - lists.freeradius.org

How do I strip netbios-style domain name from User-Name?
by Laker Netman 28 Nov '05

28 Nov '05

My FR server is successfully receiving Access-Requests from my wifi AP (XP supplicant) using PEAP/EAP-TLS. However, the received User-Name is formatted "Domain\\User". I have read the docs regarding realms and proxy.conf and believe the following should work: (In radiusd.conf) realm MY-DOMAIN-NAME { format = prefix delimiter = "\\" ignore_default = yes ignore_null = yes } (In proxy.conf) realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } I have also tried "realm MY-DOMAIN-NAME" rather than "DEFAULT" in proxy.conf with no difference. "with_ntdomain_hack" is set to "no" wherever referenced, as it is my understanding using the realms module is the preferred method (?) My ldap filter is: filter = "(sAMAccountName=%u)" and running with "-X" I get the following: rad_recv: Access-Request packet from host 192.168.12.231:2057, id=0, length=156 User-Name = "MY-DOMAIN-NAME\\username" NAS-IP-Address = 192.168.12.231 Called-Station-Id = "000d0b6b9250" Calling-Station-Id = "000e356529b4" NAS-Identifier = "000d0b6b9250" NAS-Port = 56 Framed-MTU = 1400 State = 0x9eafe6f8023c0c59423b42f6c92b96f4 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0xc8ce70994f2aba8a00f4ba8561979c20 ... then ... rlm_ldap: - authorize rlm_ldap: performing user authorization for MY-DOMAIN-NAME\\username radius_xlat: '(sAMAccountName=MY-DOMAIN-NAME)' radius_xlat: 'CN=Users,DC=mydomain,DC=branch,DC=corp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Users,DC=mydomain,DC=branch,DC=corp, with filter (sAMAccountName=MY-DOMAIN-NAME) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed Authenticating via (hard-wired) telnet works as expected and %u contains the username without any domain prefix, of course. A suggestion as to what I may have missed would be appreciated. TIA, Laker __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0

Re: AD authentication
by charles schwartz 28 Nov '05

28 Nov '05

Hi, If the wbinfo command does not work, ntlm_auth won't work too. > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO This error indicates that something went wrong with the domain access. Try to troubleshoot by using wbinfo -g or wbinfo -u. With these commands you should be able to list the users and groups of your domain. There may be a problem with NTLM on your Windows2003 server. Note thath NTLM was the authentication protocol used by earlier version of Windows. It is still supported for backward compatibility, but can be disabled. By default, Win2k and 2003 use Kerberos for authentication. You might have a security policy thats restricts the use of NTLM on your network. Check your GPO if NTLM is allowed to be transmitted across the network. Regards, Charles Schwartz > Hi, > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > box to get authenticated through users in Windows 2003 AD. > > > > I used the command net join -U Administrator to add the machine to the > domain. It gave successful results. Now on typing the command > > > > wbinfo -a checkad%Quark_123 > > > > I got the following results:- > > > > plaintext password authentication failed > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > error messsage was: No such user > > Could not authenticate user checkad%Quark_123 with plaintext password > > challenge/response password authentication failed > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > Could not authenticate user checkad with challenge/response > > > > Also, on giving the command > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > checkad > > password: > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > [root@Radius etc]# > > I get the above stated error. Please help. > > Thanks & Regards > > Varun Marwah > > CONFIDENTIALITY NOTICE > > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > attachments, and any copies without reading or saving in any manner. > Thank you. > > >

1 0

SQL Mac-Authentication based on Call-Check
by florian broder 28 Nov '05

28 Nov '05

Hello. I'm currently working on my diploma thesis, and I'm sorting some things out at the moment. The task is, to authenticate mac-adresses through a cisco catalyst 6500. A pretty new feature called "mac-authentication-bypass" is available in CatOS and works well with Cisco ACS 4.0 beta. Due to our demands we want to deploy freeradius, with a mysql database. It works like that. The switch sends an Access-Request with the connecting MAC in the Caller-ID Field and Sevice Type is set to "10", hence "Call Ceck". Radius now authenticates the users on a given MAC (Caller ID) instead of a user/password. I haven't set up freeradius yet, but I'm slighty familar with the settings that have to be done. In table "radcheck" I create attribute "Calling-Station-ID" with value "MAC-Address" (f.e. ff-ee-11-22-33-44), this value will be checked against. I also have to edit the sql.conf (user, database etc) and telling radiusd.conf to use sql in the "authorise" section. I'm sticking to the Freeradius MySQL howto by Scott Bartlett for that. :) The only thing I'm currently unaware of is, where I can tell freeradius to use Call-Check together with mysql, I think it's somewhere in sql.conf? Only thing that need to be done IMO is to tell radius, that there is no username and authentication needs to be done on a caller-id basis. Any thoughts? Thanks in advance. Bye Florian

2 5

freeradius 1.0.2 with openssl 0.9.7
by awal.mohamadou 28 Nov '05

28 Nov '05

no need please i've found a howto resolve my problem of certificates. http://www.freeradius.org/doc/EAPTLS.pdf it seems to be a problem of extension files with XPsupplicants.i'll try and see what is hapenning. Awal. Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34/mn) ; tél : 08 92 68 13 50 (0,34/mn)

1 0

freeradius 1.0.2 with openssl 0.9.7
by awal.mohamadou 28 Nov '05

28 Nov '05

hi everybody! i've got a problem for running my ./CA.pl file to generate certificate with openssl 0.9.7.may someone please give me the openssl command to generate clients and servers certificates? i've googled a lot but didn't find a howto . or give me a link. i have already well configured my openssl.cnf file.then i have to generate certificates. thanks a lot , i'll appreciate. Regards. Awal. Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34/mn) ; tél : 08 92 68 13 50 (0,34/mn)

1 0

AD authentication
by Varun Marwah 28 Nov '05

28 Nov '05

Hi, I used the document freeRadius_AD_tutorial.pdf for configuring a linux box to get authenticated through users in Windows 2003 AD. I used the command net join -U Administrator to add the machine to the domain. It gave successful results. Now on typing the command wbinfo -a checkad%Quark_123 I got the following results:- plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user checkad%Quark_123 with plaintext password challenge/response password authentication failed error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO Could not authenticate user checkad with challenge/response Also, on giving the command # ntlm_auth --request-nt-key --domain=india.quark.com --username= checkad password: NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) [root@Radius etc]# I get the above stated error. Please help. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com <mailto:vmarwah@quark.com> ) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you.

1 0

symbol lookup error EAP/PEAP
by Konne 28 Nov '05

28 Nov '05

hi when i start freeradius -X, and i'll connect with SecureW2 client... during the authentication he gives me following error... ... ... auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate and then it gives me the symbol error /usr/local/lib/rlm_eap_peap-1.0.5.so: undefined symbol: eaptls_process i have done configure --disable-share make make install but the same error... what can it be... thx

1 0

(no subject)
by jonniie＠blueyonder.co.uk 28 Nov '05

28 Nov '05

I am completely new to this and i want to know how to set up a basic radius server for WIFI authenitcation. Based on multiple users. Thanks

3 2

regexp with ldap
by Markus Krause 27 Nov '05

27 Nov '05

hi all, i am using freeradius 1.0.5 on sles 9. what i want to achieve: network devices send their mac-address to a switch, which then sends access-request packages to the freeradius. the mac-addresses are stored in an ldap tree using the objectclass "dhcpHost" and the entry "dhcpHWAddress" (which is also used for dhcp). unfortunately the attribute dhcpHWAddress contains entries like "ethernet 00:11:22:33:44:55" and not only the mac address. (how) can i use regexp to get the necessary information from ldap? i read variables.txt but seem to be misunderstanding the concept (sorry, i am not an english native speaker ..). do i have to enter something in the ldap section in 'filter="..."' radiusd.conf? could someone give me some examples? thanks in advance for any hints! best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Documentation
by Romain GAILLEGUE 26 Nov '05

26 Nov '05

Hi, I'm looking for a simple documentation to authenticate a user on a external command like "/bin/true" (for the beginning ;) If somme can give me a link or some sample configurations files i will be very happy Thanks you Romain

3 2