- Freeradius-Users - lists.freeradius.org

Freeradius and Netscreen VPN Authentication
by freeradius 29 Nov '05

29 Nov '05

Greetings, I've been attempting to get freeradius-1.0.2-2 on Fedora core 4 to send the correct authentication information to my Netscreen VPN device. my test user information within the /etc/raddb/users file consists of: freeradius Auth-Type := Accept, Password=abcd1234, Ns-User-Group == Some_Secure_grp --------- When I remove the user-group "Some_Secure_grp" from the following Netscreen configuration line, I'm able to connect if I remove "Ns-User-Group == Some_Secure_grp" from the configuration line from raddb's users file. set ike gateway "GATEWAY-SOME_SECURE_GRP" xauth server "FreeRadius" user-group "Some_Secure_grp" --------- If I attempt to utilize group authentication, I recieve the following information in my event log on the Netscreen device: 2005-11-23 14:31:56 system notif 00767 User freeradius belongs to a different group in the RADIUS server than one allowed in the device --------- If anyone has any ideas, Id greatly appreciate it. Juniper doesn't really have many people on their staff that has in depth experience with freeradius.

1 1

Long SQL queries in attributes
by Pedro Ribeiro 29 Nov '05

29 Nov '05

Hello freeradius-users, I'm having trouble using long (>253 chars) SQL queries in the "users" file. It seems the limitations of attribute size are being applied to SQL queries even before expanding %{...} variables. Example: >DEFAULT NAS-Port-Type == 'Wireless-802.11', Service-Type == 'Login-User', Client-IP-Address != 127.0.0.1 > IPLNet-VLAN = `%{sql:SELECT DISTINCT VLAN FROM alunos.RadiusVLAN AS v,alunos.Bindings AS b WHERE (Realm = '%{Realm}' OR Realm IS NULL) AND (HuntgroupName = '%{HuntgroupName}' OR HuntgroupName IS NULL) AND (User = SUBSTRING_INDEX('%{reply:User-Name}','@',1) AND Domain = '%{Realm}' AND v.CodigoCurso = b.CodigoCurso OR v.CodigoCurso IS NULL) ORDER BY v.CodigoCurso DESC,Realm DESC,HuntgroupName DESC LIMIT 1:-1003}`, > Fall-Through = Yes Is there any way to overcome this limitation ?? TIA. -- Best regards, Pedro mailto:pribeiro-bulk@net.ipl.pt

2 1

rlm_ippool: multiple ip ranges or multiple pools
by Andre Dalle 29 Nov '05

29 Nov '05

Currently using rlm_ippool with great success on freeradius-1.0.4. A single IP range and a single pool associated with all dynamic-IP users. Looking through the code, it looks like we can't have a second ip range associated with a single pool, which would be ideal. Is there a way to associate multiple ranges/pools with a single usergroup? -- André Dalle Harrumph!

3 2

AD authentication
by Varun Marwah 29 Nov '05

29 Nov '05

Hi There I have configured the Freeradius on Fedora core 3 as per the documentation [root@Radius raddb]# ntlm_auth --request-nt-key --domain=INDIA --username=checkad password: NT_STATUS_OK: Success (0x0) [root@Radius raddb]# When I start the the Radius Server using Radius -X command Starts fine. When I give the logon credentials through the wireless laptop the user doesn't get validated. Please help me out. If you need the any config files for your reference, please let me know.Atached is the log file of output generated. Also guide me, as I have already given allow permissions to users with Dialin Permissions in AD domain. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you. -----Original Message----- From: charles schwartz [mailto:charles.schwartz@umail.univ-metz.fr] Sent: Monday, November 28, 2005 10:51 PM To: freeradius-users(a)lists.freeradius.org Cc: Varun Marwah Subject: Re: AD authentication Hi, If the wbinfo command does not work, ntlm_auth won't work too. > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO This error indicates that something went wrong with the domain access. Try to troubleshoot by using wbinfo -g or wbinfo -u. With these commands you should be able to list the users and groups of your domain. There may be a problem with NTLM on your Windows2003 server. Note thath NTLM was the authentication protocol used by earlier version of Windows. It is still supported for backward compatibility, but can be disabled. By default, Win2k and 2003 use Kerberos for authentication. You might have a security policy thats restricts the use of NTLM on your network. Check your GPO if NTLM is allowed to be transmitted across the network. Regards, Charles Schwartz > Hi, > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > box to get authenticated through users in Windows 2003 AD. > > > > I used the command net join -U Administrator to add the machine to the > domain. It gave successful results. Now on typing the command > > > > wbinfo -a checkad%Quark_123 > > > > I got the following results:- > > > > plaintext password authentication failed > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > error messsage was: No such user > > Could not authenticate user checkad%Quark_123 with plaintext password > > challenge/response password authentication failed > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > Could not authenticate user checkad with challenge/response > > > > Also, on giving the command > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > checkad > > password: > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > [root@Radius etc]# > > I get the above stated error. Please help. > > Thanks & Regards > > Varun Marwah > > CONFIDENTIALITY NOTICE > > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > attachments, and any copies without reading or saving in any manner. > Thank you. > > > -- This message has been scanned for viruses and dangerous content by Quark Anti Virus, and is believed to be clean.

1 0

Redirect to Realm with Username regex
by Armin ranjbar 29 Nov '05

29 Nov '05

Dear all ; Is this possible to redirect users to another realm ( just like @realm ) with username perfix ? for example , redirect any username that start with A1 to a realm and A2's to another ? -- You will overcome the attacks of jealous associates.

2 1

dialupadmin clean_radacct not working
by radius＠pagedata.com 29 Nov '05

29 Nov '05

We have recently installed Freeradius 1.0.5 and dialupadmin on CentOS4.2. We have changed the clean_radacct file so that it will delete the online user entries that are greater than 4 days old instead of 30 in the dialupadmin. However, it does not delete out those entries from the "online users" section of the dialupadmin gui interface. We have tried turning on the debugging to see if we could see an error when we manually run the ./clean_radacct but do not see any errors. >From the command line it appears that it is working. We get the following response: # ./clean_radacct 2005-11-23 17:35:56 DELETE FROM radacct WHERE AcctStopTime IS NULL AND AcctStartTime < '2005-11-23 17:35:56'; Could someone point out what might be wrong or what else to look at so we can correct this? Also, it seems like it takes longer for the information on the page to load for the online users than when we were running freeradius 0.9.5. Does anyone know what we should look at to see what could be causing a problem? Thank you

1 0

FreeRADIUS->Active Directory
by Alhagie Puye 28 Nov '05

28 Nov '05

Hello all, I am still running into problems with this setup. I have made some progress though. First off, my setup is: SSL VPN Client -> Cisco VPN Concentrator -> FreeRadius -> Active Directory I can query Active with the ldapsearch tool. waggawagga raddb # ldapsearch -h w.x.y.z -x -b 'ou=information technology,ou=datawave users,dc=corp,dc=van,dc=dwave' '(samaccountname=apuye)' -D apuye(a)corp.van.dwave -W Enter LDAP Password: # extended LDIF # # LDAPv3 # base <ou=information technology,ou=datawave users,dc=corp,dc=van,dc=dwave> with scope sub # filter: (samaccountname=apuye) # requesting: ALL # # Alhagie Puye, Information Technology, DataWave Users, corp.van.dwave dn: CN=Alhagie Puye,OU=Information Technology,OU=Datawave Users,DC=corp,DC=van ,DC=dwave memberOf: CN=itops-folder,OU=SHARED FOLDERS,OU=DataWave Users,DC=corp,DC=van,D C=dwave memberOf: CN=rptpcps,OU=DataWave Users,DC=corp,DC=van,DC=dwave memberOf: CN=itops,OU=Information Technology,OU=DataWave Users,DC=corp,DC=van, DC=dwave memberOf: CN=datawave,OU=DataWave Users,DC=corp,DC=van,DC=dwave accountExpires: 9223372036854775807 badPasswordTime: 127775870835283171 badPwdCount: 0 codePage: 0 cn: Alhagie Puye countryCode: 0 description: IT Operations displayName: Alhagie Puye givenName: Alhagie homeDirectory: \\server\apuye homeDrive: H: instanceType: 4 lastLogoff: 0 lastLogon: 127776922250294313 logonCount: 173 msNPAllowDialin: TRUE distinguishedName: CN=Alhagie Puye,OU=Information Technology,OU=DataWave Users ,DC=corp,DC=van,DC=dwave objectCategory: CN=Person,CN=Schema,CN=Configuration,DC=corp,DC=van,DC=dwave objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user objectGUID:: oO1UkRu8RkScNIOHmaB/qw== objectSid:: AQUAAAAAAAUVAAAAzSmuLihcKk12fipaZwkAAA== primaryGroupID: 513 profilePath: \\\server1\apuye pwdLastSet: 127771529310887572 name: Alhagie Puye sAMAccountName: apuye sAMAccountType: 805306368 sn: Puye userAccountControl: 512 userParameters:: bTogICAgICAgICAgICAgICAgICAgIGQJICAgICAgICAgICAgICAgICAgICAgI CAgUBAaCAFDdHhDZmdQcmVzZW5045S15pSx5oiw44GiGAgBQ3R4Q2ZnRmxhZ3Mx44Cw44Gm4 6Cy44 C5FggBQ3R4Q2FsbGJhY2vjgLDjgLDjgLDjgLASCAFDdHhTaGFkb3fjhLDjgLDjgLDjgLAoCA FDdHh NYXhDb25uZWN0aW9uVGltZeOAsOOAsOOAsOOAsC4IAUN0eE1heERpc2Nvbm5lY3Rpb25UaW1 l44Cw 44Cw44Cw44CwHAgBQ3R4TWF4SWRsZVRpbWXjgLDjgLDjgLDjgLAiCAFDdHhLZXlib2FyZExh eW91d OOAsOOAsOOAsOOAsCoCAUN0eE1pbkVuY3J5cHRpb25MZXZlbOOEsCACAUN0eFdvcmtEaXJlY 3Rvcn njgLAgAgFDdHhOV0xvZ29uU2VydmVy44CwGAIBQ3R4V0ZIb21lRGly44CwIgIBQ3R4V0ZIb2 1lRGl yRHJpdmXjgLAgAgFDdHhXRlByb2ZpbGVQYXRo44CwIgIBQ3R4SW5pdGlhbFByb2dyYW3jgLA iAgFD dHhDYWxsYmFja051bWJlcuOAsA== userPrincipalName: apuye(a)corp.van.dwave uSNChanged: 7588047 uSNCreated: 5713011 whenChanged: 20051122170851.0Z whenCreated: 20050902184213.0Z # search result search: 2 result: 0 Success # numResponses: 2 # numEntries: 1 waggawagga raddb # When I run: Server# radtest apuye password localhost 1 testing123 I get: rad_recv: Access-Request packet from host 127.0.0.1:49732, id=181, length=57 User-Name = "apuye" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "apuye", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for apuye radius_xlat: '(sAMAccountName=apuye)' radius_xlat: 'ou=Information Technology,ou=DataWave Users,dc=corp,dc=van,dc=dwave' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to huckster.corp.van.dwave:389, authentication 0 rlm_ldap: bind as cn=apuye,ou=Information Technology,ou=DataWave Users,DC=corp,DC=van,DC=dwave/ to w2kserver.corp.van.dwave:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Information Technology,ou=DataWave Users,dc=corp,dc=van,dc=dwave, with filter (sAMAccountName=apuye) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 My radiusd.conf file looks like this: ldap { server = "w2kserver.corp.van.dwave" # identity = "cn=admin,o=My Org,c=UA" identity = "cn=apuye,ou=Information Technology,ou=DataWave Users,DC=corp,DC=van,DC=dwave" # password = mypass password_attribute = "password" #basedn= "DC=corp,DC=van,DC=dwave" basedn = "ou=Information Technology,ou=DataWave Users,dc=corp,dc=van,dc=dwave" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" #filter = "(SamAccountName=%U)" # base_filter = "(objectclass=radiusprofile)" Any help is greatly appreciated. Does anyone want to share a working ldap section to Active Directory? Thanks in advance Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Proxy radius GTC
by benjo.fr 28 Nov '05

28 Nov '05

Hi, I know proxying for PEAP/EAP-MsChapV2 is ok with FreeRadius. Or, I want to know if proxying for PEAP/EAP-GTC is working too ? Thanks BenjO

2 5

Reid Canavan/FortErie is out of the office
by Reid Canavan 28 Nov '05

28 Nov '05

I will be out of the office starting 11/28/2005 and will not return until 11/30/2005. I will respond to your message when I return.

1 0

How do I strip netbios-style domain name from User-Name?
by Laker Netman 28 Nov '05

28 Nov '05

My FR server is successfully receiving Access-Requests from my wifi AP (XP supplicant) using PEAP/EAP-TLS. However, the received User-Name is formatted "Domain\\User". I have read the docs regarding realms and proxy.conf and believe the following should work: (In radiusd.conf) realm MY-DOMAIN-NAME { format = prefix delimiter = "\\" ignore_default = yes ignore_null = yes } (In proxy.conf) realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } I have also tried "realm MY-DOMAIN-NAME" rather than "DEFAULT" in proxy.conf with no difference. "with_ntdomain_hack" is set to "no" wherever referenced, as it is my understanding using the realms module is the preferred method (?) My ldap filter is: filter = "(sAMAccountName=%u)" and running with "-X" I get the following: rad_recv: Access-Request packet from host 192.168.12.231:2057, id=0, length=156 User-Name = "MY-DOMAIN-NAME\\username" NAS-IP-Address = 192.168.12.231 Called-Station-Id = "000d0b6b9250" Calling-Station-Id = "000e356529b4" NAS-Identifier = "000d0b6b9250" NAS-Port = 56 Framed-MTU = 1400 State = 0x9eafe6f8023c0c59423b42f6c92b96f4 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300061900 Message-Authenticator = 0xc8ce70994f2aba8a00f4ba8561979c20 ... then ... rlm_ldap: - authorize rlm_ldap: performing user authorization for MY-DOMAIN-NAME\\username radius_xlat: '(sAMAccountName=MY-DOMAIN-NAME)' radius_xlat: 'CN=Users,DC=mydomain,DC=branch,DC=corp' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Users,DC=mydomain,DC=branch,DC=corp, with filter (sAMAccountName=MY-DOMAIN-NAME) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed Authenticating via (hard-wired) telnet works as expected and %u contains the username without any domain prefix, of course. A suggestion as to what I may have missed would be appreciated. TIA, Laker __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

1 0