- Freeradius-Users - lists.freeradius.org

Re: AD authentication
by charles schwartz 28 Nov '05

28 Nov '05

Hi, If the wbinfo command does not work, ntlm_auth won't work too. > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO This error indicates that something went wrong with the domain access. Try to troubleshoot by using wbinfo -g or wbinfo -u. With these commands you should be able to list the users and groups of your domain. There may be a problem with NTLM on your Windows2003 server. Note thath NTLM was the authentication protocol used by earlier version of Windows. It is still supported for backward compatibility, but can be disabled. By default, Win2k and 2003 use Kerberos for authentication. You might have a security policy thats restricts the use of NTLM on your network. Check your GPO if NTLM is allowed to be transmitted across the network. Regards, Charles Schwartz > Hi, > > > > I used the document freeRadius_AD_tutorial.pdf for configuring a linux > box to get authenticated through users in Windows 2003 AD. > > > > I used the command net join -U Administrator to add the machine to the > domain. It gave successful results. Now on typing the command > > > > wbinfo -a checkad%Quark_123 > > > > I got the following results:- > > > > plaintext password authentication failed > > error code was NT_STATUS_NO_SUCH_USER (0xc0000064) > > error messsage was: No such user > > Could not authenticate user checkad%Quark_123 with plaintext password > > challenge/response password authentication failed > > error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) > > error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > > Could not authenticate user checkad with challenge/response > > > > Also, on giving the command > > > > # ntlm_auth --request-nt-key --domain=india.quark.com --username= > checkad > > password: > > NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO > (0xc00000da) > > [root@Radius etc]# > > I get the above stated error. Please help. > > Thanks & Regards > > Varun Marwah > > CONFIDENTIALITY NOTICE > > This e-mail transmission and any documents, files, or previous e-mail > messages appended or attached to it, may contain information that is > confidential or legally privileged. If you are not the intended > recipient, or a person responsible for delivering it to the intended > recipient, you are hereby notified that any disclosure, copying, > printing, distribution, or use of the information contained or attached > to this transmission is STRICTLY PROHIBITED. If you have received this > transmission in error, please immediately notify the sender by telephone > (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com > <mailto:vmarwah@quark.com> ) and delete the original transmission, its > attachments, and any copies without reading or saving in any manner. > Thank you. > > >

1 0

SQL Mac-Authentication based on Call-Check
by florian broder 28 Nov '05

28 Nov '05

Hello. I'm currently working on my diploma thesis, and I'm sorting some things out at the moment. The task is, to authenticate mac-adresses through a cisco catalyst 6500. A pretty new feature called "mac-authentication-bypass" is available in CatOS and works well with Cisco ACS 4.0 beta. Due to our demands we want to deploy freeradius, with a mysql database. It works like that. The switch sends an Access-Request with the connecting MAC in the Caller-ID Field and Sevice Type is set to "10", hence "Call Ceck". Radius now authenticates the users on a given MAC (Caller ID) instead of a user/password. I haven't set up freeradius yet, but I'm slighty familar with the settings that have to be done. In table "radcheck" I create attribute "Calling-Station-ID" with value "MAC-Address" (f.e. ff-ee-11-22-33-44), this value will be checked against. I also have to edit the sql.conf (user, database etc) and telling radiusd.conf to use sql in the "authorise" section. I'm sticking to the Freeradius MySQL howto by Scott Bartlett for that. :) The only thing I'm currently unaware of is, where I can tell freeradius to use Call-Check together with mysql, I think it's somewhere in sql.conf? Only thing that need to be done IMO is to tell radius, that there is no username and authentication needs to be done on a caller-id basis. Any thoughts? Thanks in advance. Bye Florian

2 5

freeradius 1.0.2 with openssl 0.9.7
by awal.mohamadou 28 Nov '05

28 Nov '05

no need please i've found a howto resolve my problem of certificates. http://www.freeradius.org/doc/EAPTLS.pdf it seems to be a problem of extension files with XPsupplicants.i'll try and see what is hapenning. Awal. Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34/mn) ; tél : 08 92 68 13 50 (0,34/mn)

1 0

freeradius 1.0.2 with openssl 0.9.7
by awal.mohamadou 28 Nov '05

28 Nov '05

hi everybody! i've got a problem for running my ./CA.pl file to generate certificate with openssl 0.9.7.may someone please give me the openssl command to generate clients and servers certificates? i've googled a lot but didn't find a howto . or give me a link. i have already well configured my openssl.cnf file.then i have to generate certificates. thanks a lot , i'll appreciate. Regards. Awal. Accédez au courrier électronique de La Poste : www.laposte.net ; 3615 LAPOSTENET (0,34/mn) ; tél : 08 92 68 13 50 (0,34/mn)

1 0

AD authentication
by Varun Marwah 28 Nov '05

28 Nov '05

Hi, I used the document freeRadius_AD_tutorial.pdf for configuring a linux box to get authenticated through users in Windows 2003 AD. I used the command net join -U Administrator to add the machine to the domain. It gave successful results. Now on typing the command wbinfo -a checkad%Quark_123 I got the following results:- plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user checkad%Quark_123 with plaintext password challenge/response password authentication failed error code was NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) error messsage was: NT_STATUS_CANT_ACCESS_DOMAIN_INFO Could not authenticate user checkad with challenge/response Also, on giving the command # ntlm_auth --request-nt-key --domain=india.quark.com --username= checkad password: NT_STATUS_CANT_ACCESS_DOMAIN_INFO: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) [root@Radius etc]# I get the above stated error. Please help. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com <mailto:vmarwah@quark.com> ) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you.

1 0

symbol lookup error EAP/PEAP
by Konne 28 Nov '05

28 Nov '05

hi when i start freeradius -X, and i'll connect with SecureW2 client... during the authentication he gives me following error... ... ... auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate and then it gives me the symbol error /usr/local/lib/rlm_eap_peap-1.0.5.so: undefined symbol: eaptls_process i have done configure --disable-share make make install but the same error... what can it be... thx

1 0

(no subject)
by jonniie＠blueyonder.co.uk 28 Nov '05

28 Nov '05

I am completely new to this and i want to know how to set up a basic radius server for WIFI authenitcation. Based on multiple users. Thanks

3 2

regexp with ldap
by Markus Krause 27 Nov '05

27 Nov '05

hi all, i am using freeradius 1.0.5 on sles 9. what i want to achieve: network devices send their mac-address to a switch, which then sends access-request packages to the freeradius. the mac-addresses are stored in an ldap tree using the objectclass "dhcpHost" and the entry "dhcpHWAddress" (which is also used for dhcp). unfortunately the attribute dhcpHWAddress contains entries like "ethernet 00:11:22:33:44:55" and not only the mac address. (how) can i use regexp to get the necessary information from ldap? i read variables.txt but seem to be misunderstanding the concept (sorry, i am not an english native speaker ..). do i have to enter something in the ldap section in 'filter="..."' radiusd.conf? could someone give me some examples? thanks in advance for any hints! best regards, markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 2

Documentation
by Romain GAILLEGUE 26 Nov '05

26 Nov '05

Hi, I'm looking for a simple documentation to authenticate a user on a external command like "/bin/true" (for the beginning ;) If somme can give me a link or some sample configurations files i will be very happy Thanks you Romain

3 2

RE: Freeradius How to integrate Active Directory[ADIntegrationWindowsXP NTLM Tutorial]
by Alhagie Puye 25 Nov '05

25 Nov '05

So, the question again is if the VPN Concentrator is only sending username and password, do I need ntml_auth or ms-chap? FreeRADIUS doesn't have any usernames and password and will query Active Directory for the actual authentication. Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Alhagie Puye > >Sent: November 24, 2005 3:04 PM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active > >Directory[ADIntegrationWindowsXP NTLM Tutorial] > > > > > > > >Alhagie Puye - Network Engineer > >Datawave Group of Companies > >(604)295-1817 > > > >> >-----Original Message----- > >> >From: freeradius-users-bounces(a)lists.freeradius.org > >> >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of > >> >Alan DeKok > >> >Sent: November 24, 2005 2:36 PM > >> >To: FreeRadius users mailing list > >> >Subject: Re: Freeradius How to integrate Active Directory > >> >[ADIntegrationWindowsXP NTLM Tutorial] > >> > > >> >"Alhagie Puye" <APuye(a)datawave.com> wrote: > >> >> SSL-VPN client -> Cisco VPN Concentrator -> FreeRadius -> > >> >W2K Active > >> >> Directory > >> > > >> > What is in the RADIUS packet from the VPN concentrator? EAP? > >> >User-Password? You need to know this. > >Username and Password > >> > > >> >> I think I should be using ntlm_auth. Or should I be > >using the LDAP > >> >> module? > >> > > >> > It depends on what's in the RADIUS packet. > >> > > >> > Alan DeKok. > >> > > >> >- > >> >List info/subscribe/unsubscribe? See > >> >http://www.freeradius.org/list/users.html > >> > > > > > > >Disclaimer: This message (including any attachments) is > >confidential, may be privileged and is only intended for the > >person to whom it is addressed. If you have received it by > >mistake please notify the sender by return e-mail and delete > >this message from your system. Any unauthorized use or > >dissemination of this message in whole or in part is > >strictly prohibited. E-mail communications are inherently > >vulnerable to interception by unauthorized parties and are > >susceptible to change. We will use alternate communication > >means upon request. > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

2 1