- Freeradius-Users - lists.freeradius.org

Postgres and unix sockets
by Miguel 21 Nov '05

21 Nov '05

Hi, how can i configure freeradius to use unix sockets instead of tcp when using postgres for backend? thanks

1 0

RE: wireless+freeradius+AD
by King, Michael 21 Nov '05

21 Nov '05

> Oh, excellent. I just joined this list hoping to query the > members on finding more information on doing > wireless+activedirectory+freeradius, > unfortunately I could not find any good postings, or web > toots/examples. Hi Robin, Welcome to the club. > I would need to use Microsoft IAS. Is this false ? Yes, That particular example used Microsoft IAS, but it is not required. > Are people > using Active Directory successfully ? Yes. Besides myself, there are many people on this list that are. > I have a linux box that > is currently acting as a tacacs server while authenticating > using winbind etc, and was hoping to make it a radius server as well. You are already 3/4 of the way there, since the trickest part of my freeradius setup was getting winbind to talk to activedirectory Depending on your Linux distribution, you will just have to install freeradius. (Some distributions like Debian require a -disable-shared) Go thru the radiusd.conf and the eap.conf files, it's clearly commented on what you need to configure. You'll see a section marked: ntlm_auth = "/path/to/ntlm_auth ........(Trimmed) You might need to modify this to: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Don't hesitate to ask questions. There is a good Howto (unfortuantly, I don't have my bookmarks with me) but some others on the list hopefully will post it.

2 1

Re: 802.1x machine authentication patch help
by Jamie Crawford 21 Nov '05

21 Nov '05

I found my problem. From Andrew Bartlett himself "This is not supported against NT4. Only Samba 3.0.21rc1 and AD support this extra flag." To do machine authentication with freeradius, your workstation (supplicant) and samba server must be a member of a 2000/2003 domain. I had the supplicant and samba server still a member of the nt4 domain. Once I changed this, it worked great. Were still in the middle of a migration from nt4 to 2003 and all accounts still authenticate fine. Thanks for everyones help!!!!!! jamie >>> mgriego(a)utdallas.edu 11/18/2005 12:16:43 PM >>> Make sure you used the rlm_MSchap module from the snapshot, not the rlm_chap module. They're different. --Mike Jamie Crawford wrote: > Hi, > I am trying to get machine authentication working with freeradius. I > have patched the samba code and freeradius code. But am getting this > error when the machine tries to authenticate. I patched the rlm_chap > module by taking last nights cvs snapshot and copying over the rlm_chap > folder overwriting the contents of the same folder in the > freeradius-1.0.5 release and recompiling. I see that it is trying to > pass the username as "host/IS--000031176". I thought the updated > rlm_mschap was suppposed to strip the "host/" part of the username. Do > I need to create a realm to strip the "host/"? > Any help would be appreciated!!! > Thanks, > jamie > > > make clean > > ./configure --configure --with-raddbdir=/etc/radius > --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql > --without-rlm_ldap --without-rlm_krb5 > > make > > make install > > modcall: entering group Auth-Type for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with > NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'User-Name' > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: d3 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=12345ce0768615e > --nt-response=123456f1011a2f799b5d62e04ba > d8bb39719fa48c3d11299e' > Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=123453ce0768615e > --nt-response=12345f1011a2f799b5d62e04bad8bb39719fa48c3d11299e > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius - LDAP - Active Directory
by Konne 21 Nov '05

21 Nov '05

hi at all my system: Debian Sarge 3.1 Kernel 2.6.8 i installed the following software with apt-get apache-ssl 1.3.34-1 php4 php4-mysql mysql 4.1.14 openssl 0.9.8a-3 openldap stable 2.3.11 2005-10-18 [compiled] freeradius 1.0.5-2 freeradius-ldap 1.0.5-2 freeradius-mysql 1.0.5-2 freeradius-krb5 1.0.5-2 ---------------------------- i have a lot of problems with freeradius... i would like to authenticate my users from AP via AD. only the user which is member of a specific group should become access. *my ldap.conf* deref never referrals no i tried to authenticate but i become following error: rad_recv: Access-Request packet from host 192.168.184.26:22381, id=13, length=57 User-Name = "wuser" User-Password = "wuser" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "my.dom" for User-Name = "wuser" rlm_realm: No such realm "my.dom" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=my,dc=dom' radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to myserver.my.dom:389, authentication 0 rlm_ldap: bind as cn=ldapuser,cn=Users,dc=my,dc=dom/ldapuser to myserver.my.dom:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: ldap_search() failed: Operations error rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for wuser radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' radius_xlat: 'dc=my,dc=dom' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to myserver.my.dom:389, authentication 0 rlm_ldap: bind as cn=ldapuser,cn=Users,dc=my,dc=dom/ldapuser to myserver.my.dom:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 13 with timestamp 4381a433 Nothing to do. Sleeping until we see a request. -------------------- *users* DEFAULT Auth-Type = System Fall-Through = 1, Reply-Message = "System Logon" DEFAULT Ldap-Group == "wireless", Auth-Type :=LDAP Fall-Through = Yes, Reply-Message = "LDAP Logon" DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes -------------------- *radiusd.conf* prefix = /usr exec_prefix = /usr sysconfdir = /etc domstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${domstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius user = freerad group = freerad max_requests = 1024 hostname_lookups = no # Core dumps are a bad thing. This should only be set to 'yes' # if you're debugging a problem with the server. # # allowed values: {no, yes} # allow_core_dumps = no log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf modules { pap { encryption_scheme = md5 } chap { authtype = CHAP } unix { cache = no cache_reload = 600 passwd = /etc/passwd # shadow = /etc/shadow # group = /etc/group radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "myserver.my.dom" identity = "cn=ldapuser,cn=Users,dc=my,dc=dom" password = ldapuser basedn = "dc=my,dc=dom" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" filter = "(&(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})(objectClass=person))" start_tls = no #access_attr = "dialupAccess" access_attr = "memberOf" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{Stripped-User-Name:-%{User-Name}} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } authorize { preprocess chap mschap suffix eap files # sql ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp # sql } session { radutmp # sql } post-auth { ldap } pre-proxy { } post-proxy { eap } i would like to connect to my AD from remote w2k3 server. but i receive only following:

1 1

Free RADIUS and ldap config
by Varun Marwah 20 Nov '05

20 Nov '05

Hi, Can anyone help me in providing a documentation as to how to configure freeradius server to fetch user access details from a specific group in lpad server on windows 2003. Also let me know the config details from ldap setting on the radius server. I was able to configure Freeradius config with PEAP. Regards Varun Marwah

1 0

Re: 802.1x machine authentication patch help
by Jamie Crawford 19 Nov '05

19 Nov '05

Hi, I finally got freeradius to strip the host/ and append the $ to the host name, but it still wont validate the workstation. I get "No logon workstation trust account (0xc0000199)" At least now it's narrowed down to the ntlm_auth command. I tried to run the command manually with different workstation accounts, and got the same error. I know I've modified the code correctly by changing: init_id_info2(&ctr.auth.id2, domain, 0x800, /* param_ctrl */ 0xdead, 0xbeef, /* LUID? */ Any suggestions??? Thanks, jamie Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/radius/proxy.conf Config: including file: /etc/radius/clients.conf Config: including file: /etc/radius/snmp.conf Config: including file: /etc/radius/eap.conf Config: including file: /etc/radius/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256000 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth -d 10 --domain=central --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/radius/certs/cert-srv.pem" tls: certificate_file = "/etc/radius/certs/cert-srv.pem" tls: CA_file = "/etc/radius/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/radius/certs/dh" tls: random_file = "/etc/radius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/radius/huntgroups" preprocess: hints = "/etc/radius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/radius/users" files: acctusersfile = "/etc/radius/acct_users" files: preproxy_usersfile = "/etc/radius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 153.91.130.103:1958, id=225, length=149 NAS-IP-Address = 153.91.130.103 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "host/IS--000031176" Calling-Station-Id = "0013ce3ee800" Called-Station-Id = "00118806ad10" NAS-Identifier = "RoamAbout AP" EAP-Message = 0x0201001701686f73742f49532d2d303030303331313736 Message-Authenticator = 0xc8cf79cf435f7182a1d879819491bc89 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/IS--000031176", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "host/IS--000031176", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 59 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 225 to 153.91.130.103:1958 Filter-Id = "enterasys:version=1:policy=faculty_staff" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd7e3797fb8ffa169b236146b069f57b0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 153.91.130.103:1959, id=226, length=224 NAS-IP-Address = 153.91.130.103 NAS-Port-

1 0

Proposed patch for auth.c
by Alain cocconi 19 Nov '05

19 Nov '05

Hello, I've mad a small patch to the rad_authlog function in auth.c The purpose of this patch is to make a pair with the auth log message in it (Auth: login Ok ....). For this I use the Reply-Message attribute. What do you think, is it safe to use this one ? Or should I define a new one ? Thank you Here is the new function : /* * Make sure user/pass are clean * and then log them */ static int rad_authlog(const char *msg, REQUEST *request, int goodpass) { char clean_password[1024]; char clean_username[1024]; char buf[1024]; char msg_log[1024]; VALUE_PAIR *username = NULL; VALUE_PAIR *log_pair; if (!mainconfig.log_auth) { return 0; } /* * Get the correct username based on the configured value */ if (log_stripped_names == 0) { username = pairfind(request->packet->vps, PW_USER_NAME); } else { username = request->username; } /* * Clean up the username */ if (username == NULL) { strcpy(clean_username, "<no User-Name attribute>"); } else { librad_safeprint((char *)username->strvalue, username->length, clean_username, sizeof(clean_username)); } /* * Clean up the password */ if (mainconfig.log_auth_badpass || mainconfig.log_auth_goodpass) { if (!request->password) { strcpy(clean_password, "<no User-Password attribute>"); } else if (request->password->attribute == PW_CHAP_PASSWORD) { strcpy(clean_password, "<CHAP-Password>"); } else { librad_safeprint((char *)request->password->strvalue, request->password->length, clean_password, sizeof(clean_password)); } } if (goodpass) { sprintf(msg_log, "%s: [%s%s%s] (%s)", msg, clean_username, mainconfig.log_auth_goodpass ? "/" : "", mainconfig.log_auth_goodpass ? clean_password : "", auth_name(buf, sizeof(buf), request, 1)); } else { sprintf(msg_log, "%s: [%s%s%s] (%s)", msg, clean_username, mainconfig.log_auth_badpass ? "/" : "", mainconfig.log_auth_badpass ? clean_password : "", auth_name(buf, sizeof(buf), request, 1)); } radlog(L_AUTH, msg_log); log_pair = paircreate(PW_REPLY_MESSAGE, PW_TYPE_STRING); if (log_pair == NULL) { radlog(L_ERR|L_CONS, "no memory"); exit(1); } sprintf((char *)log_pair->strvalue, "%s", msg_log); log_pair->length = strlen((char *)log_pair->strvalue); pairadd(&request->reply->vps, log_pair); return 0; }

2 2

Re: 802.1x machine authentication patch help
by Jamie Crawford 18 Nov '05

18 Nov '05

Sorry for the typo, I meant to type rlm_mschap. Are there only certain files out of the /src/modules/rlm_mschap cvs snapshot that I need to copy over? Thanks, jamie >>> mgriego(a)utdallas.edu 11/18/2005 12:16:43 PM >>> Make sure you used the rlm_MSchap module from the snapshot, not the rlm_chap module. They're different. --Mike Jamie Crawford wrote: > Hi, > I am trying to get machine authentication working with freeradius. I > have patched the samba code and freeradius code. But am getting this > error when the machine tries to authenticate. I patched the rlm_chap > module by taking last nights cvs snapshot and copying over the rlm_chap > folder overwriting the contents of the same folder in the > freeradius-1.0.5 release and recompiling. I see that it is trying to > pass the username as "host/IS--000031176". I thought the updated > rlm_mschap was suppposed to strip the "host/" part of the username. Do > I need to create a realm to strip the "host/"? > Any help would be appreciated!!! > Thanks, > jamie > > > make clean > > ./configure --configure --with-raddbdir=/etc/radius > --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql > --without-rlm_ldap --without-rlm_krb5 > > make > > make install > > modcall: entering group Auth-Type for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with > NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'User-Name' > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: d3 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=ba9273ce0768615e > --nt-response=fd385f1011a2f799b5d62e04ba > d8bb39719fa48c3d11299e' > Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=ba9273ce0768615e > --nt-response=fd385f1011a2f799b5d62e04bad8bb39719fa48c3d11299e > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

802.1x machine authentication patch help
by Jamie Crawford 18 Nov '05

18 Nov '05

Hi, I am trying to get machine authentication working with freeradius. I have patched the samba code and freeradius code. But am getting this error when the machine tries to authenticate. I patched the rlm_chap module by taking last nights cvs snapshot and copying over the rlm_chap folder overwriting the contents of the same folder in the freeradius-1.0.5 release and recompiling. I see that it is trying to pass the username as "host/IS--000031176". I thought the updated rlm_mschap was suppposed to strip the "host/" part of the username. Do I need to create a realm to strip the "host/"? Any help would be appreciated!!! Thanks, jamie make clean ./configure --configure --with-raddbdir=/etc/radius --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql --without-rlm_ldap --without-rlm_krb5 make make install modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d3 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key --username=host/IS--000031176 --challenge=ba9273ce0768615e --nt-response=fd385f1011a2f799b5d62e04ba d8bb39719fa48c3d11299e' Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key --username=host/IS--000031176 --challenge=ba9273ce0768615e --nt-response=fd385f1011a2f799b5d62e04bad8bb39719fa48c3d11299e Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed.

2 1

pam radius integration with http server
by nagaraj 18 Nov '05

18 Nov '05

hi, I have successfully integrated PAM radius client http boa server to facilitate remote authentication. However I am facing few issues. If the number of re-tries is configured to 2 and timeout value is set to 3, it takes 24 secs to timeout when radius server is not available. Http client is making 4 connections and hence it takes 24 secs(2*3*4) to timeout. In the event of server not being reachable, http server should default to local authentication that happens only after 24 secs which is not acceptable. Is there any way I can fine tune this? Has any body dealt with this kind of issue? Please reply. Thanks, Nagaraj

2 1