- Freeradius-Users - lists.freeradius.org

FreeRadius using two SQL servers
by Fernando Brito 14 Nov '05

14 Nov '05

Hi, my version of FreeRadius is 1.0.5 and what I'm trying to do is that when a radius client ask my freeradius, if the Realm is "xxxx" I want to autorize him with the first SQL server and if the Realm is "yyyy" with the second one. I already have two diferent sql configuration files, sql1.conf and sql2.conf, with instance name SQL1 and SQL2. I had been trying to do exactly what the Autz-Type Doc says, but I had no luck with it. I don't know what to do... Thanks NanO

3 3

Problem with rlm_mschap from CVS
by Luca Corti 14 Nov '05

14 Nov '05

Hello, I'm using Freeradius from CVS (checked out today) to do WPA-EAP+Radius +PEAP+ntlm_auth because I can't get rlm_eap_peap from 1.0.5 to build on debian. When trying to authenticate everything seems to be fine, but fails when executing ntlm_auth. Here's the debugging log. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN \user" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Proxying request from user user to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 71 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for user with NT-Password freeradius: symbol lookup error: /usr/lib/freeradius/rlm_mschap-1.1.0-pre0.so: undefined symbol: radius_exec_program Is this a configuration issue or a bug? thanks -- Luca Corti PGP Key ID 1F38C091 BOFH excuse of the moment: We are Microsoft. What you are experiencing is not a problem; it is an undocumented feature.

4 9

Re: Freeradius-Users Digest, Vol 7, Issue 48
by Devel 14 Nov '05

14 Nov '05

Le lun 14/11/2005 à 12:13, freeradius-users-request(a)lists.freeradius.org a écrit : > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > ______________________________________________________________________ > > Today's Topics: > > 1. RE: Freeradius vs. ActiveDirectory (Jonathan De Graeve) > 2. Re: Freeradius vs. ActiveDirectory (A.L.M.Buxey(a)lboro.ac.uk) > 3. AW: Freeradius vs. ActiveDirectory (V?lker) > 4. RE: Failed attempts log (Thierry Hoferlin) > 5. AW: Freeradius vs. ActiveDirectory (V?lker) > > > ______________________________________________________________________ > From: Jonathan De Graeve <Jonathan.De.Graeve(a)imelda.be> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 11:36:45 +0100 > > > > What about the password? > > > > I thought this was a kerberos one and didn’t reside into the ldap > itself? > > > > -- > Jonathan De Graeve > Network/System Administrator > Imelda vzw > Informatica Dienst > 015/50.52.98 > jonathan.de.graeve(a)imelda.be > > --------- > Always read the manual for the correct way to do things because the > number of incorrect ways to do things is almost infinite > --------- > > > > ______________________________________________________________________ > > Van:freeradius-users-bounces@lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Völker, > Christian > Verzonden: maandag 14 november 2005 11:22 > Aan: freeradius-users(a)lists.freeradius.org > Onderwerp: Freeradius vs. ActiveDirectory > > > > > Yohoo! > > > > > > Yes! I did it! ;) > > > > > > My freeradius (1.0.1-1.RHEL3) authenticates again our ActiveDirectory > (on 2003 Server). Without ntlm_auth! > > > Below I have added a short summary how I realized it here. > > > > > > But now I have a question and I can't solve it for myself. I want to > retreive some group informations from AD. In an users account I find > several values "memberOf" and the DN of the group, where the user > belong to. > > > Now I want to give access via freeradius only to some special groups. > > > > > > I have figuered out, that there are these parameters: > > > groupname_attribute, groupmembership_filter and > groupmembership_attribute > > > combined with some entries in the users-file. > > > > > > I've read the doc/rlm_ldap, but I didn't find any deeper hints or > explanation. > > > Questions: > > > 1. Where can I find some docs about the %{...} Values in > groupmebership_filter? Which one should I use in combination with my > AD? > > > 2. Which value should I use then in the users-file? > > > 3. Is there anyone who can give a little help in further > authenticating with group? > > > > > > -------------short summary how to authenticate vs. ActiveDirectory > ----------------------- > > > /etc/raddb/radiusd.conf > > > [...] > > > ldap { > #servername with an AD-Server running Win2003Srv > > > server = "adsrv.qsc.de" > > > #The Useraccount for querying AD (anonymous query is > disabled) > identity = "cn=man,ou=ServiceAdmins,dc=qsc,dc=de" > > > #The password for the Query-User > password = 'xxxxxx' > > > #base DN for user search; all our Users are in > ou=employees. Without this "ou=...", no user will be found. \ > > > #I don't understand why > basedn = "ou=employees,dc=qsc,dc=de" > > > # I've copied the below string, because I didn't > understand the meanings of the %{...} > filter = > "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" > # I had to increase the timeouts > > > timeout = 40 > timelimit = 30 > net_timeout = 10 > > > > > > } > > > The users-file left on default, no changes. > > > > > > I hope, I could help some people trying to use AD for radius. > > > > > > And, I hope, someone will help me with my user-problem. > > > > > > > > > Greets > > > > > > Christian > > > > > > > > > > > > > > > > > > > ______________________________________________________________________ > > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 10:42:07 +0000 > > Hi, > > > I hope, I could help some people trying to use AD for radius. > > there is another way - use the krb module to authenticate against AD > > alan > > > > ______________________________________________________________________ > > From: "Völker, Christian" <Christian.Voelker(a)qsc.de> > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: AW: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 11:50:10 +0100 > > Yohoo! > > > > What about the password? > Which password? The User-Password? Or the shared secret? > The Password for the Proxy-User is written down in the radiusd.conf. > > > > I thought this was a kerberos one and didn't reside into the ldap itself? > Kerberos ist installed, but I don't use it (I think so! ;-)) > > Greets > Christian > > > > > > > ______________________________________________________________________ > > From: Thierry Hoferlin <thierry.hoferlin(a)staff.cybernet.be> > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: RE: Failed attempts log > Date: Mon, 14 Nov 2005 11:50:39 +0100 > > > Thanks Nicolas, > > It works fine. > > Just for info, the attributes to use in the mssql.conf file are > "postauth_table" and "postauth_query" > With the following radius configuration : > > post-auth { > > Post-Auth-Type REJECT { > sql > } > } > > > Regards, > > Thierry. > > > > > >Thierry Hoferlin wrote: > > > >> I've configured a freeradius 1.0.5 with MSSQL authentification. > >> It works fine. > >> > >> Is there a way to log failed authentification records to SQL ? > > > >Please don't post HTML on the list. > > > >Search the archives for detailed instructions, but the general idea is > to use the module "sql" in section "post-auth". > > > >http://freeradius.org/radiusd/doc/Post-Auth-Type > > > >-- > >Nicolas Baradakis > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > ______________________________________________________________________ > > From: "Völker, Christian" <Christian.Voelker(a)qsc.de> > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: AW: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 11:51:26 +0100 > > Yohoo! > > > >> I hope, I could help some people trying to use AD for radius. > >there is another way - use the krb module to authenticate against AD > > Are there any advantages/ disadvantages ldap <-> krb5? > > > > > > > ______________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Hello. I made a Freeradius 1.04 working configuration to authenticate users using krb5. It works without any problem and If you look to Microsoft Documentation, you will see that it recommands using krb5 for Alien(Unix...)/Microsoft cross authentication. When using Ldap you must "translate" standards attributes into microsoft ones without many warranties that it will keep working on the next patch.I know microsoft wants to make its AD more compatible to standards but for the moment I still wait and see. In the other hand, LDAP is a much more powerful protocol that do not only deal with authentication while kerberos 's only goal is authentication. Maybe powerful users may use LDAP powerfullness through Radius. I do not and I'm not able to help you in that way. If someone is interrested in using Radius<->krb5<->AD, I may (I have a very poor english and I'm not a radius "hacker") help him. Just post at this mailing list that you are interested in it and I will answer as soon as I can. Bye. Stephane

1 0

RE: Can mysql and mssql being used at the same time?
by Andres Pazos 14 Nov '05

14 Nov '05

great!. can u tell me how (if yes, please tell me how)?. i need to know where to start. thanks!. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Alan DeKok Sent: Mon 11/14/2005 3:10 PM To: FreeRadius users mailing list Subject: Re: Can mysql and mssql being used at the same time? "Andres Pazos" <andy(a)ferengi.com.ar> wrote: > Is it possible to have user@realm1 authenticated against MSsql and user@realm2 authenticated against MySql? Yes. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

PEAP Machine Authentication
by Jérémy Cluzel 14 Nov '05

14 Nov '05

Hi, I'm trying to set a PEAP Authentication with the rlm_mschap.c / cli_netlogon.c hacks provided by M. Griego. The user auth still working (as before), but the computer still not... (a copy of the debug log. is in attachement) According to the log, the rlm_mschap seems to be effective, but is there any way to check that the samba patch is effective too ? I use a "patched" FR 1.0.5 and a "patched" samba-3.0.20b,1 under FreeBSD 5.3-RELEASE Regards, Jeremy Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain:-DEFAULTDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Initializing the thread pool... thread: start_servers = 5 thread: max_servers = 32 thread: min_spare_servers = 3 thread: max_spare_servers = 10 thread: max_requests_per_server = 0 thread: cleanup_delay = 5 Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread spawned new child 4. Total threads in pool: 4 Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=78, length=183 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0x63444a5a8824a6668f0c4039b3fa9564 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020900261900170301001bbd4f0d6e5bb61569a12d5f373e1a1b958fda7a867f0e888ecf9134 Message-Authenticator = 0x56fb29e69b4914d39ba20bf387f680a8 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=80, length=148 --- Walking the entire request list --- Sending Access-Reject of id 78 to 192.168.0.241:6001 Waking up in 3 seconds... Thread 2 got semaphore Thread 2 handling request 1, (1 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202001501686f73742f6a632d706f727461626c65 Message-Authenticator = 0xdcb1aa29004ed8c0024d87e5ae730392 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 rlm_eap: EAP packet type response id 2 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 80 to 192.168.0.241:6001 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb1370512c2134397d46167c90c436dfc Finished request 1 Going to the next request Thread 2 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=82, length=148 Waking up in 3 seconds... Thread 3 got semaphore Thread 3 handling request 2, (1 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204001501686f73742f6a632d706f727461626c65 Message-Authenticator = 0x86b9014b85796c9dad0ee194a308342f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_eap: EAP packet type response id 4 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall: group authorize returns updated for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 2 modcall: group authenticate returns handled for request 2 Sending Access-Challenge of id 82 to 192.168.0.241:6001 EAP-Message = 0x010500061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb2415a16262a21ddc793ddd7df3e6b56 Finished request 2 Going to the next request Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=83, length=225 Waking up in 3 seconds... Thread 4 got semaphore Thread 4 handling request 3, (1 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0xb2415a16262a21ddc793ddd7df3e6b56 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0205005019800000004616030100410100003d03014378cfdf419830adfee6d61196470d31ef4e27c9898752991ac8d739c98c90dd00001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x7e1132c1cf086ce6fd6699bd8d559d4a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 rlm_eap: EAP packet type response id 5 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0673], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 83 to 192.168.0.241:6001 EAP-Message = 0x0106040a19c0000006d0160301004a0200004603014378cdc09fd9d6bf139a736e9f28b1ee378a37c033684e5329bfccace641f47720633e88e73cf68f278ff6b4036ba430bb6646bcead57546ca1c7d1320bd6c4a4200040016030106730b00066f00066c0002bd308202b930820222a003020102020900be3106f507d71918300d06092a864886f70d0101040500308194310b3009060355040613024652310e300c060355040814055268f46e65310d300b060355040713044c796f6e3111300f060355040a13086169726d6564697331133011060355040b130a42656c6c652d49736c6531193017060355040313106169726d6564697320526f6f EAP-Message = 0x742043413123302106092a864886f70d01090116146a636c757a656c406169726d656469732e636f6d301e170d3035313032303132313831315a170d3135313031393132313831315a30818e310b3009060355040613024652310e300c060355040814055268f46e65310d300b060355040713044c796f6e3111300f060355040a13086169726d6564697331133011060355040b130a42656c6c652d49736c65311330110603550403130a62656c6c652d69736c653123302106092a864886f70d01090116146a636c757a656c406169726d656469732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100e96c634b36c0 EAP-Message = 0xb0321b71e7442429893b4f9fe4fbd898bb02b4b835e08d2817a1034b660fdc78b2791378a0a1f9fa02b2bed298ad533d42d1b3126d78d4dcd5a6d107d47f0bc22aef392058f031bac8b4edb37c39e69a015265dd1455ce837daab1ab7cc81de8e02326445f4acf588d96cb84645e6189a2a94011527c757dbc450203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181006c3f5d76916ad642dcca36faf2738ffcad7677dc7966034adfcacaf4c4a44b9dc3bb784e290a02cc4c053fcedc1c2cf4f52f47ea0b033c6b31707538ad26173050d708ca7e0f04702307a5940d5169115c54 EAP-Message = 0x3de460d50b5cc424668ce8fbad1264b18579ae6c6903747d260e42d4e377f936df8b6a3c89e24e21d26bbb0e53520003a9308203a53082030ea003020102020900be3106f507d71917300d06092a864886f70d0101040500308194310b3009060355040613024652310e300c060355040814055268f46e65310d300b060355040713044c796f6e3111300f060355040a13086169726d6564697331133011060355040b130a42656c6c652d49736c6531193017060355040313106169726d6564697320526f6f742043413123302106092a864886f70d01090116146a636c757a656c406169726d656469732e636f6d301e170d30353130323031323138 EAP-Message = 0x31305a170d3135313031393132313831305a30819431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x727295dacda7c4f03237c3e2890645bb Finished request 3 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=84, length=151 Waking up in 3 seconds... Thread 5 got semaphore Thread 5 handling request 4, (1 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0x727295dacda7c4f03237c3e2890645bb Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 Message-Authenticator = 0x59143a9a0ec6bad4aa8fc684fc8d07d4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 rlm_eap: EAP packet type response id 6 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 84 to 192.168.0.241:6001 EAP-Message = 0x010702d619000b3009060355040613024652310e300c060355040814055268f46e65310d300b060355040713044c796f6e3111300f060355040a13086169726d6564697331133011060355040b130a42656c6c652d49736c6531193017060355040313106169726d6564697320526f6f742043413123302106092a864886f70d01090116146a636c757a656c406169726d656469732e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100de286538dbd149fea2e50c3e5c30c15653cac0230d8355c5b28b44860ff55e2e7619d5d5e993962f4e4ee86e9e372596fe8b14e8c8d1e2b07b3859f727b5e9a04f54b61d2f4491 EAP-Message = 0x9397aecca6b0f3499b45e9bd59df7a8ca2c701b8abd4d0363df7d26e4d957d8119dfaff924400da8e6cc71c983523fae2305fb923d48c927d70203010001a381fc3081f9301d0603551d0e0416041422306b5a55f8204218e5cfdcb6be96997eb143a93081c90603551d230481c13081be801422306b5a55f8204218e5cfdcb6be96997eb143a9a1819aa48197308194310b3009060355040613024652310e300c060355040814055268f46e65310d300b060355040713044c796f6e3111300f060355040a13086169726d6564697331133011060355040b130a42656c6c652d49736c6531193017060355040313106169726d6564697320526f6f7420 EAP-Message = 0x43413123302106092a864886f70d01090116146a636c757a656c406169726d656469732e636f6d820900be3106f507d71917300c0603551d13040530030101ff300d06092a864886f70d010104050003818100764f77d21ba3622c6b4dbf8f8ae3811fa3ca529c9296af0864fead9056512831a52a5d2a433c972c160a1fec8e697afccb3fb0f1a97cc7f66be6a00fd49623c3223c02b43130fdeb8e2cf17a33d7b543ad539993a815ea3306c833e2e2ebb3daae5b7d86a83861e836557fadfe54330b5e5e0ac9ea7c010c4ef63d96eca402ba16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe6854d631d98ad8078f595437b699ed5 Finished request 4 Going to the next request Thread 5 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=85, length=337 Waking up in 3 seconds... Thread 1 got semaphore Thread 1 handling request 5, (2 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0xe6854d631d98ad8078f595437b699ed5 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020700c01980000000b616030100861000008200801457e62cff8615490eed4e0665ffb7133c3a2ae72fef6eb6a9d041a692979ec242b93f3fea9f7582479097249260c4c0000e297afeb2aff0cb764e5199ab788354cd8fb9e283eb4b769f8e866c65de9e324401b69024c1621c078ec2733981ad6f3d50d2aa89d4bc1becb7ef481416e0f43279020a2984b36f69e7635d1172bf1403010001011603010020e09b95b93a29e33826fd6e9525dae4b614ae1c03724484b97299e4ac0f57f9bf Message-Authenticator = 0x91f11375ef42bb822e45e6165f37ac0e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 rlm_eap: EAP packet type response id 7 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 5 modcall: group authenticate returns handled for request 5 Sending Access-Challenge of id 85 to 192.168.0.241:6001 EAP-Message = 0x01080031190014030100010116030100209fc7116835f0ad29133a81d3d568b3aba897607858bba130f077538ea9dac86a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd5cba207907eb608a7ee5fcf484e8efd Finished request 5 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=86, length=151 Waking up in 3 seconds... Thread 2 got semaphore Thread 2 handling request 6, (2 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0xd5cba207907eb608a7ee5fcf484e8efd Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020800061900 Message-Authenticator = 0x0c15a09ec13c9eb95faab11fcc7af68e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 rlm_eap: EAP packet type response id 8 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 86 to 192.168.0.241:6001 EAP-Message = 0x01090020190017030100152a5280ecf8347a21ee80a3b9676dfb0eb75e798bce Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4202ad4ac8fcc2cd7198fc3716666451 Finished request 6 Going to the next request Thread 2 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=87, length=189 Waking up in 3 seconds... Thread 3 got semaphore Thread 3 handling request 7, (2 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0x4202ad4ac8fcc2cd7198fc3716666451 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0209002c190017030100215a4e16cf9683342f73c4850aa16470f58f918fad8b21ca3946157af835e1d7034a Message-Authenticator = 0x0eb5e8e55449b200cdd28e2a11c52a3a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 9 length 44 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - host/portable rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x0209001501686f73742f6a632d706f727461626c65 PEAP: Got tunneled identity of host/portable PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to host/portable PEAP: Sending tunneled request EAP-Message = 0x0209001501686f73742f6a632d706f727461626c65 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/portable" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 rlm_eap: EAP packet type response id 9 length 21 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 PEAP: Got tunneled reply RADIUS code 11 EAP-Message = 0x010a002a1a010a002510bf42800e91ddf6bfe5155eb643e8bf54686f73742f6a632d706f727461626c65 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd41587fcd15cf9a726e2e859d35310f1 PEAP: Processing from tunneled session code 0x81951c0 11 EAP-Message = 0x010a002a1a010a002510bf42800e91ddf6bfe5155eb643e8bf54686f73742f6a632d706f727461626c65 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd41587fcd15cf9a726e2e859d35310f1 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 7 modcall: group authenticate returns handled for request 7 Sending Access-Challenge of id 87 to 192.168.0.241:6001 EAP-Message = 0x010a00411900170301003676b1c5b2f7bab5bab11766300da96cccfa4d23076b6812ed6e0eb9938df2274a70569cca9911185283330ae5569bfea386e8cf914978 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7947de392fecc9fcd50a38604fcbefe9 Finished request 7 Going to the next request Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=88, length=243 Waking up in 3 seconds... Thread 4 got semaphore Thread 4 handling request 8, (2 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0x7947de392fecc9fcd50a38604fcbefe9 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a0062190017030100571584c7104c035d46872460ac212f4a12a31bd3d29fef43aabdc520f419e98d318932baa71b0ae64ac3e134c01ab2f3fd096f8bbe0becb6f60e778b093391a5fb1b50f9393b59f37731e3da9f3579d40d9f7ba36fe64f0b Message-Authenticator = 0x19bb8e5ba237a8e9605a55b66b80de62 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 rlm_eap: EAP packet type response id 10 length 98 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020a004b1a020a00463100f954a333e2d02d0ba5ac5e7b2929ec000000000000000015b13ebd33dcf6d1b4c4c22cdf1b2eb9e1db8821c003b26400686f73742f6a632d706f727461626c65 PEAP: Setting User-Name to host/portable PEAP: Adding old state with d4 15 PEAP: Sending tunneled request EAP-Message = 0x020a004b1a020a00463100f954a333e2d02d0ba5ac5e7b2929ec000000000000000015b13ebd33dcf6d1b4c4c22cdf1b2eb9e1db8821c003b26400686f73742f6a632d706f727461626c65 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "host/portable" State = 0xd41587fcd15cf9a726e2e859d35310f1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 rlm_eap: EAP packet type response id 10 length 75 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 modcall: group authorize returns updated for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 8 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/portable with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' rlm_mschap: setting NT-Domain to same as machine name radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: bf radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/local/bin/ntlm_auth --request-nt-key --username=portable$ --domain=portable --challenge=df40e8392de543b7 --nt-response=15b13ebd33dcf6d1b4c4c22cdf1b2eb9e1db8821c003b264' Exec-Program: /usr/local/bin/ntlm_auth --request-nt-key --username=portable$ --domain=portable --challenge=df40e8392de543b7 --nt-response=15b13ebd33dcf6d1b4c4c22cdf1b2eb9e1db8821c003b264 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 8 modcall: group Auth-Type returns reject for request 8 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 8 modcall: group authenticate returns reject for request 8 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x8195280 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 8 modcall: group authenticate returns handled for request 8 Sending Access-Challenge of id 88 to 192.168.0.241:6001 EAP-Message = 0x010b00261900170301001bf03c106f745ae7e8df43eebd86e1be9651f19be2cad5ec89778e98 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3acf7124cf49bb8a96cb38a5b1cbf543 Finished request 8 Going to the next request Thread 4 waiting to be assigned a request rad_recv: Access-Request packet from host 192.168.0.241:6001, id=89, length=183 Waking up in 3 seconds... Thread 5 got semaphore Thread 5 handling request 9, (2 handled so far) User-Name = "host/portable" NAS-IP-Address = 192.168.0.241 Called-Station-Id = "00-20-a6-56-73-76:TEST" Calling-Station-Id = "00-20-a6-57-83-f2" NAS-Identifier = "AP01" State = 0x3acf7124cf49bb8a96cb38a5b1cbf543 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b00261900170301001ba0d84d961a8c8810ba0963241386597ec460318e3f2af1d0559b05 Message-Authenticator = 0x9f5299f265c8eb3c68a210a7dc54782e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 rlm_eap: EAP packet type response id 11 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 modcall: group authorize returns updated for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 9 modcall: group authenticate returns invalid for request 9 auth: Failed to validate the user. Delaying request 9 for 1 seconds Finished request 9 Going to the next request Thread 5 waiting to be assigned a request

2 1

Can mysql and mssql being used at the same time?
by Andres Pazos 14 Nov '05

14 Nov '05

Is it possible to have user@realm1 authenticated against MSsql and user@realm2 authenticated against MySql? thanks in advance.

2 1

FR1.0.5: EAP + LDAP + crypted passwds ??
by aab+freeradius＠drexel.edu 14 Nov '05

14 Nov '05

Ok, I skimmed through the mailing list notes last night (mostly via Google) and found a number of notes that said it was only possible to do EAP authentications against an LDAP server if the server has either cleartext passwords or NT hashes in it. Some of those notes were very old and the ldap_howto.txt doc is also rather old with no reference of 802.1x, so I'm hoping to get an updated answer. My LDAP choices are the AD domain controllers and our iPlanet LDAP servers - the iPlanet servers have crypted passwords and no NT hash info, so I believe they're out of this(?) The AD LDAP might have a way for me to make use of PEAP or TTLS, but I'm running into a bit of trouble with the user binding at this time. I'm back to reading, but figured I'd include my AD/LDAP config just in case someone sees something blindingly wrong with it. andrew. :radiusd.conf: ldap { server = "domaincon.test.drexel.edu" basedn = "dc=drexel,dc=edu" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } :eap.conf: tls { # private_key_password = whatever private_key_file = ${raddbdir}/certs/keycert.pem certificate_file = ${raddbdir}/certs/keycert.pem CA_file = ${raddbdir}/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes copy_request_to_tunnel = no use_tunneled_reply = no } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 }

2 1

Freeradius vs. ActiveDirectory
by Völker, Christian 14 Nov '05

14 Nov '05

Yohoo! Yes! I did it! ;) My freeradius (1.0.1-1.RHEL3) authenticates again our ActiveDirectory (on 2003 Server). Without ntlm_auth! Below I have added a short summary how I realized it here. But now I have a question and I can't solve it for myself. I want to retreive some group informations from AD. In an users account I find several values "memberOf" and the DN of the group, where the user belong to. Now I want to give access via freeradius only to some special groups. I have figuered out, that there are these parameters: groupname_attribute, groupmembership_filter and groupmembership_attribute combined with some entries in the users-file. I've read the doc/rlm_ldap, but I didn't find any deeper hints or explanation. Questions: 1. Where can I find some docs about the %{...} Values in groupmebership_filter? Which one should I use in combination with my AD? 2. Which value should I use then in the users-file? 3. Is there anyone who can give a little help in further authenticating with group? -------------short summary how to authenticate vs. ActiveDirectory ----------------------- /etc/raddb/radiusd.conf [...] ldap { #servername with an AD-Server running Win2003Srv server = "adsrv.qsc.de" #The Useraccount for querying AD (anonymous query is disabled) identity = "cn=man,ou=ServiceAdmins,dc=qsc,dc=de" #The password for the Query-User password = 'xxxxxx' #base DN for user search; all our Users are in ou=employees. Without this "ou=...", no user will be found. \ #I don't understand why basedn = "ou=employees,dc=qsc,dc=de" # I've copied the below string, because I didn't understand the meanings of the %{...} filter = "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" # I had to increase the timeouts timeout = 40 timelimit = 30 net_timeout = 10 } The users-file left on default, no changes. I hope, I could help some people trying to use AD for radius. And, I hope, someone will help me with my user-problem. Greets Christian

3 2

EAP-AKA
by Rajeshwari Krishnappa 14 Nov '05

14 Nov '05

Hi all, Can some one please tell me if the current version of free radius supports EAP-AKA? If so, how can we set it up to work with x-supplicant on Linux? Thanks Rajeshwari __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Proxy replies not getting to/past proxy
by Kristina Pfaff-Harris 14 Nov '05

14 Nov '05

Hi, all. First, let me say that if the answer to this is in the lists or the docs or rlm_whatever.c, please let me know. I've been searching for a few days, but either I'm not using the right queries to find my answer, or it's not there. (Ain't that always the way?) :-) We recently upgraded from a hacked-n-patched in-house version of FR 0.8.1 to the release version 1.0.5 (which currently has almost all the hacks we needed, and we decided to do without the single one that it doesn't). All configuration files are the same with the exception that we're using the new dictionary. We also use the MegaPOP visp dialup thingy, where users dial into a MegaPOP number as "Login(a)ourdomain.com" and get proxied to our radius servers for authentication. The problem is that with FR 0.8.1, our custom Radius attributes were getting sent back to the proxy and applied to the user. As soon as we implemented 1.0.5, this does not happen and all users are assigned a generic PPP profile regardless of what we have for them here. I would have just bugged the MegaPOP folks (and, indeed, I've done so and now I'm waiting on an email from them to see if they have any ideas), but since it's pretty clearly something that changed between 0.8.1 and 1.0.5, I thought I'd see if anyone here could point me in the right direction. Anyway, any ideas or pointers to docs/code appreciated. Thanks! Kristina

2 3