- Freeradius-Users - lists.freeradius.org

how to use ntlm_auth
by Juan Mauel Lopez Villalobos 02 Nov '05

02 Nov '05

Hi, I want to know how to use ntlm_auth with ntlm-server-1 and freeradius, with the users login and password information in ldap. I have read documentation of ntlm_auth (only found the man page), docs and howtos about pptp and squid, i don't found about freeradius, and i'm experimenting with the options of ntlm_auth. I have configured freeradius+ldap+802.1X for a wireless lan, but i can't get it to work because of mschap, and i dont have windows domain. The ntlm_auth man page said: "Server-side helper protocol, intended for use by a RADIUS server or the 'winbind' plugin for pppd, for the provision of MSCHAP and MSCHAPv2 authentication." Who i can use it with (free)radius only?? The radius.conf said in the mschap module definition: "#The module can perform authentication itself, OR # use a Windows Domain Controller. How can the module permorm authentication itself??? can someone helpme?? -- LCC Juan Manuel Lopez Villalobos Departamento de Sistemas de Informacion Coordinacion de Informacion Academica Universidad Autonoma de Baja California Tel: (686) 551 8274 Fax: (686) 551 8269 Conmutador: (686) 551 8222 y 8270 ext. 3360

2 1

Re: New to List - First Time Set-up
by tech13＠netaxis.ca 02 Nov '05

02 Nov '05

Hi, Start with: http://www.oreilly.de/catalog/radius/chapter/ch05.html It was very helpful for me. Pierre Forget > -- Original Message ---- > Date: Tue, 1 Nov 2005 15:12:19 -0800 > From: "Mark Sarria" <mes4294(a)lausd.k12.ca.us> > Subject: New to List - First Time Set-up > ------------------ > Hello List, > > I have been reading about freeradius and would like to set it up in my > sandbox environment for testing. Can you point me to the right direction on > how to go about setting this service up. Also can you give me a brief list > down of the items I will need on my server. > > At the moment I have been working with Fedora Core 3 running as my > Samba-LDAP server, on my sandbox environment. > > Thanks for your help > > --mark > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

using ldap, sql and pam for user authentification
by Markus Krause 02 Nov '05

02 Nov '05

hi all! i want to configure the freeradius server (1.0.5) to use ldap, sql and pam as source for user authentification. i only get the first two to work at the same time (ldap and sql) but not together with pam. if i use this in /etc/raddb/users: ##### users wlan Auth-Type = EAP testuser Auth-Type := Local, User-Password == "secret" ------ all user in ldap and sql (and of course the "testusers" in the "users" file) can be authorized, but if users in pam can not, radiusd says: ##### radiusd debug output auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. ----- with the following in /etc/raddb/users: ##### users DEFAULT Auth-Type = Pam Fall-Through = Yes wlan Auth-Type = EAP testuser Auth-Type := Local, User-Password == "secret" ----- users in pam get an access-accept message, but not those in ldap and sql (nor the "testuser" in "users". the debug output for a user in sql says: ##### radiusd debug output (only "important parts" as i assume) modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 6 rlm_ldap: - authorize rlm_ldap: performing user authorization for nig49594 radius_xlat: '(uid=nig49594)' radius_xlat: 'dc=mogli,dc=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=mogli,dc=de, with filter (uid=nig49594) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 6 radius_xlat: 'nig49594' rlm_sql (sql): sql_set_user escaped user --> 'nig49594' [snipp sql queries] rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 6 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user nig49594, check_item=1, counter=0 rlm_sqlcounter: Sent Reply-Item for user nig49594, Type=Session-Timeout, value=1 modcall[authorize]: module "onedayaccounts" returns ok for request 6 modcall: group authorize returns ok for request 6 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <nig49594>. Reason: User not known to the underlying authentication module modcall[authenticate]: module "pam" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. ----- same for an ldap user: ##### radiusd debug output (snipped again) rlm_ldap: - authorize rlm_ldap: performing user authorization for ldapuser radius_xlat: '(uid=ldapuser)' radius_xlat: 'dc=mogli,dc=de' [snipp] rlm_ldap: user ldapuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 radius_xlat: 'ldapuser' rlm_sql (sql): sql_set_user escaped user --> 'ldapuser' [snipp] rlm_sql (sql): User ldapuser not found in radcheck rlm_sql (sql): User ldapuser not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "onedayaccounts" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <ldapuser>. Reason: User not known to the underlying authentication module modcall[authenticate]: module "pam" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Login incorrect: [ldapuser] (from client wlan port 0) ----- it seems that the pam returns "reject" if a user is not found by pam, sql and ldap reutrn "nofound". how can i set up the pam part to return "notfound" and not overwrite the "ok" request by the other modules? thanx in advance for your help! regards markus -- Markus Krause email: krause(a)biochem.mpg.de Computing Center Tel.: 089 - 89 40 85 99 Group Lottspeich / Proteomics Fax.: 089 - 89 40 85 98 --------------------------------------------------------------------- This message was sent using https://webmail.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

1 0

PEAP MS_CHAP V2: problem with tunnel attributes on enterasys V2 switch
by slapeyre＠free.fr 02 Nov '05

02 Nov '05

Hello, I am new to this list and would like to know if someone out there has been successfull in implementing eap-PEAP user authentication and VLAN assignment with freeradius and Enterasys V2 switches ? It wasn´t a problem to configure EAP-PEAP with freeradius server (running on suze) and Enterasys switches. I already use it for client authentication but I had no success with switch/port based authentication and VLAN assignment at a enterasys switch. The users and their RADIUS attributes are on LDAP base on a Novell server (version 6.5) I know from reading our enterasys notice that the switch expects the following parameters within access_accept "tunnel-type= 13 (VLAN)" "tunnel-medium-type=6 (802) "tunnel-private-group-ID=vlan_id" but with no success. I didnt see the attribute on FreeRADIUS LOG. I have put a sniffer machine between the FreeRadius Server and the Novell server, but I didnt see any Tunnel attribute. In fact, I dont know: - if the switch dont receive the tunnel parameters - OR if the switch dont understand the tunnel parameters it is receiving Any tips ?? Is it necessary to active or configure something on FreeRADIUS to use tunnel parameters ??? thank you in advance. Best regards Stephane

2 2

New to List - First Time Set-up
by Mark Sarria 01 Nov '05

01 Nov '05

Hello List, I have been reading about freeradius and would like to set it up in my sandbox environment for testing. Can you point me to the right direction on how to go about setting this service up. Also can you give me a brief list down of the items I will need on my server. At the moment I have been working with Fedora Core 3 running as my Samba-LDAP server, on my sandbox environment. Thanks for your help --mark

1 0

Re: freeradius password caching problem
by tech13＠netaxis.ca 01 Nov '05

01 Nov '05

> -- Original Message ---- > Date: Tue, 01 Nov 2005 17:05:23 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: freeradius password caching problem > ------------------ > tech13(a)netaxis.ca wrote: > > Permissions for /var/run and /var/run/radiusd are: > > > > drwxr-xr-x > > <sigh> That's nice. The question was for *you* to figure out if the > permissions let the server write the pid file. Now that I run it in daemon mode (the -s option also prevents to run in daemon mode), the pid file is created. I included the permissions, even though I had figured it out myself, because sometimes I look and I don't see the typo... As the users file is running and updating correctly with kill -HUP, I will keep it that way. syslog problem is solved with tail -f. Thanks a lot, you have been very helpful! Pierre Forget > > > Yes, I am running it as a daemon with the command: > > > > /usr/local/sbin/radiusd -s -f 2>>/tmp/radius.err >>/tmp/radius.out & > > No, you're not running it as a daemon. See the "man" page. "-f" > says to NOT run as a daemon. > > > Is there any possibility to use the Unix /etc/passwd instead of users? > > Yes. See the default configuration. There's a "unix" module. You > might want to look at it. > > > Do I need to deactivate users somewhere? > > If you want users to be deactivated, probably. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Scripts before 'authenticate', re-writing Attributes items ...
by Roberto Gonzalez Azevedo 01 Nov '05

01 Nov '05

Hi, How can I run scripts in 'authorize' phase, and modify a Attribute item? Something like this : (after 'authorize') Auth-Type = Crypt-Local (after script, BEFORE 'authenticate') Auth-Type = MS-CHAP Thanks. Roberto Gonzalez Azevedo rgonzalez(a)censanet.com.br

1 0

Re: freeradius password caching problem
by tech13＠netaxis.ca 01 Nov '05

01 Nov '05

Hi, First, thanks for the reply. See the comments. Pierre Forget > -- Original Message ---- > Date: Tue, 01 Nov 2005 13:10:30 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: freeradius password caching problem > ------------------ > tech13(a)netaxis.ca wrote: > > 1- the radiusd.pid file is not created > > Have you checked file permissions? Are you running it as a daemon? > Permissions for /var/run and /var/run/radiusd are: drwxr-xr-x Yes, I am running it as a daemon with the command: /usr/local/sbin/radiusd -s -f 2>>/tmp/radius.err >>/tmp/radius.out & > > 2- the passwd file (which I believe is from the users file) is not refreshed. > > The passwd file has nothing to do with the users file. > Is there any possibility to use the Unix /etc/passwd instead of users? With caching and auto refresh? Do I need to deactivate users somewhere? > > I would prefer to use the /etc/passwd file and have it cached, but > > even if I activate it with cache = yes, it doesn't seem to work. I > > also use the cache refresh setting. If I use cache = no, it still > > seem to use the same users file. > > There is no "cache" setting for the "files" module, which is the > one that implements the "users" file. > > To re-read /etc/raddb/users, you have to send a HUP signal to the server. > > > 3- I want to send all the logs to syslog, but this also doesn't seem to work, unless it's sent to a file. I tried syslog_facility = daemon, > > but still doesn't work. > > That doesn't work in 1.0.x. I have a fix for syslog: I use tail -f on the detail file and send it to the logs. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Using the same EAP userid on multiple devices?
by Michael Wang 01 Nov '05

01 Nov '05

Hi, I am trying to set up an environment where I have multiple wireless devices that need to authenticate to an Access Point that uses FreeRadius as its backend authentication server. I am wondering if I can use the same EAP userid and password for all of these devices? Will the FreeRadius server get confused if two or more devices are authenticating at the same time to the FreeRadius server? Or is there something in the radius protocol or in the FreeRadius implementation that keeps track of authentication sessions independently and therefore does not care if multiple sessions are using the same EAP userid? Thanks again for your helpful responses..... Michael

2 2

mysql_ippool
by Mark Novitzkas 01 Nov '05

01 Nov '05

Hi all Finally have ippool working but it seems my setting are messed-up somewhere Radiusd.conf ------------- ippool main_pool { range-start = x.x.x.x range-stop = x.x.x.x netmask = 255.255.255.0 cache-size = 800 session-db = /home/radius/db.ippool ip-index = /home/radius/db.ipindex override = yes Radius Db ---------- Radcheck mysql> select * from radcheck; +----+----------+---------------+----+---------------------------------- --+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+---------------------------------- --+ | 1 | tester | Pool-Name | == | main_pool | I get an access-reject message when sending a radtest? radtest tester <pass> 127.0.0.1 0 <secret> Does radcheck need the Pool-Name attribute? Where do you place the password for user tester in the sql DB? Thanks Notice This email is intended for the addressee only and may contain legally privileged and/or confidential information. If you have received this email in error and are not the intended recipient, you are hereby informed that you are not entitled to read, broadcast, distribute or in any manner whatsoever use the contents of this email or any attachments thereto. You are requested to please notify Psitek that you have received the email and then delete it. Unless clearly stated otherwise, the content and sentiments expressed in this email or any attachments thereto are those of the sender and not of Psitek (Proprietary) Limited. Psitek does not accept liability for any damages, loss or expense of any nature whatsoever arising (a) out of or in connection with the email or any attachments thereto and/or (b) from any act or omission by the recipient relying upon the content of the email or attachments. Psitek further disclaims liability for any damages caused by computer and/or software viruses. Should this email contain the terms of a contract, no binding agreement will result until such time as a written (hardcopy) document is signed on behalf of Psitek.

2 1