- Freeradius-Users - lists.freeradius.org

ntlm_auth multiple domains
by Jamie Crawford 20 Sep '05

20 Sep '05

Hi, I'm using ntlm_auth to authenticate users in freeradius. My samba server is joined to DOMAINA. When I run ntlm_auth --username=domainauser everything works great. When I run ntlm_auth --username=domainbuser it fails because the user does not exist in domaina which the server is joined to. If I run ntlm_auth --username=domainbuser --domain=domainb it works great. I was wanting to do ntlm_auth --domain=domaina --domain=domainb --username=domainbuser, it works only because the second domain variable is domainb. If I were to use a domainauser, it would fail. Would setting up realms help? How can I tell freeradius to use ntlm_auth --domain=domaina on domaina users and ntlm_auth --domain=domainb on domainb users? Any ideas??? tia, jamie Jamie Crawford, MCSE RHCT Network Analyst I Information Services Central Missouri State University Warrensburg, MO 64093 Phone:6605434357 Email:CRAWFORD@CMSU1.CMSU.EDU

2 1

Transmitted packet
by Iandc Davies 20 Sep '05

20 Sep '05

All, The contents of the transmitted packet include an uint8_t *data. What exactly is this pointing to ? The radius.c code sems to check it the first time round against NULL ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

Radius PEAP protocol
by Juan Daniel Moreno 20 Sep '05

20 Sep '05

Hi everyone, I am trying to create a client's interface for Radius PEAP protocol. The server has donne all I wonder it to do, but now I have a question about the finish handshake message I have to send. When I get the server's cetificate, I get a public key too. I have to "public-key-encrypt" a PreMasterSecret that is a vector of 46 random bytes and the tls version (1.0). My question is how can I do that. Am I obliged to get the ssl libraries to "public-key-encrypt" this packet? Thank you for any complemetary information. Juan Daniel MORENO

2 1

Multiple LDAPS
by S�bastien Cantos 20 Sep '05

20 Sep '05

Hi, I was wondering if there's a way to look for users in differents LDAP trees and/or servers depending of the suffix (@something) in the login. If it's possible could someone show me the config ? Thanks in advance. Regards, -- Sebastien Cantos <scantos(a)technodiva.com> Network / System Manager Neopost DIVA

2 2

RE: Transmitted packet
by Jonathan De Graeve 20 Sep '05

20 Sep '05

Actie voltooid. Wordt naar zowel Wendy als kathleen gestuurd. J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Iandc Davies Verzonden: dinsdag 20 september 2005 15:05 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Transmitted packet All, The contents of the transmitted packet include an uint8_t *data. What exactly is this pointing to ? The radius.c code sems to check it the first time round against NULL ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: 12077 error???
by King, Michael 20 Sep '05

20 Sep '05

> -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > Behalf Of Armin Krämer > > Hi, I set up freeradius with eap-tls and after I generated my > certificates with TinnyCA and configured it in eap.conf File > I get this error message...Does anyone knows what causes this error? > Thanks Armin > > debian:~# freeradius -X -A Did you install FreeRadius via Apt (aptitude) or compile from source?

3 2

Hashed passwords in the users file???
by Miguel Angel Quiles 20 Sep '05

20 Sep '05

Hi, does someone know how to use hashed passwords for the users entries in the users file????? I hope someone can help me.

1 0

RE: Nortel Networks Passport 8600 + Radius AAA
by Jonathan De Graeve 20 Sep '05

20 Sep '05

There were bugs in that release. Upgrade to 3.5.10.0 J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- ________________________________ Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Inci Gedik Verzonden: dinsdag 20 september 2005 10:53 Aan: freeradius-users(a)lists.freeradius.org Onderwerp: Nortel Networks Passport 8600 + Radius AAA Hi Everyone, I have the same problem. Could someone send me the correct configuration Radiusd.conf , users, clients.conf or if it is necessary dictionary files? Thanks Inci Gedik ------------------------------------------------------------------------ -- I am in the testing phase using Nortel 8600's (8010 is the chassis), No dictionary needed. I have had no problems. but I am also using 3.5 code. maybe trying the current version of code might help. Just a thought >>> ettan(a)online.no 1/15/2004 9:01:32 AM >>> Hi We have just bought a few Nortel Passport 8010, and I like to use freeradius to authenticate the user that want to log on to configure this switches. I can se the Radius server is sending Access-Accept back to the switch, but I don't get any login prompt, but ask me again about login name. Have someone got this to work or have any hints for me ? I can't find any dictionary for Nortel, do I need that ? users file: jon Auth-Type := local, User-Password == "jon",Huntgroup-Name == "pp8600" Service-Type = Login-User, Fall-Through = NO debuging from radiusd -X: modcall: group authorize returns ok rad_check_password: Found Auth-Type local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 23 to 10.10.9.51:1051 Service-Type = Login-User Finished request 0 Going to the next request The PP8610 config,Software Release 3.2.3.0 configuration: LAB_550:5/config/radius/server# enable true LAB_550:5/config/radius/server# create 10.10.1.2 secret test LAB_550:5/config/radius/server# set 10.10.1.2 secret test - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----------------------------------------------------- This message is intended only for certain recipients and may be privileged or confidential. If you have received it in error, please notify sender and delete it without making or retaining a copy. ----------------------------------------------------- <<<<*P*H*L*>>>>

2 1

Weird huntgroup issue
by Jonathan De Graeve 20 Sep '05

20 Sep '05

Hello, I have a weird huntgroup issue. I have users in a group 'artsen' with HuntgroupName => == ^(vpn|ras)$ I have users in group 'stagiars' with HuntgroupName => == hotspot On the radiussystem itself I can successfully authenticate users from group artsen but not from group stagiairs. But I can login with a user from group stagiars from a nas with ip 194.8.52.37 My NASclients from SQL: 17 | localhost | localhost | other | 0 |... Huntgroup file: # VPN infrastructure vpn NAS-IP-Address == 10.2.254.1 vpn NAS-IP-Address == 10.2.254.2 vpn NAS-IP-Address == localhost # ras NAS-IP-Address == 10.2.254.81 ras NAS-IP-Address == 10.2.254.82 ras NAS-IP-Address == localhost # hotspot NAS-IP-Address == x.y.z.37 hotspot NAS-IP-Address == x.y.z.38 hotspot NAS-IP-Address == localhost This comes in the logging when I do a check on the radiusystem itself with following arguments: radtest lvanhoey0 password localhost:1812 0 passwordhere radius_xlat: 'lvanhoey0' rlm_sql (sql): sql_set_user escaped user --> 'lvanhoey0' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'lvanhoey0' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'lvanhoey0' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [lvanhoey0] rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "volumelimit" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "prepaidcounter" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [lvanhoey0/jo0clni3] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- And logging when login in from nas-ipadress modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 modcall[authorize]: module "digest" returns noop for request 12 rlm_realm: No '@' in User-Name = "lvanhoey0", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 12 radius_xlat: 'lvanhoey0' rlm_sql (sql): sql_set_user escaped user --> 'lvanhoey0' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'lvanhoey0' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgrou pcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'lvanhoey0' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrou preply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'lvanhoey0' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 12 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "uploadlimit" returns noop for request 12 rlm_sqlcounter: Entering module authorize code Any idea's??? -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite ---------

2 1

Nortel Networks Passport 8600 + Radius AAA
by Inci Gedik 20 Sep '05

20 Sep '05

Hi Everyone, I have the same problem. Could someone send me the correct configuration Radiusd.conf , users, clients.conf or if it is necessary dictionary files? Thanks Inci Gedik -------------------------------------------------------------------------- I am in the testing phase using Nortel 8600's (8010 is the chassis), No dictionary needed. I have had no problems. but I am also using 3.5 code. maybe trying the current version of code might help. Just a thought >>> ettan(a)online.no 1/15/2004 9:01:32 AM >>> Hi We have just bought a few Nortel Passport 8010, and I like to use freeradius to authenticate the user that want to log on to configure this switches. I can se the Radius server is sending Access-Accept back to the switch, but I don't get any login prompt, but ask me again about login name. Have someone got this to work or have any hints for me ? I can't find any dictionary for Nortel, do I need that ? users file: jon Auth-Type := local, User-Password == "jon",Huntgroup-Name == "pp8600" Service-Type = Login-User, Fall-Through = NO debuging from radiusd -X: modcall: group authorize returns ok rad_check_password: Found Auth-Type local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 23 to 10.10.9.51:1051 Service-Type = Login-User Finished request 0 Going to the next request The PP8610 config,Software Release 3.2.3.0 configuration: LAB_550:5/config/radius/server# enable true LAB_550:5/config/radius/server# create 10.10.1.2 secret test LAB_550:5/config/radius/server# set 10.10.1.2 secret test - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ----------------------------------------------------- This message is intended only for certain recipients and may be privileged or confidential. If you have received it in error, please notify sender and delete it without making or retaining a copy. ----------------------------------------------------- <<<<*P*H*L*>>>>

1 0