- Freeradius-Users - lists.freeradius.org

RE: Windows Client Authentification bevore Domain logon
by Guy Davies 02 Sep '05

02 Sep '05

Hi, I use Funk Odyssey. It works really well with EAP-TTLS/PAP. We use an LDAP connection to our AD Global Catalogs to just query the validity of the user credentials and obtain the memberOf attributes. The Odyssey GINA module seems pretty reliable. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jérémy Cluzel Sent: 02 September 2005 00:37 To: freeradius-users(a)lists.freeradius.org Subject: RE: Windows Client Authentification bevore Domain logon Hi Guy, Do you know working supplicants with a GINA module ? aegis ? secureW2 ? Regards, Jeremy freeradius-users-request(a)lists.freeradius.org a écrit : Date: Thu, 1 Sep 2005 17:10:14 +0100 From: "Guy Davies" <Guy.Davies(a)telindus.co.uk> <mailto:Guy.Davies@telindus.co.uk> Subject: RE: Windows Client Authentification bevore Domain logon To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> <mailto:freeradius-users@lists.freeradius.org> Message-ID: <A00F4E8D8C7E8847A8ABFFE22F48033701B3692A(a)tuk1mx1.telindus.intra> <mailto:A00F4E8D8C7E8847A8ABFFE22F48033701B3692A@tuk1mx1.telindus.intra> Content-Type: text/plain; charset="iso-8859-1" Hi Marc, The only way to do this with the supplicant included with XP is to use machine auth. This must use the same method used by the individual (i.e. EAP-TLS or PEAP/MS-CHAPv2). There is a checkbox that says something like "Use machine credentials if available". Check that and the machine will authenticate before the user. Once the user authenticates, the machine auth is killed and the user's auth is used. This requires that the machine has either a PEAP/MS-CHAPv2 username/password or an EAP-TLS certificate. These are stored in AD so you have to backoff your request to AD. If you want to do that for PEAP/MS-CHAPv2, you'll need NTLM access to the AD server, LDAP won't do because it can't get the cleartext password (unless it is replicated to a non-standard attribute). A better method, in my experience, is to use a supplicant with a GINA module. That stops the windows login process immediately after the user has entered the credentials, takes the user's credentials and uses them to login to the network, then it returns control to the windows login process. This doesn't require any authentication of the machine. Regards, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Marc-Henri Boisis-delavaud Sent: 01 September 2005 15:19 To: FreeRadius users mailing list Subject: Re: Windows Client Authentification bevore Domain logon Le 31 août 05 à 18:53, Alan DeKok a écrit : =?ISO-8859-1?Q?J=E9r=E9my_Cluzel?= <j.cluzel(a)online.fr> <mailto:j.cluzel@online.fr> wrote: Sorry, but I didn't find any references of this OID in the creation scripts in the "scripts" directory (Ca.all, CA.certs...). The only OID added seem to be 1.3.6.1.5.5.7.3.1 and 1.3.6.1.5.5.7.3.2 (in "xpextensions"). Is there any way to do this without patching openssl (like explained there http://lists.cistron.nl/pipermail/freeradius-users/ 2004-July/034141.html) ? You can use that OID just like the other ones. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/ users.html Can you explain how we can activate 802.1x authentification before logon on xp. And what are the prerequisites ? Marc - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us. This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

multiple ldap
by Marc-Henri Boisis-delavaud 02 Sep '05

02 Sep '05

Hello In my radius I'm using two ldap for authenticating users. Some users have accounts in the two ldaps my radiusd.conf authorize { ldap_etu ldap_prof } authenticate { Auth-Type LDAP { ldap_etu { reject = 1 } redundant { ldap_prof } -attribute in ldap_prof are prioritary for user who have account in the two ldap I have the following problem: search in ldap_etu : success search in ldap_prof : success attribute are correct auth in ldap_etu : failed (normal because password are different between two ldap) auth in ldap_prof : failed because radius use dn=etu and it would use dn=prof How can I force the dn for ldap_prof ?

1 0

TLS/SSL to eDirectory
by jp＠joshmp.com 02 Sep '05

02 Sep '05

Setup: - FreeRADIUS 1.0.4 built with edir on FreeBSD 4.11 server. - Cisco 3005 VPN Concentrator - LDAP database on NetWare 6.5 server Everything works fine when not use SSL certificate and TLS. However, when TLS is turned on, here is what I get: -----snip----- Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 10.254.1.6:1063, id=27, length=118 User-Name = "username" User-Password = "password" NAS-Port = 1028 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "10.254.1.6" Calling-Station-Id = "69.152.48.158" Tunnel-Client-Endpoint:0 = "69.152.48.158" NAS-IP-Address = 10.254.1.6 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "stcrye", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for stcrye radius_xlat: '(cn=username)' radius_xlat: 'o=services' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.254.8.25:389, authentication 0 rlm_ldap: setting TLS CACert File to /home/juser/trustedrootcertssl-certdns-episd1.b64 rlm_ldap: starting TLS rlm_ldap: ldap_start_tls_s() rlm_ldap: could not start TLS Connect error rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.254.1.6:1063, id=27, length=118 Discarding duplicate request from client VPN:1063 - ID: 27 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 27 with timestamp 431712ab Nothing to do. Sleeping until we see a request. -----snip----- Relevent portion of radiusd.conf: -----snip----- ldap ldap1 { server = "10.254.8.25" identity = "cn=raduser,o=services" password = secretrad basedn = "o=services" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" #start_tls = no start_tls = yes tls_cacertfile = /home/juser/trustedrootcertssl-certdns-episd1.b64 dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword edir_account_policy_check=no timeout = 20 timelimit = 20 net_timeout = 20 -----snip----- When I un-comment start_tls = no and comment out start_tls = yes and tls_cacertfile, everything works fine. I don't really know where to start. I have read the faq's, been up and down the list and can't find a solution. Thanks in advance. Josh

3 2

RE: 4400 switch configuration and auth_module_radius.so problem
by Luis Antonio Chavez Puebla 02 Sep '05

02 Sep '05

-----Original Message----- From: Luis Antonio Chavez Puebla [mailto:lchavez@mpsnet.com.mx] Sent: Jueves, 01 de Septiembre de 2005 08:26 p.m. To: freeradius-users(a)lists.freeradius.org Subject: 4400 switch configuration and auth_module_radius.so problem hi i have a 4400 switch whit free radius and i need use mod_auth_radius but i can?t install this module on apache server 1.3.22 can you help me??

1 0

Removing prefix and suffix from User-Name
by Jérémy Cluzel 02 Sep '05

02 Sep '05

Hi, I want to convert the User-Name recieved: "\host\login.server.domain.com" to "username". What's the best way to do this ? - using preprocess module and "hints" file: DEFAULT Prefix == "/host", Strip-User-Name = Yes DEFAULT Suffix == ".server.domain.com", Strip-User-Name = Yes - using "proxy.conf" file: realm server.domain.com { type = radius authhost = LOCAL accthost = LOCAL } - using realm module: realm test { format = suffix delimiter = "." ignore_default = no ignore_null = no } - using attr_rewrite module: attr_rewrite saneUserName { attribute = User-Name searchin = packet searchfor = "^(+.).server.domain.com" replacewith = "%{1}" ignore_case = yes new_attribute = no max_matches = 1 append = no } - or using preprocess module and "hints" file: DEFAULT Prefix == "/host", Strip-User-Name = Yes DEFAULT Suffix == ".server.domain.com", Strip-User-Name = Yes Regards, Jeremy

2 1

RE: Windows Client Authentification bevore Domain logon
by Jérémy Cluzel 01 Sep '05

01 Sep '05

Hi Guy, Do you know working supplicants with a GINA module ? aegis ? secureW2 ? Regards, Jeremy freeradius-users-request(a)lists.freeradius.org a écrit : >Date: Thu, 1 Sep 2005 17:10:14 +0100 >From: "Guy Davies" <Guy.Davies(a)telindus.co.uk> >Subject: RE: Windows Client Authentification bevore Domain logon >To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> >Message-ID: > <A00F4E8D8C7E8847A8ABFFE22F48033701B3692A(a)tuk1mx1.telindus.intra> >Content-Type: text/plain; charset="iso-8859-1" > >Hi Marc, > >The only way to do this with the supplicant included with XP is to use machine auth. This must use the same method used by the individual (i.e. EAP-TLS or PEAP/MS-CHAPv2). > >There is a checkbox that says something like "Use machine credentials if available". Check that and the machine will authenticate before the user. Once the user authenticates, the machine auth is killed and the user's auth is used. This requires that the machine has either a PEAP/MS-CHAPv2 username/password or an EAP-TLS certificate. These are stored in AD so you have to backoff your request to AD. If you want to do that for PEAP/MS-CHAPv2, you'll need NTLM access to the AD server, LDAP won't do because it can't get the cleartext password (unless it is replicated to a non-standard attribute). > >A better method, in my experience, is to use a supplicant with a GINA module. That stops the windows login process immediately after the user has entered the credentials, takes the user's credentials and uses them to login to the network, then it returns control to the windows login process. This doesn't require any authentication of the machine. > >Regards, > >Guy > > > >>-----Original Message----- >>From: freeradius-users-bounces(a)lists.freeradius.org >>[mailto:freeradius-users-bounces@lists.freeradius.org] On >>Behalf Of Marc-Henri Boisis-delavaud >>Sent: 01 September 2005 15:19 >>To: FreeRadius users mailing list >>Subject: Re: Windows Client Authentification bevore Domain logon >> >> >> >>Le 31 août 05 à 18:53, Alan DeKok a écrit : >> >> >> >>>=?ISO-8859-1?Q?J=E9r=E9my_Cluzel?= <j.cluzel(a)online.fr> wrote: >>> >>> >>> >>>>Sorry, but I didn't find any references of this OID in the >>>>creation scripts in the "scripts" directory (Ca.all, CA.certs...). >>>>The only OID added seem to be 1.3.6.1.5.5.7.3.1 and >>>>1.3.6.1.5.5.7.3.2 (in "xpextensions"). >>>>Is there any way to do this without patching openssl (like >>>>explained there >>>> >>>> >>http://lists.cistron.nl/pipermail/freeradius-users/ >> >> >>>>2004-July/034141.html) ? >>>> >>>> >>>> >>> You can use that OID just like the other ones. >>> >>> Alan DeKok. >>>- >>>List info/subscribe/unsubscribe? See >>> >>> >>http://www.freeradius.org/list/ >> >> >>>users.html >>> >>> >>> >>Can you explain how we can activate 802.1x authentification before >>logon on xp. And what are the prerequisites ? >>Marc >> >> >> >>- >>List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html >> >> >> > >This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us. >

1 0

Re: Digest test
by Iandc Davies 01 Sep '05

01 Sep '05

>"Iandc Davies" <Iandc.Davies(a)marconi.com> wrote: > Is there a way to tell freerad not to check user-password ? >> Use ":=", as per my previous message. >> Alan DeKok. Am I doing something really stupid, as it still requires a password field in the sending file ! ? ! /etc/raddb/users file now has an entry right at the top such as this : test Auth-Type := Digest, User-Password := "xxxx" (where xxxx = password) Reply-Message = "Hello, test with Digest" Separate question: Is the Reply-Message supposed to be returned ? Or is that the authenticator field returned on a code 2 ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

upgraded to 1.0.4 lots of problems.
by Drew Weaver 01 Sep '05

01 Sep '05

I've sorted through most of my issues going from 1.0.1 to 1.0.4 but one thing I cant figure out is this: I have this line in my /etc/raddb/users file: DEFAULT Auth-Type = System rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Login incorrect: [aweaver/12345] (from client dhcp111.cmh.ee.net port 0) I copied all of the config files from the old server to the new server, only thing that has changed was the version of freeradius. I still have both servers, the old 1.0.1 and the 1.0.4, and the old one accepts "system" as a valid auth type, does anyone know if something changed or what/not? Thanks, -Drew

1 0

Excluding non-NAS from simultaneous-use checks
by Dan Siemon 01 Sep '05

01 Sep '05

I'm looking for a way to exclude some sources of RADIUS authentication requests from being subjected to the simultaneous-use checks. Basically we use RADIUS for more than just dialin, simultaneous-use is not applicable to these services. I found the following thread on the Cistron mailing list which would solve my problem if I were still running Cistron. http://lists.cistron.nl/pipermail/cistron-radius/2002-June/003861.html Setting the RAS type to none appears to have no effect for FreeRADIUS. Is there another way to accomplish this with FreeRADIUS?

2 5

RE: Windows Client Authentification bevore Domain logon
by Guy Davies 01 Sep '05

01 Sep '05

Hi Marc, The only way to do this with the supplicant included with XP is to use machine auth. This must use the same method used by the individual (i.e. EAP-TLS or PEAP/MS-CHAPv2). There is a checkbox that says something like "Use machine credentials if available". Check that and the machine will authenticate before the user. Once the user authenticates, the machine auth is killed and the user's auth is used. This requires that the machine has either a PEAP/MS-CHAPv2 username/password or an EAP-TLS certificate. These are stored in AD so you have to backoff your request to AD. If you want to do that for PEAP/MS-CHAPv2, you'll need NTLM access to the AD server, LDAP won't do because it can't get the cleartext password (unless it is replicated to a non-standard attribute). A better method, in my experience, is to use a supplicant with a GINA module. That stops the windows login process immediately after the user has entered the credentials, takes the user's credentials and uses them to login to the network, then it returns control to the windows login process. This doesn't require any authentication of the machine. Regards, Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Marc-Henri Boisis-delavaud > Sent: 01 September 2005 15:19 > To: FreeRadius users mailing list > Subject: Re: Windows Client Authentification bevore Domain logon > > > > Le 31 août 05 à 18:53, Alan DeKok a écrit : > > > =?ISO-8859-1?Q?J=E9r=E9my_Cluzel?= <j.cluzel(a)online.fr> wrote: > > > >> Sorry, but I didn't find any references of this OID in the > >> creation scripts in the "scripts" directory (Ca.all, CA.certs...). > >> The only OID added seem to be 1.3.6.1.5.5.7.3.1 and > >> 1.3.6.1.5.5.7.3.2 (in "xpextensions"). > >> Is there any way to do this without patching openssl (like > >> explained there > http://lists.cistron.nl/pipermail/freeradius-users/ > >> 2004-July/034141.html) ? > >> > > > > You can use that OID just like the other ones. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/ > > users.html > > > > Can you explain how we can activate 802.1x authentification before > logon on xp. And what are the prerequisites ? > Marc > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1