- Freeradius-Users - lists.freeradius.org

Config problem: ntlm_auth works outside of freeradius, but not in
by Ken George 19 Jul '05

19 Jul '05

The ntlm_auth command works from the command line, but not within freeradius (1.0.1) on RHEL 3.0 update 4 Below is my ntlm_auth command from within radiusd.conf and the debug output and the successful command line run of the ntlm_auth program. Where do I look for what I have misconfigured? I'm happy that I configured the client section correctly and my 3005 is now talking to freeradius, but I'll be happier when it can actually authorize. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Thread 2 got semaphore Thread 2 handling request 1, (1 handled so far) User-Name = "ken george" User-Password = "262144" Vendor-3076-Attr-32 = 0x00000015 NAS-IP-Address = 10.10.61.5 NAS-Port-Type = Virtual rad_lowerpair: User-Name now 'ken george' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "ken george", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_realm: No '\' in User-Name = "ken george", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched DEFAULT at 204 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type win_domain auth: type "win_domain" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 radius_xlat: '/usr/bin/ntlm_auth --username="ken george" --password="xxxxxx" --domain=usmisgnet' Exec-Program: /usr/bin/ntlm_auth --username="ken george" --password=" xxxxxx " --domain=usmisgnet Exec-Program output: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program-Wait: plaintext: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program: returned: 1 rlm_exec (win_domain): External script failed modcall[authenticate]: module "win_domain" returns fail for request 1 modcall: group Auth-Type returns fail for request 1 auth: Failed to validate the user. Login incorrect: [ken george] (from client VPN3005_Pri port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Thread 2 waiting to be assigned a request rad_recv: Access-Request packet from host 10.10.61.5:1045, id=2, length=74 Sending Access-Reject of id 2 to 10.10.61.5:1045 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 2 with timestamp 42dd17f4 Nothing to do. Sleeping until we see a request. [root@phllnxsrv01 raddb]# /usr/bin/ntlm_auth --username="ken george" --password=" xxxxxx " --domain=usmisgnet NT_STATUS_OK: Success (0x0) Thanks! Ken George Systems and Network Engineering Mi Services Group, Inc. +1 610-230-2500 x129

2 1

radius and clients.conf?
by Will Carter 19 Jul '05

19 Jul '05

It seems that when I start radius in debug mode, it is correctly reading my clients.conf file, but when I start it normally, it is not recognizing my nas device. Its as if it's not reading the correct clients.conf. Any ideas why this would be? -will

2 1

Difference between dictionary and RFC 2865 for Attribute Class
by Andreas Engler 19 Jul '05

19 Jul '05

Hello, i wonder why the entry for Attribute Class in the dictionary file is octets. I think that is the reason why the Value of Class will be stored as hex string in detail file and sql. So i have to convert it back to ASCII to read the contents. The definition in RFC says that the Value of Class should be string. Because Alan always warn to not edit the dictionary file, i would like to know which kind of trouble i would face in changing octets to string in dictionary file. Will the value be changed in future or do i have to do it on my own and on my own risk? Thank you for response Andreas

2 1

LDAP Authorization & different VLAN
by Felice Pizzurro 19 Jul '05

19 Jul '05

Hi, I have made a system of authorization with freeradius 1.0.4 based on LDAP attribute radiusGroupName and it works perfectly! Now I have this problem: I have on my access points two VLAN named data and students. I want to create different group for the authorization to access to this VLANs. Example, I want that who have the attribute radiusGroupName = WLANdata can access to the VLAN "data"; and who have the attribute radiusGroupName=WLANstudents can access to the VLAN "students". How I can configure the huntgroups file? or I need to configure the users file? Thanks and excuse me for my english, Felice -- Email.it, the professional e-mail, gratis per te: http://www.email.it/f Sponsor: aziendeinaffari.it: la risposta per tutte le esigenze delle industrie. Vieni a conoscere le 2000 imprese che ne fanno parte * Clicca qui: http://adv.email.it/cgi-bin/foclick.cgi?mid=3610&d=19-7

2 1

Error in Dialup Admin's online users page
by Tobias Wolf 19 Jul '05

19 Jul '05

Hi, there's a mistake in user_admin.php3 of dialup_admin. Right now, it's displaying the Download value twice on the Online Users page. Once as human-readable value under Upload and once as raw bytes under Download. I found the glitch on line 196. if ($lastlog_input) $lastlog_input = bytes2str($lastlog_input); else $lastlog_input = 'not available'; if ($lastlog_output) >>>> $lastlog_input = bytes2str($lastlog_output); else $lastlog_output = 'not available'; Of course it's got to be $lastlog_output. cheers, tobias

1 0

Script to encrypt/decrypt User-Password
by Tore Anderson 19 Jul '05

19 Jul '05

Hi. Does anyone have a script that implements the encrypting/ decrypting algorithm of User-Password that they'd like to share? I want to be able to input the Authenticator, shared secret, a password, and then get the encrypted password in return (or vice verca). Thanks -- Tore Anderson

3 5

Adding a binary null to a value using attr_rewrite
by Tore Anderson 19 Jul '05

19 Jul '05

Hi. I'm using attr_rewrite to add a Class attribute in my auth- reply packets. I need to include a binary null-byte in the value, but I cannot figure out how to do so. If I add a verbatim null-byte in radiusd.conf, the string is truncated there in the reply packet (seems like the code interprets it at some point as the string terminator). If I write \0 instead, it is simply ignored. Does someone know how to accomplish this? Thanks -- Tore Anderson

2 4

freeradius cisco-avpair problem
by Matthias Wolf 19 Jul '05

19 Jul '05

Hello I have y problem with the cisco-avpairs and a 525 cisco pix. After the pix has gotten the avpairs and created the access-list (e.g. AAA-user-test), the logging-table says that he needs an authorization. But radius and authorization? No really! Here is the line from the logging-table: "Authorization denied (acl= AAA-user-test) for user 'test' from 10.10.10.23/1369 to xx.xx.xx.xx/53 on interface inside". My avpair looks like: "ip:inacl#1=permit tcp host 10.10.10.23 any ". Where is my mistake? Either on the pix or at my kind of avpairs? Muchas gracias, Matthias Wolf

1 0

multiple realm proxying based on huntgroup.
by Roy D. Hockett 19 Jul '05

19 Jul '05

I appoligize if this question is covered somewhere, in docuementation, but I haven't found it. If you can point me to I would greatly appreciate it. I am trying to figure out a way to have different groups of realm proxies for different NAS/huntgroups. For example, for a VPN resouces I don't want realms, but for wireless/wired 802.1x I want to be able to forward to other realms. I would like to do this without running multiple instances of radiusd. I have been able to do this with Merit's AAA server for a long time, but it doesn't support kerberos v5 authentication, nor 802.1x currently. Thanks, -Roy -- /********************************************************************/ /* Roy Hockett * Telephone: (734) 763-7325 */ /* Network Engineer, * FAX: (734) 615-1727 */ /* ITCom, * Internet: royboy(a)umich.edu */ /* University of Michigan * */ /********************************************************************/

2 2

Listen to multiple ports on a single server?
by Erling Paulsen 19 Jul '05

19 Jul '05

Hello. Right now I'm running multiple servers for listening to multiple ports, for having the option of accomadating both NAS'es that use the old 1645 port and the ones using the newer 1812 port for requests. Is there a possibillity to have one radiusd listen to more ports, or do I have to reconfigure/tell all the old external participants to use the new 1812 port? >From what I can read from the docs, I guess it's not possible! Running v.1.0.4 - Erling Paulsen -- ----------------|sig|--- Erling.Paulsen(a)cc.uit.no Nettseksjonen, ITavd UiT

4 4