- Freeradius-Users - lists.freeradius.org

RE: How can i authenticate my users against Active Directory?
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

Well I am not running radiusd on my Linux box. Do I need to run radiusd on my Linux Box even though my radius server is running on a MS windows 2000 server? I thought only thing I had to do is setup pam_radius_auth to talk to my radius server. ___________________ Puneet Talwar -----Original Message----- From: Dusty Doris [mailto:freeradius@mail.doris.cc] Sent: Wednesday, June 29, 2005 4:15 PM To: FreeRadius users mailing list Subject: RE: How can i authenticate my users against Active Directory? > See I am trying to authenticate against the AD, but in my case the RADIUS > server is running on a Windows Server and my client is a Linux box. But > the problem I am having is that when I try to authenticate against the AD > from my Linux box I get error message in /var/log/messages > > login[4578]: pam_radius_auth: RADIUS server <Windows_Radius_Server > IP_address> failed to respond > login[4578]: pam_radius_auth: All RADIUS servers failed to respond. > > When I go check the log on the Radius server I can see the login attempts > that are made from the Linux box. > > So I am not sure where else I can see what I am doing wrong here. > What does the radius server show in debug mode? radiusd -X - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: How can i authenticate my users against Active Directory?
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

See I am trying to authenticate against the AD, but in my case the RADIUS server is running on a Windows Server and my client is a Linux box. But the problem I am having is that when I try to authenticate against the AD from my Linux box I get error message in /var/log/messages login[4578]: pam_radius_auth: RADIUS server <Windows_Radius_Server IP_address> failed to respond login[4578]: pam_radius_auth: All RADIUS servers failed to respond. When I go check the log on the Radius server I can see the login attempts that are made from the Linux box. So I am not sure where else I can see what I am doing wrong here. __________________________ Puneet Talwar -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Wednesday, June 29, 2005 2:05 PM To: FreeRadius users mailing list Subject: Re: How can i authenticate my users against Active Directory? Dusty Doris <freeradius(a)mail.doris.cc> wrote: > You can always do an ldap search to AD for authorization and if the > password is coming over in clear text, you could just do a bind against AD > for authentication. Correct? Yes. But this won't work for PEAP. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

external script stays in <defunct> state after executing
by rashad 29 Jun '05

29 Jun '05

Still can't solve the problem. External script fired according to acct_users file stays in <defunct> state for every call. acct_users file: DEFAULT Acct-Status-Type == Stop Exec-Program = "/usr/local/sbin/testacct.php" My conf: Debian Linux 3.0 Freeradius: 1.0.4

3 2

RE: PAM_RADIUS_AUTH
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

See I am not sure if there is an option to increase the debugging level w/out edit the source code. If I have not choice to I will edit the source code to increase debugging level. __________________________ Puneet Talwar -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Wednesday, June 29, 2005 2:04 PM To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > Can you please tell me which source code to modify? The source code to pam_radius_auth? You did say you wanted more debugging information from it. Why would you edit the source code to anything else? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

How can i authenticate my users against Active Directory?
by Schuster Christian 29 Jun '05

29 Jun '05

Hi @ all, I'm a freeradius newbie and try to authenticate a user against a active directory . My freeradius has version 1.0.2 I googled a lot and found differend hints how to implement this. (ntlm, pam-module), but no configuration example. Which of these ways is the securest way? Are there any other possibilities? Are there any manuals/helps or can someone discribe me how to implement this? thx Christian Schuster

4 5

Re: PAM_RADIUS_AUTH
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

Can you please tell me which source code to modify? Thanks ------Original Message------ From: Alan DeKok To: FreeRadius users mailing list ReplyTo: FreeRadius users mailing list Sent: Jun 29, 2005 1:06 PM Subject: Re: PAM_RADIUS_AUTH "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > I would like to know is there any way to increase the debug level on > PAM_RADIUS_AUTH module. Source code modifications. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -------------------------- Sent from my BlackBerry Wireless Handheld

2 1

Windows -> VPN -> Radius
by Roberto Greiner 29 Jun '05

29 Jun '05

Hi, I'm having the following problem: I'm trying to establish a VPN server, where most of the clients are Windows XP/2K machines. As VPN server I'm using a Debian Sarge box running PopTop 1.2.1, which sends the autentication MS-CHAPv2 requests to my other Debian Sarge box running Freeradius 1.0.4, using my-sql v. 12.22 as database for users/accounting. Problem: Windows sends the user info as a Chap challenge, and as a result the Freeradius server reports that the user request came with no password. Did somebody face a similiar problem? Can someone helpme/point in the right direction? Thank you, Marcos Roberto Radius.log entries: Mon Jun 27 10:15:16 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Jun 27 10:15:16 2005 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Jun 27 10:15:16 2005 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jun 27 10:15:16 2005 : Info: Ready to process requests. Mon Jun 27 10:15:40 2005 : Auth: Login incorrect: [testuser/<no User-Password attribute>] (from client localhost port 0 cli aaa.bbb.ccc.ddd) (IP address edited....)

3 4

ldap authentication error.
by DK 29 Jun '05

29 Jun '05

Hi, I´m trying to configure freeradius to authenticate to LDAP server. I use an users file and ldap server to authenticate, the first one goes well but when I ytry to do it with LDAP server, a get this error. rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "ldap" returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Any idea? Thanks

2 1

How the freeradius-server can get username/password from Win2k-Se rver ?
by Schuster Christian 29 Jun '05

29 Jun '05

Hi @ all, I'm a freeradius newbie and try that the freeradius(version 1.0.2) get their users (and passwords) by domain from the active directory. I googled a lot and found differend ways for this. (ntlm, pam-module). Which of these ways is the securest way? Are their any other possibilities? Are their any manuals/helps therefore or can someone discribe me how to implement this? thx schustn

2 1

PAM_RADIUS_AUTH
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

I would like to know is there any way to increase the debug level on PAM_RADIUS_AUTH module. I am having a hard time connect to the radius server which is running on Window 2000 server. Plus I am not sure if I got the pam login file correct in /etc/pam.d/login The OS I am running is RH ES WS v4.0 #%PAM-1.0 auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_unix_auth.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth session optional pam_console.so # pam_selinux.so open should be the last session rule session required pam_selinux.so multiple open __________________________ Puneet Talwar

2 1