Unknown value ntlm_auth for attribute Auth-Type
Hello again, First off, thanks go to all who provided the excellent documentation available on the FR wiki, and affiliated sites. Because of that documentation, I have FR 2.0.3 installed on CentOS 5.1, and it is working rather nicely for Cisco port-based 802.1x authentication via Active Directory (2k3 server). I have now configured LDAP-based Group authorization for Cisco privileged access to the routers/switches in our network. I have the authorization side working great, but I've run into a problem trying to get AD authorization to work: Passwords are not checked at all. Authentication is not happening through FR for these logins. As long as a valid user account from AD is supplied, and as long as that user is in the proper group, ("Network Managers" or "Switch Access") instant shell access is granted regardless of the password supplied, and they are immediately dropped into the designated privilege level for that group. I presume the immediate cause of this problem is the "Auth-Type := Accept" in my users file. My first instinct (after reading *tons* of mailing lists and forum posts) was to simply remove the Auth-Type attribute, and see if FR would find a way. Unfortunately, I receive an error stating "No authenticate method (Auth-Type) configuration found for the request", and the request is rejected. Next, I decided to try a different Auth-Type. However, anytime I try to provide an alternative Auth-Type, FR refuses to start with "Unknown value for <insert Auth-Type of choice here> for attribute Auth-Type". I have specifically tried to use ntlm_auth because that would be my preferred method of authentication between FR and AD. When I attempted to use ntlm_auth as the Auth-Type, I received the "Unknown Value" message. I also tried adding an entry for it in the sites_available/default file under the "authorize" section to see if that helped. I received the same error. Next, I tried adding it to the "instantiate" section just out of curiosity, and received a new error stating "Cannot find a configuration entry for module ntlm_auth". Am I even moving in the right direction with this? I know there are people out there who must be using a configuration similar to this setup. I have attached all of the relevant configuration files, cisco configs, and debug logs from my test lab for your review. *edit* The files take me 12K over the 100K size limit for a posting, so I will send the debug logs in a reply to this post. I will gladly accept any assistance, advice, known working configs, or suggestions you may have regarding this issue. And if I've just royally screwed something up, I'd like to know that too. Heck, if you see *anything* that doesn't make sense in my configuration setup, please feel free to bring it to my attention. Thanks in advance, Charles Jones
Next, I decided to try a different Auth-Type. However, anytime I try to provide an alternative Auth-Type, FR refuses to start with "Unknown value for <insert Auth-Type of choice here> for attribute Auth-Type". I have specifically tried to use ntlm_auth because that would be my preferred method of authentication between FR and AD. When I attempted to use ntlm_auth as the Auth-Type, I received the "Unknown Value" message. I also tried adding an entry for it in the sites_available/default file under the "authorize" section to see if that helped. I received the same error. Next, I tried adding it to the "instantiate" section just out of curiosity, and received a new error stating "Cannot find a configuration entry for module ntlm_auth".
Don't set Auth-Type. Add ntlm_auth to authenticate not authorize section. And instantiate exec module. Ivan Kalik Kalik Informatika ISP
Thanks for the response. My apologies, it was a typo when I wrote "authorize". I meant "authenticate" in that paragraph. The ntlm_auth entry is already located inside the authentication section of the sites-available/default file. I should have included that file initially, but was a little pressed for space due to the size constraints on the mailing list. I will include it in this response if it will help. Perhaps I am not entering the information correctly. In the file, you can see the 3 different methods I used to try to implement the authentication. I have already tried removing the "Auth-Type" attributes from the entries in my users file, and as far as I can tell, exec was already instantiated in my current configs. So with this suggestion, I am back to "No authenticate method (Auth-Type) configuration found for the request", and the request is rejected. Again, thanks for the assistance. I hope I am just making some sort of simple mistake somewhere in the configs. Respectfully, Charles Jones On Thu, Apr 3, 2008 at 9:07 AM, Ivan Kalik <tnt@kalik.net> wrote:
Next, I decided to try a different Auth-Type. However, anytime I try to provide an alternative Auth-Type, FR refuses to start with "Unknown value for <insert Auth-Type of choice here> for attribute Auth-Type". I have specifically tried to use ntlm_auth because that would be my preferred method of authentication between FR and AD. When I attempted to use ntlm_auth as the Auth-Type, I received the "Unknown Value" message. I also tried adding an entry for it in the sites_available/default file under the "authorize" section to see if that helped. I received the same error. Next, I tried adding it to the "instantiate" section just out of curiosity, and received a new error stating "Cannot find a configuration entry for module ntlm_auth".
Don't set Auth-Type. Add ntlm_auth to authenticate not authorize section. And instantiate exec module.
Ivan Kalik Kalik Informatika ISP
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Thu, Apr 3, 2008 at 9:07 AM, Ivan Kalik <tnt@kalik.net> wrote:
Don't set Auth-Type. Add ntlm_auth to authenticate not authorize section. And instantiate exec module.
Ivan Kalik Kalik Informatika ISP
After further experimentation, I found that if I create a new "ntlm_autz" instance by making a renamed copy of the "ntlm_auth" module, and adding it to the "authorize" section of sites-available/default, the authorization version is called, and works just fine. However, I can not seem to get anything I add to the "authenticate" section of sites-available/default to take effect. I have exec instantiated, and no "Auth-Type" set in my users file. Even after following your suggestion, I get "No authenticate method (Auth-Type) configuration found for the request". Is this perhaps a bug? Thanks, Charles Jones
Send the debug with ntlm_auth listed in authenticate section. Does ntlm_auth appear on the debug after eap? Ivan Kalik Kalik Informatika ISP Dana 3/4/2008, "Charles Jones" <linuxchuck@gmail.com> piše:
On Thu, Apr 3, 2008 at 9:07 AM, Ivan Kalik <tnt@kalik.net> wrote:
Don't set Auth-Type. Add ntlm_auth to authenticate not authorize section. And instantiate exec module.
Ivan Kalik Kalik Informatika ISP
After further experimentation, I found that if I create a new "ntlm_autz" instance by making a renamed copy of the "ntlm_auth" module, and adding it to the "authorize" section of sites-available/default, the authorization version is called, and works just fine. However, I can not seem to get anything I add to the "authenticate" section of sites-available/default to take effect. I have exec instantiated, and no "Auth-Type" set in my users file. Even after following your suggestion, I get "No authenticate method (Auth-Type) configuration found for the request". Is this perhaps a bug?
Thanks,
Charles Jones - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
2008/4/3 Ivan Kalik <tnt@kalik.net>:
Send the debug with ntlm_auth listed in authenticate section. Does ntlm_auth appear on the debug after eap?
I see no mention of ntlm_auth outside of the mschap module anywhere in the logs. I've attached full debug output, and my current sites-enabled/default config as well to ensure there is minimal confusion. Thank you, Charles Jones
OK. I can see it instantiated. But you would need unlang to call it as there is nothing to set the Auth-Type. There is another way in dealing with pap requests to AD avoiding ntlm_auth. Uncomment Auth-Type {ldap} in authenticate section and change: set_auth_type = no to yes in ldap configuration. Then you can do ldap "bind as user" authentication for pap requests. Ivan Kalik Kalik Informatika ISP Dana 4/4/2008, "Charles Jones" <linuxchuck@gmail.com> piše:
2008/4/3 Ivan Kalik <tnt@kalik.net>:
Send the debug with ntlm_auth listed in authenticate section. Does ntlm_auth appear on the debug after eap?
I see no mention of ntlm_auth outside of the mschap module anywhere in the logs.
I've attached full debug output, and my current sites-enabled/default config as well to ensure there is minimal confusion.
Thank you,
Charles Jones
2008/4/4 Ivan Kalik <tnt@kalik.net>:
OK. I can see it instantiated. But you would need unlang to call it as there is nothing to set the Auth-Type.
There is another way in dealing with pap requests to AD avoiding ntlm_auth. Uncomment Auth-Type {ldap} in authenticate section and change:
set_auth_type = no
to yes in ldap configuration. Then you can do ldap "bind as user" authentication for pap requests.
Thanks for the suggestion. I will look into learning unlang, and see if I can get it to set the Auth-Type for me. I would try the PAP method you suggest, however, I need to try to get this to work using ntlm if at all possible. I appreciate the help, and will try this out once I read through the man-page for unlang. Thanks! Charles Jones
participants (2)
-
Charles Jones -
Ivan Kalik