Maybe that impression stems from reading on multiple sites (other than yours) that the radiusd.conf shouldn't be modified and that the how-to says to add the exec ntlm_auth and some other variables to the radiusd.conf, instead of to the /modules subdir. Maybe I should just ignore the other information I've read about not modifying the radiusd.conf file (which I will now do). After commenting out the changes to mschap (the ntlm_auth command used in that file) and adding the exec ntlm_auth to the radiusd.conf and to the /sites-enabled/default radiusd still seems to be ignoring the ntlm_auth request from my switch; I have double and triple checked that winbindd and krb5 are both operating quite well. [from radiusd -X] Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } [output of authentication attempt] Ready to process requests. rad_recv: Access-Request packet from host *.*.*.200 port 1645, id=13, length=102 User-Name = "windoze_luser" User-Password = "<sekrat>" NAS-Port = 1 NAS-Port-Id = "tty1" NAS-Port-Type = Virtual Calling-Station-Id = "*.*.*.92" NAS-IP-Address = *.*.*.200 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "windoze_luser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 212 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> windoze_luzer attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 13 to 192.168.0.200 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 13 with timestamp +19 Ready to process requests.

? It's up to date with the most recent version of the server. Can you describe what's wrong about the document?

Alan DeKok.

PAP is working: ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "secretz" [pap] Using clear text password "secretz" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 21 to *.*.*.* port 1645 Cisco-AVPair = "shell:priv-lvl=15" Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 21 with timestamp +431 Ready to process requests. For some reason though, even when configured to do so, the authentication attempt coming from a switch or router is not being forwarded to the KDC. I have followed that how-to now to the letter and Active Directory is not working, however active directory and krb are both working fine on the server; [wbinfo -a test%test output] plaintext password authentication failed Could not authenticate user test%test with plaintext password challenge/response password authentication succeeded I'm not sure what I am missing here? Why isn't the login attempt on the switch being forwarded to active directory? Is there something within the switch that meeds to be set? A radius attribute maybe to identify the login attempt as mschap?

Howto will show you how to set up and test with pap first:

yeah I'm trying to authenticate and authorize administrative tty session to the cisco equipment itself, not 802.1x for clients on the network. If it's not possible I guess it's not possible. It does kind of make me wonder how the Cisco ACS works though because that 'proxies' radius or tacacs+ authen and author requests to active directory quite nicely. ________________________________ From: freeradius-users-bounces+blittle=skylight.com@lists.freeradius.org [mailto:freeradius-users-bounces+blittle=skylight.com@lists.freeradius.org] On Behalf Of Rupert Finnigan Sent: Wednesday, December 03, 2008 2:04 PM To: FreeRadius users mailing list Subject: Re: Beating a dead horse, or freeradius 2.1.1 and active directory Hi, I'm not sure if what you're doing is going to work.. You're trying to use MS-CHAP to handle terminal session logins, I think.. Most of the MS-CHAP advise given so far is to get EAP working from a client, say a XP laptop doing 802.1X to gain access to a switchport. Someone will definitely correct me if I'm wrong, but I thought you could only do PAP (or CHAP???) for Authentication to a Terminal line. In which case, you either have to use the plain old users file, use a database such as mysql, or (probably a better solution) use the LDAP module to bind to the AD with the supplied username and password, and allow access if successful. Like I say - I'm really unsure on this one, but as no-ones replied for a while I though it might help... Thanks, Rupes 2008/12/3 Ben Little <BLittle@skylight.com> PAP is working: ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "secretz" [pap] Using clear text password "secretz" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 21 to *.*.*.* port 1645 Cisco-AVPair = "shell:priv-lvl=15" Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 21 with timestamp +431 Ready to process requests. For some reason though, even when configured to do so, the authentication attempt coming from a switch or router is not being forwarded to the KDC. I have followed that how-to now to the letter and Active Directory is not working, however active directory and krb are both working fine on the server; [wbinfo -a test%test output] plaintext password authentication failed Could not authenticate user test%test with plaintext password challenge/response password authentication succeeded I'm not sure what I am missing here? Why isn't the login attempt on the switch being forwarded to active directory? Is there something within the switch that meeds to be set? A radius attribute maybe to identify the login attempt as mschap? > > Howto will show you how to set up and test with pap first: > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Following on from this, I've just had a read of my radiusd.conf file. I'd start by having a look at the ldap module, specifically around the: # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. bit.. This might provide the answer you're looking for. Rupes 2008/12/3 Rupert Finnigan <rupert.finnigan@googlemail.com>

Well, yes - it does proxy them fine.. But is the request from the switch a MS-CHAP one? I don't think it is..

The switch will be sending a PAP request, not a MS-CHAP one, and so you'll need to configure FreeRADIUS to take the PAP request and auth that against AD. As the switch isn't sending a MS-CHAP request then FreeRADIUS can't process it as such, and so MS-CHAP module returns noop. Unfortunately, I'm not clued up enough on FreeRADIUS to help you with this config, but in essence this is what I think you need to do to achieve your goal. 2008/12/3 Ben Little <BLittle@skylight.com>

...

yeah I'm trying to authenticate and authorize administrative tty session to the cisco equipment itself, not 802.1x for clients on the network. If it's not possible I guess it's not possible. It does kind of make me wonder how the Cisco ACS works though because that 'proxies' radius or tacacs+ authen and author requests to active directory quite nicely.

------------------------------

*From:* freeradius-users-bounces+blittle=skylight.com@ lists.freeradius.org [mailto:freeradius-users-bounces+blittle<freeradius-users-bounces%2Bblittle> =skylight.com@lists.freeradius.org] *On Behalf Of *Rupert Finnigan *Sent:* Wednesday, December 03, 2008 2:04 PM *To:* FreeRadius users mailing list *Subject:* Re: Beating a dead horse, or freeradius 2.1.1 and active directory

Hi,

I'm not sure if what you're doing is going to work.. You're trying to use MS-CHAP to handle terminal session logins, I think.. Most of the MS-CHAP advise given so far is to get EAP working from a client, say a XP laptop doing 802.1X to gain access to a switchport.

Someone will definitely correct me if I'm wrong, but I thought you could only do PAP (or CHAP???) for Authentication to a Terminal line. In which case, you either have to use the plain old users file, use a database such as mysql, or (probably a better solution) use the LDAP module to bind to the AD with the supplied username and password, and allow access if successful.

Like I say - I'm really unsure on this one, but as no-ones replied for a while I though it might help...

Thanks,

Rupes

2008/12/3 Ben Little <BLittle@skylight.com>

...

PAP is working:

++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "secretz" [pap] Using clear text password "secretz" [pap] User authenticated successfully ++[pap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 21 to *.*.*.* port 1645 Cisco-AVPair = "shell:priv-lvl=15" Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 21 with timestamp +431 Ready to process requests.

For some reason though, even when configured to do so, the authentication attempt coming from a switch or router is not being forwarded to the KDC. I have followed that how-to now to the letter and Active Directory is not working, however active directory and krb are both working fine on the server;

[wbinfo -a test%test output] plaintext password authentication failed Could not authenticate user test%test with plaintext password challenge/response password authentication succeeded

I'm not sure what I am missing here? Why isn't the login attempt on the switch being forwarded to active directory? Is there something within the switch that meeds to be set? A radius attribute maybe to identify the login attempt as mschap?

...

Howto will show you how to set up and test with pap first:

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

Ben Little wrote:

Yeah, I'm not sure I want to use LDAP (clear text) for authentication.

LDAP is a database, not a password management system. If the incoming Access-Requests contain clear-text passwords, then there is no additional security problem when you check them against LDAP.

I'm starting to think that I can just use md5 passwords in a database or a flat file to manage it, there's really not that many "administrative" users for the cisco equipment. It's either that or pony up several thousands for the Cisco ACS server...it was worth beating my head against a wall for a few days though :-)

Use LDAP. Configure it, and it will work. Alan DeKok.

Well that's certainly news to me... # net ads testjoin Join is OK :-) Just so you know I'm *NOT* trying to configure 802.1x suplicant authentication here, I'm trying to configure radius authentication for administrative access to the vty lines of the cisco equipment in question. I've followed the "how-to" twice now, to the letter of the how-to and it's not working. Did you see the response that suggested that it may not be possible for this to work since the mschap implementation from Cisco is not supported in freeradius? [from eap.conf] # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. Just so you know, windows authentication is working on the tty of the server in question, I can log in as a windoze luser all day long on this particular server which would indicate to me that samba is indeed working just fine.

No. freeradius is working fine. Samba isn't. Try posting your question on their list. That reply suggests that Samba machine wasn't joined to the domain.

Sure thing, here's the entire debug: Rupert had mentioned in this thread that the switch is sending a PAP request and that it isn't being forwarded to the ntlm_auth module because of that, which makes sense I suppose. I am wondering though is there a way to configure the radius server to forward (or proxy) authentication requests to the KDC for authentication? I think what I'm doing is a little outside of the how-to that has been referenced. FreeRADIUS Version 2.1.1, for host i386-redhat-linux-gnu, built on Nov 24 2008 at 10:30:21 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.200 { require_message_authenticator = no secret = "@K3Y4r@d" nastype = "cisco" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=SKYLIGHT --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Ready to process requests. rad_recv: Access-Request packet from host <switch> port 1645, id=46, length=84 User-Name = "rtest" User-Password = "<omitted>" NAS-Port = 2 NAS-Port-Id = "tty2" NAS-Port-Type = Virtual Calling-Station-Id = "<omitted>" NAS-IP-Address = +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rtest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry rtest at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> rtest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 46 to <switch> port 1645 Waking up in 4.9 seconds.

-----Original Message----- From: freeradius-users-bounces+blittle=skylight.com@lists.freeradius .org [mailto:freeradius-users-bounces+blittle=skylight.com@lists.fr eeradius.org] On Behalf Of tnt@kalik.net Sent: Wednesday, December 03, 2008 4:37 PM To: FreeRadius users mailing list Subject: RE: Beating a dead horse, or freeradius 2.1.1 and active directory

...

Just so you know I'm *NOT* trying to configure 802.1x suplicant authentication here, I'm trying to configure radius authentication for administrative access to the vty lines of the cisco equipment in question. I've followed the "how-to" twice now, to the letter of the how-to and it's not working. Did you see the response that suggested that it may not be possible for this to work since the mschap implementation from Cisco is not supported in freeradius?

Plain mschap from Cisco works fine. That relates to Cisco implementation of EAP-MSCHAPv2. So, what "is not working"? Can you post the debug (radiusd -X) of the failed request.

Ivan Kalik Kalik Informatika ISP

- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html