FR + AD host/ machine/ workstation authentication
Im after some documentation on setting up host authentication on freeradius (or an example config). This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to and we all know how touchy the radiusd.conf file is. My files are configured according to this howto: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO and user authentication is working fine. I need host/ machine authentication for laptops that will connect wirelessly to a domain (<- need machine auth) before logon. Thanks in advance.
I trigger machine logon attempt by booting the laptop or logging out of an active session (both seem to work). Near as I can tell the xp machine floods the radius server with authentication attempts. All seem to fail but the last one but it has no effect the machine does not connect to the network. Here is the output of radiusd -X -f -------------------------------------------------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) exec: wait = no exec: program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" Module: Instantiated exec (ntlm_auth) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.10.60.100:1645, id=230, length=173 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0x2523e1e90ec10228245a32fd36191cc2 EAP-Message = 0x0203002101686f73742f416e64792e61646d696e393939392e696e7465726e616c NAS-Port-Type = Wireless-802.11 NAS-Port = 534 NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 3 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 230 to 10.10.60.100 port 1645 EAP-Message = 0x010400061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc276d85e503b5f57349932197e85c357 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=231, length=238 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0x1eca57aa9a1d87b80c8475a95100cc27 EAP-Message = 0x0204005019800000004616030100410100003d0301468de1e1ad8b3454deaf1f03107d8ea1b1fd7488d932794a51f24b760e42b47b00001600040005000a000900640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0xc276d85e503b5f57349932197e85c357 NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 4 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0694], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 231 to 10.10.60.100 port 1645 EAP-Message = 0x0105040a19c0000006f1160301004a020000460301468de237724b36432833e8ae773f91588d1f596957c0dca8c392b28668f20a362063b6d7ccf98cb0c9fd0aade254013fd000eae3fa193f874e0a60e0d0e6752b1e00040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d0bbe37a4233054aaa38f9163328ddc Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=232, length=164 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0x8c241367c99a5e476ebb6605bddb3dc7 EAP-Message = 0x020500061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0x2d0bbe37a4233054aaa38f9163328ddc NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: EAP packet type response id 5 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 2 modcall: leaving group authenticate (returns handled) for request 2 Sending Access-Challenge of id 232 to 10.10.60.100 port 1645 EAP-Message = 0x010602f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8f089409df9565a3c4900226f7e56bf6 Finished request 2 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=233, length=350 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0x44fa24e07b220732a049dc9c1de6c20e EAP-Message = 0x020600c01980000000b6160301008610000082008083c8d8d05b60b1f832ad022e1339b892a33179431ff76e73a19989e5330aa5290a7be558aedd07f51d4e815fe4b9793e854d3b91eca7a15422d88eba6f83347a9486f9af78df46dfd024060913a0dd490ec3b6b3800d9b1a0199274b5bfb35205e106bdfa9e1d6195fb459ced84601bd75258ef0fb67d920c016847bbe45c73f14030100010116030100203c926f63f0fcba99f77ebd244c447a9899437953c3d1f4035366edc8ee62096e NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0x8f089409df9565a3c4900226f7e56bf6 NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 6 length 192 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns updated) for request 3 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 3 modcall: leaving group authenticate (returns handled) for request 3 Sending Access-Challenge of id 233 to 10.10.60.100 port 1645 EAP-Message = 0x010700311900140301000101160301002046a48a970827beaefe467e5239033739cd912ad368e59590e6fe62d8f80fb03b Message-Authenticator = 0x00000000000000000000000000000000 State = 0x045fbb5b828bcb0abd632ce958a07b72 Finished request 3 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=234, length=164 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0xf8bc42acfd8d09f6a84208c6baadec37 EAP-Message = 0x020700061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0x045fbb5b828bcb0abd632ce958a07b72 NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap_peap: EAPTLS_SUCCESS modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 234 to 10.10.60.100 port 1645 EAP-Message = 0x0108002019001703010015321cf8d56cb1f1a03c225d49c42f66d13f5a2f3721 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x31308d282a1b87eddaa42a7184e0e04f Finished request 4 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=235, length=214 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0x7271694018f90d3de21e76c419f11ecc EAP-Message = 0x020800381900170301002defcd1877cce20fca24bfa89f483bd9eb5b993743beefcaaca5694564b710adabd4b096f348bc15b5d292e32af3 NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0x31308d282a1b87eddaa42a7184e0e04f NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 8 length 56 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Identity - host/Andy.admin9999.internal rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled identity of host/Andy.admin9999.internal PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to host/Andy.admin9999.internal Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 8 length 33 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 235 to 10.10.60.100 port 1645 EAP-Message = 0x0109004d1900170301004287b3e056b3506e87c46f4025cd8fe82ca5238ec990e44009ec2c28f4e97e00967e47ad16d711dd0326c2352133e1851c4525bc34dc3a7326c443afa44620a987bc3a Message-Authenticator = 0x00000000000000000000000000000000 State = 0x77077d32d71be4d6c564882f6fb60d57 Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=236, length=268 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0x7a715269d85279134023d9536bdd2cb2 EAP-Message = 0x0209006e190017030100631d7e0b65940fee89ae81c5fff65e48e67432514590414d58679f8d4d1f77aceeec91cf6a6a03a2c584b1f8b8f23930abe374c592dd7e8d560be2fdd56032c9d6b7c7d35a3e5e44bdb659eaa65bda196474e267fc99cbe6bcbacfe54731dca7acfe270b NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0x77077d32d71be4d6c564882f6fb60d57 NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 9 length 110 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to host/Andy.admin9999.internal PEAP: Adding old state with 5d cd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 9 length 87 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/Andy.admin9999.internal with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=Andy$' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=admin9999' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: a1 radius_xlat: '--challenge=d86cb80cb2cc9af6' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=7010e83a5b08ff6401e35e1f5916396538272a88a162a194' Exec-Program output: NT_KEY: 18B3A6F684E6D9218D8F63B68904C2D2 Exec-Program-Wait: plaintext: NT_KEY: 18B3A6F684E6D9218D8F63B68904C2D2 Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 6 modcall: leaving group MS-CHAP (returns ok) for request 6 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 PEAP: Got tunneled Access-Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 236 to 10.10.60.100 port 1645 EAP-Message = 0x010a004a1900170301003f726dc11f92239b4b6caeed265ceae458ac7fedb07a4b2f0f0aa50462f17cf8d6a900e951409858c8aebf646010c0dbe98a879ea005e4dae247eb2934e3dff8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa168c2e0b53133afd0a311fb0bf8f811 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=237, length=187 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0xea60ea17b5edfb26edac34350b90b637 EAP-Message = 0x020a001d1900170301001278e3b9573450220cdb29024bc6027d060edc NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0xa168c2e0b53133afd0a311fb0bf8f811 NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 10 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to host/Andy.admin9999.internal PEAP: Adding old state with cf 94 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 10 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 7 modcall: leaving group authenticate (returns ok) for request 7 PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 237 to 10.10.60.100 port 1645 EAP-Message = 0x010b00261900170301001b06cc271b7548a332478a374812dfd4d32259c6a408fe83593e883f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x611781a98805ebe2fff178d0af7f3e73 Finished request 7 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.10.60.100:1645, id=238, length=196 User-Name = "host/Andy.admin9999.internal" Framed-MTU = 1400 Called-Station-Id = "001b.d526.8210" Calling-Station-Id = "0040.96a1.f472" Service-Type = Login-User Message-Authenticator = 0xac0657f2fbdcafe9e281ff37aa937856 EAP-Message = 0x020b00261900170301001bfccca09312fe89c03d3dc8a9a4a5e1b7ab536489f14fa304840ee6 NAS-Port-Type = Wireless-802.11 NAS-Port = 534 State = 0x611781a98805ebe2fff178d0af7f3e73 NAS-IP-Address = 10.10.60.100 NAS-Identifier = "TESTAP" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "host/Andy.admin9999.internal", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 11 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 238 to 10.10.60.100 port 1645 MS-MPPE-Recv-Key = 0xbba590b48209b4e284f1b69dc04d04c0db3b2e5f487e30c9b2554d3e9b14c8c3 MS-MPPE-Send-Key = 0xa41125592b9aab7510bfcee91fb53cb91bf49fba67a0ad95879538526a78edff EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/Andy.admin9999.internal" Finished request 8 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 230 with timestamp 468de237 Cleaning up request 1 ID 231 with timestamp 468de237 Cleaning up request 2 ID 232 with timestamp 468de237 Cleaning up request 3 ID 233 with timestamp 468de237 Cleaning up request 4 ID 234 with timestamp 468de237 Cleaning up request 5 ID 235 with timestamp 468de237 Cleaning up request 6 ID 236 with timestamp 468de237 Cleaning up request 7 ID 237 with timestamp 468de237 Cleaning up request 8 ID 238 with timestamp 468de237 Nothing to do. Sleeping until we see a request. -------------------------------------------------------------- On 7/6/07, Jacob Jarick <mem.namefix@gmail.com> wrote:
Im after some documentation on setting up host authentication on freeradius (or an example config).
This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to and we all know how touchy the radiusd.conf file is.
My files are configured according to this howto: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO and user authentication is working fine.
I need host/ machine authentication for laptops that will connect wirelessly to a domain (<- need machine auth) before logon.
Thanks in advance.
As per my previous emails, you can see the rlm_mschap is doing the expansion correctly without Novells hack:
modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/Andy.admin9999.internal with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=Andy$' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=admin9999' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: a1 radius_xlat: '--challenge=d86cb80cb2cc9af6' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=7010e83a5b08ff6401e35e1f5916396538272a88a162a194' Exec-Program output: NT_KEY: 18B3A6F684E6D9218D8F63B68904C2D2 Exec-Program-Wait: plaintext: NT_KEY: 18B3A6F684E6D9218D8F63B68904C2D2
...and your radius server sends an accept:
Sending Access-Accept of id 238 to 10.10.60.100 port 1645 MS-MPPE-Recv-Key = 0xbba590b48209b4e284f1b69dc04d04c0db3b2e5f487e30c9b2554d3e9b14c8c3 MS-MPPE-Send-Key = 0xa41125592b9aab7510bfcee91fb53cb91bf49fba67a0ad95879538526a78edff EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/Andy.admin9999.internal" Finished request 8
If your machine isn't on the network at this point, the problem lies with your NAS, not FreeRadius. I would investigate there I see it's wireless - what type of AP? Looks like a Cisco to me.
Phil & A.L Thanks alot for this new information I have to rebuild my network again (big shift around at work) and test again. On 7/7/07, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
As per my previous emails, you can see the rlm_mschap is doing the expansion correctly without Novells hack:
modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/Andy.admin9999.internal with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=Andy$' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=admin9999' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: a1 radius_xlat: '--challenge=d86cb80cb2cc9af6' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=7010e83a5b08ff6401e35e1f5916396538272a88a162a194' Exec-Program output: NT_KEY: 18B3A6F684E6D9218D8F63B68904C2D2 Exec-Program-Wait: plaintext: NT_KEY: 18B3A6F684E6D9218D8F63B68904C2D2
...and your radius server sends an accept:
Sending Access-Accept of id 238 to 10.10.60.100 port 1645 MS-MPPE-Recv-Key = 0xbba590b48209b4e284f1b69dc04d04c0db3b2e5f487e30c9b2554d3e9b14c8c3 MS-MPPE-Send-Key = 0xa41125592b9aab7510bfcee91fb53cb91bf49fba67a0ad95879538526a78edff EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "host/Andy.admin9999.internal" Finished request 8
If your machine isn't on the network at this point, the problem lies with your NAS, not FreeRadius. I would investigate there
I see it's wireless - what type of AP? Looks like a Cisco to me.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to and we all know how touchy the radiusd.conf file is.
those parts can go pretty much anywhere in the main config file - eg stick them at the end of the file. from what I can see of the log the NTLM is working fine - the NTKEY reply matched and its all okay. which leaves me to assume that a config on the client isnt correct - is the machine configured to validate the RADIUS server and does it have the correct 'tick' for the certificate and host name for the server to validate? alan
config on client follows exactly what the howto reccomends with the 1 change of checking "authenticate as computer when computer information is available". Which as you can see does attempt to auth. The cert options are set as in this picture: http://wiki.freeradius.org/Image:100000000000017F000001D2C7856F9F.png I just reread this section here on the howto "Certificate validation is strongly recommended for wireless configurations, and optional for wired deployments. Select « Validate server certificate » and check ONLY the CA for your FreeRADIUS server (the one you installed above). Also select « Connect to these servers » and enter the Common Name of the server certificate. If you are configuring a wired ethernet interface, you can leave certificate verification off in your supplicants: just deselect « Validate server certificate ». Either way, select « EAP-MSCHAP v2 » as authentication method. Click the « Configure » button next." So I will enable cert validation retry and post back. Cheers for the info /tip :) On 7/6/07, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to and we all know how touchy the radiusd.conf file is.
those parts can go pretty much anywhere in the main config file - eg stick them at the end of the file.
from what I can see of the log the NTLM is working fine - the NTKEY reply matched and its all okay. which leaves me to assume that a config on the client isnt correct - is the machine configured to validate the RADIUS server and does it have the correct 'tick' for the certificate and host name for the server to validate?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
quick question, should machine authentication work if I follow the howto on a base system or will I need to add attr_rewrite's as suggested in the novell howto. On 7/6/07, Jacob Jarick <mem.namefix@gmail.com> wrote:
config on client follows exactly what the howto reccomends with the 1 change of checking "authenticate as computer when computer information is available". Which as you can see does attempt to auth.
The cert options are set as in this picture: http://wiki.freeradius.org/Image:100000000000017F000001D2C7856F9F.png
I just reread this section here on the howto "Certificate validation is strongly recommended for wireless configurations, and optional for wired deployments.
Select « Validate server certificate » and check ONLY the CA for your FreeRADIUS server (the one you installed above). Also select « Connect to these servers » and enter the Common Name of the server certificate.
If you are configuring a wired ethernet interface, you can leave certificate verification off in your supplicants: just deselect « Validate server certificate ».
Either way, select « EAP-MSCHAP v2 » as authentication method. Click the « Configure » button next."
So I will enable cert validation retry and post back.
Cheers for the info /tip :)
On 7/6/07, A.L.M.Buxey@lboro.ac.uk <A.L.M.Buxey@lboro.ac.uk> wrote:
Hi,
This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to and we all know how touchy the radiusd.conf file is.
those parts can go pretty much anywhere in the main config file - eg stick them at the end of the file.
from what I can see of the log the NTLM is working fine - the NTKEY reply matched and its all okay. which leaves me to assume that a config on the client isnt correct - is the machine configured to validate the RADIUS server and does it have the correct 'tick' for the certificate and host name for the server to validate?
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, 2007-07-06 at 10:22 +0100, A.L.M.Buxey@lboro.ac.uk wrote:
Hi,
quick question, should machine authentication work if I follow the howto on a base system or will I need to add attr_rewrite's as suggested in the novell howto.
you will need to do the attr_rewrites or the host name wont be munged properly
I thought recent versions of the server handle this properly *IF* you use %{mschap:User-Name} in the appropriate places - certainly the mschap_xlat function contains the relevant code to expand "host/x.y" into "x$"
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi,
those parts can go pretty much anywhere in the main config file - eg stick them at the end of the file.
Nope.
sorry, yes - they must go into the config file BEFORE they are instantiated before a module. ie if you are calling them from authorize, then put them into the config before that section. alan
Jacob Jarick wrote:
This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to
If it's not clear, you don't understand how the configuration files work.
and we all know how touchy the radiusd.conf file is.
Ah, yes. There's nothing quite like asking for help and insulting the project in the same message. Alan DeKok.
If it's not clear, you don't understand how the configuration files work.
Well yes Alan, thats why I was asking for help on the subject If I was 100% on the subject I wouldnt request conformation or information would I ?
Ah, yes. There's nothing quite like asking for help and insulting the project in the same message.
Not everything comment / criticism about free radius is a vieled insult at you or your work Alan (rolls eyes). saying the radiusd.conf is touchy is a fail call, since it is and most people offering help warn / suggest about changing 1 line at a time. On 7/6/07, Alan DeKok <aland@deployingradius.com> wrote:
Jacob Jarick wrote:
This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or user based authentication, modify the RADIUSD.CONF file by adding the following lines:" doesnt say where or what section to add said lines to
If it's not clear, you don't understand how the configuration files work.
and we all know how touchy the radiusd.conf file is.
Ah, yes. There's nothing quite like asking for help and insulting the project in the same message.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jacob Jarick wrote:
Not everything comment / criticism about free radius is a vieled insult at you or your work Alan (rolls eyes). saying the radiusd.conf is touchy is a fail call, since it is and most people offering help warn / suggest about changing 1 line at a time.
Saying the configuration file is "touchy" is an admission that you don't understand how it works, and that you don't have a methodical approach to changing it. The recommendations aren't to change a line at a time. The recommendations are to have a methodical approach to creating a new configuration. And to read the documentation. Alan DeKok.
If you wish to split hairs over a single line in my email that you purposefully skewed the meaning off by all means be that guy. Should you have anything constructive at all to offer the conversation please do, however petty criticisms are not welcome though. On 7/9/07, Alan DeKok <aland@deployingradius.com> wrote:
Jacob Jarick wrote:
Not everything comment / criticism about free radius is a vieled insult at you or your work Alan (rolls eyes). saying the radiusd.conf is touchy is a fail call, since it is and most people offering help warn / suggest about changing 1 line at a time.
Saying the configuration file is "touchy" is an admission that you don't understand how it works, and that you don't have a methodical approach to changing it.
The recommendations aren't to change a line at a time. The recommendations are to have a methodical approach to creating a new configuration.
And to read the documentation.
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jacob Jarick wrote:
If you wish to split hairs over a single line in my email that you purposefully skewed the meaning off by all means be that guy. Should you have anything constructive at all to offer the conversation please do, however petty criticisms are not welcome though.
So why do you engage in petty criticisms of FreeRADIUS? Alan DeKok.
Fussy config file = petty criticism ? If so deal with it you will hear far worse I'm sure. Why not be honest ? and admit that all your really after is to continue the conflict we hard several months ago. So can we drop it please? If nothing else this is counter productive. I'm very surprised your still upset from previous clash which I had let lie. To be still looking for conflict after all this time is quite sad. so there is no misunderstanding: * The Freeradius configs are the touchiest fussiest config files I have ever dealt with, this in no way reflects on the product itself. It is just a very steep learning curve. I also am aware that most of the complexity is due to it supporting many many protocols and backends. * Freeradius Documentation is lacking (its a common thing for oss projects). That is a statement, not a shot at any of the howto writers. Again I do realise that this is due to the diversity of the project (many different possible configurations). I will gladly help document my current setup once finalized. * I despise people whose only purpose in a thread to be a obnoxious self-important git. To clarify on this most recent occasion that would be you Alan, though I have seen you been very helpful on other threads. The last thing a frustrated user who has been making an honest attempt needs to hear is "your an idiot, rtfm, upgrade, etc" <- paraphrasing of course. On 7/9/07, Alan DeKok <aland@deployingradius.com> wrote:
Jacob Jarick wrote:
If you wish to split hairs over a single line in my email that you purposefully skewed the meaning off by all means be that guy. Should you have anything constructive at all to offer the conversation please do, however petty criticisms are not welcome though.
So why do you engage in petty criticisms of FreeRADIUS?
Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Jacob Jarick wrote:
Fussy config file = petty criticism ?
When it's clear that you aren't following the documentation or recommended methods, yes.
* I despise people whose only purpose in a thread to be a obnoxious self-important git.
As opposed to someone who offer gratuitous slams at a product, and then asks for help? Try that with a mechanic: "The last repair you did was shoddy. Can you fix my car now?" A mechanic would use choicer words than I have used. Or, he'd smile, do the repair, and purposefully break something else so that you'd have to come in again, and again... If you're going to ask for help, don't insult the people and the project in the same message. My purpose in being a "self important git" is to point out that your posts are rude. I recognize that you are offended by that. Alan DeKok.
On 7/9/07, Alan DeKok <aland@deployingradius.com> wrote:
Jacob Jarick wrote:
Fussy config file = petty criticism ?
When it's clear that you aren't following the documentation or recommended methods, yes.
Yes I do indeed follow the documentation but alas this is another tired argument you seem bent on dredging up, so you can either repeat yourself yet again or stop calling me a liar. Mailing list / forum questions are always the end result of alot of research on my end that hasn't yielded needed information. Sometimes I may miss something obvious for that I am so sorry I am but a mere human. Rest assured I always try to double and triple check my work, it is a habit I have used for many years to compensate for my dyslexia. Recommended methods are exactly what I'm after, currently there are none listed in your wiki, howtos etc for this particular setup.
* I despise people whose only purpose in a thread to be a obnoxious self-important git.
As opposed to someone who offer gratuitous slams at a product, and then asks for help?
Try that with a mechanic: "The last repair you did was shoddy. Can you fix my car now?"
A mechanic would use choicer words than I have used. Or, he'd smile, do the repair, and purposefully break something else so that you'd have to come in again, and again...
If you're going to ask for help, don't insult the people and the project in the same message. My purpose in being a "self important git" is to point out that your posts are rude. I recognize that you are offended by that.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
my 2n comment was referring to my current project (ntlm auth + conditional auth if ldap Field dialupaccess =1 On 7/9/07, Jacob Jarick <mem.namefix@gmail.com> wrote:
On 7/9/07, Alan DeKok <aland@deployingradius.com> wrote:
Jacob Jarick wrote:
Fussy config file = petty criticism ?
When it's clear that you aren't following the documentation or recommended methods, yes.
Yes I do indeed follow the documentation but alas this is another tired argument you seem bent on dredging up, so you can either repeat yourself yet again or stop calling me a liar. Mailing list / forum questions are always the end result of alot of research on my end that hasn't yielded needed information. Sometimes I may miss something obvious for that I am so sorry I am but a mere human. Rest assured I always try to double and triple check my work, it is a habit I have used for many years to compensate for my dyslexia.
Recommended methods are exactly what I'm after, currently there are none listed in your wiki, howtos etc for this particular setup.
* I despise people whose only purpose in a thread to be a obnoxious self-important git.
As opposed to someone who offer gratuitous slams at a product, and then asks for help?
Try that with a mechanic: "The last repair you did was shoddy. Can you fix my car now?"
A mechanic would use choicer words than I have used. Or, he'd smile, do the repair, and purposefully break something else so that you'd have to come in again, and again...
If you're going to ask for help, don't insult the people and the project in the same message. My purpose in being a "self important git" is to point out that your posts are rude. I recognize that you are offended by that.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Fri, 2007-07-06 at 14:14 +0800, Jacob Jarick wrote:
Im after some documentation on setting up host authentication on freeradius (or an example config).
This url here looks like what I need http://support.novell.com/docs/Tids/Solutions/10100693.html but their instructions are pretty lousy "For machine-based authentication or
Recent versions of the server have the code in rlm_mschap to do the attribute rewriting for you. The important thing is to use the %{mschap:User-Name} expansion anywhere you'd use User-Name. I note this is not the used in the default commented configs and in many examples. Using a recent version of the server and ignore the Novell instructions, just using the FR wiki document you link, what error do you get when a machine authentication is attempted?
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Jacob Jarick -
Phil Mayers