Re: (freeradius 3) I'm trying to integrate freeradius with active directory in cenos 7.
Thanks, I saw this link and tryied these steps... ntlm_auth --request-nt-key --domain=TEST.UY --username=administrator --password=xxxx could not obtain winbind separator! Reading winbind reply failed! (0x01) : (0x0) I already joined the Active Directory domain with the procedure previously posted, I need to start from here and not undo my working configuration. Any help please? On Fri, Sep 16, 2016 at 6:34 PM, Marcelo Martinez < marcelo.martinez@nexa.com.uy> wrote:
Thanks,
I saw this link and tryied these steps...
ntlm_auth --request-nt-key --domain=TEST.UY --username=administrator --password=xxxx could not obtain winbind separator! Reading winbind reply failed! (0x01) : (0x0)
I already joined the Active Directory domain with the procedure previously posted, I need to start from here and not undo my working configuration.
Any help please?
On Fri, Sep 16, 2016 at 6:01 PM, Alan DeKok-2 [via FreeRADIUS] < ml-node+s1045715n5742599h53@n5.nabble.com> wrote:
On Sep 16, 2016, at 4:47 PM, Marcelo Martinez <[hidden email] <http:///user/SendEmail.jtp?type=node&node=5742599&i=0>> wrote:
I'm trying to integrate freeradius with active directory in cenos 7.
Follow my guide. it WILL work:
http://deployingradius.com/documents/configuration/active_directory.html
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list /users.html
------------------------------ If you reply to this email, your message will be added to the discussion below: http://freeradius.1045715.n5.nabble.com/freeradius-3-I-m-try ing-to-integrate-freeradius-with-active-directory-in- cenos-7-tp5742598p5742599.html To unsubscribe from FreeRADIUS, click here <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=2740692&code=bWFyY2Vsby5tYXJ0aW5lekBuZXhhLmNvbS51eXwyNzQwNjkyfC0xNzQ0NzUzNjYy> . NAML <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
On Mon, Sep 19, 2016 at 09:04:19AM -0300, Marcelo Martinez wrote:
ntlm_auth --request-nt-key --domain=TEST.UY --username=administrator --password=xxxx could not obtain winbind separator! Reading winbind reply failed! (0x01) : (0x0)
Winbind isn't running. If you're not running this as root and winbind is running, the private socket permissions are set incorrectly.
I already joined the Active Directory domain with the procedure previously posted, I need to start from here and not undo my working configuration.
But you haven't got a working configuration... Why not follow the instructions and use Samba's "net ads join" to join the domain like everyone else does? However - does "net ads testjoin" say "Join is OK"? If so then it may just be winbind that needs starting up. Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Hi,
I saw this link and tryied these steps...
ntlm_auth --request-nt-key --domain=TEST.UY --username=administrator --password=xxxx could not obtain winbind separator!
winbind running? smb.conf correctly configured?
I already joined the Active Directory domain with the procedure previously posted, I need to start from here and not undo my working configuration.
why have you done it the way you have? the 'net ads join' method is trvial and usual. those sssd packages you've installed are 'interesting' from my experience. alan
I'M trying with alan's guide... samba* krb5-workstation installed. [root@test-radius-test ~]# net ads testjoin Join is OK [root@test-radius-test ~]# net ads -P status objectClass: top objectClass: person objectClass: organizationalPerson objectClass: user objectClass: computer cn: prueba distinguishedName: CN=prueba,OU=Equipos Ingresados,DC=test,DC=local instanceType: 4 whenCreated: 20160919172713.0Z whenChanged: 20160919180107.0Z uSNCreated: 50294994 uSNChanged: 50296026 name: prueba objectGUID: 5e8b64aa-ca7f-498a-93d3-528499b2dae1 userAccountControl: 69632 badPwdCount: 0 codePage: 0 countryCode: 0 badPasswordTime: 0 lastLogoff: 0 lastLogon: 131187828520486649 localPolicyFlags: 0 pwdLastSet: 131187816675599507 primaryGroupID: 515 objectSid: S-1-5-21-2352482657-3702507256-981139051-8571 accountExpires: 9223372036854775807 logonCount: 11 sAMAccountName: prueba$ sAMAccountType: 805306369 dNSHostName: prueba.test.local servicePrincipalName: HOST/prueba.test.local servicePrincipalName: HOST/PRUEBA objectCategory: CN=Computer,CN=Schema,CN=Configuration,DC=test,DC=local isCriticalSystemObject: FALSE dSCorePropagationData: 16010101000000.0Z mS-DS-CreatorSID: S-1-5-21-2352482657-3702507256-981139051-1925 lastLogonTimestamp: 131187797472772194 [root@test-radius-test ~]# net join -U testing Enter testing's password: Failed to join domain: failed to set machine kerberos encryption types: Insufficient access ADS join did not work, falling back to RPC... [root@test-radius-test ~]# kinit Password for testing@TEST.LOCAL: [root@test-radius-test ~]# [root@test-radius-test ~]# cat /etc/krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] dns_lookup_realm = true ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false default_realm = test.LOCAL default_ccache_name = KEYRING:persistent:%{uid} [realms] # EXAMPLE.COM = { # kdc = kerberos.example.com # admin_server = kerberos.example.com # } test.local = { kdc = test.local admin_server = test.local } [domain_realm] # .example.com = EXAMPLE.COM # example.com = EXAMPLE.COM [domain_realm] .example.com = test.LOCAL example.com = test.LOCAL allow_weak_crypto=true [root@test-radius-test ~]# Also I configured smb.conf adding: password server = test.local realm = test.local workgroup = test security = ads ssh conf: #Kerberos options KerberosAuthentication yes KerberosOrLocalPasswd yes KerberosTicketCleanup yes #KerberosGetAFSToken ye KerberosUseKuserok yes #GSSAPI options GSSAPIAuthentication yes GSSAPIAuthentication yes GSSAPICleanupCredentials yes GSSAPICleanupCredentials yes #GSSAPIStrictAcceptorCheck yes #GSSAPIKeyExchange no Any help please? Thanks.- On Mon, Sep 19, 2016 at 9:29 AM, A.L.M.Buxey [via FreeRADIUS] < ml-node+s1045715n5742609h63@n5.nabble.com> wrote:
Hi,
I saw this link and tryied these steps...
ntlm_auth --request-nt-key --domain=TEST.UY --username=administrator --password=xxxx could not obtain winbind separator!
winbind running? smb.conf correctly configured?
I already joined the Active Directory domain with the procedure previously posted, I need to start from here and not undo my working configuration.
why have you done it the way you have? the 'net ads join' method is trvial and usual. those sssd packages you've installed are 'interesting' from my experience.
alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
------------------------------ If you reply to this email, your message will be added to the discussion below: http://freeradius.1045715.n5.nabble.com/freeradius-3-I-m- trying-to-integrate-freeradius-with-active-directory-in-cenos-7- tp5742598p5742609.html To unsubscribe from FreeRADIUS, click here <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=2740692&code=bWFyY2Vsby5tYXJ0aW5lekBuZXhhLmNvbS51eXwyNzQwNjkyfC0xNzQ0NzUzNjYy> . NAML <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
On Sep 19, 2016, at 2:33 PM, Marcelo Martinez <marcelo.martinez@nexa.com.uy> wrote:
I'M trying with alan's guide...
Which should work.
samba* krb5-workstation installed.
[root@test-radius-test ~]# net ads testjoin Join is OK
That's good.
[root@test-radius-test ~]# net ads -P status
That doesn't mean much.
ssh conf:
Why?
Any help please?
You've been very careful to not say what's going wrong. Why? Follow the guide. Each step explains what you should do, and what result you should see. If you don't see that result, post a question. Your question should say what you did, what you expected to happen, and then what actually happened. Alan DeKok.
On Mon, Sep 19, 2016 at 03:33:02PM -0300, Marcelo Martinez wrote:
Any help please?
As per my last e-mail... Is winbind running? Matthew -- Matthew Newton, Ph.D. <mcn4@leicester.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
winbind is running # systemctl status winbind ● winbind.service - Samba Winbind Daemon Loaded: loaded (/usr/lib/systemd/system/winbind.service; disabled; vendor preset: disabled) Active: active (running) since lun 2016-09-19 16:39:35 UYT; 4min 43s ago Main PID: 4752 (winbindd) Status: "winbindd: ready to serve connections..." CGroup: /system.slice/winbind.service ├─4752 /usr/sbin/winbindd └─4753 /usr/sbin/winbindd sep 19 16:39:35 prueba systemd[1]: Starting Samba Winbind Daemon... sep 19 16:39:35 prueba winbindd[4752]: [2016/09/19 16:39:35.538056, 0] ../source3/winbindd/winbindd_cache.c:3235(initialize_winbindd_cache) sep 19 16:39:35 prueba winbindd[4752]: initialize_winbindd_cache: clearing cache and re-creating with version number 2 sep 19 16:39:35 prueba winbindd[4752]: [2016/09/19 16:39:35.542982, 0] ../lib/util/become_daemon.c:124(daemon_ready) sep 19 16:39:35 prueba winbindd[4752]: STATUS=daemon 'winbindd' finished starting up and ready to serve connections sep 19 16:39:35 prueba systemd[1]: Started Samba Winbind Daemon. My progress is fine... wbinfo -a Administrador%Passw0rd plaintext password authentication failed Could not authenticate user Administrador%Passw0rd with plaintext password challenge/response password authentication succeeded [root@miem-radius-test raddb]# ntlm_auth --request-nt-key --domain=TEST --username=Administrador --password=Passw0rd NT_STATUS_OK: Success (0x0) but radtest is not working... radtest -t mschap bob hello localhost 0 testing123 -bash: radtest: command not found yum provides radtest Complementos cargados:ps miemrepo-base | 3.6 kB 00:00:00 miemrepo-epel | 4.3 kB 00:00:00 miemrepo-base/filelists_db | 6.2 MB 00:00:00 miemrepo-epel/filelists_db | 7.1 MB 00:00:00 freeradius-utils-3.0.4-6.el7.x86_64 : FreeRADIUS utilities Repositorio : testrepo-base Resultado obtenido desde: Nombre del archivo : /usr/bin/radtest On Mon, Sep 19, 2016 at 4:34 PM, Matthew Newton [via FreeRADIUS] < ml-node+s1045715n5742624h28@n5.nabble.com> wrote:
On Mon, Sep 19, 2016 at 03:33:02PM -0300, Marcelo Martinez wrote:
Any help please?
As per my last e-mail...
Is winbind running?
Matthew
-- Matthew Newton, Ph.D. <[hidden email] <http:///user/SendEmail.jtp?type=node&node=5742624&i=0>>
Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom
For IT help contact helpdesk extn. 2253, <[hidden email] <http:///user/SendEmail.jtp?type=node&node=5742624&i=1>> - List info/subscribe/unsubscribe? See http://www.freeradius.org/ list/users.html
------------------------------ If you reply to this email, your message will be added to the discussion below: http://freeradius.1045715.n5.nabble.com/freeradius-3-I-m- trying-to-integrate-freeradius-with-active-directory-in-cenos-7- tp5742598p5742624.html To unsubscribe from FreeRADIUS, click here <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=unsubscribe_by_code&node=2740692&code=bWFyY2Vsby5tYXJ0aW5lekBuZXhhLmNvbS51eXwyNzQwNjkyfC0xNzQ0NzUzNjYy> . NAML <http://freeradius.1045715.n5.nabble.com/template/NamlServlet.jtp?macro=macro_viewer&id=instant_html%21nabble%3Aemail.naml&base=nabble.naml.namespaces.BasicNamespace-nabble.view.web.template.NabbleNamespace-nabble.view.web.template.NodeNamespace&breadcrumbs=notify_subscribers%21nabble%3Aemail.naml-instant_emails%21nabble%3Aemail.naml-send_instant_email%21nabble%3Aemail.naml>
Hi,
but radtest is not working...
radtest -t mschap bob hello localhost 0 testing123 -bash: radtest: command not found
its not radtest isnt working - radtest doesnt appear to be in your command PATH. have you installed the freeradius-utils package? alan
participants (4)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan DeKok -
Marcelo Martinez -
Matthew Newton