freeradius + NTLM + samba AD 4.5.x
Hi, we have updated our samba AD domain from 4.4.x to 4.5.x. The release notes for 4.5.0 included "NTLMv1 authentication disabled by default". So we had to enable it to get our radius (freeradius) server working (for 802.1x). What would be the best way to change the freeradius configuration in such a way, that we can disable NTLMv1 again. The radius server is used for WLAN (802.1x) and for VPN. -- Bye, Peer ________________________________________________________ Max-Planck-Institut für Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705
On 26 Mar 2018, at 14:35, Dr. Peer-Joachim Koch <pkoch@bgc-jena.mpg.de> wrote:
The release notes for 4.5.0 included "NTLMv1 authentication disabled by default".
Did you upgrade the samba version running on the FreeRADIUS server too? If not, then you reconfigure samba to use NTLMv2. Adam Bishop gpg: E75B 1F92 6407 DFDF 9F1C BF10 C993 2504 6609 D460 jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
On 26 March 2018 14:35:53 BST, "Dr. Peer-Joachim Koch" <pkoch@bgc-jena.mpg.de> wrote:
So we had to enable it to get our radius (freeradius) server working (for 802.1x).
What would be the best way to change the freeradius configuration in such a way, that we can disable NTLMv1 again.
You can't.
The radius server is used for WLAN (802.1x) and for VPN.
Presuming you're using MSCHAPv2 for auth, you need NTLMv1 enabled. NTLMv2 won't work. -- Matthew
Hello, i have another question about not ended sessions in FR (thanks Alan for last replay). What about situation when switch is suddenly down (for example power failure). and empty sessions appears in database. in this case NAS wont send stop packets (because of suddenly power failure). Can i avoid this ? i mean empty session (with stop time -> NULL). Is there any way that FR will check if NAS or end user is still alive ? best regards On Feb 27, 2018, at 5:34 AM, dg <dg at poczta.tarman.pl> wrote:
From time to time I have session not ended (and without any user assigned to that session).
So i have time when session starts but stop time is NULL.
The NAS isn't sending stop packets. FreeRADIUS can only log what it gets.
so you can see that AcctStopTime is sometimes NULL. Can someone help me ? why its happening ? i am using cisco switches
Fix the switches to send stop packets. Alan DeKok.
On Mar 26, 2018, at 3:54 PM, dg <dg@poczta.tarman.pl> wrote:
What about situation when switch is suddenly down (for example power failure). and empty sessions appears in database.
in this case NAS wont send stop packets (because of suddenly power failure).
The NAS should send an Accounting-Request with status "Accounting On". That ends up being treated exactly the same as "Accounting Off" Alan DeKok.
As Alan says you should use the Accounting On to stop all active sessions from a NAS. There is, however, also the case that you somehow miss all attempts to send the STOP for a session. This is similar and no amount of people think it'll be impossible to happen. Yep it does and you have to handle it. Normally, I'd always enable interim accounting and any session that’s not had any accounting for say 2 interims is marked as 'dead' (note distinct from STOPPED to show its heuristically closed rather than absolute fact). Also rather obviously any START that has the same IP as an existing session should close the old one before STARTing a new one... I could go on listing the cases but after realising that RADIUS packets aren’t guaranteed to arrive, and other than infinite retries you can't guarantee it 100% you will get stale sessions and your RADIUS accounting system has to do the right thing when it happens. -- Alister On 26/03/2018, 21:07, "Freeradius-Users on behalf of dg" <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org on behalf of dg@poczta.tarman.pl> wrote: Hello, i have another question about not ended sessions in FR (thanks Alan for last replay). What about situation when switch is suddenly down (for example power failure). and empty sessions appears in database. in this case NAS wont send stop packets (because of suddenly power failure). Can i avoid this ? i mean empty session (with stop time -> NULL). Is there any way that FR will check if NAS or end user is still alive ? best regards On Feb 27, 2018, at 5:34 AM, dg <dg at poczta.tarman.pl> wrote: > From time to time I have session not ended (and without any user assigned to > that session). > > So i have time when session starts but stop time is NULL. The NAS isn't sending stop packets. FreeRADIUS can only log what it gets. > so you can see that AcctStopTime is sometimes NULL. > Can someone help me ? why its happening ? > i am using cisco switches Fix the switches to send stop packets. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky plc and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075) and Sky Subscribers Services Limited (Registration No. 2340150) are direct or indirect subsidiaries of Sky plc (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD.
participants (6)
-
Adam Bishop -
Alan DeKok -
dg -
Dr. Peer-Joachim Koch -
Matthew Newton -
Winfield, Alister