Re: freeRADIUS -> AD Auth (<100kb)
Hi Nicolas, I browsed a little of your error and your conf files to notice you are still missing a LOT of bits of a standard freeradius configuration to connect to an AD. mschap encryptition strength, configuration of EAP tunnels and protocols, actual domain not defined in FreeRadius/proxy.conf, and then not yet VLANs (ok, not probably at this time of the game, but you eventually will get there). You would better search and use in freeradius and Janet for tutorials about configuring RADIUS for AD. It is not as simples as tweaking the config files. About the certificates, I hope you dont use the current ones in production, as you just published them to the world at large. One last note, 2.1.12 FreeRadius has serious bugs working with AD (it works, but crashes a lot). I would recommend at least 2.2.5 or going directly to version 3.x. Regards, Rui Ribeiro
Message: 2 Date: Wed, 13 Aug 2014 10:58:31 +0200 From: nfischer@hush.com To: freeradius-users@lists.freeradius.org Subject: freeRADIUS -> AD Auth (<100kb) Message-ID: <20140813085831.79D2B60960@smtp.hushmail.com> Content-Type: text/plain; charset="utf-8"
Hi there!
I have a problem with the auth against an Active Directory. I would be very thankfull if you could help me.
Im tring to setup an WiFi Network where the Useres can auth with their AD Useraccs,
Setup: WiFi-Router with DD-WRT Ubuntu 10.04LTS with FreeRADIUS kerberus samba etc. AD at a Windows Server 2008 SBS (Total mess never install it!)
The communicatuion W-Lan Client->Router->FreeRADIUS runs. The Ubuntu Server is in the Domain, wbinfo -u gives me all Users. The auth via NTLM_AUTH runns too: /etc/freeradius$ ntlm_auth --request-nt-key --domain=DOMAINNAME --username=USERNAME Password: NT_STATUS_OK: Success (0x0)
I think just FreeRADIUS is configured wrong. The auth fails, respectively does not take place.
I put the config files and the freeradius -X output in the attachment. (I removed a few unimportant configfiles to not hit the 100kb limit of this mailinglist.)
Many thanks in advance!
Hi thanks for your reply. I followed a couple of tutorials but they don´t work for me. Do you know a good one? I don´t want to use VLANs at this point. I have a question for the FreeRadius/proxy.conf what sould it look like? realm DOMAINNAME { authhost = DomainControler.OBLAN.LOCAL:1600 accthost = DomainControler.OBLAN.LOCAL:1601 secret = testing123 } BTW: the Domain is named oblan.local does this cause a problem? I will use the company certs later. Another question: I have deactivated the service RAS&Routing on the DC. I that necessary for freeRADIUS? -- Mit freundlichem Gruß Nicolas Fischer Hi Nicolas, I browsed a little of your error and your conf files to notice you are still missing a LOT of bits of a standard freeradius configuration to connect to an AD. mschap encryptition strength, configuration of EAP tunnels and protocols, actual domain not defined in FreeRadius/proxy.conf, and then not yet VLANs (ok, not probably at this time of the game, but you eventually will get there). You would better search and use in freeradius and Janet for tutorials about configuring RADIUS for AD. It is not as simples as tweaking the config files. About the certificates, I hope you dont use the current ones in production, as you just published them to the world at large. One last note, 2.1.12 FreeRadius has serious bugs working with AD (it works, but crashes a lot). I would recommend at least 2.2.5 or going directly to version 3.x. Regards, Rui Ribeiro Message: 2 Date: Wed, 13 Aug 2014 10:58:31 +0200 From: nfischer@hush.com To: freeradius-users@lists.freeradius.org Subject: freeRADIUS -> AD Auth (Router->FreeRADIUS runs. The Ubuntu Server is in the Domain, wbinfo -u gives me all Users. The auth via NTLM_AUTH runns too: /etc/freeradius$ ntlm_auth --request-nt-key --domain=DOMAINNAME --username=USERNAME Password: NT_STATUS_OK: Success (0x0) I think just FreeRADIUS is configured wrong. The auth fails, respectively does not take place. I put the config files and the freeradius -X output in the attachment. (I removed a few unimportant configfiles to not hit the 100kb limit of this mailinglist.) Many thanks in advance!
hi,
I followed a couple of tutorials but they don´t work for me.
the main FreeRADIUS docs work
I have a question for the FreeRadius/proxy.conf what sould it look like?
realm DOMAINNAME { authhost = DomainControler.OBLAN.LOCAL:1600 accthost = DomainControler.OBLAN.LOCAL:1601 secret = testing123 }
if the domain DOMAINNAME is to be authenticated by a RADIUS server thats running on DomainControler.OBLAN.LOCAL and listening on port 1600 then yes. that would be what you want.... but as your box is in the AD and you've been talking about ntlm_auth I assume that the authentication is going to be done locally (and not on eg an NPS/IAS box). in which case you want something like realm DOMAINNAME { } yes. thats all for dealing with a realm locally.
BTW: the Domain is named oblan.local does this cause a problem?
why do you think it would be? its your domain is it not? :)
Another question: I have deactivated the service RAS&Routing on the DC. I that necessary for freeRADIUS?
nope. FreeRADIUS doesnt care a single bit about another box or service alan
Thanks to all of you guys! I try to get it work and write you later :) -- Mit freundlichem Gruß Nicolas Fischer email: nfischer@hush.com jabber: jagger@jabber.ccc.de tel: 01573-0420888 Skype: jagger64 TOX: Just ask me :) PGP-Key: http://keyserver.ubuntu.com/pks/lookup?op=vindex&fingerprint=on&search=0xCF5... If you sent me a PGP Crypted Mail I´ll be happy and will give you a free cookie :)
Hi! Okay Im one step further. It now fails with: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Im not really sure what the problem is... Thanks again for you help, i will try to pay it forward :) -- Mit freundlichem Gruß Nicolas Fischer email: nfischer@hush.com jabber: jagger@jabber.ccc.de tel: 01573-0420888 Skype: jagger64 TOX: Just ask me :) PGP-Key: http://keyserver.ubuntu.com/pks/lookup?op=vindex&fingerprint=on&search=0xCF5... If you sent me a PGP Crypted Mail I´ll be happy and will give you a free cookie :)
On 13-08-14 17:51, nfischer@hush.com wrote:
Hi!
Okay Im one step further. It now fails with: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
Im not really sure what the problem is...
I see this part in the logs: [mschap] Told to do MS-CHAPv2 for hausmeister@oblan with NT-Password [mschap] expand: %{User-Name} -> hausmeister@oblan [mschap] expand: --username==%{%{User-Name}:-None}} -> --username==hausmeister@oblan} Exec-Program output: Password: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Active Directory can be a bit weird when trying to do authentication with usernames where the domain is given via the postfix (@domain) notation. Adding "--domain=%{mschap:NT-Domain}" to the params of ntlm_auth may work (even if it gets expanded to an empty string). -- Herwin Weststrate
Hi,
It now fails with: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.
no. thats way up near the top. the real failure is much much further down: [mschapv2] # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: hausmeister@oblan [mschap] Told to do MS-CHAPv2 for hausmeister@oblan with NT-Password [mschap] expand: %{User-Name} -> hausmeister@oblan [mschap] expand: --username==%{%{User-Name}:-None}} -> --username==hausmeister@oblan} Exec-Program output: Password: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program-Wait: plaintext: Password: NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject I would change your User-Name call in the tnlm_auth to Stripped-User-Name alan
Hi,
about configuring RADIUS for AD. It is not as simples as tweaking the config files.
well..it is. even easier guide: http://deployingradius.com/documents/configuration/active_directory.html
One last note, 2.1.12 FreeRadius has serious bugs working with AD (it works, but crashes a lot). I would recommend at least 2.2.5 or going directly to version 3.x.
never had problems with 2.1.12 for this aspect - I know hundreds of sites that still run such a release and use AD - but yes, 2.2.5 is much better :-) alan
participants (5)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Buxey
-
Herwin Weststrate -
nfischer＠hush.com -
Rui Ribeiro