Problem with PEAP and MS-CHAPv2 and AD
I am having a strange problem, and was hoping for some expertise in this matter and I need to get this working very quickly since I am running out of time. I have freeradius configured to authenticate our users for a wired 802.1x environment. Authentication works succesfully if the supplicant (odyssey client) sends only the username and not domain\username. The problem is when I install the odyssey gina module to configure the supplicant to authenticate prior to windows login it passes the credentials as domain\username, whichs fails authentication. I did some searches and made the following changes: proxy.conf added: realm domain { type = radius authhost = LOCAL accthost = LOCAL } and uncommented the ntdomain section in radiusd.conf This did not work, so I tried another suggestion and changed the ntlm_auth string from: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MEM --username=%{User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" to: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Now when I login I get the following error: This also occurs at the desktop level rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xf8716a50 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE If I change the ntlm_auth back to the original string and authenticate at the desktop (not gina) it authenticates. So my question is: What do I need to do to configure Freeradius to strip the domain portion where EAP-PEAP is successful at both gina (login) and desktop? Any help would be greatly appreciated. Thanks Robert Graham
Hi, I'm still having problems getting FreeRadius-1.0.4 to log accounting data to sql. I know it is receiving the data, as I can log it to file. In my accounting section I have 'sql', and the SQL queries are there in sql.conf. However, when looking at the sqltrace log the only queries are inserts to radpostauth. Can anyone help? Thanks in advance, Ben
Yep, but I need some more info. Your sql section in radiusd.conf and your sql_accounting* definitions in sql.conf. Also the "accounting" section in radiusd.conf, in wich it must be a "sql" instance. Ing. Paolo Rotela Jefe Técnico Blue Telecom Eng. Paolo Rotela CTO Blue Telecom ----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, September 27, 2005 6:00 PM Subject: SQL Accouting
Hi,
I'm still having problems getting FreeRadius-1.0.4 to log accounting data to sql. I know it is receiving the data, as I can log it to file. In my accounting section I have 'sql', and the SQL queries are there in sql.conf. However, when looking at the sqltrace log the only queries are inserts to radpostauth. Can anyone help?
Thanks in advance, Ben
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I previously mentioned, the accounting section contains just 'sql'. I have no sql section in radiusd.conf though (perhaps this is my problem?) and no sql_accouting definitions in my sql.conf, but the sql accouting queries are defined there, and they are correct. The sql connection is working, and post auth data gets logged fine, just not the accouting stuff. Cheers, Ben On Wed, 2005-09-28 at 09:11 -0300, Paolo Rotela wrote:
Yep, but I need some more info. Your sql section in radiusd.conf and your sql_accounting* definitions in sql.conf. Also the "accounting" section in radiusd.conf, in wich it must be a "sql" instance.
Ing. Paolo Rotela Jefe Técnico Blue Telecom
Eng. Paolo Rotela CTO Blue Telecom ----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, September 27, 2005 6:00 PM Subject: SQL Accouting
Hi,
I'm still having problems getting FreeRadius-1.0.4 to log accounting data to sql. I know it is receiving the data, as I can log it to file. In my accounting section I have 'sql', and the SQL queries are there in sql.conf. However, when looking at the sqltrace log the only queries are inserts to radpostauth. Can anyone help?
Thanks in advance, Ben
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
You should have something like this in your radiusd.conf $INCLUDE ${confdir}/sql.conf Then you should have this in sql.conf (or the file pointed to by the include, my example is with mysql, could be another engine) sql { # Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql" # Connect info server = "localhost" login = "user" password = "user" # Database table configuration radius_db = "radius" # If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct" .... and then some accounting_*_query that inserts or updates the ${acct_table1} or ${acct_table2}. Then your "accounting {" section in radiusd.conf should have a line saying "sql" or the sql instance name (if you are using more than the default instance for sql module). And then you must have the "radius" database and the "radacct" table. If all this is ok, then I don't know for sure, you should check your radius.log for errors in the sql module. ----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, September 28, 2005 2:30 PM Subject: Re: SQL Accouting
I previously mentioned, the accounting section contains just 'sql'. I have no sql section in radiusd.conf though (perhaps this is my problem?) and no sql_accouting definitions in my sql.conf, but the sql accouting queries are defined there, and they are correct.
The sql connection is working, and post auth data gets logged fine, just not the accouting stuff.
Cheers, Ben
On Wed, 2005-09-28 at 09:11 -0300, Paolo Rotela wrote:
Yep, but I need some more info. Your sql section in radiusd.conf and your sql_accounting* definitions in sql.conf. Also the "accounting" section in radiusd.conf, in wich it must be a "sql" instance.
Ing. Paolo Rotela Jefe Técnico Blue Telecom
Eng. Paolo Rotela CTO Blue Telecom ----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, September 27, 2005 6:00 PM Subject: SQL Accouting
Hi,
I'm still having problems getting FreeRadius-1.0.4 to log accounting data to sql. I know it is receiving the data, as I can log it to file. In my accounting section I have 'sql', and the SQL queries are there in sql.conf. However, when looking at the sqltrace log the only queries are inserts to radpostauth. Can anyone help?
Thanks in advance, Ben
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
That is exactly the setup I have, but it doesn't seem to be working. There are no errors reported in radius.log, and no accounting queries in sqltrace.sql. Any ideas? Cheers, Ben On Wed, 2005-09-28 at 15:08 -0300, Paolo Rotela wrote:
You should have something like this in your radiusd.conf
$INCLUDE ${confdir}/sql.conf
Then you should have this in sql.conf (or the file pointed to by the include, my example is with mysql, could be another engine)
sql {
# Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql"
# Connect info server = "localhost" login = "user" password = "user"
# Database table configuration radius_db = "radius"
# If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct"
....
and then some accounting_*_query that inserts or updates the ${acct_table1} or ${acct_table2}.
Then your "accounting {" section in radiusd.conf should have a line saying "sql" or the sql instance name (if you are using more than the default instance for sql module).
And then you must have the "radius" database and the "radacct" table.
If all this is ok, then I don't know for sure, you should check your radius.log for errors in the sql module.
----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, September 28, 2005 2:30 PM Subject: Re: SQL Accouting
I previously mentioned, the accounting section contains just 'sql'. I have no sql section in radiusd.conf though (perhaps this is my problem?) and no sql_accouting definitions in my sql.conf, but the sql accouting queries are defined there, and they are correct.
The sql connection is working, and post auth data gets logged fine, just not the accouting stuff.
Cheers, Ben
On Wed, 2005-09-28 at 09:11 -0300, Paolo Rotela wrote:
Yep, but I need some more info. Your sql section in radiusd.conf and your sql_accounting* definitions in sql.conf. Also the "accounting" section in radiusd.conf, in wich it must be a "sql" instance.
Ing. Paolo Rotela Jefe Técnico Blue Telecom
Eng. Paolo Rotela CTO Blue Telecom ----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, September 27, 2005 6:00 PM Subject: SQL Accouting
Hi,
I'm still having problems getting FreeRadius-1.0.4 to log accounting data to sql. I know it is receiving the data, as I can log it to file. In my accounting section I have 'sql', and the SQL queries are there in sql.conf. However, when looking at the sqltrace log the only queries are inserts to radpostauth. Can anyone help?
Thanks in advance, Ben
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
That is exactly the setup I have, but it doesn't seem to be working. There are no errors reported in radius.log, and no accounting queries in sqltrace.sql. Any ideas?
Yep, reinstall it ;) No, really, you should try to shutdown the daemon and try running "radiusd -X", then test it, and see if the debugging mode tells you something :)
Cheers, Ben
On Wed, 2005-09-28 at 15:08 -0300, Paolo Rotela wrote:
You should have something like this in your radiusd.conf
$INCLUDE ${confdir}/sql.conf
Then you should have this in sql.conf (or the file pointed to by the include, my example is with mysql, could be another engine)
sql {
# Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql"
# Connect info server = "localhost" login = "user" password = "user"
# Database table configuration radius_db = "radius"
# If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct"
....
and then some accounting_*_query that inserts or updates the ${acct_table1} or ${acct_table2}.
Then your "accounting {" section in radiusd.conf should have a line saying "sql" or the sql instance name (if you are using more than the default instance for sql module).
And then you must have the "radius" database and the "radacct" table.
If all this is ok, then I don't know for sure, you should check your radius.log for errors in the sql module.
----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, September 28, 2005 2:30 PM Subject: Re: SQL Accouting
I previously mentioned, the accounting section contains just 'sql'. I have no sql section in radiusd.conf though (perhaps this is my problem?) and no sql_accouting definitions in my sql.conf, but the sql accouting queries are defined there, and they are correct.
The sql connection is working, and post auth data gets logged fine, just not the accouting stuff.
Cheers, Ben
On Wed, 2005-09-28 at 09:11 -0300, Paolo Rotela wrote:
Yep, but I need some more info. Your sql section in radiusd.conf and your sql_accounting* definitions in sql.conf. Also the "accounting" section in radiusd.conf, in wich it must be a "sql" instance.
Ing. Paolo Rotela Jefe Técnico Blue Telecom
Eng. Paolo Rotela CTO Blue Telecom ----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, September 27, 2005 6:00 PM Subject: SQL Accouting
Hi,
I'm still having problems getting FreeRadius-1.0.4 to log accounting data to sql. I know it is receiving the data, as I can log it to file. In my accounting section I have 'sql', and the SQL queries are there in sql.conf. However, when looking at the sqltrace log the only queries are inserts to radpostauth. Can anyone help?
Thanks in advance, Ben
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I am running it with -X, and it all seems fine. It shows the sql module loading, and all the accounting queries. What could I be missing? Ben On Wed, 2005-09-28 at 16:42 -0300, Paolo Rotela wrote:
That is exactly the setup I have, but it doesn't seem to be working. There are no errors reported in radius.log, and no accounting queries in sqltrace.sql. Any ideas?
Yep, reinstall it ;)
No, really, you should try to shutdown the daemon and try running "radiusd -X", then test it, and see if the debugging mode tells you something :)
Cheers, Ben
On Wed, 2005-09-28 at 15:08 -0300, Paolo Rotela wrote:
You should have something like this in your radiusd.conf
$INCLUDE ${confdir}/sql.conf
Then you should have this in sql.conf (or the file pointed to by the include, my example is with mysql, could be another engine)
sql {
# Database type # Current supported are: rlm_sql_mysql, rlm_sql_postgresql, # rlm_sql_iodbc, rlm_sql_oracle, rlm_sql_unixodbc, rlm_sql_freetds driver = "rlm_sql_mysql"
# Connect info server = "localhost" login = "user" password = "user"
# Database table configuration radius_db = "radius"
# If you want both stop and start records logged to the # same SQL table, leave this as is. If you want them in # different tables, put the start table in acct_table1 # and stop table in acct_table2 acct_table1 = "radacct" acct_table2 = "radacct"
....
and then some accounting_*_query that inserts or updates the ${acct_table1} or ${acct_table2}.
Then your "accounting {" section in radiusd.conf should have a line saying "sql" or the sql instance name (if you are using more than the default instance for sql module).
And then you must have the "radius" database and the "radacct" table.
If all this is ok, then I don't know for sure, you should check your radius.log for errors in the sql module.
----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Wednesday, September 28, 2005 2:30 PM Subject: Re: SQL Accouting
I previously mentioned, the accounting section contains just 'sql'. I have no sql section in radiusd.conf though (perhaps this is my problem?) and no sql_accouting definitions in my sql.conf, but the sql accouting queries are defined there, and they are correct.
The sql connection is working, and post auth data gets logged fine, just not the accouting stuff.
Cheers, Ben
On Wed, 2005-09-28 at 09:11 -0300, Paolo Rotela wrote:
Yep, but I need some more info. Your sql section in radiusd.conf and your sql_accounting* definitions in sql.conf. Also the "accounting" section in radiusd.conf, in wich it must be a "sql" instance.
Ing. Paolo Rotela Jefe Técnico Blue Telecom
Eng. Paolo Rotela CTO Blue Telecom ----- Original Message ----- From: "Ben Dowling" <bendowling@lineone.net> To: "FreeRadius users mailing list" <freeradius-users@lists.freeradius.org> Sent: Tuesday, September 27, 2005 6:00 PM Subject: SQL Accouting
Hi,
I'm still having problems getting FreeRadius-1.0.4 to log accounting data to sql. I know it is receiving the data, as I can log it to file. In my accounting section I have 'sql', and the SQL queries are there in sql.conf. However, when looking at the sqltrace log the only queries are inserts to radpostauth. Can anyone help?
Thanks in advance, Ben
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ben Dowling <bendowling@lineone.net> wrote:
I previously mentioned, the accounting section contains just 'sql'. I have no sql section in radiusd.conf though (perhaps this is my problem?) and no sql_accouting definitions in my sql.conf, but the sql accouting queries are defined there, and they are correct.
Is it getting accounting packets? Run it in debugging mode, and use "radclient" to send it accounting packets. See what happens. Alan DeKok.
Yeah it is getting accounting packets, because I can log them to file with 'detail'. Just not to sql. Ben On Wed, 2005-09-28 at 16:32 -0400, Alan DeKok wrote:
Ben Dowling <bendowling@lineone.net> wrote:
I previously mentioned, the accounting section contains just 'sql'. I have no sql section in radiusd.conf though (perhaps this is my problem?) and no sql_accouting definitions in my sql.conf, but the sql accouting queries are defined there, and they are correct.
Is it getting accounting packets?
Run it in debugging mode, and use "radclient" to send it accounting packets. See what happens.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Ben Dowling <bendowling@lineone.net> wrote:
Yeah it is getting accounting packets, because I can log them to file with 'detail'. Just not to sql.
The debug log should show the SQL module being executed for any accounting packets. If not, there's the problem. If the SQL module is being executed, it should show success/fail for the SQL statements. Alan DeKok.
participants (4)
-
Alan DeKok -
Ben Dowling -
Graham, Robert -
Paolo Rotela