RE: Active Directory with NTLM_AUTH
I also need to check that the user is a member of a particular group in Active Directory before Access-Accept is sent - do I fall back to LDAP for this?
You can use LDAP in the authorize section to accomplish this. Is the group name you are checking against static? Is it sometimes/always/never the primary group for the user?
I have had LDAP only working with PAP, but am stuck with getting it to work with MS-CHAP.
You can't use LDAP with MS-CHAP. Use the mschap module to do the authentication. Look at the comments in radiusd.conf to see how to use ntlm_auth via the mschap module of FR.
You can use LDAP in the authorize section to accomplish this. Is the group name you are checking against static? Is it sometimes/always/never the primary group for the user?
Group name is static, never the primary group for the user. What is added to the user file for this? Is it similar to below: DEFAULT Ldap-Group == "GroupName" Service-Type = Framed, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, etc.. Can I simply use the: --require-membership-of='DOMAIN\Group' option of ntlm_auth to accomplish the the group check?
I have had LDAP only working with PAP, but am stuck with getting it to work with MS-CHAP.
You can't use LDAP with MS-CHAP. Use the mschap module to do the authentication. Yup I realised this which is why I'm persuring the mschap module with ntlm_auth.
Look at the comments in radiusd.conf to see how to use ntlm_auth via the mschap module of FR.
I'm not finding the comments very useful in terms of what I need to do next after setting the options, which why I posted here.
Hi All, I am new to FreeRadius and in fact Radius. Having spent some time playing with FreeRadius (Windows ver) I need to call an external program in the preacct, authorize & authenticate sections. While the code comment in the piece prior to the exec module states the following: # If you wish to execute an external program in more than # one section (e.g. 'authorize', 'pre_proxy', etc), then it # is probably best to define a different instance of the # 'exec' module for every section. I am lost as to where or maybe how this definition is done. If I duplicate the exec module in the actual section, RadiusD complains about 'wait' not being defined. Can anyone provide guidance? Many thanks Les Brinkworth
On 10/13/06, Les Brinkworth <lbrinkworth@qkon.com> wrote:
I am lost as to where or maybe how this definition is done. If I duplicate the exec module in the actual section, RadiusD complains about 'wait' not being defined.
Just a guess (as you didn't provide any output): The error (more of a warning) is something like "...Wait=yes but no output defined..."? So check for the subsequent comment in the definition of an exec instance called "echo". Which should also serve as an example how to define different instances, which would then be called in the "actual section" by their name. regards K. Hoercher
Hi K Thanks for the reply. My apologies for including the code and trace. I have done so below. The error I think is more serious as the server fails to load. I am obviously understanding the "define" incorrectly. How does one define two instances of exec with different names that can be called from other sections? Code snippet from Modules section of radiusd.conf... exec { wait = yes program = "handlebillingrequests.exe ACCR:%Z" input_pairs = request output_pairs = reply packet_type = Accounting-Request } ...This executes for an accounting request If I then add the same code to the authorize section... exec { wait = yes program = "handlebillingrequests.exe AUTR:%Z" input_pairs = request output_pairs = reply packet_type = Access-Request } ...it results in the following when I run debug C:\Documents and Settings\lbrinkworth>Cd \Program Files\FreeRADIUS.net-1.1.1-r0.0.1 C:\Program Files\FreeRADIUS.net-1.1.1-r0.0.1>start_radiusd_debug.bat Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/mssql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "handlebillingrequests.exe ACCR:%Z" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "Accounting-Request" Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.crt" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-CA.crt" tls: private_key_password = "demo" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = yes rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "../etc/raddb/huntgroups" preprocess: hints = "../etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = yes Module: Instantiated preprocess (preprocess) radiusd.conf[1527] Unknown module rcode 'wait'. radiusd.conf[1513] Failed to parse authorize section. C:\Program Files\FreeRADIUS.net-1.1.1-r0.0.1\bin> Thanks Les -----Original Message----- From: freeradius-users-bounces+lbrinkworth=qkon.com@lists.freeradius.org [mailto:freeradius-users-bounces+lbrinkworth=qkon.com@lists.freeradius.o rg] On Behalf Of K. Hoercher Sent: 13 October 2006 11:21 AM To: FreeRadius users mailing list Subject: Re: Multiple instances of the exec module On 10/13/06, Les Brinkworth <lbrinkworth@qkon.com> wrote:
I am lost as to where or maybe how this definition is done. If I duplicate the exec module in the actual section, RadiusD complains about 'wait' not being defined.
Just a guess (as you didn't provide any output): The error (more of a warning) is something like "...Wait=yes but no output defined..."? So check for the subsequent comment in the definition of an exec instance called "echo". Which should also serve as an example how to define different instances, which would then be called in the "actual section" by their name. regards K. Hoercher - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 10/13/06, Les Brinkworth <lbrinkworth@qkon.com> wrote:
How does one define two instances of exec with different names that can be called from other sections?
Aaah, now it gets a bit more clear to me. You should take into account the comments at the beginning of the modules{} section. That would lead to something like:
Code snippet from Modules section of radiusd.conf...
exec doacctfoo {
wait = yes program = "handlebillingrequests.exe ACCR:%Z" input_pairs = request output_pairs = reply packet_type = Accounting-Request }
...This executes for an accounting request
If I then add the same code to the authorize section...
ah no, that won't work. you just put it into the modules{} too with analogous change:
exec dorequestfoo {
wait = yes program = "handlebillingrequests.exe AUTR:%Z" input_pairs = request output_pairs = reply packet_type = Access-Request }
...it results in the following when I run debug
radiusd.conf[1527] Unknown module rcode 'wait'. radiusd.conf[1513] Failed to parse authorize section.
Ok, that confuses freeradius way to much, as that is not the place to define module instances (see above), especially when another one (the unnamed one) already is present. But you can now put the named defined ones in the appropriate section e.g. authorize { ... dorequestfoo ... } accounting { ... doacctfoo ... } There might be other ways of doing it, (using the same module, but changing the called program, so it can cope with both tasks accordingly) but keeping it simple at first and following the recommendations in the comments looks preferable, at least until you get some working config. regards K. Hoercher
K. Many thanks for clarifying... Les -----Original Message----- From: freeradius-users-bounces+lbrinkworth=qkon.com@lists.freeradius.org [mailto:freeradius-users-bounces+lbrinkworth=qkon.com@lists.freeradius.o rg] On Behalf Of K. Hoercher Sent: 13 October 2006 14:44 PM To: FreeRadius users mailing list Subject: Re: Multiple instances of the exec module On 10/13/06, Les Brinkworth <lbrinkworth@qkon.com> wrote:
How does one define two instances of exec with different names that can be called from other sections?
Aaah, now it gets a bit more clear to me. You should take into account the comments at the beginning of the modules{} section. That would lead to something like:
Code snippet from Modules section of radiusd.conf...
exec doacctfoo {
wait = yes program = "handlebillingrequests.exe ACCR:%Z" input_pairs = request output_pairs = reply packet_type = Accounting-Request }
...This executes for an accounting request
If I then add the same code to the authorize section...
ah no, that won't work. you just put it into the modules{} too with analogous change:
exec dorequestfoo {
wait = yes program = "handlebillingrequests.exe AUTR:%Z" input_pairs = request output_pairs = reply packet_type = Access-Request }
...it results in the following when I run debug
radiusd.conf[1527] Unknown module rcode 'wait'. radiusd.conf[1513] Failed to parse authorize section.
Ok, that confuses freeradius way to much, as that is not the place to define module instances (see above), especially when another one (the unnamed one) already is present. But you can now put the named defined ones in the appropriate section e.g. authorize { ... dorequestfoo ... } accounting { ... doacctfoo ... } There might be other ways of doing it, (using the same module, but changing the called program, so it can cope with both tasks accordingly) but keeping it simple at first and following the recommendations in the comments looks preferable, at least until you get some working config. regards K. Hoercher - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
duckeo -
Garber, Neal -
K. Hoercher -
Les Brinkworth