How do I set up simple AD integration?
Burton, Steven
sburton at shepherd-construction.co.uk
Tue Apr 11 17:38:58 CEST 2006
> -----Original Message-----
> From:
> freeradius-users-bounces+sburton=shepherd-construction.co.uk at l
> ists.freer
> adius.org
> [mailto:freeradius-users-bounces+sburton=shepherd-construction
> .co.uk at lis
> ts.freeradius.org]On Behalf Of Burton, Steven
> Sent: 11 April 2006 16:15
> To: FreeRadius users mailing list
> Subject: RE: How do I set up simple AD integration?
>
>
>
>
> > -----Original Message-----
> > From:
> > freeradius-users-bounces+sburton=shepherd-construction.co.uk at l
> > ists.freer
> > adius.org
> > [mailto:freeradius-users-bounces+sburton=shepherd-construction
> > .co.uk at lis
> > ts.freeradius.org]On Behalf Of King, Michael
> > Sent: 11 April 2006 15:40
> > To: FreeRadius users mailing list
> > Subject: RE: How do I set up simple AD integration?
> >
> >
> > >
> > > Is there a how-to or tutorial for this simple case? I have
> > > searched this list and google generally. I have read the
> > > articles referred to on the FreeRadius home page and several
> > > others and I still can't see how the configuration works. Any
> > > and all help gratefully received.
> > >
> > > Steve.
> > >
> >
> >
> > As for the simple how to, they're a few, but none that I
> > would consider
> > easy to follow.
> >
> > What your looking for this the following lines: (I have
> > two ntlm_auth
> > Lines, the original that is commented out, and the one that I
> > use. They
> > are long, so they will break across lines, but they are not
> > that way in
> > my config file)
> >
> >
> > # Windows sends us a username in the form of
> > # DOMAIN\user, but sends the challenge response
> > # based on only the user portion. This hack
> > # corrects for that incorrect behavior.
> > #
> > with_ntdomain_hack = yes
> >
> > # The module can perform authentication itself, OR
> > # use a Windows Domain Controller. This
> configuration
> > # directive tells the module to call the ntlm_auth
> > # program, which will do the authentication,
> > and return
> > # the NT-Key. Note that you MUST have
> "winbindd" and
> > # "nmbd" running on the local machine for ntlm_auth
> > # to work. See the ntlm_auth program documentation
> > # for details.
> > #
> > # Be VERY careful when editing the following line!
> > #
> > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key
> > --username=%{Stripped-User-Name:-%{User-Name:-None}}
> > --challenge=%{mschap:Challenge:-00}
> > --nt-response=%{mschap:NT-Response:-00}"
> > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
> > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge}
> > --nt-response=%{mschap:NT-Response}"
>
> This stanza is a enclosed with the mschap section, still
> nothing ventured....
> I changed the line and unfolded it and ran radiusd -X. The
> first request didn't match anything usefull and was rejected
> by System. I tried again but ticked the box 'CHAP' on
> NTRadPing and got the output:
>
> Starting - reading configuration files ...
> reread_config: reading radiusd.conf
> Config: including file: /usr/local/etc/raddb/proxy.conf
> Config: including file: /usr/local/etc/raddb/clients.conf
> Config: including file: /usr/local/etc/raddb/snmp.conf
> Config: including file: /usr/local/etc/raddb/eap.conf
> Config: including file: /usr/local/etc/raddb/sql.conf
> main: prefix = "/usr/local"
> main: localstatedir = "/var"
> main: logdir = "/var/log"
> main: libdir = "/usr/local/lib"
> main: radacctdir = "/var/log/radacct"
> main: hostname_lookups = no
> main: max_request_time = 30
> main: cleanup_delay = 5
> main: max_requests = 1024
> main: delete_blocked_requests = 0
> main: port = 0
> main: allow_core_dumps = no
> main: log_stripped_names = no
> main: log_file = "/var/log/radius.log"
> main: log_auth = no
> main: log_auth_badpass = no
> main: log_auth_goodpass = no
> main: pidfile = "/var/run/radiusd/radiusd.pid"
> main: user = "(null)"
> main: group = "(null)"
> main: usercollide = no
> main: lower_user = "no"
> main: lower_pass = "no"
> main: nospace_user = "no"
> main: nospace_pass = "no"
> main: checkrad = "/usr/local/sbin/checkrad"
> main: proxy_requests = yes
> proxy: retry_delay = 5
> proxy: retry_count = 3
> proxy: synchronous = no
> proxy: default_fallback = yes
> proxy: dead_time = 120
> proxy: post_proxy_authorize = no
> proxy: wake_all_if_all_dead = no
> security: max_attributes = 200
> security: reject_delay = 1
> security: status_server = no
> main: debug_level = 0
> read_config_files: reading dictionary
> read_config_files: reading naslist
> read_config_files: reading clients
> read_config_files: reading realms
> radiusd: entering modules setup
> Module: Library search path is /usr/local/lib
> Module: Loaded exec
> exec: wait = yes
> exec: program = "(null)"
> exec: input_pairs = "request"
> exec: output_pairs = "(null)"
> exec: packet_type = "(null)"
> rlm_exec: Wait=yes but no output defined. Did you mean output=none?
> Module: Instantiated exec (exec)
> Module: Loaded expr
> Module: Instantiated expr (expr)
> Module: Loaded PAP
> pap: encryption_scheme = "crypt"
> Module: Instantiated pap (pap)
> Module: Loaded CHAP
> Module: Instantiated chap (chap)
> Module: Loaded MS-CHAP
> mschap: use_mppe = yes
> mschap: require_encryption = no
> mschap: require_strong = no
> mschap: with_ntdomain_hack = no
> mschap: passwd = "(null)"
> mschap: authtype = "MS-CHAP"
> mschap: ntlm_auth = "/usr/local/bin/ntlm_auth
> --request-nt-key --username=%{mschap:User-Name}
> --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}"
> Module: Instantiated mschap (mschap)
> Module: Loaded System
> unix: cache = no
> unix: passwd = "(null)"
> unix: shadow = "(null)"
> unix: group = "(null)"
> unix: radwtmp = "/var/log/radwtmp"
> unix: usegroup = no
> unix: cache_reload = 600
> Module: Instantiated unix (unix)
> Module: Loaded eap
> eap: default_eap_type = "md5"
> eap: timer_expire = 60
> eap: ignore_unknown_eap_types = no
> eap: cisco_accounting_username_bug = no
> rlm_eap: Loaded and initialized type md5
> rlm_eap: Loaded and initialized type leap
> gtc: challenge = "Password: "
> gtc: auth_type = "PAP"
> rlm_eap: Loaded and initialized type gtc
> tls: rsa_key_exchange = no
> tls: dh_key_exchange = yes
> tls: rsa_key_length = 512
> tls: dh_key_length = 512
> tls: verify_depth = 0
> tls: CA_path = "(null)"
> tls: pem_file_type = yes
> tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem"
> tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem"
> tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem"
> tls: private_key_password = "whatever"
> tls: dh_file = "/usr/local/etc/raddb/certs/dh"
> tls: random_file = "/usr/local/etc/raddb/certs/random"
> tls: fragment_size = 1024
> tls: include_length = yes
> tls: check_crl = no
> tls: check_cert_cn = "(null)"
> rlm_eap_tls: Loading the certificate file as a chain
> rlm_eap: Loaded and initialized type tls
> peap: default_eap_type = "mschapv2"
> peap: copy_request_to_tunnel = no
> peap: use_tunneled_reply = no
> peap: proxy_tunneled_request_as_eap = yes
> rlm_eap: Loaded and initialized type peap
> mschapv2: with_ntdomain_hack = no
> rlm_eap: Loaded and initialized type mschapv2
> Module: Instantiated eap (eap)
> Module: Loaded preprocess
> preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
> preprocess: hints = "/usr/local/etc/raddb/hints"
> preprocess: with_ascend_hack = no
> preprocess: ascend_channels_per_line = 23
> preprocess: with_ntdomain_hack = no
> preprocess: with_specialix_jetstream_hack = no
> preprocess: with_cisco_vsa_hack = no
> Module: Instantiated preprocess (preprocess)
> Module: Loaded realm
> realm: format = "suffix"
> realm: delimiter = "@"
> realm: ignore_default = no
> realm: ignore_null = no
> Module: Instantiated realm (suffix)
> Module: Loaded files
> files: usersfile = "/usr/local/etc/raddb/users"
> files: acctusersfile = "/usr/local/etc/raddb/acct_users"
> files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
> files: compat = "no"
> Module: Instantiated files (files)
> Module: Loaded Acct-Unique-Session-Id
> acct_unique: key = "User-Name, Acct-Session-Id,
> NAS-IP-Address, Client-IP-Address, NAS-Port"
> Module: Instantiated acct_unique (acct_unique)
> Module: Loaded detail
> detail: detailfile =
> "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d"
> detail: detailperm = 384
> detail: dirperm = 493
> detail: locking = no
> Module: Instantiated detail (detail)
> Module: Loaded radutmp
> radutmp: filename = "/var/log/radutmp"
> radutmp: username = "%{User-Name}"
> radutmp: case_sensitive = yes
> radutmp: check_with_nas = yes
> radutmp: perm = 384
> radutmp: callerid = yes
> Module: Instantiated radutmp (radutmp)
> Listening on authentication *:1812
> Listening on accounting *:1813
> Ready to process requests.
> rad_recv: Access-Request packet from host
> 192.168.50.127:3337, id=18, length=48
> User-Name = "burst01"
> CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22
> Processing the authorize section of radiusd.conf
> modcall: entering group authorize for request 0
> modcall[authorize]: module "preprocess" returns ok for request 0
> rlm_chap: Setting 'Auth-Type := CHAP'
> modcall[authorize]: module "chap" returns ok for request 0
> modcall[authorize]: module "mschap" returns noop for request 0
> rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL
> rlm_realm: No such realm "NULL"
> modcall[authorize]: module "suffix" returns noop for request 0
> rlm_eap: No EAP-Message, not doing EAP
> modcall[authorize]: module "eap" returns noop for request 0
> users: Matched entry DEFAULT at line 152
> modcall[authorize]: module "files" returns ok for request 0
> modcall: leaving group authorize (returns ok) for request 0
> rad_check_password: Found Auth-Type CHAP
> auth: type "CHAP"
> Processing the authenticate section of radiusd.conf
> modcall: entering group CHAP for request 0
> rlm_chap: login attempt by "burst01" with CHAP password
> rlm_chap: Could not find clear text password for user burst01
> modcall[authenticate]: module "chap" returns invalid for request 0
> modcall: leaving group CHAP (returns invalid) for request 0
> auth: Failed to validate the user.
> Delaying request 0 for 1 seconds
> Finished request 0
> Going to the next request
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Waking up in 1 seconds...
> --- Walking the entire request list ---
> Sending Access-Reject of id 18 to 192.168.50.127 port 3337
> Waking up in 4 seconds...
> --- Walking the entire request list ---
> Cleaning up request 0 ID 18 with timestamp 443bc5b9
> Nothing to do. Sleeping until we see a request.
>
> I think I'll put a protocol analyser on this (when I've time)
> and see what is passing between the PC and RADIUS and what
> (if anything) is passing between RADIUS and AD.
>
A quick look seems to show that the radius server does not contact a DC between the request and the subsequent rejection.
Steve.
______________________________________________________________________
This email has been scanned by the MessageLabs Email Security System.
For more information please visit http://www.messagelabs.com/email
______________________________________________________________________
More information about the Freeradius-Users
mailing list