RE: Error with AD/freeradius config
I can't guarantee the syntax of the ntlm_auth command is correct for OP's particular environment, but I will guarantee you must specify the correct path to the Samba ntlm_auth binary. As for perms, I agree they can be tricky. If I run into issues I typically start running stuff as root. Not fail safe, but does uncover perms issues pretty quick. G -Original Message- From: freeradius-users-bounces+ggatten=waddell@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org] On Behalf Of Sallee, Stephen (Jake) Sent: Friday, July 15, 2011 10:53 AM To: FreeRadius users mailing list Subject: RE: Error with AD/freeradius config If I may interject... if Gary's hint does not pan out I would suggest also checking that the ntlm_auth binary is accessible to the FR daemon, I had an issue on my box that the file permissions were correct but one of the directories in the path was denying me access. So not only does the file need the correct permissions but every directory in the path does too. That one was a bugger to pin down the first time I came against it : ) Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221 -Original Message- From: freeradius-users-bounces+jake.sallee=umhb@lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb@lists.freeradius.org] On Behalf Of Edge Sent: Friday, July 15, 2011 10:42 AM To: freeradius-users@lists.freeradius.org Subject: Re: Error with AD/freeradius config Hi Arran, I did read the debug messages, I just didn't understand what they were telling me, I couldn't understand why it had failed to execute as the file was there, I was root and I even tried using an admin account - just in case.. Gary has given me a clue so off I go hunting.. Thanks Guys and have a good weekend -Original Message- From: freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org [mailto:freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org] On Behalf Of freeradius-users-requ...@lists.freeradius.org Sent: 15 July 2011 16:17 To: freeradius-users@lists.freeradius.org Subject: Freeradius-Users Digest, Vol 75, Issue 58 Send Freeradius-Users mailing list submissions to freeradius-users@lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-requ...@lists.freeradius.org You can reach the person managing the list at freeradius-users-ow...@lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Error with AD/freeradius config (Arran Cudbard-Bell) 2. Re: Stripped-User-Name Problems (Re: Unmatched ( or \(, and, ?more?broadly, setting Stripped-User-Name) (Alexander Clouter) 3. RE: Error with AD/freeradius config (Gary Gatten) -- Message: 1 Date: Fri, 15 Jul 2011 16:31:34 +0200 From: Arran Cudbard-Bell Subject: Re: Error with AD/freeradius config To: FreeRadius users mailing list Message-ID: <7df14eea-3164-48bd-996b-8edc42c59...@freeradius.org> Content-Type: text/plain; charset=us-ascii On Jul 15, 2011, at 4:26 PM, Edge wrote: > Exec-Program output: Exec-Program: FAILED to execute > /usr/local/etc/raddb/modules/ntlm_auth: Permission denied > Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute > /usr/local/etc/raddb/modules/ntlm_auth: Permission denied Helps to actually read the debug output you're posting ;) Arran Cudbard-Bell a.cudba...@freeradius.org RADIUS - Half the complexity of Diameter -- Message: 2 Date: Fri, 15 Jul 2011 15:49:34 +0100 From: Alexander Clouter Subject: Re: Stripped-User-Name Problems (Re: Unmatched ( or \(, and, ?more?broadly, setting Stripped-User-Name) To: freeradius-users@lists.freeradius.org Message-ID: Phil Mayers wrote: > >>Unfortunately, when you set nostrip in the config, it doesn't add a >>Stripped-User-Name attribute to the request, but when you unset it, >>rlm_realms adds a Stripped-User-Name attribute and also updates the >>User-Name attribute to the same value. > > I am 90% sure that's not what rlm_realm does. We use unlang to process > realms now, but I am certain we used it with nostrip and it left the > original User-Name intact and populated Stripped-User-Name. > You are right, we use rlm_realm and it leaves User-Name unadulterated. This sounds like maybe the *inner* auth User-Name is realmless and making it's way out into outer.reply. When you use
RE: Error with AD/freeradius config
If I may interject... if Gary's hint does not pan out I would suggest also
checking that the ntlm_auth binary is accessible to the FR daemon, I had an
issue on my box that the file permissions were correct but one of the
directories in the path was denying me access. So not only does the file need
the correct permissions but every directory in the path does too. That one was
a bugger to pin down the first time I came against it : )
Jake Sallee
Godfather of Bandwidth
System Engineer
University of Mary Hardin-Baylor
900 College St.
Belton, Texas
76513
Fone: 254-295-4658
Phax: 254-295-4221
-Original Message-
From: freeradius-users-bounces+jake.sallee=umhb@lists.freeradius.org
[mailto:freeradius-users-bounces+jake.sallee=umhb@lists.freeradius.org] On
Behalf Of Edge
Sent: Friday, July 15, 2011 10:42 AM
To: freeradius-users@lists.freeradius.org
Subject: Re: Error with AD/freeradius config
Hi
Arran, I did read the debug messages, I just didn't understand what they were
telling me, I couldn't understand why it had failed to execute as the file was
there, I was root and I even tried using an admin account - just in case..
Gary has given me a clue so off I go hunting..
Thanks Guys and have a good weekend
-Original Message-
From: freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org
[mailto:freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org]
On Behalf Of freeradius-users-requ...@lists.freeradius.org
Sent: 15 July 2011 16:17
To: freeradius-users@lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 75, Issue 58
Send Freeradius-Users mailing list submissions to
freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-requ...@lists.freeradius.org
You can reach the person managing the list at
freeradius-users-ow...@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than
"Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Error with AD/freeradius config (Arran Cudbard-Bell)
2. Re: Stripped-User-Name Problems (Re: Unmatched ( or \(, and,
?more?broadly, setting Stripped-User-Name) (Alexander Clouter)
3. RE: Error with AD/freeradius config (Gary Gatten)
--
Message: 1
Date: Fri, 15 Jul 2011 16:31:34 +0200
From: Arran Cudbard-Bell
Subject: Re: Error with AD/freeradius config
To: FreeRadius users mailing list
Message-ID: <7df14eea-3164-48bd-996b-8edc42c59...@freeradius.org>
Content-Type: text/plain; charset=us-ascii
On Jul 15, 2011, at 4:26 PM, Edge wrote:
> Exec-Program output: Exec-Program: FAILED to execute
> /usr/local/etc/raddb/modules/ntlm_auth: Permission denied
> Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute
> /usr/local/etc/raddb/modules/ntlm_auth: Permission denied
Helps to actually read the debug output you're posting ;)
Arran Cudbard-Bell
a.cudba...@freeradius.org
RADIUS - Half the complexity of Diameter
--
Message: 2
Date: Fri, 15 Jul 2011 15:49:34 +0100
From: Alexander Clouter
Subject: Re: Stripped-User-Name Problems (Re: Unmatched ( or \(, and,
?more?broadly, setting Stripped-User-Name)
To: freeradius-users@lists.freeradius.org
Message-ID:
Phil Mayers wrote:
>
>>Unfortunately, when you set nostrip in the config, it doesn't add a
>>Stripped-User-Name attribute to the request, but when you unset it,
>>rlm_realms adds a Stripped-User-Name attribute and also updates the
>>User-Name attribute to the same value.
>
> I am 90% sure that's not what rlm_realm does. We use unlang to process
> realms now, but I am certain we used it with nostrip and it left the
> original User-Name intact and populated Stripped-User-Name.
>
You are right, we use rlm_realm and it leaves User-Name unadulterated.
This sounds like maybe the *inner* auth User-Name is realmless and making it's
way out into outer.reply. When you use 'User-Name' in post-auth{} you will get
reply:User-Name rather than request:User-Name if I remember correctly.
The fix is to *reject* inner-authentications that are realm-less.
Cheers
--
Alexander Clouter
.sigmonster says: You are the only person to ever get this message.
------
Message: 3
Date: Fri, 15 Jul 2011 10:16:48 -0500
From: Gary Gatten
Subject: RE: Error with AD/freeradius config
To: "'FreeRadius users mailing list'"
Message-ID:
<30615_1310743009_4E2059E1_30615_115_1_D9B37353831173459FDAA836D3B43499C5218
6...@wadpmbxv0.waddell.com>
Content-Type: text/plain; charset="us-ascii"
Re: Error with AD/freeradius config
Hi
Arran, I did read the debug messages, I just didn't understand what they
were telling me, I couldn't understand why it had failed to execute as the
file was there, I was root and I even tried using an admin account - just in
case..
Gary has given me a clue so off I go hunting..
Thanks Guys and have a good weekend
-Original Message-
From: freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org
[mailto:freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org]
On Behalf Of freeradius-users-requ...@lists.freeradius.org
Sent: 15 July 2011 16:17
To: freeradius-users@lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 75, Issue 58
Send Freeradius-Users mailing list submissions to
freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-requ...@lists.freeradius.org
You can reach the person managing the list at
freeradius-users-ow...@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than
"Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Error with AD/freeradius config (Arran Cudbard-Bell)
2. Re: Stripped-User-Name Problems (Re: Unmatched ( or \(, and,
?more?broadly, setting Stripped-User-Name) (Alexander Clouter)
3. RE: Error with AD/freeradius config (Gary Gatten)
--
Message: 1
Date: Fri, 15 Jul 2011 16:31:34 +0200
From: Arran Cudbard-Bell
Subject: Re: Error with AD/freeradius config
To: FreeRadius users mailing list
Message-ID: <7df14eea-3164-48bd-996b-8edc42c59...@freeradius.org>
Content-Type: text/plain; charset=us-ascii
On Jul 15, 2011, at 4:26 PM, Edge wrote:
> Exec-Program output: Exec-Program: FAILED to execute
> /usr/local/etc/raddb/modules/ntlm_auth: Permission denied
> Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute
> /usr/local/etc/raddb/modules/ntlm_auth: Permission denied
Helps to actually read the debug output you're posting ;)
Arran Cudbard-Bell
a.cudba...@freeradius.org
RADIUS - Half the complexity of Diameter
--
Message: 2
Date: Fri, 15 Jul 2011 15:49:34 +0100
From: Alexander Clouter
Subject: Re: Stripped-User-Name Problems (Re: Unmatched ( or \(, and,
?more?broadly, setting Stripped-User-Name)
To: freeradius-users@lists.freeradius.org
Message-ID:
Phil Mayers wrote:
>
>>Unfortunately, when you set nostrip in the config, it doesn't add a
>>Stripped-User-Name attribute to the request, but when you unset it,
>>rlm_realms adds a Stripped-User-Name attribute and also updates the
>>User-Name attribute to the same value.
>
> I am 90% sure that's not what rlm_realm does. We use unlang to process
> realms now, but I am certain we used it with nostrip and it left the
> original User-Name intact and populated Stripped-User-Name.
>
You are right, we use rlm_realm and it leaves User-Name unadulterated.
This sounds like maybe the *inner* auth User-Name is realmless and
making it's way out into outer.reply. When you use 'User-Name' in
post-auth{} you will get reply:User-Name rather than request:User-Name
if I remember correctly.
The fix is to *reject* inner-authentications that are realm-less.
Cheers
--
Alexander Clouter
.sigmonster says: You are the only person to ever get this message.
----------
Message: 3
Date: Fri, 15 Jul 2011 10:16:48 -0500
From: Gary Gatten
Subject: RE: Error with AD/freeradius config
To: "'FreeRadius users mailing list'"
Message-ID:
<30615_1310743009_4E2059E1_30615_115_1_D9B37353831173459FDAA836D3B43499C5218
6...@wadpmbxv0.waddell.com>
Content-Type: text/plain; charset="us-ascii"
Exec-Program output: Exec-Program: FAILED to execute
/usr/local/etc/raddb/modules/ntlm_auth: Permission denied
Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute
/usr/local/etc/raddb/modules/ntlm_auth: Permission denied
Your path to ntlm auth is wrong. You need to specify the path to the ntlm
auth bin/exe that comes with samba.
G
-Original Message-
From: freeradius-users-bounces+ggatten=waddell@lists.freeradius.org
[mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org]
On Behalf Of Edge
Sent: Friday, July 15, 2011 9:27 AM
To: freeradius-users@lists.freeradius.org
Subject: Error with AD/freeradius config
OK, sorry as this is a long mail because Im going to include as much config
as possible.
I have been playing around trying to get this to work with little success
though the debug error messages have changed since yesterday
Im having trouble getting freeradius to us
RE: Error with AD/freeradius config
Exec-Program output: Exec-Program: FAILED to execute
/usr/local/etc/raddb/modules/ntlm_auth: Permission denied
Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute
/usr/local/etc/raddb/modules/ntlm_auth: Permission denied
Your path to ntlm auth is wrong. You need to specify the path to the ntlm auth
bin/exe that comes with samba.
G
-Original Message-
From: freeradius-users-bounces+ggatten=waddell@lists.freeradius.org
[mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org] On
Behalf Of Edge
Sent: Friday, July 15, 2011 9:27 AM
To: freeradius-users@lists.freeradius.org
Subject: Error with AD/freeradius config
OK, sorry as this is a long mail because Im going to include as much config
as possible.
I have been playing around trying to get this to work with little success
though the debug error messages have changed since yesterday
Im having trouble getting freeradius to use ntlm_auth - the error massage is
now stating a permission error..
Just to confirm, Im following the steps on deployingradius.com ..
PAP has been tested and is working
Samba configured and working
wbinfo -a = works, having tested multiple logins
ntlm_auth --request-nt-key --domain=MYDOMAIN --username=user
--password=password = working, again tested with multiple logins
radtest user password localhost 0 testing123 = does not work, see debug info
at end of email..
Contents of/raddb/modules/ntlm_auth file
#
# For testing ntlm_auth authentication with PAP.
#
# If you have problems with authentication failing, even when the
# password is good, it may be a bug in Samba:
#
# https://bugzilla.samba.org/show_bug.cgi?id=6563
#
exec ntlm_auth {
wait = yes
program = "/usr/local/etc/raddb/modules/ntlm_auth --request-nt-key
--domain=xx --username=%{mschap:User-Name}
--password=%{User-Password}"
}
I have modified the authenticate sections of the raddb/sites-enabled/default
file, and of the raddb/sites-enabled/inner-tunnel file
Listed below are the authenticate sections only as that is all I have
changed
sites-enabled/default
authenticate {
#
# PAP authentication, when a back-end database listed
# in the 'authorize' section supplies a password. The
# password can be clear-text, or encrypted.
Auth-Type PAP {
pap
}
#
# Most people want CHAP authentication
# A back-end database listed in the 'authorize' section
# MUST supply a CLEAR TEXT password. Encrypted passwords
# won't work.
Auth-Type CHAP {
chap
}
#
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
# ntlm authentication.
ntlm_auth
# If you have a Cisco SIP server authenticating against
# FreeRADIUS, uncomment the following line, and the 'digest'
# line in the 'authorize' section.
digest
#
# Pluggable Authentication Modules.
# pam
#
# See 'man getpwent' for information on how the 'unix'
# module checks the users password. Note that packets
# containing CHAP-Password attributes CANNOT be authenticated
# against /etc/passwd! See the FAQ for details.
#
# For normal "crypt" authentication, the "pap" module should
# be used instead of the "unix" module. The "unix" module should
# be used for authentication ONLY for compatibility with legacy
# FreeRADIUS configurations.
#
unix
# Uncomment it if you want to use ldap for authentication
#
# Note that this means "check plain-text password against
# the ldap database", which means that EAP won't work,
# as it does not supply a plain-text password.
# Auth-Type LDAP {
# ldap
# }
#
# Allow EAP authentication.
eap
#
# The older configurations sent a number of attributes in
# Access-Challenge packets, which wasn't strictly correct.
# If you want to filter out these attributes, uncomment
# the following lines.
#
# Auth-Type eap {
# eap {
# handled = 1
# }
# if (handled && (Response-Packet-Type == Access-Challenge)) {
# attr_filter.access_challenge.post-auth
# handled # override the "updated" code from
attr_filter
# }
# }
}
#
raddb/sites-enabled/inner-tunnel file - again just showing the bit
modified..
#
authenticate {
#
# PAP authentication, when a back-end database listed
# in the 'authorize' section supplies a password. The
# password can be clear-text, or encrypted.
Auth-Type PAP {
pap
}
#
# Most people want CHAP authentic
Re: Error with AD/freeradius config
On Jul 15, 2011, at 4:26 PM, Edge wrote: > Exec-Program output: Exec-Program: FAILED to execute > /usr/local/etc/raddb/modules/ntlm_auth: Permission denied > Exec-Program-Wait: plaintext: Exec-Program: FAILED to execute > /usr/local/etc/raddb/modules/ntlm_auth: Permission denied Helps to actually read the debug output you're posting ;) Arran Cudbard-Bell a.cudba...@freeradius.org RADIUS - Half the complexity of Diameter - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Error with AD/freeradius config
On 07/14/2011 06:11 PM, Arran Cudbard-Bell wrote: How about what I've just put there? Neat :) Looks good. Tweaked a few bits and pieces and converted it back to RST. I wanted this to be bundled with general AD Back to? There was just an empty page there when I visited, or am I missing your point? Anyway. RST, Markdown, not fussed (except for code formatting - see my other email) documentation in the docs directory at some point. Sounds sensible. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Error with AD/freeradius config
On Jul 14, 2011, at 6:29 PM, Phil Mayers wrote: > On 14/07/11 16:34, Arran Cudbard-Bell wrote: > >> http://wiki.freeradius.org/NTLM+Auth+with+PAP+HOWTO > > How about what I've just put there? Neat :) Looks good. Tweaked a few bits and pieces and converted it back to RST. I wanted this to be bundled with general AD documentation in the docs directory at some point. -Arran Arran Cudbard-Bell a.cudba...@freeradius.org RADIUS - Half the complexity of Diameter - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Error with AD/freeradius config
On Jul 14, 2011, at 6:03 PM, Gary Gatten wrote: > Not sure if that was intended for OP or myself, but I went to check it out > and it wants me to login. I did with my fb, but then it wanted “access” to > stuff I don’t want to share – so I can’t read it. No matter what FB says, all omnigollum is interested in is your name and email (I know, I wrote it). Can't figure out where the privacy control settings are for the App on Facebook, so if you have an issue, sign up with GitHub or twitter. But anyway, you only actually need to sign in to edit or create pages. gollum was just getting confused... and i've unconfused it. > > In my case I use (currently) ntlm_auth exclusively, so setting the default to > that doesn’t bother me – much…. At some point I’ll need to do some LDAP > stuff, which then I’m sure it will bother me more. Probably not, but the correct way to do it is posted at that wiki page. -Arran > > G > > > From: freeradius-users-bounces+ggatten=waddell@lists.freeradius.org > [mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org] On > Behalf Of Arran Cudbard-Bell > Sent: Thursday, July 14, 2011 10:34 AM > To: FreeRadius users mailing list > Subject: Re: Error with AD/freeradius config > > > On Jul 14, 2011, at 5:18 PM, Gary Gatten wrote: > > > I don’t think you need braces and such, this is not as much an auth type as a > method > > Try just a single line that reads: ntlm_auth > > Also, I actually had to set my default auth-type to ntlm_auth. You know the > part where it says “…for testing only..”. in the users file? But, I had to > leave it in or it would never call ntlm_auth and hence to logins would work. > > G > > See here *sigh*: > > http://wiki.freeradius.org/NTLM+Auth+with+PAP+HOWTO > > > Arran Cudbard-Bell > a.cudba...@freeradius.org > > RADIUS - Half the complexity of Diameter > > "This email is intended to be reviewed by only the intended recipient and may > contain information that is privileged and/or confidential. If you are not > the intended recipient, you are hereby notified that any review, use, > dissemination, disclosure or copying of this email and its attachments, if > any, is strictly prohibited. If you have received this email in error, please > immediately notify the sender by return email and delete this email from your > system." > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Arran Cudbard-Bell a.cudba...@freeradius.org RADIUS - Half the complexity of Diameter - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Error with AD/freeradius config
On 14/07/11 16:34, Arran Cudbard-Bell wrote: http://wiki.freeradius.org/NTLM+Auth+with+PAP+HOWTO How about what I've just put there? Needs testing, but it should work. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
RE: Error with AD/freeradius config
Where do you have the ntlm_auth "command" specified? You "can" put it in
numerous/various FR conf files; I think mine is in radiusd.conf, but I forget.
And, what IS that command? It should be essentially the same command you
execute to test SAMBA with outside the FR environment.
I can help more after lunch if needed. Well, helping "more" assumed I've
helped "some" already - which is a big assumption huh!?
G
-Original Message-
From: freeradius-users-bounces+ggatten=waddell@lists.freeradius.org
[mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org] On
Behalf Of Edge
Sent: Thursday, July 14, 2011 11:18 AM
To: freeradius-users@lists.freeradius.org
Subject: Re: Error with AD/freeradius config
Thanks for the quick reply Gary
I changed the /usr/local/etc/raddb/sites-enabled/default file to
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
# ntlm authentication.
ntlm_auth
#
I also changed the /usr/local/etc/raddb/sites-enabled/inner-tunnel file to
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
#
# NTLM authentication.
ntlm_auth
# Pluggable Authentication Modules.
I can confirm that the top of my users file has the following entry..
DEFAULT Auth-Type = ntlm_auth
The debug file is still giving the same output..
rad_recv: Access-Request packet from host 127.0.0.1 port 46984, id=103,
length=60
User-Name = ""
User-Password = "xxx"
NAS-IP-Address = xxx.xxx.xxx.xxx
NAS-Port = 0
# Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication
may fail because of this.
++[pap] returns noop
ERROR: No authenticate method (Auth-Type) found for the request: Rejecting
the user
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> xxx
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 17 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 17
Sending Access-Reject of id 103 to 127.0.0.1 port 46984
Waking up in 4.9 seconds.
Cleaning up request 17 ID 103 with timestamp +95119
Ready to process requests.
-Original Message-
From: freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org
[mailto:freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org]
On Behalf Of freeradius-users-requ...@lists.freeradius.org
Sent: 14 July 2011 16:19
To: freeradius-users@lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 75, Issue 49
Send Freeradius-Users mailing list submissions to
freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-requ...@lists.freeradius.org
You can reach the person managing the list at
freeradius-users-ow...@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than
"Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Error with AD/freeradius config (Phil Mayers)
2. Re: SoH - FR 2.1.11 (Phil Mayers)
3. RE: Error with AD/freeradius config (Gary Gatten)
------------------
Message: 1
Date: Thu, 14 Jul 2011 16:13:28 +0100
From: Phil Mayers
Subject: Re: Error with AD/freeradius config
To: freeradius-users@lists.freeradius.org
Message-ID: <4e1f0798.3000...@imperial.ac.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 14/07/11 16:04, Edge wrote:
> My /sites-enabled/default file - I have just copied the authentication
> section as everything else in the file is at default settings
Not necessary or helpful. Full debug (which you didn't provide; you trimmed
the start) is what's needed.
>
> rad_recv: Access-Request packet from host 127.0.0.1 port 44992,
> id=218,
> length=60
>
> User-Name = ""
>
> User-Password = "x"
Re: Error with AD/freeradius config
Thanks for the quick reply Gary
I changed the /usr/local/etc/raddb/sites-enabled/default file to
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
# ntlm authentication.
ntlm_auth
#
I also changed the /usr/local/etc/raddb/sites-enabled/inner-tunnel file to
# MSCHAP authentication.
Auth-Type MS-CHAP {
mschap
}
#
# NTLM authentication.
ntlm_auth
# Pluggable Authentication Modules.
I can confirm that the top of my users file has the following entry..
DEFAULT Auth-Type = ntlm_auth
The debug file is still giving the same output..
rad_recv: Access-Request packet from host 127.0.0.1 port 46984, id=103,
length=60
User-Name = ""
User-Password = "xxx"
NAS-IP-Address = xxx.xxx.xxx.xxx
NAS-Port = 0
# Executing section authorize from file
/usr/local/etc/raddb/sites-enabled/default
+- entering group authorize {...}
++[preprocess] returns ok
++[chap] returns noop
++[mschap] returns noop
++[digest] returns noop
[suffix] No '@' in User-Name = "", looking up realm NULL
[suffix] No such realm "NULL"
++[suffix] returns noop
[eap] No EAP-Message, not doing EAP
++[eap] returns noop
++[files] returns noop
++[expiration] returns noop
++[logintime] returns noop
[pap] WARNING! No "known good" password found for the user. Authentication
may fail because of this.
++[pap] returns noop
ERROR: No authenticate method (Auth-Type) found for the request: Rejecting
the user
Failed to authenticate the user.
Using Post-Auth-Type Reject
# Executing group from file /usr/local/etc/raddb/sites-enabled/default
+- entering group REJECT {...}
[attr_filter.access_reject] expand: %{User-Name} -> xxx
attr_filter: Matched entry DEFAULT at line 11
++[attr_filter.access_reject] returns updated
Delaying reject of request 17 for 1 seconds
Going to the next request
Waking up in 0.9 seconds.
Sending delayed reject for request 17
Sending Access-Reject of id 103 to 127.0.0.1 port 46984
Waking up in 4.9 seconds.
Cleaning up request 17 ID 103 with timestamp +95119
Ready to process requests.
-Original Message-
From: freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org
[mailto:freeradius-users-bounces+edgedemon=hotmail@lists.freeradius.org]
On Behalf Of freeradius-users-requ...@lists.freeradius.org
Sent: 14 July 2011 16:19
To: freeradius-users@lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 75, Issue 49
Send Freeradius-Users mailing list submissions to
freeradius-users@lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-requ...@lists.freeradius.org
You can reach the person managing the list at
freeradius-users-ow...@lists.freeradius.org
When replying, please edit your Subject line so it is more specific than
"Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: Error with AD/freeradius config (Phil Mayers)
2. Re: SoH - FR 2.1.11 (Phil Mayers)
3. RE: Error with AD/freeradius config (Gary Gatten)
------
Message: 1
Date: Thu, 14 Jul 2011 16:13:28 +0100
From: Phil Mayers
Subject: Re: Error with AD/freeradius config
To: freeradius-users@lists.freeradius.org
Message-ID: <4e1f0798.3000...@imperial.ac.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 14/07/11 16:04, Edge wrote:
> My /sites-enabled/default file - I have just copied the authentication
> section as everything else in the file is at default settings
Not necessary or helpful. Full debug (which you didn't provide; you trimmed
the start) is what's needed.
>
> rad_recv: Access-Request packet from host 127.0.0.1 port 44992,
> id=218,
> length=60
>
> User-Name = ""
>
> User-Password = "x"
>
> NAS-IP-Address = xxx.xxx.xxx.xxx
>
> NAS-Port = 0
This is not an MSCHAP request. It's a PAP request, probably from radtest or
radclient.
You need to test with EAP. Either use "eapol_test" from the wpa_supplicant
source, or use "radtest -t mschap" and direct the request to the "testing"
port of the inner-tunnel virtual server.
--
Message: 2
Date: Thu, 14 Jul 2011 16:14:48 +0100
From: Phil Mayers
Subject: Re: SoH - FR 2.1.11
To: freeradius-users@lists.freeradius.org
Message-ID: <4e1f07e8.6060...@imperial.ac.uk>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
On 14/07/11 15:59, Palmer J.D.F. wrote:
> Thanks Phil& Arran,
>
> I keep starting reply emails and another
RE: Error with AD/freeradius config
Not sure if that was intended for OP or myself, but I went to check it out and it wants me to login. I did with my fb, but then it wanted "access" to stuff I don't want to share - so I can't read it. In my case I use (currently) ntlm_auth exclusively, so setting the default to that doesn't bother me - much At some point I'll need to do some LDAP stuff, which then I'm sure it will bother me more. G From: freeradius-users-bounces+ggatten=waddell@lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: Thursday, July 14, 2011 10:34 AM To: FreeRadius users mailing list Subject: Re: Error with AD/freeradius config On Jul 14, 2011, at 5:18 PM, Gary Gatten wrote: I don't think you need braces and such, this is not as much an auth type as a method Try just a single line that reads: ntlm_auth Also, I actually had to set my default auth-type to ntlm_auth. You know the part where it says "...for testing only..". in the users file? But, I had to leave it in or it would never call ntlm_auth and hence to logins would work. G See here *sigh*: http://wiki.freeradius.org/NTLM+Auth+with+PAP+HOWTO Arran Cudbard-Bell a.cudba...@freeradius.org<mailto:a.cudba...@freeradius.org> RADIUS - Half the complexity of Diameter "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Error with AD/freeradius config
On Jul 14, 2011, at 5:18 PM, Gary Gatten wrote: > I don’t think you need braces and such, this is not as much an auth type as a > method > > Try just a single line that reads: ntlm_auth > > Also, I actually had to set my default auth-type to ntlm_auth. You know the > part where it says “…for testing only..”. in the users file? But, I had to > leave it in or it would never call ntlm_auth and hence to logins would work. > > G See here *sigh*: http://wiki.freeradius.org/NTLM+Auth+with+PAP+HOWTO > Arran Cudbard-Bell a.cudba...@freeradius.org RADIUS - Half the complexity of Diameter - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Re: Error with AD/freeradius config
On 14/07/11 16:04, Edge wrote: My /sites-enabled/default file - I have just copied the authentication section as everything else in the file is at default settings Not necessary or helpful. Full debug (which you didn't provide; you trimmed the start) is what's needed. rad_recv: Access-Request packet from host 127.0.0.1 port 44992, id=218, length=60 User-Name = "" User-Password = "x" NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port = 0 This is not an MSCHAP request. It's a PAP request, probably from radtest or radclient. You need to test with EAP. Either use "eapol_test" from the wpa_supplicant source, or use "radtest -t mschap" and direct the request to the "testing" port of the inner-tunnel virtual server. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
