February 2006 - Freeradius-Devel - lists.freeradius.org

php and freeradius
by Pezhman Lali 27 Feb '06

27 Feb '06

Tanx Dear Allen I can reply back an attribute to my nas, but a little problem, when I want to send back more than one attribue , none of them aren't sent. but each one works properly alonely. this is my php: #!/usr/bin/php -f <?php $u="root"; $h="radius"; $_ENV['Access-Request']=TRUE; $f = fopen('./php.log','w'); fwrite($f,print_r($_ENV,TRUE)); fclose($f); $minutes=100; $mtu=100; echo "Session-Timeout :=\"$minutes\""; echo "Framed-MTU:=\"$mtu\""; exit(0) ; ?> and also this is my last lines of Debug mode. rad_recv: Access-Request packet from host 217.218.95.126:40973, id=98, length=56 User-Name = "reza" User-Password = "12340" NAS-IP-Address = 255.255.255.255 NAS-Port = 12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 users: Matched entry DEFAULT at line 186 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: '/usr/local/etc/raddb/test.php ' Exec-Program: /usr/local/etc/raddb/test.php Exec-Program output: Session-Timeout :="100"Framed-MTU:="100" Exec-Program-Wait: plaintext: Session-Timeout :="100"Framed-MTU:="100" Exec-Program: returned: 0 modcall[authorize]: module "authphp" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [reza/12340] (from client 217.218.95.126 port 12) Sending Access-Accept of id 98 to 217.218.95.126:40973 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 98 with timestamp 442ac3ec Nothing to do. Sleeping until we see a request. is it a true limitation? or I have a wrong? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

php and freeradius
by Pezhman Lali 26 Feb '06

26 Feb '06

hi, how can send back attributes from php script(as external) to nas? like Framed-IP-Address? or etc? tanx --------------------------------- Yahoo! Mail Bring photos to life! New PhotoMail makes sharing a breeze.

2 1

very large installations: req/s?
by Frank Cusack 24 Feb '06

24 Feb '06

Hi I'm wondering about folks that have very large installations, 100k+ users. Can you share the number of users, the type of site (ISP/enterprise VPN/etc), and the radius req/s that you get? I'm curious about the ratio of users to req/s for different types of sites. I guess 3 req = one user access, ie one auth and 2 acct packets. Should you care to respond, please be clear about how you are reporting a "request". thanks! -frank

1 0

quintum
by Pezhman Lali 24 Feb '06

24 Feb '06

tanx for your helping about php and freeradius now I want to implement Freeradius for aaa voip calling, using tenor nas. is there any special dictionary to send and receive attributes, and next,is my old question, how can send attr from external scripts such as php,to connected nas? best Pezhman --------------------------------- Yahoo! Mail Use Photomail to share photos without annoying attachments.

1 0

problems about pam and freeradius
by 陈旭 23 Feb '06

23 Feb '06

Hello, FreeRadiusDevel I've got a server running redhat linux. I am testing to login with ssd2, which will send the login request to my correctly configured radius server(running freeradius 1.0.5, and sybase 12.5). I installed PAM following the guide carefully and things seemed to be OK. I've also insert the login info into Sybase(login info in radcheck, and reply info in radreply). After that, I rewrote the configure file: /etc/pam.d/sshd, and the new as following: #%PAM-1.0 #auth required pam_stack.so service=system-auth #auth required pam_nologin.so auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_radius_auth.so conf=/etc/raddb/server/pam_radius_auth.conf debug auth required /lib/security/pam_unix_auth.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session required pam_limits.so session optional pam_console.so so, I send a login request to the server, and expect that I can login into the server correctly. But things start going wrong. I found my radius server has correctly authenticated the request, and an Access-Accept packet is sent to the server that I'm going to login. But the server seems to ignore the Access-Accept packet, and denied my request, though the login user name and the password is correct. I think I am quite near to success, but failed at the last step. Anybody tells me what is going wrong? How can I success login to the server with the pam and radius? Thanks a lot and any reply will be appreciated. MSN: oicqcx(a)hotmail.com

1 0

Re: Freeradius-Devel Digest, Vol 10, Issue 24
by InCho Chong 23 Feb '06

23 Feb '06

> pam_radius can't do that. I have patches which should make this work, > which I could send you. But the configuration is quite complex. You > may not be up to the task if you're not able to debug your more basic > setup. > > You should try running radiusd with -X to get useful debug information. > Can you least share some of your insight? This is typical setup, but I have not been able to get CentOS4.2 PAM to use pam_radius for authentication. Currently I am able to use RADIUS to AAA most of the network devices, but want to also AAA linux ssh login as well without success. I have ran the RADIUS with -X option, but have not even seen the traffic on the RADIUS server. Only logs I have been able to locate were on the client server's messages. Even though I was able to compile pam_radius_auth.so on CentOS server, it is suspect. I am pretty sure, if you give me enough information I should be able to follow most complex setup on Linux. InCho

2 1

Re: PAM_RADIUS Authentication Setup for CentOS4.2
by InCho Chong 23 Feb '06

23 Feb '06

> pam_radius can't do that. I have patches which should make this work, > which I could send you. But the configuration is quite complex. You > may not be up to the task if you're not able to debug your more basic > setup. > > You should try running radiusd with -X to get useful debug information. > Can you least share some of your insight? This is typical setup, but I have not been able to get CentOS4.2 PAM to use pam_radius for authentication. Currently I am able to use RADIUS to AAA most of the network devices, but want to also AAA linux ssh login as well without success. I have ran the RADIUS with -X option, but have not even seen the traffic on the RADIUS server. Only logs I have been able to locate were on the client server's messages. Even though I was able to compile pam_radius_auth.so on CentOS server, it is suspect. I am pretty sure, if you give me enough information I should be able to follow most complex setup on Linux. InCho

2 1

PAM_RADIUS Authentication Setup for CentOS4.2
by InCho Chong 23 Feb '06

23 Feb '06

Using FreeRadius 1.0.5 I have attempted using Toby Zimmerer's post, but have not yet been able to get this work on CentOS 4.2. CentOS4.2 should resemble RedHat ES closely. I am just wondering, if anyone has gotten this to work properly. I am trying to use PAM_RADIUS, but having some issues. I am trying to use the pam_radius_auth.so (I was able to compile it on CentOS4.2) to use RADIUS as primary authentication and if RADIUS server is not reachable, then use native unix_auth. I have the client configured in RADIUS, I have created a /etc/raddb/server file to point to the RADIUS servers, modified /etc/pam.d/sshd as following: #%PAM-1.0 # auth required pam_stack.so service=system-auth auth required pam_radius_auth.so # auth required pam_nologin.so # account required pam_stack.so service=system-auth account required pam_radius_auth.so password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session required pam_loginuid.so But I am not getting the authentication to work. /var/log/secure shows following: Feb 16 12:44:53 eastern-dge-2 sshd[24372]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 2433732. Feb 16 12:44:55 eastern-dge-2 sshd[24372]: Failed password for invalid user ICHONG from ::ffff:172.25.1.190 port 4145 Feb 16 12:45:25 eastern-dge-2 sshd[24465]: Invalid user ichong from ::ffff:172.25.1.190 Feb 16 12:45:26 eastern-dge-2 sshd[24465]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 3883716. Feb 16 12:45:29 eastern-dge-2 sshd[24465]: Failed password for invalid user ichong from ::ffff:172.25.1.190 port 4146 /var/log/messages shows following: Feb 16 12:44:53 eastern-dge-2 sshd(pam_unix)[24372]: check pass; user unknown Feb 16 12:45:14 eastern-dge-2 sshd(pam_unix)[24372]: 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.25.1.190 Feb 16 12:45:26 eastern-dge-2 sshd(pam_unix)[24465]: check pass; user unknown Feb 16 12:45:26 eastern-dge-2 sshd(pam_unix)[24465]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.25.1.190 Please help. Thanks, InCho

2 1

php and freeradius
by Pezhman Lali 21 Feb '06

21 Feb '06

tanx for youe great help, now, my freeradius can Authorizes users by PHP script, also start and stop accounting. but reply(Authentication) and nas control( checking secret key) done via freeradius,1)I want to add these items to php too. I did these testes by ntradping, but I want to run this freeradius for voip aaa (quintum tenor), 2)is there any simulator like ntradping for voice packets. 3) am I need any new freeradius's plugin to work with quintum(tenor)? 4) where can I find any good Document, specialy talks about voip aaa with freeradius (executes external php scripts for AAA). Best __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

php and freeradius
by Pezhman Lali 19 Feb '06

19 Feb '06

tanx for reply, this is mut debug output with -X. at last my user was rejected, how can define auth-type? Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 3 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded exec exec: wait = yes exec: program = "/usr/local/etc/raddb/exec-program-wait" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "(null)" Module: Instantiated exec (authphp) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:38170, id=57, length=56 User-Name = "reza" User-Password = "12349" NAS-IP-Address = 255.255.255.255 NAS-Port = 12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "reza", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: '/usr/local/etc/raddb/exec-program-wait' Exec-Program: /usr/local/etc/raddb/exec-program-wait /usr/local/etc/raddb/exec-program-wait: line 8: Exec-Program-Wait: command not found Exec-Program output: Reply-Message += "Hello, %u", Reply-Message += "PATH=/usr/local/bin:/bin:/usr/bin", Framed-IP-Address = 255.255.255.255 Exec-Program-Wait: value-pairs: Reply-Message += "Hello, %u", Reply-Message += "PATH=/usr/local/bin:/bin:/usr/bin", Framed-IP-Address = 255.255.255.255 Exec-Program: returned: 0 modcall[authorize]: module "authphp" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [reza/12349] (from client 217.218.95.126 port 12) Delaying request 0 for 3 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 127.0.0.1:38170, id=57, length=56 Sending Access-Reject of id 57 to 127.0.0.1:38170 Reply-Message += "Hello, %u" Reply-Message += "PATH=/usr/local/bin:/bin:/usr/bin" --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 57 with timestamp 441f4a79 Nothing to do. Sleeping until we see a request. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1