- Freeradius-Devel - lists.freeradius.org

quintum
by Pezhman Lali 24 Feb '06

24 Feb '06

tanx for your helping about php and freeradius now I want to implement Freeradius for aaa voip calling, using tenor nas. is there any special dictionary to send and receive attributes, and next,is my old question, how can send attr from external scripts such as php,to connected nas? best Pezhman --------------------------------- Yahoo! Mail Use Photomail to share photos without annoying attachments.

1 0

problems about pam and freeradius
by 陈旭 24 Feb '06

24 Feb '06

Hello, FreeRadiusDevel I've got a server running redhat linux. I am testing to login with ssd2, which will send the login request to my correctly configured radius server(running freeradius 1.0.5, and sybase 12.5). I installed PAM following the guide carefully and things seemed to be OK. I've also insert the login info into Sybase(login info in radcheck, and reply info in radreply). After that, I rewrote the configure file: /etc/pam.d/sshd, and the new as following: #%PAM-1.0 #auth required pam_stack.so service=system-auth #auth required pam_nologin.so auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_radius_auth.so conf=/etc/raddb/server/pam_radius_auth.conf debug auth required /lib/security/pam_unix_auth.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session required pam_limits.so session optional pam_console.so so, I send a login request to the server, and expect that I can login into the server correctly. But things start going wrong. I found my radius server has correctly authenticated the request, and an Access-Accept packet is sent to the server that I'm going to login. But the server seems to ignore the Access-Accept packet, and denied my request, though the login user name and the password is correct. I think I am quite near to success, but failed at the last step. Anybody tells me what is going wrong? How can I success login to the server with the pam and radius? Thanks a lot and any reply will be appreciated. MSN: oicqcx(a)hotmail.com

1 0

Re: Freeradius-Devel Digest, Vol 10, Issue 24
by InCho Chong 23 Feb '06

23 Feb '06

> pam_radius can't do that. I have patches which should make this work, > which I could send you. But the configuration is quite complex. You > may not be up to the task if you're not able to debug your more basic > setup. > > You should try running radiusd with -X to get useful debug information. > Can you least share some of your insight? This is typical setup, but I have not been able to get CentOS4.2 PAM to use pam_radius for authentication. Currently I am able to use RADIUS to AAA most of the network devices, but want to also AAA linux ssh login as well without success. I have ran the RADIUS with -X option, but have not even seen the traffic on the RADIUS server. Only logs I have been able to locate were on the client server's messages. Even though I was able to compile pam_radius_auth.so on CentOS server, it is suspect. I am pretty sure, if you give me enough information I should be able to follow most complex setup on Linux. InCho

2 1

Re: PAM_RADIUS Authentication Setup for CentOS4.2
by InCho Chong 23 Feb '06

23 Feb '06

> pam_radius can't do that. I have patches which should make this work, > which I could send you. But the configuration is quite complex. You > may not be up to the task if you're not able to debug your more basic > setup. > > You should try running radiusd with -X to get useful debug information. > Can you least share some of your insight? This is typical setup, but I have not been able to get CentOS4.2 PAM to use pam_radius for authentication. Currently I am able to use RADIUS to AAA most of the network devices, but want to also AAA linux ssh login as well without success. I have ran the RADIUS with -X option, but have not even seen the traffic on the RADIUS server. Only logs I have been able to locate were on the client server's messages. Even though I was able to compile pam_radius_auth.so on CentOS server, it is suspect. I am pretty sure, if you give me enough information I should be able to follow most complex setup on Linux. InCho

2 1

PAM_RADIUS Authentication Setup for CentOS4.2
by InCho Chong 23 Feb '06

23 Feb '06

Using FreeRadius 1.0.5 I have attempted using Toby Zimmerer's post, but have not yet been able to get this work on CentOS 4.2. CentOS4.2 should resemble RedHat ES closely. I am just wondering, if anyone has gotten this to work properly. I am trying to use PAM_RADIUS, but having some issues. I am trying to use the pam_radius_auth.so (I was able to compile it on CentOS4.2) to use RADIUS as primary authentication and if RADIUS server is not reachable, then use native unix_auth. I have the client configured in RADIUS, I have created a /etc/raddb/server file to point to the RADIUS servers, modified /etc/pam.d/sshd as following: #%PAM-1.0 # auth required pam_stack.so service=system-auth auth required pam_radius_auth.so # auth required pam_nologin.so # account required pam_stack.so service=system-auth account required pam_radius_auth.so password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session required pam_loginuid.so But I am not getting the authentication to work. /var/log/secure shows following: Feb 16 12:44:53 eastern-dge-2 sshd[24372]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 2433732. Feb 16 12:44:55 eastern-dge-2 sshd[24372]: Failed password for invalid user ICHONG from ::ffff:172.25.1.190 port 4145 Feb 16 12:45:25 eastern-dge-2 sshd[24465]: Invalid user ichong from ::ffff:172.25.1.190 Feb 16 12:45:26 eastern-dge-2 sshd[24465]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 3883716. Feb 16 12:45:29 eastern-dge-2 sshd[24465]: Failed password for invalid user ichong from ::ffff:172.25.1.190 port 4146 /var/log/messages shows following: Feb 16 12:44:53 eastern-dge-2 sshd(pam_unix)[24372]: check pass; user unknown Feb 16 12:45:14 eastern-dge-2 sshd(pam_unix)[24372]: 1 more authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.25.1.190 Feb 16 12:45:26 eastern-dge-2 sshd(pam_unix)[24465]: check pass; user unknown Feb 16 12:45:26 eastern-dge-2 sshd(pam_unix)[24465]: authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=172.25.1.190 Please help. Thanks, InCho

2 1

php and freeradius
by Pezhman Lali 21 Feb '06

21 Feb '06

tanx for youe great help, now, my freeradius can Authorizes users by PHP script, also start and stop accounting. but reply(Authentication) and nas control( checking secret key) done via freeradius,1)I want to add these items to php too. I did these testes by ntradping, but I want to run this freeradius for voip aaa (quintum tenor), 2)is there any simulator like ntradping for voice packets. 3) am I need any new freeradius's plugin to work with quintum(tenor)? 4) where can I find any good Document, specialy talks about voip aaa with freeradius (executes external php scripts for AAA). Best __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

php and freeradius
by Pezhman Lali 20 Feb '06

20 Feb '06

tanx for reply, this is mut debug output with -X. at last my user was rejected, how can define auth-type? Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = yes main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 3 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded exec exec: wait = yes exec: program = "/usr/local/etc/raddb/exec-program-wait" exec: input_pairs = "request" exec: output_pairs = "reply" exec: packet_type = "(null)" Module: Instantiated exec (authphp) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:38170, id=57, length=56 User-Name = "reza" User-Password = "12349" NAS-IP-Address = 255.255.255.255 NAS-Port = 12 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "reza", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: '/usr/local/etc/raddb/exec-program-wait' Exec-Program: /usr/local/etc/raddb/exec-program-wait /usr/local/etc/raddb/exec-program-wait: line 8: Exec-Program-Wait: command not found Exec-Program output: Reply-Message += "Hello, %u", Reply-Message += "PATH=/usr/local/bin:/bin:/usr/bin", Framed-IP-Address = 255.255.255.255 Exec-Program-Wait: value-pairs: Reply-Message += "Hello, %u", Reply-Message += "PATH=/usr/local/bin:/bin:/usr/bin", Framed-IP-Address = 255.255.255.255 Exec-Program: returned: 0 modcall[authorize]: module "authphp" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [reza/12349] (from client 217.218.95.126 port 12) Delaying request 0 for 3 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 3 seconds... rad_recv: Access-Request packet from host 127.0.0.1:38170, id=57, length=56 Sending Access-Reject of id 57 to 127.0.0.1:38170 Reply-Message += "Hello, %u" Reply-Message += "PATH=/usr/local/bin:/bin:/usr/bin" --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 57 with timestamp 441f4a79 Nothing to do. Sleeping until we see a request. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

compiling freeradius 1.0.5 : config error: silently not building rlm_ldap
by sumi 19 Feb '06

19 Feb '06

Hi All, Do you any idea?? Please help me in fixing this issue. Im building freeradius-1.0.5. But rlm_ldap module was not built. Im setting the ldap library path correctly( hope so). I checked with the free-radius mailing list for the same issue. But im not able to fix it. Could please reply me if you have any idea?? Thanks in advance. FYI.. config output was.. configuring in src/modules/rlm_ldap running /bin/sh ./configure --prefix=/root/usr --with-kernel-version= 2.4.29-ccb-symbol--with-kernel-headers=/src/kernel/2.4.29-ccb-symbol/linux/include --with-openssl-libraries=/root/usr/lib --with-openssl-inc=/root/usr/include/openssl/ --without-kerberos --without-sql-mysql --enable-ltdl-install --with-rlm-ldap-lib-dir=/root/usr/local/lib --with-rlm-ldap-include-dir=/root/usr/include --with-ldap --cache-file=../../.././config.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) /i686-linux-gnu/gcc-3.4.1-glibc-2.3.3 /bin/i686-linux-gnu-gcc checking whether the C compiler (/i686-linux-gnu/gcc-3.4.1-glibc-2.3.3/bin/i686-linux-gnu-gcc -I/root/usr/include -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -L/root/usr/lib ) works... yes checking whether the C compiler (/i686-linux-gnu/gcc-3.4.1-glibc-2.3.3/bin/i686-linux-gnu-gcc -I/root/usr/include -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -L/root/usr/lib ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether /i686-linux-gnu/gcc-3.4.1-glibc-2.3.3/bin/i686-linux-gnu-gcc accepts -g... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking for ldap_init in -lldap_r... no checking for ldap.h... yes configure: warning: silently not building rlm_ldap. configure: warning: FAILURE: rlm_ldap requires: libldap_r. updating cache ../../.././config.cache creating ./config.status creating Makefile -- "If u look at what u dont have in life, u dont have anything But if u look at what u have in life, u have everything.....!!"

2 1

Automatic report from sources (radiusd) between 18.02.2006 - 19.02.2006 GMT
by Automatic cvs log generator 19 Feb '06

19 Feb '06

CVS log entries from 18.02.2006 (Sat) 09:00:02 - 19.02.2006 (Sun) 09:00:01 GMT ===================================================== Summary by authors ===================================================== Author: nbk File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revisions: 1.122.2.8.2.4 ===================================================== Log entries ===================================================== Description: Pull from CVS head: Use mutexes only if we have pthread.h (closes: #333) Modified files: File: radiusd/src/modules/rlm_ldap/rlm_ldap.c; Revision: 1.122.2.8.2.4; Date: 2006/02/18 22:54:35; Author: nbk; Lines: (+2 -1) ===================================================== Summary of modified files ===================================================== File: radiusd/src/modules/rlm_ldap/rlm_ldap.c Revisions: 1.122.2.8.2.4 Authors: nbk (+2 -1) -- Automatic cron job from /web/pages/us.freeradius.org/bin/new_makelog.pl

1 0

RE: using stored procedures with freeradius (Urgent help request)
by Murat Mığdısoğlu 18 Feb '06

18 Feb '06

I found it, If u return some variables from the accounting sp with some kind of select, you can encounter this problem. -----Original Message----- From: freeradius-devel-bounces+murat.migdisoglu=superonline.net(a)lists.freeradius.org [mailto:freeradius-devel-bounces+murat.migdisoglu=superonline.net@lists.freeradius.org] On Behalf Of Murat Mığdısoğlu Sent: Saturday, January 28, 2006 3:29 PM To: freeradius-devel(a)lists.freeradius.org Subject: using stored procedures with freeradius (Urgent help request) Hi all, I'm using freeradius with sybase using freetds and unixodbc. For some purposes, i had to use stored procedures and changed sql statements in sql.con to procedure calls like "EXEC -----". I have to question at this point 1) has anyone used this method before?(in the archie, i saw some mails about sp, so i assume freeradius support it) 2) Examining my logs, i found that some sockets getting 'Invalid cursor State' error from unix-odbc driver in some cases and they don't work anymore. What it can be? Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/devel.html Bu e-posta mesaji ve ekleri sadece gonderildigi kisi veya kuruma ozeldir. Eger dogru kisiye ulasmadigini dusunuyorsaniz, bu mesajin yonlendirilmesi, kopyalanmasi veya herhangi bir sekilde kullanilmasi yasaktir.Mesaj iceriginde bulunan fikir ve yorumlar, SUPERONLINE'a degil sadece gondericiye aittir. Bu mesaj bilinen tum viruslere karsi test edilmistir. This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you are not the intended recipient you are hereby notified that any dissemination, copying or use of the information is prohibited. The opinions expressed in this message belong to sender alone. There is no implied endorsement by SUPERONLINE.This e-mail has been scanned for all known computer viruses.

2 1