October 2005 - Freeradius-Users - lists.freeradius.org

+ in Usernames?
by Christian Meutes 20 Oct '05

20 Oct '05

Hello, i want that an incoming request is always authenticated and should reply with some attributes. i have the following entry in my sql database in radcheck: --- id UserName Attribute op Value | 18 | +496925738971(a)sip.claranet.de | Auth-Type | := | Accept --- The incoming request looks like this: --- Packet-Type = Access-Request Wed Oct 19 14:42:17 2005 User-Name = "+496925738971(a)sip.claranet.de" Service-Type = Call-Check NAS-IP-Address = 172.20.23.232 NAS-Port = 0 Client-IP-Address = 172.20.23.232 --- I dont know where the problem exists exactly, but the the radius.log says: --- Wed Oct 19 14:36:16 2005 : Auth: Login incorrect: [+496925738971(a)sip.claranet.de/<no User-Password attribute>] (from client test port 0) --- radiusd -X output: --- rad_recv: Access-Request packet from host 172.20.23.232:33352, id=212, length=69 User-Name = "+496925738971(a)sip.claranet.de" Service-Type = Call-Check NAS-IP-Address = 172.20.23.232 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radacct/172.20.23.232/auth-detail-20051019' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/172.20.23.232/auth-detail-20051019 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '%' in User-Name = "+496925738971(a)sip.claranet.de", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmpercent" returns noop for request 0 rlm_realm: Looking up realm "sip.claranet.de" for User-Name = "+496925738971(a)sip.claranet.de" rlm_realm: Found realm "sip.claranet.de" rlm_realm: Adding Stripped-User-Name = "+496925738971" rlm_realm: Proxying request from user +496925738971 to realm sip.claranet.de rlm_realm: Adding Realm = "sip.claranet.de" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "realmat" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "realmraute" returns noop for request 0 radius_xlat: '+496925738971(a)sip.claranet.de' rlm_sql (sql): sql_set_user escaped user --> '+496925738971(a)sip.claranet.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '=2B496925738971(a)sip.claranet.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 255 rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 255 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [+496925738971(a)sip.claranet.de/<no User-Password attribute>] (from client test port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.20.23.232:33353, id=213, length=69 User-Name = "+496925738971(a)sip.claranet.de" Service-Type = Call-Check NAS-IP-Address = 172.20.23.232 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radacct/172.20.23.232/auth-detail-20051019' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/172.20.23.232/auth-detail-20051019 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "digest" returns noop for request 1 rlm_realm: No '%' in User-Name = "+496925738971(a)sip.claranet.de", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "realmpercent" returns noop for request 1 rlm_realm: Looking up realm "sip.claranet.de" for User-Name = "+496925738971(a)sip.claranet.de" rlm_realm: Found realm "sip.claranet.de" rlm_realm: Adding Stripped-User-Name = "+496925738971" rlm_realm: Proxying request from user +496925738971 to realm sip.claranet.de rlm_realm: Adding Realm = "sip.claranet.de" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "realmat" returns noop for request 1 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "realmraute" returns noop for request 1 radius_xlat: '+496925738971(a)sip.claranet.de' rlm_sql (sql): sql_set_user escaped user --> '+496925738971(a)sip.claranet.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '=2B496925738971(a)sip.claranet.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 254 rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '=2B496925738971(a)sip.claranet.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User +496925738971(a)sip.claranet.de not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 254 modcall[authorize]: module "sql" returns notfound for request 1 modcall: group authorize returns ok for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [+496925738971(a)sip.claranet.de/<no User-Password attribute>] (from client test port 0) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.20.23.232:33352, id=212, length=69 Sending Access-Reject of id 212 to 172.20.23.232:33352 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 172.20.23.232:33353, id=213, length=69 Sending Access-Reject of id 213 to 172.20.23.232:33353 Waking up in 1 seconds... --- Walking the entire request list --- Either i have a problem with my authorize section or the username shouldnt include an "+" i think. Anybody with an idea? kind regards, -christian

3 2

RLM_IPPOOL bug?
by magmike＠mail.ru 20 Oct '05

20 Oct '05

my radiusd uses rlm_ippool. Sometimes ippool gives one ip for two different users simultaneously. here output of rlm_ippool_tool. # rlm_ippool_tool -va /etc/raddb/pools/db.pool-1-pool1* | grep X.Y.Z.170 NAS:192.168.0.1 port:0xde - ipaddr:X.Y.Z.170 active:1 cli:0 num:1 NAS:192.168.0.1 port:0xad - ipaddr:X.Y.Z.170 active:1 cli:0 num:1

1 0

adding a nas via dialupadmin
by Nick B 20 Oct '05

20 Oct '05

Hello while adding a NAS thru dialupadmin i noticed that the changes dont take effect unless the freeradius process is restarted is this intended? or is something wrong with my config I.E. i added 192.168.0.1 / as a NAS but when i tried to authenticate with the nas , the debug showed it being as unreconized.. I stoped and restarted freeradius and then that nas was able to authenticate. Freeradius 1.02-4 (debian stable version) Thanks. Nick.

1 0

Newbie question. Where does Freeradius fit in?
by jamrock 19 Oct '05

19 Oct '05

I have done some reading re: radius in general and Freeradius in particular. When should one use radius? I have read that radius is useful when one needs a centralized user/password database. I guess that would be good when one has lots of remote access servers. I have read that radius is good when one needs accounting. We just need a dial in solution for 6 or so users. No accounting is necessary. What are the disadvantages of using a simple ppp solution that authenticates against the /etc/passwd file on a Linux box? We were thinking of using a pci card with 8 modems. Is Freeradius overkill for us or is it a more secure solution? Any advice/links to documentation would be useful. The Freeradius FAQ's don't address this issue.

1 1

NULL file
by ramiro de zavalia 19 Oct '05

19 Oct '05

Hi, i'm using freeradius 1.0.5. In /etc/raddb is a NULL file which keep increasing it's size. What is it ? Sorry for my bad inglish thanks

2 3

Prefix Usage and issues
by Curt LeCaptain 19 Oct '05

19 Oct '05

Yet another cropped up issue for me. I've got this in my users file: DEFAULT Prefix == "W", Auth-Type = "System" Service-Type == 0, Session-Timeout = 10, Fall-Through = No It's used by a perl script to do authentication. When the system attempts an authentication, I get a login failed for the username Wusername. Example: Mon Oct 17 11:07:43 2005 : Auth: Login incorrect: [Wusername/userpass] (from client webserver port 0) Any thoughts on something I could be doing wrong with the prefix? Thanks, Curt LeCaptain

6 7

newbie question on using digest authentication with postgresql
by Horton, Dave 19 Oct '05

19 Oct '05

I'm a newbie with freeradius (understand radius protocol though), and I'm struggling with some basics of configuration re: digest authentication and use of postgresql for subscriber database. I haven't found much documentation so far on the freeradius site about authentication using sql (besides the basic install of the schema), and I feel I'm probably missing something/somewhere, so please feel free to point me towards docs if this is covered somewhere. Anyways, my simple attempt at digest authentication is currently failing. Here is what I have done: 1. Provisioned the following simple data in my postgresql radius database (this is the area where I'm most in the dark, any pointers to information on the purpose and use of each of these tables would be useful): radius=# select * from radreply ; id | username | attribute | op | value ----+----------+--------------+----+------- 1 | dhorton | Idle-Timeout | == | 60 (1 row) radius=# select * from radcheck ; id | username | attribute | op | value ----+----------+-----------+----+------- 1 | dhorton | Password | == | 0276 (1 row) radius=# select * from usergroup ; id | username | groupname ----+----------+----------- 2 | dhorton | pactolus (1 row) 2. Edited my radiusd.conf file to uncomment the 'digest' lines in the 'authorize' and 'authenticate' sections. 3. Send an access-request message that looks like this (here is debug output from radiusd): rad_recv: Access-Request packet from host 10.10.105.11:1812, id=1, length=579 User-Name = "dhorton" User-Password = "NULL" NAS-IP-Address = 10.10.105.11 NAS-Port = 0 Cisco-AVPair = "h323-incoming-conf-id=664A92F5 C5305B22 A8C5F339 06C5803D" h323-conf-id = "h323-conf-id=68F37347 92CF847A 3676C449 5361F60E" Cisco-NAS-Port = "0:0" Cisco-AVPair = "sip-hdr=From: Dave Horton <sip:dhorton@voip.dogan.com>" Cisco-AVPair = "sip-hdr=Authorization: Digest username="dhorton",realm="voip.dogan.com",nonce="3e320b5b5dbd4a37cb7168b f607455b5",response="325d8976711bc76a7c1a25b53c8b0cf9",uri="sip:voip.dog an.com"" Acct-Status-Type = Start NAS-Port-Type = Virtual Digest-Response = "325d8976711bc76a7c1a25b53c8b0cf9" Digest-Attributes = 0x0110766f69702e646f67616e2e636f6d02223365333230623562356462643461333763 62373136386266363037343535623504147369703a766f69702e646f67616e2e636f6d03 0a52454749535445520a0964686f72746f6e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/10.10.105.11/auth-detail-20051019' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m% d expands to /usr/local/var/log/radius/radacct/10.10.105.11/auth-detail-20051019 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "voip.dogan.com" Digest-Nonce = "3e320b5b5dbd4a37cb7168bf607455b5" Digest-URI = "sip:voip.dogan.com" Digest-Method = "REGISTER" Digest-User-Name = "dhorton" rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 0 rlm_realm: No '@' in User-Name = "dhorton", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'dhorton' rlm_sql (sql): sql_set_user escaped user --> 'dhorton' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'dhorton' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'dhorton' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'dhorton' ??ORDER BY id' rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'dhorton' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): No matching entry in the database for request from user [dhorton] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_digest: Configuration item "User-Password" is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Login incorrect: [dhorton/NULL] (from client pcs-network port 0)

2 1

PEAP Machine Authentication
by Michael Griego 19 Oct '05

19 Oct '05

I'm happy to announce that 802.1x/PEAP machine authentication with the Windows built in supplicant is now possible using FreeRADIUS. In the past, machine authentication was only possible by proxying machine authentication requests to another RADIUS server capable of handling them, such as IAS. FreeRADIUS, along with some updates to Samba, is now capable of handling these authentications internally. Here's a synopsis on how to get this working right now: The first item required to get machine authentication is a patch to the Samba source. This patch sets a set of flags used when sending the authentication request to the domain such that workstation logons are allowed. I expect that the Samba team will include the ability to set these flags at runtime in a future release. You can find the details of the patching required at http://www.open.com.au/archives/radiator/2005-10/msg00037.html. It's a very simple patch to the samba/source/rpc_client/cli_netlogon.c file. In the cli_netlogon_sam_network_logon() function (be sure not to edit the cli_netlogon_sam_logon() function by mistake), there is a call to the init_id_info2() function. The param_ctrl flags parameter to this function sets all flags to 0. In order to enable machine authentication, they should be set to 0x800 (MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT). If you change this and recompile/reinstall Samba, your ntlm_auth command will now be able to handle machine authentications. As noted above, it is expected that these flags will become manipulable at runtime in some future release of Samba, so this fix is for those who need this functionality now. Next, when using ntlm_auth, the User-Name received in the request has to be rewritten. Windows supplicants send the machine name in the form of host/fully.qualified.domain.name. When you provide the user name to ntlm_auth, it must be in the form of machineshortname$, the SAM account form of the name. I have updated the rlm_mschap module so that a call to the xlat function mschap:User-Name will now properly format the machine name as above as well as format usernames. In addition, a call to the xlat function mschap:NT-Domain will also grab the domain name from the host/ formatted username. Therefore, with this updated code, the only change to the configuration in the radiusd.conf is to ensure that your ntlm_auth line looks like the following: ntlm_auth = "/path/to/ntlm_auth --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain:-DEFAULTDOMAIN} The updated rlm_mschap module is available in CVS now. You can grab the nightly CVS snapshot (the usual caveat of unstable code applies). In addition, for those familiar with CVS, it is available in the release_1_0 branch for use with the stable source tree. And, finally, it will be included in the next stable release of FreeRADIUS. --Mike

1 0

AW: OT: Freeradius and Redback SMS 1800
by Dominik Sennfelder 19 Oct '05

19 Oct '05

> > On Tue, Oct 18, 2005 at 05:11:54PM +0200, Dominik Sennfelder wrote: > > We are using Freeradius with two Redback SMS 1800 > > Authorizing and accounting works with mysql. > > > > Is it possible to log the IP-Address at > > the beginging of the accounting? > > see AOS Command Reference, AAA and Radius commands. > > aaa delay-start-record > > Oliver. > Great Thats it. Thank you Dominik

1 0

i need help to auth by using mac address in freeradius
by kdr akm 19 Oct '05

19 Oct '05

hi i made a pppoe-server with freeradius and i success to make it without mysql all going fine but i need to get authentication by mac address to my users ( username and password and mac address ) i need help guys thanks in advanced --------------------------------- Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

1 0