November 2005 - Freeradius-Users - lists.freeradius.org

Blank User-name attribute
by Gustave Nylander 15 Nov '05

15 Nov '05

Hello all, I have freeradias 1.0.5 installed with the rlm_perl module, and the trouble I'm having is that the user-name attribute is an empty string within the 'authenticate' routine I have for the perl script. My goal is to have the perl script handle the authentication, so this is obviously a problem. I'm guessing I have something misconfigured. Freeradius *definitely* runs the perl script, as you'll see from the debug info below. I have the perl script explicitely checking for an empty user-name string, and rejecting on that situation. Any hints would be much appreciated! In the .conf file, I have the following relevant sections: modules { perl{ module = /home/goose/radperl.pl func_authenticate = authenticate func_authorize = authorize } ... authorize { perl ... authenticate { perl And here is the debug from radiusd: rad_recv: Access-Request packet from host 127.0.0.1:33480, id=31, length=55 User-Name = "gus" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 perl_pool: item 0x9d35538 asigned new request. Handled so far: 1 found interpetator at address 0x9d35538 we did something with the perl module! perl_pool total/active/spare [5/0/5] Unreserve perl at address 0x9d35538 modcall[authorize]: module "perl" returns ok for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "gus", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry gus at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type perl auth: type "perl" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 perl_pool: item 0x9e8b308 asigned new request. Handled so far: 1 found interpetator at address 0x9e8b308 rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-Routing = Broadcast-Listen rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Framed-Filter-Id = std.ppp rlm_perl: Added pair Framed-IP-Address = 172.16.3.33 rlm_perl: Added pair Framed-IP-Netmask = 255.255.255.0 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair User-Password = 123 rlm_perl: Added pair Auth-Type = perl perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x9e8b308 modcall[authenticate]: module "perl" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 31 to 127.0.0.1:33480 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 31 with timestamp 436d5cab Nothing to do. Sleeping until we see a request.

2 3

Send Cisco AVPair Attribute in Access-Accept Response
by Mehdi Torki 15 Nov '05

15 Nov '05

Hi all I have a Cisco AS5350 and I writed a custom TCL IVR script for voice application. When a call occures, then my script collects a 10 digit number and sends it to my freeRadius for authorization. my freeRadius configured with MySql db. I inserted (VENDOR: CISCO) and (ATTRIBUTE: Cisco-AVPair) in dictionary table. also in radreply table I have below record: <a 10 digit number> (user FIELD) Cisco-AVPair (Attribute FIELD) := (op FIELD) h323-ivr-in=A:B (Value FIELD) In debug output of Cisco AS5350, after sending authorization request, I saw: ************************************************************************ ROUTER#Received from id 42 192.168.230.110:1645<http://192.168.230.110:1645>, Access-Accept, len 56 4w5d: RADIUS: authenticator 06 3A 4D BB 2C AA 28 B8 - B7 11 CE DA B0 66 B2 66 4w5d: RADIUS: Vendor, Cisco [26] 24 4w5d: RADIUS: Cisco AVpair [1] 18 "h323-ivr-in=A:B" 4w5d: RADIUS: Service-Type [6] 6 Framed [2] 4w5d: RADIUS: Framed-Protocol [7] 6 PPP [1] ************************************************************************ It doesn't show any "Attribute 26 ..." in debug output. Also in my TCL script: "infotag get aaa_avpair_exists h323-ivr-in" returns False and could not found h323-ivr-in avpair in Access-Accept message! Please help me and guide me if I take a mistake on freeRadius configuration or MySql configuration for sending Cisco AVPair (VSA) to AS5350. Tank you in Advanced.

1 0

AW: Freeradius vs. ActiveDirectory
by Völker, Christian 15 Nov '05

15 Nov '05

Yohoo! > This is done via simple LDAP bind, which AD supports. Yes, thought so. > It works for PAP authentication. It doesn't work for CHAP, MSCHAP, >or PEAP. THX for the information. I'm just writing a little howto. For completeness could you explain in short words the disadvantage when using PAP? Greets Christian

1 0

RE: 802.1x
by Jonathan De Graeve 14 Nov '05

14 Nov '05

Chillispot certainly does! M0n0wall almost ;) Don't know about nocat J. ________________________________ Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Alex M Verzonden: woensdag 2 november 2005 19:19 Aan: 'FreeRadius users mailing list' Onderwerp: RE: 802.1x Ok, will call Dlink to see if that have something (the hotspot itself has that functionality internally though) Also do you know if opensources such as NoCAT and ChillBox support such features? ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 1:08 PM To: FreeRadius users mailing list Subject: RE: 802.1x AV = ATTRIBUTE VALUE <? D-Link what? D-Link makes lots of stuff... generally great price... but not the most feature rich products. To get the features you desire you'll likely need a higher-end box. I'm not a big proponent of "pitching" specific products in this forum. Suffice it to say there are vendors that will (or attempt) to provide CoS / filtering on Wireless... jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm(a)lrcommunications.net> Date: Wed, November 02, 2005 10:04 am To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Ok I got it By the way what is AV pair? And how do you get NAS related attributes to control bandwidth from vendors? Like if im using D-Link how could I get attributes from them? Thanks! ________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Jeff Reilly Sent: Wednesday, November 02, 2005 11:53 AM To: FreeRadius users mailing list Subject: RE: 802.1x Alex, Features such as 'bandwidth and port blocking" (if any) are allocated/configured on the _NAS_ (in this case a NAS port) via AV pair/s provided by RADIUS... the '802.1x Supplicant" (Client/Endpoint) in simple terms... provides a secure/standard conduit which facilitates the communication of credentials (from the Supplicant to the Authenticator). The '802.1x Authenticator" (or NAS) _MAY_ provision/enforce Authorization for the specific endpoint in the context of a user or group... The management & granularity of this functionality verifies greatly by switch vendor as a result providing this functionality across a multi-vendor environment... in a large scale deployment... is often too complex to seriously consider.<?<? jmr -------- Original Message -------- Subject: RE: 802.1x From: "Alex M" <alexm(a)lrcommunications.net> Date: Wed, November 02, 2005 9:10 am To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Now im totally lost... Can u give me an example what 802.1x does? -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, November 02, 2005 11:04 AM To: FreeRadius users mailing list Subject: Re: 802.1x "Alex M" <alexm(a)lrcommunications.net> wrote: > So then such features as bandwidth and port blocking could be controlled via > 802.1x? No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 12

nospace_user not working as expected in 1.0.5
by Kristina Pfaff-Harris 14 Nov '05

14 Nov '05

Hi, again. Another strangeness I noticed: we have "nospace_user = after" in radiusd.conf, but since switching to 1.0.5, this doesn't appear to act the same way as it did in 0.8.1. Using a username like "username " keeps rejecting the user instead of stripping spaces and trying again. "nospace_user = before" works fine. Actually, "nospace_pass = after" seems to work fine as well. Is this a known issue, or an "oops?" My workaround was to put use nospace_user before and keep nospace_pass after, since passwords may have spaces in them, but usernames may not. Thanks! Kristina

2 4

Script for counting # of NAS ports in use?
by Scott Langley 14 Nov '05

14 Nov '05

Before I write one, I wonder if anyone already has a script or module for counting the number of ports on a NAS that were in use at a given point of time? I know this can be done by collecting the SNMP data sent from the NAS, but I would rather do this by querying the radacct table in a SQL database. -- Scott Langley scott(a)ruralnetwork.net Systems Administrator Rural Network Services

2 1

How to use the counter module
by Martin.Ward＠uk.neceur.com 14 Nov '05

14 Nov '05

OK, I had no luck with my previous email so let's try a different approach. Could I use the Counter module to count the number of times a user gets their password wrong? I guess I need to call Counter on Access-Reject, or just before the Reply packet is sent as I can check the attributes sent back. This would be in the post-process area I think. Thanks for your time. |\/|artin -- Senior Network Consultant, NEC (Europe) Ltd. Acton extension: 3379 NEC*Net: 800-44-21-3379 Direct: +44 20 8752 3379 Fax: +44 20 8752 3389 Mobile: +44 7721 869 356 ***************************************************************** IMPORTANT: The information contained in this e-mail and attachment (if any) is intended for the person to whom it is addressed and may contain confidential and/or privileged information. The contents of this message may contain personal views which are not the views of NEC Europe Ltd or its subsidiaries, unless specifically stated. You should not copy, retain, forward or disclose its contents to anyone else, or take any action based upon it, if it is not addressed to you personally. If you have received this e-mail in error please contact the sender immediately. Any legally binding agreement resulting from its content must be made separately in a printed medium. *****************************************************************

3 2

FreeRadius using two SQL servers
by Fernando Brito 14 Nov '05

14 Nov '05

Hi, my version of FreeRadius is 1.0.5 and what I'm trying to do is that when a radius client ask my freeradius, if the Realm is "xxxx" I want to autorize him with the first SQL server and if the Realm is "yyyy" with the second one. I already have two diferent sql configuration files, sql1.conf and sql2.conf, with instance name SQL1 and SQL2. I had been trying to do exactly what the Autz-Type Doc says, but I had no luck with it. I don't know what to do... Thanks NanO

3 3

Problem with rlm_mschap from CVS
by Luca Corti 14 Nov '05

14 Nov '05

Hello, I'm using Freeradius from CVS (checked out today) to do WPA-EAP+Radius +PEAP+ntlm_auth because I can't get rlm_eap_peap from 1.0.5 to build on debian. When trying to authenticate everything seems to be fine, but fails when executing ntlm_auth. Here's the debugging log. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: Looking up realm "MYDOMAIN" for User-Name = "MYDOMAIN \user" rlm_realm: Found realm "MYDOMAIN" rlm_realm: Adding Stripped-User-Name = "user" rlm_realm: Proxying request from user user to realm MYDOMAIN rlm_realm: Adding Realm = "MYDOMAIN" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 6 rlm_eap: EAP packet type response id 6 length 71 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for user with NT-Password freeradius: symbol lookup error: /usr/lib/freeradius/rlm_mschap-1.1.0-pre0.so: undefined symbol: radius_exec_program Is this a configuration issue or a bug? thanks -- Luca Corti PGP Key ID 1F38C091 BOFH excuse of the moment: We are Microsoft. What you are experiencing is not a problem; it is an undocumented feature.

4 9

Re: Freeradius-Users Digest, Vol 7, Issue 48
by Devel 14 Nov '05

14 Nov '05

Le lun 14/11/2005 à 12:13, freeradius-users-request(a)lists.freeradius.org a écrit : > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > ______________________________________________________________________ > > Today's Topics: > > 1. RE: Freeradius vs. ActiveDirectory (Jonathan De Graeve) > 2. Re: Freeradius vs. ActiveDirectory (A.L.M.Buxey(a)lboro.ac.uk) > 3. AW: Freeradius vs. ActiveDirectory (V?lker) > 4. RE: Failed attempts log (Thierry Hoferlin) > 5. AW: Freeradius vs. ActiveDirectory (V?lker) > > > ______________________________________________________________________ > From: Jonathan De Graeve <Jonathan.De.Graeve(a)imelda.be> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 11:36:45 +0100 > > > > What about the password? > > > > I thought this was a kerberos one and didn’t reside into the ldap > itself? > > > > -- > Jonathan De Graeve > Network/System Administrator > Imelda vzw > Informatica Dienst > 015/50.52.98 > jonathan.de.graeve(a)imelda.be > > --------- > Always read the manual for the correct way to do things because the > number of incorrect ways to do things is almost infinite > --------- > > > > ______________________________________________________________________ > > Van:freeradius-users-bounces@lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Völker, > Christian > Verzonden: maandag 14 november 2005 11:22 > Aan: freeradius-users(a)lists.freeradius.org > Onderwerp: Freeradius vs. ActiveDirectory > > > > > Yohoo! > > > > > > Yes! I did it! ;) > > > > > > My freeradius (1.0.1-1.RHEL3) authenticates again our ActiveDirectory > (on 2003 Server). Without ntlm_auth! > > > Below I have added a short summary how I realized it here. > > > > > > But now I have a question and I can't solve it for myself. I want to > retreive some group informations from AD. In an users account I find > several values "memberOf" and the DN of the group, where the user > belong to. > > > Now I want to give access via freeradius only to some special groups. > > > > > > I have figuered out, that there are these parameters: > > > groupname_attribute, groupmembership_filter and > groupmembership_attribute > > > combined with some entries in the users-file. > > > > > > I've read the doc/rlm_ldap, but I didn't find any deeper hints or > explanation. > > > Questions: > > > 1. Where can I find some docs about the %{...} Values in > groupmebership_filter? Which one should I use in combination with my > AD? > > > 2. Which value should I use then in the users-file? > > > 3. Is there anyone who can give a little help in further > authenticating with group? > > > > > > -------------short summary how to authenticate vs. ActiveDirectory > ----------------------- > > > /etc/raddb/radiusd.conf > > > [...] > > > ldap { > #servername with an AD-Server running Win2003Srv > > > server = "adsrv.qsc.de" > > > #The Useraccount for querying AD (anonymous query is > disabled) > identity = "cn=man,ou=ServiceAdmins,dc=qsc,dc=de" > > > #The password for the Query-User > password = 'xxxxxx' > > > #base DN for user search; all our Users are in > ou=employees. Without this "ou=...", no user will be found. \ > > > #I don't understand why > basedn = "ou=employees,dc=qsc,dc=de" > > > # I've copied the below string, because I didn't > understand the meanings of the %{...} > filter = > "(sAMAccountname=%{Stripped-User-Name:-%{User-Name}})" > # I had to increase the timeouts > > > timeout = 40 > timelimit = 30 > net_timeout = 10 > > > > > > } > > > The users-file left on default, no changes. > > > > > > I hope, I could help some people trying to use AD for radius. > > > > > > And, I hope, someone will help me with my user-problem. > > > > > > > > > Greets > > > > > > Christian > > > > > > > > > > > > > > > > > > > ______________________________________________________________________ > > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 10:42:07 +0000 > > Hi, > > > I hope, I could help some people trying to use AD for radius. > > there is another way - use the krb module to authenticate against AD > > alan > > > > ______________________________________________________________________ > > From: "Völker, Christian" <Christian.Voelker(a)qsc.de> > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: AW: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 11:50:10 +0100 > > Yohoo! > > > > What about the password? > Which password? The User-Password? Or the shared secret? > The Password for the Proxy-User is written down in the radiusd.conf. > > > > I thought this was a kerberos one and didn't reside into the ldap itself? > Kerberos ist installed, but I don't use it (I think so! ;-)) > > Greets > Christian > > > > > > > ______________________________________________________________________ > > From: Thierry Hoferlin <thierry.hoferlin(a)staff.cybernet.be> > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: RE: Failed attempts log > Date: Mon, 14 Nov 2005 11:50:39 +0100 > > > Thanks Nicolas, > > It works fine. > > Just for info, the attributes to use in the mssql.conf file are > "postauth_table" and "postauth_query" > With the following radius configuration : > > post-auth { > > Post-Auth-Type REJECT { > sql > } > } > > > Regards, > > Thierry. > > > > > >Thierry Hoferlin wrote: > > > >> I've configured a freeradius 1.0.5 with MSSQL authentification. > >> It works fine. > >> > >> Is there a way to log failed authentification records to SQL ? > > > >Please don't post HTML on the list. > > > >Search the archives for detailed instructions, but the general idea is > to use the module "sql" in section "post-auth". > > > >http://freeradius.org/radiusd/doc/Post-Auth-Type > > > >-- > >Nicolas Baradakis > > > >- > >List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > ______________________________________________________________________ > > From: "Völker, Christian" <Christian.Voelker(a)qsc.de> > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: AW: Freeradius vs. ActiveDirectory > Date: Mon, 14 Nov 2005 11:51:26 +0100 > > Yohoo! > > > >> I hope, I could help some people trying to use AD for radius. > >there is another way - use the krb module to authenticate against AD > > Are there any advantages/ disadvantages ldap <-> krb5? > > > > > > > ______________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Hello. I made a Freeradius 1.04 working configuration to authenticate users using krb5. It works without any problem and If you look to Microsoft Documentation, you will see that it recommands using krb5 for Alien(Unix...)/Microsoft cross authentication. When using Ldap you must "translate" standards attributes into microsoft ones without many warranties that it will keep working on the next patch.I know microsoft wants to make its AD more compatible to standards but for the moment I still wait and see. In the other hand, LDAP is a much more powerful protocol that do not only deal with authentication while kerberos 's only goal is authentication. Maybe powerful users may use LDAP powerfullness through Radius. I do not and I'm not able to help you in that way. If someone is interrested in using Radius<->krb5<->AD, I may (I have a very poor english and I'm not a radius "hacker") help him. Just post at this mailing list that you are interested in it and I will answer as soon as I can. Bye. Stephane

1 0