November 2005 - Freeradius-Users - lists.freeradius.org

Re: CHAP Problems
by radius＠kingmanaz.net 24 Nov '05

24 Nov '05

Taking it out stopped everything all together. ----- Original Message ----- From: "Mitchell, Michael J" <Michael.Mitchell(a)team.telstra.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, November 21, 2005 3:37 PM Subject: RE: CHAP Problems > There used to be a DEFAULT stanza in the "users" configuration file that > set Auth-Type := System which tells the RADIUS server to use /etc/passwd > for authentication. This has caused a few issues like this in the past, > though I thought it had been resolved for 1.0.5. > > If is still exists you may have more success if you comment that out. > > Hope that helps, > Mike > > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Tuesday, 22 November 2005 9:13 AM > To: freeradius-users(a)lists.freeradius.org > Subject: CHAP Problems > > rad_check_password: Found Auth-Type Local > rad_check_password: Found Auth-Type System > Warning: Found 2 auth-types on request for user 'awarren' > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 14 > rlm_unix: Attribute "User-Password" is required for authentication. > Cannot > use "CHAP-Password". > modcall[authenticate]: module "unix" returns invalid for request 14 > modcall: group authenticate returns invalid for request 14 > auth: Failed to validate the user. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: CHAP Problems
by radius＠kingmanaz.net 24 Nov '05

24 Nov '05

Michael, I got it to work. What I found worked. I recall this was not the way to do this, but it worked until I get it worked out. I have two entries in the users file. DEFAULT Auth-Type := System Fall-Through = Yes DEFAULT Auth-Type := Local Fall-Through = Yes I did find if the := Local entry was first it would error out, but as long as it was second I get users logging in both ways PAP and CHAP. Thanks Bob ----- Original Message ----- From: "Mitchell, Michael J" <Michael.Mitchell(a)team.telstra.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, November 21, 2005 3:37 PM Subject: RE: CHAP Problems > There used to be a DEFAULT stanza in the "users" configuration file that > set Auth-Type := System which tells the RADIUS server to use /etc/passwd > for authentication. This has caused a few issues like this in the past, > though I thought it had been resolved for 1.0.5. > > If is still exists you may have more success if you comment that out. > > Hope that helps, > Mike > > > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] > Sent: Tuesday, 22 November 2005 9:13 AM > To: freeradius-users(a)lists.freeradius.org > Subject: CHAP Problems > > rad_check_password: Found Auth-Type Local > rad_check_password: Found Auth-Type System > Warning: Found 2 auth-types on request for user 'awarren' > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 14 > rlm_unix: Attribute "User-Password" is required for authentication. > Cannot > use "CHAP-Password". > modcall[authenticate]: module "unix" returns invalid for request 14 > modcall: group authenticate returns invalid for request 14 > auth: Failed to validate the user. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: tool for testing machine authentication
by freeradius＠caribsms.com 24 Nov '05

24 Nov '05

Robin Mordasiewicz wrote: >i just did a google on NTRadTest, but found nothing. Where can I download NTRadTest Try NTRadPing at: http://www.mastersoft-group.com/download/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: CHAP Problems
by Michael.Mitchell＠team.telstra.com 24 Nov '05

24 Nov '05

There used to be a DEFAULT stanza in the "users" configuration file that set Auth-Type := System which tells the RADIUS server to use /etc/passwd for authentication. This has caused a few issues like this in the past, though I thought it had been resolved for 1.0.5. If is still exists you may have more success if you comment that out. Hope that helps, Mike -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Sent: Tuesday, 22 November 2005 9:13 AM To: freeradius-users(a)lists.freeradius.org Subject: CHAP Problems rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 14 modcall: group authenticate returns invalid for request 14 auth: Failed to validate the user. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by Alhagie Puye 24 Nov '05

24 Nov '05

Actually, I believe the more important questions is to authenticate against Active Directory, do you need MS-CHAP or LDAP? Thanks, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Robin Mordasiewicz > >Sent: November 23, 2005 6:16 PM > >To: FreeRadius users mailing list > >Subject: RE: Freeradius How to integrate Active Directory > >[AD Integration WindowsXP NTLM Tutorial] > > > >On Wed, 23 Nov 2005, Alhagie Puye wrote: > > > > > >> I have followed the steps in the howto and everything > >seems to work > >> fine but FreeRADIUS is ignoring "MS-CHAP". I'm using > >> ntradping....maybe that's a wrong utility for this instance. > >> > > > >I don't think you can properly test this with NTRadPing, but > >I have not been able to figure it out. > > > >I have set my wireless access point to use radius and the > >results I am getting are very different. I would suggest > >testing a tool that more closely resembles your production gear. > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > Disclaimer: This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

More than one sentence in accounting_stop_query
by Jorge Pomoro 23 Nov '05

23 Nov '05

Hi, I use Freeradius with Mysql. I want to make 2 SQL consultations in the accounting_stop_query field. (in sql.conf) I proved all the possible alternatives, but it does not work, like: accounting_stop_query field = "sentence1, sentence2" or accounting_stop_query field = "sentence1; sentence2" or accounting_stop_query field = "sentence1" accounting_stop_query field = "sentence2" somebody knows how to do it? Regards, Jorge

2 1

RE: help with EAP MD5 wired authentication
by MINODIER David RD-RESA-LAN 23 Nov '05

23 Nov '05

Since you're using EAP-MD5, you should have in your users file: Xxx Auth-Type := EAP, User-Password == "whatever" David. > -----Message d'origine----- > De : freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] De la > part de Anup Parkhi > Envoyé : mardi 22 novembre 2005 01:54 > À : freeradius-users(a)lists.freeradius.org > Objet : help with EAP MD5 wired authentication > > Hi, > > I am struggling with EAP-MD5 wired authentication for last > couple of days. I checked the web and archives but to no avail. > > I am using XP supplicant. Tried with Funk's supplicant also > but same result. > > Any help will be highly appreciated. > > Thanks > Anup > > My users file has following towards the end > > # On no match, the user is denied access. > > a User-Password == "a" > > "test" User-Password == "test" > > "Administrator" User-Password == "pnbidm123!" > > aparkhi Auth-Type := System, User-Password == "aparkhi" > > DEFAULT Auth-Type := Accept > Reply-Message = "All users are allowed, Welcome %u." > > Radiusd.conf has > > 1. modules section > ... > pap { > encryption_scheme = crypt > } > > # CHAP module > # > # To authenticate requests containing a CHAP-Password > attribute. > # > chap { > authtype = CHAP > } > ... > $INCLUDE ${confdir}/eap.conf > > mschap { > ... > } > > files { > ... > } > > ... > > > The console output of radiusd -X -s is > > Ready to process requests. > rad_recv: Access-Request packet from host 10.11.12.107:1024, id=76, > length=214 > Framed-MTU = 1480 > NAS-IP-Address = 10.11.12.107 > NAS-Identifier = "HP ProCurve Switch 2824" > User-Name = "test" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 24 > NAS-Port-Type = Ethernet > NAS-Port-Id = "24" > Called-Station-Id = "00-0f-20-8d-04-c8" > Calling-Station-Id = "00-c0-9f-0d-4a-1f" > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "1010" > EAP-Message = 0x020200090174657374 > Message-Authenticator = 0xb12214c2d6fb14f33c7cc758ccfb54b7 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_eap: EAP packet type response id 2 length 9 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 152 > users: Matched entry DEFAULT at line 171 > users: Matched entry DEFAULT at line 183 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type md5 > rlm_eap_md5: Issuing Challenge > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: group authenticate returns handled for request 0 > Sending Access-Challenge of id 76 to 10.11.12.107:1024 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > Framed-Protocol = PPP > Framed-Compression = Van-Jacobson-TCP-IP > EAP-Message = 0x0103001604100118f4899111b27fc08900284095e5e2 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x33fe6026586af730cd367983bb9ea8b6 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, > length=249 > Framed-MTU = 1480 > NAS-IP-Address = 10.11.12.107 > NAS-Identifier = "HP ProCurve Switch 2824" > User-Name = "test" > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 24 > NAS-Port-Type = Ethernet > NAS-Port-Id = "24" > Called-Station-Id = "00-0f-20-8d-04-c8" > Calling-Station-Id = "00-c0-9f-0d-4a-1f" > Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" > Tunnel-Type:0 = VLAN > Tunnel-Medium-Type:0 = IEEE-802 > Tunnel-Private-Group-Id:0 = "1010" > State = 0x33fe6026586af730cd367983bb9ea8b6 > EAP-Message = > 0x0203001a04101c913399463bebf9f6dc2d0af18f0c7974657374 > Message-Authenticator = 0x2592cd875d1068f5b16fe7999f451769 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_eap: EAP packet type response id 3 length 26 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > users: Matched entry DEFAULT at line 152 > users: Matched entry DEFAULT at line 171 > users: Matched entry DEFAULT at line 183 > modcall[authorize]: module "files" returns ok for request 1 > modcall: group authorize returns updated for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP/md5 > rlm_eap: processing type md5 > rlm_eap_md5: User-Password is required for EAP-MD5 authentication > rlm_eap: Handler failed in EAP/md5 > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 1 > modcall: group authenticate returns invalid for request 1 > auth: Failed to validate the user. > Delaying request 1 for 1 seconds > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, > length=249 > Sending Access-Reject of id 77 to 10.11.12.107:1024 > EAP-Message = 0x04030004 > Message-Authenticator = 0x00000000000000000000000000000000 > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 76 with timestamp 43826690 Cleaning > up request 1 ID 77 with timestamp 43826690 Nothing to do. > Sleeping until we see a request. > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 2

RE: SQL Mac-Authentication based on Call-Check
by Jonathan De Graeve 23 Nov '05

23 Nov '05

If I understand this correctly I could have 3 ways to do RADIUS MAC Authentication: 1) (enterasys seems to do it like this) Username == mac, password == default password set in the nas and that matches the pass in the 'radcheck' table but different from the nas secret 2) (like it seems most vendors are doing it): Username == mac, password == nas-secret (but this also needs username(mac)/password(nas-secret) pairs in 'radcheck' table 3) calling-station-id == mac, username == mac, password == NULL, service-type == Call Check (10) and Auth-Type := Accept My questions: a)could I have a security problem with 2 or 3? b)any suggestions to choose between 1, 2 or 3 or 'just choose whatever works'? Kind Regards, -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 Jonathan.de.graeve(a)imelda.be > -----Oorspronkelijk bericht----- > Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] Namens Alan DeKok > Verzonden: woensdag 23 november 2005 19:33 > Aan: FreeRadius users mailing list > Onderwerp: Re: SQL Mac-Authentication based on Call-Check > > florian broder <flobroed(a)googlemail.com> wrote: > > The only thing I'm currently unaware of is, where I can tell freeradius > to > > use Call-Check together with mysql, I think it's somewhere in sql.conf? > > No, it's also in the "radcheck" table. > > > Only thing that need to be done IMO is to tell radius, that there is no > > username and authentication needs to be done on a caller-id basis. > > In radcheck, also set "Auth-Type := Accept" if the MAC & Call-Check > match. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Question about deleting old files
by Linda Pagillo 23 Nov '05

23 Nov '05

Hi Everyone: I have upgraded my freeradius from version 0.9.3 to the newest version. Is it safe to delete all of the files from the 0.9.3 version such as the .lib, .lib.so and .a files? Thanks! Linda Pagillo Director of Technical Services N2 The Net, LLC 931-372-9179 931-520-4031 (FAX) lpagillo(a)n2thenet.com

3 4

"Unprintable characters" error with crypt() and Blowfish
by Josh Endries 23 Nov '05

23 Nov '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello, I have a server on FreeBSD 5.4-STABLE, using PAP and crypt(). When it uses MD5 passwords ($1$...) it works fine, but when using Blowfish ($2a$...) it gives me the unprintable characters error. Anyone seen this and/or resolved it (without resetting all passwords to SHA1 or MD5)? Thanks, Josh -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFDUBaNV/+PyAj2L+IRAoV4AJ9P19JPwcBvOG38xOAIok8czWE6WgCfRpqj J/HyeZ40QUygqGPV0g2xjwU= =NoXV -----END PGP SIGNATURE-----

4 4