December 2005 - Freeradius-Users - lists.freeradius.org

PAM client password change
by John Kelly 16 Dec '05

16 Dec '05

I see that >http://www.freeradius.org/pam_radius_auth/README says > This is the PAM to RADIUS authentication module. It allows any >Linux or Solaris machine to become a RADIUS client for authentication >and password change requests. ^^^^^^^^^^^^^^^^^^^^^ OK! But then http://www.freeradius.org/pam_radius_auth/USAGE says > The module takes a number of configuration options. > Password changing is not implemented, as the RADIUS protocol does not ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ So README says yes, and USAGE says no. I want take all my users out of /etc/passwd and put them in a RADIUS server (running on the same host). And it would be nice if they could change their own passwords. But after reading the documents above, I don't know what to believe. Is this possible with pam_radius?

1 0

EAP-PEAP and windows supplicant behaviour
by Riccardo Veraldi 16 Dec '05

16 Dec '05

Hello, I Tried EAP-PEAP with success, and it works great with freeradius. My question (perhaps off topic) is how to change the default behaviour of the XP PEAP supplicant ? If you insert login/password it remembers those setting and it will not prompt you for them anymore... how to solve this problem ? is there a registry key to modify ? anyone has a hint about this ? thanks Rick

2 1

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Hi, Alan In a previous email, I asked you if Freeradius supports IPv6 authentications and you response to me that CVS version does. > > > How and where did I configure the IPv6 attributes referred in RFC 3162 to > > RADIUS distribute them to Authenticated users? > > You use the IPv6 attributes from the dictionary, just like you use > IPv4 attributes from the dictionary. Where I can get some documentation about this configuration? > Version 1.0.5 does not listen on IPv6 addresses, so you can't use > IPv6 clients, either. If I can't use IPv6 clients, how I can execute an IPv6 authentication? Did CVS version listening IPv6 addresses? > > Alan DeKok. Thanks in advance, Paulo Ferreira

2 1

After the manual's config, chap wont work with LDAP
by Matt Juszczak 16 Dec '05

16 Dec '05

Hi all, We've got our freeradius servers working with LDAP fine, except for CHAP. Originally, the logs were saying "Invalid user \\user", but we fixed that by enabling an option in radiusd.conf. Now, when we dial up without encrypted password enabled, the connection comes through successfully. However, when we enable the encrypted password option and try again, we get: Thu Dec 15 18:12:52 2005 : Auth: Login incorrect (rlm_ldap: empty password supplied): [username/] (from client 123.123.123.123 port 3088 cli 2125550404) Its saying the password is empty, but we are indeed using a password. Does anyone have any ideas? We've followed the instructions in the FAQ (CHAP above LDAP in the authorize section, no := Auth-Type, etc.)..... it just doesn't seem to want to recognize that a password is being entered. For the record, no query hits the LDAP server during a CHAP authentication...... so its obviously something with the config of freeradius. Thanks for any help! -Matt

2 3

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Ok, I will try the CVS version. Thanks for helping me. Best regards, Paulo Ferreira > > In a previous email, I asked you if Freeradius supports IPv6 > > authentications and you response to me that CVS version does. > > Yes... so? > > > > You use the IPv6 attributes from the dictionary, just like you use > > > IPv4 attributes from the dictionary. > > > > Where I can get some documentation about this configuration? > > Read your NAS documentation on what IPv6 attributes it takes. > > > > Version 1.0.5 does not listen on IPv6 addresses, so you can't use > > > IPv6 clients, either. > > > > If I can't use IPv6 clients, how I can execute an IPv6 authentication? > > Is it really that hard to figure out? > > > Did CVS version listening IPv6 addresses? > > Uh... why are you asking this again? Do you think the answer has > changed? > > Alan DeKok.

1 0

radacct mysql query for badguy
by Andys Pool Shop 16 Dec '05

16 Dec '05

Greetings everyone, I have a bad guy that keeps sending harassment emails from a well-known web-mail acct. I know he has httpd an email on 2005-12-15 08:57:32 I have tried to query mySQL radacct but, I left my level of expertise. Please don't be brutal, I know..Go to the the mySQL list. But since radius logs are for security too, I thought this list would help me. Can someone tell me the best SELECT statements to use, so I can narrow my search? My problems come when I try to SELECT UserName FROM radacct WHERE AcctStartTime with the date/time format syntax We are a very small and only have 46 dial-up ports so any returned results would be most satisfying.

1 0

No matching entry in the database for request from user
by Bill Schoolfield 16 Dec '05

16 Dec '05

Hello, I'm getting "No matching entry in the database for request from user" returned from the sql lookup. Below I have the radclient and server diagnostics interlaced. All look correct and the querries are good (see below for them). What is wrong? Bill /usr/local/bin/radclient -x -f radclient.dat2 "194.54.234.234:1814" auth example Sending Access-Request of id 33 to 194.54.234.234:1814 Acct-Session-Id = "6000006B" User-Name = "GLF0000002(a)billmax.com" User-Password = "example" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP rad_recv: Access-Request packet from host 194.54.234.234:1814, id=29, length=94 Acct-Session-Id = "6000006B" User-Name = "GLF0000002" User-Password = "example" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP Proxy-State = 0x30303164 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'GLF0000002' ORDER BY id rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'GLF0000002' ORDER BY id rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): No matching entry in the database for request from user [GLF0000002] rlm_sql (sql): Released sql socket id: 4 Re-sending Access-Request of id 33 to 194.54.234.234:1814 Acct-Session-Id = "6000006B" User-Name = "GLF0000002(a)billmax.com" User-Password = "\291\246\352\320\006\303p\316\230\n%\353\255\202J\341" Group = "default" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP rad_recv: Access-Request packet from host 194.54.234.234:1814, id=29, length=94 Sending Access-Reject of id 29 to 194.54.234.234:1814 Proxy-State = 0x30303164 rad_recv: Access-Reject packet from host 194.54.234.234:1814, id=33, length=54 Reply-Message = "Proxied request" Reply-Message = "Proxied request" Here are the querries from above. They all work: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'GLF0000002' ORDER BY id; +-------+------------+-----------------+---------------+----+ | id | UserName | Attribute | Value | op | +-------+------------+-----------------+---------------+----+ | 60647 | GLF0000002 | Crypt-Password | SMVdbmrqLzh2A | == | | 60648 | GLF0000002 | Session-Timeout | 7200 | == | +-------+------------+-----------------+---------------+----+ 2 rows in set (0.00 sec) mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+------------------+-------------+----+ | 1 | default | Auth-Type | Pap | := | | 2 | default | Service-Type | Framed-User | := | | 3 | default | Framed-Protocol | PPP | := | | 4 | default | Simultaneous-Use | 1 | := | +----+-----------+------------------+-------------+----+ 4 rows in set (0.00 sec) mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'GLF0000002' ORDER BY id; +----+------------+------------------+-------+----+ | id | UserName | Attribute | Value | op | +----+------------+------------------+-------+----+ | 11 | GLF0000002 | Simultaneous-Use | 1 | := | +----+------------+------------------+-------+----+ 1 row in set (0.00 sec) mysql> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; +----+-----------+-------------------+-----------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+-----------------+----+ | 2 | default | Framed-Protocol | PPP | := | | 3 | default | Service-Type | Framed-User | := | | 4 | default | Framed-MTU | 1500 | := | | 5 | default | Simultaneous-Use | 1 | := | | 6 | default | Framed-IP-Netmask | 255.255.255.255 | := | | 7 | default | Idle-Timeout | 900 | := | +----+-----------+-------------------+-----------------+----+ 6 rows in set (0.01 sec)

2 3

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Hi, it's me again. Now I'm trying to implement the IPv6 Freeradius, but I'm having some doubts. When I'm configuring Freeradius, is the same configuration that is used in IPv4, except in the clients file, where I must use IPv6 addresses. My doubt is: How and where did I configure the IPv6 attributes referred in RFC 3162 to RADIUS distribute them to Authenticated users? Please if is possible send to me a configuration example. Regards, Paulo Ferreira > > > > > > I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 > > > Freeradius functioning. > > > > Why? > > Because I didn't arrange a machine for test it yet :) > > > > > > Did the communications between NAS and Freeradius, in IPv6 only > > networks, > > > are made only with IPv6 packets (Access request packets, etc.)? > > > > Uh... you're asking if non-IPv6 packets are sent in an IPv6-only > > network. > > > > That makes *no* sense. > > No, I wanted an IPv6 only, but I wasn't sure if Freeradius was > communicating with NAS in IPv6 only packets, or if it was encapsulating > IPv6 attributes (RFC 3162) over IPv4 packets. > > > > > > Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated > in > > > IPv4 packets? > > > > Read the RFC's. The data in a RADIUS packet is completely > > independent of the IPv4 or IPv6 transport. > > I already red the RFC 3162, and I think that was the idea, but I asked to > the list this questions to had sure. > > Good, that means that it works with packets in both network protocols, > depending of NAS support. > > > > > Alan DeKok. > > > > Thanks for the help, and I will try that when I will have opportunity. > > Regards, > Paulo Ferreira >

2 1

no inet from clients & mysql tables topics
by mfred 16 Dec '05

16 Dec '05

Hi again, thx 2 all who helped me until now with my freeradius project. I made many advancings but have 2 issues which I cant figure out. 1) My client gets authenticated if I use the users file (testentry from howto of Christoph Gravier) Sending Accounting-Response of id 2 to 192.168.0.8:32780 but it dont get authenticated if I use sql entries radius output: rad_recv: Access-Request packet from host 192.168.0.8:32782, id=0, length=199 User-Name = "sqltest2" User-Password = "sqltest2" NAS-IP-Address = 192.168.0.8 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-E0-98-35-00-28" Called-Station-Id = "00-02-B3-4C-95-89" NAS-Identifier = "nas01" Acct-Session-Id = "43a2af6200000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x79af42dc40dbe6235bcf8585938c6a02 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 13 radius_xlat: 'sqltest2' rlm_sql (sql): sql_set_user escaped user --> 'sqltest2' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'sqltest2' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqltest2' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'sqltest2' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqltest2' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 13 modcall: group authorize returns ok for request 13 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13 modcall[authenticate]: module "unix" returns notfound for request 13 modcall: group authenticate returns notfound for request 13 auth: Failed to validate the user. Login incorrect: [sqltest2/sqltest2] (from client 192er-testnetz port 0 cli 00-E0-98-35-00-28) my sql table (only radcheck entries, all others are empty): mysql> select * from radcheck; +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 1 | mfred | User-Password | := | test | | 7 | sqltest | Password | := | sqltest | | 8 | sqltest2 | User-Password | := | sqltest2 | | 9 | sqltest3 | User-Password | == | sqltest3 | | 10 | argl | User-Password | == | argl | +----+----------+---------------+----+----------+ I tried different Attribute/op entries as I dont know exactly which are good. The different howto's out there are not clear about this. Maybe its version dependent? --------------------------------------- 2) My next problem is that even if I get conneted with my local user I dont have Internet access from the clients. I only can ping 192.168.182.1 but nothing more. >From the Server If you woulbe be so kind again and help me in these topics I would be very happy and my weekend is maybe saved this time :) br, mfred

1 1

rlm_sqlcounter causing a segmentation fault
by Serge Lhermitte 16 Dec '05

16 Dec '05

Hi, I am not too sure about how this should be handled, but hopefully someone can give me a hint As soon as I try to use the rlm_sqlcounter module and start the radiusd, it gives me a segmentation fault message. The last line before it crashes, radiusd -xx is giving me is the following Sqlcounter: safe-characters = "@abc..... /" I am using a recent CVS. Cheers. S.

2 1