December 2005 - Freeradius-Users - lists.freeradius.org

Free Radius and Squid
by Sean Ali 05 Dec '05

05 Dec '05

Hello, I'm very new to free raduis and would like to know if it will run with squid proxy server. If so how would this work? What I am looking to do is to allow users to access the internet via the transparent squid proxy for limited time sessions. Eg. a user who wishes to use the system would be greeted by a web page asking for a code. The code (which they would get from the system admin) would grant them access for 1 hour. Can this be done using FreeRadius and Squid? Sean.

3 2

FreeRadius Authentication Protocol
by Hamid Salim 05 Dec '05

05 Dec '05

Hi, I have a FreeRadius EAP-TLS working enviornment. Going forward, I would like to avoid installing client certificates on every new mobile client and maintaining the current installs. I think the solution will be EAP-TTLS. However, I would like to get input from the experts about best available option/s. The goal is to authenticate supplicants via FreeRadius without the use of client certificates (server certificate is ok). Any help is appreciated. Regards, Hamid.

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 05 Dec '05

05 Dec '05

Alan, You seem to be one of the most knowledgeable folks on the list. Can you provide any input? All help is appreciated. Chad. From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Bohannan, Chad W Sent: Friday, December 02, 2005 12:51 PM To: FreeRadius users mailing list Subject: RADIUS Auth-Type OK, here is the situation. I have successfully configured RADIUS to authenticate/authorize NAS requests from my Cisco gear so long as the user "Auth-Type= System". I have also managed to get Samba working and have joined the radius server to the AD realm in question. This is confirmed through the following: ntlm_auth --request-nt-key --domain=MYDOMAIN --username=MYUID password:xxxxx NT_STATUS_OK: Success (0x0) wbinfo -a MYUID%MYPASSWD plaintext password authentication failed error code was NT_STATUS_NO_SUCH_USER (0xc0000064) error messsage was: No such user Could not authenticate user MYUID%MTPASSWD with plaintext password challenge/response password authentication succeeded However, when I edit the /etc/raddb/users file and change the "Auth-Type= System" to "Auth-Type=MSCAP" all authentication attempts fail. Am I specifying the correct auth-type? Have I missed a step? Is there something I can do (debug maybe) that will better assist in identifying the problem? Any and all suggestions are appreciated. I am attempting to have RADIUS proxy authentication requests to AD, then assign attributes if authentication succeeds. Chad

1 0

Accounting proxy to multiple hosts
by Deon van der Merwe 05 Dec '05

05 Dec '05

Hi, I have successfully been running freeradius as an accounting proxy. Next step is to be able to proxy to multiple hosts... actually it will be a proxy to the real RADIUS server and then (what I can only describe as...) replication of the accounting messages to at least 2 other servers. - I only want the response from the real RADIUS server to be sent back to the originator - the responses from the other (replication) servers can be dropped/ignored Is this possible to do? Is there some better options that you might know of?

3 3

FreeRadius and Interim Packets
by Matt 05 Dec '05

05 Dec '05

Does anyone have experience with FreeRadius and Interim packets? Does it work ok? Any problems? How do you enable it?

7 22

SQL Call-Check Authentication (again :( )
by florian broder 05 Dec '05

05 Dec '05

Hi. I'm still having a hard time of implementing the Calling-Station-Id Authentication. Basis is a Cisco Catalyst with "Mac-Authentication-Bypass" turned on. Alan DeKok told me, that I can use sql.conf: # Use Stripped-User-Name, if it's there. # Else use User-Name, if it's there, -->># Else use hard-coded string "DEFAULT" as the user name.<<-- sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" To tell freeradius, that there is no user-name. Ok, I've done that, but It gives me this error: rad_recv: Access-Request packet from host 192.168.1.222:1038, id=13, length=45 Service-Type = Call-Check Calling-Station-Id = "11-22-33-44-55-66" -->> rlm_sql (sql): zero length username not permitted <<-- That's basically the same packet, the Cisco Switch sends as Auth-Request. Notice, that there is NO user-name in here at all. The fact is also mentioned in the sql Source-Code: /* * They MUST have a user name to do SQL authorization. */ if ((request->username == NULL) || (request->username->length == 0)) { radlog(L_ERR, "rlm_sql (%s): zero length username not permitted\n", inst->config->xlat_name); return RLM_MODULE_INVALID; } Switching to "file-based-Authentication" (in radiusd.conf) it works immediately: rad_recv: Access-Request packet from host 192.168.1.222:1044, id=19, length=45 Service-Type = Call-Check Calling-Station-Id = "11-22-33-44-55-66" Sending Access-Accept of id 19 to 192.168.1.222:1044 Reply-Message = "Hello" So, it's really a limitation in sql, rather that a misconfiguration? Would be nice, if anyone can confirm this! Bye Flo

3 3

(no subject)
by debik 05 Dec '05

05 Dec '05

When i try to authenticate on my Xp client this message is in the log and the Acces-Reject is send modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_tls: <<< TLS 1.0 Alert [length 0002], fatal access_denied TLS Alert read:fatal:access denied rlm_eap_peap: No data inside of the tunnel. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: group authenticate returns invalid for request 5 auth: Failed to validate the user. Somebody knows what this means ??

1 0

sqltrace.log
by TK Lew 05 Dec '05

05 Dec '05

hi all :: Is it adviseable to turn on the sqltrace.log file under production environment ? Thanks ! BR

2 1

further ldap problems
by Norbert Wegener 05 Dec '05

05 Dec '05

Although I can query an AD server via ldapsearch without problems, I do not get it working using freeradiusd. I do get rlm_ldap: search failed. In the logs first I see: rlm_ldap: Bind was successful later there is: ... ldap_chase_referrals^M read1msg: V2 referral chased, mark request completed, id = 3^M new result: res_errno: 1, res_error: <00000000: LdapErr: DSID-0C090627, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, vece>, res_matched: <>^M Why can this happen? (complete log at: http://www.wegener-net.de/fr ) raidusd.conf is also there My radiusd.conf includes the section: ldap ldap1 { server = "tde002.sitest.net" identity = "testrad(a)TDE002.SITEST.NET" password = "mypass" basedn = "dc=TDE002,dc=SITEST,dc=NET" filter="(servicePrincipalName=HOST/lnxad)" # a fixed value here, just for testing. This filter works with ldapsearch. ldap_debug=0xFFFF #base_filter = "(objectclass=computer)" ldap_connections_number = 1 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap } Any hint is appreciated. Thanks Norbert Wegener

1 0

solaris 8 compilation problem of pam_radius
by Peter Bergmann 05 Dec '05

05 Dec '05

Hi, I want to use the client function of free-radius, but I've got a problem while compiling the pam_radius-1.3.16 module under solaris 8: Any ideas are welcome!!! Thanks Peter hqwww01tban{root} @: make gcc -Wall -fPIC -c pam_radius_auth.c -o pam_radius_auth.o In file included from pam_radius_auth.h:23, from pam_radius_auth.c:63: md5.h:21: error: parse error before "u_int32_t" md5.h:21: warning: no semicolon at end of struct or union md5.h:22: warning: type defaults to `int' in declaration of `bits' md5.h:22: warning: data definition has no type or storage class md5.h:24: error: parse error before '}' token md5.h:29: error: parse error before "buf" pam_radius_auth.c: In function `ipstr2long': pam_radius_auth.c:179: warning: subscript has type `char' pam_radius_auth.c: In function `good_ipaddr': pam_radius_auth.c:215: warning: subscript has type `char' pam_radius_auth.c: In function `host2server': pam_radius_auth.c:271: warning: subscript has type `char' pam_radius_auth.c: In function `get_random_vector': pam_radius_auth.c:350: error: storage size of `my_md5' isn't known pam_radius_auth.c:350: warning: unused variable `my_md5' pam_radius_auth.c: In function `get_accounting_vector': pam_radius_auth.c:382: error: storage size of `my_md5' isn't known pam_radius_auth.c:382: warning: unused variable `my_md5' pam_radius_auth.c: In function `verify_packet': pam_radius_auth.c:400: error: storage size of `my_md5' isn't known pam_radius_auth.c:400: warning: unused variable `my_md5' pam_radius_auth.c: In function `add_password': pam_radius_auth.c:497: error: storage size of `md5_secret' isn't known pam_radius_auth.c:497: error: storage size of `my_md5' isn't known pam_radius_auth.c:497: warning: unused variable `md5_secret' pam_radius_auth.c:497: warning: unused variable `my_md5' pam_radius_auth.c: In function `rad_converse': pam_radius_auth.c:1016: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1019: warning: passing arg 2 of pointer to function from incompatible pointer type pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1071: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1099: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1113: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1146: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_private_session': pam_radius_auth.c:1267: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1288: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_chauthtok': pam_radius_auth.c:1374: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1395: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1404: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing arg 3 of `pam_get_item' from incompatible pointer type make: *** [pam_radius_auth.o] Error 1 hqwww01tban{root} @: -- Lust, ein paar Euro nebenbei zu verdienen? Ohne Kosten, ohne Risiko! Satte Provisionen f�r GMX Partner: http://www.gmx.net/de/go/partner

2 2