June 2005 - Freeradius-Users - lists.freeradius.org

RADIUS Authentication
by "Ferreira, André" 09 Jun '05

09 Jun '05

If RADIUS receives and ACCESS-REQUEST packet, but RADIUS does not authenticate against its own database but an external server, does it also send an ACCESS-REQUEST to the external server? And does the external server send and ACCESS-ACCEPT with REPLY_MESSAGE information If authentication is successful? Thanx. André Ferreira

2 1

[Freeradius 1.0.3] failed to lilnk to module 'rlm_eap'
by Pete Flynt 09 Jun '05

09 Jun '05

Hi list, I've configure freeradius to compile with --confsysdir=/etc/ --disable-shared. When running radiusd -X -A Im getting this error line: radiusd.conf[9] Failed to link to module 'rlm_eap': /usr/local/lib/rlm_eap.a: invalid ELF header What does this mean? Pete _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

1 0

RE: How to? - use/configure winbind/ntlm_auth for Windows authentication
by Pete Flynt 09 Jun '05

09 Jun '05

Thanks for your solution. I think this will be helpful for some people. I'll try this on next opportunity. But does it provide Single-Sign-On possibility with windows credentials like PEAP MSCHAPv2? I've finally managed to get the ntlm_auth working. When one knows how to do it, it is very easy: On my fedora core 3 (with samba) I ran the authconfig tool, checked the "use winbind/use winbind for authentication" options, entered the domain info, joined the windows domain via net rpc and ntlm_auth worked at once! I did not have to touch samba config files. Regards, Pete >Subject: How to? - use/configure winbind/ntlm_auth for Windows >authentication >Date: Wed, 8 Jun 2005 15:00:10 -0400 > >I use LDAP. For each OU I want to authenticate I create an entry in >radiusd.conf > > > >ldap MyFirstOU { > > server = "your.server.dns.name" > > identity = "CN=LDAP VIEW,CN=Users,DC=acs,DC=ocad,DC=ca" > > password = ldapAccountPassword > > basedn = "ou=yourOU,dc=acs,dc=ocad,dc=ca" > > filter = >"(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" > > start_tls = no > > tls_mode = no > > groupname_attribute = cn > > groupmembership_filter = >"(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr >oupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))" > > ldap_connections_number = 5 > > timeout = 4 > > timelimit = 3 > > access_attr_used_for_allow = yes > > } > > > >authorize { > > MyFirstOU > > } > > > >Auth-Type LDAP { > > MyFirstOU > >} > > > >You need a user on the AD box called "LDAP VIEW" with a password of >"ldapAccountPassword". > > > >Works great for me. > _________________________________________________________________ FREE pop-up blocking with the new MSN Toolbar - get it now! http://toolbar.msn.click-url.com/go/onm00200415ave/direct/01/

1 0

Re: Authenticate/Attributes based on NAS-IP-Address
by Mike Lampson 08 Jun '05

08 Jun '05

> That link doesn't give me anything. Page Not Found. I've done a lot of > searching through the archives though and haven't really found anything > like this. Did you add the "tml" back into the URL? >> http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg16842.h >> tml _Mike

1 0

Hanging radiusd
by Doug Hardie 08 Jun '05

08 Jun '05

I am encountering a problem on 1 of my radius servers (not any of the others). Every so often it hangs and quits responding to requests. FreeBSD 5.3. ps shows a status of TLs which means its waiting for a lock. There is no way to kill the process and ktrace shows absolutely nothing over many requests that timeout. The only way to restart it is a reboot. I do know that one of the memory boards is likely to be defective. I suspect that this is the cause of the problem. FreeBSD reports less memory on that board that is marked on the board itself. I don't recall the exact numbers but its not a multiple of 2. I won't be on site till Friday so won't be able to put in new memory till then. Does my assumption appear valid?

2 1

Problems with LDAP
by alfonso celestino 08 Jun '05

08 Jun '05

Hello, first, excuseme for my english I have freeradius running with EAP and PEAP authentication very well, but i would like use Openldap like database, but when after i do the changes, and I restart the radius appears the error: segmetation fault These are my configurations: radiusd.conf File... ldap { server = "xxx.xxx.xxx.xxx" identity = "cn=redes,ou=admins,ou=radius,dc=mydomain,dc=com" password = secretpasswd basedn = "ou=users,ou=radius,dc=mydomain,dc=com" filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(objectclass=radiusprofile))" ssword_attribute = userPassword start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "userPassword" timeout = 4 timelimit = 3 net_timeout = 1 } authorize{ preprocess auth_log chap mschap suffix ldap } authenticate { Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap unix } users file ... DEFAULT Auth-Type := LDAP Fall-Through = 1 ... Here's error /usr/local/radius/sbin/run-radius -X -A + LD_LIBRARY_PATH=/usr/local/openssl/lib + LD_PRELOAD=/usr/local/openssl/lib/libcrypto.so + export LD_LIBRARY_PATH LD_PRELOAD + /usr/local/radius/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/radius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/radius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) /usr/local/radius/sbin/run-radius: line 8: 910 Segmentation fault /usr/local/radius/sbin/radiusd $@ when I comment the next: #ldap #Auth-Type LDAP { # ldap # } the Freeradius server run correctly Thanks Saludos!!!! ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Re: Authenticate/Attributes based on NAS-IP-Address
by Mike Lampson 08 Jun '05

08 Jun '05

Nick, Extend the MySQL schema and change the SQL queries in sql.conf to do what you want. You could extend by HuntGroup, NAS-IP, Client-IP, whatever. See my previous post to this list archived here: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg16842.h tml Cheers, _Mike -----Original Message----- Message: 6 Date: Tue, 07 Jun 2005 19:20:28 -0700 From: N White <nwtech(a)tele-net.net> Subject: Re: Authenticate/Attributes based on NAS-IP-Address To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <42A655EC.7050009(a)tele-net.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Actually I already have two running FreeRADIUS servers with SQL. That isn't the hard part. The problem with your instructions is that I'm not using ippool to assign dynamic IPs, our NASes are doing that (Portmaster 2/3). I don't have a problem setting up static IPs either, as we have several Dial-Up users who need those also. The problem lies in that I want to use the RADIUS server for PPPoE authentication also. But I want to allow users who log in through PPPoE to also be able to log in regularly(Dial-Up), when their PPPoE isn't logged in. BUT, when they log in through PPPoE, I want them to be assigned a static IP, when they login via Portmasters/Dial-Up, then they don't get the static IP, they get a regular dynamic one. Basically if a user logs in through NAS1, they are assigned X attributes with dynamic IP, if they log in through NAS2, they are assigned Y attributes with a static IP. And all this needs to be done in MySQL, that way my own PHP frontend(which I intend to release GPL) can work with it. Also I think MySQL scales better. -Nick -- ------------------------ | Nick White | | Network Consultant | | http://www.edge9.net | | nwtech(a)tele-net.net | ------------------------

3 4

RE: Authenticate/Attributes based on NAS-IP-Address
by Jeff Green 08 Jun '05

08 Jun '05

Hi Nick, I've modified FreeRadius to retrieve NAS specific reply items from a (Postgresql) table as I have three different NAS h/w that users can connect using - they have different IP pools. Is this similar to what you want to do ? Regards, -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of N White Sent: 07 June 2005 22:29 To: FreeRadius users mailing list Subject: Authenticate/Attributes based on NAS-IP-Address Using MySQL as a backend, is there any way to configure Authentication and Attribute (replies), based on the NAS-IP-Address sent to the FreeRADIUS server? Allow requests from NAS1 to authenticate and have certain attributes for users in that group and then allow requests from NAS2 to authenticate and have different attributes. Would there be anyway to allow a user to be a part of both groups? Thanks, Nick - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------------------------------------------------ Confidentiality Note: The information contained in this email and document(s) attached are for the exclusive use of the addressee and may contain confidential, privileged and non-disclosable information. If the recipient of this email is not the addressee, such recipient is strictly prohibited from reading, photocopying, distribution or otherwise using this email or its contents in any way. Please notify the Sapiens (UK) Ltd. Systems Administrator via e-mail immediately at networksupport(a)sapiens.co.uk, if you have received this email in error. Disclaimer: The views, opinions and guidelines contained in this confidential e-mail are those of the originating author and may not be representative of Sapiens (UK) Ltd. ------------------------------------------------------------------------

2 1

RE: MSChap/LDAP Question
by alan walters 08 Jun '05

08 Jun '05

Cant use crypt with chap and ldap -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Douglas Phillips Sent: 08 June 2005 18:19 To: freeradius-users(a)lists.freeradius.org Subject: MSChap/LDAP Question I'm trying to authenticate MSChap with LDAP (LDAP has crypted passwords) for PPTP from a Cisco VPN box. I'm getting a strange error. Here's the logs: rad_recv: Access-Request packet from host ************:1071, id=138, length=153 User-Name = "csdgp" NAS-Port = 2311 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "**********" MS-CHAP-Challenge = 0x6ad5d5a423e76b09aeb8ac329215d4b1 MS-CHAP2-Response = 0x02000b2f32af6a677146bd81ec222958a45f00000000000000007249bfd5eb81dd31ee 0af1a17712be08a7bc758820949d71 NAS-IP-Address = ********** NAS-Port-Type = Virtual rlm_ldap: - authorize rlm_ldap: performing user authorization for csdgp rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as *************** to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user csdgp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 Login incorrect: [csdgp/<no User-Password attribute>] (from client vpn1 port 2311) rad_recv: Access-Request packet from host ********:1071, id=138, length=153 Sending Access-Reject of id 138 to ********:1071 MS-CHAP-Error = "\002E=691 R=1" Here's the config: chap { authtype = CHAP } mschap { authtype = MS-CHAP use_mppe = yes } ldap { server = "localhost" identity = *************** password = *************** basedn = *************** filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}}) (host=ux1))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "userPassword" timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess auth_log chap mschap suffix ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } -- End of config -- Am I up a creek here or is there something I can do? I haven't been able to find much online, but I may not be hitting the right things. -- Douglas G. Phillips Development Information Technology Services Eastern Illinois University (217) 581-7631 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Anti-Virus. Version: 7.0.322 / Virus Database: 267.5.1 - Release Date: 02/06/2005 -- No virus found in this outgoing message. Checked by AVG Anti-Virus. Version: 7.0.322 / Virus Database: 267.5.1 - Release Date: 02/06/2005

1 0

MSChap/LDAP Question
by Douglas Phillips 08 Jun '05

08 Jun '05

I'm trying to authenticate MSChap with LDAP (LDAP has crypted passwords) for PPTP from a Cisco VPN box. I'm getting a strange error. Here's the logs: rad_recv: Access-Request packet from host ************:1071, id=138, length=153 User-Name = "csdgp" NAS-Port = 2311 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "**********" MS-CHAP-Challenge = 0x6ad5d5a423e76b09aeb8ac329215d4b1 MS-CHAP2-Response = 0x02000b2f32af6a677146bd81ec222958a45f00000000000000007249bfd5eb81dd31ee 0af1a17712be08a7bc758820949d71 NAS-IP-Address = ********** NAS-Port-Type = Virtual rlm_ldap: - authorize rlm_ldap: performing user authorization for csdgp rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as *************** to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user csdgp authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 Login incorrect: [csdgp/<no User-Password attribute>] (from client vpn1 port 2311) rad_recv: Access-Request packet from host ********:1071, id=138, length=153 Sending Access-Reject of id 138 to ********:1071 MS-CHAP-Error = "\002E=691 R=1" Here's the config: chap { authtype = CHAP } mschap { authtype = MS-CHAP use_mppe = yes } ldap { server = "localhost" identity = *************** password = *************** basedn = *************** filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}}) (host=ux1))" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = "userPassword" timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess auth_log chap mschap suffix ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } } -- End of config -- Am I up a creek here or is there something I can do? I haven't been able to find much online, but I may not be hitting the right things. -- Douglas G. Phillips Development Information Technology Services Eastern Illinois University (217) 581-7631

2 1