June 2005 - Freeradius-Users - lists.freeradius.org

Windows -> VPN -> Radius
by Roberto Greiner 29 Jun '05

29 Jun '05

Hi, I'm having the following problem: I'm trying to establish a VPN server, where most of the clients are Windows XP/2K machines. As VPN server I'm using a Debian Sarge box running PopTop 1.2.1, which sends the autentication MS-CHAPv2 requests to my other Debian Sarge box running Freeradius 1.0.4, using my-sql v. 12.22 as database for users/accounting. Problem: Windows sends the user info as a Chap challenge, and as a result the Freeradius server reports that the user request came with no password. Did somebody face a similiar problem? Can someone helpme/point in the right direction? Thank you, Marcos Roberto Radius.log entries: Mon Jun 27 10:15:16 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Jun 27 10:15:16 2005 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Jun 27 10:15:16 2005 : Info: rlm_sql (sql): Attempting to connect to radius@localhost:/radius Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jun 27 10:15:16 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jun 27 10:15:16 2005 : Info: Ready to process requests. Mon Jun 27 10:15:40 2005 : Auth: Login incorrect: [testuser/<no User-Password attribute>] (from client localhost port 0 cli aaa.bbb.ccc.ddd) (IP address edited....)

3 4

ldap authentication error.
by DK 29 Jun '05

29 Jun '05

Hi, I´m trying to configure freeradius to authenticate to LDAP server. I use an users file and ldap server to authenticate, the first one goes well but when I ytry to do it with LDAP server, a get this error. rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "ldap" returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Any idea? Thanks

2 1

How the freeradius-server can get username/password from Win2k-Se rver ?
by Schuster Christian 29 Jun '05

29 Jun '05

Hi @ all, I'm a freeradius newbie and try that the freeradius(version 1.0.2) get their users (and passwords) by domain from the active directory. I googled a lot and found differend ways for this. (ntlm, pam-module). Which of these ways is the securest way? Are their any other possibilities? Are their any manuals/helps therefore or can someone discribe me how to implement this? thx schustn

2 1

PAM_RADIUS_AUTH
by Talwar, Puneet (NIH/NIAID) 29 Jun '05

29 Jun '05

I would like to know is there any way to increase the debug level on PAM_RADIUS_AUTH module. I am having a hard time connect to the radius server which is running on Window 2000 server. Plus I am not sure if I got the pam login file correct in /etc/pam.d/login The OS I am running is RH ES WS v4.0 #%PAM-1.0 auth required /lib/security/pam_securetty.so auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_unix_auth.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth # pam_selinux.so close should be the first session rule session required pam_selinux.so close session required pam_stack.so service=system-auth session optional pam_console.so # pam_selinux.so open should be the last session rule session required pam_selinux.so multiple open __________________________ Puneet Talwar

2 1

wrong DNS IP address for dialup clients
by mnisay 29 Jun '05

29 Jun '05

hello. before, the assigned DNS IP address are being properly assigned to dialup customers, now that we have changed our IP block addresses, 10% of the dialup customers are still getting the OLD DNS IP addresses, which is wrong. i have checked all the routers and servers and did not found any devices that uses the OLD IP block nor the old DNS IP addresses. i have tried restarting routers, clearing DNS caches from DNS servers as well. i have tried testing different dns attributes like Client-DNS-Pri / Client-DNS-Pri pairs Ascend-Client-Primary-DNS / Ascend-Client-Secondary-DNS pairs i double checked name-servers declaration in the router level , what could it be? my resources says: freeradius-0.9.1-1 under FC2 would appreciate advises pls. thanks in advance. msn

2 3

RE: sql counter clarification and issues
by Ross Tsolakidis 29 Jun '05

29 Jun '05

Thanks for responding. Can you give me an example of how to set the counter to reset in SQL ? This is my config for the counter. counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } Thanks again. Regards, -- Ross -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, 29 June 2005 12:58 AM To: FreeRadius users mailing list Subject: Re: sql counter clarification and issues "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > Looking at that debug, where exactly is it resetting the counter ? The "counter" module is resetting the counter. > In the db.daily ? Because it's not resetting in SQL. Yes, the counter module doesn't say it's using SQL. > Also what is the db.daily ? How do you read that file ? You don't. Its used by the counter module to keep it's count. > What I'm trying to achieve here is to get mysql to reset the counters > its doing, and then start a new row if possible. > Within the table radacct. AcctInputOctets AcctOutputOctets. > Is it possible to do this ? > Does the counter actually do that ? You want sqlcounter. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: Win2k and Freeradius, newbe plz help
by Guy Davies 29 Jun '05

29 Jun '05

Upgrade to win2k SP4. Before that, the M$ supplicant was broken. If you're doing PEAP, I'm assuming you're doing PEAP/MS-CHAPv2. If so, why do you need a client cert? You only need a client cert if you're doing EAP/TLS. PEAP/MS-CHAPv2 uses MS-CHAPv2 to exchange a user's credentials based on a username and password. Rgds, Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Michael Langer > Sent: 29 June 2005 13:45 > To: Freeradius-Users > Subject: Win2k and Freeradius, newbe plz help > > > Hi, > > i try to configure freeradius and win2k(SP2) client for PEAP. > But the client doesnt connect to server or send any packages :( > > I have create the certificates (root,client,server) and > install root.der and client.d12 on the windows machine. Further i do: > > Select the Authentication tab > Select Protected EAP on the drop-down list > Click Properties > Enable "Validate server certificate" > In Trusted Root Certification Authorities list, enable the > root.der certificate. In Select Authentication Method, select > "Secured password (EAP-MSCHAPv2)" > > freeradius (1.0.4): > > Change the default_eap_type from tls to peap: > > eap { default_eap_type = peap > > Move to the PEAP section below the TLS section and uncomment > the following > lines: > > peap { > default_eap_type = mschapv2 > } > > After i start radiusd -X all go fine, and i get: waiting for ... > > > This should work, doesnt it? > > mfg Michael > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Win2k and Freeradius, newbe plz help
by Michael Langer 29 Jun '05

29 Jun '05

Hi, i try to configure freeradius and win2k(SP2) client for PEAP. But the client doesnt connect to server or send any packages :( I have create the certificates (root,client,server) and install root.der and client.d12 on the windows machine. Further i do: Select the Authentication tab Select Protected EAP on the drop-down list Click Properties Enable "Validate server certificate" In Trusted Root Certification Authorities list, enable the root.der certificate. In Select Authentication Method, select "Secured password (EAP-MSCHAPv2)" freeradius (1.0.4): Change the default_eap_type from tls to peap: eap { default_eap_type = peap Move to the PEAP section below the TLS section and uncomment the following lines: peap { default_eap_type = mschapv2 } After i start radiusd -X all go fine, and i get: waiting for ... This should work, doesnt it? mfg Michael

1 0

Re: help me
by rashad 29 Jun '05

29 Jun '05

Most probably your freeradius built without mysql drivers. Run ./configure and check output. If you can find 'mysql module disabled' then mysql drivers are not built. Check whether libmysqlclient and libmysqlclient-dev packages are installed. > rlm_sql (sql): Could not link driver rlm_sql_mysql: > rlm_sql_mysql.so: cannot open shared object file:No > such file or directory > rlm_sql (sql): Make sure it (and all its dependent > libraries!) are in the search path of your system's > ld. > radiusd.conf[14]: sql: Module instantiation failed. > > i found rlm_sql_mysql.so file in my pc but this file > not found so please help me what i can to do? > > regards > > Umar Draz > > > > ____________________________________________________ > Yahoo! Sports > Rekindle the Rivalries. Sign up for Fantasy Football > http://football.fantasysports.yahoo.com > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 2, Issue 127 > ************************************************ > >

1 0

PEAP and NT domain logon problem
by Jérémy Cluzel 29 Jun '05

29 Jun '05

Hi, I have a freebsd box with a working freeradius 1.0.4 on it. PEAP works fine but I have to be logged before... Here is my problem, when I try to log on my domain, Windows complains about the fact that it is "unable to find my profile on the server" (or sometimes that "the domain XXXXX is unreachable"). Is there any solution to tell windows XP supplicant to wait for auth before trying to download profile ? I think this will be solve by switching to EAP/TLS or EAP/TTLS... but I'm not sure. Regards, Jeremy

1 0