July 2005 - Freeradius-Users - lists.freeradius.org

Weird situation proxying accounting packets
by Loris Fadda 28 Jul '05

28 Jul '05

Hello guys, We use freeradius on a Debian 3.1 system, I've created an hybrid distro using packets from the testing tree to use the FR release 1.0.4 (deb revision 2). This box needs to proxy both auth and acct requests to a customer server that runs Cisco ACS 2.6. The NAS is Cisco AS5300. Proxyied authentication requests are satisfyed correctly, while accounting requests are sent back with a "shared secret is incorrect" from the customer radius server. Now, why if the secret is verified correctly on authentication I get this error on the accounting requests. Have you ever seen something like this? Notice that we checked out the secrets 10000 times and they match perfectly, also, in my proxy.conf as well as in the clients.conf(the equivalent on FR ... I donno what the hell ACS uses) of the customer the shared secret is defined just once, I mean the same directive "secret" is used both for auth and acct . Is there any library or dictionary issue I've missed to check? Thanks for your attention any help will be really appreciated. Loris

2 1

Free Radius Compilation problem
by Ranjitsinh Wable 28 Jul '05

28 Jul '05

Hi All, I am compiling the free radius server code on Linux kernel 2.4.20. I wanted to use it for the text file authentication. I am getting the error as follows: sql_mysql.c:39:20: errmsg.h: No such file or directory sql_mysql.c:40:19: mysql.h: No such file or directory gmake[10]: *** [sql_mysql.o] Error 1 gmake[9]: *** [common] Error 2 gmake[8]: *** [static] Error 2 gmake[7]: *** [common] Error 2 gmake[6]: *** [static] Error 2 gmake[5]: *** [common] Error 2 gmake[4]: *** [all] Error 2 gmake[3]: *** [common] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [common] Error 2 make: *** [all] Error 2 Whether it is configuration problem or library proble. Help needed. Thanks in advance. Regards, Wable R. U.

2 1

adding user-name to post-proxy logs
by Tariq Rashid 28 Jul '05

28 Jul '05

hi - i'm logging the pre-proxy and post-proxy logs. this works fine. the proxy-logs show the user-name (and password attribute) and that is fine. however the post-proxy logs don't contain the user-name because the reply from the backend radius server doesn't necessarily send the username as an attribute in the reply packet. since the state must be maintained in the freeradius proxy - is it possible to add it to the logs so that troubleshooting is easier? currently i have to match the timestamps. if i wrote the pre- and post- proxy logs to the same file i am guessing that the send-receive won't neccesarily be consecutive in the logs (like they are in other single-threaded servers!) tariq

2 1

Problems with User-Name/Stripped-User-Name
by Erling Paulsen 28 Jul '05

28 Jul '05

Hello. Is it possible to have the stripped username stored somewhere, even if I set 'nostrip' for a realm in proxy.conf? My setting is this, and this is the only problem I have left on my server: 01 I have a realm example.com, and this realm has 'nostrip' in it's definition in proxy.conf 02 If I detect it's an EAP request I proxy it to another realm (in the users file) and this works great - as 'user(a)example.com'. 03 If it's not an EAP request I want the local LDAP module to handle the request, just that I now need the stripped username, and the realm has already made it 'nostrip'. Here I want just 'user' instead of 'user(a)example.com'. If I change the filter in the LDAP module to match on %{Stripped-User-Name}, then this is offcourse empty. It would be nice to %have some way to make both User-Name and Stripped-User-Name exist at the %same time. If I remove the 'nostrip' from the realm it works for local ldap module handling but not for proxy to remote server for EAP, because that server requires the full non-stripped username. Any hints as to fix this little problem? - Erling -- ----------------|sig|--- Erling.Paulsen(a)cc.uit.no Nettseksjonen, ITavd UiT

3 4

etc_passwd module doesnt authenticate
by Ramses van Pinxteren 28 Jul '05

28 Jul '05

Hiya, I have a problem (as you can see in the output of radiusd -X) I am using a VPN server, and I want it to authenticate to my /etc/samba/smbpasswd file. Somehow it seems to me it gets the password from the radiusclient but then it gives the cryptical option: <no User-Password attribute> in the logfiles and tells me that the login incorrect was. I have the funny feeling that I need to edit the users file (now still default, and I dont know what to edit where to get this going. ) I am using this softwareversions: Fedora core 4 all updates applied ppp-2.4.3-5 from the pptpclient yum repository kernel-ppp-mppe-0.0.5-5dkms pptpd-1.2.1-2 freeradius-1.0.4-1 radiusclient-0.3.2-0.1 (RPM version from apt.sw.be) The VPN client I am using is Windows XP pro english btw... i hope that someone has time to help a stupid dutchman ;) This is the output of "radiusd -X" Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "yes" main: lower_pass = "no" main: nospace_user = "yes" main: nospace_pass = "yes" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded passwd passwd: filename = "/etc/samba/smbpasswd" passwd: format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" passwd: authtype = "MS-CHAP" passwd: delimiter = ":" passwd: ignorenislike = no passwd: ignoreempty = yes passwd: allowmultiplekeys = no passwd: hashsize = 100 rlm_passwd: nfields: 7 keyfield 0(User-Name) listable: no Module: Instantiated passwd (etc_smbpasswd) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.87.138.222:32774, id=176, length=68 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "ramses" Calling-Station-Id = "192.87.138.220" NAS-IP-Address = 192.87.138.222 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_passwd: Added LM-Password: '95903FD81E9ECFEC17306D272A9441BB' to config_items rlm_passwd: Added NT-Password: '435979E55C915EC8AD30AF6418407E89' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[UX ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" modcall[authorize]: module "etc_smbpasswd" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect: [ramses/<no User-Password attribute>] (from client h-range port 0 cli 192.87.138.220) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 176 to 192.87.138.222:32774 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 176 with timestamp 42e78a98 Nothing to do. Sleeping until we see a request. ----- end output ------ I have the following configurationfiles /etc/raddb/radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = no extended_expressions = no log_stripped_names = yes log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = yes lower_pass = no nospace_user = yes nospace_pass = yes checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } passwd etc_smbpasswd { filename = /etc/samba/smbpasswd format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" authtype = MS-CHAP hashsize = 100 ignorenislike = no allowmultiplekeys = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ntdomain_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } # perm = 0600 } #instantiate { #} authorize { preprocess mschap etc_smbpasswd } authenticate { Auth-Type MS-CHAP { mschap } } #preacct { # preprocess # files #} #accounting { # detail #} #post-auth { #} #pre-proxy { #} #post-proxy { #} ----- end radiusd.conf ------ /etc/raddb/clients.conf # # clients.conf - client configuration directives # ####################################################################### ####################################################################### # # Definition of a RADIUS client (usually a NAS). # # The information given here over rides anything given in the # 'clients' file, or in the 'naslist' file. The configuration here # contains all of the information from those two files, and allows # for more configuration items. # # The "shortname" is be used for logging. The "nastype", "login" and # "password" fields are mainly used for checkrad and are optional. # # # Defines a RADIUS client. The format is 'client [hostname|ip-address]' # # '127.0.0.1' is another name for 'localhost'. It is enabled by default, # to allow testing of the server after an initial installation. If you # are not going to be permitting RADIUS queries from localhost, we suggest # that you delete, or comment out, this entry. # client 127.0.0.1 { # # The shared secret use to "encrypt" and "sign" packets between # the NAS and FreeRADIUS. You MUST change this secret from the # default, otherwise it's not a secret any more! # # The secret can be any string, up to 32 characters in length. # secret = testing123 # # The short name is used as an alias for the fully qualified # domain name, or the IP address. # shortname = localhost # # the following three fields are optional, but may be used by # checkrad.pl for simultaneous use checks # # # The nastype tells 'checkrad.pl' which NAS-specific method to # use to query the NAS for simultaneous use. # # Permitted NAS types are: # # cisco # computone # livingston # max40xx # multitech # netserver # pathras # patton # portslave # tc # usrhiper # other # for all other types # nastype = other # localhost isn't usually a NAS... # # The following two configurations are for future use. # The 'naspasswd' file is currently used to store the NAS # login name and password, which is used by checkrad.pl # when querying the NAS for simultaneous use. # # login = !root # password = someadminpas } #client some.host.org { # secret = testing123 # shortname = localhost #} # # You can now specify one secret for a network of clients. # When a client request comes in, the BEST match is chosen. # i.e. The entry from the smallest possible network. # client 192.87.138.0/24 { secret = testing123 shortname = h-range } client 195.169.144.0/24 { secret = testing123 shortname = n-range } #client 10.10.10.10 { # # secret and password are mapped through the "secrets" file. # secret = testing123 # shortname = liv1 # # the following three fields are optional, but may be used by # # checkrad.pl for simultaneous usage checks # nastype = livingston # login = !root # password = someadminpas #} ----- end clients.conf ------ /etc/raddb/users # # Please read the documentation file ../doc/processing_users_file, # or 'man 5 users' (after installing the server) for more information. # # This file contains authentication security and configuration # information for each user. Accounting requests are NOT processed # through this file. Instead, see 'acct_users', in this directory. # # The first field is the user's name and can be up to # 253 characters in length. This is followed (on the same line) with # the list of authentication requirements for that user. This can # include password, comm server name, comm server port number, protocol # type (perhaps set by the "hints" file), and huntgroup name (set by # the "huntgroups" file). # # If you are not sure why a particular reply is being sent by the # server, then run the server in debugging mode (radiusd -X), and # you will see which entries in this file are matched. # # When an authentication request is received from the comm server, # these values are tested. Only the first match is used unless the # "Fall-Through" variable is set to "Yes". # # A special user named "DEFAULT" matches on all usernames. # You can have several DEFAULT entries. All entries are processed # in the order they appear in this file. The first entry that # matches the login-request will stop processing unless you use # the Fall-Through variable. # # If you use the database support to turn this file into a .db or .dbm # file, the DEFAULT entries _have_ to be at the end of this file and # you can't have multiple entries for one username. # # You don't need to specify a password if you set Auth-Type += System # on the list of authentication requirements. The RADIUS server # will then check the system password file. # # Indented (with the tab character) lines following the first # line indicate the configuration values to be passed back to # the comm server to allow the initiation of a user session. # This can include things like the PPP configuration values # or the host to log the user onto. # # You can include another `users' file with `$INCLUDE users.other' # # # For a list of RADIUS attributes, and links to their definitions, # see: # # http://www.freeradius.org/rfc/attributes.html # # # Deny access for a specific user. Note that this entry MUST # be before any other 'Auth-Type' attribute which results in the user # being authenticated. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #lameuser Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # Deny access for a group of users. # # Note that there is NO 'Fall-Through' attribute, so the user will not # be given any additional resources. # #DEFAULT Group == "disabled", Auth-Type := Reject # Reply-Message = "Your account has been disabled." # # # This is a complete entry for "steve". Note that there is no Fall-Through # entry so that no DEFAULT entry will be used, and the user will NOT # get any attributes in addition to the ones listed here. # #steve Auth-Type := Local, User-Password == "testing" # Service-Type = Framed-User, # Framed-Protocol = PPP, # Framed-IP-Address = 172.16.3.33, # Framed-IP-Netmask = 255.255.255.0, # Framed-Routing = Broadcast-Listen, # Framed-Filter-Id = "std.ppp", # Framed-MTU = 1500, # Framed-Compression = Van-Jacobsen-TCP-IP # # This is an entry for a user with a space in their name. # Note the double quotes surrounding the name. # #"John Doe" Auth-Type := Local, User-Password == "hello" # Reply-Message = "Hello, %u" # # Dial user back and telnet to the default host for that port # #Deg Auth-Type := Local, User-Password == "ge55ged" # Service-Type = Callback-Login-User, # Login-IP-Host = 0.0.0.0, # Callback-Number = "9,5551212", # Login-Service = Telnet, # Login-TCP-Port = Telnet # # Another complete entry. After the user "dialbk" has logged in, the # connection will be broken and the user will be dialed back after which # he will get a connection to the host "timeshare1". # #dialbk Auth-Type := Local, User-Password == "callme" # Service-Type = Callback-Login-User, # Login-IP-Host = timeshare1, # Login-Service = PortMaster, # Callback-Number = "9,1-800-555-1212" # # user "swilson" will only get a static IP number if he logs in with # a framed protocol on a terminal server in Alphen (see the huntgroups file). # # Note that by setting "Fall-Through", other attributes will be added from # the following DEFAULT entries # #swilson Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.65, # Fall-Through = Yes # # If the user logs in as 'username.shell', then authenticate them # against the system database, give them shell access, and stop processing # the rest of the file. # #DEFAULT Suffix == ".shell", Auth-Type := System # Service-Type = Login-User, # Login-Service = Telnet, # Login-IP-Host = your.shell.machine # # The rest of this file contains the several DEFAULT entries. # DEFAULT entries match with all login names. # Note that DEFAULT entries can also Fall-Through (see first entry). # A name-value pair from a DEFAULT entry will _NEVER_ override # an already existing name-value pair. # # # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # DEFAULT Auth-Type = System Fall-Through = 1 # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. # #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "alphen" # Framed-IP-Address = 192.168.1.32+, # Fall-Through = Yes #DEFAULT Service-Type == Framed-User, Huntgroup-Name == "delft" # Framed-IP-Address = 192.168.2.32+, # Fall-Through = Yes # # Defaults for all framed connections. # DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes # # Default for PPP: dynamic IP address, PPP mode, VJ-compression. # NOTE: we do not use Hint = "PPP", since PPP might also be auto-detected # by the terminal server in which case there may not be a "P" suffix. # The terminal server sends "Framed-Protocol = PPP" for auto PPP. # DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for CSLIP: dynamic IP address, SLIP mode, VJ-compression. # DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP # # Default for SLIP: dynamic IP address, SLIP mode. # DEFAULT Hint == "SLIP" Framed-Protocol = SLIP # # Last default: rlogin to our main server. # #DEFAULT # Service-Type = Login-User, # Login-Service = Rlogin, # Login-IP-Host = shellbox.ispdomain.com # # # # Last default: shell on the local terminal server. # # # DEFAULT # Service-Type = Shell-User # On no match, the user is denied access. ----- end users ------

2 3

RE: mod_radius, apache2 and the auth cookie.
by Palmer J.D.F. 28 Jul '05

28 Jul '05

Hi Alan, > > "Palmer J.D.F." <J.D.F.Palmer(a)swansea.ac.uk> wrote: > > Is it possible to set the timeout for the auth cookie used by the > mod_radius > > authentication module to 0; by Zero I mean no time, not infinite time? > > You mean re-authenticate for every request? That would require > source code changes. Effectively yes, see the description of what I'm trying to do below. > > Or, is there a way that I can clear the cookie on a failed login? > > The module doesn't set the cookie on a failed login, so there > shouldn't be any problem. If I get a failed login, then try to login again it just uses cached credentials and doesn't prompt for details, if I close and re-open the browser it does then allow me to enter details. I guess it may not be a cookie if one isn't set, but the credentials are being cached somewhere. > > > At present, if a user login fails the user has to close the browser and > open > > another in order to be able to re-enter their credentials, I want to try > to > > get round this if possible. > > I don't see why that would happen. The module was designed, and > tested to work properly in that situation. > > Can you explain more about what you're doing, how, and what browser > you're using? So far this has only been tested with IE on a patched up but otherwise std XP machine. The reason for the authentication is to log into a web-redirect gateway. An iptables rule redirects any un-authenticated IP/MAC pairs to the login page; on a successful login the page (a php page which resides in a protected folder) adds some iptables rules to allow that particular client (IP/MAC pair) through the gateway. This is why it doesn't matter that there is an instant timeout, as the client will not need to access the page again until his/her connection times out and the 'allowing' iptables rules are removed. The removal of stale connections is handled with a cron job script that compares iptables entries to the arp table on the internal interface, if there are iptables rules for an IP/MAC pair, but no arp entry for them then the iptables rules are removed. Quite crude, but it works. In summary, I have index.php that users are redirected to, this page contains a 'Log In' link to a page in a protected folder /gateway/go.php when they click the link they are challenged for credentials, if they are correct then /gateway/go.php loads setting some iptables rules, if it fails then we are currently loading a page called failed.php that explains to the user that they need to shut down the browser and open a new one and try again. An aside to this, is it possible to have a couple of text boxes on the login page where the user/pass are entered which are then sent to mod_radius, as opposed to having a pop up user/pass dialogue box? Thanks, Jezz Palmer.

3 2

help
by Liew Toh Seng 28 Jul '05

28 Jul '05

Hi, Is there any documentation for freeradius ? How and where to start ? Thanks. -- -------------------------------------------------------- Best Regards, Liew Toh Seng System Consultant, RedHat Certified Engineer http://www.redhat.com/rhce/rhce803005004313527.html My Directory Sdn Bhd, (http://www.md.com.my) "Your Open Source Partner"

3 2

Re: Access-Reject packet from host 127.0.0.1:1812
by Peter Cheng 28 Jul '05

28 Jul '05

> 3. Re: Access-Reject packet from host 127.0.0.1:1812 > ------------------------------ > Message: 3 > Date: Wed, 27 Jul 2005 21:34:01 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Access-Reject packet from host 127.0.0.1:1812 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20050727203401.GB21675(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> BAD PASSWORD: it is based on a dictionary word > > > I hope you dont let folk SSH into this box :-) > > >>[root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 >>Sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "testing" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>Re-sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "\271g\343\034{~\235\364M\344ID%\345\021j" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=251, length=20 > > > from a quick look att he logs, it looks as if the FreeRADIUS process > is unable to read your /etc/passwd file > > alan > > Hi Alan, i have do some chown on the shadow file and everything seem to be work fine.. Thank you very much for your advices.. check the below output:- ====================================================================== [root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 Sending Access-Request of id 226 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "testing" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=226, length=20 [root@cerebro ~]# ====================================================================== Best Regards, -- Peter Cheng Chief Technical Officer Open Source Edge O.S. Edge Sdn Bhd Mobile: +6.012.4766.202 Office: +6.03.4023.0337/8337 Fax : +6.03.4023.2337

1 0

Re: Freeradius-Users Digest, Vol 3, Issue 121
by Peter Cheng 28 Jul '05

28 Jul '05

> 3. Re: Access-Reject packet from host 127.0.0.1:1812 > ------------------------------ > Message: 3 > Date: Wed, 27 Jul 2005 21:34:01 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Access-Reject packet from host 127.0.0.1:1812 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20050727203401.GB21675(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> BAD PASSWORD: it is based on a dictionary word > > > I hope you dont let folk SSH into this box :-) > > >>[root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 >>Sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "testing" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>Re-sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "\271g\343\034{~\235\364M\344ID%\345\021j" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=251, length=20 > > > from a quick look att he logs, it looks as if the FreeRADIUS process > is unable to read your /etc/passwd file > > alan > > Hi Alan, i have do some chown on the shadow file and everything seem to be work fine.. Thank you very much for your advices.. check the below output:- ====================================================================== [root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 Sending Access-Request of id 226 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "testing" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=226, length=20 [root@cerebro ~]# ====================================================================== Best Regards, -- Peter Cheng Chief Technical Officer Open Source Edge O.S. Edge Sdn Bhd Mobile: +6.012.4766.202 Office: +6.03.4023.0337/8337 Fax : +6.03.4023.2337

1 0

Access-Reject packet from host 127.0.0.1:1812
by peter＠osedge.com 27 Jul '05

27 Jul '05

Hi all, I am a complete newbie with radius. I have try to configure freeradius on fedora core 3 to authenticates against unix password /etc/passwd, /etc/shadow, but seem to be fail until now.. can any want pls guide me though this.. Besides, pls advice me if i doing anything wrong. My installation step:- 1) install freeradius using apt-get command:- ===================================================================== [root@cerebro ~]# apt-get install freeradius ===================================================================== 2) As i go though the doc, the default seem to be ok.., so i just start the services:- ===================================================================== [root@cerebro ~]# /etc/init.d/radiusd start Starting RADIUS server: [ OK ] [root@cerebro ~]# ===================================================================== 3) add a dummy user and assigh a password to user dummy:- ===================================================================== [root@cerebro ~]# adduser dummy [root@cerebro ~]# passwd dummy Changing password for user dummy. New UNIX password: testing BAD PASSWORD: it is based on a dictionary word Retype new UNIX password: testing passwd: all authentication tokens updated successfully. [root@cerebro ~]# ===================================================================== 4) testing to autheticate the user dummy:- ===================================================================== [root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 Sending Access-Request of id 251 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "testing" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 Re-sending Access-Request of id 251 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "\271g\343\034{~\235\364M\344ID%\345\021j" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=251, length=20 [root@cerebro ~]# ===================================================================== The output of /var/log/radius/radius.log ===================================================================== [root@cerebro radius]# tail -f /var/log/radius/radius.log Thu Jul 28 03:54:16 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 28 03:54:16 2005 : Info: Ready to process requests. Thu Jul 28 03:55:38 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Jul 28 03:55:38 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 28 03:55:38 2005 : Info: Ready to process requests. Thu Jul 28 03:55:42 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Jul 28 03:55:42 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 28 03:55:42 2005 : Info: Ready to process requests. Thu Jul 28 03:55:45 2005 : Auth: rlm_unix: [dummy]: invalid password Thu Jul 28 03:56:25 2005 : Auth: rlm_unix: [dummy]: invalid password Thu Jul 28 03:56:37 2005 : Auth: rlm_unix: [dummy]: invalid password ===================================================================== output of the command "radiusd -X" ===================================================================== Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ===================================================================== Sorry, if i make you confuse Best Regards, -- Peter Cheng Chief Technical Officer Open Source Edge O.S. Edge Sdn Bhd Mobile: +6.012.4766.202 Office: +6.03.4023.0337 Fax : +6.03.4023.2337

2 1