September 2005 - Freeradius-Users - lists.freeradius.org

How to get the server to respond with Access-Challenge ?
by Saravanan Ramaswamy 18 Sep '05

18 Sep '05

Hi, I would like to know how to make the RADIUS server (freeRADIUS 1.0.0-pre3) to send a challenge to the NAS. That is, instead of getting Access-Accept or Access-Reject, I want to see Access-Challenge. What do I need to set in the user's profile ? I tried looking thru the FAQ and some archives but could not find anything. RFC 2865 states that "if the server decides to send a challenge ..." - I want to know what makes the server to send the challenge. I am using the plain ascii/pap/chap/mschap kind of authentications. Any help appreciated. Thanks, Sarav __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

Walled Garden for Users Without Realms.
by McCain, Al 18 Sep '05

18 Sep '05

Hi. I was wondering if there was a way to place users in a Walled Garden if they try to Auth without a Realm. We are currently running FreeRADIUS Version 0.9.3. Our users are stored in MySQL. Company: I work for an ISP. We seem to aquire new properties every few months. Current structure : We have multiple instances of RADIUS running: one for each domain. (I have NO clue who set it up this way). I would like to consolidate these intances into one, and force our users to use realms. Problem: We can't just force the customers to use realms. We would need to notify them of the changes. (This can prove tricky). What I would like to see: Aside from contacting the customer about changes, I would like to send the users to a web page after they log in without a realm. The page would tell them that they need to log in with realms. I believe this is called hURL'ing, however I cannot seem to find any documentation. Has anyone ever done this, or know if it can be done ? Any help is greatly appreciated. Thanks, Al

2 1

segmentation fault when running radiusd -X
by Voipers Portugal 18 Sep '05

18 Sep '05

I am using Free Radius 1.0.1 and i get the following output when i try to run the server. Any ideias? ser:/usr/local/src# radiusd -sfxxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/postgresql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded DIGEST Module: Instantiated digest (digest) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Segmentation Fault Can it be anything within the confguration files? Regards, Jose Simoes

2 1

1.0.5 + rlm_sql_mysql: Segmentation fault
by Thomas Krause (Webmatic) 17 Sep '05

17 Sep '05

Hello, I want to setup a new server with FreeRadius using MySQL as backend. OS is FreeBSD 5.4, DB Mysql 4.1.13. I've compiled FreeRadius from source (not from ports). Without sql all is doing fine. With sql enabled, the daemon dies with "Segmentation fault (core dumped)": rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to freeradius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 Segmentation fault (core dumped) I've followed the instructions in the bugs file, but I'm not a programmer (so the output doesn't really helps me): # gdb /usr/local/sbin/radiusd radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-marcel-freebsd"... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /lib/libcrypt.so.2...done. Loaded symbols for /lib/libcrypt.so.2 Reading symbols from /usr/local/lib/libradius-1.0.5.so...done. Loaded symbols for /usr/local/lib/libradius-1.0.5.so Reading symbols from /usr/local/lib/libltdl.so.4...done. Loaded symbols for /usr/local/lib/libltdl.so.4 Reading symbols from /usr/lib/libssl.so.3...done. Loaded symbols for /usr/lib/libssl.so.3 Reading symbols from /lib/libcrypto.so.3...done. Loaded symbols for /lib/libcrypto.so.3 Reading symbols from /usr/lib/libpthread.so.1...done. Loaded symbols for /usr/lib/libpthread.so.1 Reading symbols from /lib/libc.so.5...done. Loaded symbols for /lib/libc.so.5 Reading symbols from /usr/local/lib/rlm_exec-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_exec-1.0.5.so Reading symbols from /usr/local/lib/rlm_expr-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_expr-1.0.5.so Reading symbols from /usr/local/lib/rlm_pap-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_pap-1.0.5.so Reading symbols from /usr/local/lib/rlm_chap-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_chap-1.0.5.so Reading symbols from /usr/local/lib/rlm_mschap-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_mschap-1.0.5.so Reading symbols from /usr/local/lib/rlm_unix-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_unix-1.0.5.so Reading symbols from /usr/local/lib/rlm_preprocess-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_preprocess-1.0.5.so Reading symbols from /usr/local/lib/rlm_realm-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_realm-1.0.5.so Reading symbols from /usr/local/lib/rlm_files-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_files-1.0.5.so Reading symbols from /usr/local/lib/rlm_sql-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_sql-1.0.5.so Reading symbols from /usr/lib/libm.so...done. Loaded symbols for /usr/lib/libm.so Reading symbols from /usr/lib/libz.so...done. Loaded symbols for /usr/lib/libz.so Reading symbols from /usr/local/lib/mysql/libmysqlclient.so...done. Loaded symbols for /usr/local/lib/mysql/libmysqlclient.so Reading symbols from /usr/local/lib/rlm_sql_mysql-1.0.5.so...done. Loaded symbols for /usr/local/lib/rlm_sql_mysql-1.0.5.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x282f8550 in memset () from /lib/libc.so.5 (gdb) bt #0 0x282f8550 in memset () from /lib/libc.so.5 #1 0x00000001 in ?? () #2 0x283d1b64 in sql_init_socket (sqlsocket=0x8080020, config=0x8067500) at sql_mysql.c:71 #3 0x28348fa8 in connect_single_socket (sqlsocket=0x8080020, inst=0x8080400) at sql.c:70 #4 0x28349110 in sql_init_socketpool (inst=0x8080400) at sql.c:131 #5 0x283474eb in rlm_sql_instantiate (conf=0x8140038, instance=0x0) at rlm_sql.c:712 #6 0x0805470d in find_module_instance (instname=0x8078610 "sql") at modules.c:358 #7 0x0805596e in do_compile_modsingle (component=1, ci=0x8079400, filename=0x805f353 "radiusd.conf", grouptype=0, modname=0xbfbfdae8) at modcall.c:814 #8 0x08054e82 in setup_modules () at modules.c:568 #9 0x0804c850 in main (argc=2, argv=0xbfbfec8c) at radiusd.c:960 (gdb) (The same happens when using ver. 1.0.4 from ports). Kind regards, Thomas -- ------------------------------------------------------------ Thomas Krause Webmatic Kommunikations GmbH Tel: +49 345 7779999 ------------------------------------------------------------

3 4

Problems with oracle
by chabral - 17 Sep '05

17 Sep '05

Hi, I'm trying to use freeradius 1.0.1 with oracle 9i. I successfully (i think) compiled freeradius with oracle support. I've the files: /usr/local/etc/raddb/oraclesql.conf /usr/local/lib/rlm_sql_oracle-1.0.1.so /usr/local/lib/rlm_sql_oracle.so /usr/local/lib/rlm_sql_oracle.la /usr/local/lib/rlm_sql_oracle.a The problem is when I start "radiusd -X" I see the lines: rlm_sql (sql): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked rlm_sql (sql): Attempting to connect to TR_RADIUS@oracle:1521/(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=oracle)(PORT=1521)))(CONNECT_DATA=(SID=TESTSID)(SERVER=DEDICATED))) rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_oracle #0 rlm_sql_oracle: Couldn't init Oracle OCI environment (OCIEnvCreate()) rlm_sql (sql): Failed to connect DB handle #0 rlm_sql (sql): starting 1 rlm_sql (sql): starting 2 rlm_sql (sql): starting 3 rlm_sql (sql): starting 4 rlm_sql (sql): Failed to connect to any SQL server. Module: Instantiated sql (sql) Any help? -- chabral

2 1

Re: PEAP without credentials
by Stefan.Neis＠t-online.de 16 Sep '05

16 Sep '05

Hi, > I thought the username/passwd is transfered while the shake-hand. Yes and no. I.e. it depends on the precise protocol you're using. For some of them (mostly PAP, EAP-TTLS/PAP), the password is transfered in an encrypted form. For others (CHAP, MSCHAP, EAP-MD5, PEAP), the password is only used to perform a computation on a "challenge" presented by the server and only the "reply" to the challenge is transferred. Those protocols are designed in a way to make it impossible to obtain the cleartext password from challenge and response, so an attacker doesn't get any hint about the password. > So it wouldn't be able to reuse this transfered (encrypted or not) password > for the connection? No, the problem in the case of MSCHAP is, that you _do_ need the cleartext password and can't obtain it from the data transfered. > When I look in my radius log, it shows me the clear-text > password of everyone who tries to auth. Then, you're either using a PAP based protocol for those tests where the password is shown, or it shows you the password it got from the "database" (users file, SQL, whatever) > I would use that transfer to copy username & Passwd and store it in a db, > so for the rest of the auth and autz the server would have the passwd. No such transfer is taking place in the case of PEAP; just as I already said in my first reply: > > ..., there's no > > way to extract the clear text password from the request, ... Just look at the raw RADIUS paket via e.g. ethereal, if you're unwilling to believe my words ... Regards, Stefan

1 0

RE: Howto strip off Domain Name
by Jamie Crawford 16 Sep '05

16 Sep '05

proxy.conf realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } >>> bjohnson(a)drtel.com 9/16/2005 9:56:21 AM >>> Lookup realms in the docs. And people wonder why Alan is so cranky. ;-) - Brian J. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Sebastian Mauer > Sent: Friday, September 16, 2005 9:43 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Howto strip off Domain Name > > Hello there, > > I managed to get FreeRadius authenticating users with PEAP against a > OpenLDAP Directory containing my Samba controlled domain data > and users. > The Users are stored with der normal username (without Domain) in the > LDAP. As default the windows WLAN Client tries to > authenticate with the > entered windows logon credentials which is fine if the client > would send > the username without the Domain added. When FreeRadius looks up > DOMAIN\testuser in the LDAP there is obviously no result because the > user is stored as testuser. So what can I do to strip of any > Domain Name > by default? > > Thanks in Advance, > > Sebastian Mauer > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

PAP and clear text
by Chuck Slate 16 Sep '05

16 Sep '05

Hi All. I have a few freeRADIUS newbie questions for you. I have always read and been told that PAP is insecure because it transmits passwords in clear text. However, If I sniff the communication between my NAS and server when PAP is used, the password is indeed obfuscated. It appears to be hashed. So my questions are: 1) First and foremost, am I interpreting this correctly? 2) If so, is it the shared secret defined in the clients.conf file that is used as a key for the hash? 3) If not, any clue as to what I am seeing, and in that case, what is the shared secret used for? As you can see, I am looking for some basic info about the flow of the connection. I have taken an honest shot at RTFM, but have not come across these details yet. Can someone please explain or point me to an explanation? Thanks in advance. Chuck

3 2

mssql and authenticate_query
by Duane Cox 16 Sep '05

16 Sep '05

List: There is an "authenticate_query" variable defined in the stock mssql.conf I can not get freeradius to run this query when authenticating users; and when I add the 'sql' module in the authenticate section of radius.conf, freeradius stops with the following error... Module: Instantiated sql (sql) radiusd.conf: "SQL" modules aren't allowed in 'authenticate' sections -- they have no such method. I am beginning to think this entry is defunct or never implemented. Am I right? If so, then I could remove that entry from my mssql.conf. Thanks Duane Cox

4 7

Howto strip off Domain Name
by Sebastian Mauer 16 Sep '05

16 Sep '05

Hello there, I managed to get FreeRadius authenticating users with PEAP against a OpenLDAP Directory containing my Samba controlled domain data and users. The Users are stored with der normal username (without Domain) in the LDAP. As default the windows WLAN Client tries to authenticate with the entered windows logon credentials which is fine if the client would send the username without the Domain added. When FreeRadius looks up DOMAIN\testuser in the LDAP there is obviously no result because the user is stored as testuser. So what can I do to strip of any Domain Name by default? Thanks in Advance, Sebastian Mauer

2 1