September 2005 - Freeradius-Users - lists.freeradius.org

PEAP and ntlm_auth
by Dick 29 Sep '05

29 Sep '05

Hi all, I've got a small problem with FreeRadius, I'm trying to forward NTLM authentication to a NT domain by using ntlm_auth but the %{Stripped-User-Name} is empty. I've enabled ntdomain in authorize { } and preacct { }, but it doesn't seem to translate "%{User-name}" as "NTCORP01\\USER" to "%{Stripped-User-Name}" as"USER". When I use "ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=USER" it works (but only for USER ;-)). with_ntdomain_hack in preprocess { } it breaks PEAP (as mentioned earlier on this list). Should I create a wrapper script for ntlm_auth (to strip the %{User-name}) as a workaround or can I use another FreeRadius trick? Thanks, Dick

1 0

setting password from an application
by Nagaraj Venkatapuram 29 Sep '05

29 Sep '05

All, I am having a problem setting password from the http application. It is getting reset to NULL inside pam_authenticate somehow. The only place I can see password is set to NULL is in the function *void _pam_sanitize(pam_handle_t *pamh)* in pam_misc.c file. I've also commented out the invocation of _pam_sanitize from pam api. Also I have syslog trace in the *pam_sanitize *function. However, for some reason I am losing the password inside pam_authenticate inspite of all the changes and also I don't see any trace from the function *pam_sanitize. *If anybody has any idea about this, please reply. retval = pam_start("http", auth_userpass, &conv, &pamh); syslog(LOG_INFO, "before pam_set_item..........................\n"); pam_set_item(pamh, PAM_AUTHTOK, pwd); if (retval == PAM_SUCCESS) { retval = pam_authenticate(pamh, 0); /* is user really user? */ } else { syslog(LOG_INFO, "--Not authenticated - pam start failed\n"); } /* This is where we have been authorized or not. */ if (retval == PAM_SUCCESS) { syslog(LOG_INFO, "Authentication successful for %s from %s\n", auth_userpass, req->remote_ip_addr); strncpy(req->user, auth_userpass, 15); req->user[15] = '\0'; if (pam_end(pamh,retval) != PAM_SUCCESS) { /* close Linux-PAM */ pamh = NULL; syslog(LOG_ERR, "http: failed to release pam authenticator\n"); } return 1; } Thanks, N

1 0

Freeradius + oracle
by chabral - 29 Sep '05

29 Sep '05

Hi, Is it possible to install and run freeradius on an Oracle App Server?. The database server is another server located at another local network. Is it possible to achieve this configuration? Which are the requirements of freeradius for compiling with oracle support? Can I download the code and compile it in the app server? I'll really appreciate your advice. Best regards, -- chabral

1 0

How can i tell which version of freeradius i'm running?
by Linda Pagillo 29 Sep '05

29 Sep '05

Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

3 2

Re: SSL3_GET_CLIENT_KEY_EXCHANGE
by Juan Daniel Moreno 29 Sep '05

29 Sep '05

> > The protocol specification describes this. The implementation in > src/modules/rlm_eap/ contains diagrams of the packets it expects to > receive. > > Alan DeKok. > > Thank you Alan, but now I have a new problem. I have been reading the src/modules/rlm_eap/ to understand my problem but I don't find the issue. In TLS establishment, the public key in the server.cert is 128 bytes length. I generate a random string of 46 bytes and the protocol version (TLS 1.0 (0x03, 0x01)) and I use the SSL function RSA_public_encrypt() with server's public key to encrypt the PreMasterSecret. As a result I get a 128 length string. As I send this data to the server, I get a "tls rsa encrypted length is wrong: s3_srvr.c: 1450:" Can anybody please tell me where can be my problem? Here is my code for exemple. void Client_Key_Exchange (SSLData *ClientSSLData, unsigned short *length, char *HandshakeMessages, unsigned short *length_Hndshk, char *buff) { char *PreMasterSecret = (char*) _MEMORY_Allocate (58 , true); char *EncryptedPreMasterSecret = (char*) _MEMORY_Allocate (128, true); char *temp = (char*) _MEMORY_Allocate (58 , true); unsigned char *tmpCert = _MEMORY_Allocate (ClientSSLData->certificate_len + 128, true); _RANDOM_MakeCharString (temp, 46); PreMasterSecret [0] = 0x03; PreMasterSecret [1] = 0x01; for (register int i = 0; i<46; i++) { PreMasterSecret[i+2] = temp [i]; ClientSSLData->PreMasterSecret[i] = PreMasterSecret[i]; } for (i = 0; i < ClientSSLData->certificate_len; i++) tmpCert[i] =(unsigned char) ClientSSLData->certificate[i]; //----- OpenSSL Functions ----- RSA *server_public_key; X509 *cert = X509_new (); EVP_PKEY *evp = EVP_PKEY_new (); X509 *err = d2i_X509 (&cert, (unsigned char**) &tmpCert, (ClientSSLData->certificate_len) ); //----- d2i_509 Function retrives tmpCert pointer advanced the number of bytes read ----- tmpCert = tmpCert - (ClientSSLData->certificate_len); //----- We get the public key from the Server certificate ----- evp = X509_get_pubkey(cert); server_public_key = (RSA *) evp->pkey.ptr; int rsasize = RSA_size(server_public_key); //----- We get the PreMasterSecret encrypted ----- int Encrypted_len = RSA_public_encrypt(48, (BYTE*) PreMasterSecret, (unsigned char*)EncryptedPreMasterSecret, server_public_key, RSA_PKCS1_PADDING); ClientSSLData->bufferSSL[(*length)++] = 0x16; // Handshake Message ClientSSLData->bufferSSL[(*length)++] = 0x03; // Version ClientSSLData->bufferSSL[(*length)++] = 0x01; // Version ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len + 6) % 256; // Length ClientSSLData->bufferSSL[(*length)++] = 0x10; // Client key exchange ClientSSLData->bufferSSL[(*length)++] = 0x00; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) / 256; // Length ClientSSLData->bufferSSL[(*length)++] = (Encrypted_len ) % 256; // Length //----- Public key exchange ----- for (i = 0; i < Encrypted_len; i++) { buff[i] = EncryptedPreMasterSecret[i]; HandshakeMessages[(*length_Hndshk)++] = EncryptedPreMasterSecret[i]; } free (PreMasterSecret); free (EncryptedPreMasterSecret); free (temp); free (tmpCert); } Thank you for your help. Juan Daniel MORENO

2 1

My server is up and running. Thanks to all who helped
by Linda Pagillo 29 Sep '05

29 Sep '05

Hi Guys: I finally got Freeradius upgraded to the most current version. Thanks to all who helped. Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

1 0

Postgresql+freeradius configuration
by msah＠otitelecom.bj 29 Sep '05

29 Sep '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance.

1 0

(no subject)
by msah＠otitelecom.bj 29 Sep '05

29 Sep '05

Good morning!!!!! I have successfully configured freeradius server with using postgresql database to storage users which i want to authenticate. when i put it in debug mode to test he works well. But when I run it as deamon the server radius don't see the postgresql server. In the radius's log file i look this: Driver rlm_sql_postgresql (module rlm_sql_postgresql) loaded and linked Info: rlm_sql (sql): Attempting to connect to radiusadmin@localhost:/radiusdb Error: rlm_sql_postgresql: Couldn't connect socket to PostgreSQL server radiusadmin@localhost:radiusdb Error: rlm_sql_postgresql: Postgresql error 'could not connect to server: Permission denied ?Is the server running on host "localhost" and accepting ?TCP/IP connections on port 5432? ' Error: rlm_sql (sql): Failed to connect DB handle #0 Info: Ready to process requests. I use fedora core4 as Operating System and freeradius 1.0.4-1, postgresql 8.0.3-1. In the postgresql's file pg_hba.conf i make this configuration: #TYPE DATABASE USER CIDR-ADDRESS METHOD #IPv4 local connections: host radiusdb radiusadmin 127.0.0.1/32 trust I don't why this dysfonctionnement Please help me and thanks for your assistance.

1 0

LDAP and groups
by Jean-Francois Gobin 29 Sep '05

29 Sep '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello there, I have a small problem. And I read the documentation. And I can't find what's wrong. I have a corporate LDAP with users and group. Each group is a "groupOfUniqueNames", with "uniquemember". In the user defintion, no group definition is set. I need to authenticate members of a certain groups, and not of another ... Every doc I read mention that you have to create an attribute "per user" ... Any other way ? Regards, Jean-Francois Gobin - ---------- Jean-Francois Gobin - Administrateur gobinjf.be http://www.gobinjf.be mailto:gobin@gobinjf.be -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (FreeBSD) Comment: Made with pgp4pine 1.76 iD8DBQFDO6+pkkg3QInH2uURAkoTAJ9CiiYoljx0B2zP/tInkSG4TwiwIgCbBWft g16kNx6wUzO1va189DJmHRA= =kTQn -----END PGP SIGNATURE-----

3 2

RE: Proxy of Accounting Requests
by Jonathan De Graeve 29 Sep '05

29 Sep '05

Can you also do this in SQL? J. -- Jonathan De Graeve Network/System Administrator Imelda vzw Informatica Dienst 015/50.52.98 jonathan.de.graeve(a)imelda.be --------- Always read the manual for the correct way to do things because the number of incorrect ways to do things is almost infinite --------- -----Oorspronkelijk bericht----- Van: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Namens Nicolas Baradakis Verzonden: donderdag 29 september 2005 13:55 Aan: FreeRadius users mailing list Onderwerp: Re: Proxy of Accounting Requests Ashwin Gobind wrote: > I want to proxy accounting requests originating from certain hosts to > another server, how can I do this. You could add something like this in file "acct_users": DEFAULT Client-IP-Address == 10.0.0.1, Proxy-To-Realm := realm1 DEFAULT Client-IP-Address == 10.0.0.2, Proxy-To-Realm := realm2 -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0