September 2005 - Freeradius-Users - lists.freeradius.org

Help .Radius -X works but regular start won't
by Cris Boisvert 27 Sep '05

27 Sep '05

I have Freeradius connecting to and LDAP Server.. If I run radiusd -X I can authenticate ok.. IF I start radius normally it gives me an error stating that it cannot bind to the ldap server. How can it work one way and not the other? I thought radiusd -X was just debugin? Help... After 2 days of this I'm getting kinda Crazed.. Thanx Cris

1 1

automated response
by Olaf Becker 27 Sep '05

27 Sep '05

HI, i am on vacation till 11. th of october 2005. This Email will not be forwarded automaticly in anzurgent cases please email to PCSupport(a)trustinternational.com. regarding Olaf Becker

1 0

ARUBA NAS simultaneous-Use Problem ... Enterasys and colubris work very well
by alfonso celestino 27 Sep '05

27 Sep '05

Hi, Everybody Please I need your help!! Why, When I work with enterasys or colubris NAS the simultaneous-Use work perfectly, but with ARUBA NAS not work. I need add or configure another things?, or the problem is from Aruba Manufacturer?, I need some Specific characteristics (Which) from Aruba Manufacturer?. Please someone help me!! Thank in advance Alfonso Celestino DGSCA, UNAM ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Cisco Privilege Level
by Ryan Sharpe 27 Sep '05

27 Sep '05

Hello all, I'm having a problem getting users to default to the right privilege level. aaa authentication login default group radius local aaa authorization exec default group radius local radius-server host xx.20.xx.xx auth-port 1645 acct-port 1646 radius-server key 7 xxxxxxxxxxxx privilege exec level 2 enable DEFAULT Group == "radiusfull", Auth-Type = System CiscoAVPair = "shell:priv-lvl=2", Fall-Through = No DEFAULT Group == "radiusview", Auth-Type = System CiscoAVPair = "shell:priv-lvl=1", Fall-Through = No rad_recv: Access-Request packet from host xx.xx.xx.xx:1645, id=30, length=93 User-Name = "rsharpe" User-Password = "*****" Cisco-NAS-Port = "tty226" NAS-Port = 226 NAS-Port-Type = Virtual Calling-Station-Id = "xx.xx.xx.xx" NAS-IP-Address = xx.xx.xx.xx Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "rsharpe", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 users: Matched entry DEFAULT at line 54 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns ok for request 2 modcall: group authenticate returns ok for request 2 Sending Access-Accept of id 30 to xx.xx.xx.xx:1645 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 30 with timestamp 43304ea1 Nothing to do. Sleeping until we see a request. What I am trying to accomplish is to have to two different unix groups authorized to two different levels. As I'm sure you can see from the configuration I want to have "radiusfull" have access to exec level 2 and "radiusview" have access to exec level 1. I know that the service is working I can login with my unix account to the router. I have seen numerous examples about how to do this, and from what I understand it should work. I also did a packet capture of the communication between the two devices and I did no see any of the AVPairs in the packet data. If someone could help and enlighten me that would be great. THANKS! -- Ryan Sharpe Junior Technical Analyst LARG*net (519) 661-2111 x86356 rsharpe(a)largnet.on.ca http://www.largnet.on.ca

2 1

users file for ser
by Santiago L. Aggio 27 Sep '05

27 Sep '05

Hi, I am using ser-0.9.3 and freeradius-1.0.5. Is possible to use a DEFAULT tag with Auth-Type Digest? I don't want to define in the users file all my users. I would use something similar to Auth-Type PAM or LDAP? Thank you in advance Santiago. ----------------------------------------------------------------- | Santiago L. Aggio | TE: 54-291-4861666 | | SECECOM - CRIBABB | FAX: 54-291-4861527 | | Camino la Carrindanga km 7 | | | 8000 - Bahia Blanca | E-MAIL: slaggio(a)criba.edu.ar | | Buenos Aires - Argentina | HTTP: www.criba.edu.ar | -----------------------------------------------------------------

2 1

Problem with PEAP and MS-CHAPv2 and AD
by Graham, Robert 27 Sep '05

27 Sep '05

I am having a strange problem, and was hoping for some expertise in this matter and I need to get this working very quickly since I am running out of time. I have freeradius configured to authenticate our users for a wired 802.1x environment. Authentication works succesfully if the supplicant (odyssey client) sends only the username and not domain\username. The problem is when I install the odyssey gina module to configure the supplicant to authenticate prior to windows login it passes the credentials as domain\username, whichs fails authentication. I did some searches and made the following changes: proxy.conf added: realm domain { type = radius authhost = LOCAL accthost = LOCAL } and uncommented the ntdomain section in radiusd.conf This did not work, so I tried another suggestion and changed the ntlm_auth string from: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=MEM --username=%{User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" to: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Now when I login I get the following error: This also occurs at the desktop level rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=RGraham --domain=MEM --challenge=71c3373eb458a75e --nt-response=c410b4f18e8527df26495cad16d20a09679b03969efa3d3e Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xf8716a50 3 MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE If I change the ntlm_auth back to the original string and authenticate at the desktop (not gina) it authenticates. So my question is: What do I need to do to configure Freeradius to strip the domain portion where EAP-PEAP is successful at both gina (login) and desktop? Any help would be greatly appreciated. Thanks Robert Graham

1 0

LDAP Freeradius
by Cris Boisvert 27 Sep '05

27 Sep '05

I can authenticate off correctly when I run radiuss -X But when I start radius normally it can't connect to the ldap server? Running Freeradius on fedora core 4 Ideas? Why would it working in debug but not normally? Here's the log info --------------------------------Radius log----------------------------------- Mon Sep 26 15:55:27 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Sep 26 15:55:27 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Sep 26 15:55:27 2005 : Info: Ready to process requests. Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: bind to 192.168.77.6:389 failed: Can't contact LDAP server Mon Sep 26 15:55:30 2005 : Error: rlm_ldap: (re)connection attempt failed ------------------radius x output ----------------------------------------- modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "wow(a)pork.com" with password "test1234" radius_xlat: '(mail=wow(a)pork.com)' radius_xlat: 'o=pork.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.77.6:389, authentication 0 rlm_ldap: bind as / to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=pork.com, with filter (mail=wow(a)pork.com) rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: user DN: uid=wow,ou=People,o=pork.com rlm_ldap: (re)connect to 192.168.77.6:389, authentication 1 rlm_ldap: bind as uid=wow,ou=People,o=pork.com/test1234 to 192.168.77.6:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user wow(a)pork.com authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 26 to 192.168.77.6:3665 Finished request 0

1 0

Problem with radzap
by Andoni Ayala - KNET 27 Sep '05

27 Sep '05

hello!. I have experienced with freeradius, but i updated to 1.0.1 on Fedora Core 3 and when i use radzap i get this error: Error: There appears to be another RADIUS server running on the authentication port 1812 i launch this command: radzap '' 34 user456 even, replacing '' with NAS ip. can anyone help me? (i'm searching on google and freeradius-list archive but nothing help me) Thanks --

2 2

rml_perl
by Abdul Lateef 27 Sep '05

27 Sep '05

Hi all, I linked rml_perl module successfully to call only in authenticate event to return h323-credit-amount based on example.pl. and others event i want to do them from sql.conf. Here is the configuration what i did. ==========users file========= DEFAULT Auth-Type := Perl ===========radiusd file======== In module section perl { module = /usr/local/etc/example.pl func_accounting = accounting func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_checksimul = checksimul func_xlat = xlat } authenticate { Auth-Type Perl { perl } } But it is not working, and i cannot see any log in radius.log file while the logs writing is enabled. Anyone can help me is these configurations are correct? Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

2 1

separate accounting to two modules based on NAS-IP-Address
by Ilia Chipitsine 27 Sep '05

27 Sep '05

Dear Sirs, how can I organize radiusd.conf in order to put accounting coming from nas1 to one module and from nas2 to another module ? Cheers, Ilia Chipitsine

2 1