January 2006 - Freeradius-Users - lists.freeradius.org

Problem translating users file to Postgre DB
by Andrew Teixeira 19 Jan '06

19 Jan '06

Hello, I tried to port my users file to PostgreSQL today, but I am having a great deal of confusing trouble trying to get it to work. I am using the postgresql.conf file that came with Freeradius 1.1.0 and am having no trouble getting Freeradius to connect to Postgre. My problem comes when trying to authenticate to my firewall. First, I will explain the working "files-only" configuration: ::::::::::::::::: huntgroups ::::::::::::::::: switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 127.0.0.1 firewall NAS-IP-Address == 10.20.10.x firewall NAS-IP-Address == 10.20.10.x ::::::::: users ::::::::: DEFAULT Auth-Type = System Fall-Through = 1 admin Auth-Type := Kerberos, Huntgroup-Name == "switches" Service-Type == "Administrative-User" admin Auth-Type := Kerberos, Huntgroup-Name == "firewall" NS-Admin-Privilege = "All-VSYS-Root-Admin" When I do this with files only, it works great. I then tried to get the database setup to work. I left the huntgroups file alone and commented out the 2 'admin' entries in users. Now, this is my setup in the database that is not working: :::::::::::::::::::::: radgroupcheck :::::::::::::::::::::: id | groupname | attribute | op | value ----+-------------+----------------+----+------------- 1 | switches | Huntgroup-Name | == | switches 2 | firewall | Huntgroup-Name | == | firewall 5 | firewall | Auth-Type | := | Kerberos 6 | switches | Auth-Type | := | Kerberos ::::::::::::::::::::: radgroupreply ::::::::::::::::::::: id | groupname | attribute | op | value ----+-------------+--------------------+----+--------------------- 2 | firewall | NS-Admin-Privilege | = | All-VSYS-Root-Admin 1 | switches | Service-Type | = | Administrative-User ::::::::::::::: usergroup ::::::::::::::: id | username | groupname ----+----------+------------- 1 | admin | switches 2 | admin | firewall In this setup, I can authenticate with 'admin' using my Kerberos password for the 'switches' huntgroup, but I cannot authenticate to 'firewall'. Also, when I do radtest for an IP in the switches huntgroup, I get a reply of both 'Service-Type' and 'NS-Admin-Privilege', when I assumed that this would give me one or the other since they are in different groups. When running radiusd with the '-X' flag and trying to authenticate to firewall, I get the error: rlm_sql (sql): No matching entry in the database for request from user [admin] This shouldn't be the case since the user 'admin' is part of both groups. I am at a loss at this point what could be the problem. If anyone has any insight, I would greatly appreciate it. Thanks in advance.

1 0

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 19 Jan '06

19 Jan '06

Done that fixed the issue....Now I want to use ldap with freeradius is that possible? Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, January 18, 2006 11:22 AM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > I am not altering the users file all I have in it is : > > I was using the same username and password for both. Below is my users > file. Perhaps I was unclear. *YOU* should read the users file and compare it's entries to what's in the debug log. If you don't understand what you configured or how it works, then you're never going to solve the problem. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Ippool and NAS
by Johansson, Daniel 19 Jan '06

19 Jan '06

Hi Freeradius users. I have compiled and installed the 1.1.0 version of Freeradius and made the basic configurations and everything works fine. Now I have 5 NAS boxes that is accessing the radius server the problem is that I want each NAS to use a set if ipadresses. So for NAS(1) the radius should return ippool(1) and so on. I have looked at the FAQ and have been searching in the mail archive for several hours and have only seen people asking about allocating ipadresses for specific user(s) or group(s) but not for a NAS. Could anyone please help me to get me started on this. Best Regards /Daniel Johansson Below is my NAS boxes in clients.conf # Client for RTP-RFTN, GGSN 1 client 192.168.9.1 { secret = xxx shortname = RTP-RFTN } # Client for S99, GGSN 249 client 192.168.15.249 { secret = xxx shortname = S99 GGSN 249 } # Client for S98, GGSN 254 client 192.168.13.254 { secret = xxx shortname = S98 GGSN 254 } # Client for GLANA, GGSN 250 client 192.168.11.250 { secret = xxx shortname = GLANA GGSN 250 } # Client for Telia GLANA, GGSN 249 client 192.168.11.249 { secret = xxx shortname = GLANA GGSN 249 }

3 2

mschap and users file
by André Lemos 19 Jan '06

19 Jan '06

Right now I'm only using mschap and the users file to authenticate a user, but I'm getting: modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for wifi with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect although on my users file I have: "wifi" Crypt-Password == "BcFvDSx8ydTSk" "wifi" lmPassword == "02D093CE93078E8FAAD3B435B51404EE" "wifi" ntPassword == "CAF13C4F321B608B27FD75D2549BA53C" can't I have my users file only with encrypted passwords? thanks -- **_____________________** * *André Ventura Lemos** **Software Engineer** **Critical Software, SA** **MSN:** **tux(a)tuxslare.org** **GSM:** **+351916401042** **TLF:** **+351239989100** DISCLAIMER: This message may contain confidential information or privileged material and is intended only for the individual(s) named. If you are not a named addressee and mistakenly received this message you should not copy or otherwise disseminate it: please delete this e-mail from your system and notify the sender immediately. E-mail transmissions are not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete or contain viruses. Therefore, the sender does not accept liability for any errors or omissions in the contents of this message that arise as a result of e-mail transmissions. Please request a hard copy version if verification is required. Critical Software.

3 2

Windows PPTP and Cisco VPN Concentrator
by ALMEIDA Antonio Jose 19 Jan '06

19 Jan '06

Hello, I'm trying to implement one pptp vpn between one windows xp and one vpn concentrator. I've no problems with the Cisco vpn client but I get this error when I try the windows software: In the software: The PPP link control protocol was terminated. In the vpn concentrator: User [xxxx] disconnected. Cannot resolve an IP address for remote peer. In debug mode, freeradius gives this output:; auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: Told to do MS-CHAPv2 for toze3 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 38 to AA.BB.CC.DD:1033 MS-CHAP2-Success = 0x02533d3346343545313438444234344339303636463630454141394444413134444436 4630463137343639 MS-MPPE-Recv-Key = 0x7bece896d285fa327b97e150aa13cc9d MS-MPPE-Send-Key = 0x91606621ce8a086e8a961d21bf250787 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 0 Can someone help me with this? I've search google for some time now and I still can't solve this. Regards, Antonio

1 0

Question about dialup-admin
by Miguel Angel Quiles 19 Jan '06

19 Jan '06

I've downloaded dialup-admin. I've changed few values from the admin.conf file, such as mysql username and password, and path to the different directories. I also created the "badusers" table in the "radius" in the mysql. I opened a web browser and I can see the accounting is working ok, but I can´t see any bad users. I've already enabled the log auth in the radiusd.conf (log_auth = yes), so now I´ve got some entries in the /var/log/radius/radius.log. I've been reading the README file, and it says that the bin/log_badlogins it will constantly check the radiusd.log file. But it seems that this doesn't happen. I hope someone knows how I can resolve this problem, or another solution so I can get the badusers. Thanks.

1 0

Re: Authorization
by Stefan Adams 19 Jan '06

19 Jan '06

Dusty, Thanks for your fine input and the reminder on the index (I completely forgot about that). I'll give the ldap module filter a go with the attr_rewrite. I like keeping attributes with the user object, rather than spreading usernames around to various other objects. With this implementation, to me, the extra benefit is that I can just add a radiusGroupName attribute = X to each user object. BTW, on the attr_rewrite, can I use more advanced regex than just ................: ? It works and always will work, but it would be more clear in the config file if I could say "([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2}):" or something to that effect... I couldn't get ANY regex to work except the . Does that seem right? Stefan > Message: 4 > Date: Mon, 19 Dec 2005 14:52:10 -0500 (EST) > From: Dusty Doris <freeradius(a)mail.doris.cc> > Subject: Re: Freeradius-Users Digest, Vol 8, Issue 82 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20051219143705.I21565(a)mail.doris.name> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Mon, 19 Dec 2005, Stefan Adams wrote: > > > Hey, guys! Thanks for the great replies!! I like what you suggested > > better than what I've come up with in the mean time. I think what I > > came up with will work, it just seems messy/wrong/inefficient. What > > do you think? > > > > modules { > > ldap { > > : > > filter = > > > >"(&(uid=%{Stripped-User-Name:-%{User-Name}}) > >(radiusGroupName=%{Called-Station-ID}))" > > : > > } > > attr_rewrite getssid { > > attribute = Called-Station-Id > > searchin = packet > > searchfor = ".................:" > > replacewith = "" > > ignore_case = yes > > new_attribute = no > > } > > } > > > > authorize { > > # for WinXP, 802.1x, EAP-PEAP, MS-CHAPv2 > > preprocess > > eap > > getssid > > ldap > > } > > > > This cuts off the first 17 bytes and then a colon of the > > Called-Station-ID (My AP transmits a dash separated MAC followed by a > > colon and then the SSID). Then it uses this rewritten > > Called-Station-ID and uses that as a filter in the LDAP search. > > Therefore, if the SSID a user tries to connect to is not listed as an > > attribute of the user's LDAP object, the user is denied. > > > > Does that make sense? > > That's a pretty neat idea. The benefit of that is if you had multiple > ldap instances and wanted to implement fail-over within freeradius. To do > it the traditional way, you would need this for fail-over with ldap-group > checks if say you had two ldap instances. > > DEFAULT Called-Station-Id =~ /studentregex/, ldap1-Ldap-Group == > "students" > > DEFAULT Called-Station-Id =~ /studentregex/, ldap2-Ldap-Group == > "students" > > That is so it will check with ldap1 instance first. If that fails, then > check ldap2. > > By doing it your way, you won't need to do that anymore. Instead a > redundant block in authorize would get you what you need already since the > radiusGroupname inside your search filter takes care of the Ldap-Group > check. > > I wonder if you could use regex matches of Called-Station-ID in the > huntgroups file. You'll have to test this out, I doubt it would work, but > its another interesting idea. I don't know if huntgroups excepts regex > and if it can use things like Called-Station-Id > > in huntgroups > > students Called-Station-Id =~ /studentregex/ > faculty Called-Station-Id =~ /facultyregex/ > > Then in users file. > > DEFAULT Ldap-Group == %{Huntgroup-Name} > > Or you're way. > > (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=%{Huntgroup-Name}))" > > See doc/configurable_failover and doc/rlm_ldap to see what I'm talking > about with the failover. If you have a load balancer in front of that > ldap server, you won't need to worry about it. But if you don't and you > want to add redundancy, then its something you'll need to think about some > day. Freeradius can do the redundancy for you w/out a load balancer or > shared IP using configurable failover. Actually in the upcoming 1.1 > release it will also do load balancing for you in addition to failover > inside your ldap blocks. > > Hope I'm not too confusing. My point is I like your idea and if its > working for you, it doesn't sound like a bad one to me. You might want to > try hitting it hard to see if the rewrite slows anything down, but I would > bet it doesn't. > > I'd also make sure to add an eq index to radiusgroupname, since you'll be > using that as part of your search filter.

8 8

Re: Ippool and NAS
by Kai Geek 19 Jan '06

19 Jan '06

Hello, where you radius server and users config file ? > ----- Original Message ----- > From: "Johansson, Daniel" <Daniel.Johansson2(a)sonyericsson.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Ippool and NAS > Date: Thu, 19 Jan 2006 15:18:59 +0100 > > > Hi Freeradius users. > > I have compiled and installed the 1.1.0 version of Freeradius and made > the basic configurations and everything works fine. > > Now I have 5 NAS boxes that is accessing the radius server the problem > is that I want each NAS to use a set if ipadresses. > > So for NAS(1) the radius should return ippool(1) and so on. > > I have looked at the FAQ and have been searching in the mail archive for > several hours and have only seen people asking about allocating > ipadresses for specific user(s) or group(s) but not for a NAS. > > > Could anyone please help me to get me started on this. > > Best Regards > /Daniel Johansson > > > Below is my NAS boxes in clients.conf > > # Client for RTP-RFTN, GGSN 1 > > client 192.168.9.1 { > secret = xxx > shortname = RTP-RFTN > > } > > # Client for S99, GGSN 249 > > client 192.168.15.249 { > secret = xxx > shortname = S99 GGSN 249 > } > > # Client for S98, GGSN 254 > > client 192.168.13.254 { > secret = xxx > shortname = S98 GGSN 254 > } > > # Client for GLANA, GGSN 250 > > client 192.168.11.250 { > secret = xxx > shortname = GLANA GGSN 250 > } > > # Client for Telia GLANA, GGSN 249 > > client 192.168.11.249 { > secret = xxx > shortname = GLANA GGSN 249 > } > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

How to compile freeradius with sqlcounter module on debian/ubuntu
by Gabriele Vidali 19 Jan '06

19 Jan '06

hi, I'm trying to compile freeradius with sqlcounter module on my ubuntu dapper with no success. Actually I can compile it but at the end I have no rlm_sqlcounter-x.x.so in my /usr/lib/freeradius directory. This is how I proceeded: * apt-get source freeradius * apt-get build-dep freeradius * I added --with-experimental-modules in debian/rules file * dpkg-buildpackage -rfakeroot -uc -us Is this way correct? freeradius version in dapper is 1.0.5-2 many thanks Gabriele

3 2

Blank Username in radacct
by Maykel Moya 18 Jan '06

18 Jan '06

Accidentally, I found today tons of tuples in raddact with blank Username. Is that normal? Regards, maykel

2 1