January 2006 - Freeradius-Users - lists.freeradius.org

dictionary.3gpp2 note
by Alexander Serkin 18 Jan '06

18 Jan '06

hi, According to http://www.3gpp2.org/Public_html/specs/P.S0001-B_v2.0_041004.pdf (page 65) the attribute 41 (3GPP2-R-P-Session-Id) in dictionary.3gpp2 should be integer, not string. And i'd remove the comment '#' on it in the file. Thanks, -- als

1 0

Error: Assertion failed in request_list.c, line 1119
by masetio 17 Jan '06

17 Jan '06

i'm using freeradius-snapshot-20060115 i have error --> Tue Jan 17 19:56:34 2006 : Error: rlm_sql: Failed to create the pair: Unknown at tribute "1" Tue Jan 17 19:56:34 2006 : Error: rlm_sql (sql): Error getting data from databas e Tue Jan 17 19:56:34 2006 : Error: rlm_sql (sql): SQL query error; rejecting user Tue Jan 17 20:00:16 2006 : Info: Ready to process requests. Tue Jan 17 20:00:55 2006 : Error: Assertion failed in request_list.c, line 1119 i dont understan with code request_list.c ??? plz... How to debug this problem ? -- ~_|[]~

1 1

eap authentication and proxy radius
by Matteo Paoli 17 Jan '06

17 Jan '06

It's possible configure Freeradius to request two eap authentication? For example, the supplicant starts the eap-tls and the authentication is ok. But the server radius don't send Access Accept but it requests a new authentication (for example eap-md5). If also eap-md5 is ok, the supplicant is authenticated. authentication supplicant = (authentication eap-tls) && (authentication eap-md5) If the first answer is Yes. It's possible that the first authentication is forwarded to remote radius server and the second one is resolved locally? authentication supplicant = (authentication eap-tls on remote radius server) && (authentication eap-md5 on proxy radius server) Many thanks, Matteo Paoli -- Matteo Paoli

2 1

freeradius-1.1.0 + oracle + fedora
by Fred Casavant 17 Jan '06

17 Jan '06

I'm running Fedora (FC4) with the Oracle Instantclient 10g rpms (basic,devel,sqlplus,jdbc) and I'm trying to compile freeradius 1.1.0 with oracle support but the oracle module doesn't compile at all. It seem like the rlm_sql_oracle configure and makefile are buggy as hell or they only support an Oracle8 installation. It look like the with-oracle-home-dir and with-oracle-include-dir and with-oracle-lib-dir configure switches are useless because even when I set them up properly it doesn't seem to be using them and it doesn't compile. At first it was complaining about some missing oci.h even if it's there. So after reading the config.log I created some soft link so that it's finding it but then it was complaining about some other missing stuff so I did some other soft links. So now I'm at something like four soft link all around my system and it still doesn't compile :) I tried to edit the configure.in and the makefile files (I'm a newbie when it come to makefile and configure and autoconf stuff) and it still doesn't work. So I don't know what to do next. I'm very close to scrap the whole oracle plan and switch to mysql or to flat raddb file. Is there anyone that successfully compile the rlm_sql_oracle module in FC4 (or any fedora for that matter)?

1 0

FreeRADIUS with PEAP(MSCHAPv2), MySQL and LDAP?
by Palmer J.D.F. 17 Jan '06

17 Jan '06

Hi, I am currently trying to create a new auth system for our WPA 802.1x WiFi network. Thus far I have the server authenticating using PEAP(MSCHAPv2) against a users file containing a simple test user/pass pair. What I would now like to do is use MySQL to contain user data such as the VLAN to be assigned to that user and which LDAP server their account exists on, then use LDAP to verify the credentials. The idea being that a PEAP request comes in, tunnel gets built etc, the user gets looked up in the MySQL database, the credentials are then authenticated against the correct LDAP (or RADIUS) server, then on success an access-accept along with the user's VLAN is passed back to the NAS. The question is, is it possible for PEAP(MSCHAPv2) and LDAP with MySQL to interact in this way? Many thanks, Jezz Palmer.

2 1

unsubscribe
by Cian Phillips 17 Jan '06

17 Jan '06

unsubscribe

1 0

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 17 Jan '06

17 Jan '06

Notice the first request that comes from the 10.2.0.69...It is using the test aaa-server from the PIX itself. The other 2 are when I am connecting to the VPN client and trying to authenicate. It says Auth Type unknown. Any ideas Alan? Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: ../etc/raddb/proxy.conf Config: including file: ../etc/raddb/clients.conf Config: including file: ../etc/raddb/snmp.conf Config: including file: ../etc/raddb/eap.conf Config: including file: ../etc/raddb/sql.conf main: prefix = ".." main: localstatedir = "../var" main: logdir = "../var/log/radius" main: libdir = "../lib" main: radacctdir = "../var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "../var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "../var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "../bin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is ../lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "../var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.pem" tls: certificate_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Server.crt" tls: CA_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/FreeRADIUS.net-Root.crt" tls: private_key_password = "demo" tls: dh_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/dh" tls: random_file = "../etc/raddb/certs/FreeRADIUS.net/DemoCerts/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "../etc/raddb/huntgroups" preprocess: hints = "../etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "../etc/raddb/users" files: acctusersfile = "../etc/raddb/acct_users" files: preproxy_usersfile = "../etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "../var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "../var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=85, length=93 User-Name = "tripp" User-Password = "tripp" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=000.000.000.000" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry tripp at line 224 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [tripp/tripp] (from client BorderPatrol port 0) Sending Access-Accept of id 85 to 10.2.0.69:1025 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 85 with timestamp 43cd26ed Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=86, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 739 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 739 cli 24.73.134.236) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 86 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 86 with timestamp 43cd273a Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.2.0.69:1025, id=87, length=154 User-Name = "tripp" User-Password = "tripp" NAS-Port = 739 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "68.208.135.26" Calling-Station-Id = "24.73.134.236" Tunnel-Client-Endpoint:0 = "24.73.134.236" NAS-IP-Address = 10.2.0.69 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=24.73.134.236" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 modcall[authorize]: module "chap" returns noop for request 2 modcall[authorize]: module "mschap" returns noop for request 2 rlm_realm: No '@' in User-Name = "tripp", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 179 users: Matched entry DEFAULT at line 191 modcall[authorize]: module "files" returns ok for request 2 modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [tripp/tripp] (from client BorderPatrol port 739 cli 24.73.134.236) Delaying request 2 for 1 seconds Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 87 to 10.2.0.69:1025 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 87 with timestamp 43cd2740 Nothing to do. Sleeping until we see a request. Terminate batch job (Y/N)? -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, January 16, 2006 10:33 PM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > It says Auth-Type found Local but when I run with the VPN client it > says unknown auth type. Please any help would be great! Help us help you. Read the README, INSTALL, and FAQ. Then follow the instructions there for debugging the server. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

FreeRADIUS and OpenLDAP
by Michael Schwartzkopff 17 Jan '06

17 Jan '06

Hi, If I use OpenLDAP to authorize / authenticate my users, what kinds of passwords can I store in LDAP? clear, crypt, SSHA, SMD5, MD5, SHA, NTHASH, LMHASH? Is this controlled by the password_header configuation or does this only strip the header of the password? Is there any difference if use the EAP module? Thanks. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

3 2

Problem in sending PAP Authentication with radclient
by Hamzeh Motahari 17 Jan '06

17 Jan '06

Hello We have set PAP scheme to MD5 in "radius.conf". Now we can't authenticate users using "radclient". When configuration changes from 'MD5' to 'Clear text', every thing is good. What should we do if we want send password using MD5 method? If "radclient" doesn't support this, can you suggest an open source radius client which can do this? Thanks. --------------------------------- Yahoo! Photos Got holiday prints? See all the ways to get quality prints in your hands ASAP.

2 1

Re: Debian + Exec-Program = Zombie process
by Rashad Rustamoff 17 Jan '06

17 Jan '06

> as soon as I send accounting stop packet to radius, test.pl executes and > becomes a zombie. (I tried bash script, c program with the same result.) > > 3890 ? Ss 0:00 /usr/local/freeradius/sbin/radiusd > 3893 ? Z 0:00 \_ [test.pl] <defunct> > > As far as I know, this should have been fixed in 1.0.3 and I doubt it's > debian specific, as I know 0.93 works on another RH 7.3 without a > problem (In fact zombie is listed there as well but disappears after > several seconds). > > Any ideas/suggestions? Did you try version 1.0.1 indeed? I had this problem several monthes ago with versions 1.0.4 and 1.0.5, but in case of 1.0.1 it works. As I know version 1.0.1 hasn't this problem. My server configuration is similar with yours: Debian 3.1 (Sarge) -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.18/230 - Release Date: 2006-01-14

2 1