January 2006 - Freeradius-Users - lists.freeradius.org

rlm_eap.so
by Anton Gorlov 17 Jan '06

17 Jan '06

I'v compiled fresh verison FreeRADIUS (Version 1.1.0) from http://www.freeradius.org/ but i'v got error on program startup: Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no radiusd: symbol lookup error: /usr/lib/freeradius/rlm_eap.so: undefined symbol: eaptype_name2type [root@ring freeradius-1.1.0]# ldd /usr/lib/freeradius/rlm_eap.so libssl.so.4 => /lib/libssl.so.4 (0x00128000) libcrypto.so.4 => /lib/libcrypto.so.4 (0x00158000) libnsl.so.1 => /lib/libnsl.so.1 (0x00253000) libresolv.so.2 => /lib/libresolv.so.2 (0x00268000) libpthread.so.0 => /lib/libpthread.so.0 (0x0027b000) libc.so.6 => /lib/libc.so.6 (0x002ce000) libdl.so.2 => /lib/libdl.so.2 (0x003db000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x80000000) [root@ring rlm_eap]# uname -a Linux ring.local 2.4.26-std-up-alt13 #1 Mon Nov 14 00:25:14 MSK 2005 i686 unknown unknown GNU/Linux

2 4

libeap.so
by Anton Gorlov 17 Jan '06

17 Jan '06

Hm... **** Warning: Linking the executable radeapclient against the loadable module **** libeap.so is not portable! [root@ring root]# ls /usr/lib/freeradius/libeap.so /usr/lib/freeradius/libeap.so

1 0

Does freeradius as a proxy pass along everything?
by Gerdisch, Mitchell R (Mitchell) 16 Jan '06

16 Jan '06

Dumb question that I'm hoping is easy to answer. If I configure freeradius to proxy all requests, and the client (and ultimate RADIUS server) uses some vendor specific attributes, will freeradius as a proxy forward the requests and responses without dropping any of the VSAs? In other words, when freeradius is acting as a proxy, does it basically ignore the contents of the request and response? Or, does it need to be able to speak the vendor-specific language, so to speak, to be able to proxy the request/response? Thanks, Mitch Gerdisch

2 1

CIsco Pix and FreeRadius....
by Sills, Tripp 16 Jan '06

16 Jan '06

Good Morning All, I am having an issue with No Auth-Type when trying to connect to the radius server from the Pix. I can authenticate to the radius server by using "test aaa-server authentication" command. It says Auth-Type found Local but when I run with the VPN client it says unknown auth type. Please any help would be great! Tripp

2 1

FreeRadius, Pam authentication issue ...
by Le Gal Philippe 16 Jan '06

16 Jan '06

Hi ! I was asked to create a network based authentication system for the linux servers of my company. i have chosen radius and the FreeRadius server to authenticate Admins/ DBAs/Developers on the servers. I'm using FreeRadius server and pam_radius authentication on the servers I want to autheticate the users on. I have created a default account : login : test paswd : test on the radius server As advised I ran the FreeRasius server in the debug mode. The following shows the last lines once I have started the server : Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. I have configured my PAM module sshd in /etc/pam.d/ssh to be (on the machines I want to be authenticate): #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so I try so ssh to the box I want to be authenticated on : ssh test@machine_of_the_test The login name I used is : test passwd : test But when I see the incoming request, I can't see that the login name is "test" but is : User-Name = "NOUSER" What's wrong ? Thank you for your help Phil rad_recv: Access-Request packet from host 172.16.51.67:18299, id=22, length=91 User-Name = "NOUSER" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "sshd" NAS-Port = 17274 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.60.76" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "NOUSER", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 22 to 172.16.51.67:18299 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 22 with timestamp 43cbe46d Nothing to do. Sleeping until we see a request. Philippe LE GAL Email: <mailto:Philippe.LeGal@emea.eu.int> Philippe.LeGal(a)emea.eu.int ________________________________________________________________________ This e-mail has been scanned for all known viruses by EMEA. ________________________________________________________________________

1 0

FreeRADIUS 1.0.5 rlm_ldap crashing
by Paul Khavkine 16 Jan '06

16 Jan '06

Hi Guys. I'm doing a stress test on 1.0.5 running on FreeBSD 5.4-RELEASE and when start_tls is enabled radiusd crashed somwhere in the rlm_ldap module. I can't seem to make it produce a core file to properly inspect it. The server is running as root and core dumps are enabled in the config file. When i disable start_tls it does not crash. It always crased with signal 6 at random periods. Here's an error: rlm_ldap: attempting LDAP reconnection rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: (re)connect to ldap01.totftds.int.distributel.net:389, authentication 0 rlm_ldap: ldap_get_conn: Checking Id: 1 rlm_ldap: ldap_get_conn: Got Id: 1 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap01.totftds.int.distributel.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radiusd/current/etc/raddb/certs/cacert.pem rlm_ldap: setting TLS CACert File to /usr/local/radiusd/current/etc/raddb/certs/cacert.pem radiusd in free(): error: chunk is already free rlm_ldap: starting TLS Abort Any pointers on how to debug this problem ? Thanx Paul

4 15

Re: How do you setup MD5 using Freeradius and MySQL?
by Frank Reiss 16 Jan '06

16 Jan '06

Hi, Well I did not get the zip file but did find the solution. What I did not know was to add the information into the database. Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> select * from radcheck; +----+------------+----------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+------------+----------------+----+------------------------------------+ | 1 | fred | User-Password | == | wilma | | 2 | barney | User-Password | == | betty | | 3 | dialrouter | User-Password | == | dialup | | 4 | frankr | User-Password | == | missy | | 6 | flr | Crypt-Password | == | $1$M/Dyy6Ix$wEc4DMMhp4MK222lTn1X/0 | | 7 | flr3 | Crypt-Password | == | $1$NxQPW2DB$glf2EPj/iPS3H8SwId6mA. | | 5 | flr1 | Crypt-Password | == | $1$HoIOzDKM$.TZWU5kiU9.sjHGrbSkc.1 | | 8 | flr1 | Auth-Type | == | Crypt-Local | | 9 | flr | Auth-Type | == | Crypt-Local | | 10 | flr3 | Auth-Type | == | Crypt-Local | | 11 | flr2 | Crypt-Password | == | $1$bZTA.bno$RgogLTF9j9/H7jTsnAsLQ. | | 12 | flr2 | Auth-Type | == | Crypt-Local | | 13 | flr4 | Crypt-Password | == | $1$Q42F5AEu$Oq7g9z2s38PsQ4Qzjv14Z0 | | 14 | flr4 | Auth-Type | == | Crypt-Local | +----+------------+----------------+----+------------------------------------+ 14 rows in set (0.01 sec) Below is a test bash shell that works #!/bin/bash set -v IDV=$(mysql radius -e "select max(id)+1 from radcheck;" | grep -v max) USV=$(mysql radius -e "select UserName from usergroup where UserName = '$1';" | grep -c $1) HTS=$(grep master-host /etc/my.cnf | awk -F= '{ print $2 }') HPW=$(grep master-password /etc/my.cnf | awk -F= '{ print $2 }') HUS=$(grep master-user /etc/my.cnf | awk -F= '{ print $2 }') HCP=$(openssl passwd -1 $2) echo "$2 $HCP" if [ $USV -eq 0 ] then RSV=$(mysql radius -e "select UserName from radcheck where UserName = '$1';" | grep -c "$1") if [ $RSV -eq 0 ] then echo "Adding user $1 $2" echo "insert into usergroup (UserName, GroupName) values('$1', 'dynamic');" > /tmp/maddusr.tmp echo "insert into radcheck ( UserName, Attribute, op, Value) values('$1', 'Crypt-Password', '==', '$HCP');" >> /tmp/maddusr.tmp echo "insert into radcheck ( UserName, Attribute, op, Value) values('$1', 'Auth-Type', '==', 'Crypt-Local');" >> /tmp/maddusr.tmp echo "select * from usergroup;" >> /tmp/maddusr.tmp echo "select * from radcheck;" >> /tmp/maddusr.tmp cat /tmp/maddusr.tmp mysql radius < /tmp/maddusr.tmp > /tmp/maddusr.log radtest $1 $2 localhost 1 p1zzap1e | tee -a /tmp/maddusr.log # rm -f /tmp/maddusr.tmp fi fi [root@localhost ~]# Frank Reiss Impeva Labs, Inc. Phone: 1-850-872-7099 COMPANY CONFIDENTIAL NOTICE This electronic mail transmission and any accompanying documents contain information belonging to the sender which may be company confidential and legally privileged. If you are not the intended recipient, any disclosure, copying, distribution or action taken in reliance on the message is strictly prohibited. If you have received this message in error, please delete it. Thank You ----- Original Message ----- From: "Marco Spiga" <ctxspi(a)gmail.com> To: "Frank Reiss" <f.reiss(a)impeva.com> Cc: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Saturday, January 14, 2006 6:55 AM Subject: Re: How do you setup MD5 using Freeradius and MySQL? > On Fri, Jan 13, 2006 at 06:18:41PM -0600, Frank Reiss wrote: >> From: "Frank Reiss" <f.reiss(a)impeva.com> >> To: <freeradius-users(a)lists.freeradius.org> >> Date: Fri, 13 Jan 2006 18:18:41 -0600 >> X-Mailer: Microsoft Outlook Express 6.00.2900.2180 >> Subject: How do you setup MD5 using Freeradius and MySQL? >> >> HI, >> >> Well I tested the MD5 authentication using the user file and that worked >> but I still can not figure out how to do it against the mysql database. >> Is there anyone out there that knows hot to set this up I would >> appreciate some HELP!! >> >> Frank Reiss >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > ---fine del testo--- > > If you want I send you a file tar.gz that work fine with Postgresql and > eap-md5!!! > I think there are few differences!!! > Sorry for my bad english!!! > -- > !!!!! Messaggio da Marco !!!!! > >

1 0

D-Link Airplus Supplicant MSCHAP2 error
by Ben Thompson 16 Jan '06

16 Jan '06

Hi We run a WPA/TKIP/PEAP wireless network with FreeRADIUS 1.0.1 on Redhat. Most client machines tend to be Windows XP and we they are usually set up to use the Microsoft built in supplicant. Occasionally someone comes along with a Windows 2000 box and we have to set them up using whatever software came with the network card as there is no wireless configuration tool included in the OS. Usernames are specified using the format username@realm and we normally reject anything without a realm using the following entry in the users file :- DEFAULT Realm == "NULL", Auth-Type := Reject we also have :- DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = "%{User-Name}", Fall-Through = Yes and in eap.conf :- peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes } The other day someone came along with a Win2K box with D-Link wireless card and we attempted to set it up to access the network. We could not get it to work and noticed the following output from FreeRADIUS :- modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for emm502(a)york.ac.uk with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 Tunnel-Type:1 := VLAN Tunnel-Medium-Type:1 := IEEE-802 Tunnel-Private-Group-Id:1 := "4025" User-Name = "emm502(a)york.ac.uk" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xc15ca10 3 Tunnel-Type:1 := VLAN Tunnel-Medium-Type:1 := IEEE-802 Tunnel-Private-Group-Id:1 := "4025" User-Name = "emm502(a)york.ac.uk" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 168 to 144.32.226.208:1645 Tunnel-Type:1 := VLAN Tunnel-Medium-Type:1 := IEEE-802 Tunnel-Private-Group-Id:1 := "3970" EAP-Message = 0x0108004819001703010018e031d8fca1c0cbfedb0cfcdce46b9a4c46758441f22e0ba417030100203027372cc858586642a97e40254bb292c08bd9e461560f21dd2c8e77b66450ee Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73386b81b01f285fe325fdeb408f2f43 Finished request 6 Just for testing we removed the NULL realm reject from the users file and tested the client with username entered on its own and found that this worked OK. Does this point to a problem with the D-link supppicant or could it be a problem with our setup? The MSCHAP2 response is incorrect when I specify the realm. Does this mean the supplicant is incorrectly handling the username and stripped username? Thanks Ben Thompson University of York

1 0

EAP-TLS and MySQL
by Frank Buttner 15 Jan '06

15 Jan '06

Hello, is it possible to store the certs in an MySQL DB and not in files? Thanks Frank

2 1

bandwidth restrction with radius and PPTP
by Markus Wiedner 15 Jan '06

15 Jan '06

Dear all, I have sorted out to configure freeradius/mysql on poptop server. Now i want to restrict bandwidth per user. What procedure should I follow. I know how to restrict bandwidth with tc iproute2 package. But don't know how to integrate tc with freeradius/mysql on poptop server. has any one over here did these things? any ideas/clues/rough manual... I have found an older Link about tat in the List, because the Link is dead, please could someone help my? Best regards and sorry for my English

2 1