January 2006 - Freeradius-Users - lists.freeradius.org

another mysql database
by debik 26 Jan '06

26 Jan '06

Is it possible to configure radius to connect to the two databases. If in one database user do not exist, so connect to another database and search for entry for that user. Sorry for my english if make some mistakes.

2 2

VSA Problem
by Romao Izumi Ito 26 Jan '06

26 Jan '06

Hello, I'm working with Nortel Network Passport and I'm trying to configure a new dictionary on the freeradius. In the vendors doc we have following VSA and Vendor-ID: VENDOR nortel 562 ATTRIBUTE Passport-Command-Scope 200 integer nortel ATTRIBUTE Passport-Command-Impact 201 integer nortel ATTRIBUTE Passport-Customer-Identifier 202 integer nortel ATTRIBUTE Passport-Allowed-Access 203 integer nortel ATTRIBUTE Passport-AllowedOut-Access 204 integer nortel ATTRIBUTE Passport-Login-Directory 205 string nortel ATTRIBUTE Passport-Timeout-Protocol 206 integer nortel ATTRIBUTE Passport-Role 207 string nortel ... I configure the file dictionary.nortel in /etc/raddb and include it in dictionary file. Also I tried it in /usr/share/freeradius/. I added this attributes in the users file but when I look at the radius packet I see: Vendor Specific(26), Vendor: Undefined(562) Unknown Type(200), Value: Unknown Value type What am I doing wrong? Thank you, Romao.

2 1

radkill and a small question about radwho
by Torkel Mathisen 26 Jan '06

26 Jan '06

Hi, I read about the radkill program in the FAQ. However the link doesn't work so I was wondering if anyone had a new link to that program? I'd like to kill users that are logged in twice or something. Like in the output below. If it works on 1.0.5 at all. Also I got a simple question about radwho. It doesnt seem to output the last part of the AP ip-address: # radwho Login Name What TTY When From Location tom shell S470 Thu 08:49 192.168.2 tom shell S480 Thu 10:35 192.168.2 I can always use -r so its not a big problem. Just wondered if its normal. Regards, Torkel

2 1

SNMP apparently not working with FreeRadius 1.0.1 and above on Centos 4.2
by klkbranch＠hotmail.com 26 Jan '06

26 Jan '06

Hi, I am new to this list, though I've been using FreeRadius 0.9.3 for a few years now. My present goal is to get a newer version of FreeRadius (running on Centos 4.2) to work with snmp. Though I have carefully followed the snmp setup instructions as documented in radiusd.conf and snmp.conf, I have yet to get radiusd to attempt SMUX initialization (from output of radiusd -X). Net-snmp is already working (stock Centos rpm net-snmp-5.1.2-11.EL4.6). I have tried the stock Centos freeradius rpm (freeradius-1.0.1-3.RHEL4.i386.rpm). I have also tried tarball installs of freeradius 1.0.1, 1.0.2, 1.0.5, and 1.1.0, with the "--with-snmp" option, with no success. Nothing results in any SMUX-related output from radiusd -X. After reading this thread, http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-April/04286… it appeared I needed some kind of patch. Near the end of that thread, Kevin Bonner gave this solution: You're using Net-SNMP in RHAS4. FreeRADIUS 1.0.2 doesn't have the net-snmp compatibility fix. You can find the patch at http://lists.freeradius.org/archives/freeradius-users/2004/10/frm00210.html Apply that patch, rebuild, and it should work. Unfortunately this link is now broken. However, after some more digging it appeared Kevin was probably referring to: freeradius-0.9.3-net-snmp.patch which I was able to download from another source. I was able to successfully apply this patch to FreeRadius 1.0.1, 1.0.2, 1.0.5, and 1.1.0, and the subsequent compiles were successful, but still radiusd -X makes no references to SMUX and snmp queries for freeradius OIDs fail as before. I'm at my wit's end about what to try next, and would sincerely appreciate any light you all might be able to shed on this issue. My /usr/local/etc/radiusd.conf file contains snmp = yes $INCLUDE ${confdir}/snmp.conf My /usr/local/etc/snmp.conf file contains smux_password = verysecret My /etc/snmp/snmpd.conf file contains rocommunity public smuxpeer .1.3.6.1.4.1.3317.1.3.1 verysecret But every time I run this on the server snmpwalk -v2c -cpublic 127.0.0.1 .1.3.6.1.2.1.67 I get this result SNMPv2-SMI::mib-2.67 = No Such Object available on this agent at this OID Here is an example of the output I get from radiusd -X (when using 1.0.5 in this case): Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Thanks in advace for your assistance, Kevin Branch

3 3

Can't import ldap schema provided in ldap howto
by Laura Donovan 26 Jan '06

26 Jan '06

Hello, I've been trying to configure openldap for use with radius. I'm running a RedHat ES 4 server with the following rpm's installed: openldap-2.2.13-3 freeradius-1.0.1-3.RHEL4 I've been following the instructions in ldap_howto.txt, and I created the schema.ldif file exactly as outlined in the doc. But when I run the ldapadd command it gives the following error: [root@myserver]# ldapadd -f schema.ldif -x -D "cn=root,dc=mydomain,dc=com" -w secret adding new entry "dc=mydomain,dc=com" adding new entry "ou=radius,dc=mydomain,dc=com" adding new entry "ou=profiles,ou=radius,dc=mydomain,dc=com" adding new entry "ou=users,ou=radius,dc=mydomain,dc=com" adding new entry "ou=admins,ou=radius,dc=mydomain,dc=com" adding new entry "uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com" ldap_add: Object class violation (65) additional info: no structural object class provided I do have the include statement for "RADIUS-LDAPv3.schema" configured in my slapd.conf, and I already verified that it is readable by the user ldap (and that the path is correct). Here is the entry ldapadd is erroring on: dn: uid=dial,ou=profiles,ou=radius,dc=mydomain,dc=com objectclass: radiusprofile uid: dial radiusServiceType: Framed-User radiusFramedProtocol: PPP radiusFramedIPNetmask: 255.255.255.0 radiusFramedRouting: None I've found other posts with users having the same issue, but I haven't found one detailing the resolution. I've checked to ensure that there are no extra spaces at the end of the lines. Thanks in advance for any assistance! Sincerely, -Laura Donovan

3 2

problems compiling, but works, or don't??
by pelusa vali 26 Jan '06

26 Jan '06

hi every body, well trying to use freeradius v 1.0.5 to add security to a wlan, i configured this to use with openssl and eap-tls with this command: ./configure --prefix=/usr/local/ --with-openssl-includes=/usr/local/ssl/include/ --with-experimental-modules --enable-ltdl-install when i type make, get this error: Making static dynamic in rlm_perl... make[6]: Entering directory `/usr/src/freeradius-1.0.5/src/modules/rlm_perl' /usr/src/freeradius-1.0.5/libtool --mode=link gcc -release 1.0.5 \ -module -export-dynamic \ -o rlm_perl.la -rpath /usr/local//lib rlm_perl.lo `perl -MExtUtils::Embed -e ldopts` -lssl -lcrypto -lnsl -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! rm -fr .libs/rlm_perl.la .libs/rlm_perl.* .libs/rlm_perl-1.0.5.* gcc -shared rlm_perl.lo -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lpthread -lc -lcrypt -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.0.5.so -o .libs/rlm_perl-1.0.5.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/usr/src/freeradius-1.0.5/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/usr/src/freeradius-1.0.5/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/usr/src/freeradius-1.0.5/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/usr/src/freeradius-1.0.5' make: *** [all] Error 2 i have installed libsdl-perl and in /usr/src/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_tls/Makefile i have this: TARGET = rlm_eap_tls SRCS = rlm_eap_tls.c eap_tls.c cb.c tls.c mppe_keys.c RLM_CFLAGS = $(INCLTDL) -I../.. -I/usr/local/ssl/include/ HEADERS = eap_tls.h RLM_INSTALL = RLM_LDFLAGS += -I/usr/local/ssl/lib RLM_LIBS += -lssl -lcrypto $(STATIC_OBJS): $(HEADERS) $(DYNAMIC_OBJS): $(HEADERS) RLM_DIR=../../ include ${RLM_DIR}../rules.mak well why this error occurs and how could i solve?? i just can install if don't compile with --with-experimental-modules, so what happen if i don't use those experimental modules?? could freeradius work in my wlan as i hope? thanks in advance for your time. _________________________________________________________________ Charla con tus amigos en línea mediante MSN Messenger: http://messenger.latam.msn.com/

3 2

Modifying a radreply
by Thulani Maphosa (T) 26 Jan '06

26 Jan '06

Hi all, am investigating the possibility of appending to a radreply attribute. 1. This will come from ISP * Cisco-Avpair += "ip route 10.0.1.0 255.255.255.0" 2. From our radius as per Realm * Cisco-AVpair += "ip:vrf-id=client1" * Cisco-AVpair += "ip:ip-unnumbered=Loopback11" * Cisco-Avpair += "ip:addr-pool=easyvpnpool" Modify proxy reply from ISP to look like this: * Cisco-Avpair += "ip route vrf client1 10.0.1.0 255.255.255.0" Can this be achieved on post-proxy with attr_rewrite? Kind regards Thulani Maphosa IP Networks and Services (012) 311 5494 maphost(a)telkom.co.za There are 10 types of people that can understand Binary. Those who can, and those who can't. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ This e-mail and its contents are subject to the Telkom SA Limited e-mail legal notice available at http://www.telkom.co.za/TelkomEMailLegalNotice.PDF ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

deny access to ms-chap
by André Lemos 26 Jan '06

26 Jan '06

1 1

SV: How to log users in radutmp
by Torkel Mathisen 26 Jan '06

26 Jan '06

Hi Thanks. I was looking on the freeradius server, but ofcourse the problem was on the AP. :) Regards, Torkel -----Opprinnelig melding----- Fra: freeradius-users-bounces+torkel.mathisen=bbs.no(a)lists.freeradius.org [mailto:freeradius-users-bounces+torkel.mathisen=bbs.no@lists.freeradius.org] På vegne av Alan DeKok Sendt: 24. januar 2006 18:29 Til: FreeRadius users mailing list Emne: Re: How to log users in radutmp "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > I don't have that radutmp file. > > How do I get freeradius to log users in that file? Make the NAS send data that FreeRADIUS can log. See the FAQ. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Yet another PEAP/LDAP Question
by Jon P. Giza 25 Jan '06

25 Jan '06

Hello all: I am trying to setup a 802.1x WiFi authentication system using freeradius. My setup is as follows: Windows XP SP2 as the supplicant using PEAP/MSCHAPv2 Cisco Aironet 1231 Freeradius 1.1.0 IBM Lotus Domino LDAP The process is mostly working - Freeradius binds to LDAP properly, the User gets authorized, Freeradius pulls the correct password hash from the Domino LDAP server.. But, then the MSCHAP portion fails. Portion of the log is shown below which I believe shows the problem. I am thinking that the problem is that I am not telling Freeradius how to hash the supplied password correctly to match the Domino password. The aggravating part is that we are using the exact same Domino LDAP server to authenticate our VPN users. Full (sanatized) copy of the debug output is here: http://www.xbytenetworks.com/debug-log.txt Copy of Radiusd.conf is here: http://www.xbytenetworks.com/radiusd.conf Thanks in advance for any help you can offer. Jon rlm_ldap: - authorize rlm_ldap: performing user authorization for jon.giza radius_xlat: '(uid=jon.giza)' radius_xlat: 'OU=Waukesha,OU=NA,O=MyCo' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Waukesha,OU=NA,O=MyCo, with filter (uid=jon.giza) rlm_ldap: Added password (6BDC5527858B28XXXXXXXXXEFAF2323F) in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jon.giza authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: Told to do MS-CHAPv2 for jon.giza with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: leaving group MS-CHAP (returns reject) for request 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: leaving group authenticate (returns reject) for request 5 auth: Failed to validate the user. Login incorrect: [jon.giza/<no User-Password attribute>] (from client wifi.myco.com port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 152 to 10.100.224.235 port 1645 EAP-Message = 0x010800261900170301001b1bb3ec40925325e30990ce3b14a78af7abc1f7222d06716740d2 ff Message-Authenticator = 0x00000000000000000000000000000000 State = 0x132496908cd3121e6967d7ddafcdd795 Finished request 5

3 6