October 2006 - Freeradius-Users - lists.freeradius.org

Pam radius authentication
by danieldinu＠rdslink.ro 12 Oct '06

12 Oct '06

Hello! I try to authenticate ssh users logins using pam_radius_auth.so. On my RedHat 9 I have the following setup: - freeradius server - users file: test Auth-Type := Local, User-Password == "test" - clients.conf client 127.0.0.1 { secret = secret shortname = localhost } -pam radius module - cat /etc/pam.d/sshd #%PAM-1.0 auth required pam_securetty.so auth sufficient pam_radius_auth.so debug auth required /lib/security/pam_unix_auth.so account required pam_radius_auth.so debug password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session required pam_limits.so session optional pam_console.so -cat /etc/raddb/server 127.0.0.1 secret 1 - pam_radius_auth.so is copied in /lib/security -I created linux user test with home directory /home/test , without setting up a password - freeradius started with radiusd -X Problem is that, when I trie to connect to this machine using ssh, the radius server receives the request, processes it, sends access-accept, but the ssh session is ended, without the user being really logged in !!! I don't know the reason why the user gets rejected... tail -f /var/log/secure Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: Got RADIUS response code 2 Oct 12 11:06:27 D-Server sshd[26585]: pam_radius_auth: authentication succeeded Oct 12 11:06:27 D-Server sshd[26585]: Accepted password for test from 10.243.30.42 port 2847 ssh2 Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got user name test Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Sending RADIUS request code 1 Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1108551052. Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: Got RADIUS response code 2 Oct 12 11:28:30 D-Server sshd[26590]: pam_radius_auth: authentication succeeded Oct 12 11:28:30 D-Server sshd[26590]: Accepted password for test from 10.243.30.42 port 2881 ssh2 from radiusd -X : rad_recv: Access-Request packet from host 127.0.0.1:27615, id=253, length=97 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "sshd" NAS-Port = 26590 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "512wyse83.cosmote.rom" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry test at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 253 to 127.0.0.1 port 27615 Finished request 0 thank you!

1 0

Insert charactrer in username
by Nicola Iotti 12 Oct '06

12 Oct '06

Hi all, we use Freeradius as proxy. Is it possible to insert a character inside the username every time in the same position (i.e. before last six characters) using preproxy_users configuration file ?. For example : original username = Johnnyfavourite username after preproxy section = Johnnyfav@ourite So the server can use "ourite" as proxy realm.. And if it is possible, which is the right syntax of the instruction in preproxy_users file? If it is not possible, is there another way to do it? Thank you

1 0

LDAP authorizedService attribute matching
by Owen DeLong 12 Oct '06

12 Oct '06

I've got an LDAP database which works with PAM and uses PosixAccounts to describe users. It uses the authorizedService attribute to specify which services the user is allowed to log into. I've configured freeradius to map authorizedService -> Service-Type and have set up Service-Type as a check attribute. I'm running: (radiusd: FreeRADIUS Version 1.1.3, for host i686-pc-linux-gnu, built on Oct 10 2006 at 13:13:55) For example, say user foo has: dn: uid=foo, ou=people, dc=zone, dc=example, dc=com ... authorizedService: sshd authorizedService: vpn authorizedService: xdm ... I would like this user to succeed authenticating against RADIUS if Service-Type in the request matches sshd, vpn, or xdm, but, not if it contains anything else. Is there a way to set up this comparison in freeradius? I've read the FAQ, but, I haven't found a way to do this. I've included debug output below, just in case. Any help, especially a sepecific set of "put this in x configuration file here and it should work" type help is greatly appreciated. Thanks, Owen Test authentication command (the username, password, and domain name have been replaced to preserve the anonymity of the implementation in question): In this case, user foo has authorizedService attributes with the following values: passwd login sshd xdm gdm sudo su (echo "User-Name = foo" ; echo "User-Password = xyzzy"; echo "Service- type = sshd" ) | \ radclient localhost auth testing123 results in: rad_recv: Access-Request packet from host 127.0.0.1:32772, id=37, length=50 User-Name = "foo" User-Password = "xyzzy" Service-Type = sshd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "foo", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "foo" rlm_realm: Proxying request from user owen to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for foo radius_xlat: '(uid=foo)' radius_xlat: 'ou=people,dc=zone,dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=zone,dc=example,dc=com, with filter (uid=foo) rlm_ldap: checking if remote access for owen is allowed by authorizedService rlm_ldap: looking for check items in directory... rlm_ldap: Adding authorizedService as Service-Type, value passwd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value login & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sshd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value xdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value gdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sudo & op=21 rlm_ldap: Adding authorizedService as Service-Type, value su & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user foo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "foo" with password "xyzzy" rlm_ldap: user DN: uid=foo,ou=people,dc=zone,dc=example,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=foo,ou=people,dc=zone,dc=example,dc=com/xyzzy to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user owen authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 0 modcall: leaving group LDAP (returns ok) for request 0 Sending Access-Accept of id 37 to 127.0.0.1 port 32772 Finished request 0 Going to the next request --- Walking the entire request list --- Received response ID 37, code 2, length = 20 Waking up in 6 seconds... Which is correct. However, because the following does not fail: (echo "User-Name = foo" ; echo "User-Password = xyzzy"; echo "Service- type = vpn" ) | \ radclient localhost auth testing123 I suspect it's just that anything succeeds whether it matches or not. Here is the debug output for the VPN test: rad_recv: Access-Request packet from host 127.0.0.1:32772, id=39, length=50 User-Name = "foo" User-Password = "xyzzy" Service-Type = vpn Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "foo", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "foo" rlm_realm: Proxying request from user foo to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for foo radius_xlat: '(uid=foo)' radius_xlat: 'ou=people,dc=zone,dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=zone,dc=example,dc=com, with filter (uid=foo) rlm_ldap: checking if remote access for foo is allowed by authorizedService rlm_ldap: looking for check items in directory... rlm_ldap: Adding authorizedService as Service-Type, value passwd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value login & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sshd & op=21 rlm_ldap: Adding authorizedService as Service-Type, value xdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value gdm & op=21 rlm_ldap: Adding authorizedService as Service-Type, value sudo & op=21 rlm_ldap: Adding authorizedService as Service-Type, value su & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user foo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "foo" with password "xyzzy" rlm_ldap: user DN: uid=foo,ou=people,dc=zone,dc=example,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=foo,ou=people,dc=zone,dc=example,dc=com/ n0t4u2c! to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user foo authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: leaving group LDAP (returns ok) for request 1 Sending Access-Accept of id 39 to 127.0.0.1 port 32772 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... Received response ID 39, code 2, length = 20

2 1

RE: SQL Accounting oddness
by Sean 12 Oct '06

12 Oct '06

Hi, Check that you have all the ports used by FreeRadius open. It looks as if the accounting traffic is not getting through to the server. Let me know if I'm right. Regards, Sean Bracken http://swarmhotspots.com

3 2

AKA Digest Support in FRadius
by Vineet.Asati＠t-systems.com 12 Oct '06

12 Oct '06

Hi, Would any of you, please confirm me whether AKA Digest Support is there in the Freeradius Server (Version 1.1.3). Thanks in Advance Vineet

1 0

windows login using freeradius?
by Leo Lei 12 Oct '06

12 Oct '06

hi list, can we use freeradius to authenticate the windows login users? if yes, can we guide me to some related materials? thanks. -------------- Leo Lei 2006-10-12

2 1

pam_radius_auth.so : talk_radius() go by 2 second( max 4 second)
by 나종현 11 Oct '06

11 Oct '06

1 0

Huntgroups
by Brad McAllister 11 Oct '06

11 Oct '06

I got past my last config problem that I was having and now I running into what is probably more of a design issue on my side. I am not sure if I am trying to use huntgroups for more than they were intended for and perhaps there is another method of achieving what I am looking to do. To start our current radius server uses "identifiers" which allow users to connect from specific NASs. In the current system I can assign multiple identifiers to an account. For example a wireless user can connect with both the wireless equipment and a dialup as a backup. When I started working with freeRadius I figured I would create huntgroups for each service type, wireless, dialup, dsl, etc. Add the appropriate NASs to the list. Then in my SQL DB I would add the user to the groups they belong to. Unfortunately, when I add multiple entries to the "usergroup" table with different group names, the authentication is rejected with the following error: modcall: group authorize returns ok for request 2 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. To sum things up, I need to know how to let clients connect from multiple NASs with the ability to block them from other NASs. Thanks for the help. -- Brad McAllister bmcallister(a)noc.dls.net

2 1

SQL Accounting oddness
by John Williams 11 Oct '06

11 Oct '06

I’ve just setup a new freeradius server using the exact same config files from our other radius server. We are using a different MySQL database for the second freeradius server so we have changed the database name in sql.conf to reflect this. Authentication is working fine and it’s authenticating from the database. However accounting information is not being entered into the radacct table, its currently empty but we are getting accounting packets back. I run freeradius in debug mode and found the following sql accounting queries that don’t look right: sql: accounting_update_query_alt = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S',INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Octets}', '%{Acct-Output-Octets}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0')" sql: accounting_start_query = "INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time}', '0')" Surely the values should be replaced by the actual information it should be entering into the table? If that’s the case that’s why the radacct table is empty, MySQL won’t insert the data showing there and must be erroring. Anyone got any ideas? Thanks John -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.0.407 / Virus Database: 268.13.1/469 - Release Date: 09/10/2006

1 1

lots of duplicated user logins via cisco aironet
by Michael Messner 11 Oct '06

11 Oct '06

hey freeRADIUS users, [root@Xradius ~]# radwho -r ISALAB.local\\mmessner,ISALAB.local\\mmessner,shell,S31005,Thu 12:15,141.201.43.115, mmessnerO,mmessnerO,shell,S310,Wed 11:33,141.201.43.118, mmessnerO,mmessnerO,shell,S279,Tue 12:45,141.201.43.118, mmessnerO,mmessnerO,shell,S453,Thu 15:13,141.201.43.118, mmessnerO,mmessnerO,shell,S468,Thu 15:24,141.201.43.118, mmessnerO,mmessnerO,shell,S268,Thu 09:44,141.201.43.118, mmessnerO,mmessnerO,shell,S273,Tue 12:33,141.201.43.118, mmessnerO,mmessnerO,shell,S259,Mon 14:49,141.201.43.118, mmessnerO,mmessnerO,shell,S325,Tue 16:28,141.201.43.118, mmessnerO,mmessnerO,shell,S372,Mon 12:07,141.201.43.118, 02-01-8D-C9-2B-19,02-01-8D-C9-2B-19,shell,S31003,Mon 15:44,141.201.43.115, ISALAB.LOCAL\\schernhorst,ISALAB.LOCAL\\schernhorst,shell,S31009,Thu 13:42,141.201.43.115, mmessnerO,mmessnerO,shell,S295,Thu 10:05,141.201.43.118, mmessnerO,mmessnerO,shell,S301,Thu 10:52,141.201.43.118, X.115 is a enterasys switch and the X.118 device is a cisco aironet access point, whats going wrong with this device? acutally there is just one mmessner connected! why is the username as mmessner0 displayed, while if I connect via the enterasys switch I got also the domainpart?!? thanks mIke

1 1