October 2006 - Freeradius-Users - lists.freeradius.org

Radius+LDAP for TACACS alternative
by Arya, Manish Kumar 30 Oct '06

30 Oct '06

Hi People, I am a newbie to Radius, picking up slowly with Radius. Can I use Radius for TACACS replacement ? We have users/groups and Tacacs server provides authentication/authorization for router cmds to these user/groups. Can I achive this using Radius, if yes, please send some links to start. Regards, -Manish __________________________________________________________________________________________ Check out the New Yahoo! Mail - Fire up a more powerful email and get things done faster. (http://advision.webevents.yahoo.com/mailbeta)

3 2

Cisco AP, FreeRADIUS and Fedora Directory Server
by Mustafa Şenay 30 Oct '06

30 Oct '06

Hello, I'm trying to authenticate Windows users via Cisco AP 1100, freeradius and Fedora Directory Server (FDS) combination. I configured FDS and radiusd.conf and other configuration files according to ldap_howto found in freeradius documentation. I managed to authorize users but authentication doesn't work. Here is the log of radiusd -X. I have to make it work urgently. Has anybody suggestions? rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:21645, id=91, length=170 User-Name = "yilmaz" Framed-MTU = 1400 Called-Station-Id = "0012.dae5.02d0" Calling-Station-Id = "00a0.c5fb.a044" Service-Type = Login-User Message-Authenticator = 0xb5aae70f920a25df14d59908548ecadf EAP-Message = 0x020a00261900170301001b242f66ff01fc8cabcc0f2e8203235bec935abdc9dac564949a1b82 NAS-Port-Type = Wireless-802.11 NAS-Port = 674 State = 0x5a4c45339a4de6925fbb158c95df2d80 NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Identifier = "ap" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 17 modcall[authorize]: module "preprocess" returns ok for request 17 modcall[authorize]: module "chap" returns noop for request 17 modcall[authorize]: module "mschap" returns noop for request 17 rlm_realm: No '@' in User-Name = "yilmaz", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 17 rlm_eap: EAP packet type response id 10 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 17 users: Matched entry DEFAULT at line 152 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=Personel,dc=deu,dc=edu,dc=tr' radius_xlat: '(uid=yilmaz)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Personel,dc=deu,dc=edu,dc=tr, with filter (uid=yilmaz) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(uid=yilmaz)(objectclass=radiusprofile))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Personel,dc=deu,dc=edu,dc=tr, with filter (&(radiusGroupName=disabled)(&(uid=yilmaz)(objectclass=radiusprofile))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in uid=yilmaz, ou=Personel,dc=deu,dc=edu,dc=tr, with filter (objectclass=*) rlm_ldap::groupcmp: Group disabled not found ????or user not a member rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=Personel,dc=deu,dc=edu,dc=tr' radius_xlat: '(&(uid=yilmaz)(objectclass=radiusprofile))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Personel,dc=deu,dc=edu,dc=tr, with filter (&(radiusGroupName=kablosuz)(&(uid=yilmaz)(objectclass=radiusprofile))) rlm_ldap::ldap_groupcmp: User found in group kablosuz rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 222 modcall[authorize]: module "files" returns ok for request 17 rlm_ldap: - authorize rlm_ldap: performing user authorization for yilmaz radius_xlat: '(uid=yilmaz)' radius_xlat: 'ou=Personel,dc=deu,dc=edu,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Personel,dc=deu,dc=edu,dc=tr, with filter (uid=yilmaz) rlm_ldap: performing search in uid=kablosuz,ou=Radius,ou=Profil,dc=deu,dc=edu,dc=tr, with filter (objectclass=radiusprofile) rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user yilmaz authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 17 modcall: leaving group authorize (returns updated) for request 17 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 17 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 17 modcall: leaving group authenticate (returns invalid) for request 17 auth: Failed to validate the user. Delaying request 17 for 1 seconds Finished request 17 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:21645, id=91, length=170 Sending Access-Reject of id 91 to xxx.xxx.xxx.xxx port 21645 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Cleaning up request 9 ID 83 with timestamp 4532acc3 Cleaning up request 10 ID 84 with timestamp 4532acc3 Cleaning up request 11 ID 85 with timestamp 4532acc3 Cleaning up request 12 ID 86 with timestamp 4532acc3 Cleaning up request 13 ID 87 with timestamp 4532acc3 Cleaning up request 14 ID 88 with timestamp 4532acc3 Cleaning up request 15 ID 89 with timestamp 4532acc3 Cleaning up request 16 ID 90 with timestamp 4532acc3 Cleaning up request 17 ID 91 with timestamp 4532acc3 Nothing to do. Sleeping until we see a request.

3 7

3com wx - peap-mschapv2 - freeradius - mysql
by news.gmane.org 30 Oct '06

30 Oct '06

Hello, I have a wireless network based on wx switch 3com (centrally managed access-point) and I'm trying to activate WPA protection on one ssid "wpa-experimental". I hope to have configured all the component correctly. When I attempt to connect, on radius log (started by radiusd -X) I see: rad_recv: Access-Request packet from host 149.139.32.61:20001, id=118, length=148 NAS-Port-Id = "2/1" Calling-Station-Id = "00-08-E3-B0-73-46" Called-Station-Id = "00-12-A9-17-08-40:wpa-experimental" Service-Type = Framed-User EAP-Message = 0x0201000d0161676f7374696e69 User-Name = "agostini" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = xxx.xxx.xxx.xxx Message-Authenticator = 0x3c8c9588223b33c4a8dafd70db73e334 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 203 modcall[authorize]: module "preprocess" returns ok for request 203 modcall[authorize]: module "chap" returns noop for request 203 modcall[authorize]: module "mschap" returns noop for request 203 rlm_realm: No '@' in User-Name = "agostini", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 203 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 203 radius_xlat: 'agostini' rlm_sql (sql): sql_set_user escaped user --> 'agostini' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 203 users: Matched DEFAULT at 155 modcall[authorize]: module "files" returns ok for request 203 modcall: group authorize returns updated for request 203 rad_check_password: Found Auth-Type EAP rad_check_password: Found Auth-Type Local Warning: Found 2 auth-types on request for user 'agostini' auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [agostini/<no User-Password attribute>] (from client Wx1200-B1D port 0 cli 00-08-E3-B0-73-46) Delaying request 203 for 1 seconds Finished request 203 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 118 to 149.139.32.61:20001 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 203 ID 118 with timestamp 44896cc8 Nothing to do. Sleeping until we see a request. Have you any idea what is wrong? Thank you in advance A Agostini

6 11

RADIUS AUTHENTICATOR---need HELP using MSCHAP and NTPASSWORD
by ego seek 30 Oct '06

30 Oct '06

I use Squid and RADIUS. Squid use Squid_radius_authenticator to authenticate a client and write a log in which there is the username and the http request. THE PROBLEM IS: In the radcheck table i put a value: "AUTH-TYPE" and set "MS-CHAP" for the user. his password is stored in NT-HASH format. when the authenticator try to authenticate the user, this is the output "....... rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 auth: Failed to validate the user. Login incorrect:[username/password]" can anybody help me? please.

2 1

How does freeradius calculate the number of required threads?
by Pshem Kowalczyk 30 Oct '06

30 Oct '06

Hi group, I'm trying to figure out optimal configuration for our radius-proxy farm. atm the farm is handling about 10-15 req/sec per device with the following config (two servers, load-balanced using an slb) thread pool { start_servers = 20 max_servers = 120 min_spare_servers = 20 max_spare_servers = 70 max_requests_per_server = 300 } perl { {...} max_clones = 100 start_clones = 20 min_spare_clones = 20 max_spare_clones = 50 cleanup_delay = 5 max_request_per_clone = 100 } With this configuration both servers run between 25 and 35 threads. Everything is fine (except for huge memory consumption), but when i try to point another device to the load balanced ip (device creates about 15-20req/sec (auth+acct)) freeradius starts spawning threads untill it hits the limit (both freeradius and rlm_perl) and then it locks. I suppose the problems are caused by the fact that the number of requests increases so suddenly, but I have no other way of switching the device over. Is there any way I can influence that behaviour? I suspect that about 50-60 threads would do the job, but if i drop the limit to 60 it just locks quicker. Any ideas how to fix that? regards pshemko

2 5

FreeRadius User config file
by Uma Palvannan 29 Oct '06

29 Oct '06

Hi All, I am currently configuring power distribution units(PDU) in our organisation, authentication from freeradius-1.0.1-3.RHEL4.3 1. I have configured the dictionary file accordingly. client 131.xxx.xx.xxx { secret =abcdeffghijk shortname =PDU1 } client 131.xxx.xx.xxx { secret =lmnoopqrstuve shortname =PDU2 } 2. I have also defined the ATTRIBUTE and VALUE the dictionary file as per APC vendor's instructions VENDOR APC 318 BEGIN-VENDOR APC ATTRIBUTE APC-Service-Type 1 integer APC VALUE APC-Service-Type Admin 1 VALUE APC-Service-Type Device 2 VALUE APC-Service-Type ReadOnly 3 3. I have modified the users file , created groups and outlet access for each group. In the below example,I have given group3 access to outlet3. DEFAULT Group == "group3", Auth-Type = System APC-Service-Type = Outlet, APC-Outlets = "3", Fall-Through = No 4. Now, I have 20 PDUs setup (in pair) and I also would like to restrict the subnets that it can authenticate from. I would like to set up a rule in user file as following: If pdu1 or pdu2 {if group1 and authenticated from the approved subnets Then APC-Service-Type = Outlet, APC-Outlets = "1", } ....And so on for the rest of PDU pairs. Has anyone done a similar setup before? If so, could you please shed light? Thanks in advance Uma u.palvannan(a)qut.edu.au

1 0

RE: Static IP Address allocation database - Active Directory?
by Jonathan De Graeve 29 Oct '06

29 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > Has anyone experimented with using Active Directory as a database for > Static IP Addressing? Yes, just assign a static ip in the AD dial-in properties for that user and adapt the ldap.attrmap accordingly, this works perfectly. There is no need to make a user member of a 'radius_staticip' Group. J. - -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98 -----BEGIN PGP SIGNATURE----- Version: 9.5.0 (Build 1202) wsBVAwUBRUG6jdjY2X/BrZGJAQgslggAmOMNyQR2lingFOOZas2+tRm2DM7+LgrG A8PNHcGxeMIWhtksMm++/nWwwZgK0PrBXECeX13fJf+mmgt3U1V1oXsD58HUAFJj VW+PW9O8o8ef5Br+03pzrIV0enZ6N4AmUOz42JudO4qPrUdrE7SyKDkz41vu8gSz dhW7SO9nTR7h9r688XqJnQU+w6ZQi2AUTumQ+9rvNn6UMS7AhzoNm0naH5tTp0Ql LUPEMByf4O6e4Ucuqd1SJk+gyeKD+ZsZ93YzmFP8btevLAnIw3VK2lnT0gwcejlD FIlkGc7Rt+DJ9Dznn3BXk19hZxNqnsPBDs1rZOX8nGdo7uLdjHctSQ== =tLiY -----END PGP SIGNATURE-----

2 4

Question about rlm modules
by Ali Majdzadeh 29 Oct '06

29 Oct '06

Hi all Is it possible to send Vendor Specific Attributes through an rlm module? I use the following method to send standard attributes through an rlm module: (As suggested by the template itself) * *reply = pairmake ("User-Name", "root", T_OP_EQ); pairadd (&request->reply->vps, reply); request->reply->code = PW_USER_NAME; DEBUG ("rlm_cmod: Sending User-Name"); What specific code should I use when for example I want to send h323-credit-amount attribute to a NAS? Best Regards Ali

2 1

RE: Peap mschapv2 proxy early termination of EAP
by Yogesh Nagarkar 28 Oct '06

28 Oct '06

EAP-PEAP-MSCHAPv2 hack for FreeRADIUS 1.1.3 If anyone has been following the threads http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg30477.… http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg22903.… The solution was: Edit : freeradius-1.1.3/src/main/request_list.c Comment out line 321: ----------------------------------------- proxy_ipaddr = listener->ipaddr; change to /*proxy_ipaddr = listener->ipaddr;*/ ----------------------------------------- Comment out line 797: request->proxy->src_ipaddr = proxy_ipaddr; Change to /*request->proxy->src_ipaddr = proxy_ipaddr;*/ ---------------------------------------- Compile request_list.c make && make install and we have FreeRADIUS 1.1.3 successfully authenticating: Microsoft Windows Supplicant -------> Request--------> Proxy Server -------- MSCHAPv2------> Home Server (WPA1/TKIP/PEAP) (PEAP tunnel ends) (Access Accept) Microsoft Windows Supplicant <------- Response------ Proxy Server <--------- MSCHAPv2------ Home Server (success) (Copy to PEAP tunnel) -------------------------------------------------- /etc/raddb/users file (proxy server) DEFAULT User-Name =~ "@somerealm.net", FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := inner-somerealm /etc/raddb/proxy.conf file (proxy server) realm somerealm.net { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm inner- somerealm{ type = radius authhost = xxxxxxxxx:1645 accthost = xxxxxxxxx:1646 secret = xxxxxxxx ldflag = round_robin nostrip } ------------------------------------------------- /etc/raddb/users file (home server) kirkhammet(a)somerealm.net User-Password == xxxxxxxxxx Reply-Message = "Enter Sandman!" ------------------------------------------------- Good luck :) Yogesh Nagarkar ------------------- Related thread ---------------------------------- I have tried the examples in those postings as well as suggestions from other postings without any success. I have started with the default config and turned on the debug option. However, looking at the debug output yet I couldn't quite figure out what went wrong. What I got so far is as follow: 1) Send a PEAP/MSCHAPv2 request using Linux's Xsupplicant or Mac client to the proxy radius 2) Proxy radius terminated EAP locally and proxied request (MSCHAPv2 minus EAP) to home radius 3) Home radius responded with an access-accept packet to proxy radius 4) Proxy Radius sent access-reject to client. See error output below. Tue Oct 3 20:10:37 2006 : Debug: rlm_eap: Request not found in the list Tue Oct 3 20:10:37 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Tue Oct 3 20:10:37 2006 : Debug: rlm_eap: Failed in handler I am running Freeradius 1.1.3 and have attached below my configuration files and an excerpt of the debug output hoping that the mistake would look obvious to some of you and that you could provide some helpful pointers or links. Thanks a lot for your help. -David In case, anyone is following this thread, the problem was solved by downgrading from Freeradius 1.1.2 and above running on Solaris 9 down to Freeradius 1.0.5 running on the same OS. Still tracing this issue through the debugger and will post to this thread if more information is available. Best, David ----------------------------------------------------------------------

1 0

Why is radiusd command not found?
by Chad Best 28 Oct '06

28 Oct '06

This is a total newbie question, but I can figure out the answer to it so I decided to post here. I have installed Freeradius-1.0.0(little behind the times, I know). After I finished configuring the radiusd.conf, eap.conf, and users files, I tried to start FreeRadius in debug mode. However, when I type "radiusd -X", I get command not found. What did I do wrong? When I installed the program, I just ran ./configure, make, make install so it should have installed properly. Any help would be greatly appreciated.

3 2