November 2006 - Freeradius-Users - lists.freeradius.org

RE: freeradius and ntlm_auth howto
by King, Michael 25 May '07

25 May '07

Some things I've noticed from your attached files Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes I've never enabled these before, I'm unaware what affect they will have tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" Did you generate your OWN certs... They one's that ship with the server ARE NOT vailid. You have to generate your own. rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 That doesn't look right BUT YOUR FINAL ANSWER: xec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=b9ee04ca891c7b7d --nt-response=79b960c773fa101929d3bf8e738168e8b6d8ae8cd61f64f0 Exec-Program output: Account locked out (0xc0000234) Exec-Program-Wait: plaintext: Account locked out (0xc0000234) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Your account in the domain is not correct. Looks like it's been disabled or something. Fix that first before you change anymore config files. ________________________________ From: Stieven.Struyf(a)komatsu.eu [mailto:Stieven.Struyf@komatsu.eu] Sent: Monday, November 06, 2006 3:16 AM To: King, Michael Subject: Fw: freeradius and ntlm_auth howto Michael, I sent my reply already to the list, but due to the size(larger than 100k) it had to be reviewed by the admin and after a week it was rejected. Below you can find the mail. Thanks for helping me. Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 ----- Forwarded by Stieven Struyf/KEISA/BE/KOMEUR on 11/06/2006 09:13 AM ----- Stieven Struyf/KEISA/BE/KOMEUR 11/02/2006 08:55 AM To FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc Subject RE: freeradius and ntlm_auth howtoLink <Notes://BENT63KE/C1257011005324FB/DABA975B9FB113EB852564B5001283EA/625A 148B6EA233CDC125721400531414> I added the debuglog as attachment(as it is a little large to paste here). This is the mschap config: mschap { authtype = MS-CHAP use_mppe = yes require_strong = yes with_ntdomain_hack = yes require_encryption = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 freeradius-users-bounces+stieven.struyf=komatsu.eu(a)lists.freeradius.org wrote on 10/27/2006 04:36:00 PM: > Let's see if we can get this solved... > > > -----Original Message----- > > Here's the full log: > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 10.104.254.73:1645, > > This is NOT the full log. The full log would have started with the line > /path/to/radiusd -X > > Some important stuff is printed out there, it helps us help you. > > > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > Did you enable Ntdomain Hack in the MSCHAP module? (See below) > > > Including your radius.conf file would help. > > > > > HOWEVER, first you may want to check your mschap module definition: > > > > > > modules { > > > mschap { > > > ntlm_auth = "/usr/bin/ntlm_auth \ > > > --request-nt-key \ > > > --username=%{mschap:User-Name:-None} \ > > > --domain=%{mschap:NT-Domain:-None} \ > > > --challenge=%{mschap:Challenge:-00} \ > > > --nt-response=%{mschap:NT-Response:-00}" > > > > > > ...all on one line of course. Note the use of the > > "mschap:User-Name" > > > and "mschap:NT-Domain" values. > > Mine radiusd.conf file's mschap section looks like this: > NOTE that I do NOT have the :-00 and the :-None statements, and I DO > have with_ntdomain_hack=yes > > > # Microsoft CHAP authentication > # > # This module supports MS-CHAP and MS-CHAPv2 authentication. > # It also enforces the SMB-Account-Ctrl attribute. > # > mschap { > with_ntdomain_hack = yes > ntlm_auth = "/usr/bin/ntlm_auth \ > --request-nt-key \ > --username=%{mschap:User-Name} \ > --challenge=%{mschap:Challenge} \ > --nt-response=%{mschap:NT-Response} > } > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 09 May '07

09 May '07

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" identity = "cn=Directory Manager" password = 1223 basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 6

pptp + vpn + freeradius Acct-Status-Type Alive
by "Jóhann B. Guðmundsson" 13 Mar '07

13 Mar '07

Is it possible to enable Acct-Status-Type Alive for pptp vpn? If so how.. Best regards Jóhann B.

2 3

Questions about latest CVS
by 高嵩 02 Feb '07

02 Feb '07

Hi,all I just installed the radiusd on CVS successfully. There are two questions: Does the radiusd server listen on IPv6 address by default?How to use the radclient in Ipv6 ? Regards

3 2

redundant LDAP server with free-radius
by sumi thra 02 Feb '07

02 Feb '07

Hi All, 1. When i configure the free-radius to use redundant ldap, the radius server contacts the secondary ldap server first. My config file options are: authorize { ... .... redundant{ ldap_primary ldap_secondary } .. } authenticate { .. .. Auth-Type LDAP { redundant { ldap_primary ldap_secondary } } } #unix eap } ldap ldap_primary { ;; .. } ldap ldap_secondary { .... ... } 2. My users file has : DEFAULT LDAP-Group := "groupname1" some vendor specific attributes follows.. DEFAULT LDAP-Group := "groupname2" ..... Do i need to specify it as ldap_primary-LDAP-Group := "groupname1" ldap_secondary-LDAP-Group := "groupname1" ?? or the previous define itself will work ?? Its very urgent. Please reply me if you have any idea. Thanks in advance. Regards, Sumi.

4 12

Re: Best practices for redundant servers
by Aaron Paetznick 19 Jan '07

19 Jan '07

Thanks, this was helpful. I would rather not use LVS. I would prefer to use the built-in functionality of the NAS to fall back from a primary to secondary or tertiary auth/accounting servers. This whole setup would be far simpler and more robust if I could just do master-master replication with the MySQL servers. Oh well. I was not aware of radsqlrelay. I think this gets me closer to what I need than anything else. I can't guarantee which server the NAS will choose to log to at any given time. Therefore, I may need to use radsqlrelay on each server to keep the others in sync. Does this seem like a sensible plan? --Aaron Nicolas Baradakis wrote: > Aaron Paetznick wrote: > >> I've been struggling with this problem for a couple of weeks, and I >> thought I'd pass it along to the mailing list. Basically I'm trying to >> answer the following question. Given multiple identical dedicated >> servers each running Linux and MySQL, how can I configure FreeRADIUS for >> maximum stability, reliability, and performance? The question, it >> seems, is not as easy as is sounds. > > I've already setup FreeRADIUS on multiple redundant servers, but never > had the time to write a HOWTO. The main guideline is: > > 1. Use LVS in a "direct routing" setup to dispatch the RADIUS requests. > http://www.linuxvirtualserver.org/VS-DRouting.html > > 2. Use MySQL replication for the authorize database, so each FreeRADIUS > server connects to a local, read only database. > http://dev.mysql.com/doc/refman/5.1/en/replication.html > > 3. Use radsqlrelay for the accounting database, so the accounting data > is written to a central database without slowing down the RADIUS > servers. radsqlrelay is to be found in the FreeRADIUS source tarball, > you could read the "rlm_sql_log" and "radsqlrelay" manpages for more > details. >

8 10

How to send tome clients to the same detail file
by Angel L. Mateo 18 Jan '07

18 Jan '07

Hello, I have a running server with this configuration: detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } I have activated the detail file in the accounting section and the auth_log in the authorize and are working fine. But now I want to send all the logs for requests from a group of clients (defined as a huntgroup) to the same files, and the request for all other clients as now (classified with the IP address of the client). Is there any way to redefine this files for a set of clients? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

2 3

Accounts staying online past Session Timeout value
by Mike Jakubik 16 Dec '06

16 Dec '06

Hello, I am having some problems lately with freeradius 1.1.2 + mysql, and users staying online past their session timeout value (4 hours). Can anyone shed some light on the matter? I can not find any problems with the server itself, the loads are low and everything seems to be functioning OK. Would this be a function of the NAS to disconnect the user and send a stop packet or is it up to freeradius? Also, sometimes i have users who are getting disconnected and can not reconnect because they are still shown to be online, and i am limiting the sessions to 1. Again, would this be a problem with the NAS/network because freeradius is not receiving the stop packet? This setup has been running for over 80 days without a problem, so it leads me to believe that the problem is not on the radius server, but i would like some second opinions. Thank You.

4 6

configuring groups in sql tables
by Alexander Serkin 14 Dec '06

14 Dec '06

Hi, Wther i'm missing something in docs or it is impossible to do more than one groupcheck for the same username by sql. I have two groups which should be authorized differently - group1: DEFAULT Huntgroup-Name == MSK, Realm == domain.com, Auth-Type := Accept Service-Type = Outbound-User, Tunnel-Type = L2TP, Tunnel-Server-Endpoint = xxx.yyy.97.71, Cisco-AVpair += "vpdn:l2tp-tunnel-password=secret" and group2: DEFAULT Realm == domain.com, NAS-IP-Address == xxx.yyy.117.1 Framed-Protocol = PPP, Service-Type = Framed, Framed-IP-Netmask = 255.255.255.255, cisco-avpair = "lcp:interface-config=peer default ip address pool VRFNAM\nppp ipcp dns aaa.bbb.1.253 aaa.bbb.1.253\nppp ipcp wins aaa.bbb.1.253\n" What i can do: insert into RADGROUPCHECK values('','group2','Realm','==','domain.com'); insert into RADGROUPCHECK values('','group2','NAS-IP-Address','==','xxx.yyy.117.1'); insert into RADGROUPREPLY values('','group2','Framed-Protocol','=','PPP'); insert into RADGROUPREPLY values('','group2','Service-Type','=','Framed'); insert into RADGROUPREPLY values('','group2','Framed-IP-Netmask','=','255.255.255.255'); insert into RADGROUPREPLY values('','group2','cisco-avpair','=','lcp:interface-config=peer default ip address pool group1\nppp ipcp dns aaa.bbb.1.253 aaa.bbb.1.253\nppp ipcp wins aaa.bbb.1.253\n'); and insert into USERGROUP values('','user(a)domain.com','','group2','5'); Then i can remove group2 description from users file and it works. But when i do the same with group1 - both groups 1 and 2 stop working. The difference is that both radgroupcheck and radgroupreply sql queries now return two attribute sets for group 1 and 2 simultaneously. I thought that radiusd should follow check items and select the proper group according to attributes present in the request, but sqlauth module returns notfound. So the users file and sql tables are not processed in the same manner. What am i missing? -- Sincerely Yours, Alexander

2 4

Temporary Accounts
by Thibault Le Meur 12 Dec '06

12 Dec '06

Hi, I'm using FR 1.1.3. I'd like to use the 'files' or 'mysql' backends to store temporary radius accounts used for guest accesses. I'd like to be able to enforce: * a Day-Of-Week and Time-Of-Day policy ===> using the Login-Time attribute seems appropriate * an 'account available Not-Before / Not-After' policy ===> What is the recommended setup for this last part of the policy ? - Using the 'Expiration' attribute for the 'Not-After' part is ok, but what about the Not-Before part ? - Do I have to use the Current-Login attribute to check the Not-Before part ? If yes what is the format of this attribute ? Any pointer to a faq or a sample setup file would be appreciated ;-) Regards, Thibault

2 8