February 2006 - Freeradius-Users - lists.freeradius.org

Freeradius 1.1.0 and rlm_ldap
by futhwo 02 Feb '06

02 Feb '06

A little addition: I also tried to have the authenticate part done by the "files" module, putting in the user file: DEFAULT Auth-Type := LDAP but i still get: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0

1 0

Freeradius 1.1.0 and rlm_ldap
by futhwo 02 Feb '06

02 Feb '06

Hi I use an AAA infrastructure based on FreeRADIUS, OpenLDAP and pam on some freebsd machines. All worked fine untill i upgraded FreeRADIUS form 1.0.5 to 1.1.0. From there on i cannot authenticate because the Auth-Type attribute is no more valorized to LDAP by the ldap module during authorize section. This is the error: rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 85.239.184.44:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: bind as / to 85.239.184.44:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=ifom-ieo-campus,dc=it, with filter (uid=futhwo) rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusAuthType as Auth-Type, value ldap & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusServiceType as Service-Type, value Shell-User & op=11 rlm_ldap: extracted attribute Cisco-AVPair from generic item cisco- avpair="shell:priv-lvl=15" rlm_ldap: user futhwo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds and this is the definition of ldap module in radiusd.conf: ldap { server = "XX.XX.XX.XX" port = 636 basedn = "dc=ifom-ieo-campus,dc=it" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 groupmembership_filter = "(memberuid=%{User-Name})" access_attr_used_for_allow = no set_auth_type = yes } I tried also to change the last 2 directives but it didn't worked. Another thing i tried (as can be seen in the output) is to set the attribute radiusAuthType to "ldap" in the user entry, and/or to set the directive "authtype = LDAP" in the module definition but still didn't work Lurking in the dictionaries,i found this in dictionary.freeradius.internal: VALUE Auth-Type CHAP 1025 # 1026 was LDAP, but we deleted it. Adding it back will break the # ldap module. VALUE Auth-Type PAM 1027 as he author said manually adding the Auth-Type ldap definition prevent the server from starting. So if the Auth-Type LDAP is no more defined,how can i perform authentication against a LDAP server? Thanks in advance to who will help me Regards Ivan

1 0

realm based proxy not working
by Stephen Walsh 01 Feb '06

01 Feb '06

Hi Folks I'm trying to get my Radius server handling requests for other realms now, and have been unsuccessful in the process. Despite my best efforts, the radius server ignores that the login realm is incorrect and attempts to authenticate the user against my LDAP tree. startup with debug shows it's being loaded; Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf <snip> main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no Proxy.conf has; realm DEFAULT { type = radius authhost = xx.xx.xx.xx:1812 accthost = xx.xx.xx.xx.4:1813 secret = <snip> nostrip } realm DEFAULT { type = radius authhost = yy.yy.yy.yy:1812 accthost = yy.yy.yy.yy:1813 secret = <snip> nostrip } realm acu.edu.au { type = radius authhost = LOCAL accthost = LOCAL strip } Radiusd.conf has # PROXY CONFIGURATION # proxy_requests = yes $INCLUDE ${confdir}/proxy.conf #realm module 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } authorize { preprocess suffix auth_log eap ldap1 ldap2 ldap3 ldap4 ldap5 ldap6 ldap7 } The logon is reaching the radius server with the correct realm, can anyone shed any light on this behaviour? I've tried it with our local domain both above and below the default entries, but without luck. Stephen Walsh s.walsh(a)signadou.acu.edu.au Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Re: eap.conf configuration
by Stephen Walsh 01 Feb '06

01 Feb '06

>Please, could you be more accurate When you create the private key file(pem file), you are asked to provide a passphrase that can be used to decode the File. The Passphrase is a key to allow you to confirm the validity of the private key file (pem file). Stephen Walsh s.walsh(a)signadou.acu.edu.au Client Support Officer (Technology) Australian Catholic University (Limited) PO Box 256, Dickson ACT 2602 Phone: +61 2 6209 1133 Fax: +61 2 6209 1179 Mobile: +61 419 496796 +++++++++++++++++++++++++++++++++++++++++++++++++ CRICOS Registration: 00004G, 00112C, 00873F, 00885B ABN 15 050 192 660 +++++++++++++++++++++++++++++++++++++++++++++++++

1 0

Unable to connect TCP/IP error 733
by Galloway, David Mr KRS 01 Feb '06

01 Feb '06

Hi All.... Here's an issue I'm getting, and I seem to not be able to find any answers elsewhere on the internet. We're testing currently and our client is dialing into our NAS, the NAS sends the auth. request to the RADIUS, RADIUS authenticates and returns a good request.... BUT!!!!! On the client side the connection is quickly dropped when it moves to "Registering Your Computer on The Network" and returns the error message of -Checking network protocol connections... TCP/IP CP reported error 733. A connection to the remote computer could not be completed. You might need to adjust the protocols on this computer.- The protocol on the Client is set to PPP. When I checked out various modem sites they kept referring to problems negotiating mult-link for single link connections... That option is off by default on Windows XP (which is the client). So I'm quite stuck, not sure exactly which way to go and what changed to make on the RADIUS side to resolve this connection issue. Client- Windows XP Pro NAS- Cisco AS5400 Radius Server - RHEL4 freeRADIUS version 1.0.1 Here's the debug dump. Don't know if it'll do any good, but... Hey, anything is worth a try. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.2.5:1645, id=115, length=100 Framed-Protocol = PPP User-Name = "test" User-Password = "test" NAS-Port-Type = Async Connect-Info = "54667/24000 V90/V44/LAPM" NAS-Port = 538 Service-Type = Framed-User NAS-IP-Address = 172.16.2.5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched test at 80 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 115 to 172.16.2.5:1645 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.2.150 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 115 with timestamp 43e171f9 Nothing to do. Sleeping until we see a request. Regards, David Galloway Public Networks Administration KRS IT Network Operations Help Desk (805) 355-2444 Direct (805) 355-4512 +12Hrs GMT

1 0

FramedIPAddress not showing in MySQL
by Fred Casavant 01 Feb '06

01 Feb '06

The FramedIPAddress <sql.php?lang=en-utf-8&server=1&collation_connection=utf8_general_ci&db=radius&table=radacct&pos=0&session_max_rows=30&disp_direction=horizontal&repeat_cells=100&dontlimitchars=0&sql_query=SELECT+%2AFROM+%60radacct%60++ORDER+BY+%60FramedIPAddress%60+ASC> are showing up in my accounting file (the detail-date file) but it's not showing up in the radacct table in mysql. At first I thought it was an issue with the NASes but the IPs are always showing up in the flat file (after an Accounting Stop action) so I doubt the NASes are the problem. And I didn't touch the default sql.conf file at all and the mysql radius schema was created with the db_mysql.sql that come with the freeradius tarball. So I wonder what could be the problem here. Could it be because I'm logging the accounting stuff in two places (flat detail file and mysql) at the same time? My setup is freeradius 1.1.0 with MySQL 4.1.16 on a FC4 distro.

1 0

More than one sql Query in Accounting
by bertram 01 Feb '06

01 Feb '06

Hello, i want to run more than one SQL Query when a User logoff. the first Query is the accounting_stop_query to insert Accounting infos. the second Query is for recalculating the remaining traffic for the User (for ChilliSpot-Max-Total-Octets). When i insert one new section in the sql.conf like the sql {...} and add it in the accounting section of the radiusd.conf the radiusd coldnt start and print out a memory access error Message. can everybody help me to solve this Problem Bertram sorry for my bad english

1 0

client's shortname cast the real IP
by Min Qiu 01 Feb '06

01 Feb '06

Hi, I have: client 10.1.2.0/24 { secret = secretkey shortname = 10.1.2.x } The problem is the log has only 10.1.2.x, not the real NAS IP. However, taking the shortname out will generate error when the radiusd runs. What I can do to have the server log the real NAS ip. Of cause, I don't want to do client 10.1.2.1 ... client 10.1.2.2 ... ... client 10.1.2.254 ... I have FC4 and freeradius 1.0.4 installed Thanks, Min

1 0

Re: FreeRADIUS on FreeBSD 6.0-RELEASE
by Rob Parker 01 Feb '06

01 Feb '06

D'oh - ignore me. Just spotted that it's currently in the FreeBSD PR queue waiting to be commited since it was submitted yesterday! Thanks all, Rob. -----Original Message----- From: Rob Parker Sent: 01 February 2006 17:31 To: 'freeradius-users(a)lists.freeradius.org' Subject: FreeRADIUS on FreeBSD 6.0-RELEASE Hi, I've just come up with a small patch to otp_state.c to allow clean compilation on FreeBSD 6.0. I notice there is no port maintainer, so I'm not entirely sure where I should send it! If someone has a cleaner/tidier way of doing this, let me know... I've included the patch below for review. I am also considering submitting it to ports(a)freebsd.org and possibly taking over maintaing the FreeBSD port of FreeRADIUS unless anyone knows who currently controls it? diff -u otp_state.c.backup otp_state.c --- otp_state.c.backup Wed Feb 1 18:32:52 2006 +++ otp_state.c Wed Feb 1 18:32:45 2006 @@ -35,7 +35,7 @@ #include <fcntl.h> #include <unistd.h> #include <sys/socket.h> -#if defined(__linux__) || defined(__APPLE__) +#if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) #include <sys/un.h> #endif Regards, Rob.

1 0

FreeRADIUS on FreeBSD 6.0-RELEASE
by Rob Parker 01 Feb '06

01 Feb '06

Hi, I've just come up with a small patch to otp_state.c to allow clean compilation on FreeBSD 6.0. I notice there is no port maintainer, so I'm not entirely sure where I should send it! If someone has a cleaner/tidier way of doing this, let me know... I've included the patch below for review. I am also considering submitting it to ports(a)freebsd.org and possibly taking over maintaing the FreeBSD port of FreeRADIUS unless anyone knows who currently controls it? diff -u otp_state.c.backup otp_state.c --- otp_state.c.backup Wed Feb 1 18:32:52 2006 +++ otp_state.c Wed Feb 1 18:32:45 2006 @@ -35,7 +35,7 @@ #include <fcntl.h> #include <unistd.h> #include <sys/socket.h> -#if defined(__linux__) || defined(__APPLE__) +#if defined(__linux__) || defined(__APPLE__) || defined(__FreeBSD__) #include <sys/un.h> #endif Regards, Rob.

1 0