April 2006 - Freeradius-Users - lists.freeradius.org

How to implement radius with mysql
by Alejandro Sanchez 11 Apr '06

11 Apr '06

Hello. I am a new user of free radius the version that i use is 1.0.4-1. Anybody knows where can i find help to enable mysql with radius? Thank's Alex. ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of Burton, Steven > Sent: 11 April 2006 16:15 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > > -----Original Message----- > > From: > > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > > ists.freer > > adius.org > > [mailto:freeradius-users-bounces+sburton=shepherd-construction > > .co.uk@lis > > ts.freeradius.org]On Behalf Of King, Michael > > Sent: 11 April 2006 15:40 > > To: FreeRadius users mailing list > > Subject: RE: How do I set up simple AD integration? > > > > > > > > > > Is there a how-to or tutorial for this simple case? I have > > > searched this list and google generally. I have read the > > > articles referred to on the FreeRadius home page and several > > > others and I still can't see how the configuration works. Any > > > and all help gratefully received. > > > > > > Steve. > > > > > > > > > As for the simple how to, they're a few, but none that I > > would consider > > easy to follow. > > > > What your looking for this the following lines: (I have > > two ntlm_auth > > Lines, the original that is commented out, and the one that I > > use. They > > are long, so they will break across lines, but they are not > > that way in > > my config file) > > > > > > # Windows sends us a username in the form of > > # DOMAIN\user, but sends the challenge response > > # based on only the user portion. This hack > > # corrects for that incorrect behavior. > > # > > with_ntdomain_hack = yes > > > > # The module can perform authentication itself, OR > > # use a Windows Domain Controller. This > configuration > > # directive tells the module to call the ntlm_auth > > # program, which will do the authentication, > > and return > > # the NT-Key. Note that you MUST have > "winbindd" and > > # "nmbd" running on the local machine for ntlm_auth > > # to work. See the ntlm_auth program documentation > > # for details. > > # > > # Be VERY careful when editing the following line! > > # > > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > > --nt-response=%{mschap:NT-Response}" > > This stanza is a enclosed with the mschap section, still > nothing ventured.... > I changed the line and unfolded it and ran radiusd -X. The > first request didn't match anything usefull and was rejected > by System. I tried again but ticked the box 'CHAP' on > NTRadPing and got the output: > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "/usr/local/bin/ntlm_auth > --request-nt-key --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, > NAS-IP-Address, Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host > 192.168.50.127:3337, id=18, length=48 > User-Name = "burst01" > CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_chap: Setting 'Auth-Type := CHAP' > modcall[authorize]: module "chap" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type CHAP > auth: type "CHAP" > Processing the authenticate section of radiusd.conf > modcall: entering group CHAP for request 0 > rlm_chap: login attempt by "burst01" with CHAP password > rlm_chap: Could not find clear text password for user burst01 > modcall[authenticate]: module "chap" returns invalid for request 0 > modcall: leaving group CHAP (returns invalid) for request 0 > auth: Failed to validate the user. > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 18 to 192.168.50.127 port 3337 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 18 with timestamp 443bc5b9 > Nothing to do. Sleeping until we see a request. > > I think I'll put a protocol analyser on this (when I've time) > and see what is passing between the PC and RADIUS and what > (if anything) is passing between RADIUS and AD. > A quick look seems to show that the radius server does not contact a DC between the request and the subsequent rejection. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

1 0

RE: How do I set up simple AD integration?
by King, Michael 11 Apr '06

11 Apr '06

You would still need with_ntdomain_hack = yes But that isn't your actual problem. It never called ntlm_auth > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Burton, Steven > Sent: Tuesday, April 11, 2006 11:15 AM > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > -----Original Message----- > > From: > > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > > ists.freer > > adius.org > > [mailto:freeradius-users-bounces+sburton=shepherd-construction > > .co.uk@lis > > ts.freeradius.org]On Behalf Of King, Michael > > Sent: 11 April 2006 15:40 > > To: FreeRadius users mailing list > > Subject: RE: How do I set up simple AD integration? > > > > > > > > > > Is there a how-to or tutorial for this simple case? I > have searched > > > this list and google generally. I have read the articles > referred to > > > on the FreeRadius home page and several others and I > still can't see > > > how the configuration works. Any and all help gratefully received. > > > > > > Steve. > > > > > > > > > As for the simple how to, they're a few, but none that I would > > consider easy to follow. > > > > What your looking for this the following lines: (I have two > > ntlm_auth Lines, the original that is commented out, and > the one that > > I use. They are long, so they will break across lines, but > they are > > not that way in my config file) > > > > > > # Windows sends us a username in the form of > > # DOMAIN\user, but sends the challenge response > > # based on only the user portion. This hack > > # corrects for that incorrect behavior. > > # > > with_ntdomain_hack = yes > > > > # The module can perform authentication itself, OR > > # use a Windows Domain Controller. This > configuration > > # directive tells the module to call the ntlm_auth > > # program, which will do the authentication, and > > return > > # the NT-Key. Note that you MUST have > "winbindd" and > > # "nmbd" running on the local machine for ntlm_auth > > # to work. See the ntlm_auth program documentation > > # for details. > > # > > # Be VERY careful when editing the following line! > > # > > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > > --nt-response=%{mschap:NT-Response}" > > This stanza is a enclosed with the mschap section, still > nothing ventured.... > I changed the line and unfolded it and ran radiusd -X. The > first request didn't match anything usefull and was rejected > by System. I tried again but ticked the box 'CHAP' on > NTRadPing and got the output: > > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/var" > main: logdir = "/var/log" > main: libdir = "/usr/local/lib" > main: radacctdir = "/var/log/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/var/log/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "/usr/local/bin/ntlm_auth > --request-nt-key --username=%{mschap:User-Name} > --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/var/log/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" > tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/usr/local/etc/raddb/certs/dh" > tls: random_file = "/usr/local/etc/raddb/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = no > tls: check_cert_cn = "(null)" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > peap: default_eap_type = "mschapv2" > peap: copy_request_to_tunnel = no > peap: use_tunneled_reply = no > peap: proxy_tunneled_request_as_eap = yes > rlm_eap: Loaded and initialized type peap > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, > NAS-IP-Address, Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host > 192.168.50.127:3337, id=18, length=48 > User-Name = "burst01" > CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_chap: Setting 'Auth-Type := CHAP' > modcall[authorize]: module "chap" returns ok for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 152 > modcall[authorize]: module "files" returns ok for request 0 > modcall: leaving group authorize (returns ok) for request 0 > rad_check_password: Found Auth-Type CHAP > auth: type "CHAP" > Processing the authenticate section of radiusd.conf > modcall: entering group CHAP for request 0 > rlm_chap: login attempt by "burst01" with CHAP password > rlm_chap: Could not find clear text password for user burst01 > modcall[authenticate]: module "chap" returns invalid for request 0 > modcall: leaving group CHAP (returns invalid) for request 0 > auth: Failed to validate the user. > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 18 to 192.168.50.127 port 3337 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 18 with timestamp 443bc5b9 Nothing > to do. Sleeping until we see a request. > > I think I'll put a protocol analyser on this (when I've time) > and see what is passing between the PC and RADIUS and what > (if anything) is passing between RADIUS and AD. > > Steve. > > ______________________________________________________________________ > This email has been scanned by the MessageLabs Email Security System. > For more information please visit > http://www.messagelabs.com/email > ______________________________________________________________________ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

> -----Original Message----- > From: > freeradius-users-bounces+sburton=shepherd-construction.co.uk@l > ists.freer > adius.org > [mailto:freeradius-users-bounces+sburton=shepherd-construction > .co.uk@lis > ts.freeradius.org]On Behalf Of King, Michael > Sent: 11 April 2006 15:40 > To: FreeRadius users mailing list > Subject: RE: How do I set up simple AD integration? > > > > > > Is there a how-to or tutorial for this simple case? I have > > searched this list and google generally. I have read the > > articles referred to on the FreeRadius home page and several > > others and I still can't see how the configuration works. Any > > and all help gratefully received. > > > > Steve. > > > > > As for the simple how to, they're a few, but none that I > would consider > easy to follow. > > What your looking for this the following lines: (I have > two ntlm_auth > Lines, the original that is commented out, and the one that I > use. They > are long, so they will break across lines, but they are not > that way in > my config file) > > > # Windows sends us a username in the form of > # DOMAIN\user, but sends the challenge response > # based on only the user portion. This hack > # corrects for that incorrect behavior. > # > with_ntdomain_hack = yes > > # The module can perform authentication itself, OR > # use a Windows Domain Controller. This configuration > # directive tells the module to call the ntlm_auth > # program, which will do the authentication, > and return > # the NT-Key. Note that you MUST have "winbindd" and > # "nmbd" running on the local machine for ntlm_auth > # to work. See the ntlm_auth program documentation > # for details. > # > # Be VERY careful when editing the following line! > # > #ntlm_auth = "/path/to/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} > --nt-response=%{mschap:NT-Response}" This stanza is a enclosed with the mschap section, still nothing ventured.... I changed the line and unfolded it and ran radiusd -X. The first request didn't match anything usefull and was rejected by System. I tried again but ticked the box 'CHAP' on NTRadPing and got the output: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.50.127:3337, id=18, length=48 User-Name = "burst01" CHAP-Password = 0xcb043904b29de0427e32dc343c1db5ac22 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "burst01" with CHAP password rlm_chap: Could not find clear text password for user burst01 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 18 to 192.168.50.127 port 3337 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 18 with timestamp 443bc5b9 Nothing to do. Sleeping until we see a request. I think I'll put a protocol analyser on this (when I've time) and see what is passing between the PC and RADIUS and what (if anything) is passing between RADIUS and AD. Steve. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2

RE: How do I set up simple AD integration?
by King, Michael 11 Apr '06

11 Apr '06

> > Is there a how-to or tutorial for this simple case? I have > searched this list and google generally. I have read the > articles referred to on the FreeRadius home page and several > others and I still can't see how the configuration works. Any > and all help gratefully received. > > Steve. > As for the simple how to, they're a few, but none that I would consider easy to follow. What your looking for this the following lines: (I have two ntlm_auth Lines, the original that is commented out, and the one that I use. They are long, so they will break across lines, but they are not that way in my config file) # Windows sends us a username in the form of # DOMAIN\user, but sends the challenge response # based on only the user portion. This hack # corrects for that incorrect behavior. # with_ntdomain_hack = yes # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # directive tells the module to call the ntlm_auth # program, which will do the authentication, and return # the NT-Key. Note that you MUST have "winbindd" and # "nmbd" running on the local machine for ntlm_auth # to work. See the ntlm_auth program documentation # for details. # # Be VERY careful when editing the following line! # #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}"

1 0

How do I set up simple AD integration?
by Burton, Steven 11 Apr '06

11 Apr '06

Hi, I am trying to set up FreeRadius 1.1.1 on FreeBSD 6.0 REL with user integration with Active directory for a Windows 2003 domain currently in Win2000 mixed mode. My final object is to authenticate user-connections through a wireless AP. I have setup Samba 3 and successfully joined the Windows domain. I have tried: # wbinfo -u # wbinfo -g # wbinfo -a username%password # ntlm_auth --request-nt-key --domain=<domain> --username= <username> and all ran/authenticated successfully. I have built and installed FreeRadius 1.1.1 from the FreeBSD port and copied: acct_users clients.conf dictionary eap.conf hints huntgroups preproxy_users proxy.conf radiusd.conf realms snmp.conf sql.conf users from the *.sample files provided and added my PC as a client (for NTRadPing) and a 802.11g AP with matching shared secrets and type 'other' I have uncommented the example user 'steve' in users and I can get an 'Access-Accept' using NTRadPing with Steve's credentials so I know that local users are working. If I point NTRadPing at our Funk SBR server and my Windows username and password I can get an 'Access-Accept' so, initially, I would like to emulate this operation before I get involved with MSCHAPv2 PEAP etc. However, although I can see tantalizing references to 'ntlm_auth' and 'ntdomain' and the like in various files I cannot see how to trigger an AD lookup from a RADIUS request. So far all I have achieved is: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.50.127:2888, id=15, length=47 User-Name = "burst01" User-Password = "mypassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "burst01", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 15 to 192.168.50.127 port 2888 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 15 with timestamp 443bb1ca Nothing to do. Sleeping until we see a request. which is indistinguishable from nothing :-( Is there a how-to or tutorial for this simple case? I have searched this list and googled generally. I have read the articles referred to on the FreeRadius home page and several others and I still can't see how the configuration works. Any and all help gratefully received. Steve. S Burton BSc(Hons) MIEE MBCS MIEEE Network Manager Shepherd Construction Ltd Head Office Frederick House, Fulford Road, York, YO10 4EA Tel: 01904 660391 Fax: 01904 660577 Web: www.shepherd-construction.co.uk Registered number: 201860 England Registered address: Huntington House, Jockey Lane, Huntington, York YO32 9XW The views or opinions presented in this e-mail are solely those of the author and do not necessarily represent those of the company. This email and any files transmitted with it are confidential and are intended solely for the individual or entity to which they are addressed. If you have received this e-mail in error, please notify sclcomp(a)shepherd-construction.co.uk quoting the name of the sender. Whilst every care has been taken to check this outgoing e-mail for viruses it is seen as your responsibility to check and sweep it, and any attachments, for viruses on receipt. ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

2 1

problem with oracle scheme - table radacct
by Mathieu Legare 11 Apr '06

11 Apr '06

Using freeradius 1.1.0 on RHEL 4.0 update 3 with Oracle 9 database backend for accounting, we discovered the following problem while trying to add our wireless stuff to our RADIUS system. We've been using the current setup for PPP login with a Cisco access server without any problem. So the NAS is a Nortel WLAN Security Switch 2380 (more or less a Trapeze device if i am not mistaken). The WLAN switch sends a "start accounting" packet, unfortunalety the content of the %{NAS-Port-Id} variable that the WLAN switch sends seems to be in the following format: "2049/1" which is NOT a NUMERIC(12) (or integer if using the MySQL driver). This cause an ORA-01722 error . We've changed the NasPortId field type to VARCHAR2(15) to fix the problem. I really don't know if changing the type of the NasPortId field to varchar2 can introduce other problems, so far we haven't notice any. Thanks and have a nice day, --

2 1

Cisco AP 1240AG - PEAP/MSCHAPv2 with ntlm_auth
by Konne 11 Apr '06

11 Apr '06

hi my situation: ive Windows 2003 Server Domaincontrollers. i use freeradius who authenticates the clients in the domain with ntlm_auth. only users they will be in the group "wireless" have access to the wireless: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=DOMAIN\\WIRELESS" my question is now: how can i realize that ive 2 ssid, one ssid=administrators, and the other ssid=users, i omit the "--require-membership-of=DOMAIN\\WIRELESS" on the ntlm authentication and make two groups in the active directory: -- wireless_admin - ssid1=adminis -- wireless_users - ssid2=users when the user is a member of admins he become the vlan and the ssid for Administrators, and when the user is a member of users he become the vlan and the ssid for Users. is that possible to configure it in the "/etc/raddb/users" like following, but without user1, instead of this a group... user1 Auth-Type := EAP Cisco-AVPair := "ssid=admins", Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 2, Tunnel-Type = VLAN user2 Auth-Type := EAP Cisco-AVPair := "ssid=users", Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 3, Tunnel-Type = VLAN somone has experience to associate ntlm and group differentiation... and how can i do that the Admins can also login via shell, and the user only authentication no shell or something like that? thx Konne

1 0

Compiling freeradius 1.1.1 in FreeBSD 6.0 with mysql support
by Mark Hennessy 11 Apr '06

11 Apr '06

I'm trying to build freeradius 1.1.1 on a FreeBSD 6.0 system with MySQL 4.1.15 I'm using the following configure commandline: ./configure --with-mysql-lib=/usr/local/mysql/lib/mysql --with-mysql-include=/usr/local/mysql/include/mysql --prefix=/usr/local/adm/freeradius-1.1.1 I'd include the full output, but I figure that I should only do that if asked. Here's the problematic section: configuring in ./drivers/rlm_sql_mysql running /bin/sh ./configure --with-mysql-lib-dir=/usr/local/mysql/lib/mysql --with-mysql-include-dir=/usr/local/mysql/include/mysql --prefix=/usr/local/adm/freeradius-1.1.1 --enable-ltdl-install --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for mysql_config... (cached) yes checking for pthread_create in -lpthread... (cached) yes checking for mysql_init in -lmysqlclient_r (using mysql_config)... no checking for mysql_init in -lmysqlclient_r... no configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql.h (using mysql_config)... yes configure: warning: sql submodule 'mysql' disabled updating cache ../../../../.././config.cache creating ./config.status creating Makefile creating config.h config.h is unchanged It's not seeing mysql libraries, but they do indeed exist: # ls -al /usr/local/mysql/lib/mysql total 1974 drwxr-xr-x 2 root wheel 512 Apr 5 10:39 . drwxr-xr-x 3 root wheel 512 Apr 5 10:39 .. -rw-r--r-- 1 root wheel 14446 Apr 5 10:39 libdbug.a -rw-r--r-- 1 root wheel 41928 Apr 5 10:39 libheap.a -rw-r--r-- 1 root wheel 13640 Apr 5 10:39 libmerge.a -rw-r--r-- 1 root wheel 331488 Apr 5 10:39 libmyisam.a -rw-r--r-- 1 root wheel 24934 Apr 5 10:39 libmyisammrg.a -rw-r--r-- 1 root wheel 472466 Apr 5 10:39 libmysqlclient.a -rwxr-xr-x 1 root wheel 871 Apr 5 10:39 libmysqlclient.la lrwxr-xr-x 1 root wheel 20 Apr 5 10:39 libmysqlclient.so -> libmysqlclient.so.14 -rwxr-xr-x 1 root wheel 387482 Apr 5 10:39 libmysqlclient.so.14 -rw-r--r-- 1 root wheel 237570 Apr 5 10:39 libmystrings.a -rw-r--r-- 1 root wheel 253852 Apr 5 10:39 libmysys.a -rw-r--r-- 1 root wheel 105640 Apr 5 10:39 libnisam.a -rw-r--r-- 1 root wheel 5472 Apr 5 10:39 libvio.a # ls -al /usr/local/mysql/include/mysql total 288 drwxr-xr-x 2 root wheel 1024 Apr 5 10:39 . drwxr-xr-x 3 root wheel 512 Apr 5 10:39 .. -rw-r--r-- 1 root wheel 3428 Apr 5 10:39 errmsg.h -rw-r--r-- 1 root wheel 6778 Apr 5 10:39 keycache.h -rw-r--r-- 1 root wheel 17899 Apr 5 10:39 m_ctype.h -rw-r--r-- 1 root wheel 8085 Apr 5 10:39 m_string.h -rw-r--r-- 1 root wheel 1859 Apr 5 10:39 my_alloc.h -rw-r--r-- 1 root wheel 28650 Apr 5 10:39 my_config.h -rw-r--r-- 1 root wheel 3463 Apr 5 10:39 my_dbug.h -rw-r--r-- 1 root wheel 3509 Apr 5 10:39 my_dir.h -rw-r--r-- 1 root wheel 3000 Apr 5 10:39 my_getopt.h -rw-r--r-- 1 root wheel 39298 Apr 5 10:39 my_global.h -rw-r--r-- 1 root wheel 1515 Apr 5 10:39 my_list.h -rw-r--r-- 1 root wheel 3588 Apr 5 10:39 my_net.h -rw-r--r-- 1 root wheel 1245 Apr 5 10:39 my_no_pthread.h -rw-r--r-- 1 root wheel 24387 Apr 5 10:39 my_pthread.h -rw-r--r-- 1 root wheel 1784 Apr 5 10:39 my_semaphore.h -rw-r--r-- 1 root wheel 32346 Apr 5 10:39 my_sys.h -rw-r--r-- 1 root wheel 2007 Apr 5 10:39 my_xml.h -rw-r--r-- 1 root wheel 27615 Apr 5 10:39 mysql.h -rw-r--r-- 1 root wheel 15028 Apr 5 10:39 mysql_com.h -rw-r--r-- 1 root wheel 1241 Apr 5 10:39 mysql_embed.h -rw-r--r-- 1 root wheel 2184 Apr 5 10:39 mysql_time.h -rw-r--r-- 1 root wheel 781 Apr 5 10:39 mysql_version.h -rw-r--r-- 1 root wheel 11315 Apr 5 10:39 mysqld_error.h -rw-r--r-- 1 root wheel 5841 Apr 5 10:39 raid.h -rw-r--r-- 1 root wheel 6499 Apr 5 10:39 readline.h -rw-r--r-- 1 root wheel 1751 Apr 5 10:39 sql_common.h -rw-r--r-- 1 root wheel 6401 Apr 5 10:39 sql_state.h -rw-r--r-- 1 root wheel 1055 Apr 5 10:39 sslopt-case.h -rw-r--r-- 1 root wheel 1883 Apr 5 10:39 sslopt-longopts.h -rw-r--r-- 1 root wheel 970 Apr 5 10:39 sslopt-vars.h -rw-r--r-- 1 root wheel 1265 Apr 5 10:39 typelib.h I'm thoroughly perplexed. What should I try next? -- Mark Hennessy

8 11

Digest & Messenger
by saman alaniazar 11 Apr '06

11 Apr '06

dear Alan I changed the version of freeradius to 1.1.1 and we kept the last radiusd.conf file from 1.0.5 version unchanged. Belove you can see the excerpt of radiusd.conf file expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { # preprocess # auth_log # attr_filter # chap # mschap digest # eap sql } authenticate { # Auth-Type PAP { # pap # } # Auth-Type CHAP { # chap # } # Auth-Type MS-CHAP { # mschap # } digest # unix # eap } =============================================================== When I test the server with some open source sip phones, everything is ok but when I want to test following user with MSN messenger , reject packet was received : user = server2_user1 password = test URI =user(a)testrealm.icii.com Method = REGISTER Algorithm = "MD5" Here it is the dubug of freeradius for this packet : rad_recv: Access-Request packet from host 10.10.1.3:2309, id=242, length=200 NAS-Identifier = "testrealm" Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x0a0f736572766572325f7573657231 Digest-Attributes = 0x02226530663765326631373633376638323638316463323461396262363264643637 Digest-Attributes = 0x06054d4435 User-Name = "server2_user1" Digest-Attributes = 0x04187369703a746573747265616c6d2e696369692e636f6d Digest-Response = "5f0fc8449eb607379d80ad34a83fe512" Digest-Attributes = 0x0114746573747265616c6d2e696369692e636f6d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 0 radius_xlat: 'server2_user1' rlm_sql (sql): sql_set_user escaped user --> 'server2_user1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'server2_user1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'server2_user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'server2_user1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_digest: Converting Digest-Attributes to something sane... Digest-Method = "REGISTER" Digest-User-Name = "server2_user1" Digest-Nonce = "e0f7e2f17637f82681dc24a9bb62dd67" Digest-Algorithm = "MD5" Digest-URI = "sip:testrealm.icii.com" Digest-Realm = "testrealm.icii.com" A1 = server2_user1:testrealm.icii.com:test A2 = REGISTER:sip:testrealm.icii.com KD = 590b483ad6e6df65edb1826f5404e3a5:e0f7e2f17637f82681dc24a9bb62dd67:684a8ca612e13a06c419dc89351ac183 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. ======================================================= Now let's look at a correct authentication that was sent by open source sip phone. rad_recv: Access-Request packet from host 10.10.1.3:2773, id=22, length=200 NAS-Identifier = "testrealm" Digest-Attributes = 0x030a5245474953544552 Digest-Attributes = 0x0a0f736572766572325f7573657231 Digest-Attributes = 0x02226562376234336638333032613234656261343338313533366338346334393335 Digest-Attributes = 0x06054d4435 User-Name = "server2_user1" Digest-Attributes = 0x04187369703a746573747265616c6d2e696369692e636f6d Digest-Response = "d1b993f54dc5e242c4b67389188db5dd" Digest-Attributes = 0x0114746573747265616c6d2e696369692e636f6d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 36 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 36 radius_xlat: 'server2_user1' rlm_sql (sql): sql_set_user escaped user --> 'server2_user1' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'server2_user1' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'server2_user1' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'server2_user1' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'server2_user1' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 36 modcall: leaving group authorize (returns ok) for request 36 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 36 rlm_digest: Converting Digest-Attributes to something sane... Digest-Method = "REGISTER" Digest-User-Name = "server2_user1" Digest-Nonce = "eb7b43f8302a24eba4381536c84c4935" Digest-Algorithm = "MD5" Digest-URI = "sip:testrealm.icii.com" Digest-Realm = "testrealm.icii.com" A1 = server2_user1:testrealm.icii.com:test A2 = REGISTER:sip:testrealm.icii.com KD = 590b483ad6e6df65edb1826f5404e3a5:eb7b43f8302a24eba4381536c84c4935:684a8ca612e13a06c419dc89351ac183 modcall[authenticate]: module "digest" returns ok for request 36 modcall: leaving group authenticate (returns ok) for request 36 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 36 rlm_sql (sql): Processing sql_postauth radius_xlat: 'server2_user1' rlm_sql (sql): sql_set_user escaped user --> 'server2_user1' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'server2_user1', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'server2_user1', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 36 modcall: leaving group post-auth (returns ok) for request 36 Sending Access-Accept of id 22 to 10.10.1.3 port 2773 >* I have installed FreeRadius 1.1.0 as an authentication server for our sip *>* proxy, I am using MSN messenger and some other sip phone to test. *>* everything in my database is ok and I receive access packet by the sip *>* phones except MSN messenger , when I am using MSN mesenger , I receive *>* reject packet. * Run the server in debugging mode to see what's going wrong. Also, you might try using version 1.1.1, which has updates to the digest module. Alan DeKok. -- S.A.A

1 0