May 2006 - Freeradius-Users - lists.freeradius.org

Freeradius and prepaid extension
by deborah malka 14 Aug '06

14 Aug '06

Hello all, I have heard about Freeradius, that it is a very powerfull server. Thank you to all for the work you have done !! I need a Radius server to perform prepaid VOIP telephony. For that the server must implement the RFCs 2865, 2866, 3539, and the extension for Prepaid follows the specifications : X.S0011-005-C and X.S0011-006-C. Does Freeradius implements all this ? I need these informations, because I have to install a platform demo, so if someone can help me ... thank you so much by advance. Deborah ================= Déborah Malka --------------------------------- Nouveau : téléphonez moins cher avec Yahoo! Messenger ! Découvez les tarifs exceptionnels pour appeler la France et l'international.Téléchargez la version beta.

6 11

Active directory and MS-CHAP Authentication.
by Antonio Matera 25 Jul '06

25 Jul '06

Hi, I have a problem with the authentication of active directory users on freeradius. I correctly set up samba and kerberos and if I write: # ntlm_auth --request-nt-key --domain=mydomain --username=myuser if I insert the correct password I receive the authentication ok. My problem is to configure the mschap module on freeradius. My mschap config is: mschap { auth-type = MS-CHAP with_ntdomain_hack = yes ntlm_auth ="/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } If I insert in the users file "DEFAULT Auth-Type := MS-CHAP", in the log file I read this error: rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NM-Password. rlm_mschap: No MS-CHAP-Challenge in the request If I remove the DAFAULT user in the users file in the log I can't find a mschap authentication and the user is reject. What is wrong? Thanks a lot Bye Antonio

7 19

Can you use TLS and Request users authentication as well
by Walter Reynolds 22 Jun '06

22 Jun '06

Hi, What I am trying to figure out is a way to not only have a certificate, but a secondary way to verify that that certificate is being used by a person we allow. If we put cert onto a machine, we have authenticated that the cert was trusted. The problem is coming from a university, we do not have a way to control a users machine. So a user could take that certificate and put it onto a friends machine. This friend may not be affiliated and should not have access. So I would like to use the cert as machine authentication and then follow up with another (username/pass) using the KRB module. Is this something that can be done? Has anyone run into a similar problem and what did they do? I know we could go TTLS and not have a machine cert, but then we get fears of man-in-the-middle. Thanks. -- Walter Reynolds University of Michigan

5 9

ntdomain_hack
by wekz 15 Jun '06

15 Jun '06

Hello everyone, I've configured a freeradius 1.1.1 + LDAP for eap-tls authentication with domains. authorize { preprocess ntdomain ... } realm host { type = radius authhost = LOCAL accthost = LOCAL strip } This configuration gives an error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. When I enable with_ntdomain_hack in eap.conf it works quite well. Could anyone tell me why it's neccesary? The problem is that this secondary_radius do proxy when it doesn't find the user in its LDAP and the master_radius gives this error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. I've tried in master_radius the same configuration with and without ntdomain_hack and it fails. I've been thinking of adding the realm before the secondary do proxy, so the master could treat the request as it's been local. But I don't like this too much. Does anyone have a better idea of what to do? Thanks.

4 4

Regarding VLAN attributes
by radhika putty 10 Jun '06

10 Jun '06

Hi.. When we use VLAN tunneled attributes how do we send the VLAN id value. For ex if i give a vlan group 10 when configuring the switch how do i pass that attribute in my program.In the value field I need to set it as 10 or VLAN10 --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

2 1

Another RPM build issue with version 1.1.1
by Sandworm 08 Jun '06

08 Jun '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello There appears to be a conflict with the Makefiles in the doc directories and the behaviour of RPM. With version 1.1.0, this was OK as they were both consistent, but are not with version 1.1.1. Now when the RPMs are built (on RHEL3 U6), the build bombs out with: RPM build errors: Installed (but unpackaged) file(s) found: /usr/share/doc/freeradius/Acct-Type /usr/share/doc/freeradius/Autz-Type /usr/share/doc/freeradius/CYGWIN /usr/share/doc/freeradius/ChangeLog /usr/share/doc/freeradius/DIFFS /usr/share/doc/freeradius/MACOSX etc... This is because the Makefiles in the doc directories have lines like this: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius whereas version 1.1.0 had lines like: $(INSTALL) -d -m 755 $(R)$(datadir)/doc/freeradius- $(RADIUSD_VERSION) RPMs %doc macro, however (AFAIK), uses the version in the path, and the documentation seems to say this too (from http://www.rpm.org/max-rpm-snapshot/s1-rpm-inside-files-list- directives.html, "When the package is installed, RPM creates a directory in the documentation directory named the same as the package (ie, <software>-<version>-<release>)"). This is what I am seeing during the RPM build - a relevant extract: Processing files: freeradius-1.1.1-0 Executing(%doc): /bin/sh -e /var/tmp/rpm-tmp.18818 + umask 022 + cd /usr/src/redhat/BUILD + cd freeradius-1.1.1 + DOCDIR=/var/tmp/freeradius-root/usr/share/doc/freeradius-1.1.1 + export DOCDIR Incidentally, apart from this, even if the Makefile/RPM conflict were resolved, not all files get copied into the doc directory, I think, and this was true with version 1.1.0 as well. The only files seen there are: ls /usr/share/doc/freeradius-1.1.0 ChangeLog COPYRIGHT INSTALL README todo To get the other files there, it would unfortunately need a more detailed list in the %files section of the SPEC file as shown below: %files %defattr(-,root,root) %doc doc/Acct-Type doc/Autz-Type doc/CYGWIN doc/ChangeLog doc/DIFFS doc/MACOSX %doc doc/OS2 doc/Post-Auth-Type doc/RADIUS-LDAP-eDirectory doc/RADIUS-SQL.schema %doc doc/README doc/Session-Type doc/Simultaneous-Use doc/aaa.txt doc/ascend %doc doc/bay doc/bugs doc/cisco doc/coding-methods.txt doc/configurable_failover %doc doc/duplicate-users doc/ldap_howto.txt doc/load-balance.txt doc/misc-nas %doc doc/module_interface doc/mssql doc/performance-testing doc/processing_users_file %doc doc/proxy doc/radrelay doc/release-method.txt doc/rfc/ doc/rlm* doc/supervise-radiusd.txt %doc doc/tuning_guide doc/variables.txt todo/ COPYRIGHT INSTALL Regards SW -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.5 wkYEARECAAYFAkQp19gACgkQmw4BJyaatJ3xhgCgsjwbq8mP6XhQpsqSTLCBFena9fUA nAvGkYPRHnlRzCnV+FMt5R6F5lOm =jS3p -----END PGP SIGNATURE-----

4 3

How the hell do you use multiple NOT values with rlm_checkval and sql??
by Mike Jakubik 04 Jun '06

04 Jun '06

Ok, so after much frustration someone finally pointed out that using multiple values with checkval and sql is possible wen using the += OP. Great, now, how the heck do you specify NOT items? I want to specify the numbers that users can NOT dial to. This seems impossible. I have tried regexp, and using the !=, !~ OPS, none of the methods seem to work. I never knew Radius's configuration would be so frustrating... I'm ready to start pulling my hair out, someone please save my hair!

2 6

Auth-Type = System not working
by Maillists 02 Jun '06

02 Jun '06

Hi, I've read the freeradius-users achives and found that other people have problems when using Freeradius on an OS which uses a shadow password file. I too have encountered such problems and have found why this problem occurs but require assistance to fix. Here's a recap of the problem: Auth-Type = Local works fine but Auth-Type = System does not. OS: FreeBSD 6.0 running Freeradius-1.1.1 installed from ports collection users file contents: DEFAULT Auth-Type = System Reply-Message = "System password works" Running radiusd -X produces (see below for greater detail) rlm_unix: [test]: invalid password but I know 100% that the password is correct. What appears to be happening (determined from hours of frustrating testing) is Freeradius (rlm_unix) is looking for the users passwords in the /etc/passwd file but my /etc/passwd file doesn't contain any passwords: test:*:1003:1003:Test User:/home/test:/bin/sh my /etc/master.passwd file does: test:$1$RlHYm4Ca$QhlYcYV7BqIjTF.UQ4pTX/:1003:1003::0:0:Test User:/home/test:/bin/sh if I copy the encrypted password from /etc/master.passwd and replace the "*" in /etc/passwd I can successfully authenticate via Auth-Type = System Login OK: [test] (from client localhost port 0) (more detail below) ******* So my question is what do I need to do so I don't have to manually replace the "*" in /etc/passwd with the encrypted password from /etc/master.passwd for every user I enter in the system? ******* TIA, Shane Output of radiusd -X when /etc/passwd contains "*" for password rad_recv: Access-Request packet from host 127.0.0.1:52869, id=153, length=53 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 688 modcall[authorize]: module "preprocess" returns ok for request 688 radius_xlat: '/var/log/radacct/127.0.0.1/auth-detail-20060531' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-detail-20060531 modcall[authorize]: module "auth_log" returns ok for request 688 modcall[authorize]: module "chap" returns noop for request 688 modcall[authorize]: module "mschap" returns noop for request 688 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 688 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 688 users: Matched entry DEFAULT at line 13 modcall[authorize]: module "files" returns ok for request 688 modcall: leaving group authorize (returns ok) for request 688 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 688 rlm_unix: [test]: invalid password modcall[authenticate]: module "unix" returns reject for request 688 modcall: leaving group authenticate (returns reject) for request 688 auth: Failed to validate the user. Login incorrect: [test/test] (from client localhost port 0) Delaying request 688 for 1 seconds Finished request 688 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 153 to 127.0.0.1 port 52869 Reply-Message = "System password works" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 688 ID 153 with timestamp 447e1534 Nothing to do. Sleeping until we see a request. Output of radiusd -X when /etc/passwd contains encrypted password instead of "*" rad_recv: Access-Request packet from host 127.0.0.1:55703, id=181, length=53 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radacct/127.0.0.1/auth-detail-20060531' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-detail-20060531 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 13 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 radius_xlat: 'System password works' Login OK: [test] (from client localhost port 0) Sending Access-Accept of id 181 to 127.0.0.1 port 55703 Reply-Message = "System password works" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 181 with timestamp 447e1744 Nothing to do. Sleeping until we see a request.

3 4

EAP (PEAP) problems
by Drew Linsalata 01 Jun '06

01 Jun '06

This is freeradius 1.1.1 with a Proxim/Orinoco AP700. We're configured to use PEAP. We seem to be hung up on the EAP start from the AP. Here's some log output. Note the "No EAP Start" part, which I think tells us that the AP isn't relaying the EAP Start properly from the supplicant. Any feedback from the gurus? (-: rad_recv: Access-Request packet from host ***.***.***.***:6001, id=22, length=154 User-Name = "testtwo" NAS-IP-Address = ***.***.***.*** Called-Station-Id = "00-20-a6-5d-9c-d1:ourtestssid" Calling-Station-Id = "00-20-a6-4c-16-7f" NAS-Identifier = "ORiNOCO-AP-700-5d-9c-d1" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000c017465737474776f Message-Authenticator = 0x62af36a7da3b8f655c8a9cda6dba34eb Wed May 31 13:50:59 2006 : Debug: Processing the authorize section of radiusd.conf Wed May 31 13:50:59 2006 : Debug: modcall: entering group authorize for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 3 Wed May 31 13:50:59 2006 : Debug: rlm_realm: No '@' in User-Name = "testtwo", looking up realm NULL Wed May 31 13:50:59 2006 : Debug: rlm_realm: No such realm "NULL" Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 3 Wed May 31 13:50:59 2006 : Debug: rlm_eap: EAP packet type response id 4 length 12 Wed May 31 13:50:59 2006 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "eap" returns updated for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 3 Wed May 31 13:50:59 2006 : Debug: users: Matched entry testtwo at line 2 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "files" returns ok for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 3 Wed May 31 13:50:59 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 3 Wed May 31 13:50:59 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 3 Wed May 31 13:50:59 2006 : Debug: modcall: leaving group authorize (returns updated) for request 3 Wed May 31 13:50:59 2006 : Debug: rad_check_password: Found Auth-Type Accept Wed May 31 13:50:59 2006 : Debug: rad_check_password: Auth-Type = Accept, accepting the user Wed May 31 13:50:59 2006 : Auth: Login OK: [testtwo/<no User-Password attribute>] (from client testAP port 0 cli 00-20-a6-4c-16-7f) Sending Access-Accept of id 22 to ***.***.***.*** port 6001 Wed May 31 13:50:59 2006 : Debug: Finished request 3 Wed May 31 13:50:59 2006 : Debug: Going to the next request Wed May 31 13:50:59 2006 : Debug: --- Walking the entire request list --- Wed May 31 13:50:59 2006 : Debug: Waking up in 6 seconds... Wed May 31 13:51:05 2006 : Debug: --- Walking the entire request list --- Wed May 31 13:51:05 2006 : Debug: Cleaning up request 3 ID 22 with timestamp 447dd783 Wed May 31 13:51:05 2006 : Debug: Nothing to do. Sleeping until we see a request. -- Drew Linsalata The Gotham Bus Company, Inc. Dedicated Servers and Colocation Solutions Long Island, New York http://www.gothambus.com

3 4

OSX rlm_sql_mysql problem
by Benedikt Baer 31 May '06

31 May '06

Hi, I am trying to compile FreeRadius 1.1.1 on Mac OSX. The ./configure script works well and without errors (as far as I can see) First, when I do make, it finishes good but shows an error: *** Warning: This library needs some functionality provided by -lmysqlclient_r. *** I have the capability to make that library automatically link in when *** you link to this library. But I can only do this if you have a *** shared version of the library, which you do not appear to have. *** Warning: libtool could not satisfy all declared inter-library *** dependencies of module rlm_sql_mysql. Therefore, libtool will create *** a static module, that should work as long as the dlopening *** application is linked with the -dlopen flag. Then, starting freeradius: Fri May 26 13:16:13 2006 : Info: Starting - reading configuration files ... Fri May 26 13:16:14 2006 : Info: Using deprecated naslist file. Support for this will go away soon. Fri May 26 13:16:15 2006 : Error: rlm_sql (sql): Could not link driver rlm_sql_mysql: dlcompat: invalid handle Fri May 26 13:16:15 2006 : Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. Fri May 26 13:16:15 2006 : Error: radiusd.conf[14]: sql: Module instantiation failed. Fri May 26 13:16:15 2006 : Error: radiusd.conf[1585] Unknown module "sql". The mysql libs and headers are in: /usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib/ /usr/local/mysql-max-5.0.21-osx10.3-powerpc/include/ mysql_config: --cflags [-I/usr/local/mysql-max-5.0.21-osx10.3-powerpc/include -O -fno-common] --include [-I/usr/local/mysql-max-5.0.21-osx10.3-powerpc/include] --libs [-L/usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib -lmysqlclient -lz -lm] --libs_r [-L/usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib -lmysqlclient_r -lz -lm] --socket [/tmp/mysql.sock] --port [3306] --version [5.20.21] --libmysqld-libs [-L/usr/local/mysql-max-5.0.21-osx10.3-powerpc/lib -lmysqld -lz -lm] I also tired to copy, link, move various files but it didn't help. Any ideas?? Thanks for your help.

4 11