May 2006 - Freeradius-Users - lists.freeradius.org

MS-CHAP: what password backends can be used?
by Alain Fauconnet 11 May '06

11 May '06

Hello readers, I've browsed the FAQs, the mailing list archives but I have failed to find a definite, clear answer to this: what kind of user/password back-end can work if one is to support MS-CHAP? is anything storing crypt or MD5 passwords (/etc/passwd+shadow, NIS, LDAP) hopeless? (I suspect it is) I'm setting up a VPDN server on a Cisco AS5300 for Windows clients. It works fine if I use PAP and no encryption. If I want to use encryption, I need MS-CHAP, right? Right now my FreeRADIUS server is configured to use PAM. It runs on a box that is a NIS master, as well as a LDAP server with a directory built from NIS data using the well-known migration scripts (but FreeRADIUS doesn't talk to LDAP now). The master source of authentication is /etc/passwd and /etc/shadow, so passwords are in MD5 format. Is there any way I can get FreeRADIUS to handle MS-CHAP authentication requests from the Cisco box in this context? (i'm kind of expecting a big "no" here, but I want to be sure) If I'm not using Samba or a domain controller, do I need cleartext passwords to achieve this? where? in the "users" file only? In radiusd.conf, the "mschap" module has parameters for a Samba smpasswd format file or invoking ntlm_auth. If neither is set, where does it try to get the password from? I'm confused. Thanks for any reply, pointers etc. Greets, _Alain_

2 3

Re: Accounting - FramedIPAddress - DHCP/IPPOOL
by Walter Reynolds 11 May '06

11 May '06

So even though the AP must know the information, we are unable to get it into the radius accounting? We have to script the coordination between the DHCP server? ============================ Message: 4 Date: Wed, 10 May 2006 12:52:36 -0400 From: "Alan DeKok" <aland(a)nitros9.org> Subject: Re: Accounting - FramedIPAddress - DHCP/IPPOOL To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20060510165236.00C2F16CC1(a)mail.nitros9.org> mad <psymad(a)gmail.com> wrote: > I have a problem with the ip address ... because it's dhcpd who give an ip > address at the client, so freeradius can't have this information. Exactly. > I have try ippool in freeradius (freeradius want to give an ip address but > the client don't receive). Also I have read that it's impossible to use > ippool with eap and when there are access point and/or swith between client > and server ... it's true ? It's impossible to use ippool with EAP. > I have also try other solutions (with syslog-ng who get the ip address in > the log and insert in acct table ..., a scripts with omshell who permit to > freeradius to indicate at dhcpd what ip address give at this client ...) BUT > I think this solution are very unstable ... A well written DHCP server should be as flexible as FreeRADIUS, and allow you to write the IP to an SQL table. Unfortunately, there is no such DHCP server. Alan DeKok. -- Walter Reynolds University of Michigan

3 2

Accounting - FramedIPAddress - DHCP/IPPOOL
by mad 11 May '06

11 May '06

Hello, I have a freeradius server, I use an eap/ttls authentication with 802.1x and ldap. I want to save the username, the ip adress, the MAC address, the start time and the stop time of the connection with the accounting function (with mysql). I have a problem with the ip address ... because it's dhcpd who give an ip address at the client, so freeradius can't have this information. I have try ippool in freeradius (freeradius want to give an ip address but the client don't receive). Also I have read that it's impossible to use ippool with eap and when there are access point and/or swith between client and server ... it's true ? I have also try other solutions (with syslog-ng who get the ip address in the log and insert in acct table ..., a scripts with omshell who permit to freeradius to indicate at dhcpd what ip address give at this client ...) BUT I think this solution are very unstable ... What do you think about this ? Have you an other solution ? Sorry my english is rusty ... and thanks for your answers Regards, Psymad

4 5

Privileged Login on CISCO using freeradius and MySQL [Virus checked]
by thomas.pudil＠t-mobile.at 11 May '06

11 May '06

3 4

radius filters for ldap searching
by Mircea Harapu 11 May '06

11 May '06

Hello, I'm using freeradius 1.0.4 with openldap 2.2.24 to authenticate users on cisco switches. Every switch belongs to a specific group and for every user I'm setting the groups he can access. I also use cisco avpairs for level privilege. So far , so good! The problems occured when I tried to make a user to have different level privileges on different switches . This is the profile I'm using : # test, radius, isp.ro dn: uid=test,ou=radius,dc=isp,dc=ro uid: test objectClass: radiusprofile cn: test userPassword:: xxx radiusGroupName: bucuresti radiusGroupName: valcea radiusServiceType: NAS-Prompt-User # bucuresti, test, radius, isp.ro dn: cn=bucuresti,uid=test,ou=radius,dc=isp,dc=ro uid: test objectClass: radiusprofile userPassword:: xxx radiusGroupName: bucuresti radiusServiceType: NAS-Prompt-User radiusCiscoLevel: "shell:priv-lvl=15" cn: bucuresti # valcea, test, radius, isp.ro dn: cn=valcea,uid=test,ou=radius,dc=isp,dc=ro uid: test objectClass: radiusprofile userPassword:: xxx radiusGroupName: valcea radiusServiceType: NAS-Prompt-User radiusCiscoLevel: "shell:priv-lvl=7" cn: valcea raddb/users # Switch 192.168.50.202 # Descriere test DEFAULT NAS-IP-Address == 192.168.50.202, Ldap-Group == bucuresti Fall-Through = no DEFAULT Auth-Type := Reject what I need is to filter the ldap search in authorize section based on GroupName and I don't know how. -- ................................................................ Mircea Harapu Abuse Engineer, RDS NOC in Bucharest t: 021-301.08.50 f: 021-301.08.51 e: mircea.harapu(a)rcs-rds.ro w: www.rdslink.ro ................................................................ Privileged/Confidential Information may be contained in this message. If you are not the addressee indicated in this message (or responsible for delivery of the message to such person), you may not copy or deliver this message to anyone. In such a case, you should destroy this message and kindly notify the sender by reply e-mail.

1 0

RE: with_ntdomain_hack
by Chris Liles 11 May '06

11 May '06

You are right, it was that I was lowercasing the username before authentication... After I turned that off, I am getting further, it still doesn't work and I believe it is because of a problem with "Stripped-User-Name" and ntlm_auth ntlm_auth is getting called with the entire username "DOMAIN\user" and not "user" I don't understand why, as in the config file it says: --username=%{Stripped-User-Name:-%{User-Name:-None}} I didn't edit that part of the ntlm_auth line, just corrected the path.. I know this is a problem because when I use ntlm_auth from the command line I can't use --username=DOMAIN\user I have to use --username=user I hacked up the line to just say %{Stripped-User-Name} but that value must be null or something, because then ntlm_auth gets called with "--username=" Any thoughts as to why I can't get the DOMAIN\ stripped when calling ntlm_auth Thanks! -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309 -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of King, Michael Sent: Wednesday, May 10, 2006 3:39 PM To: FreeRadius users mailing list Subject: RE: with_ntdomain_hack > -----Original Message----- > I can't seem to figure out how to get with_ntdomain_hack set > correctly. > > I am trying to get peap going against active directory with winbind. > > It works if I enter in the username and password from the > windows supplicant prompt, but when I set the supplicant to > send the information automatically it is appending the > domain\ onto the username, and I can't get it to work? > I don't think it's the ntdomain hack that is the problem (It should be on, and I'm only aware of it being located in the radiusd.conf file, just above the ntlm_auth line I'd double check that your Samba config is correct. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Regarding on " radtest "
by raviprakash sunkara 11 May '06

11 May '06

Hi Everybody I'm working on openser + freeradius. Recently Installed both . I had a issue below onw, actual what this means... By Typing '" radtest 444 444 192.168.2.55 1812 radiustest " its shows below one. Sending Access-Request of id 236 to 192.168.2.55 port 1812 User-Name = "444" User-Password = "444" NAS-IP-Address = 255.255.255.255 Re-sending Access-Request of id 236 to 192.168.2.55 port 1812 User-Name = "444" User-Password = "444" NAS-IP-Address = 255.255.255.255 -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com

2 1

Ignoring request from unknown home server
by Jarrid Keller 10 May '06

10 May '06

Hi everyone, I am running freeradius version 1.0.4 on Fedora Core 4. I am trying to authenticate mt VPN users on my Cisco VPN concentrator to my ldap server. I am trying to use my radius server to proxy the authentication requests to the ldap server. After setting the radius server up and trying to authenticate a user, the radius server is giving me the following error. rad_recv: Access-Request packet from host 172.16.1.2:1042, id=10, length=71 Ignoring request from unknown home server 172.16.1.2:1042 I am fairly new to freeradius. What do I need to do to make this work. Any info is greatly appreciated. -Thanks Jarrid Keller

2 1

RE: Wildcards in Username and Passwd
by Jason Montgomery 10 May '06

10 May '06

You are correct about being able to sneeze and break into the network. But luckily all machines with that prefix will be placed into a Ethernet Only VLAN. The Devices with that prefix belong to a Ethernet based phone system (www.3com.com/nbx) so anyone who breaks into that vlan will only be able to see the broadcast Ethernet packets the phones are sending out occasionally. As a extra layer of security the phone system itself will only communicate with phones that have already been configured in its internal mac table list. Thanks for the help Jason -----Original Message----- From: freeradius-users-bounces+jmont=preferredtechnology.com(a)lists.freeradius. org [mailto:freeradius-users-bounces+jmont=preferredtechnology.com@lists.fre eradius.org] On Behalf Of Dennis Skinner Sent: Wednesday, May 10, 2006 3:54 PM To: FreeRadius users mailing list Subject: Re: Wildcards in Username and Passwd Jason Montgomery wrote: > Hello I have a customer who would like to have 100% MAC address lock > down on their network. To do that we are able to have the Ethernet > Switches Send the Device MAC address as the Username and password to the > Radius Server. The question I have is on the radius server is it > possible to set a wildcard so that any device showing "00-E0-BB" as the > MAC Address prefix will automatically be accepted then I can throw the > usual variables back at the port. If this is possible then I can avoid > having to enter 300 Devices into the Radius table. This may give you some ideas: http://wiki.freeradius.org/index.php/Adding%2C_Removing%2C_Modifying_Att ributes_for_further_processing But, I should warn you, that anyone wanting to break into your customers' network can sneeze and have a machine fake a MAC address. Hell, some Cisco equipment even have a builtin command to do it (handy for replacing/upgrading routers without messing up local ARP tables). Hopefully there is some other form of authentication. -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Freeradius radclient problem and sql dialupadmin question
by Eric Hilden 10 May '06

10 May '06

I have installed FreeRadius (latest version) to my system and all goes well until it gets to the rlm_* files. I have tried specifying the mysql directory at /usr/lib/mysql and it seemed to fix a few of those errors in the make process but then it just errors out. So I blew away that installation because I am really trying to get this working with mysql. This attempt I'm really trying to get working because I think the linker setups up the libs more correctly. Using Suse 10.0 doing a source rpm install and let it do all the magic. It installs everything to the /etc/raddb directory and other default directories, but now I am running into this issue. After the install is done I run "radiusd -x" for a test and everything is working and listening for requests. As soon as a add a user to the users.txt file and run radtest is where I get my errors. After running "*radtest steve testing localhost 1812 testing123"* I get the following. *radclient: dict_init: Couldn't open dictionary "/usr/local/etc/raddb/dictionary: No such file or directory. * I can however use the radclient -d command to switch make it switch directories. I have no idea why it is wanting to push to that directory. The installation put the dictionary in the following. */etc/raddb/dictionary *and */usr/share/freeradius/dictionary. *Is there a way to make it default to the */usr/share/freeradius/dictionary*? After running with the *"radtest -d /usr/share/freeradius/dictionary steve testing localhost 1812 testing123" *I get the accept message request from my test user. Furthermore looking at the file /etc/raddb/dictionary I see* $Include /usr/share/freeradius/dictionary* and looking at */usr/share/freeradius/dictionary *has all the include statements for the rest of the dictionary files. Where am I missing the configuration to change the default setting for where radclient is wanting to look? Why the using Yast configured it look there I have no clue but it seems like an easy fix. *SQL & Dialup Admin* *Questions?* --------------------------- 1.) In all the guides I have found you modify the sql.conf and radiusd.conf files to get it working. In my /etc/raddb directory however I have a mysql.conf file; do I need to use this file instead? 2.)(not really a question) Before hand I was getting all the rlm_*** errors but know using Yast I believe the linker is now having everything work. As what I have changed is the following. In radiusd.conf I changed under authorize and accounting, I uncommented out the sql parts and commented out the files part. And in sql.conf I changed my settings to locahost and my login information. Now when I run radiusd -x and I get ready to accept requests like everything is working with no errors and all my databases have connected. 3.) Dialup Admin problems I am experiencing. I know this isn't dialup admin forums/mailing list but I figured I would find the most help here. Find Users still seems to do nothing even when I create users through Dialup Admin. And when I go to edit users I get the following: Warning: main(password.php3) [function.main]: failed to open stream: No such file or directory in /srv/www/dialup_admin/lib/sql/password_check.php3 on line 2 Fatal error: main() [function.require]: Failed opening required 'password.php3' (include_path='/usr/share/php') in /srv/www/dialup_admin/lib/sql/password_check.php3 on line 2 I'm no php expert but I really couldn't find what would be wrong here? I have no password on dialupadmin currently. 4.) How exactly do I test if Dialup Admin is working correctly? Also is there any documentation someone could point me to with what all the values and fields mean. It seems a bit different than working with the text files. I didn't see a place from secret. So if someone could point me a guide/documention explaining this I would appreciate it. Thank you for your time reading this. Eric

2 2