May 2006 - Freeradius-Users - lists.freeradius.org

Wildcards in Username and Passwd
by Jason Montgomery 10 May '06

10 May '06

Hello I have a customer who would like to have 100% MAC address lock down on their network. To do that we are able to have the Ethernet Switches Send the Device MAC address as the Username and password to the Radius Server. The question I have is on the radius server is it possible to set a wildcard so that any device showing "00-E0-BB" as the MAC Address prefix will automatically be accepted then I can throw the usual variables back at the port. If this is possible then I can avoid having to enter 300 Devices into the Radius table. Thanks in Advance Jason Montogmery

2 1

RE: with_ntdomain_hack
by Chris Liles 10 May '06

10 May '06

I changed the username portion to what you suggested and it works :) Thanks! -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309 -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of King, Michael Sent: Wednesday, May 10, 2006 4:12 PM To: FreeRadius users mailing list Subject: RE: with_ntdomain_hack Try this ntlm_auth string (Watch for page breaks in email) ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challeng e} --nt-response=%{mschap:NT-Response} > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Chris Liles > Sent: Wednesday, May 10, 2006 3:51 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > You are right, it was that I was lowercasing the username > before authentication... > After I turned that off, I am getting further, it still > doesn't work and I believe it is because of a problem with > "Stripped-User-Name" and ntlm_auth > > ntlm_auth is getting called with the entire username > "DOMAIN\user" and not "user" I don't understand why, as in > the config file it says: > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > I didn't edit that part of the ntlm_auth line, just corrected > the path.. > I know this is a problem because when I use ntlm_auth from > the command line I can't use --username=DOMAIN\user I have to > use --username=user > > I hacked up the line to just say %{Stripped-User-Name} but > that value must be null or something, because then ntlm_auth > gets called with "--username=" > > Any thoughts as to why I can't get the DOMAIN\ stripped when > calling ntlm_auth > > Thanks! > > -- > Chris Liles > System Analyst > Air2Web, Inc. > 1230 Peachtree St. N.E. > 12th Floor > Atlanta, GA 30309 > > > -----Original Message----- > From: > freeradius-users-bounces+chris.liles=air2web.com(a)lists.freerad > ius.org > [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists > .freeradius.org] On Behalf Of King, Michael > Sent: Wednesday, May 10, 2006 3:39 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > > > > -----Original Message----- > > I can't seem to figure out how to get with_ntdomain_hack set > > correctly. > > > > I am trying to get peap going against active directory with winbind. > > > > It works if I enter in the username and password from the windows > > supplicant prompt, but when I set the supplicant to send the > > information automatically it is appending the domain\ onto the > > username, and I can't get it to work? > > > > > I don't think it's the ntdomain hack that is the problem (It > should be on, and I'm only aware of it being located in the > radiusd.conf file, just above the ntlm_auth line > > I'd double check that your Samba config is correct. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: with_ntdomain_hack
by King, Michael 10 May '06

10 May '06

Try this ntlm_auth string (Watch for page breaks in email) ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challeng e} --nt-response=%{mschap:NT-Response} > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Chris Liles > Sent: Wednesday, May 10, 2006 3:51 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > You are right, it was that I was lowercasing the username > before authentication... > After I turned that off, I am getting further, it still > doesn't work and I believe it is because of a problem with > "Stripped-User-Name" and ntlm_auth > > ntlm_auth is getting called with the entire username > "DOMAIN\user" and not "user" I don't understand why, as in > the config file it says: > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > I didn't edit that part of the ntlm_auth line, just corrected > the path.. > I know this is a problem because when I use ntlm_auth from > the command line I can't use --username=DOMAIN\user I have to > use --username=user > > I hacked up the line to just say %{Stripped-User-Name} but > that value must be null or something, because then ntlm_auth > gets called with "--username=" > > Any thoughts as to why I can't get the DOMAIN\ stripped when > calling ntlm_auth > > Thanks! > > -- > Chris Liles > System Analyst > Air2Web, Inc. > 1230 Peachtree St. N.E. > 12th Floor > Atlanta, GA 30309 > > > -----Original Message----- > From: > freeradius-users-bounces+chris.liles=air2web.com(a)lists.freerad > ius.org > [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists > .freeradius.org] On Behalf Of King, Michael > Sent: Wednesday, May 10, 2006 3:39 PM > To: FreeRadius users mailing list > Subject: RE: with_ntdomain_hack > > > > > -----Original Message----- > > I can't seem to figure out how to get with_ntdomain_hack set > > correctly. > > > > I am trying to get peap going against active directory with winbind. > > > > It works if I enter in the username and password from the windows > > supplicant prompt, but when I set the supplicant to send the > > information automatically it is appending the domain\ onto the > > username, and I can't get it to work? > > > > > I don't think it's the ntdomain hack that is the problem (It > should be on, and I'm only aware of it being located in the > radiusd.conf file, just above the ntlm_auth line > > I'd double check that your Samba config is correct. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

RE: with_ntdomain_hack
by King, Michael 10 May '06

10 May '06

> -----Original Message----- > I can't seem to figure out how to get with_ntdomain_hack set > correctly. > > I am trying to get peap going against active directory with winbind. > > It works if I enter in the username and password from the > windows supplicant prompt, but when I set the supplicant to > send the information automatically it is appending the > domain\ onto the username, and I can't get it to work? > I don't think it's the ntdomain hack that is the problem (It should be on, and I'm only aware of it being located in the radiusd.conf file, just above the ntlm_auth line I'd double check that your Samba config is correct.

1 0

with_ntdomain_hack
by Chris Liles 10 May '06

10 May '06

I can't seem to figure out how to get with_ntdomain_hack set correctly. I am trying to get peap going against active directory with winbind. It works if I enter in the username and password from the windows supplicant prompt, but when I set the supplicant to send the information automatically it is appending the domain\ onto the username, and I can't get it to work? Where is the 1 place (or places) to set "with_ntdomain_hack =yes" to get the supplicant's auto settings to work? Thanks! -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309

1 0

Regarding on radiusd.conf file
by raviprakash sunkara 10 May '06

10 May '06

Hello Everybody, I'm working on openser, recently I install freeradius for "AAA". By seeing the Documentation from " http://openser.org/docs/openser-radius-1.0.x.html " I followed that. While testing the radius server by ' radiusd -X " its shows radiusd.conf[1840] unknown Auth-type " Digest" in authenticate section ---> what its means. And also By Typing '" radtest 444 444 192.168.2.55 1812 radiustest " its shows below one. Sending Access-Request of id 236 to 192.168.2.55 port 1812 User-Name = "444" User-Password = "444" NAS-IP-Address = 255.255.255.255 Re-sending Access-Request of id 236 to 192.168.2.55 port 1812 User-Name = "444" User-Password = "444" NAS-IP-Address = 255.255.255.255 What its means one . Is it error ? I run this in my box . where in my box installed openser , freeradius and radiusclinet-ng.. Please help me and main thing is, Is any mistakes in my english please excuse me.. -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) ravi.sunkara(a)hyperion-tech.com Hyperion Technology www.hyperion-tech.com

2 1

Solaris 8/SPARC - MySQL 5.0 NDB Cluster - Freeradius 1.1.1 withrlm_sqlippool module: 'radiusd' segmentation fault
by Robles Rodriguez,Alejandro 10 May '06

10 May '06

Hi, The purpose of this mail is to give you an insight on some stuff I've been trying at work (playing some could argue) that I'd like to share in case it could be useful to any of you out there. I won't describe all the issues I've had during the compilation, configuration and functional/performance testing nor ask you for help but rather just describe what I've done and document one of the last problems I had which kept me awake a few nights (segmentation fault). I have for the past 4 weeks been trying to evaluate if FreeRadius can be used as a AAA in an UMTS network with a large amount of subscribers for the GPRS Data services. With "if it can be used" I mean essentially if it can handle: (1) Functionality: basic Authentication/Authorization/Accounting, IP Address allocation and some GPRS attribute to IP Address mapping storage. (2) High Availability (no single point of failure HW/SW) (3) Distributed Architecture (performance target of 250 requests/second peak hour at a reasonable HW/SW cost) For the purpose of this test I have decided to use (32 bit due to problems getting it to compile with 64 bit on SPARC with the distributed binaries from MySQL): (a) Solaris 8 on SPARC (selected due to the fact that these machines were pretty much idle at my company similar tests were run on x86 PCs based on Fedora Linux Core 4). (b) MySQL 5.0.21 (MAX version) 32 bit SPARC binary distribution. (c) Freeradius 1.1.1 (originally with 1.1.0 but due to bugs on the Dictionary and thanks to recommendation (mail archives) from Alan DeKok I upgraded. (d) For IP allocation I'm using the rlm_sqlippool module (hard to tell its version because it's not version controlled as far as I could see, I got it from a Russian website) as per Alan DeKok's recommendation (mail archives). It will require some customization as I'm looking into being able to define IP pools as being comprised of several (not just one) start/end IP ranges. The test bed is basically two physical nodes each running the same software i.e. radiusd, mysqld and ndbd (MySQL clustered storage engine process). The NAS (in UMTS these are called GGSN) will load-balance the requests (directly or through an IP Load Balancer or even a freeradius proxy haven't decided yet which). This configuration allows vertical (bigger machines) and horizontal (more machines) scalability by adding more CPU:s or extra nodes to the cluster respectively for improved performance. I have tested the vertical scalability and it's linear with the CPU utilization. The horizontal will be tested in the coming days (hard to get hold of the required HW for the tests). I will publish some results (more quantitative than this email) then. Last but not least (and in connection to the subject of this email) one bug I found on the rlm_sqlippool that I have (as I mentioned hard to tell its version) is that during load testing and given the right circumstances (multiple NAS, Solaris architecture, MySQL Cluster storage engine only and high CPU utilization) I was getting a core dump of the 'radiusd' process. The problem was during the post-authorization phase of the sqlippool module on the 'allocate-find' SQL statement result retrieval due to the fact that the expected result row (just one expected with just one field containing the IP address to allocate) had invalid memory references (a row is modelled as an array of references to result columns and the only reference was invalid and therefore causing a segmentation fault to happen). Looking at the code and debugging it for a while I noticed that the memory holding the result set was being released before it was being used (though previously a reference to the first and only row had been kept) hence causing unpredictable results. Anyhow the code changes to fix this was to simply move the 'sql_finish_select_query' function call (which indirectly calls the MySQL function 'mysql_free_result' to release memory allocated to the result set) a few lines down the 'sqlippool_query1' function which is the one retrieving the IP Address to be allocated in 'rlm_sqlippool.c' file. See below for details: 1 /* 2 * Query the database expecting a single result row 3 */ 4 static int sqlippool_query1(char * out, int outlen, const char * fmt, SQLSOCK * sqlsocket, void * instance, REQU 5 EST * request, char * param, int param_len) 6 { 7 rlm_sqlippool_t * data = (rlm_sqlippool_t *) instance; 8 char expansion[MAX_STRING_LEN * 4]; 9 char query[MAX_STRING_LEN * 4]; 10 SQL_ROW row; 11 int r; 12 13 sqlippool_expand(expansion, sizeof(expansion), fmt, instance, param, param_len); 14 15 /* 16 * Do an xlat on the provided string 17 */ 18 if (request) { 19 if (!radius_xlat(query, sizeof(query), expansion, request, NULL)) { 20 radlog(L_ERR, "sqlippool_command: xlat failed."); 21 out[0] = '\0'; 22 return 0; 23 } 24 } 25 else { 26 strcpy(query, expansion); 27 } 28 29 #if 0 30 DEBUG2("sqlippool_query1: '%s'", query); 31 #endif 32 33 if (rlm_sql_select_query(sqlsocket, data->sql_inst, query)){ 34 radlog(L_ERR, "sqlippool_query1: database query error"); 35 out[0] = '\0'; 36 return 0; 37 } 38 39 r = rlm_sql_fetch_row(sqlsocket, data->sql_inst); 40 41 if (r) { 42 DEBUG("sqlippool_query1: SQL query did not succeed"); 43 out[0] = '\0'; 44 return 0; 45 } 46 47 row = sqlsocket->row; 48 if (row == NULL) { 49 DEBUG("sqlippool_query1: SQL query did not return any results"); 50 out[0] = '\0'; 51 return 0; 52 } 53 54 if (row[0] == NULL){ 55 DEBUG("sqlippool_query1: row[0] returned NULL"); 56 out[0] = '\0'; 57 return 0; 58 } 59 60 r = strlen(row[0]); 61 if (r >= outlen){ 62 DEBUG("sqlippool_query1: insufficient string space"); 63 out[0] = '\0'; 64 return 0; 65 } 66 67 strncpy(out, row[0], r); 68 out[r] = '\0'; 69 70 (data->sql_inst->module->sql_finish_select_query)(sqlsocket, data->sql_inst->config); 71 72 return r; 73 } Line number 70 was originally right after 39 (after keeping a reference to the first (and only) result row. The problem is that the row is a reference to references to memory allocated by the MySQL C API, which gets released whenever the 'mysql_free_result' function gets called, but the problem it only popped up under certain conditions hard to re-create. I'm done for now more details will come later meanwhile I have a question: is the rlm_sqlippool module going to be part of a freeradius release in the near future and if not, what would it be the procedure to follow for it to happen? Thanks and hope I didn't take so much of your time if you have read the whole thing! Cheers, Alex.

2 1

clients.conf file in MYSQL DB? [Virus checked]
by thomas.pudil＠t-mobile.at 10 May '06

10 May '06

Hi, I just set up freeradius1.1.1 with MySQL and startet some basic tests - first question I ran into was: Can I (I assume I can) "force" freeradius not to use the "clients.conf" file for checkinf for known clients, but put this information into MySQL? (I assume this would be in the "nas" table of the radius-db) I think it should be done in the radiusd.conf file in the "Clients configuration" section, that currently looks like that: # CLIENTS CONFIGURATION # # Client configuration is defined in "clients.conf". # # The 'clients.conf' file contains all of the information from the old # 'clients' and 'naslist' configuration files. We recommend that you # do NOT use 'client's or 'naslist', although they are still # supported. # # Anything listed in 'clients.conf' will take precedence over the # information from the old-style configuration files. # $INCLUDE ${confdir}/clients.conf what should I state here? thank you thomas

3 3

FreeRadius + MySQL & Encrypted passwords
by Bogdan Dumitriu - Technical Support Team 10 May '06

10 May '06

Hi all, I've been trying to encrypt the passwords in mySQL using SHA1 or MD5 without any luck for the last several days. First let me tell you a bit about our system: RedHat ES 4 freeradius-1.0.1-2.RHEL4 freeradius-mysql-1.0.1-2.RHEL4 mysql-server-4.1.7-4.RHEL4.1 mysql-4.1.7-4.RHEL4.1 Everything works fine with clear text passwords and if I use Unix Crypt. This is the config that works with Unix Crypt: radcheck +-----+------------+---------------+----+------------------------------- ---------------------------+ | id | UserName | Attribute | op | Value | +-----+------------+---------------+----+------------------------------- ---------------------------+ | 844 | bogdan | Crypt-Password | == | 55MCU5TXMoKsA | +-----+------------+---------------+----+------------------------------- ---------------------------+ usergroup +-----+------------+-------------+ | id | UserName | GroupName | +-----+------------+-------------+ | 844 | bogdan | adsl-static | +-----+------------+-------------+ radgroupcheck +----+-------------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-------------+-----------+----+-------+ | 1 | adsl | Auth-Type | := | PAP | | 2 | adsl-static | Auth-Type | := | PAP | radius.conf ------------- ........................... modules { .................. pap { encryption_scheme = crypt } .................... } authenticate { .............. Auth-Type PAP { pap } ............... } This works perfect ! now I want to use MD5 or SHA1 so I change: pap { encryption_scheme = sha1 (or md5) } and this is what I get in /usr/sbin/radiusd -X modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "shipcoadsl" with password test rlm_pap: Crypt-Password attribute but encryption scheme is not set to CRYPT modcall[authenticate]: module "pap" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 if I change: +-----+------------+---------------+----+------------------------------- ---------------------------+ | id | UserName | Attribute | op | Value | +-----+------------+---------------+----+------------------------------- ---------------------------+ | 844 | bogdan | Crypt-Password | == | {md5} password | +-----+------------+---------------+----+------------------------------- ---------------------------+ to: +-----+------------+---------------+----+------------------------------- ---------------------------+ | id | UserName | Attribute | op | Value | +-----+------------+---------------+----+------------------------------- ---------------------------+ | 844 | bogdan | User-Password | == | {md5} password | +-----+------------+---------------+----+------------------------------- ---------------------------+ and this is what I get: rlm_sql (sql): No matching entry in the database for request from user [shipcoadsl] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [shipcoadsl/test] (from client TestNAS2 port 0) I also tried changing: radgroupcheck +----+-------------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-------------+-----------+----+-------+ | 1 | adsl | Auth-Type | := | PAP | to: radgroupcheck +----+-------------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-------------+-----------+----+-------+ | 1 | adsl | Auth-Type | := | MD5 | then add: authenticate { .............. Auth-Type MD5 { pap } ............... } an I got exactly the same answer as before! Tried adding to the radgroupreply: | 26 | adsl-static | Auth-Type | := | PAP | 0 | but still no luck! Is this a bug? What am I missing? Your help will be greatly appreciated! Thanks, Bogdan.

4 10

Automatic redirection
by Nick Marino 10 May '06

10 May '06

Is there a way to redirect a authenticated user to a specific web address depending on there login information? Nick Marino - IT Solutions

7 13