May 2006 - Freeradius-Users - lists.freeradius.org

Missing User-Name attribute causing a segfault in attr_rewrite
by Dennis Skinner 05 May '06

05 May '06

Hello, I finally got around to upgrading our RADIUS servers to FR 1.1.1. Everything is working well except we seem to have a customer somewhere who is able to attempt to auth without sending a User-Name attribute and a blank User-Password. I'm not sure at this point if it is an attempted exploit or just a badly coded client. Here is an attempt: --- Walking the entire request list --- Cleaning up request 1 ID 88 with timestamp 44512aa3 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host xxx.xxx.xxx.xxx:21674, id=218, length=203 Framed-Protocol = PPP User-Password = "" Calling-Station-Id = "##########" Called-Station-Id = "##########" NAS-Port-Type = Async Cisco-NAS-Port = "Async172" NAS-Port = 172 Connect-Info = "28800/26400 V34+/V44/LAPM (53333/26400)" Cisco-AVPair = "v92-info=V.92 QC MOH/QC Full Train Success/0/0" Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 2 rlm_attr_rewrite: Could not find value pair for attribute Realm modcall[authorize]: module "fix_realm" returns noop for request 2 The very next line is the segfault. Here is my "fix_realm" module: attr_rewrite fix_realm { attribute = Realm searchin = packet searchfor = "blue.*$$" replacewith = "bluefrog.com" ignore_case = yes new_attribute = no max_matches = 1 append = no } (we used to use both bluefrognet.net and bluefrog.biz, so this attempts to normalize everyone since the username in the db is always user(a)bluefrog.com) I think the fact that there is no realm may be causing the segfault. Unfortunately, I have no idea how to recreate the situation myself and I have yet to try to track down the customer. I didn't see this problem listed on bugs.freeradius.org and don't recall seeing mention of it on the list. The other thing I changed in the authorize section of the config file is that I moved the suffix (and fix_realm) higher in the list (as you can probably tell from the debug output). Here is my authorize section: authorize { suffix fix_realm preprocess chap mschap eap files redundant { # slave first sql2 sql1 handled } } My old config wasn't using huntgroups, so I didn't need to fix_realm before preprocessing. I need to do that now, hence suffix and fix_realm are at the top. I will continue to dig at this problem from my end, but I thought maybe Alan or someone could modify radclient to send a packet like above and see if they can recreate the bug (or better yet, have a look at the code and go, "oh yeah, that is why that happened"). My C coding skills have all but rusted solid at this point. Let me know if you need any more information. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

3 6

freeradius + ldap
by ludovic cailleau 05 May '06

05 May '06

Good morning, I have made an authentification 802.11x with Freeradius and his user file. Now I would like to use Ldap. I have made a configuration but it does not run. Have you got a procedure of the configuration of Freeradius and Ldap? thank --------------------------------- Faites de Yahoo! votre page d'accueil sur le web pour retrouver directement vos services préférés : vérifiez vos nouveaux mails, lancez vos recherches et suivez l'actualité en temps réel. Cliquez ici.

3 11

VLAN Mapping with MS-CHAP
by robiwan＠arcor.de 05 May '06

05 May '06

Dear all, I try to put my Windows-XP-Clients in different VLANs on my Cisco Catalyst 3750 Switch, depending on their Account. And i use two differnt authentication methods: MD5-Challange and MS-CHAP. User hugo should be mapped in VLAN 50 and authenticated via MD5-Challange User roka at Domain WINLAB should be mapped in VLAN 40 and authenticated via MS-CHAP Now both authentication works (thanks to all again) but i have difficulties to map user roka in his right VLAN. Here is my users file: -----------------------snip------------------------ hugo User-Password == "hugo01" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 50 roka Auth-Type := MS-CHAP Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 ---------------------snap-------------------------- Here is the output of my radiusd with user hugo The Cisco-Switch map user hugo in VLAN 50: Login OK: [hugo/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-5D-84-AE-CA) Sending Access-Accept of id 210 to 10.187.0.15 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "50" EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "hugo" Finished request 1 Going to the next request Here is the output with user roka The Cisco-Switch map user roka in VLAN 1, and NOT in VLAN 40, i miss the Tunnel informations: Login OK: [WINLAB\\roka/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-AA-84-AE-CA) Sending Access-Accept of id 220 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0x70235fcdc1bc208578d0a26edb3c6d0b09f7cb712d4e9b66e7b2bea5b159c4f2 MS-MPPE-Send-Key = 0x6208fd4f8c1d2cd07a5e4597c98707dc70c94f29898eb0672e4572808efbd13d EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "WINLAB\\roka" Finished request 9 Going to the next request So, any ideas what to do, that for user roka my radiusd also say to my Switch the Tunnel things: Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "40" Thanks in advance Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

audiocodes dictionary
by Guido 04 May '06

04 May '06

Hi everybody, Im using freeradius 1.1.0 and an Audiocodes as NAS. Audiocodes is sending some parameters accounting as Vendor-4923-Attr-XX. Here an example: rad_recv: Accounting-Request packet from host 192.1.1.1:1813, id=2, length=297 Acct-Session-Id = "1288892787" NAS-IP-Address = 192.1.1. NAS-Port-Type = Async Acct-Status-Type = Start Vendor-4923-Attr-25 = 0x683332332d73657475702d74696d653d Vendor-4923-Attr-33 = 0x683332332d67772d69643d Vendor-4923-Attr-1 = 0x683332332d696e636f6d696e672d636f6e662d69643d3334333533393335203337333233363332203330333233313332203330333033303332 Vendor-4923-Attr-27 = 0x683332332d63616c6c2d747970653d564f4950 Vendor-4923-Attr-26 = 0x683332332d63616c6c2d6f726967696e3d416e73776572 Called-Station-Id = "043353612323" Calling-Station-Id = "2135866293" Vendor-4923-Attr-24 = 0x683332332d636f6e662d69643d3334333533393335203337333233363332203330333233313332203330333033303332 I suspect the problem is I don't have a dictionary for Audiocodes. If it is the problem, can somebody tell me where can I find it ? If not, can somebody give an idea? Thanks in advanced, Guido

2 1

Freeradius config rlm_sqlcounter.so missing
by Andrew Belling 04 May '06

04 May '06

I have now after a lot of reading and searching managed to configure my freeradius server to my needs(auth for wireless hotspot) however a required libary module "rlm_sqlcounter.so" has not been installed with the RPM used to install. System info: fedoracore 5 fedoracore RPM freeradius-1.0.5 fedoracore RPM freeradius_sql-1.0.5 now after modyfiyng all the config files as required to authenticate using a mysql db all test work, then after making the final config changes to use the module rlm_sqlcounter to support the time limits the folowing shows in my radiusd.log "Error: radiusd.conf[1] Failed to link to module 'rlm_sqlcounter': rlm_sqlcounter.so: cannot open shared object file: No such file or directory" So after finding the dir where radiusd looks for it's library modules rlm_sqlcounter.so was not there, all the other rlm_sql.so were so after a few mor hours googling found that i needed to make the file so i downloaded the sorce code for ver 1.0.5 from freeradius.org found the rlm_sqlcounter folder containing the files needed to make the .so file. however am having problems doing so. What i am doing is: ./configure also tryed sh configure make make install as described in a email found in the archive of this list. Here are the responses i received: # sh configure loading cache ./config.cache checking for gcc... no checking for cc... no configure: error: no acceptable cc found in $PATH Any help will be gratefully received as this is slowly moving from a fun challenge to a annoying task. Regards Andrew

2 1

Password in auth-detail file
by Axel Seguin 04 May '06

04 May '06

Hi everyone, I am using Freeradius with LDAP. I use EAP-TTLS for authentication with PAP (the passwords in LDAP being crypted). In the ldap.conf file I have : log_auth_badpass = no log_auth_goopass = no But I still see the user password in clear text in the auth-detail file. I am sorry if this is a silly question but I have been trying to find a solution for quite a while now and still haven't found anything. Is it possible to make sure the passwords are not stored in the auth- detail files? Or does it have to be like this? Thank you all in advance.

3 2

dialup_admin blank pages
by rabbtux rabbtux 04 May '06

04 May '06

All, Not to sound like a nubie, but I spent the day researching & working on this issue. My dialup_admin package has the standard "blank pages", and does not report errors. I've checked apache,mysql, and freeradius log files. I configured dialup_admin to use mysql database and all. First I did a debian install of freeradius and freeradius-dialupadmin packages. All the apache and php dependencies were met, as I installed & used phpmyadmin. Later I wiped out the binaries and did a fresh source build and install. I have the mysql -> freeradius working, as I can manually put user/password in the proper mysql table, and then use radtest to successfully test the entry. Help! I have the basic functionality of mysql->freeradius, just not the GUI for others to use :-( Thanks in advance - marshall

2 2

Re: ntlm_auth is not used by mschap
by robiwan＠arcor.de 04 May '06

04 May '06

----- Original Nachricht ---- Von: Stefan Winter <stefan.winter(a)restena.lu> An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Datum: 04.05.2006 13:20 Betreff: Re: ntlm_auth is not used by mschap > Hi, > > you didn't state what problem you have right now. The logs send an Accept at > > the end, so everything looks very fine. > Was your mail just to let the world know that things work now, or do you > have > a question? > Hi, Oh sorry, my Question is, that the Authenticator, a Cisco Catalyst 3750, do not map my XP-Client into the VLAN 40 as i defined it in the users file: roka Auth-Type := MS-CHAP Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 When the XP-Client will be authenticated via MS-CHAP, the Cisco Catalyst map my Client in VLAN 1, the default-VLAN, and NOT in VLAN 40. When i authenticate with Auth-Type := Local roka Auth-Type := Local, User-Password = "Gerti1000" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 it works, as you can see the output from radtest: Debian:~# radtest roka Gerti1000 localhost 1645 testing123 Sending Access-Request of id 0 to 127.0.0.1 port 1812 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=0, length=36 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "40" Here is the output from the radiusd: rad_recv: Access-Request packet from host 127.0.0.1:1024, id=72, length=56 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 modcall[authorize]: module "chap" returns noop for request 13 modcall[authorize]: module "mschap" returns noop for request 13 rlm_realm: No '@' in User-Name = "roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 13 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 13 users: Matched entry roka at line 82 modcall[authorize]: module "files" returns ok for request 13 modcall: leaving group authorize (returns ok) for request 13 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [roka/Gerti1000] (from client localhost port 1645) Sending Access-Accept of id 72 to 127.0.0.1 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "40" Finished request 13 Going to the next request Thanks in advance... Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

Proxy Radius and accthost
by Tony Spencer 04 May '06

04 May '06

We have a customer who we terminate connections for and pass on the authentication and accounting to via proxy.conf. However we want to be able to see the accounting also. Is it possible to add another “accthost” to the entry in proxy.conf for this customer so we receive the radius accounting packets also? If not is there another way to be able to have the accounting packets logged in 2 different places? Thanks Tony -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.2/329 - Release Date: 02/05/2006 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

c module
by Kamanashis Roy 04 May '06

04 May '06

Thanks yao guoxian,Mike Mitchell, But it looks to fork(using exec section of radiusd.conf) new processes each time. Using rlm_example($FREERADIUSHOME/src/modules/rlm_example) works fine. I have just replaced the 'example' to 'sync' (the name i chose for my module) in the directory name and all the files inside,-Entered into the directory. I have done some DEBUG("Start Authentication "); So that I understand what it actually does. The compile time configuration is done by, shell &lt ./configure command. Then I done, shell &lt make shell &lt make install I have also made some change in modules section modules{ .... sync { } .... .... } Is it good? I donot know.Some other changes have also be made. authorize{ .... sync .... } authencate{ .... sync .... } accounting{ .... sync .... } At last it works fine. Just donot authenticate the NAS. I think i should work with the attributes (for specific NAS) for replying. Do not know details about authType. Is it make any problem for me? I think i can use mysql-client library to connect local mysql server in it. I have not yet tryed it. I think it needs mysql_client lib to be linked or I include the source. I have done it in a standalone server. But the question is, if freeradius is using threads. And if so what should be done to take care of that. Good Luck -- Kamanashis Roy -- Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

1 0