May 2006 - Freeradius-Users - lists.freeradius.org

ntlm_auth is not used by mschap
by robiwan＠arcor.de 03 May '06

03 May '06

Dear all, I try to authenticate Radius-users against my Microsoft-2003-Server Active-Directory using the mschap-Module with ntlm_auth. My Windows-Domain is "winlab" my username is "roka" and the Password is "Gerti1000". The winbindd and therefore the ntlm_auth works properly as you can see: Debian:~# /usr/bin/ntlm_auth --username=roka --password=Gerti1000 --domain=winlab NT_STATUS_OK: Success (0x0) Here is the mschap section of my /etc/freeradius/radiusd.conf: ----------snip radiusd.conf---------------------------- mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap ----------snap radiusd.conf---------------------------- Here is my /etc/freeradius/users: ----------------snip users------------------------------------- hugo Auth-Type = Local, User-Password == "hugo01" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 roka Auth-Type := MS-CHAP Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 DEFAULT Auth-Type := MS-CHAP DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP ----------------snap users................. Here is the output when i start freeradius, the ntlm_auth in the mschap-section is seen Debian:/etc/freeradius# freeradius -sfxxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Now i try to authenticate the user roka: --------------------------------------------------- Debian:/tmp# radtest roka Gerti1000 localhost 1645 testing123 Sending Access-Request of id 116 to 127.0.0.1:1812 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = Debian NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=116, length=20 And that is the output of my radiusd: ------------------------------------------------ rad_recv: Access-Request packet from host 127.0.0.1:33565, id=141, length=56 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry roka at line 144 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [roka/Gerti1000] (from client localhost port 1645) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 141 to 127.0.0.1:33565 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 141 with timestamp 44586c93 Nothing to do. Sleeping until we see a request. I can not see that the ntlm_auth is used anywhere. I expect, that module mschap is calling the ntlm_auth, but it don't works I tried in the /etc/freeradius/users the following lines: roka Auth-Type := MSCHAP, MS-CHAP-USE-NTLM-Auth = 1 roka Auth-Type := MS-CHAP, MS-CHAP-USE-NTLM-Auth = yes but nothing works. Many thanks in advance for any suggestion Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

3 2

Aw: Re: ntlm_auth is not used by mschap
by robiwan＠arcor.de 03 May '06

03 May '06

----- Original Nachricht ---- Von: Stefan Winter <stefan.winter(a)restena.lu> An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Datum: 03.05.2006 11:59 Betreff: Re: ntlm_auth is not used by mschap > > Now i try to authenticate the user roka: > > --------------------------------------------------- > > > > Debian:/tmp# radtest roka Gerti1000 localhost 1645 testing123 > > Sending Access-Request of id 116 to 127.0.0.1:1812 > > User-Name = "roka" > > User-Password = "Gerti1000" > > NAS-IP-Address = Debian > > NAS-Port = 1645 > > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=116, > length=20 > > You send a packet that does not contain any MS-CHAP attributes. Because of > that, the server is not doing MS-CHAP: > > > modcall[authorize]: module "mschap" returns noop for request 0 > > As this line tells you. > > Send a MS-CHAP request, and look what happens then. > > Stefan > > -- > Stefan WINTER > > Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de > la Recherche > Ingenieur Forschung & Entwicklung > > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 > http://www.restena.lu Fax: +352 422473 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Hi Stefan, You say i do not send a MS-CHAP Request. Hmm ... Finally it should work with Windows-XP Supplicant: In my WindowsXP 802.1X Network-Configuration I can choose between "MD5Challenge" , or "secure EAP(PEAP)" or "Smartcart or other Certificate" What ist the right one? Or is mschap basically the wrong authentication method for my equipment? Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

freeradius + pptp + mysql
by Michael Gale 03 May '06

03 May '06

Hello, I am trying to get freeradius to work with my pptp / ppp server. I have followed the documents from the following locations: http://poptop.sourceforge.net/dox/radius_mysql.html http://www.frontios.com/freeradius.html However I am unable to get it to work when using freeradius. pptpd-1.3.0-0 ppp-2.4.3-5.rhel4 freeradius-1.0.1-3.RHEL4.3 My client is a XP Pro laptop using MS-CHAP v2 I believe, with just pptp / ppp and using a chap-secrect file it work great. However once I introduce freerdius and mysql I am unable to authentication. The following works fine on my test server: radtest testuser testpass localhost 1812 testing123 When trying from the XP Pro client it fails with: rlm_mschap: No MS-CHAP-Challenge in the request I have added the logs below, any feedback would be appreciated. Here are the logs: rad_recv: Access-Request packet from host 127.0.0.1:32804, id=83, length=65 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser" Calling-Station-Id = "10.10.0.3" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

5 7

default vlan for ldap users
by Nuno Reis 03 May '06

03 May '06

Hi, Is there any way to make freeradius assign a vlan to any user that was authenticated using active directory database? Something like, freeradius asks active directory for user authenticity, and if accepted, freeradius forwards always the same tunnel-pvt-group-id to NAS. Thanks, Nuno Reis -- No trees were killed in the sending of this message. However, a large number of electrons have been terribly inconvenienced

2 1

Re: Running prepaid apps on freeradius
by Sean 03 May '06

03 May '06

On Wed, 2006-05-03 at 12:13 +0200, freeradius-users-request(a)lists.freeradius.org wrote: > Running prepaid apps on freeradius Hi Checkout phpMyPreaid on sourceforge and http://swarmhotspots/faq for a tutorial. Sean

1 0

rlm_attr_rewrite doesn't read the regexp in searchfor
by Mark Supersonik 03 May '06

03 May '06

Hi Freeradius friends! I am programming a proxyRadius (FreeRadius v1.88.2.3 in Debian) in order to write a Session-Tiemout attribute with a value =3600 if the attribute doesn't exist yet. I have defined an instance of attr_rewirte called setSessionTimeout3600 with append=no, new_attribute=no, searchfor= NULL, searchin =reply and replacewith = "3600" I call then it in post-proxy stage, but i found that it doesn't do nothing. The only thing it works is to set new_attribute to yes, but then i have 2 attributes Session-Tiemout, there is no rewriting and no parsing of regexp. Help please, thank you all, Marc _________________________________________________________________ Horóscopo, tarot, numerología... Escucha lo que te dicen los astros. http://astrocentro.msn.es/

1 1

Running prepaid apps on freeradius
by Lex Lethol 03 May '06

03 May '06

Hi, I am very new to freeradius and to radius in general. I searched for a while and have not found any comments regarding any prepaid implementations or modules running on freeradius. If anyone could point me to the right direction, articles, forums or comments, I'd greatly appreciate it. Thank you! Lex

1 0

single login
by riky＠bogor.net 03 May '06

03 May '06

Dear all, My friend having problem, because he gave me 1 account but it can be use for 2 PC, maybe someone can help how to setup the single login on freeradius. Thanks riky *I'm apologize my english not to good ^^

2 1

freeradius problem with DialupAdmin.
by Eric Hilden 03 May '06

03 May '06

I am currently running Suse 10.x Linux with Freeradius 1.0.4-42., dailupAdmin 2.7, and apache2. I believe I have everything installed correctly as I can check my info.php page, phpmyadmin, and dialupadmin. Freeradius also rejects my request so I know it is running and working. Here is my issue I am having.; I am also very new the linux/sql/php world fyi. My tables currently under the Radius Database that I have created are as follows: badusers mtotacct totacct userinfo I added these tables via the phpMyadmin located in /srv/www/dialup_admin/sql All tables seem to work via the webgui in dialup admin. However, I am still getting errors on Statistics and Failed Users. * "Database query failed: Table 'radius.radacct' doesn't exit." Also if I try to create a user or new group I get : "Database query failed: Table 'radius.usergroup' doesn't exit." "Database query failed: Table 'radius.radgroupcheck' doesn't exit." I have tried looking for where I setup these tables and values with no luck. I read somewhere that there is a script for automatically generating these tables but I did not reference where the script was. I have tried looking in the /var/log/radius/radacct but not files are in here. I'm assuming once it reads the table this is where the info logs are stored. Do I need to generate another table for the rest of the tables ? If so what are the values needed for this .sql file. I have tried searching for any information on how to create these tables with little luck on how to create this table and values needed. I also could not find any how-tos on how to make these tables. It seems from everything I read that these files should already be there. Thank you for your time to read this and help. Eric eric(a)linkednetworks.com

3 2

RE: Storing in SQL, repeat Attributes
by Jackie Lau 02 May '06

02 May '06

Can you elaborate? I'm still not following how I reference the second occurance vs the first occurance of an attribute in the same start record. Thanks! -----Original Message----- From: freeradius-users-bounces+jackie=ingenio.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+jackie=ingenio.com@lists.freeradius.org ] On Behalf Of Alan DeKok Sent: Tuesday, May 02, 2006 1:38 PM To: FreeRadius users mailing list Subject: Re: Storing in SQL, repeat Attributes "Jackie Lau" <Jackie(a)ingenio.com> wrote: > Notice how the FlowID attribute is logged twice but have different > values How do I reference the second occurance of FlowID i.e > %{FlowID} See doc/variables.txt Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1