June 2006 - Freeradius-Users - lists.freeradius.org

Auth-Type = System not working
by Maillists 02 Jun '06

02 Jun '06

Hi, I've read the freeradius-users achives and found that other people have problems when using Freeradius on an OS which uses a shadow password file. I too have encountered such problems and have found why this problem occurs but require assistance to fix. Here's a recap of the problem: Auth-Type = Local works fine but Auth-Type = System does not. OS: FreeBSD 6.0 running Freeradius-1.1.1 installed from ports collection users file contents: DEFAULT Auth-Type = System Reply-Message = "System password works" Running radiusd -X produces (see below for greater detail) rlm_unix: [test]: invalid password but I know 100% that the password is correct. What appears to be happening (determined from hours of frustrating testing) is Freeradius (rlm_unix) is looking for the users passwords in the /etc/passwd file but my /etc/passwd file doesn't contain any passwords: test:*:1003:1003:Test User:/home/test:/bin/sh my /etc/master.passwd file does: test:$1$RlHYm4Ca$QhlYcYV7BqIjTF.UQ4pTX/:1003:1003::0:0:Test User:/home/test:/bin/sh if I copy the encrypted password from /etc/master.passwd and replace the "*" in /etc/passwd I can successfully authenticate via Auth-Type = System Login OK: [test] (from client localhost port 0) (more detail below) ******* So my question is what do I need to do so I don't have to manually replace the "*" in /etc/passwd with the encrypted password from /etc/master.passwd for every user I enter in the system? ******* TIA, Shane Output of radiusd -X when /etc/passwd contains "*" for password rad_recv: Access-Request packet from host 127.0.0.1:52869, id=153, length=53 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 688 modcall[authorize]: module "preprocess" returns ok for request 688 radius_xlat: '/var/log/radacct/127.0.0.1/auth-detail-20060531' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-detail-20060531 modcall[authorize]: module "auth_log" returns ok for request 688 modcall[authorize]: module "chap" returns noop for request 688 modcall[authorize]: module "mschap" returns noop for request 688 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 688 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 688 users: Matched entry DEFAULT at line 13 modcall[authorize]: module "files" returns ok for request 688 modcall: leaving group authorize (returns ok) for request 688 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 688 rlm_unix: [test]: invalid password modcall[authenticate]: module "unix" returns reject for request 688 modcall: leaving group authenticate (returns reject) for request 688 auth: Failed to validate the user. Login incorrect: [test/test] (from client localhost port 0) Delaying request 688 for 1 seconds Finished request 688 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 153 to 127.0.0.1 port 52869 Reply-Message = "System password works" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 688 ID 153 with timestamp 447e1534 Nothing to do. Sleeping until we see a request. Output of radiusd -X when /etc/passwd contains encrypted password instead of "*" rad_recv: Access-Request packet from host 127.0.0.1:55703, id=181, length=53 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "0" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radacct/127.0.0.1/auth-detail-20060531' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-detail-20060531 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 13 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 radius_xlat: 'System password works' Login OK: [test] (from client localhost port 0) Sending Access-Accept of id 181 to 127.0.0.1 port 55703 Reply-Message = "System password works" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 181 with timestamp 447e1744 Nothing to do. Sleeping until we see a request.

3 4

Huntgroups how to?
by Unknown 02 Jun '06

02 Jun '06

Hello, i'm pretty new to the freeradius world, so please forgive me if i don't use the correct terms. Here is my situation: 1 AP with a freeradius auth backend used to gain access to the inner network. All works fine, i've setup both clients and server to use EAP-TLS. Now the question: I need to add one more AP and another user class, specifically: UserClass1 Users (Students) must be able to gain access through AP1 Only UserClass2 Users (Staff) must be able to gain access through both APs I think that i can accomplish this using huntgroups, forcing all requests coming from AP2 (Staff only) to auth through EAP-TLS AND mysql backend, maybe. I need not to change the actual enviroment, so I cannot redestribuite certs again nor order the users to use another auth method. Is there a Way ? Thank you all in advance, Pieces of code, howto, links and whatsoever are wellcome :) Thanks Again

2 2

peap authentication
by Kartthik Raghunathan 02 Jun '06

02 Jun '06

Am having a strange problem after my supplicant get authenticated to my active directory. My supplicant trying to get authenticated to active directory or validating identity every 60 mins, which disturbs wireless connection that bother me a lot. Is this normal or can i set the timer to authenticate every 120 mins or whatever timing i like. Am using dynamic WEP and it has been set to change the key every 6 hours. Any help will be really appreciated. Please help me. Thanks in advance !!! Kartthik -- _______________________________________________ Search for businesses by name, location, or phone number. -Lycos Yellow Pages http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.as…

1 0

RE: rlm_eap_mschapv2: out of memory
by Ryan Melendez 02 Jun '06

02 Jun '06

Thank You Alan, The microsoft dictionary was commented out in /usr/local/share/freeradius/dictionary. Ryan > -----Original Message----- > From: freeradius-users-bounces+rmelendez=wayport.net(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+rmelendez=wayport.net(a)lists.freeradius.org] On Behalf Of Alan > DeKok > Sent: Friday, June 02, 2006 10:16 AM > To: FreeRadius users mailing list > Subject: Re: rlm_eap_mschapv2: out of memory > > "Ryan Melendez" <rmelendez(a)wayport.net> wrote: > > Can someone please tell me how I might fix this? > > > ... > > rlm_eap_mschapv2: out of memory > > rlm_eap: Default EAP type mschapv2 failed in initiate > > From looking at the source, it happens when a call to pairmake() > fails. I'd guess that the MS-CHAP-Challenge attribute it's in your > dictionaries. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

RE: Lawrence Billson has left Transurban
by King, Michael 02 Jun '06

02 Jun '06

You think if someone was going to be out of the office for 2 and a half years, He might Unsubscribe from his mailing lists. > -----Original Message----- > From: > freeradius-users-bounces+mking=bridgew.edu(a)lists.freeradius.or > g > [mailto:freeradius-users-bounces+mking=bridgew.edu@lists.freer > adius.org] On Behalf Of Lawrence Billson > Sent: Friday, June 02, 2006 4:24 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Lawrence Billson has left Transurban > > > > > > I will be out of the office starting 02/06/2006 and will not > return until 12/12/2008. > > > Please send personal messages to lawrencebillson(a)yahoo.com.au. > > For all business related matters, please contact Jeremy > Forrester at jforrester(a)transurban.com.au. > > Cheers, > Lawrence > > > Privileged/Confidential information may be contained in this > message. If you are not the addressee indicated in this > message (or responsible for delivery of the message to such > person), you may not copy or deliver this message to anyone. > In such a case, you should destroy this message and kindly > notify the sender by reply e-mail or by telephone on (03) > 9612-6999 or +61 3 9612-6999. > > Please advise immediately if you or your employer does not > consent to Internet e-mail for messages of this kind. > > Opinions, conclusions and other information in this message > that do not relate to the official business of Transurban > Limited or any companies within the Transurban Group shall be > understood as neither given nor endorsed by them. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Authentication Method
by fvt3 02 Jun '06

02 Jun '06

Hi, I have questions concerning authentication method. Is it possible to force radius to authenticate off of ldap AND also from a local database? Example, say a user is connected to radius, first his user id/password will be authenticated against ldap and if the supplied credential is correct, force it to also authenticate against a local database. Second question, can you force radius to authenticate off of ldap or local database. I want the option to choose which method a user should be authenticated depending on their user id. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

rlm_eap_mschapv2: out of memory
by Ryan Melendez 02 Jun '06

02 Jun '06

Can someone please tell me how I might fix this? Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 20 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: out of memory rlm_eap: Default EAP type mschapv2 failed in initiate rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 20 modcall: leaving group authenticate (returns invalid) for request 20 auth: Failed to validate the user. 2.6.15-wpnmd.3.1 #1 SMP Wed Apr 12 04:50:31 GMT 2006 i686 GNU/Linux Thanks, Ryan

2 1

Sending multiple attributes from radius to the NAS
by vignesh 02 Jun '06

02 Jun '06

Hello all I have following doubts regarding access reply query 1. how do I send multiple attributes using the radreply E.g billing model, credit time etc 2. I have written a function in MySQL to return me the credit time. How do I include this function in my radreply query. Vignesh

1 0

Xsupplicant is receiving this Error Message
by Karthikeyan S 02 Jun '06

02 Jun '06

[STATE] Backend State : RECEIVE -> TIMEOUT [WARNING] Timeout waiting for the authenticator to begin the EAP conversation. This usually happens when the RADIUS server is misconfigured, the authenticator can't talk to the RADIUS server, or the username provided is invalid. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

RE: ip pool
by vertito 02 Jun '06

02 Jun '06

that simply means you need to call them from Accounting and Post-Auth module section of radius conf see more of Pool-Name attribute as well Hello Vertito, Thanks for your information.But I did not get the meaning of the attributes in the below sentence, dont forget to call them from conf and from attributes. I have configured these things in radiusd.conf. But I am not getting why it is requried,Because with out thses configuration I am able to do Authentication sucessfully. range-start = 192.168.1.1 range-stop = 192.168.1.200 netmask = 255.255.255.255 cache-size = 56 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = yes maximum-timeout = 90 Regards, Basavaraja. -----Original Message----- From: vertito [mailto:mnisay@aim-consultants.com] Sent: Friday, June 02, 2006 11:07 AM To: 'Basavaraja.pv'; 'FreeRadius users mailing list' Subject: RE: ip pool range-start = 192.168.1.1 range-stop = 192.168.1.200 netmask = 255.255.255.255 cache-size = 56 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = yes maximum-timeout = 90 dont forget to call them from conf and from attributes -----Original Message----- From: freeradius-users-bounces+mnisay=aim-consultants.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+mnisay=aim-consultants.com@lists.freeradius .org] On Behalf Of Basavaraja.pv Sent: Friday, June 02, 2006 10:00 AM To: freeradius-users(a)lists.freeradius.org Subject: ip pool Hello Sir, I went through the radiusd.conf file. I am not getting the exact purpose of the ippool main_pool{ rangesatrt = 192.168.1.1 rangestop = 192.168.3.254 } Please give me the working of the above code. Thanks and Regards, Basavaraja - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.1/354 - Release Date: 6/1/2006 -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.1/354 - Release Date: 6/1/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.1/354 - Release Date: 6/1/2006 -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.394 / Virus Database: 268.8.1/354 - Release Date: 6/1/2006

1 0