July 2006 - Freeradius-Users - lists.freeradius.org

Ldap-Group DN and the match "=~" check
by Thibault Le Meur 17 Jul '06

17 Jul '06

Hello, I've made a little test and found that the match operator "=~" doesn't work on my setup (Freeradius 1.0.4) for Groups defined as LDAP DNs. Indeed I'd like to to use the following rule (in the users file): DEFAULT Ldap-Group =~ "cn=mygroupname,ou=(unit1|unit2|unit3),dc=mycorp,dc=org" Fall-Through = no This way, a unique rule will match 3 different groups having the same cn, but in different subtrees. Am I missing something or is this setup impossible with Ldap-Groups ? Thanks in advance for your answer. Regards, Thibault Le Meur

3 5

persistant problem with my router and my freeradius server
by Moustapha Ould Maouloud 17 Jul '06

17 Jul '06

Hello, I have in my LAN a Colubris Access Conroller (IP: 192.168.10.81, gw: 192.168.10.1/80.B.C.D) which I authenticate on a freeradius via Internet (IP of freerad server : 63.E.F.G). My server (on log mode radiusd -X) receives : rad_recv: Access-Request packet from host 80.B.C.D:10901, id=64, length=251 Acct-Session-Id = "7592eefb" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "noven-ac1" Calling-Station-Id = "00-03-52-01-FC-33" Called-Station-Id = "00-03-52-01-FC-33" Framed-IP-Address = 192.168.1.1 User-Password = "novenac1" NAS-Identifier = "noven.Vincennes.0" NAS-IP-Address = 192.168.10.81 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Administrative-User WISPr-Location-Name = "noven.Noven-WiFi" WISPr-Location-ID = "noven2/Noven-WiFi" Message-Authenticator = 0xa4619c3e1b4b1f7f5a877de95f208ab0 Processing the authorize section of radiusd.conf ..... and returns : Sending Access-Accept of id 64 to 80.B.C.D:10901 Framed-Protocol := PPP Service-Type := Framed-User Framed-MTU := 1500 Colubris-AVPair += "transport-page=https://192.168.10.82/Noven/transport.html" Colubris-AVPair += "session-page=https://192.168.10.82/Noven/session.html" ........ My problem is that the response from the radius server does not reach my AC (IP 192.168.10.81) although the answer was indeed turned over to my router (IP : 80.B.C.D) !!! what is what I must do on the level of my router ZyXel (ZyWall) so that the response of the radius server arrive to my AC? Someone can help me ? Please Thanks; Moustapha Maouloud --------------------------------- Yahoo! Mail réinvente le mail ! Découvrez le nouveau Yahoo! Mail et son interface révolutionnaire.

1 0

Multiple Radius Servers
by Jory Privett 17 Jul '06

17 Jul '06

I have to upgrade my current radius solution and have chosen FreeRadius for this task. I have been reading the docs and so forth and can not find an answer to a setup that I want to do. I need to be able to have one server (FreeRadius) check a username and if it is not found then to forward the request to another server (not FreeRadius). Is this possible? I see how FreeRadius can Proxy by domain but none of my users have the domain set and it would be a nightmare to go back and change this. Can anyone give ma some insight if this is possible and if so on how to do it?

2 1

mysql modifications
by simon＠434canada.com 17 Jul '06

17 Jul '06

Hi, I need to add a foreign key to the radcheck table, but the tables are in MyISAM, and not InnoDB. When I tried changing the table type to InnoDB, I get back errors that the table cannot be created. Is there any way to add a foreign key into the tables created using the db_mysql.sql script found in /usr/share/doc/freeradius/examples? If not, are there any other ways to accomplish this? Thanks, Simon

2 1

need help - Freeradius + oracle
by Vishwanath Srikant Pattanshetti 17 Jul '06

17 Jul '06

Hello all My setup has freeradius 1.1.0 with Oracle10 my oraclesql.conf file has the following line: readclients=yes Now my problem is: when I change the shared secret stored in nas table, it is not being picked by the RADIUS server. I need to restart the RADIUS server for new shared secret to take effect. Is there now way the RADIUS server can pick it up every time this value changes? Any help would be extremely helpful. -vishwa.

2 1

Can I run a shell command after an authentication session?
by Kun Niu 17 Jul '06

17 Jul '06

Dear all, I have a freeradius server on Debian3.1. And I have a shell command to execute after an authentication session. In fact, I want to limit the time of user connection. I know that it's not freeradius' job. So I want to write a shell command for private use. I just wonder if I can communicate with freeradius with a dependent script. Thanks for your attention and look forward to your reply. Sincerely, Kun

2 1

ntlm_auth - rlm_mschap: No User-Password configured. Cannot create NT-Password.
by Peter de Groot 17 Jul '06

17 Jul '06

> eter de Groot <peter.de.groot(a)det.wa.edu.au> wrote: >> > I am trying to autheticate against a different domain that than the >> > samba server is joined to.. should be ok ?? > > Probably not. > >> > [root@curric4182-05 raddb]# ntlm_auth --request-nt-key >> > --domain=admin4182 --username=e2052982 >> > password: >> > NT_STATUS_OK: Success (0x0) > > That's nice, but it's not what the server is doing: > >> > radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982 >> > --domain=ADMIN4182 --challenge=7801a84637ef5c68 >> > --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757' > > What happens when you run the above command from the command line? > > Alan DeKok. > Thanks for the reply .... I re-ran the connect and then copy and pasted onto the command line from the (radiusd -X ) log.. [root@curric4182-05 raddb]# [root@curric4182-05 raddb]# [root@curric4182-05 raddb]# /usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=6151ad29f27eff47 --nt-response=01e42eabc464bf9915883d804457069d4702d95534ce4d53 Logon failure (0xc000006d) [root@curric4182-05 raddb]# [root@curric4182-05 raddb]# Not good. :-( .. but they do give me the domain option .. so it "should" be ok. ? . . . Sorry ... couple more idiot (newbie) questions .... I am using PEAP with MSCHAPv2 .. and (I think) according to the how-tos .. I do NOT need ANY certificate(s) on the client PC... Is this correct ??.... or, if not .. which certificate(s) are REQUIRED on the PC... ?? I am using tinyCA with the OID extra bits for the XP extensions. Is this an error in the following certficate stuff ?? . . . rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0927], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED . . . . IS the following significant ... ?? It seems to say it cannot create the password ?? modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password Thanks Peter de Groot Windows Re-Installation Engineer Eastern Goldfields College Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312 http://egshs.wa.edu.au

3 7

Re: mysql default install schema (Matt Manjos)
by Kun Niu 17 Jul '06

17 Jul '06

Hi Matt, Here is the db_mysql.gz I copied from /usr/share/doc/freeradius/examples You can make some minor changes if you get warning when installing. Hope you good luck.:) ########################################################################### # db_mysql.sql rlm_sql - FreeRADIUS SQL Module # # # # Database schema for MySQL rlm_sql module # # # # To load: # # mysql -uroot -prootpass radius < db_mysql.sql # # # # Mike Machado <mike(a)innercite.com> # ########################################################################### # # Table structure for table 'radacct' # CREATE TABLE radacct ( RadAcctId bigint(21) NOT NULL auto_increment, AcctSessionId varchar(32) NOT NULL default '', AcctUniqueId varchar(32) NOT NULL default '', UserName varchar(64) NOT NULL default '', Realm varchar(64) default '', NASIPAddress varchar(15) NOT NULL default '', NASPortId int(12) default NULL, NASPortType varchar(32) default NULL, AcctStartTime datetime NOT NULL default '0000-00-00 00:00:00', AcctStopTime datetime NOT NULL default '0000-00-00 00:00:00', AcctSessionTime int(12) default NULL, AcctAuthentic varchar(32) default NULL, ConnectInfo_start varchar(32) default NULL, ConnectInfo_stop varchar(32) default NULL, AcctInputOctets bigint(12) default NULL, AcctOutputOctets bigint(12) default NULL, CalledStationId varchar(50) NOT NULL default '', CallingStationId varchar(50) NOT NULL default '', AcctTerminateCause varchar(32) NOT NULL default '', ServiceType varchar(32) default NULL, FramedProtocol varchar(32) default NULL, FramedIPAddress varchar(15) NOT NULL default '', AcctStartDelay int(12) default NULL, AcctStopDelay int(12) default NULL, PRIMARY KEY (RadAcctId), KEY UserName (UserName), KEY FramedIPAddress (FramedIPAddress), KEY AcctSessionId (AcctSessionId), KEY AcctUniqueId (AcctUniqueId), KEY AcctStartTime (AcctStartTime), KEY AcctStopTime (AcctStopTime), KEY NASIPAddress (NASIPAddress) ) ; # # Table structure for table 'radcheck' # CREATE TABLE radcheck ( id int(11) unsigned NOT NULL auto_increment, UserName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '==', Value varchar(253) NOT NULL default '', PRIMARY KEY (id), KEY UserName (UserName(32)) ) ; # # Table structure for table 'radgroupcheck' # CREATE TABLE radgroupcheck ( id int(11) unsigned NOT NULL auto_increment, GroupName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '==', Value varchar(253) NOT NULL default '', PRIMARY KEY (id), KEY GroupName (GroupName(32)) ) ; # # Table structure for table 'radgroupreply' # CREATE TABLE radgroupreply ( id int(11) unsigned NOT NULL auto_increment, GroupName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '=', Value varchar(253) NOT NULL default '', prio int unsigned NOT NULL default '0', PRIMARY KEY (id), KEY GroupName (GroupName(32)) ) ; # # Table structure for table 'radreply' # CREATE TABLE radreply ( id int(11) unsigned NOT NULL auto_increment, UserName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '=', Value varchar(253) NOT NULL default '', PRIMARY KEY (id), KEY UserName (UserName(32)) ) ; # # Table structure for table 'usergroup' # CREATE TABLE usergroup ( id int(11) unsigned NOT NULL auto_increment, UserName varchar(64) NOT NULL default '', GroupName varchar(64) NOT NULL default '', PRIMARY KEY (id), KEY UserName (UserName(32)) ) ; # # Table structure for table 'radpostauth' # CREATE TABLE radpostauth ( id int(11) NOT NULL auto_increment, user varchar(64) NOT NULL default '', pass varchar(64) NOT NULL default '', reply varchar(32) NOT NULL default '', date timestamp(14) NOT NULL, PRIMARY KEY (id) ) ; ###################################################################### # # The next two tables are commented out because they are not # currently used in the server. # # # Table structure for table 'dictionary' # #CREATE TABLE dictionary ( # id int(10) DEFAULT '0' NOT NULL auto_increment, # Type varchar(30), # Attribute varchar(64), # Value varchar(64), # Format varchar(20), # Vendor varchar(32), # PRIMARY KEY (id) #); # # Table structure for table 'nas' # CREATE TABLE nas ( id int(10) NOT NULL auto_increment, nasname varchar(128) NOT NULL, shortname varchar(32), type varchar(30) DEFAULT 'other', ports int(5), secret varchar(60) DEFAULT 'secret' NOT NULL, community varchar(50), description varchar(200) DEFAULT 'RADIUS Client', PRIMARY KEY (id), KEY nasname (nasname) ); > Date: Sun, 16 Jul 2006 18:50:03 -0400 > From: "Matt Manjos" <mattdev121(a)gmail.com> > Subject: mysql default install schema > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <3a1455400607161550q12f1809ex1e5058ee4192433a(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hello, it's my first install of freeradius using mysql for auth and I > must be going mental because I can't seem to find the default schema > to import into sql. > > I'm using freeradius-1.1.1 on gentoo, and i've looked in > /usr/share/doc/freeradius-1.1.1/sql.schemas and all of the source code > (/src/modules/rlm_sql/drivers/rlm_sql_mysql) and I still can't seem to > find it anywhere. > > Where do I get the default schema from? > > Many Thanks, > Matt > >

2 1

mysql default install schema
by Matt Manjos 17 Jul '06

17 Jul '06

Hello, it's my first install of freeradius using mysql for auth and I must be going mental because I can't seem to find the default schema to import into sql. I'm using freeradius-1.1.1 on gentoo, and i've looked in /usr/share/doc/freeradius-1.1.1/sql.schemas and all of the source code (/src/modules/rlm_sql/drivers/rlm_sql_mysql) and I still can't seem to find it anywhere. Where do I get the default schema from? Many Thanks, Matt

2 3

Digest auth with LDAP
by Matt 17 Jul '06

17 Jul '06

Hello, I have a problem with the users file. Indeed, if I write in this file : DEFAULT Auth-Type := digest I got this error "rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication." So I decided to put a Digest-HA1 attribute in the users file and the auth works : DEFAULT Auth-Type := digest, Digest-HA1 := "409e2df0ac3a755199a8a91817bb87b8" But it's works of course only for my login. How to do this for different login? Thank you for your help and sorry for my English! Sincerely, Matt -- View this message in context: http://www.nabble.com/Digest-auth-with-LDAP-tf1953428.html#a5357147 Sent from the FreeRadius - User forum at Nabble.com.

2 1