July 2006 - Freeradius-Users - lists.freeradius.org

Defining different Service-Types for different equipment for the same user
by Nuno Cervaens 06 Jul '06

06 Jul '06

Hi, I have to install a Radius Server that is going to authenticate and autorize users in the CLI of a mix of router brands and switches. The server will have a bunch of users that will have defined the Service-Type Administrative or NAS-Prompt. My problem is that when a user logs in to an Enterasys SSR with the Service-Type = Administrative, it goes immediately to the configure mode, and I dont want that, just the enable mode. So for a user that has Serv.Type = Administrative I would like to specifically define for the SSRs the Service-Type as NAS-Prompt (which goes to enable mode, equivalent for Administrative for CISCO that goes as well to enable mode for example). Do you know the best way to implement this? Thanks, Nuno

2 3

Mysql Authentication
by Max Clark 06 Jul '06

06 Jul '06

Hi all, We are migrating from an old installation of Radiator onto Freeradius. Local test accounts work fine, however I am getting an error on mysql based authentication. I am sure I'm missing something basic, here is the output from the radiusd process. Thanks, Max Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:59269, id=53, length=75 User-Name = "cisp1(a)foo.com" User-Password = "testdial" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "foo.com" for User-Name = "cisp1(a)foo.com" rlm_realm: Found realm "foo.com" rlm_realm: Proxying request from user cisp1 to realm foo.com rlm_realm: Adding Realm = "foo.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'cisp1(a)foo.com' rlm_sql (sql): sql_set_user escaped user --> 'cisp1(a)foo.com' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'cisp1(a)foo.com' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'cisp1(a)foo.com' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'cisp1(a)foo.com' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'cisp1(a)foo.com' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 53 to 127.0.0.1 port 59269 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 53 with timestamp 44ad4ca3 -- Max Clark http://www.clarksys.com

3 3

Radius ip pool service !!
by Emerson 06 Jul '06

06 Jul '06

Hi, I read about ip pool service in freeradius. I need to deliver ip to my clients postauth. I need to know if "ip pool" is the tool for this..... Thank's Emerson

2 1

CHAP and Windows 2003 AD LDAP
by Luke 06 Jul '06

06 Jul '06

Hi, I'm trying to get a freeradius server (v1.0.1) to work with CHAP and querying a Windows 2003 Active Directory server using LDAP. I've got LDAP working for PAP queries, but CHAP comes back with the "rlm_chap: Could not find clear text password". Now I've read the FAQ and followed those notes, but I'm not sure what the values should be for the "password_header", "password_attribute" and "password_radius_attribute"? Any help would be much appreciated, Thanks, Luke

5 7

cisco 3550
by fhcom＠club-internet.fr 06 Jul '06

06 Jul '06

1 0

module install
by Cihan DEMİR 06 Jul '06

06 Jul '06

Hi all, I'm new to radius and i'm searching "authentication without username/password but calling number" about a week. After all, i find rlm_checkval module. We are using version 0.9.3 and rlm_checkval module doesn't exist. I want to install it but it's not in "stable" list. So, here is the question : in 1.1.2 version, it is in stable list. If i want to install rlm_checkval module which exists in 1.1.2 version to 0.9.3 , what happens? I think there is no difference. Thanks in advance. Cihan. -------------------------------------------------------------------------------- Omsan'in sundugu hizmetleri nasil degerlendiriyorsunuz? Görüsleriniz bizim için degerli. Aldiginiz hizmetin beklentilerinizi ve ihtiyaçlarinizi ne ölçüde karsiladigi konusunda benimle irtibata geçebilir veya pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr veya innovate(a)omsan.com.tr adreslerine e-mail gönderebilirsiniz. How do you evaluate the services of Omsan? Your opinions are valuable for us. You can contact me or send an e-mail to , pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr or innovate(a)omsan.com.tr to inform us about the extent to which the services provided fulfill your expectations and needs. -------------------------------------------------------------------------------- Bu e-posta mesaji kisiye özel olup, gizli bilgiler içeriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, içerigini hiç bir sekilde kullanmayiniz ve ekli dosyalari açmayiniz. Bu durumda lütfen e-posta mesajini kullaniciya hemen geri gönderiniz ve tüm kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hiç bir sekilde, herhangi bir amaç için çogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji virüslere karsi anti-virüs sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virüs koruma sistemleri ile kontrol ediliyor olsa bile - virüs içermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hiçbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed, and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence.

2 1

Listening on proxy*: 1814
by Giuseppe Parlato 06 Jul '06

06 Jul '06

Hi all, I upgraded freeradius but when it starts at the end of debug I don't get the usual "Listening on proxy*: 1814" , where can I configure it.. couldn't find anything in proxy.conf or radiusd.conf configuration files. I use 1812 for authentication e 1813 for accounting. jay

2 1

"unknown module eap" error
by simon＠434canada.com 06 Jul '06

06 Jul '06

Hello, I was running freeRadius version 1.1.1, and everything was working smoothly. I then had to reformat my server, so I saved my entire raddb config directory so that I would not need to start completely from scratch. However, I have now installed version 1.1.2, and I cannot get it running properly. I have included the output from running in debug mode below. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 60 main: cleanup_delay = 6 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "nobody" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: file not found radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1894] Unknown module "eap". radiusd.conf[1841] Failed to parse authenticate section. Any help or advice would be appreciated. Thanks, Simon

2 1

multiple Auth-Type
by Rohaizam Abu Bakar 06 Jul '06

06 Jul '06

I've mutiple Auth-Type and Autz-Type to use for LDAP backend >From below setting, i'm trying NOT to set Auth-Type as suggested... So i let Freeradius detecting Auth-Type by itself... It only working for "OCE" line coz it's EAP type. Other line not working unless the password is stored in plain-text in LDAP If all line (except OCE line) been added with Auth-Type :=LDAP/Y5/ADSL.. then it's working .. So my big question is ..why it's recommended not to set Auth-Type?? Error in debug: auth: type Local auth: user supplied User-Password does NOT match local User-Password users: ===== DEFAULT NAS-Identifier == "Wireless-802.11", Autz-Type := Y5 DEFAULT Huntgroup-Name == "adsl", Autz-Type := ADSL DEFAULT NAS-Identifier == "OCEPOP", Autz-Type := OCE DEFAULT Autz-Type := LDAP modules{ ldap ldapadsl { -- some config basedn = "ou=ADSL,ou=AAA,ou=People,dc=jaring,dc=my" -- some config } ldap ldapy5 { -- some config basedn = "ou=Y5,ou=AAA,ou=People,dc=jaring,dc=my" -- some config } ldap ldap1 { -- some config basedn = "ou=DIALUP,ou=AAA,ou=People,dc=jaring,dc=my" -- some config } ldap ldapOCE { -- some config basedn = "ou=OCE,ou=AAA,ou=People,dc=jaring,dc=my" -- some config } } authorize { Autz-Type ADSL { ldapadsl } Autz-Type Y5 { ldapy5 } Autz-Type OCE { ldapOCE } Autz-Type LDAP { ldap1 } } authenticate { Auth-Type ADSL { ldapadsl } Auth-Type Y5 { ldapy5 } Auth-Type OCE { ldapOCE } Auth-Type LDAP { ldap1 } }

1 0

problem in configuring PEAP on freeRADIUS1.1.2
by Pradeep Sengar 06 Jul '06

06 Jul '06

Hi, I m running freeRADIUS 1.1.2. Trying to run it for PEAP authentication and made few changes in radiusd.conf,eap.conf & users files in /usr/local/etc/raddb/ directory. on running freeradius in debugging mode by typing "radiusd -x" on command prompt it gives this output: [root@localhost ~]# radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap_tls: Loading the certificate file as a chain rlm_eap: SSL error error:0200100E:system library:fopen:Bad address rlm_eap_tls: Error reading certificate file rlm_eap: Failed to initialize type tls radiusd.conf [10]: eap: Module instantiation failed. radiusd.conf[1920] Unknown module "eap". radiusd.conf[1867] Failed to parse authenticate section. I am attaching radiusd.conf,clients.conf,eap.conf and users files here. Plz tell me also how to mention network in clients.conf. Do i need to install openssl before running freeradius server? I m pasting my files below here: xxxxxxxxxxxx radiusd.conf xxxxxxxxxxxx ## radiusd.conf -- FreeRADIUS server configuration file. prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid #user = nobody #group = nobody # max_request_time: The maximum time (in seconds) to handle a request. # # Useful range of values: 5 to 120 # max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad # SECURITY CONFIGURATION security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf # CLIENTS CONFIGURATION $INCLUDE ${confdir}/clients.conf # SNMP CONFIGURATION snmp = no $INCLUDE ${confdir}/snmp.conf # THREAD POOL CONFIGURATION thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } # MODULE CONFIGURATION modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } # Extensible Authentication Protocol $INCLUDE ${confdir}/eap.conf # Microsoft CHAP authentication mschap { authtype = MS-CHAP #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } # Lightweight Directory Access Protocol (LDAP) ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 } #} #} realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } # checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id data-type = string } #} preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no # H323-Attribute = "value" with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 #suppress { # User-Password #} } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { # allowed values: {no, yes} wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } # Instantiation instantiate { exec expr } authorize { preprocess chap mschap suffix eap files } # Authentication. authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix # } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { # } } pre-proxy { } post-proxy { eap } xxxxxxxxxxxxxxradiusd.conf ends here xxxxxxxxxxxxxxxxx xxxxxxxxxxxxxx eap.conf xxxxxxxxxxxxx ap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh # random_file = ${raddbdir}/certs/random # fragment_size = 1024 # include_length = yes # check_crl = yes # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # } peap { default_eap_type = mschapv2 } mschapv2 { } } xxxxxxxxxxxxxxxxx eap.conf ends here xxxxxxxxxxxxxxxxxxxxxx xxxxxxxxxx clients.conf xxxxxxxxxxx # # clients.conf - client configuration directives client 127.0.0.1 { secret = testing123 shortname = localhost nastype = other # localhost isn't usually a NAS... } #client 192.168.0.0/24 { # secret = testing123-1 # shortname = private-network-1 #} # #client 192.168.0.0/16 { # secret = testing123-2 # shortname = private-network-2 #} xxxxxxxxxxxxxxx clients.conf ends here xxxxxxxxxxxxxxxx xxxxxxxxx users xxxxxxxxx "testuser" User-Password == "testing" Reply-Message = "Hello, %u" DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP xxxxxxxxxx users file ends here xxxxxxxxxxxxxxxxx can anybody suggest me how to make it work(what modifications i need to do) -- Regards Pradeep Singh

3 2