August 2006 - Freeradius-Users - lists.freeradius.org

Active Directory Users
by Mohammad Abohelal 17 Aug '06

17 Aug '06

Hi all I need help with simple configuration to authenticate windows active directory users via free radius. I have a domain controller, Cisco vpdn router , and free radius UNIX environment ( FreeBSD ) Active directory group: VPDN, user name's have allow dialin on user option Radiusd.conf ldap configuration: ldap { server = "ad.xxx.yyy" identity = "CN=radiusd,OU=External_Object,DC=xxxl,DC=yyy" password = radiusd111 basedn = "OU=VPDN_USERS,OU=External_Object,DC=xxx,DC=yyy" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" When I try to connect via l2tp dialer I get error: (auth: Failed to validate the user ( modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "vpdn1" with password "xxxx" radius_xlat: '(uid=vpdn1)' radius_xlat: 'OU=VPDN_USERS,OU=External_Object,DC=xxxl,DC=yyy' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ad.xxx.yyy:389, authentication 0 rlm_ldap: bind as CN=radiusd,OU=External_Object,DC=xxx,DC=yyy/radiusd111 to ad.xxx.yyy:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in OU=VPDN_USERS,OU=External_Object,DC=xxx,DC=yyy, with filter (uid=vpdn1) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [vpdn1/xxxx (from client wan-gw1 port 25) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 194.90.143.73:1645, id=20, length=102 Sending Access-Reject of id 20 to 194.90.143.73 port 1645 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 20 with timestamp 44e4c472 Nothing to do. Sleeping until we see a request. Thank you Mohammad

3 4

Garbled class attribute?
by Geoff Silver 17 Aug '06

17 Aug '06

I have a bunch of users which should have a class attribute returned upon successful authentication. Their entries look something like: bob NAS-IP-Address == 172.31.33.66, Hint==HasSlash Auth-Type:=Accept Class = "OU=MY_CORP", Filter-Id = "SPCCOLO_O", Split-Tunneling-Policy = 1, Split-Tunnel-List = "SPCCOLO_ST" What they're actually getting back is: Packet-Type = Access-Accept User-Name = "bob" Class = 0x3739774831423272375053516a71424143444358434979507544493d Filter-Id = "SPCCOLO_O" Split-Tunneling-Policy = 1 Split-Tunnel-List = "SPCCOLO_ST"

3 7

Pretty easy question, I think? :D
by Drew Weaver 17 Aug '06

17 Aug '06

I'm setting up a new AAA server here using freeradius. I am just attempting to get it to authenticate using /etc/passwd (unix style) and I am getting this error: Thu Aug 17 11:06:51 2006 : Debug: rad_check_password: Found Auth-Type System Thu Aug 17 11:06:51 2006 : Debug: auth: type "System" Thu Aug 17 11:06:51 2006 : Debug: ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. Thu Aug 17 11:06:51 2006 : Debug: auth: Failed to validate the user. This is my module configuration: unix { cache = no cache_reload = 600 passwd = /etc/passwd group = /etc/group shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } Anyone have any advice for me? Thanks, Andrew

2 1

Regarding using strcmp instead of memcmp
by Ravi S M 17 Aug '06

17 Aug '06

Hi I am trying to run free radius code with purify , it is giving errors as UMR: Uninitialized memory read (13 times) in memcmp Reading 5 bytes from 0xffbdd108 on the stack (1 byte at 0xffbdd10c uninit). Address 0xffbdd108 is 4 bytes past start of local variable "cs" in function So can I use strcmp instead of memcmp . because if I use strcmp instead of memcmp the error is not coming Please I would be grateful if u can provide some useful information regarding this Thanks & regards Ravi ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

RE: question about an output
by John Mylchreest 17 Aug '06

17 Aug '06

Agreed, it is clear and it does make sense, but did it warrant such a tactless reply? Anyways, I'm feeding the troll so I'll not be reading anymore of the thread. -----Original Message----- From: freeradius-users-bounces+john.mylchreest=ioko.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+john.mylchreest=ioko.com@lists.freeradius.org] On Behalf Of Stefan Winter Sent: 17 August 2006 15:33 To: FreeRadius users mailing list Subject: Re: question about an output > /etc/raddb/users[154]: Syntax error: Previous line is missing a trailing > comma for entry DEFAULT > > Basically, it is something in the config file, but is there a way to locate > the error in this configuration file? How could this message be any more clear? What do you *think* you have to chack, after reading this output, word by word? Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473 Communications on or through ioko's computer systems may be monitored or recorded to secure effective system operation and for other lawful purposes. Unless otherwise agreed expressly in writing, this communication is to be treated as confidential and the information in it may not be used or disclosed except for the purpose for which it has been sent. If you have reason to believe that you are not the intended recipient of this communication, please contact the sender immediately. No employee is authorised to conclude any binding agreement on behalf of ioko with another party by e-mail without prior express written confirmation. ioko365 Ltd. VAT reg 656 2443 31. Reg no 3048367. All rights reserved.

1 0

Garbled class attribute?
by Geoff Silver 17 Aug '06

17 Aug '06

I should note that when I set Class to be a string in the dictionary.rfc2865 file instead of a octets, I get: Class = "79wH1B2r7PSQjqBACDCXCIyPuDI=" Which looks equally wrong to me. -------- Original Message -------- Subject: Garbled class attribute? Date: Thu, 17 Aug 2006 11:40:50 -0400 From: Geoff Silver <geoff+freeradius(a)uslinux.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> I have a bunch of users which should have a class attribute returned upon successful authentication. Their entries look something like: bob NAS-IP-Address == 172.31.33.66, Hint==HasSlash Auth-Type:=Accept Class = "OU=MY_CORP", Filter-Id = "SPCCOLO_O", Split-Tunneling-Policy = 1, Split-Tunnel-List = "SPCCOLO_ST" What they're actually getting back is: Packet-Type = Access-Accept User-Name = "bob" Class = 0x3739774831423272375053516a71424143444358434979507544493d Filter-Id = "SPCCOLO_O" Split-Tunneling-Policy = 1 Split-Tunnel-List = "SPCCOLO_ST"

1 0

Query to know radius disconnect request and Ack is supported in freeradius
by Shankar Ganesh C 17 Aug '06

17 Aug '06

Hi All, Could some body help me to know whether Radius disconnect and Ack messages are supported in free radius as defined in RFC 2822 ? The message ID are diconnet 40 adn Ack 41. Thanks and regards Shankar ganesh

2 2

Unknown user or bad password while using Free RADIUS PAM
by Shteinberg-hirik, Jenny (Jenny) 17 Aug '06

17 Aug '06

Hi, We use Free Radius PAM_RADIUS_AUTH (version 1.3.16) intergrated into Linux from WindRiver distribution based on kernel 2.6.10 As Radius Server we use Internet Authentication Server from Win2000 Server. We can not receive authentication for user defined on the Radius Server. Here the Warning that is logged on the Radius Server for this event: User slb was denied access. Fully-Qualified-User-Name = KERNEL\slb NAS-IP-Address = 127.0.0.1 NAS-Identifier = check Called-Station-Identifier = <not present> Calling-Station-Identifier = 135.64.103.49 Client-Friendly-Name = 149.49.76.121 Client-IP-Address = 149.49.76.121 NAS-Port-Type = Virtual NAS-Port = 16015 Policy-Name = <undetermined> Authentication-Type = PAP EAP-Type = <undetermined> Reason-Code = 16 Reason = There was an authentication failure because of an unknown user name or a bad password. Using the same PAM_RADIUS_AUTH installed on VMware Player (version 1.0.1) enables us receive authentication for the same user. Here the Information that is logged on the Radius Server for this event: User slb was granted access. Fully-Qualified-User-Name = KERNEL\slb NAS-IP-Address = 127.0.0.1 NAS-Identifier = check Client-Friendly-Name = 135.64.102.130 Client-IP-Address = 135.64.102.130 NAS-Port-Type = Virtual NAS-Port = 24935 Policy-Name = GAdmin Authentication-Type = PAP EAP-Type = <undetermined> Both Radius clients ( for Linux and for VmWare) are configured absolutely identical on the Radius Server. The same user, same password and the same shared secret are used. What can be the problem? Thank you, Jenny

2 1

Re: Freeradius-Users Digest, Vol 16, Issue 66
by raviprakash sunkara 17 Aug '06

17 Aug '06

Hi peter , Thanks for replying ... The NAS value is MY radius server ip... Really i don't Know that... What NAS value should take . Bywe On 8/17/06, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Unknown user or bad password while using Free RADIUS PAM > (Shteinberg-hirik, Jenny (Jenny)) > 2. Re: Oracle is not supported by radsqlrelay? (Nicolas Baradakis) > 3. AcctSessionTime is inserting Null (raviprakash sunkara) > 4. Help! (Shankar Ganesh C) > 5. Re: AcctSessionTime is inserting Null (Peter Nixon) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 17 Aug 2006 14:16:04 +0300 > From: "Shteinberg-hirik, Jenny $Jenny$" <jhirik(a)avaya.com> > Subject: Unknown user or bad password while using Free RADIUS PAM > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: > < > AAB4B3D3CF0F454F98272CBE187FDE2F0B0C7AEE(a)is0004avexu1.global.avaya.com> > > Content-Type: text/plain; charset="us-ascii" > > Hi, > > We use Free Radius PAM_RADIUS_AUTH (version 1.3.16) intergrated into > Linux from WindRiver distribution based on kernel 2.6.10 > As Radius Server we use Internet Authentication Server from Win2000 > Server. > > We can not receive authentication for user defined on the Radius Server. > Here the Warning that is logged on the Radius Server for this event: > > User slb was denied access. > Fully-Qualified-User-Name = KERNEL\slb > NAS-IP-Address = 127.0.0.1 > NAS-Identifier = check > Called-Station-Identifier = <not present> > Calling-Station-Identifier = 135.64.103.49 > Client-Friendly-Name = 149.49.76.121 > Client-IP-Address = 149.49.76.121 > NAS-Port-Type = Virtual > NAS-Port = 16015 > Policy-Name = <undetermined> > Authentication-Type = PAP > EAP-Type = <undetermined> > Reason-Code = 16 > Reason = There was an authentication failure because of an unknown user > name or a bad password. > > Using the same PAM_RADIUS_AUTH installed on VMware Player (version > 1.0.1) enables us receive authentication for the same user. Here the > Information that is logged > on the Radius Server for this event: > > User slb was granted access. > Fully-Qualified-User-Name = KERNEL\slb > NAS-IP-Address = 127.0.0.1 > NAS-Identifier = check > Client-Friendly-Name = 135.64.102.130 > Client-IP-Address = 135.64.102.130 > NAS-Port-Type = Virtual > NAS-Port = 24935 > Policy-Name = GAdmin > Authentication-Type = PAP > EAP-Type = <undetermined> > > Both Radius clients ( for Linux and for VmWare) are configured > absolutely identical on the Radius Server. The same user, same password > and the same shared secret are used. > What can be the problem? > > > Thank you, > > Jenny >

2 1

Freeradius on Fedora Core 4
by Vida Luz Arista 17 Aug '06

17 Aug '06

Hi All I have installed rpm freeradius-1.0.4-1.FC4.1 on Fedora core 4, however I have the following problems, whe I use radtest for test my server radtest kiko "kako99" localhost 1812 testing123 Sending Access-Request of id 215 to 127.0.0.1:1812 User-Name = "vlal" User-Password = "vita99" NAS-IP-Address = smtp.cablenet.com.ni NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=215, length=20 All my user are of my system (/etc/passwd and /etc/shadow), I need to enable radius for dialuo users. I am testing the radius server with [root@mailproxy3 raddb]# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "(null)" unix: group = "/etc/group" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. I need you suggestions. Regards.

4 5