September 2006 - Freeradius-Users - lists.freeradius.org

rautmp not working..
by Collen Blijenberg 14 Sep '06

14 Sep '06

Hello all... i'm trying to make rautmp to work... but it doesn't... -xx debug showes: ------ Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) ------- also in radiusd.conf: radutmp { filename = ${LOGDIR}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = yes } accounting { detail radutmp } session { radutmp } ----- but no radutmp file is created, and if created by hand it stay's 0 bytes... dunno my guesses tells me i forgot something... ??? but what.. Greets Collen

2 5

freeRADIUS doc
by Carlo Prestopino 14 Sep '06

14 Sep '06

Hi all, I'm trying to access freeRaDIUS doc section (http://www.freeradius.org/radiusd/doc/) but I got a "Forbidden" access message. Is this section accessible to normal users? Best regards, Carlo

4 3

Re: IAS and Openser
by Artur Hayne 14 Sep '06

14 Sep '06

modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_realm: Looking up realm "voip.domain.br" for User-Name = "teste(a)voip.domain.br" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user teste to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 3 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for teste(a)voip.domain.br radius_xlat: '(uid=teste(a)voip.domain.br)' radius_xlat: 'ou=users,dc=voip,dc=domain,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,dc=voip,dc=domain,dc=br, with filter (uid=teste(a)voip.domain.br) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 3 modcall: leaving group authorize (returns notfound) for request 3 Sending Access-Request of id 3 to 10.2.1.XY port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Proxy-State = 0x323038 Re-sending Access-Request of id 0 to 10.2.1.XX port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Client-IP-Address = 10.2.1.XX Realm = "DEFAULT" Module-Failure-Message = "rlm_ldap: User not found" Realm = "DEFAULT" Proxy-State = 0x323035 Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.2.1.XX:33634, id=206, length=200 Ignoring duplicate packet from client OpenSER:33634 - ID: 206, due to outstanding proxied request 1. Its seems the proxy is working, but it dont communicate with the IAS. -- Module-Failure-Message = "rlm_ldap: User not found" -- I dont know what meanig, but the sound is not good. The command ldasearch return a rigth answer, I dont know what happended. The problem is in IAS? How can I test it? Any ideia? Merci. -------- freeradius-users-request(a)lists.freeradius.org escreveu:Hi, > How can I transform freeradius server in a proxy? > I configured the proxy.conf, but seems dont work > > And I uncommnet the line in radiusd.conf: > > proxy_requests = yes > $INCLUDE ${confdir}/proxy.conf > > I wanna do this: > |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| > > Its work? > > And in IAS should I configured anything? Configure the NULL realm with the same settings as DEFAULT. Other than that, the config sounds good to me. Did you change anything apart from that in the default config file? In particular, you need to have at least one instance of the "realm" module in authorize { }. The default config has "suffix" in there, that should be fine. You need to be sure then that your user names don't contain the @ character - otherwise they won't match the DEFAULT realm you set up in proxy.conf. If you are positive that an instance of realm is in authorize and NULL is configured, but it still doesn't work then please post the debug output (radiusd -X) of a packet that arrived and was supposed to be proxied, but wasn't. > Sorry for the portuguese e-mail. When I read it, I wondered what strange dialect of Spanish this is. :-) Portuguese and Spanish aren't that far apart after all, it seems. Greetings, Stefan Winter --------------------------------- Yahoo! Acesso Grátis - Internet rápida e grátis. Instale o discador agora!

1 0

issue while setting up clients list from mysql
by Christian Hahn 14 Sep '06

14 Sep '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I've running a freeradius 2.0.0.pre0 from CVS (20060912) and have problems generating the clients list from the nas table of an mysql server. The mysql server is running on localhost I can connect using the same user/password combination configured in the radiusd sql section. On the mysql console I can ask the SELECT query for the nas tables defined in sql/mysql-dialup.conf with success. But if I fire up the radiusd it gives this error: - ----------8<----------- rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to radius@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret FROM nas rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=testing123 rlm_sql (sql): Adding client 127.0.0.1 (localhost) to clients list rlm_sql (sql): generate_sql_clients() returned error rlm_sql (sql): Closing sqlsocket 4 rlm_sql (sql): Closing sqlsocket 3 rlm_sql (sql): Closing sqlsocket 2 rlm_sql (sql): Closing sqlsocket 1 rlm_sql (sql): Closing sqlsocket 0 radiusd.conf[11]: sql: Module instantiation failed. radiusd.conf[1966] Failed to find module "sql". radiusd.conf[1889] Failed to parse authorize section. Errors setting up modules I'm a little bit lost now, maybe I don't see the obvious. Any hints what can cause this error are appreciated. regards, Christian -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFFCUPj6kMW7HW8620RAt9PAJ9pU1Ff4pmx5aIVuc7kfA7T7o2uWwCgnxDr FGRD6tYbV9JPq64hah4N48s= =6EQ9 -----END PGP SIGNATURE-----

1 0

NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47
by ego seek 14 Sep '06

14 Sep '06

Date: Wed, 13 Sep 2006 16:35:49 +0100 From: Rob Shepherd <rob(a)techniumcast.com> Subject: Re: NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <45082555.6030105(a)techniumcast.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Thank you, but, after done that radiusd display this to me: radius_xlat: 'davide' rlm_sql (sql): sql_set_user escaped user --> 'davide' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'davide' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql: Failed to create the pair: Unknown attribute "NT_Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 What I have to do now? (username=davide, password=verde, my radcheck table row is: ------------|------------------------------|--------|--------------------------------------------------------------| |davide | NT_Password | := | 781b0395cf9f8c1e5873eee5d28c38eb | ------------|------------------------------|---------|--------------------------------------------------------------| where i have to configure radius? BEst regards. ego seek wrote: > I'm working with mschapv2, > I use a PHP web site to register a user, can i insert into the db a > NT-hased password? Yes, radcheck should contain UserName | Attribute | op | Value | ----------|---------------|------|------------------------------------| colin | NT_Password | := | abcdef1234567890abcdef1234567890 | I use Pear Crypt... <?php $cr = new Crypt_CHAP_MSv1(); $cr->password = $password; $NThash = bin2hex($cr->ntPasswordHash()); ?> Rob

2 1

(Desperate) help setting up freeradius for use with eap-tls and win clients
by Federico Carbonetti 14 Sep '06

14 Sep '06

Hello everybody! I am completely new to freeradius and its world, as well as to linux environment.. I post this e-mail because I have few days left to configure freeradius for an exam about WLAN security and I am desperate... :( Yesterday I installed freeradius 1.1.3 on my linux kubuntu box (where I have kernel 2.6.15 installed) by following this step by step guide in 3 parts: http://www.linuxjournal.com/article/8151 Everything worked fine, maybe I just wasn't sure about the permissions changing described in part III of the guide.. But when I finally started the server by typing rc.radiusd start It just wrote radiusd as response and then the shell prompts for new commands, while I think it should say something like "waiting to process..." Can anybody please help me to fix this? Otherwise, if you could please suggest me another HOWTO more updated and more reliable of the one I mentioned above, I could also start again on another laptop where i have kubuntu installed as well.. Thanks a lot everybody for your attention/the help you will wish to give me!:) federico

3 4

NT-PASSWORD--WORKING
by ego seek 14 Sep '06

14 Sep '06

FOUND ERROR.... if I insert NT-PASSWORD, instead of NT_PASSWORD, it work fine. thank you so much egoseek Date: Wed, 13 Sep 2006 16:35:49 +0100 From: Rob Shepherd <rob(a)techniumcast.com> Subject: Re: NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <45082555.6030105(a)techniumcast.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed ego seek wrote: > I'm working with mschapv2, > I use a PHP web site to register a user, can i insert into the db a > NT-hased password? Yes, radcheck should contain UserName | Attribute | op | Value | ----------|---------------|------|------------------------------------| colin | NT_Password | := | abcdef1234567890abcdef1234567890 | I use Pear Crypt... <?php $cr = new Crypt_CHAP_MSv1(); $cr->password = $password; $NThash = bin2hex($cr->ntPasswordHash()); ?> Rob

1 0

Maximum timed out Session
by Elie Hani 14 Sep '06

14 Sep '06

Hi; Is there a way to disconnect a user after a certain time automatically using freeradius? I've tried the entry:"Max-All-Session" in the database, but it didn't work. Thanks Elie Hani

3 2

RADIUS proxy-----trace user site surfed------
by ego seek 14 Sep '06

14 Sep '06

Does anybody know how can I setup RADIUS and a proxy server to generate a log for the users? I need to trace where in the Internet the user went. Do yoy have any other suggestion for this pourpose? thank you. Best regards egoseek

3 2

Re: IAS and Openser
by Artur Hayne 14 Sep '06

14 Sep '06

Hello, How can I transform freeradius server in a proxy? I configured the proxy.conf, but seems dont work proxy.conf: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm DEFAULT { type = radius authhost = mydomain.br accthost = mydomain.br secret = mysecret nostrip } And I uncommnet the line in radiusd.conf: proxy_requests = yes $INCLUDE ${confdir}/proxy.conf I wanna do this: |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| Its work? And in IAS should I configured anything? Sorry for the portuguese e-mail. freeradius-users-request(a)lists.freeradius.org escreveu: Hello! This list is in English. > Como faço para transformar o Freeradius num cliente do IAS? Existe algum > tutorial, ou artigo? Se for sem passar pelo servidor freeradius eu já > configurei o radiusclient para ir direto ao IAS, mas não deu certo, nada > acontece, e o pior de tudo que não tenho nem como debugar o problema e o > arquivo de log do IAS é muito fraco. > > |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| > > Da pra fazer isso? Como faço isso? > > Alguma idéia? If I got you right, all you want to do is use FreeRADIUS as a proxy to communicate to an IAS which does the authentication. This is easy, all you need to do is proxy all incoming requests to the IAS. See proxy.conf, read it, try it, and if doesn't work for you ask here again. But in English please, it's been quite a time since I had Spanish in school. Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1