November 2007 - Freeradius-Users - lists.freeradius.org

nas-port always the same
by John Kougoulos 05 Nov '07

05 Nov '07

Hello all, I'm trying to integrate a Cisco wireless controller in web authentication mode with freeradius which uses rlm_dbm as user database. I run also some extra scripts using rlm_exec to update the session-timeout etc. The odd thing is that this device sends as nas-port always the number 1. So, this breaks rlm_radutmp and the check simultaneous users functionality. Obviously the correct method is to try to convince cisco to send different nas-port number for every request. However, in the mean time I thought of changing the nas-port with a number based on the calling-station-id (the last 4 bytes of the client's mac-address). To do this I tried the rlm_perl, in preacct, but as far as I've understood from the archives of the mailing list, I cannot change the request pairs, at least up to Freeradius 1.1.7. Is this correct? Is this functionality supported on 2.0.0pre2 ? Am I in the correct path for resolving this issue or should I consider an alternative method? thanks, John

2 3

Need help
by Frank Winkler 05 Nov '07

05 Nov '07

Hi there ! Could someone please assisst me in configuring FreeRADIUS? I'm quite new to FR and migrated a server from 0.6 on Solaris 8/SPARC to 1.1.7 on Solaris 10/x64. On the old server, the users were authenticated by regular /etc/passwd means. I got this working on the new server. As there are some new features in the later versions, I'd prefer to move the RADIUS users to a separate smbpasswd-like file but I can't get the authentication to work. Some questions: The old server querying itself for a /etc/passwd user: root@old # ./radtest frank XXX localhost 10 test123 Sending Access-Request of id 161 to 127.0.0.1:1812 User-Name = "frank" User-Password = "D[\326<\255h\016A\275\357"%\367\027_y" NAS-IP-Address = XXX NAS-Port-Id = "10" rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=161, length=20 root@old # The old server querying the new one for a /etc/passwd user: root@old # ./radtest frank XXX new 10 test123 Sending Access-Request of id 216 to 10.1.1.12:1812 User-Name = "frank" User-Password = "T)n\244Lec\226\246)U@\366\217&%" NAS-IP-Address = XXX NAS-Port-Id = "10" rad_recv: Access-Accept packet from host 10.1.1.12:1812, id=216, length=20 root@old # The new server querying itself for the exact same user as above: root@new# ./radtest frank XXX localhost 10 test123 Sending Access-Request of id 177 to 127.0.0.1 port 1812 User-Name = "frank" User-Password = "XXX" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=177, length=20 root@new# Why is the password displayed in plain text instead of hashed as on the old server? And how do I configure a separate user file? Currently, I have passwd radpasswd { filename = /opt/freeradius/etc/radpasswd #format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" format = "*User-Name:LM-Password:NT-Password:" delimiter = ":" # authtype = MS-CHAP authtype = PAP hashsize = 0 ignorenislike = yes allowmultiplekeys = no } with radpasswd looking like frank:A:B:Frank Winkler with A and B created by "smbencrypt". I'm pretty unsure about the "authtype". I can post debug outout of radiusd but it looks like it finds the user in the file but cannot authenticate the password. TIA fw

2 7

RE: PAM_RADIUS_AUTH - Need help
by Sobanbabu Bakthavathsalu 05 Nov '07

05 Nov '07

Hi Alan, Any thought gone on this? Why is the plugin unable to resolve the IP address of the RADIUS server, or trying to resolve an IP to IP? Is that something related to compilation? Regards Soban ________________________________________ From: Sobanbabu Bakthavathsalu Sent: 02 November 2007 11:59 To: FreeRadius users mailing list Subject: RE: PAM_RADIUS_AUTH Is this compatible with Solaris 10 First time I tried with IP address only, and got the following error. Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.31.186 (errcode=12) Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.69.133 (errcode=12) It was trying to resolve the IP address for an address again. Later I made a host entry and tried and the changed the config to name again. And getting the same error. Regards Soban ________________________________________ From: Sobanbabu Bakthavathsalu Sent: 31 October 2007 10:46 To: FreeRadius users mailing list Subject: RE: PAM_RADIUS_AUTH Hi Alan, First time I tried with IP address only, and got the following error. Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.31.186 (errcode=12) Oct 25 19:58:20 ada-delegate1 login: [ID 801593 auth.error] pam_radius_auth: Failed looking up IP address for RADIUS server 10.213.69.133 (errcode=12) It was trying to resolve the IP address for an address again. Later I made a host entry and tried and the changed the config to name again. And getting the same error. Regards Soban ________________________________________ From: freeradius-users-bounces(a)lists.freeradius.org [freeradius-users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok [aland(a)deployingradius.com] Sent: 30 October 2007 17:28 To: FreeRadius users mailing list Subject: Re: PAM_RADIUS_AUTH Sobanbabu Bakthavathsalu wrote: > Thank you for the response. There is no firewall in between the RADIUS server and Solaris server (RADIUS client), only an Cisco router with standard ACL. I have verified the ACL matches counter and found that the request from the clinet itself is not reachign the router. > Is that host entries in /etc/hosts file wont work for this, do I need a DNS server for RADIUS server name authentication to work with pam_radius_auth. No. You *can* enter just an IP address... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

2 1

Using Freeradius with Ruby
by Werner Stucky 05 Nov '07

05 Nov '07

Hi All I want to hand off some custom processing to a ruby script. What would be the best way to implement this. I need the same functionality provided by rlm_perl. Should I use rlm_perl to call the ruby script? Or is there a better way. Thanks -- Werner Stucky Stucky Motors IT Cell : +27 72 605 0035 Fax : +27 86 636 6237 E-Mail : werner(a)stucky.co.za Web : www.stucky.co.za

2 1

FreeRadius hanging
by Phil Mayers 05 Nov '07

05 Nov '07

All, We've had sporadic problems with our Wireless radius service hanging. The occurrences tended to be spaced weeks apart, and consist of clusters of hangs 4-12 hours apart over a few days. I had formed the hypothesis that a particular client or type of client was triggering it - when they realised they could never authenticate (because unknown to them, they were hanging the server) they went away. These problems generally manifest in one of two ways: * the process hangs (and is unkillable except by -9) - most common * the process CPU runs to 100% - less common The service basically does PEAP/MS-CHAP with ntlm_auth helper and rlm_sql_postgresql; the database does not seem to be the issue. We are not HUPing the server. We were running on 1.1.6 and I was holding off reporting the issue until we had time to move to 1.1.7; however the issue has started to occur again and seems to be longer-lived this time. I've upgraded to 1.1.7 and it's still happening. I have managed to get a capture, and observe what the last packets were before the server stopped responding; sure enough, it was in the middle of a PEAP conversation. The last packet(s) the server manages to get our contain the (PEAP-fragmented) SSL server hello/certificate/hello done. The client then responds with the EAP/PEAP/TLS client key ex/change cipher/encrypted handshake, to which it never gets a response. The underlying OS is RHEL4 with OpenSSL 0.9.7a plus RHEL backports. I haven't yet managed to capture a backtrace from a hung 1.1.7 but I got a few from 1.1.6; nothing particular stands out. I'll wait until it happens again and get a definitive one from the 1.1.7 binary. Does anyone have any thoughts on what I might to do narrow the problem down?

2 1

pam_radius_auth updated spec file, please include in future releases
by Florin Andrei 05 Nov '07

05 Nov '07

I attached an updated spec file for pam_radius_auth. The original one fails when building as non-root. I fixed that and made a few other minor changes. It would be nice if the build system could generate this spec file from a template, automatically replace the version number inside the spec with the actual version of the pam_radius_auth tarball, and include the automatically generated spec in the tarball. That way, users could generate RPM packages out of the tarball by simply downloading the archive and running: rpmbuild -ta pam_radius...(version number here)...tar.gz Thanks, -- Florin Andrei http://florin.myip.org/

2 2

Maintaining a (very) dynamic user list with freeradius
by Jos Vos 05 Nov '07

05 Nov '07

Hi, What is the best way to maintain a very dynamic user list for freeradius (on a Linux platform)? I'm talking about a setup where every few minutes (sometimes every minute) a user has to be added and/or removed, with in total up to about 200 users in the user base at the same moment. Ideally, I'd like to just regenerate the users file with a script whenever a change is needed and let radiusd reload it, but I saw in the docs that reloading the config (and the users file) is "expensive", so this will probably not be very suitable for this situation. If anyhow possible I'd like to minimize any extra overhead, and avoid running PostgreSQL or MySQL servers, for example. Maybe use DBM? What is recommended for this purpose? Thanks for all suggestions. -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

5 10

FreeRADIUS with PostgreSQL fails to authenticate
by Jos Vos 04 Nov '07

04 Nov '07

Hello, After configuring FreeRADIUS to use PostgreSQL, and adding a user to the database, when doing a "radtest" for that user I see with "radiusd -X": modcall[authorize]: module "sql" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. It looks like the password is not checked against the radcheck table. There I added the user with attribute "User-Password", op ":=" and a password value. I also added another user to the users file and that user is accepted. This is with the old freeradius 1.0.1, but I hope the problem I have is just a simple user configuration error. Thanks for any suggestions, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

2 2

Problem: Proxy cleartext-password requests to remote IAS that only
by Erling Paulsen 03 Nov '07

03 Nov '07

Hi. I have the following scenario: [1]NAS <--> [2]FreeRADIUS <--> [3]IAS [1] A NAS that supports RADIUS. It sends request-packets with "User-Password" set in cleartext. [2] A FreeRADIUS server that proxies certain users (by realm) to another server (IAS). [3] An IAS (Windows RADIUS). The problem is that this server ONLY accepts ms-chap1 or ms-chap2 session. Is there a common way to bypass this problem, I cannot find any? I was thinking it would be nice to let FreeRADIUS act as an ms-chap session client on behalf of the NAS, and then in the end only send ACCEPT/DENY back to the NAS instead of proxying directly to the IAS (which denies cleartext logins). Is this possible in some way? -- Erling Paulsen

2 1

Users can't access the Web
by Rob Borland 03 Nov '07

03 Nov '07

I've installed FreeRadius-0.9.3 (the latest version my old RedHat Linux distribution will support). FreeRadius is working fine for logins but since installing it users can't access the Web. I'd appreciate any advice. Regards, Rob

1 1