November 2007 - Freeradius-Users - lists.freeradius.org

Execute A Script After User Authenticate
by fvt3 28 Nov '07

28 Nov '07

Hi, I have Freeradius setup to authenticate user off mysql database. I was able to set Freeradius to execute a script base on what group a user is in. ex. usergroup table: username groupname Jdoe testprogram radgroupreply table: Groupname atrribute op value testprogram Exec-Program-Wait == /usr/local/etc/raddb/test.pl When user Jdoe authenticates, the script ran no problem. My problem is how do you pass the user-name and client host information to this script. Note: I was able to pass the user-name to the script when the following is placed in the users file. However this does not behave the way I want. DEFAULT Auth-Type= local Exec-Program-Wait = '/usr/local/etc/raddb/test.pl %{User-Name}', Any help would be appreciated.. ____________________________________________________________________________________ Get easy, one-click access to your favorites. Make Yahoo! your homepage. http://www.yahoo.com/r/hs

2 1

Re: rlm_passwd and EAP-MD5
by Alan DeKok 28 Nov '07

28 Nov '07

Kolbjørn Barmen wrote: > Can rlm_passwd be used together with EAP-MD5? Yes. Only if the password is in clear-text. > If I in the users file set "Password == blabla" for a user test-user > and then connects using radeapclient as described in the manual with > "EAP-MD5-Password = blabla" it works fine. However, I want to use an > external clear-text password instead of having the password in users, > since I want to change the password for each and every test, and do > not want to HUP radiusd all the time. I'm not sure that will work. > On the same server I use rlm_passwd already for authenticate certain > clients against a TACACS passwd file, and for those clients I have in > users file entires like this: > > DEFAULT Auth-Type := PAP, Client-IP-Address == "w.x.y.z" > > which (if I have grasped things right) enforces those to use PAP, In 1.1.7, you don't need that Auth-Type. > With the above I get in the log: > > Info: rlm_eap_md5: User-Password is required for EAP-MD5 authentication Ugh. It works in 1.1.7. Which version are you running? > As for "Why EAP-MD5?", I just need some EAP-method for which > I can easily generate requests with radeapclient. See also wpa_supplicant and eapol_test. I use it to test all of the EAP types... Alan DeKok.

1 0

rlm_passwd and EAP-MD5
by Kolbjørn Barmen 28 Nov '07

28 Nov '07

Can rlm_passwd be used together with EAP-MD5? If I in the users file set "Password == blabla" for a user test-user and then connects using radeapclient as described in the manual with "EAP-MD5-Password = blabla" it works fine. However, I want to use an external clear-text password instead of having the password in users, since I want to change the password for each and every test, and do not want to HUP radiusd all the time. Is this at all possible? More details... On the same server I use rlm_passwd already for authenticate certain clients against a TACACS passwd file, and for those clients I have in users file entires like this: DEFAULT Auth-Type := PAP, Client-IP-Address == "w.x.y.z" which (if I have grasped things right) enforces those to use PAP, and this works excellent with module passwd tacacs { filename = /local/etc/tacpasswd format = "*User-Name:Crypt-Password:::::" delimiter = ":" hashsize = 100 ignorenislike = yes ignoreempty = yes allowmultiplekeys = no } Now, what I want is another passwd-module as above: passwd mypw { filename = ${confdir}/mypasswd format = "*User-Name:Cleartext-Password" delimiter = ":" hashsize = 100 ignorenislike = yes ignoreempty = yes allowmultiplekeys = no } and mypasswd being in the form "test-user:cleartextpassword" and in users instead of: test-user Password == "blabla", NAS-Identifier == "mytest-NAS" Reply-Message = "myradius.somewhere.no: OK" which works just fine, I have test-user NAS-Identifier == "mytest-NAS" Reply-Message = "myradius.somewhere.no: OK" and have EAP-MD5 work with this. My radeapclient sends: User-Name = test-user(a)test-realm.no NAS-Identifier = mytest-NAS EAP-MD5-Password = blabla EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = test-user(a)test-realm.no Message-Authenticator = 0x00 NAS-Port = 0 With the above I get in the log: Info: rlm_eap_md5: User-Password is required for EAP-MD5 authentication Auth: Login incorrect: [test-user] (from client blabla.somewhere.no port 0) And with debug (-X) I see this: modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry test-user at line 7 Yay! modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "tacacs" returns notfound for request 5 modcall[authorize]: module "mypw" returns notfound for request 5 Sob.. why? rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [test-user] (from client foo.somewhere.no port 0) Anyone got a tip on how I might do this? As for "Why EAP-MD5?", I just need some EAP-method for which I can easily generate requests with radeapclient. Thanks! :) -- Kolbjørn Barmen UNINETT Driftsenter

1 0

radtest seems to fail out of the box
by Dan Gahlinger 28 Nov '07

28 Nov '07

Ok, Al, can you explain or help with this. just to appease you, I unpacked free radius, out of the box, changed a single line in "server" as such: 127.0.0.1 testing123 3 ran radtest using a testuser local account: radtest testuser 1234 127.0.0.1 10 testing123 it failed, radtest shows: Sending Access-Request of id 90 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "1234" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=90, length=20 Radiusd -X shows: /usr/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32773, id=90, length=60 User-Name = "testuser" User-Password = "1234" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [testuser]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 90 to 127.0.0.1 port 32773 Waking up in 4 seconds... the password is valid, as a local SSH using the same information works. And one other oddity, when using users with "hardended" passwords like say "test@" radtest and radiusd -X will show the password as "test2", whether quotes are used or not. is this normal? and why does the radtest fail? no other configurations or files where changed. everything is default. _________________________________________________________________ Are you ready for Windows Live Messenger Beta 8.5 ? Get the latest for free today! http://entertainment.sympatico.msn.ca/WindowsLiveMessenger

2 3

Dynamic Realm
by Michael da Silva Pereira 28 Nov '07

28 Nov '07

I wonder if somebody else has managed to get this kind of thing right, I want to eliminate the need for usernames in my authentication process, I want to work with the callerid instead. Now thats not very hard, except now I want to be able to classify a user/callerid into a specific realm, a realm of which is declared in a SQL table. I've tried creating a Perl module with rlm_perl but it doesn't seem to classify the user into a realm. I don't really want to create a custom module for it, as I like to keep this kind of thing config based and not modular. Any Ideas? Thanks, Mike

4 5

Password Authentication Failing
by Frank Everitt 28 Nov '07

28 Nov '07

I'm running Freeradius 1.1.6 on a Solaris 10 platform and have run across a strange problem. My password file contains over 80 thousands entries and it appears that freeradius won't find a user entry beyond line 76665. Is there a buffer that can be bumped up or have I just reached a limitation of using the UNIX style password file within radiusd? Any insight/help would be greatly appreciated. Thanks... Frank ------------------------------------------------------------ | | Frank Everitt | | Systems Administrator :|||: :|||: 7025 Kit Creek Rd. :|||||: :|||||: RTP, NC 27709 ..:|||||||:.....:|||||||:.... Ph :(919) 392-8885 FAX :(469) 574-5042 CISCO SYSTEMS Cell:(919) 624-6098 ------------------------------------------------------------

3 4

Convert from user@domain to domain\user
by Robert Graham 28 Nov '07

28 Nov '07

Hi all I am a newbie to freeradius and I have searched the internet and all the documentation I can find, however I cannot find a simple solution to the following problem. I want to have the freeradius server act as a proxy and receive radius requests in the form user@domain but then pass these requests to another server that needs to have the request in domain\user format. It would seem to be a simple format issue which you should be able to create an output template or something but I don't have a clue. Running freeradius v 1.188.2.4.2.12 Rob Graham

2 1

destination unreachable (port unreachable)
by inl2goal 27 Nov '07

27 Nov '07

Hello: FreeRadius was working perfectly with EAP/MD5 a few weeks ago here. But some providers came here to offer a NAC solution and messed with the network configuration. Authentication stopped working, and by using a sniffer we realised that packets get to the freeRADIUS server, to which it responds with a challenge but apparently that challenge never gets back to the switch and it sends a "destination unreachable (port unreachable)" message. Any ideas why that might happen? Thanks -- View this message in context: http://www.nabble.com/destination-unreachable-%28port-unreachable%29-tf4883… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

freeradius support eap-fast?
by Hangjun He 27 Nov '07

27 Nov '07

Hi, Eap-fast introduction from cisco said freeradius support eap-fast. Is it right? http://www.t11.org/ftp/t11/pub/fc/sp-2/07-595v0.pdf John --------------------------------- 雅虎邮箱，终生伙伴！

4 7

Re: freeradius-pre2 .. "unknown client" appears in log !
by Alan DeKok 27 Nov '07

27 Nov '07

Edvin Seferovic wrote: > Ive just installed freeradius-pre2 Please try the CVS head. It has large numbers of fixes over -pre2. > Would it be possible to have the name of the virtual server in the log too ? > Something like > Servername: Auth: Login OK: [00:01:6c:a0:93:57] (from client switch_1stock > port 23 cli 00-01-6c-a0-93-57) Not a bad idea. That should really be configurable in radiusd.conf. Alan DeKok.

1 0