December 2007 - Freeradius-Users - lists.freeradius.org

authenticating a user via rlm_sql
by Stuart Kendrick 16 Dec '07

16 Dec '07

hi, i'm trying to migrate from a flat 'users' file to postgres, and i'm seeing "No 'known good' password found for the user" from rlm_pap. freeradius-2.0.0-pre2 with an empty postgres database, i see radtest/debug traffic like this: guru> ./radtest steve testing localhost 1234 testing123 [...] rad_recv: Access-Accept packet from host 127.0.0.1 port 1234, id=172, length=20 rad_recv: Access-Request packet from host 127.0.0.1 port 52838, id=56, length=57 User-Name = "steve" User-Password = "testing" NAS-IP-Address = 140.107.74.123 NAS-Port = 1234 [...] ++[files] returns ok expand: %{User-Name} -> steve rlm_sql (sql): sql_set_user escaped user --> 'steve' rlm_sql (sql): Reserving sql socket id: 4 [...] rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 [...] rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): User steve not found [...] rlm_pap: login attempt with password testing rlm_pap: Using clear text password. rlm_pap: User authenticated successfully ++[pap] returns ok Login OK: [steve/testing] (from client localhost port 1234) Sending Access-Accept of id 56 to 127.0.0.1 port 52838 [...] that makes sense ... 'steve' does not exist in the postgres database, but is defined in '/etc/radbb/users' so now i go add user 'foozle' to my database: radius=> select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+------- 1 | foozle | Cleartext-Password | == | foo (1 row) radius=> select * from radreply; id | username | attribute | op | value ----+----------+--------------+----+------- 1 | foozle | Fall-Through | = | Yes (1 row) radius=> select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+------- 1 | foozle | Cleartext-Password | == | foo (1 row) radius=> select * from radusergroup; username | groupname | priority ----------+-----------+---------- foozle | HutchNet | 0 (1 row) radius=> select * from radgroupcheck; id | groupname | attribute | op | value ----+-----------+-----------+----+------- (0 rows) radius=> select * from radgroupreply; id | groupname | attribute | op | value ----+-----------+-------------------------+----+---------- 1 | HutchNet | Tunnel-Type | := | VLAN 2 | HutchNet | Tunnel-Medium-Type | := | 802 3 | HutchNet | Tunnel-Private-Group-ID | := | HutchNet (3 rows) radius=> and test using: vishnu> ./radtest foozle foo localhost 1234 testing123 [...] rad_recv: Access-Reject packet from host 127.0.0.1 port 1234, id=166, length=20 [...] ++[files] returns noop expand: %{User-Name} -> foozle rlm_sql (sql): sql_set_user escaped user --> 'foozle' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, Op FROM rad check WHERE Username = '%{SQL-User-Name}' ORDER BY id -> S ELECT id, UserName, Attribute, Value, Op FROM radcheck W HERE Username = 'foozle' ORDER BY id rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op F ROM radcheck WHERE Username = 'foozle' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 5 expand: SELECT GroupName FROM radusergroup WHERE UserName='%{SQL-User-Na me}' ORDER BY priority -> SELECT GroupName FROM radusergroup WHERE UserName='foo zle' ORDER BY priority rlm_sql_postgresql: query: SELECT GroupName FROM radusergroup WHERE UserName='fo ozle' ORDER BY priority rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 1 , fields = 1 expand: SELECT id, GroupName, Attribute, Value, op FROM radgroupchec k WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupcheck WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM r adgroupcheck WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 0 , fields = 5 rlm_sql (sql): User found in group HutchNet expand: SELECT id, GroupName, Attribute, Value, op FROM radgrouprepl y WHERE GroupName = '%{Sql-Group}' ORDER BY id -> SELECT id, GroupName, Attribute, Value, op FROM radgroupreply WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: query: SELECT id, GroupName, Attribute, Value, op FROM r adgroupreply WHERE GroupName = 'HutchNet' ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: query affected rows = 3 , fields = 5 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication m ay fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user auth: Failed to validate the user. ok, so why isn't "++[sql] returns ok" good enough? seems to me that rlm_sql is happy ... it found the user, it agrees that the associated password is correct ... but radiusd keeps on going, to rlm_pap, which does not find a match ... and radiusd returns Access-Reject looking at my /etc/raddb config files ... i've made the following changes from default: radiusd.conf: log_destination = syslog user = nobody group = nobody log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes proxy_requests = no $INCLUDE ${confdir}/sql/postgresql/counter.conf sql.conf: database = "postgres" sqltrace = yes sites-enabled/default: # # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql - suggestions on how to dig a little deeper into why radiusd continues to rlm_pap? - sqltrace.sql remains stubbornly empty ... have any tips on populating it? i've tried running radiusd as 'root' (this to test file system permissions on 'sqltrace.sql' ... but even then, this file remains empty tia, --sk stuart kendrick fhcrc

2 1

radius ldap tls
by David Hláčik 16 Dec '07

16 Dec '07

Hi to all, i am finding in my radiusd.log on CentOS 5.1 Sun Dec 16 14:45:04 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow In radiusd.conf i have use_tls to off , my ldap server (open ldap) is configured with tls support and set to not regueire certificate from client. Where should be the problem? Thanks. David

1 0

Re: powerfull manager?
by liran tal 16 Dec '07

16 Dec '07

Billing is indeed a crucial part but with some group-effort we could probably come up with something good... daloRADIUS is an open source application for management, accounting, and billing. The billing side is almost not developed at all but the management, accounting, and everything else is growing pretty fast. If someone wants to join the team to lead the development of the billing side I will gladly appreciate it. Homepage: http://sourceforge.net/projects/daloradius Wiki: http://daloradius.wiki.sourceforge.net/<http://sourceforge.net/projects/daloradius> Regards, Liran Tal. On Dec 11, 2007 11:40 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at> wrote: > >I love GPL, but unfortunatelly there is too few software being developed > >for Radius... > > That was my problem too ! > > >All I need is actually: > >- bandwith, time, volume limitation > >- username/password authentication > >- MAC authentication (but here is a trick - few MAC's for a one "billing" > >user) > >- card generator > > Almost everything covered ! > > >And of course something that would allow me to print bills ;) > > I have PDF generation :) > > > Do you know anything, that would do that? > Not at the time of writing this. PhpMyPrePaid has some of interesting features. > > >I suppose, that as your project is a Uni project, you can't make it as GPL? > > Actually I am developing it for my company and my BS project is about data accounting and anomaly detection in systems that use RADIUS ! > > I'll let you know ! Anyone interested in supporting this project ? > > Regards, > E:S > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

2 2

release date 2.0.0?
by Norbert Wegener 16 Dec '07

16 Dec '07

Hello Alan, since the release of pre1 half a year has gone. Can you already foresee when the final version will be released? Thanks Norbert Wegener

4 6

EAP-TLS: Certificate creation doesn't work (Debian)
by Julian Stöver 15 Dec '07

15 Dec '07

Hi! I'm using Freeradius 1.1.3 under Debian Etch! I want to configure Freeradius with EAP-TLS in my network but there some problems with the certficate creation. I get this message when i run the file "certs.sh" in the "docs/ freeradius/examples/" directory: > ################## > create private key > name : name-root > CA.pl -newcert > ################## > > Generating a 1024 bit RSA private key > .............++++++ > ....................................++++++ > writing new private key to 'newreq.pem' > ----- > You are about to be asked to enter information that will be > incorporated > into your certificate request. > What you are about to enter is what is called a Distinguished Name > or a DN. > There are quite a few fields but you can leave some blank > For some fields there will be a default value, > If you enter '.', the field will be left blank. > ----- > Country Name (2 letter code) [AU]:State or Province Name (full name) > [Some-State]:Locality Name (eg, city) []:Organization Name (eg, > company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, > section) []:Common Name (eg, YOUR name) []:Email Address []: > ################## > create CA > use just created 'newreq.pem' private key as filename > CA.pl -newca > ################## > > CA certificate filename (or enter to create) > > ################## > exporting ROOT CA > CA.pl -newreq > CA.pl -signreq > openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem - > out root.pem > openssl pkcs12 -in root.cer -out root.pem > ################## > > MAC verified OK > > ################## > creating client certificate > name : name-clt > client certificate stored as cert-clt.pem > CA.pl -newreq > CA.pl -signreq > ################## > > Generating a 1024 bit RSA private key > ......................++++++ > .++++++ > writing new private key to 'newreq.pem' > ----- > You are about to be asked to enter information that will be > incorporated > into your certificate request. > What you are about to enter is what is called a Distinguished Name > or a DN. > There are quite a few fields but you can leave some blank > For some fields there will be a default value, > If you enter '.', the field will be left blank. > ----- > Country Name (2 letter code) [AU]:State or Province Name (full name) > [Some-State]:Locality Name (eg, city) []:Organization Name (eg, > company) [Internet Widgits Pty Ltd]:Organizational Unit Name (eg, > section) []:Common Name (eg, YOUR name) []:Email Address []: > Please enter the following 'extra' attributes > to be sent with your certificate request >> A challenge password []:An optional company name []:Using >> configuration from /usr/lib/ssl/openssl.cnf >> ./demoCA/serial: No such file or directory >> error while loading serial number > 11733:error:02001002:system library:fopen:No such file or > directory:bss_file.c:352:fopen('./demoCA/serial','r') > 11733:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:354: > Failed to do sign certificate I think the 6 last lines are important and i search for a "serial" file, but i doesn't exist. Are there other users with this problem? How can i solve this problem? Mfg Julian

2 2

Freeradius and AD
by Dave Gibelli 15 Dec '07

15 Dec '07

Hi I am testing Freeradius within an 802.1x environment. I want to send authentication request to 4 different AD DC's depending on the Domain sent from the client to the Authenticator. Can Freeradius forward request in this way? Dave

4 4

Re: 802.1x machine authentication patch help
by Michael Patzer 15 Dec '07

15 Dec '07

i found the topic about "No logon workstation trust account (0xc0000199)". i've the same problem using freeradius-2.0.0-pre2 samba 3.0.24 on debian etch is it required to update to samba 3.0.28 (debian unstable) to fix this issue, or could it be anything else? thx michael freeradius-log: +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/trelane.ka.foobar.de with NT-Password expand: --username=%{mschap:User-Name} -> --username=trelane$ mschap2: 95 expand: --challenge=%{mschap:Challenge} -> --challenge=36fc487a5fe99e03 expand: --nt-response=%{mschap:NT-Response} -> --nt-response=b8ec109fa4b1a1ed3b2832f4e9704456febebeb4d790574e Exec-Program output: No logon workstation trust account (0xc0000199) Exec-Program-Wait: plaintext: No logon workstation trust account (0xc0000199) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject -----Original Message----- From: [EMAIL PROTECTED] [EMAIL PROTECTED] On Behalf Of Phil Mayers Sent: 01 October 2007 09:55 To: FreeRadius users mailing list Subject: Re: 802.1x machine authentication patch help On Fri, 2007-09-28 at 12:06 +0100, Marco Casulli wrote: > Hi Jamie, > > Marco from BBC in london. > > I have read your message > (http://lists.cistron.nl/pipermail/freeradius-users/2005-November/0485 > 76.html related to the error when the radius is trying to authenticate > in AD and I am getting exactly the same message. > > "No logon workstation trust account (0xc0000199)". > > The article is dated Nov 2005 so I hope you have the solution by now! > ;-) You need a suitably recent version of Samba. I can't remember the exact version number, but I'm sure judicious use of Google will find it, or just use the most recent.

2 1

unlang question
by Norbert Wegener 15 Dec '07

15 Dec '07

In pre2 an update reply works, when I have: update reply { ... Tunnel-Private-Group-ID ="%{control:Huntgroup-Name}" ... } Enterasys have a unusual syntax. They need for the same something like: update reply { ... filter-id = Enterasys:version=1:mgmt=su:policy="%{control:Huntgroup-Name}" ... } This does not work for me. Trying different quoting do not yet help. Is this possible at all? Norbert Wegener

2 1

wds eap-ttls
by Sergio Belkin 14 Dec '07

14 Dec '07

Hi, I've configured freeradius with eap-ttls, and is working fine, but I have one doubt: Can I use this kind of settings for use several APs with WDS? I ask this because I've read this: "This means that Wi-Fi Protected Access (WPA) and other dynamic key assignment technology may not be used" http://www.smallnetbuilder.com/?option=com_content&task=view&id=24308&pop=1… Is that right? If I can, should I modify something of my config? Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 4

Re: EAP-TLS - About username sent by supplicant
by Alexism 14 Dec '07

14 Dec '07

Hello, I have the same problem but this procedure don't work in my environment (FREERADIUS, OpenLDAP, SAMBA). I have this eap error : rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler Can you send me your radiusd.conf ? Regards OLIVER Patrice wrote: > > Hello, > > It works, thanks. :) > > Regards. > > -----Original Message----- > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Date: Fri, 14 Dec 2007 09:39:08 +0000 > Subject: Re: EAP-TLS - About username sent by supplicant > >> Hi, >> >> > My question deals with the username sent by the supplicant when the >> authentication goes on. At >> boot >> > time, the username sent is : host/user_name. After the login, the >> username sent is : user_name. >> So, I >> > have to create 2 users. I want to cut 'host/' to make this task easier. >> It is possible ? How do I >> do this ? >> >> attr_filter or somesuch eg put these into radiusd.conf >> >> attr_rewrite copy-user-name { >> attribute = Stripped-User-Name >> new_attribute = yes >> searchfor = "" >> searchin = packet >> replacewith = "%{User-Name}" >> } >> >> attr_rewrite remove-host { >> attribute = Stripped-User-Name >> searchfor = "^(host/.*)" >> searchin = packet >> new_attribute = no >> replacewith = "%{1}" >> } >> >> and then call these 2 functions in your authorize section >> (radiusd.conf or sites-enabled/wherever (for FR 2.0) ) >> >> copy-user-name >> remove-host >> >> just before the other modules are called - eg chap, auth_log etc etc >> >> alan >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > -- View this message in context: http://www.nabble.com/EAP-TLS---About-username-sent-by-supplicant-tp1433164… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1