February 2007 - Freeradius-Users - lists.freeradius.org

Cisco enable authentication on freeradius and mysql
by mkr1e＠yahoo.com 16 Feb '07

16 Feb '07

I am trying to authenticate Cisco enable password requests via freeradius (1.1.3.) on a mysql (5.0.26) database. As per http://wiki.freeradius.org/Cisco, the router tries to authenticate user $enab15$ but it doesn't get matched on mysql query because '$' gets escaped to '=24' radius_xlat: '$enab15$' rlm_sql (sql): sql_set_user escaped user --> '$enab15$' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '=24enab15=24' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): User $enab15$ not found in radcheck Is there any solution to this? ____________________________________________________________________________________ Have a burning question? Go to www.Answers.yahoo.com and get answers from real people who know.

3 2

Freeradius 1.1.3 and Connectra
by Joseph Parker 16 Feb '07

16 Feb '07

I have got my radius server to do port based authentication with PEAP on a cisco 3750 switch. That works no problem. I am trying to get connectra to authenticate with it as well. Every time that I try to authenticate a user in Active Directory I get the following error message. What is different with Connectra vs. PEAP? Thanks for any help you can give me. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.90.1.254:32768, id=58, length=65 User-Name = "joseph.parker" User-Password = "JPpass02" Service-Type = Login-User NAS-IP-Address = 10.90.1.254 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "joseph.parker", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 58 to 10.90.1.254 port 32768 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 58 with timestamp 45ca3d12 Nothing to do. Sleeping until we see a request.

2 2

Re: Freeradius(.net) and Oracle
by Brian Atkins 16 Feb '07

16 Feb '07

Sorry for the delay Peter. I overlooked you message. On Tue, 23 Jan 2007 02:34:55, Peter Nixon wrote: > I don't believe that "freeradius.net" contains database support of any > kind. > You will likely have to recompile freeradius yourself if you want to > add Oracle support. You can expect some pain getting it all to build > correctly on windows. So, am I understanding you to say that I would be better off not installing the .net version, but instead download the sources and compile on the server (W2K running Cygwin)?

3 4

AW: ntlm_auth for PEAP with rlm_perl
by Habegger Lukas, ERZ-AZD-AIL 16 Feb '07

16 Feb '07

Because I have a perl script to switch between two different Samba-servers for authorization. I had several problems with this setup because parallel requests cause that the wrong domain is available (The domain-switch wouldn't be blocked for a request). Is there an easier way to do the ntlm_auth with the perl module? Or is there a way to build some kind of dependencies between the mschap module and the perl module? Lukas -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+lukas.habegger=erz.be.ch(a)lists.freeradius.org [mailto:freeradius-users-bounces+lukas.habegger=erz.be.ch@lists.freeradius.org] Im Auftrag von Alan DeKok Gesendet: Freitag, 16. Februar 2007 11:17 An: FreeRadius users mailing list Betreff: Re: ntlm_auth for PEAP with rlm_perl Habegger Lukas, ERZ-AZD-AIL wrote: > Hi > > Is it possible to do the ntlm_auth authorization used for PEAP with a perl-script over rlm_perl? Why? The MSCHAP module already does this for you. If you want to know how to re-do all of that work in the Perl module, look at the code in the mschap module. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

MySQL support in Windows binary of FreeRadius
by Foo JH 16 Feb '07

16 Feb '07

Hi all, I'm using the precompiled binary of FreeRadius from freeradius.net. Well, I'm happy to say that it works! My last challenge with FreeRadius is getting it to work with MySQL. I don't know if MySQL connectivity is possible with the precompiled Windows version. Can anyone confirm this? Cos I'm not getting very far trying to activate mysql. Basically I uncommented the sql line in line 2017 (under accounting), and the daemon will not run any more. It complains: Error: radiusd.conf[2017] Unknown module "sql" Can anyone comment on this? Thanks.

3 4

Algorithm used by FreeRADIUS to choose cipher suite used with EAP-TLS/TTLS
by Walter Goulet 16 Feb '07

16 Feb '07

Hi, How does FreeRADIUS's rlm_eap module choose the cipher suite used for EAP-TLS/TTLS sessions? RFC 2246 for TLS states that the client presents the list of ciphersuites supported to the server and the server picks one that it supports. Is there a way to configure FreeRADIUS to only use a specific set of ciphersuites? The goal is that in some cases it may be desireable to restrict incoming clients to use a particular suite. Thanks, Walter

2 2

ntlm_auth for PEAP with rlm_perl
by Habegger Lukas, ERZ-AZD-AIL 16 Feb '07

16 Feb '07

Hi Is it possible to do the ntlm_auth authorization used for PEAP with a perl-script over rlm_perl? And if yes how? Greetings Lukas -----Ursprüngliche Nachricht----- Von: freeradius-users-bounces+lukas.habegger=erz.be.ch(a)lists.freeradius.org [mailto:freeradius-users-bounces+lukas.habegger=erz.be.ch@lists.freeradius.org] Im Auftrag von A.L.M.Buxey(a)lboro.ac.uk Gesendet: Donnerstag, 15. Februar 2007 16:00 An: scott(a)renshawauto.com; FreeRadius users mailing list Betreff: Re: Simple security Hi, > Thanks Jeremy. > > I've been doing various searches for practical examples of 802.1x in a LAN setting and haven't found anything yet. Have you? it all depends on what kit you've got, both in the network space and in the server architecture. eg with decent Cisco or HP switches you can simply enable dot1X on each switch interface and configure the switch to RADIUS authenticate eg against FreeRADIUS. you would need to install EAP-TLS certs on each machine - or configure PEAP etc v's an AD for auth. thats hardly 'seamless' but no network access control is seamless to users in reality. alternatively. how 'secure' does this have to be? you could, eg use MAC address authentication. eg use dot1x with MAC auth...and then also do the same for DHCP. going this was you could use VMPS on the CISCO kit - unregistered machine live on their own VLAN devoid of anything - execpt maybe an authentication gateway to register their systems. or, as a final option, default VLAN on the switch gives people only a captive portal. once they have registered (or if they are already known - via MAC) a quick SNMP of their switch port sets their vlan to the correct working one. this can be acheived with home-brew code OR via solutions such as campus manager. balance up the security requirements v's the cost and implementation timeframe. for a small setup, EAP-TLS certs with real dot1x would be my personal way to go. you've just then got the headache of those network devices that dont do dot1X - eg network printers/scanners, voip handsets etc - for those you'd have to secure the network socket and cabling :-| alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

attr_rewrite molude - creating new parameter from the existing one
by tzieleniewski 16 Feb '07

16 Feb '07

Hi! Is it possible to implement such functionality with the usage of attr_rewrite module that whenever a packet arives to freeradius module will check if particular parameter exists in a request and if it doesn't, it will try to create it from other set of packet parameters? Maybe it can be done in other way not through the attr_rewrite module. Thanks in advance. -tomasz

1 0

Configure FreeRadius to generate new accounting file by hour
by Foo JH 16 Feb '07

16 Feb '07

Hi all. Just want to pose this qn to the community: Is it possible to configure FreeRadius, so that instead of generate a new accouting file per-day, can it be per-hour (or better: per-n minutes)? Thanks

2 2

Getting error in radius server with dot1X and supplicant on windows XP...
by raghavendra.sadaramachandra＠wipro.com 15 Feb '07

15 Feb '07

Hi All, I am using free radius server with dot1X. and supplicant is on windows XP. Here when I use user name <= 3 letters I am getting following error... 1. Received packet from 192.168.112.90 with invalid Message-Authenticator! (Shared secret is incorrect.) and for user name <=3 my client is getting following error. 2. Malformed RADIUS packet from host 192.168.0.1: too short (length 17 < minimum 20). where as radius RFC say... user name length can be >= 3. since user name goes as part of attributes in radius packet... but errors we are getting are totally different. I mean first we are getting related to message-authenticator where as we are passing username with length <=3. and second error my client getting is related to packet length...another interesting thing is we get these errors only for PEAP configuration.... this will work for MD5 and others. can any one help me in this. whether we are getting different errors because both of us may be using different versions of RADIUS server? just a guess. This error may be because of RADIUS client or server? Thanx in Advance... ---Raghu. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

1 0