February 2007 - Freeradius-Users - lists.freeradius.org

mschap and unix
by Jean Frontin 14 Feb '07

14 Feb '07

Hello, I'm usinq freeradius + mysql. I should want that users use mschap protocol and I should want that freeradius uses unix shadow to authenticate them. tests return in "radius.log" : "no user password configured" Any ideas please Regards Jean Frontin

2 1

Mysql - radcheck, radreply, radgroupcheck and radgroupreply
by "Fabrício F. Kammer" 14 Feb '07

14 Feb '07

Anyone can help me with this??? ---- Hi, I'm using Freeradius + Mysql to do the MAC Address authentication of the clients that connection on my APs (Mikrotik machines). In the mysql I've the follow: Table usergroup: UserName = MAC address GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Table radgroupcheck: GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Then I've four lines for each GroupName with the follow: Attribute: "Auth-Type" // op: ":=" // Value: "Local" Attribute: "NAS-IP-Address" // op: "==" // Value: "IP of the AP" Attribute: "NAS-Port-Identify" // op: "==" // Value: "Name of the AP - Ex: MyAP1" On the table radcheck I don't have anything. This table is empty. In the table radreply I've one record: UserName: "MAC Address of the client" Attribute: "Mikrotik-Rate-Limite" op: "=" Value: "64000/128000" The problem is: If the Freeradius don't find the UserName on the table radcheck it doesn't return the attributes that are on the table radreply, just the records of the table radgroupreply are returned. I need to return the reply different for each client because this parameter is the speed of upload and download and this values are different for each client. My questio is: Is it possible that the Freeradius return the values of the table radreply if I don't have any value on the radcheck? (The authentication was made in the radgroupcheck table) Thanks in advanced, Fabrício F.: Kammer

2 1

nas table in rlm_sql module - usage
by tzieleniewski 13 Feb '07

13 Feb '07

Hi!! I was trying to find out what is this table nas really used for. I read the whole documentation in the doc directory of radius and dialup_admin but I still have many doubts. Is it used just for mapping and getting information about online users or it is somehow equivalent to clients.conf file?? Please give me o short explanation of this issue. Thank you in advance:) Cheers tomasz

5 10

Re: Error: Ignoring request from unknown client IP:1645
by Davide Molteni 13 Feb '07

13 Feb '07

I'm very sorry Alan for replying to your own email address and not on the list. Here it is Il giorno lun, 12/02/2007 alle 13.35 +0100, Alan DeKok ha scritto: > Davide Molteni wrote: > > > On the cisco I configured: > > radius-server host ipmyradius auth-port 1812 acct-port 1813 > > and the other aaa commands needed > > > > If I look at the radius.log file I always see > > > > Error: Ignoring request from unknown client ipmycisco:1645 > > Did you configure the server to have that IP in "clients.conf"? Sure! With the IP and the same shared key as the cisco NAS client > > > The Cisco router keeps always trying to connect to radius using port > > 1645 even if I specified to use 1812... > > That's a bug in the Cisco router. Yea but is this a problem for freeradius to properly work? I need to set freeradius to listen on 1645 in radiusd.conf? Or I need to change it in /etc/services ? > > > I have tried to configure radius > > server to listen on port 1645 but is the same. > > Listening on port 1645 won't make the server believe that "ipmycisco" > is a known client. Well I know this very well in fact, the client that is ignored is properly configured in clients.conf > > > The microsoft radius integration(server 2003) worked at first try with > > this cisco config... > > Really. Did you configure the Cisco box as a client in the MS RADIUS > server? Yes, sure I had to put in the ms radius the cisco box as a client otherwise it wouldn't work... Please notice that I would like to use this radius for simple PAP ONLY. Maybe I'm doing something wrong with users file? Please tell me the right way to configure a single test user for PAP only. I would like to disable unused modules (ldap,mysql...) It couldn't be a problem of authentication method? I forgot an important element to tell anyone wants to help. I tried to change the shared key on one side (radius) and noticed that log file continue to write again the same error Ignoring request from unknown client IP:1645 So the issue it's due to the fact that cisco client don't exchange shared key with radius... This can halp to focus better the problem? thanks in advance

3 7

wep encryption
by Hillary Marek 13 Feb '07

13 Feb '07

Hello. I have a FreeRadius 1.1.4 server setup on Fedora Core 6. Right Now I have it set up to filter Mac addresses and to authenticate against Active Directory. I am looking to add encryption, but unfortunately many of my wireless devices are older 802.11b devices that can't handle wpa. I am also restricted in how much I am allowed to put the end user through. Is there a way to cenralize a wep key in the server, as I have 26 access points that I would hope not to have to go into individually to add encryption (I already need to set up 70+ devices). Because I can't put any truly strong protection on the network, and I can't take the wlan off of the main network, I am trying to add as many layers of lesser protection as I can. Does anyone have any other ideas for me? Thanks Hillary Marek Hazen Paper Co.

2 1

EAP-PEAP/MS-ChapV2 password storing options
by Matt Ashfield 13 Feb '07

13 Feb '07

Hi All, I'm sure this is a simple question, and I thought I'd pose it here in hopes of a quick response. We're trying to implement username/password authentication and so far are using EAP-PAP (with secureW2 client) because our passwords are stored in LDAP in a 1-way encrypted hash. We're hoping to get away from this secureW2 implementation and would like to use Windows built-in authentication, which seems to be EAP-PEAP with MS-ChapV2 authentication. As such, we're meeting with the LDAP folks to negotiate how to store passwords in LDAP...soo...my question is: In order to get EAP-PEAP/MS-ChapV2 to work with FreeRadius, what are my options for storing the password in LDAP? Does it have to be clear-text? Thanks Matt mda(a)unb.ca

3 3

Re: Error: Ignoring request from unknown client IP:1645
by Walt Reynolds 13 Feb '07

13 Feb '07

I had the problem before and it was because in the clients.conf file I had written clients (with an s) and not client. > > Message: 1 > Date: Tue, 13 Feb 2007 12:13:08 +0100 > From: Davide Molteni <d.molteni(a)ntsitalia.com> > Subject: Re: Error: Ignoring request from unknown client IP:1645 > To: freeradius list <freeradius-users(a)lists.freeradius.org> > Message-ID: <1171365188.6512.39.camel@PRT-TOSHIBA> > Content-Type: text/plain > > I'm very sorry Alan for replying to your own email address and not on > the list. Here it is > > > Il giorno lun, 12/02/2007 alle 13.35 +0100, Alan DeKok ha scritto: >> Davide Molteni wrote: >> >>> On the cisco I configured: >>> radius-server host ipmyradius auth-port 1812 acct-port 1813 >>> and the other aaa commands needed >>> >>> If I look at the radius.log file I always see >>> >>> Error: Ignoring request from unknown client ipmycisco:1645 >> Did you configure the server to have that IP in "clients.conf"? > > Sure! With the IP and the same shared key as the cisco NAS client > >>> The Cisco router keeps always trying to connect to radius using port >>> 1645 even if I specified to use 1812... >> That's a bug in the Cisco router. > > Yea but is this a problem for freeradius to properly work? I need to set > freeradius to listen on 1645 in radiusd.conf? Or I need to change it > in /etc/services ? > >>> I have tried to configure radius >>> server to listen on port 1645 but is the same. >> Listening on port 1645 won't make the server believe that > "ipmycisco" >> is a known client. > > Well I know this very well in fact, the client that is ignored is > properly configured in clients.conf >>> The microsoft radius integration(server 2003) worked at first try > with >>> this cisco config... >> Really. Did you configure the Cisco box as a client in the MS > RADIUS >> server? > > Yes, sure I had to put in the ms radius the cisco box as a client > otherwise it wouldn't work... > > Please notice that I would like to use this radius for simple PAP ONLY. > Maybe I'm doing something wrong with users file? > Please tell me the right way to configure a single test user for PAP > only. I would like to disable unused modules (ldap,mysql...) > > It couldn't be a problem of authentication method? > > I forgot an important element to tell anyone wants to help. > I tried to change the shared key on one side (radius) and noticed that > log file continue to write again the same error > > Ignoring request from unknown client IP:1645 > > So the issue it's due to the fact that cisco client don't exchange > shared key with radius... > > This can halp to focus better the problem? > > thanks in advance > -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

1 0

major problem with ntlm_auth and winbindd pipe
by Habegger Lukas, ERZ-AZD-AIL 13 Feb '07

13 Feb '07

Hi All, I use freeradius for peap-authentication and I have multiple samba/winbind services to authenticate against to different ADs. In my setup I use a perlscript to start the right winbindd for a request. Now I have the problem that the winbind-pipe sometime dies. Has anyone experiences with dieing winbind-pipes in a freeradius peap environment? Can anyone help me? Lukas

1 0

Problems with rlm_sqlcounter
by Tas Dionisakos 13 Feb '07

13 Feb '07

After many months of fault finding Im still in the dark about the counter not understanding values greater that 2 gigabytes. School is started next week and Im starting to panic as I dont have a solution for this as yet. I am running ubuntu 6.10 and freeradius 1.1.4, I have configured the following counter in radius.conf. sqlcounter mb { counter-name = Max-All-MB check-name = Max-All-MB reply-name = ChilliSpot-Max-Output-Octets sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctOutputOctets) FROM radacct where UserName='%{%k}'" } If "Max-All-MB" is greater than two gigabytes it "wraps" that value into a negative, if the values is > 3 gigabytes it simply returns a "-1". I have ran everything in debug mode (freeradius, mysqld, etc) and cannot find the cause. I have looked into rlm_sqlcounter.c and have traced the problem to variable "check_vp->lvalue", but I cannot find the place where the variable is defined in order to change it from a int to a long as I think that the variable is defined as 32bit and that is the reason it fails. I have setup many systems with various versions of freeradius and mysql running, yet this problem has being consistent through all my setups. From version 1.1.0 to 1.1.4 of freeradius this problem has occurred, this is a shame as the "reply-name" feature has recently being setup (freeradius 1.1.4) on the rlm_sqlcounter and its hard to use with a value < 2gb. I thank you in advance for any help which might steer me in the right direction, i have attached some of my finding on the error below. Freeradius -X mode, this is a dump of a accepted user and the denied user. Accepted User: sqlcounter_expand: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='%{User-Name}'' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='fullspec.john'' sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets) FROM radacct where UserName='fullspec.john'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='fullspec.john'' rlm_sql (sql): - sql_xlat radius_xlat: 'fullspec.john' rlm_sql (sql): sql_set_user escaped user --> 'fullspec.john' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='fullspec.john'' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 1 radius_xlat: '1601368097' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user fullspec.john, check_item=2087831324, counter=1601368097 rlm_sqlcounter: Sent Reply-Item for user fullspec.john, Type=ChilliSpot-Max-Output-Octets, value=486463227 modcall[authorize]: module "mb" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 Denied User: sqlcounter_expand: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='%{User-Name}'' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='duler.peter'' sqlcounter_expand: '%{sql:SELECT SUM(AcctOutputOctets) FROM radacct where UserName='duler.peter'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='duler.peter'' rlm_sql (sql): - sql_xlat radius_xlat: 'duler.peter' rlm_sql (sql): sql_set_user escaped user --> 'duler.peter' radius_xlat: 'SELECT SUM(AcctOutputOctets) FROM radacct where UserName='duler.peter'' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): row[0] returned NULL rlm_sql (sql): Released sql socket id: 3 radius_xlat: '' rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user duler.peter, check_item=-1312351118, counter=0 modcall[authorize]: module "mb" returns reject for request 0 modcall: leaving group authorize (returns reject) for request 0 -- ************************************* Tas Dionisakos IT Manager St Mary’s College and Newman College The University of Melbourne T: 03 9342 1708 M: 0439 655 565 E: tas(a)newman.unimelb.edu.au C: (0o (||||)(||||) o0) *************************************

2 3

Re: Freeradius-Users Digest, Vol 22, Issue 52
by silvia bogos 13 Feb '07

13 Feb '07

To Mr. Alan. i'v heard about what's called SLACKWARE so is it better than REDHAT or what? On 2/12/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. need a help.... (silvia bogos) > 2. Error: Ignoring request from unknown client IP:1645 > (Davide Molteni) > 3. Re: need a help.... (Alan DeKok) > 4. Re: Error: Ignoring request from unknown client IP:1645 > (Alan DeKok) > 5. Re: rlm_eap_tls: No SSL info available. Waiting for more SSL > data (Norbert Wegener) > 6. Re: rlm_eap_tls: No SSL info available. Waiting for more SSL > data (Alan DeKok) > 7. Segmentation fault (core dumped) - freeradius-1.1.4 > (adreas Polyxronopoulos) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 12 Feb 2007 13:56:35 +0200 > From: "silvia bogos" <silvia.bogos(a)gmail.com> > Subject: need a help.... > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <13e227190702120356j6667c2b9vceee567ff3864939(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi list. > im so happy that im now one of this list members > so can any one from u help me in freeradius installation and config. > coz im new in this domain and i will b so thankfull > > silvia >

1 0