March 2007 - Freeradius-Users - lists.freeradius.org

windows XP computer WPA, TKIP, PEAP, EAP-MSCHAP v2 has "No User-Password or CHAP-Password attribute in the request"
by PoWah Wong 25 Aug '07

25 Aug '07

My freeradius client is a windows XP SP2 computer running 802.11 WPA, TKIP, PEAP, EAP-MSCHAP v2 and trying to connect to the linux Fedora Core 2 wireless server. I run the freeradius server in debugging mode # radiusd -sfxxyz -l stdout This is the output. How to fix this problem? rad_recv: Access-Request packet from host 127.0.0.1:52001, id=38, length=134 Framed-MTU = 1380 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "wifictrl" User-Name = "test" NAS-Port-Id = ":2:2" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 Called-Station-Id = "00-f0-00-06-67-a8" Calling-Station-Id = "00-20-a6-57-7a-e9" EAP-Message = 0x020100090174657374 Message-Authenticator = 0x737afc3b6c1fb17ad13ee348ca5fbf4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched test at 90 radius_xlat: 'Hello, test' modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 38 to 127.0.0.1:52001 Reply-Message = "Hello, test" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 38 with timestamp 43d1500d Nothing to do. Sleeping until we see a request. # radiusd -v radiusd: FreeRADIUS Version 1.0.1, for host , built on Apr 15 2005 at 11:57:29 # uname -a Linux wifictrl 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux __________________________________________________________ Find your next car at http://autos.yahoo.ca

8 15

Duplicate requests in a session
by Santiago Balaguer García 16 Aug '07

16 Aug '07

Hi people, 1) In my activity I realize that when the conexion to Internet of a NAS is NOT good (there are some reday in the DSL), the NAS send several Start requests. My problen is my RADIUS server ask for all these requests and they are inserted in my DB. So, when the user or the NAS finalize the session and NAS sends Stop Request, the credit associates to the user account is decremented several times. It happens so because I put a trgger in my DB to decrement the user credit atomatically. Can I avoid the problem of inserting several times the start request? If it is so, how?? 2) Is it supposed that the value of acctsessionid and acctuniqueid in radacct table are UNIQUE and they can not be duplicated ? Thanks, Santiago _________________________________________________________________ Grandes éxitos, superhéroes, imitaciones, cine y TV... http://es.msn.kiwee.com/ Lo mejor para tu móvil.

6 9

RE: freeradius and ntlm_auth howto
by King, Michael 25 May '07

25 May '07

Some things I've noticed from your attached files Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes I've never enabled these before, I'm unaware what affect they will have tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" Did you generate your OWN certs... They one's that ship with the server ARE NOT vailid. You have to generate your own. rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 That doesn't look right BUT YOUR FINAL ANSWER: xec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=b9ee04ca891c7b7d --nt-response=79b960c773fa101929d3bf8e738168e8b6d8ae8cd61f64f0 Exec-Program output: Account locked out (0xc0000234) Exec-Program-Wait: plaintext: Account locked out (0xc0000234) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Your account in the domain is not correct. Looks like it's been disabled or something. Fix that first before you change anymore config files. ________________________________ From: Stieven.Struyf(a)komatsu.eu [mailto:Stieven.Struyf@komatsu.eu] Sent: Monday, November 06, 2006 3:16 AM To: King, Michael Subject: Fw: freeradius and ntlm_auth howto Michael, I sent my reply already to the list, but due to the size(larger than 100k) it had to be reviewed by the admin and after a week it was rejected. Below you can find the mail. Thanks for helping me. Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 ----- Forwarded by Stieven Struyf/KEISA/BE/KOMEUR on 11/06/2006 09:13 AM ----- Stieven Struyf/KEISA/BE/KOMEUR 11/02/2006 08:55 AM To FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc Subject RE: freeradius and ntlm_auth howtoLink <Notes://BENT63KE/C1257011005324FB/DABA975B9FB113EB852564B5001283EA/625A 148B6EA233CDC125721400531414> I added the debuglog as attachment(as it is a little large to paste here). This is the mschap config: mschap { authtype = MS-CHAP use_mppe = yes require_strong = yes with_ntdomain_hack = yes require_encryption = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 freeradius-users-bounces+stieven.struyf=komatsu.eu(a)lists.freeradius.org wrote on 10/27/2006 04:36:00 PM: > Let's see if we can get this solved... > > > -----Original Message----- > > Here's the full log: > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 10.104.254.73:1645, > > This is NOT the full log. The full log would have started with the line > /path/to/radiusd -X > > Some important stuff is printed out there, it helps us help you. > > > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > Did you enable Ntdomain Hack in the MSCHAP module? (See below) > > > Including your radius.conf file would help. > > > > > HOWEVER, first you may want to check your mschap module definition: > > > > > > modules { > > > mschap { > > > ntlm_auth = "/usr/bin/ntlm_auth \ > > > --request-nt-key \ > > > --username=%{mschap:User-Name:-None} \ > > > --domain=%{mschap:NT-Domain:-None} \ > > > --challenge=%{mschap:Challenge:-00} \ > > > --nt-response=%{mschap:NT-Response:-00}" > > > > > > ...all on one line of course. Note the use of the > > "mschap:User-Name" > > > and "mschap:NT-Domain" values. > > Mine radiusd.conf file's mschap section looks like this: > NOTE that I do NOT have the :-00 and the :-None statements, and I DO > have with_ntdomain_hack=yes > > > # Microsoft CHAP authentication > # > # This module supports MS-CHAP and MS-CHAPv2 authentication. > # It also enforces the SMB-Account-Ctrl attribute. > # > mschap { > with_ntdomain_hack = yes > ntlm_auth = "/usr/bin/ntlm_auth \ > --request-nt-key \ > --username=%{mschap:User-Name} \ > --challenge=%{mschap:Challenge} \ > --nt-response=%{mschap:NT-Response} > } > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9

POD not work with radclient
by satish patel 11 May '07

11 May '07

Dear guys I am comming with new problem now i have enable POD packet of disconnet on cisco router and now i m trying to disconnect user with radclient command but i got this output [root@radius ~]# cat packet.txt Acct-Session-Id=0000C476 User-Name=mlpm607 X-Ascend-Session-Svr-Key=396830D9 NAS-IP-Address=192.168.1.1 [root@radius ~]# cat packet.txt | radclient -x 192.168.1.1:1700 disconnect tulip786 Sending Disconnect-Request of id 115 to 192.168.1.1 port 1700 Acct-Session-Id = "0000C476" User-Name = "mlpm607" X-Ascend-Session-Svr-Key = "396830D9" NAS-IP-Address = 192.168.1.1 rad_recv: Disconnect-NAK packet from host 192.168.1.1:1700, id=115, length=41 Reply-Message = "No Matching Session" why user not disconnect from NAS but user still login on NAS ????? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

4 4

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 09 May '07

09 May '07

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" identity = "cn=Directory Manager" password = 1223 basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 6

EAP-TLS authentication
by deepak kumar 07 May '07

07 May '07

Hi, I am using freeradius1.1 on linux suse 10.1 and chillispot for captive portal. I have implemented EAP -TLS using client and server side certificate and it worked well. but even after client authentication from certificate. the router(chillispot) prompts for a username and password and then does authentication using UAM. Please tell me why this is asking for login name password after client certificate validation. is something needs to be changed in chilli.conf , or any other radius conf file. thanks in advance dee

2 13

restricting users access to clients?
by Matt Ashfield 20 Apr '07

20 Apr '07

Hi, We're using FreeRadius to authenticating our wireless users (who's credentials are stored in LDAP). But we'd also like to use it to authenticate a select few users who need access to our networking gear. Our networking gear is setup to do this, but I'm not sure how to set this up in FreeRadius. I would assume that you'd specify in the clients.conf section which users are allowed access to that device, but in looking at the documentation for clients.conf, that doesn't seem to be the case. Any links/advice is appreciated. Thanks Matt mda(a)unb.ca

3 5

radius-apache authentication problem
by Ramazan Ulker 11 Apr '07

11 Apr '07

Hi I want to implement otp authentication for a web site. Radius and otp scripts works well together but apache don't send any authentication data to radius. I followed instructions in http://www.freeradius.org/mod_auth_radius/ but apache mod_authn_file wants passwords and could not be disabled. when i removed the module no authn provider configured are seen in apache error logs. Changing AuthBasicAuthorative on or off in .htaccess didn't solve the problem. Problem stems from apache but someone solves such a problem can respond me.

2 6

MAC authorisation (but not authentication) via LDAP
by Martin Whinnery 11 Apr '07

11 Apr '07

Hi. Probly just me not understanding... What I want is for our switches to only allow access to MAC addresses in our LDAP database. I don't want to store passwords on our LDAP host entries. I'm set up to check LDAP during authorisation, and it correctly returns authorised / not authorised depending on whether the appropriate attribute contains the right value. The trouble comes with authentication - either I set Auth-Type := Accept, in which case and failed authorisation is overridden, or I allow authentication to carry on against LDAP ( or System, or whatever ), in which case it fails always and access is denied, even for authorised MACs. Is there a way to make the Authorisation part final and authoritative? As I say, probly just being stoopid. Mart -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 12

1.1.5 double free or corruption
by Thor Spruyt 10 Apr '07

10 Apr '07

Hi, I have built freeradius-1.1.5 with mysql, ldap and openssl on CentOS 4.4 Everything looks ok (configure, make, make install), but when running the server, it dies. [thor@byze freeradius-1.1.5]$ sudo /opt/freeradius-1.1.5-1/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/proxy.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/clients.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/snmp.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/eap.conf Config: including file: /opt/freeradius-1.1.5-1/etc/raddb/sql.conf main: prefix = "/opt/freeradius-1.1.5-1" main: localstatedir = "/opt/freeradius-1.1.5-1/var" main: logdir = "/opt/freeradius-1.1.5-1/var/log/radius" main: libdir = "/opt/freeradius-1.1.5-1/lib" main: radacctdir = "/opt/freeradius-1.1.5-1/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius-1.1.5-1/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/opt/freeradius-1.1.5-1/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius-1.1.5-1/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /opt/freeradius-1.1.5-1/lib *** glibc detected *** double free or corruption (fasttop): 0x098a55d8 *** Aborted If it helps, here's the end of an strace: open("/opt/freeradius-1.1.5-1/etc/raddb/realms", O_RDONLY) = 3 fstat64(3, {st_mode=S_IFREG|0640, st_size=187, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f76000 read(3, "#\n#\tTHIS FILE IS DEPRECATED.\n#\n#"..., 4096) = 187 read(3, "", 4096) = 0 close(3) = 0 munmap(0xb7f76000, 4096) = 0 getrlimit(RLIMIT_CORE, {rlim_cur=0, rlim_max=RLIM_INFINITY}) = 0 stat64("/opt/freeradius-1.1.5-1/var/log/radius", {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0 getgid32() = 0 open("/etc/services", O_RDONLY) = 3 fcntl64(3, F_GETFD) = 0 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0 fstat64(3, {st_mode=S_IFREG|0644, st_size=20373, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f76000 read(3, "# /etc/services:\n# $Id: services"..., 4096) = 4096 read(3, "123/tcp\nntp\t\t123/udp\t\t\t\t# Networ"..., 4096) = 4096 read(3, "\t\t873/tcp\t\t\t\t# rsync\nrsync\t\t873/"..., 4096) = 4096 close(3) = 0 munmap(0xb7f76000, 4096) = 0 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 3 bind(3, {sa_family=AF_INET, sin_port=htons(1812), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 4 bind(4, {sa_family=AF_INET, sin_port=htons(1813), sin_addr=inet_addr("0.0.0.0")}, 16) = 0 time(NULL) = 1173470425 write(1, "radiusd: entering modules setup"..., 33radiusd: entering modules setup ) = 33 time(NULL) = 1173470425 write(1, "Module: Library search path is /"..., 59Module: Library search path is /opt/freeradius-1.1.5-1/lib ) = 59 open("/opt/freeradius-1.1.5-1/lib/rlm_exec.la", O_RDONLY) = 5 fstat64(5, {st_mode=S_IFREG|0755, st_size=895, ...}) = 0 mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xb7f76000 read(5, "# rlm_exec.la - a libtool librar"..., 4096) = 895 read(5, "", 4096) = 0 close(5) = 0 munmap(0xb7f76000, 4096) = 0 futex(0xa98060, FUTEX_WAKE, 2147483647) = 0 open("/opt/freeradius-1.1.5-1/lib/rlm_exec.a", O_RDONLY) = 5 read(5, "!<arch>\n/ 11734703"..., 512) = 512 close(5) = 0 open("/opt/freeradius-1.1.5-1/lib/rlm_exec-1.1.5.so", O_RDONLY) = 5 read(5, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0\270\10"..., 512) = 512 fstat64(5, {st_mode=S_IFREG|0755, st_size=17018, ...}) = 0 old_mmap(NULL, 9308, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 5, 0) = 0xf7a000 old_mmap(0xf7c000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 5, 0x1000) = 0xf7c000 close(5) = 0 open("/dev/tty", O_RDWR|O_NONBLOCK|O_NOCTTY) = 5 writev(5, [{"*** glibc detected *** ", 23}, {"double free or corruption (fastt"..., 35}, {": 0x", 4}, {"080f95d8", 8}, {" ***\n", 5}], 5*** glibc detected *** double free or corruption (fasttop): 0x080f95d8 *** ) = 75 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0 tgkill(26392, 26392, SIGABRT) = 0 --- SIGABRT (Aborted) @ 0 (0) --- +++ killed by SIGABRT +++ Process 26392 detached -- Thor Spruyt M: +32 475 67 22 65 E: thor.spruyt(a)telenet.be W: www.thor-spruyt.com

3 3