April 2007 - Freeradius-Users - lists.freeradius.org

windows XP computer WPA, TKIP, PEAP, EAP-MSCHAP v2 has "No User-Password or CHAP-Password attribute in the request"
by PoWah Wong 25 Aug '07

25 Aug '07

My freeradius client is a windows XP SP2 computer running 802.11 WPA, TKIP, PEAP, EAP-MSCHAP v2 and trying to connect to the linux Fedora Core 2 wireless server. I run the freeradius server in debugging mode # radiusd -sfxxyz -l stdout This is the output. How to fix this problem? rad_recv: Access-Request packet from host 127.0.0.1:52001, id=38, length=134 Framed-MTU = 1380 NAS-IP-Address = 0.0.0.0 NAS-Identifier = "wifictrl" User-Name = "test" NAS-Port-Id = ":2:2" Service-Type = Framed-User NAS-Port-Type = Wireless-802.11 Called-Station-Id = "00-f0-00-06-67-a8" Calling-Station-Id = "00-20-a6-57-7a-e9" EAP-Message = 0x020100090174657374 Message-Authenticator = 0x737afc3b6c1fb17ad13ee348ca5fbf4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched test at 90 radius_xlat: 'Hello, test' modcall[authorize]: module "files" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 5 for 1 seconds Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 38 to 127.0.0.1:52001 Reply-Message = "Hello, test" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 38 with timestamp 43d1500d Nothing to do. Sleeping until we see a request. # radiusd -v radiusd: FreeRADIUS Version 1.0.1, for host , built on Apr 15 2005 at 11:57:29 # uname -a Linux wifictrl 2.6.5-1.358 #1 Sat May 8 09:04:50 EDT 2004 i686 i686 i386 GNU/Linux __________________________________________________________ Find your next car at http://autos.yahoo.ca

8 15

Duplicate requests in a session
by Santiago Balaguer García 16 Aug '07

16 Aug '07

Hi people, 1) In my activity I realize that when the conexion to Internet of a NAS is NOT good (there are some reday in the DSL), the NAS send several Start requests. My problen is my RADIUS server ask for all these requests and they are inserted in my DB. So, when the user or the NAS finalize the session and NAS sends Stop Request, the credit associates to the user account is decremented several times. It happens so because I put a trgger in my DB to decrement the user credit atomatically. Can I avoid the problem of inserting several times the start request? If it is so, how?? 2) Is it supposed that the value of acctsessionid and acctuniqueid in radacct table are UNIQUE and they can not be duplicated ? Thanks, Santiago _________________________________________________________________ Grandes éxitos, superhéroes, imitaciones, cine y TV... http://es.msn.kiwee.com/ Lo mejor para tu móvil.

6 9

Freeradius Auth via LDAP against Active Directory Server 2003
by Jacob Jarick 09 Jul '07

09 Jul '07

I have been at this for awhile now, so I thought I would share a summary of what I have figured out so far for anyone else that decides to try this. 1 - Documentation for this particular configuration is either out of date / incomplete / both. There are no howtos that will get from start to end (if you do know of one or wrote one yourself please share - I will myself when I figure it all out). 2 - Most the trouble is due to the fact we are making a linux service talk to a windows service (AD LDAP). Freeradius talking to the linux passwd file is a breeze by comprassion. 3 - Windows 2003 LDAP implementation will not provide a password when a user/ service preforms a ldap search, the proper way If I understand correctly is to supply plain text username / password then freeradius preforms a bind with the provided credentials against your ADS server, success means the password was correct. 4 - Installing "Services For Unix" on 2003 will make AD LDAP provide a password hash attribute among other unix LDAP attributes. The user has have posix enabled. 5 - Anonymous searchs can be preformed on 2003 AD LDAP if you set dSHeuristics to 0000002 using adsiedit.msc. 6 - Microsofts LDAP is different to Novells (big surprise) and so unfortunately their documentation isnt to helpfull as a reference for people trying to use ADS in the same fashion.

6 17

sql auth problems with 2.0.0-pre
by Alexander Serkin 07 Jul '07

07 Jul '07

Gurus, may be i'm pulling some common mistake with my configuration being tested against cvs snapshot, but no idea which one. I've an sql profile telling: some.dotted.user Cleartext-Password = cisco NAS-IP-Address =~ "xxx.xxx.97.(85|86)" authentication request: User-Name = "some.dotted.user" User-Password = "cisco" Calling-Station-Id = "000000000000000" Framed-Protocol = PPP Service-Type = Framed-User NAS-IP-Address = xxx.xxx.97.85 gives the access-reject for unknown (for me) reason: rlm_sql (sqlauth): sql_set_user escaped user --> 'some.dotted.user' rlm_sql (sqlauth): Reserving sql socket id: 3 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id' SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id ... rlm_sql (sqlauth): Released sql socket id: 3 modcall[authorize]: module "sqlauth" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [some.dotted.user/cisco] (from client localhost port 0 cli 00000000000000) auth: Failed to validate the user. I've checked the authorization sql query shown in debug - it properly returns the profile configured -- Sincerely Yours, Alexander

5 21

performace on chainging clients.conf and huntgroup
by Kevin J 14 Jun '07

14 Jun '07

Alan, I noticed that more IPs I add to clients.conf and huntgroups, more steep performance declines FreeRadius got. Guessing the linked-list. Have we considered other data structures like hashing or btree? -Kevin ____________________________________________________________________________________ Never miss an email again! Yahoo! Toolbar alerts you the instant new Mail arrives. http://tools.search.yahoo.com/toolbar/features/mail/

10 25

configuration
by parfait kouassi nda 06 Jun '07

06 Jun '07

i want to configure my freeradius server to be a proxy server! can i have the config of the modification of freeradius's files? My proxy's server must turn with IAS of windows server 2003! thanks! _________________________________________________________________ MSN Messenger : discutez en direct avec vos amis ! http://www.msn.fr/msger/default.asp

3 4

rlm_sql: processing radcheck & radgroupcheck
by Milan Holub 25 May '07

25 May '07

Hi all, I'm wondering about procedure of precessing radcheck&radgroupcheck database tables. On http://wiki.freeradius.org/Rlm_sql we can read: Group processing then begins if any of the following conditions are met: * The user IS NOT found in radcheck * The user IS found in radcheck, but the check items don't match ... Ok, the first point I can imagine that if the user is not found we still can accept the "generic" user and give him some reply attributes based on further group processing. But the 2nd point I do not understand. Few lines below on wiki we can read: > For any fairly complex setup, it is likely that most of the actual > processing will be done in the groups. In these cases, the user entry in > radcheck will be of limited use except for things like setting the > user's password. In fact in my case(I believe in almost all of the cases) we DO check users against their passwords. If this check fails we should reject the user else we give him reply attributes based on group membership and accept the request. Thus my question is: why to continue in group processing when the check items(password,...) in radcheck do not match? This leads to accepting users giving valid username but incorrect password... Here is my patch which enables read_groups option and targets the issue above(rejects user immediately if it's found that the radcheck failed): Index: src/modules/rlm_sql/rlm_sql.c =================================================================== RCS file: /source/radiusd/src/modules/rlm_sql/rlm_sql.c,v retrieving revision 1.165 diff -u -r1.165 rlm_sql.c --- src/modules/rlm_sql/rlm_sql.c 5 Apr 2007 10:52:37 -0000 1.165 +++ src/modules/rlm_sql/rlm_sql.c 12 Apr 2007 09:54:34 -0000 @@ -57,6 +57,8 @@ offsetof(SQL_CONFIG,tracefile), NULL, SQLTRACEFILE}, {"readclients", PW_TYPE_BOOLEAN, offsetof(SQL_CONFIG,do_clients), NULL, "no"}, + {"read_groups", PW_TYPE_BOOLEAN, + offsetof(SQL_CONFIG,read_groups), NULL, "yes"}, {"deletestalesessions", PW_TYPE_BOOLEAN, offsetof(SQL_CONFIG,deletestalesessions), NULL, "yes"}, {"num_sql_socks", PW_TYPE_INTEGER, @@ -638,6 +640,11 @@ /* * Only do this if *some* check pairs were returned */ + DEBUG2("rlm_sql (%s): check items", inst->config->xlat_name); + vp_listdebug(check_tmp); + DEBUG2("rlm_sql (%s): items found in packet", inst->config->xlat_name); + vp_listdebug(request->packet->vps); + if (paircompare(request, request->packet->vps, check_tmp, &request->reply->vps) == 0) { found = 1; DEBUG2("rlm_sql (%s): User found in group %s", @@ -960,6 +967,11 @@ dofallthrough = fallthrough(reply_tmp); pairxlatmove(request, &request->reply->vps, &reply_tmp); pairxlatmove(request, &request->config_items, &check_tmp); + } else { + /* + * check items did not match; do not process groups; return REJECT immediately + */ + return RLM_MODULE_REJECT; } } Hope this helps someone. Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 3

RE: freeradius and ntlm_auth howto
by King, Michael 25 May '07

25 May '07

Some things I've noticed from your attached files Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes I've never enabled these before, I'm unaware what affect they will have tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/etc/raddb/certs/random" Did you generate your OWN certs... They one's that ship with the server ARE NOT vailid. You have to generate your own. rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 That doesn't look right BUT YOUR FINAL ANSWER: xec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=b9ee04ca891c7b7d --nt-response=79b960c773fa101929d3bf8e738168e8b6d8ae8cd61f64f0 Exec-Program output: Account locked out (0xc0000234) Exec-Program-Wait: plaintext: Account locked out (0xc0000234) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect Your account in the domain is not correct. Looks like it's been disabled or something. Fix that first before you change anymore config files. ________________________________ From: Stieven.Struyf(a)komatsu.eu [mailto:Stieven.Struyf@komatsu.eu] Sent: Monday, November 06, 2006 3:16 AM To: King, Michael Subject: Fw: freeradius and ntlm_auth howto Michael, I sent my reply already to the list, but due to the size(larger than 100k) it had to be reviewed by the admin and after a week it was rejected. Below you can find the mail. Thanks for helping me. Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 ----- Forwarded by Stieven Struyf/KEISA/BE/KOMEUR on 11/06/2006 09:13 AM ----- Stieven Struyf/KEISA/BE/KOMEUR 11/02/2006 08:55 AM To FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc Subject RE: freeradius and ntlm_auth howtoLink <Notes://BENT63KE/C1257011005324FB/DABA975B9FB113EB852564B5001283EA/625A 148B6EA233CDC125721400531414> I added the debuglog as attachment(as it is a little large to paste here). This is the mschap config: mschap { authtype = MS-CHAP use_mppe = yes require_strong = yes with_ntdomain_hack = yes require_encryption = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551 freeradius-users-bounces+stieven.struyf=komatsu.eu(a)lists.freeradius.org wrote on 10/27/2006 04:36:00 PM: > Let's see if we can get this solved... > > > -----Original Message----- > > Here's the full log: > > Waking up in 6 seconds... > > rad_recv: Access-Request packet from host 10.104.254.73:1645, > > This is NOT the full log. The full log would have started with the line > /path/to/radiusd -X > > Some important stuff is printed out there, it helps us help you. > > > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > rlm_mschap: NT Domain delimeter found, should we have > > enabled with_ntdomain_hack? > > Did you enable Ntdomain Hack in the MSCHAP module? (See below) > > > Including your radius.conf file would help. > > > > > HOWEVER, first you may want to check your mschap module definition: > > > > > > modules { > > > mschap { > > > ntlm_auth = "/usr/bin/ntlm_auth \ > > > --request-nt-key \ > > > --username=%{mschap:User-Name:-None} \ > > > --domain=%{mschap:NT-Domain:-None} \ > > > --challenge=%{mschap:Challenge:-00} \ > > > --nt-response=%{mschap:NT-Response:-00}" > > > > > > ...all on one line of course. Note the use of the > > "mschap:User-Name" > > > and "mschap:NT-Domain" values. > > Mine radiusd.conf file's mschap section looks like this: > NOTE that I do NOT have the :-00 and the :-None statements, and I DO > have with_ntdomain_hack=yes > > > # Microsoft CHAP authentication > # > # This module supports MS-CHAP and MS-CHAPv2 authentication. > # It also enforces the SMB-Account-Ctrl attribute. > # > mschap { > with_ntdomain_hack = yes > ntlm_auth = "/usr/bin/ntlm_auth \ > --request-nt-key \ > --username=%{mschap:User-Name} \ > --challenge=%{mschap:Challenge} \ > --nt-response=%{mschap:NT-Response} > } > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

6 9

Performance with Freeradius-1.1.4
by nikitha george 20 May '07

20 May '07

Hi All, I am using freeradius-1.1.4 with PEAP-MSCHAPV2. Each session starting from Access-Request till Access-Accept it takes more than 250ms to complete. Is it the normal performance of freeradius-1.1.4 or anything suspicious in this regard? When i try to send many Request simultaneously then there is no response from the server for the latest requests as the server is busy processing first request. Only the first request gets response after 250ms. When i tried with some other RADIUS Server i could connect each mobile unit in some 150ms. Please let me know if anybody faced this problem with performance. Thanks, Nikitha

4 7

EAP-SIM : symbol lookup error
by deepak kumar 16 May '07

16 May '07

Hi Alan I have downloaded freeradius 1.1.6 and configured for EAP-SIM and run successfully. but when i send a request using radeapclient to radius server i get this error " ./radiusd: symbol lookup error: /usr/local/lib/rlm_sim_files- 1.1.6.so: undefined symbol: rad_assert" I have set LD_LIBRARY_PATH, reconfigured and and rebuilt server with share disable option , but still get the same error. what is the problem, what should I do? this is log of radius ------------------------- Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:37454, id=33, length=89 User-Name = "232420100000015" NAS-IP-Address = 255.255.255.255 Message-Authenticator = 0x42014f09257d6d91d04b6e145e251adb NAS-Port = 0 EAP-Message = 0x0220001401323332343230313030303030303135 ./radiusd: symbol lookup error: /usr/local/lib/rlm_sim_files-1.1.6.so: undefined symbol: rad_assert thanks Deepak

3 5