April 2007 - Freeradius-Users - lists.freeradius.org

1.1.6: PAP and MySQL-stored NT-Password don't work
by Stefan Winter 11 May '07

11 May '07

Hi, I try to get rid of cleartext passwords stored in a MySQL db, and replace them by NT hashes. I set up a test environment and first tried with an entry in users: swinter NT-Password := "...", Auth-Type := Accept which worked okay. Storing the same password in MySQL did NOT work, with a quite spurious error, see below: Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:52635, id=148, length=59 User-Name = "swinter" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 1234 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "swinter", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 radius_xlat: 'swinter' rlm_sql (sql): sql_set_user escaped user --> 'swinter' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'swinter' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'swinter' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'swinter' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'swinter' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Normalizing NT-Password from hex encoding modcall[authorize]: module "pap" returns updated for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 1 rlm_pap: login attempt with password test rlm_pap: Using NT encryption. radius_xlat: Running registered xlat function of module mschap for string 'NT-Hash test' rlm_mschap: Unknown expansion string "NT-Hash test" radius_xlat: '' rlm_pap: mschap xlat failed rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 1 modcall: leaving group PAP (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Especially the lines radius_xlat: Running registered xlat function of module mschap for string 'NT-Hash test' rlm_mschap: Unknown expansion string "NT-Hash test" radius_xlat: '' rlm_pap: mschap xlat failed appear suspicious ("test" is the password"). Maybe there's some xlat escaping wrong? The configuration in use is almost as shipped, only added sql config. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 9

POD not work with radclient
by satish patel 11 May '07

11 May '07

Dear guys I am comming with new problem now i have enable POD packet of disconnet on cisco router and now i m trying to disconnect user with radclient command but i got this output [root@radius ~]# cat packet.txt Acct-Session-Id=0000C476 User-Name=mlpm607 X-Ascend-Session-Svr-Key=396830D9 NAS-IP-Address=192.168.1.1 [root@radius ~]# cat packet.txt | radclient -x 192.168.1.1:1700 disconnect tulip786 Sending Disconnect-Request of id 115 to 192.168.1.1 port 1700 Acct-Session-Id = "0000C476" User-Name = "mlpm607" X-Ascend-Session-Svr-Key = "396830D9" NAS-IP-Address = 192.168.1.1 rad_recv: Disconnect-NAK packet from host 192.168.1.1:1700, id=115, length=41 Reply-Message = "No Matching Session" why user not disconnect from NAS but user still login on NAS ????? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

4 4

timeouts through a firewall?
by Matt Ashfield 09 May '07

09 May '07

Hi All We are seeing the following error: Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Our radius server talks to our LDAP server through a firewall. I'm wondering if this has to do with the session lifetime setting on the firewall? If there are no authentications taking place (we're in testing mode, and it was at least 2-3 hours between client authentications), then I guess this connection/session could be timed out by the firewall? I just want to know if that makes sense before approaching the firewall guys and asking to increase the timeout. Thanks Matt mda(a)unb.ca

4 3

LDAP retrieve additional attributes and map to radius attributes
by Workout Yahoo 09 May '07

09 May '07

Hi, Sorry if this question is a repeat but I saw the mail archives and not able to find what I am looking for. We are using freeradius to connect to LDAP server. I can able to authenticate with the radius sever fine. Now I want to retrieve ldap attribute called productId. Depends on the productId, I have to give access the users. If the productId=1234, then all the users will get access. If not..no access. After reading the mail archives and documentation, I saw I need to do changes in /etc/raddb/dictionary,/etc/raddb/users, /etc/raddb/ldap.attrmap Can you please explain me what is the right config I need to modify. You help is really appreciated. Thanks and regards. Here is the radiusd.conf for ldap. ldap { server = "testldap.xyz.com" identity = "cn=Directory Manager" password = 1223 basedn = "dc=test1213,dc=household,o=internet" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" encryption_scheme = crypt start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 #compare_check_items = yes #do_xlat = yes # access_attr_used_for_allow = yes } __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

4 6

EAP-TLS authentication
by deepak kumar 07 May '07

07 May '07

Hi, I am using freeradius1.1 on linux suse 10.1 and chillispot for captive portal. I have implemented EAP -TLS using client and server side certificate and it worked well. but even after client authentication from certificate. the router(chillispot) prompts for a username and password and then does authentication using UAM. Please tell me why this is asking for login name password after client certificate validation. is something needs to be changed in chilli.conf , or any other radius conf file. thanks in advance dee

2 13

libradius error
by Roberto Greiner 04 May '07

04 May '07

Hi, I'm having a small problem with radwho/libradius. When I give a 'radwho' command, I receive the following error: radwho: error while loading shared libraries: libradius-1.1.6.so: cannot open shared object file: No such file or directory I've installed FreeRadius following the guidelines for Debian from de wiki, including mysql support. FreeRadius itself works fine, as does access to the mysql base. The mentioned libradius file is in /usr/lib/freeradius, and the radius.conf file has the following entry(it's the pre-installed entry, I didn't change it): libdir = /usr/lib/freeradius So freeradius should find the library file. I'm running FreeRadius version 1.1.6, in a fresh Debian Etch install. Any Ideas? Thank you very much, Marcos Roberto Greiner The -x entry from freeradius is the following (although, as I said, FreeRadius itself works fine). Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to dialup@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=localhost,shortname=local,secret=foobar rlm_sql (sql): Adding client 127.0.0.1 (local) to clients list rlm_sql (sql): Read entry nasname=a.b.c.d,shortname=xxxxxxx,secret=s3mf!o/ rlm_sql (sql): Adding client a.b.c.d (xxxxxxx) to clients list rlm_sql (sql): Read entry **** Cut => more entries from the nas table in mysql rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

3 7

Freeradius proxy code questions and proposed patch
by Kostas Zorbadelos 04 May '07

04 May '07

Hello to everyone. In a previous thread http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg33354.… I had described a strange behavior in our large proxy setup. After running the server in debug mode (radiusd -xxx) in our production systems we found out what was causing our problems. The problem was that the home server in our proxy setup was marked dead quite often during the day and with a dead_time of 30 secs every request that came within these 30 secs was rejected. Our proxy conf initially looked like the following: proxy server { synchronous = yes retry_delay = 0 retry_count = 0 dead_time = 30 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... We first changed the dead_time to 0 so as to avoid marking the home server dead in synchronous mode. Additionally, we implemented the following patch (against version 1.1.6): --- ./src/main/files.c.orig 2007-04-23 15:14:14.569932000 +0300 +++ ./src/main/files.c 2007-04-23 15:22:30.995686000 +0300 @@ -489,6 +489,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "authentication server %s:%d for realm %s seems unresponsive.", + cl->server, port, cl->realm); + continue; + } cl->active = FALSE; cl->wakeup = now + mainconfig.proxy_dead_time; @@ -498,6 +507,15 @@ if (cl->last_reply > (( now - mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count ))) { continue; } + /* + * If we are running in synchronous proxy mode, there's no point marking the target + * server(s) dead, since this should be done by the radius client + */ + if (mainconfig.proxy_synchronous) { + radlog(L_PROXY, "accounting server %s:%d for realm %s seems unresponsive.", + cl->acct_server, port, cl->realm); + continue; + } cl->acct_active = FALSE; cl->acct_wakeup = now + mainconfig.proxy_dead_time; The purpose of this patch is to not have the freeradius server mark the home server dead when working in synchronous mode. We believe that in synchronous operation it is a good idea to leave the job of marking the server dead to the NAS client. All the above actions solved our initial problems. However, after a while we noticed again clients being rejected when they shouldn't. The following code in request_list.c caught my attention: /* * Refresh a request, by using proxy_retry_delay, cleanup_delay, * max_request_time, etc. * * When walking over the request list, all of the per-request * magic is done here. */ static int refresh_request(REQUEST *request, void *data) { ... (around line 1264 version 1.1.6) } else if (request->proxy && !request->proxy_reply) { /* * The request is NOT finished, but there is an * outstanding proxy request, with no matching * proxy reply. * * Wake up when it's time to re-send * the proxy request. * * But in synchronous proxy, we don't retry but we update * the next retry time as NAS has not resent the request * in the given retry window. */ if (mainconfig.proxy_synchronous) { /* * If the retry_delay * count has passed, * then mark the realm dead. */ if (info->now > (request->timestamp + (mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count))) { rad_assert(request->child_pid == NO_SUCH_CHILD_PID); request_reject(request); realm_disable(request->proxy->dst_ipaddr, request->proxy->dst_port); request->finished = TRUE; goto setup_timeout; } request->proxy_next_try = info->now + mainconfig.proxy_retry_delay; } difference = request->proxy_next_try - info->now; } else { ... It seems that in some "strange" occations the code enters the above path. A decision is made in case the current time is older than mainconfig.proxy_retry_delay * mainconfig.proxy_retry_count. If this is the case, the request is rejected and the code tries to disable the realm. However in the proxy.conf configuration file it is mentioned: # If you want to have the server send proxy retries ONLY when the NAS # sends it's retries to the server, then set this to 'yes', and # set the other proxy configuration parameters to 0 (zero). # ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # Additionally, if you want 'failover' to work, the server must manage # retries and timeouts. Therefore, if this is set to yes, then no # failover functionality is possible. # synchronous = no When we have proxy_retry_delay and proxy_retry_count zero, the request is rejected whenever we enter the above code path. I can't tell for sure if there is a problem in that code but it does not look clean to me. In order to circumvent the problems we just gave values to these 2 configuration parameters, so we ended up with the following proxy.conf: proxy server { synchronous = yes retry_delay = 15 retry_count = 5 dead_time = 0 default_fallback = yes post_proxy_authorize = no } ####################################################################### # # Configuration for the proxy realms. # ... Please let me know your thoughts on these matters (also on the patch we provide) Thanks, Kostas

4 6

FreeRadius+AD integration
by shrikant Bhat 03 May '07

03 May '07

Hi, I am trying to integrate freeradius with ADS 2003. I reffred to http://deployingradius.com/documents/configuration/active_directory.html . everything works perfectly fine till ( $ ntlm_auth --request-nt-key --domain=*MYDOMAIN* --username=*user* --password=*password*) I get NT_STATUS_OK. I dont see NT_KEY output. I made changes to exec module in radius.conf as per the instructions, but radtest fails with Access-Reject .I have attached the debug window output for reference. ________________________________________________________________________________________ rad_recv: Access-Request packet from host 127.0.0.1:32928, id=44, length=57 User-Name = "raduser" User-Password = "radpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "raduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry sbhat at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 _____________________________________________________________________________________________________________________ Any help fixing this issue will be appreciated. thank you! SB

6 31

EAP-TTLS PEAP MCHAPv2
by Eshun Benjamin 02 May '07

02 May '07

Any one has an idea of how to get rid of "The server certificate is not trusted because there are no explicit trust settings" on MAC OSX 10.4.9 without selecting "always trust these freecertificate" ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

4 3

Different Groups
by Norman Zhang 02 May '07

02 May '07

Is there a way to set FreeRADIUS to authenticate against specific group of users for certain devices. For example, DEFAULT Auth-Type = System Fall-Through = Yes, cisco-avpair = "shell:priv-lvl=1", Service-Type = NAS-Prompt-User DEFAULT Group == router-rw cisco-avpair := "shell:priv-lvl=15" DEFAULT Group == fw-admin cisco-avpair := "shell:priv-lvl=15" Can I have the PIX to authenticate only against group fw-admin? Norman

2 3