June 2007 - Freeradius-Users - lists.freeradius.org

Ldap Group Membership Requirements
by Cody Jarrett 20 Jun '07

20 Jun '07

I'm trying to require a user to be a member of the wireless group in ldap to be able to join the wireless. All users can currently join the wireless. I can't find very much documentation on the groupmembers* lines in the ldap section of radius.conf. Basically trying to figure out what I need to add to these lines: groupname_attribute, groupmembership_filter, and groupmembership_attribute. Also not sure if I need to add something to users file like: DEFAULT LDAP-Group == "wireless". Can anyone provide input on what I need to configure, Thanks. wireless group in ldap, you can see cjarrett is a member: dn: cn=wireless,ou=Groups,dc=itfreedom,dc=com objectClass: posixGroup cn: wireless gidNumber: 1011 memberUid: cjarrett

3 3

add new arributes in the proxy reply message
by Ashraf Al-Basti 20 Jun '07

20 Jun '07

Dear, i need to add attributes in the proxy reply message, how can i do that using attrib_rewrite?

2 1

1.1.6 name resolution
by Andrew Long 20 Jun '07

20 Jun '07

Is it permissable to use a hostname in clients.conf, as for a host using dyndns? Regards, Andrew Long

2 2

empty password / dhcpd
by Felipe Ceglia - PY1NB 20 Jun '07

20 Jun '07

Hi again... I am now trying to authenticate a DHCPd request from a mikrotik box. My freeradius server says that there is a problem with user's password. How can I tell him (PAP) that this should be ok? Something strange that I noticed is that the calling station id got changed from the original mac address value. Anyway, I just put this as a calling-station id attribute on radcheck. mysql> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id; +------+-------------------+--------------------+-------------------+----+ | id | UserName | Attribute | Value | op | +------+-------------------+--------------------+-------------------+----+ | 2047 | 00:0B:CD:EC:63:50 | Calling-Station-Id | 1:0:b:cd:ec:63:50 | := | | 2050 | 00:0B:CD:EC:63:50 | User-Password | | := | +------+-------------------+--------------------+-------------------+----+ 2 rows in set (0.00 sec) SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; Empty set (0.00 sec) mysql> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id; +----+-------------------+-------------------+-----------------+----+ | id | UserName | Attribute | Value | op | +----+-------------------+-------------------+-----------------+----+ | 42 | 00:0B:CD:EC:63:50 | Framed-IP-Address | 192.168.254.101 | == | | 43 | 00:0B:CD:EC:63:50 | Framed-IP-Netmask | 255.255.255.0 | == | +----+-------------------+-------------------+-----------------+----+ 2 rows in set (0.00 sec) SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; Empty set (0.00 sec) Ready to process requests. rad_recv: Access-Request packet from host 172.16.3.5:32768, id=71, length=113 NAS-Port-Type = Ethernet NAS-Port = 2205155400 Calling-Station-Id = "1:0:b:cd:ec:63:50" Called-Station-Id = "server1" User-Name = "00:0B:CD:EC:63:50" User-Password = "" NAS-Identifier = "MikroTik" NAS-IP-Address = 172.16.3.5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00:0B:CD:EC:63:50", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "00:0B:CD:EC:63:50" rlm_realm: Proxying request from user 00:0B:CD:EC:63:50 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 174 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '00:0B:CD:EC:63:50' rlm_sql (sql): sql_set_user escaped user --> '00:0B:CD:EC:63:50' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '00:0B:CD:EC:63:50' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '00:0B:CD:EC:63:50' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 ****************************************************************************** rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 modcall[authenticate]: module "pap" returns invalid for request 0 modcall: leaving group PAP (returns invalid) for request 0 ****************************************************************************** auth: Failed to validate the user. Login incorrect (rlm_pap: empty password supplied): [00:0B:CD:EC:63:50/] (from client mikrotik port 2205155400 cli 1:0:b:cd:ec:63:50) rad_lowerpair: Stripped-User-Name now '00:0b:cd:ec:63:50' rad_lowerpair: User-Password now '' rad_rmspace_pair: Stripped-User-Name now '00:0b:cd:ec:63:50' rad_rmspace_pair: User-Password now '' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 0 Thank you, Felipe

2 2

RE: PHP issues with PHP 4.3.9 and dialup_admin
by Josh Howlett 20 Jun '07

20 Jun '07

> On 6/16/07, Josh Howlett <J.Howlett(a)ukerna.ac.uk> wrote: > > Ethan, > > > > Have you got the freeradius-mysql RPM installed? > > I don't know if I remembered to post a followup or not, but, > "undefined constant" messages aside (which are caused by a > change to how PHP requires single quotes), my real problems > with dialup_admin not working at all (blank screens), was > caused by a missing rpm related to PHP and a > reported/documented "feature" that if you call a PHP function > that does not exist, you get no feedback in the way of error > messages - just total silence. You were probably missing php-mysql, as I was. PHP does normally return sensible error messages of the kind you mention, so I had the some confusion as you. I'm not sure if there is an new option in php5 to enable these, or if something has changed in dialup_admin to suppress them... josh.

1 0

RE: PHP issues with PHP 4.3.9 and dialup_admin
by Josh Howlett 20 Jun '07

20 Jun '07

Ethan, Have you got the freeradius-mysql RPM installed? josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Ethan Dicks > Sent: 20 March 2007 21:00 > To: freeradius-users(a)lists.freeradius.org > Subject: PHP issues with PHP 4.3.9 and dialup_admin > > I've been digging around all day and I've seen other people > describe the same symptoms I'm having, but the follow-ups > typical asy "Oh, I fixed it", but don't describe the fix. It > seems that something resembling my symptoms goes back to the > version of dialup_admin that shipped with freeRADIUS 1.0.1, > so I am not convinced what I'm seeing is _specifically_ a PHP > 4.3 problem, but given the changes with registers_global from > 4.1.0 to 4.2.0, I thought it would be prudent to mention that. > > My setup is... > CentOS 4.4.2 (RHEL 4 without the RedHat trademarks and graphics) > Apache 2.0.52 > PHP 4.3.9 > mysql 4.1.20 > freeRADIUS 1.1.5 > dialup_admin ? (CVS snapshot 20070320) > firefox 1.5.0.10 > > I have freeRADIUS installed and working with users stuffed > into a flat file, verified with 'radtest'. I can get the > main page of dialup_admin to come up, but I get blank screens > and lots of PHP errors logged when I try to invoke nearly any > button. My radius database has tables, but no rows, since I > was trying to set up dialup_admin to start inserting users > and groups. I have set PHP's registers_global to 'on' via > /etc/php.ini and verified that it's on with phpinfo(), and I > still get dozens of errors per mouse-click... > > Here's a typical example - the output is generated when > clicking on the 'new group' button: a long list of 'undefined > constant', 'undefined variable', and 'undefined index' > following the warning that there's no prefix on a function > call to say what its namespace is. > I'm putting the error dump at the bottom to keep it from > creating a huge gulf between sections of this query. > > I know it must look familar because I've found several > references to errors that look just like this in the mailing > list archives. What's lacking is the solution. > > Am I just missing a setup step somewhere? Am I running > servers and packages that are just too new and untested? > > Thanks, > > -ethan > > > [client 127.0.0.1] PHP Notice: import_request_variables(): > No prefix specified - possible security hazard in > /usr/local/dialup_admin/conf/config.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/conf/config.php3 on line 66, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 73, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 76, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_username_mappings_file - assumed > 'general_username_mappings_file' in > /usr/local/dialup_admin/conf/config.php3 on line 86, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_username_mappings_file - assumed > 'general_username_mappings_file' in > /usr/local/dialup_admin/conf/config.php3 on line 87, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > name - assumed 'name' in > /usr/local/dialup_admin/conf/config.php3 on line 100, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/conf/config.php3 on line 106, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: show in > /usr/local/dialup_admin/htdocs/group_new.php3 on line 3, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_lib_type - assumed 'general_lib_type' in > /usr/local/dialup_admin/htdocs/group_new.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_user_edit_attrs_file - assumed 'general_user_edit_attrs_file' > in /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/attrshow.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > accounting - assumed 'accounting' in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > userdb - assumed 'userdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasdb - assumed 'nasdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasadmin - assumed 'nasadmin' in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 17, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_accounting_attrs_file - assumed > 'general_accounting_attrs_file' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 23, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_accounting_attrs_file - assumed > 'general_accounting_attrs_file' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/attrshow.php3 on line 24, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > accounting - assumed 'accounting' in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 8, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > userdb - assumed 'userdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 9, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasdb - assumed 'nasdb' in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, > referer: http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 10, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: http_user in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > nasadmin - assumed 'nasadmin' in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: mappings in > /usr/local/dialup_admin/lib/xlat.php3 on line 11, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: acct_attrs in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: ua in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: fl in > /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 40, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: uf in > /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined index: num in > /usr/local/dialup_admin/lib/attrshow.php3 on line 36, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/attrshow.php3 on line 44, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/defaults.php3 on line 18, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Use of undefined constant > general_use_session - assumed 'general_use_session' in > /usr/local/dialup_admin/lib/sql/attrmap.php3 on line 32, referer: > http://localhost/dialup/buttons.php3 > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/lib/sql/defaults.php3 on line 3, referer: > http://localhost/dialup/buttons.php3 > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

1.1.6 rpmbuild on centos 4.4
by Andrew Long 20 Jun '07

20 Jun '07

I know this is a little off topic, but would appreciate any help. Following instructions at http://radiuswiki.suntel.com.tr/Build I am getting... [root@dev SPECS]# rpmbuild -bb freeradius.spec error: Failed build dependencies: libtool-ltdl-devel is needed by freeradius-1.1.6-0.i386 On Cent 4.4 there is no libtool-ltdl or devel package. I don't quite understand this, as this machine is identical to another on which I built freeradius from source (not rpmbuild, though). I can find a libtool-ltdl for FC, but it puts me in a spiral of failed deps... Anyone have a clue? Regards, Andrew Long

3 3

mschapv2 and users file
by Matt Cobb 20 Jun '07

20 Jun '07

I have freeradius 1.1.4 setup as a proxy to an upstream radius server which works. I also want to put guests in a local users file and use MSCHAPV2 on them, but didn't get it to work. I was able to get PAP and CHAP working. Here is the MSCHAPV2 configuration I tried: users file: cobb User-Password=="secret" proxy.conf: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm guests { type = radius authhost = LOCAL:1812 accthost = LOCAL:1813 secret = whatever } realm testlab.com { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } realm DEFAULT { type = radius authhost = 172.16.0.3:1812 accthost = 172.16.0.3:1813 secret = testing } radius.conf: prefix = /usr exec_prefix = ${prefix} sysconfdir = /etc localstatedir = /var/lib sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = /var/log/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 1812 listen { ipaddr = * port = 1645 type = auth } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no #require_encryption = yes #require_strong = yes #with_ntdomain_hack = no } ldap { server = "ldap.your.domain" # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = yes } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } } instantiate { exec expr # daily } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. # # The order of the realm modules will determine the order that # we try to find a matching realm. # # Make *sure* that 'preprocess' comes before any realm if you # need to setup hints for the remote radius server authorize { preprocess chap mschap suffix ntdomain eap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique suffix ntdomain # # Read the 'acct_users' file files } accounting { detail unix radutmp } session { radutmp } post-auth { } post-proxy { eap } I get this error about the mschap response being incorrect. A request form the same client that is proxied back to IAS with mschapv2 works. rlm_realm: Looking up realm "guests" for User-Name = "cobb@guests" rlm_realm: Found realm "guests" rlm_realm: Adding Stripped-User-Name = "cobb" rlm_realm: Proxying request from user cobb to realm guests rlm_realm: Adding Realm = "guests" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "ntdomain" returns noop for request 0 modcall: leaving group (returns noop) for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry cobb at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Told to do MS-CHAPv2 for cobb@guests with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. I also tried changing the users file to have NT-Password == "0xB6FFB3200061D7B7928F0D932F095128" But then freeradius just said it couldn't create the NT-Password: rlm_mschap: No User-Password configured. Cannot create NT-Password, followed by the previous error. How do I configure MSCHAPv2 to a local users file?

7 11

Exec-Program-Wait
by Felipe Ceglia - PY1NB 20 Jun '07

20 Jun '07

Hi gurus! Should this work, or am I missing something? radiusd -x doesnt outupt any call to this script. When I run it thru users file, it is called, and works. mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mendes' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+-------------------+----------------------------------------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+----------------------------------------------+----+ | 24 | dialup2 | Exec-Program-Wait | php /intranet/prod/src/checkradius.php %u %n | := | +----+-----------+-------------------+----------------------------------------------+----+ 1 row in set (0.00 sec) Thank you, Felipe Ceglia

2 1

1.1.6 README error?
by Andrew Long 20 Jun '07

20 Jun '07

The README for 1.1.6 states... "New users of FreeRADIUS should prefer using Cleartext-Password over User-Password. That is, if the documentation or a web page says to configure User-Password in a database or server configuration file, the documentation is likely out of date, and you should use User-Password instead." I am wondering if the last line is supposed to read, " use Cleartext-Password instead." Regards, Andrew Long

3 3