June 2007 - Freeradius-Users - lists.freeradius.org

Freeradius PEAP and Wireless
by Cody Jarrett 19 Jun '07

19 Jun '07

I'm trying to setup freeradius with ldap for use with a wireless network. I don't want to have to deal with tls and certificates if possible, I would just like for users to use their username and password to connect. The radius config for ldap is pretty easy, but I'm having a problem when trying to enable peap as my default eap type. I've done so in my eap.conf which I've included and a section of debug when trying to start radiusd. Appreciate any info. When trying to start radiusd: Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Unable to load EAP-Type/peap, as EAP-Type/TLS is required first. radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1939] Unknown module "eap". radiusd.conf[1886] Failed to parse authenticate section. eap.conf basically, everything else is commented out. eap { default_eap_type = peap peap { default_eap_type = mschapv2 } mschapv2 { } } -- Cody Jarrett IT Freedom cody.jarrett(a)itfreedom.com Office: 512.419.0070 Fax: 512.419.0080

6 8

Attribute "User-Password" is required for authentication
by Cody Jarrett 19 Jun '07

19 Jun '07

I found a few topics on this issue but nothing quite informative enough. I'm trying to get freeradius auth working with pam and peap. When I test my config with radtest, I get Access-accept. When I use a windows XP supplicant with a 3com access point, I get: rlm_pam: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "pam" returns invalid for request 4 modcall: leaving group authenticate (returns invalid) for request 4 auth: Failed to validate the user. Is the 3com not sending User-Password attributes in the packets, or is something else wrong?

6 10

freeradius performance , requests per second
by deepak kumar 19 Jun '07

19 Jun '07

Hi I am using freeradius 1.1.6 on Suse Linux 10 , and mysql for database. My processor is Intel Pentium 4, 3.40 Ghz, RAM is 512 MB and hard disk is 80 GB. On this configuration how many requests , freeraradius can handle per second. Is there any tool which can test the performance of freeradius. Can you please tell me the average number of authentication requests that freeradius can process per second. can it handle 1 lac requests per second. thanks deepak

4 3

Freeradius w/ mikrotik - blank password issue
by Jay Banks 19 Jun '07

19 Jun '07

Hello everyone, I have a problem I have worked on for a couple of days now and just can't get it to work. Searched the forum really good and actually found a fix for one issue I was having. I have also searched the Mikrotik forum as well as the web from one end to the other. Nothing seems to be able to answer this one question, though. Here is the deal. I have a working FreeRadius server (latest version). It works with Mikrotik to authenticate with user name / password using PAP. Mikrotik can authenticate by MAC address, but it's docs says it sends a blank password. What they also don't tell you in their weak documentation, is that the colons in the MAC address will foobar freeradius authentication. I fixed that problem by adding this to radiusd.conf: attr_rewrite mac_colons { attribute = User-Name searchin = packet searchfor = ":" replacewith = "" ignore_case = yes new_attribute = no max_matches = 10 append = no } This appears to work fine. If someone would help me with this one last issue, I would be a happy camper. The Mikrotik documentation (weak) says that it sends a "blank password" when authenticating by MAC. I have looked up one side and down the other, but I can't get FreeRadius to accept no password. I tried this, but it fails: attr_rewrite blank_password { attribute = User-Password searchin = packet searchfor = "" replacewith = "password" ignore_case = yes new_attribute = no max_matches = 10 append = no } And then I added something like this to the "users" file: 00095B23389F User-Password := "password" If there is a password, the above works. For instance, I can change "password" to "password1" using the above script, and it will authenticate. But if there is no password, it gets this error: rlm_attr_rewrite: Could not find value pair for attribute User-Password Well guys, I'm an extreme newbie with freeradius, but there has to be something I'm missing somewhere in order to authenticate by mac address through mikrotik. Other people are doing it. I'm just missing some little something somewhere, I know. I have also seen other wireless equipment that sends a blank password when authenticating by MAC...and people use freeradius with it. Any help would be greatly appreciated. Thanks, Jay Banks

3 5

Disabling EAP-TLS while keeping EAP-PEAP
by Martin Gadbois 18 Jun '07

18 Jun '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 When enabling EAP-PEAP with FreeRADIUS, module EAP-TLS is required. How can I disable EAP-TLS while using EAP-PEAP? I agree that if the client does not have a client key, EAP-TLS will not work. But how to restrict EAP-TLS in any case? Thanks! - -- ============== +---------------------------------------------+ Martin Gadbois | "Please answer by yes or no. | Sr. SW Designer | Uncooperative user waste precious CPU time" | Colubris Networks Inc. | -- The Andromeda Strain, M. Crichton, 1969 | -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGYGSw9Y3/iTTCEDkRAiawAJ9hANUDvgjJTDDwAfiQkDR/NUKH1ACghRNW O1DdJnCymFB8hsiiIUMc9Ks= =1OR5 -----END PGP SIGNATURE-----

5 6

SQL statement expansion with alternate internal expansions ...
by Arran Cudbard-Bell 18 Jun '07

18 Jun '07

update request { Supplicant-Flags = "%{sql_clients:SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1}" } is parsed as SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1} expanded to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = 'null' LIMIT 0,1} when should be SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1} expanded to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = 'null' LIMIT 0,1 Tailing } breaks sql queries. Thing that breaks it is the alternate value declaration for Calling-Station-Id. works fine with update request { Supplicant-Flags = "%{sql_clients:SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id}' LIMIT 0,1}" } This has been a bug for as long as I can remember using the server :) so since 1.1.4 --- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 2

Segmentation fault on conflicting packet
by Milan Holub 18 Jun '07

18 Jun '07

Hi Alan, I'm using cvs build based on cvs head on May 29 2007. I'm running it under conditions close to production(40 auth requests/hour, 700 accounting requests/hour). Most of the time it's doing well but I've observed already multiple times following behaviour: 2007-05-31 06:18:14.884403500 Thread 1 handling request 11920, (2384 handled so far) 2007-05-31 06:18:14.884406500 Processing the preacct section of radiusd.conf 2007-05-31 06:18:14.884408500 +- entering group preacct 2007-05-31 06:18:14.884410500 ++[preprocess] returns ok 2007-05-31 06:18:14.884412500 radius_xlat: '<CLIENT_IP>' 2007-05-31 06:18:14.884414500 rlm_attr_rewrite: Added attribute Client-IP-Address with value '<CLIENT_IP>' 2007-05-31 06:18:14.884417500 ++[add_clientip] returns ok 2007-05-31 06:18:14.884534500 rlm_acct_unique: Hashing 'NAS-Port = 5292,Client-IP-Address = <CLIENT_IP>,NAS-IP-Address = <NAS_IP>,Acct-Session-Id = "192458",User-Name = "<USERNAME>"' 2007-05-31 06:18:14.884540500 rlm_acct_unique: Acct-Unique-Session-ID = "4c66e6ddb85d6ed4". 2007-05-31 06:18:14.884543500 ++[acct_unique] returns ok 2007-05-31 06:18:14.884544500 rlm_realm: No '/' in User-Name = "<USERNAME>", looking up realm NULL 2007-05-31 06:18:14.884547500 rlm_realm: No such realm "NULL" 2007-05-31 06:18:14.884562500 ++[IPASS] returns noop 2007-05-31 06:18:14.884564500 rlm_realm: No '@' in User-Name = "<USERNAME>", looking up realm NULL 2007-05-31 06:18:14.884567500 rlm_realm: No such realm "NULL" 2007-05-31 06:18:14.884568500 ++[suffix] returns noop 2007-05-31 06:18:14.884570500 radius_xlat: '<CLIENT_IP>' 2007-05-31 06:18:14.884572500 acct_users: Matched entry DEFAULT at line 39 2007-05-31 06:18:14.884574500 ++[files] returns ok 2007-05-31 06:18:14.884575500 Using perl at 0x81691e0 2007-05-31 06:18:14.884590500 rlm_perl: rlm_perl: preacct 2007-05-31 06:18:14.884592500 rlm_perl: Request attributes: 2007-05-31 06:18:14.884594500 rlm_perl: RAD_REQUEST: WISPr-Location-Name = 21001:BE-HO Bern Holingen KVA 2007-05-31 06:18:14.884619500 rlm_perl: RAD_REQUEST: Calling-Station-Id = 0000000000000000 2007-05-31 06:18:14.884622500 rlm_perl: RAD_REQUEST: NAS-Port = 5292 2007-05-31 06:18:14.884624500 rlm_perl: RAD_REQUEST: Acct-Delay-Time = 0 2007-05-31 06:18:14.884626500 rlm_perl: RAD_REQUEST: WISPr-Location-ID = 68 2007-05-31 06:18:14.884628500 rlm_perl: RAD_REQUEST: Acct-Session-Id = 192458 2007-05-31 06:18:14.884630500 rlm_perl: RAD_REQUEST: NAS-Identifier = <NAS_IP>:5292 2007-05-31 06:18:14.884645500 rlm_perl: RAD_REQUEST: Class = TN_S1M 2007-05-31 06:18:14.884647500 rlm_perl: RAD_REQUEST: Acct-Unique-Session-Id = 4c66e6ddb85d6ed4 2007-05-31 06:18:14.884650500 rlm_perl: RAD_REQUEST: Called-Station-Id = 00:19:D2:3D:5A:EA 2007-05-31 06:18:14.884652500 rlm_perl: RAD_REQUEST: Acct-Authentic = RADIUS 2007-05-31 06:18:14.884654500 rlm_perl: RAD_REQUEST: Framed-IP-Address = 10.2.159.24 2007-05-31 06:18:14.884657500 rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 2007-05-31 06:18:14.884672500 rlm_perl: RAD_REQUEST: User-Name = <USERNAME> 2007-05-31 06:18:14.884674500 rlm_perl: RAD_REQUEST: Client-IP-Address = <CLIENT_IP> 2007-05-31 06:18:14.884676500 rlm_perl: RAD_REQUEST: NAS-IP-Address = <NAS_IP> 2007-05-31 06:18:14.884678500 rlm_perl: RAD_REQUEST: Acct-Status-Type = Start 2007-05-31 06:18:14.884680500 rlm_perl: Reply attributes: 2007-05-31 06:18:14.884682500 rlm_perl: Check attributes: 2007-05-31 06:18:14.884684500 rlm_perl: RAD_CHECK Proxy-To-Realm = LOCAL 2007-05-31 06:18:14.884699500 rlm_perl: Added pair WISPr-Location-Name = 21001:BE-HO Bern Holingen KVA 2007-05-31 06:18:14.884720500 rlm_perl: Added pair Calling-Station-Id = 0000000000000000 2007-05-31 06:18:14.884723500 rlm_perl: Added pair NAS-Port = 5292 2007-05-31 06:18:14.884725500 rlm_perl: Added pair Acct-Delay-Time = 0 2007-05-31 06:18:14.884727500 rlm_perl: Added pair WISPr-Location-ID = 68 2007-05-31 06:18:14.884729500 rlm_perl: Added pair Acct-Session-Id = 192458 2007-05-31 06:18:14.884731500 rlm_perl: Added pair NAS-Identifier = <NAS_IP>:5292 2007-05-31 06:18:14.884746500 rlm_perl: Added pair Class = TN_S1M 2007-05-31 06:18:14.884748500 rlm_perl: Added pair Acct-Unique-Session-Id = 4c66e6ddb85d6ed4 2007-05-31 06:18:14.884750500 rlm_perl: Added pair Called-Station-Id = 00:19:D2:3D:5A:EA 2007-05-31 06:18:14.884753500 rlm_perl: Added pair Acct-Authentic = RADIUS 2007-05-31 06:18:14.884755500 rlm_perl: Added pair Framed-IP-Address = 10.2.159.24 2007-05-31 06:18:14.884757500 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 2007-05-31 06:18:14.884772500 rlm_perl: Added pair User-Name = <USERNAME> 2007-05-31 06:18:14.884774500 rlm_perl: Added pair Client-IP-Address = <CLIENT_IP> 2007-05-31 06:18:14.884776500 rlm_perl: Added pair NAS-IP-Address = <NAS_IP> 2007-05-31 06:18:14.884778500 rlm_perl: Added pair Acct-Status-Type = Start 2007-05-31 06:18:14.884780500 rlm_perl: Added pair Proxy-To-Realm = LOCAL 2007-05-31 06:18:14.884782500 ++[perl] returns ok 2007-05-31 06:18:14.884784500 +- group preacct returns ok 2007-05-31 06:18:14.884835500 Processing the accounting section of radiusd.conf 2007-05-31 06:18:14.884837500 +- entering group accounting 2007-05-31 06:18:14.884839500 radius_xlat: '/var/log/freeradius/radacct/<CLIENT_IP>/detail-20070531' 2007-05-31 06:18:14.884860500 rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradi us/radacct/<CLIENT_IP>/detail-20070531 2007-05-31 06:18:14.884865500 radius_xlat: 'Thu May 31 06:18:14 2007' 2007-05-31 06:18:14.884935500 Threads: total/active/spare threads = 5/1/4 2007-05-31 06:18:14.885099500 Received conflicting packet from client <SHORTNAME> port 33499 - ID: 0 due to unfinished request 11920.Giving up on old request. 2007-05-31 06:18:14.885168500 Failed to insert request 11921 in the list of live requests: discarding 2007-05-31 06:18:14.913060500 ++[detail] returns ok 2007-05-31 06:18:14.913068500 rad_accounting: Cancelling proxy to realm LOCAL, as it is a LOCAL realm. 2007-05-31 06:18:14.913071500 Request 11920 was cancelled. 2007-05-31 06:18:14.913073500 Going to the next request 2007-05-31 06:18:14.913074500 Thread 1 waiting to be assigned a request >>SEQMENTATION FAULT... If you check the timeline we've received conclicting packet after 0.000696 sec. Which I think was a duplicate packet due to some network problem. Packet 11920 was in the middle of processing(finished writing into detail file, but not yet written to database). Segmentation fault occured when another request was received. I was not able to simulate by sending duplicate packets via radclient. I think the sensitive part is receiving duplicate packet during the processing of original packet. Any ideas? Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

3 2

RE: Freeradius PEAP and Wireless
by Josh Howlett 18 Jun '07

18 Jun '07

> rlm_eap: Unable to load EAP-Type/peap, as EAP-Type/TLS is > required first. You need to uncomment the tls section in eap.conf, even if yoo're not intending to use EAP-TLS. josh.

1 0

Re: AW: AW: encrypted password
by Felipe Ceglia - PY1NB 18 Jun '07

18 Jun '07

Hi, Running 1.1.6 now. Crypt-Local works ok now. I would like to know if it is possible to have both User-Password and Crypt-Local Auth-Types for sql users. Now I need to disable the current System (/etc/passwd) users to Crypt-Local, and also have users with cleartext passwords. Thank you, Felipe Ceglia Rascher, Markus wrote: > If u use the db for user authentication, then db, here is my db-content: > > select * from radcheck; > +----+----------+---------------+----+---------------+ > | id | UserName | Attribute | op | Value | > +----+----------+---------------+----+---------------+ > | 1 | testuser | Crypt-Password| := | oV9XYXNTx4awE | > +----+----------+---------------+----+---------------+ > > > select * from radgroupcheck; > +----+-----------+-----------+----+---------------+ > | id | GroupName | Attribute | op | Value | > +----+-----------+-----------+----+---------------+ > | 1 | testgroup | Auth-Type | := | Crypt-Local | > +----+-----------+-----------+----+---------------+ > 1 row in set (0.01 sec) > > > If it works with cleartext pwd's and the auth-type Local then it will work with Crypt-Local and the crypted pwd in the radcheck table > > For encrypting the pwd use the encrypt("pwd") function in sql > > Do you have any further questions? > > > regards > Markus > > > > -----Ursprüngliche Nachricht----- > Von: Felipe Ceglia [mailto:felipeceglia@gmail.com] Im Auftrag von Felipe Ceglia - PY1NB > Gesendet: Mittwoch, 13. Juni 2007 13:54 > An: Rascher, Markus > Betreff: Re: AW: encrypted password > > Hi Markus, > > Where should I try it? users file, or as an attribute on the db? > > Thank you, > > Felipe > > Rascher, Markus wrote: >> Did you try Crypt-Local auth-Type? >> >> -----Ursprüngliche Nachricht----- >> Von: freeradius-users-bounces+markus.mr.rascher=siemens.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+markus.mr.rascher=siemens.com@lists.freeradius.org] Im Auftrag von Felipe Ceglia - PY1NB >> Gesendet: Mittwoch, 13. Juni 2007 00:26 >> An: FreeRadius users mailing list >> Betreff: Re: encrypted password >> >> Hi Arran, >> >> Thank you for your reply. >> >> I tried Crypt-Password := "9D8wtP7DGqgCg", but then the debug says: >> >> (...) >> modcall[authorize]: module "sql" returns ok for request 2 >> modcall: group authorize returns ok for request 2 >> rad_check_password: Found Auth-Type Local >> auth: type Local >> auth: user supplied User-Password does NOT match local User-Password >> auth: Failed to validate the user. >> Login incorrect: [anavc/2572ava] (from client localhost port 0) >> Delaying request 2 for 2 seconds >> >> When I try with a clear text password user, it says: >> >> (...) >> modcall[authorize]: module "sql" returns ok for request 3 >> modcall: group authorize returns ok for request 3 >> rad_check_password: Found Auth-Type Local >> auth: type Local >> auth: user supplied User-Password matches local User-Password >> (...) >> >> >> Thank you, >> >> Felipe >> >> >> >> Arran Cudbard-Bell wrote: >>> Felipe Ceglia - PY1NB wrote: >>>> Hi again, >>>> >>>> I need to migrate my users from plain old unix passwd file to sql. >>>> >>>> How do I have the user information in the radcheck table? >>>> >>>> Encrypted-Password == 9D8wtP7DGqgCg ? >>>> >>>> My passwd file looks like: >>>> anavc:9D8wtP7DGqgCg:1002:300:#Ana:/home/dummy:/usr/bin/passwd >>>> >>>> This password seems not to be MD5. >>>> >>>> Any guesses? >>>> >>>> Thank you again, >>>> >>>> Felipe >>>> >>>> - >>>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>>> >>> That would be unix crypt. >>> >>> The attribute in radcheck is >>> >>> Crypt-Password := "9D8wtP7DGqgCg" >>> - >>> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >>> >> - >> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >> >

2 1

download latest version: link broken?
by Andrew Long 18 Jun '07

18 Jun '07

ftp://ftp.freeradius.org/pub/radius/freeradius-1.1.5.tar.gz I am getting an error that the dir or file does not exist... Am I right that 2.0 is not available and/or not considered stable yet? Regards, Andrew

5 8