August 2007 - Freeradius-Users - lists.freeradius.org

Strange problem
by Sean Bracken 22 Aug '07

22 Aug '07

Hi, I am using Freeradius with a MySQL backend and the users log in through Chillispot running on Buffalo and Linksys routers running DD-WRT. The problem is that randomly users are recorded up to five times in radacct with one login. This is not a problem for users with expiration acccounts but users with max-all-session accounts are thrown out before they have really used up their time. Has anyone come accross this before? I'd appreiate any help. Sean ----- Original Message ----- From: <freeradius-users-request(a)lists.freeradius.org> To: <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, August 21, 2007 4:28 PM Subject: Freeradius-Users Digest, Vol 28, Issue 73 > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. RE: PAM Radius (Sayan S) > 2. customise dialup admin (Carl aniams) > 3. I am a first timer ! (Joshua Mashiane) > 4. Database Population problem with mysql (ram) > 5. RE: Database Population problem with mysql (Josh Howlett) > 6. Re: I am a first timer ! (Alan DeKok) > 7. Re: Database Population problem with mysql (ram) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 21 Aug 2007 04:22:20 -0700 (PDT) > From: Sayan S <sayann_u(a)yahoo.com> > Subject: RE: PAM Radius > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Cc: Josh Howlett <Josh.Howlett(a)ja.net> > Message-ID: <445430.39719.qm(a)web63910.mail.re1.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > yes josh, as you guessed it, it doesn't work with HP-UX and Solaris (to > some extent, as it provides a warning during useradd command with '@' in > the username). > We don't plan to use LDAP for NSS immediately. > > thanks to all. > > sayan > > Josh Howlett <Josh.Howlett(a)ja.net> wrote: Hi Sayan, > > I think I have tried this previously, and it was possible (on > Linux/glibc anyway - YMMV with other unices). > > TBH, I don't really see the point in using RADIUS when you'll (probably) > want to use LDAP anyway for nss resolution, so you might as well just > use LDAP for PAM. > > josh. > >> -----Original Message----- >> From: >> freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. >> org >> [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre > eradius.org] On Behalf Of Sayan S >> Sent: 20 August 2007 14:04 >> To: FreeRadius users mailing list >> Subject: Re: PAM Radius >> >> Thanks Alan for the quick response. >> I am referring to realm here, as RADIUS support realms, and >> we are using RADIUS to authenticate the users to Linux, so >> seems like we need to have all users contained in the same realm. >> >> Is having username in user@realm form a valid unix format? I >> was thinking the first part of the user@realm should be the >> unix username though the radius request is sent as >> user@realm. Otherwise we need to have a comprehensive >> RADIUS-username@realm to Unix-userid mapping. >> >> regards, >> sayan >> >> Alan DeKok wrote: >> >> Sayan S wrote: >> > Greetings, I am very new to RADIUS and PAM RADIUS. >> > I am trying to configure PAM Radius to authenticate >> users on a Linux >> > host. I would like to know, how to configure PAM >> Radius to authenticate >> > users from different realms, as the current >> configuration doesn't seem >> > to take realm. >> >> You don't use realms in Unix logins. >> >> > please help me with this as I have configured users >> to be part of >> > different realms on radius server and now want to >> authenticate all those >> > users to the same Linux host. >> >> You just login as "user@realm". That might work. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> >> ________________________________ >> >> Park yourself in front of a world of choices in alternative vehicles. >> Visit the Yahoo! Auto Green Center. >> n_center/;> > _ylc=X3oDMTE5cDF2bXZzBF9TAzk3MTA3MDc2BHNlYwNtYWlsdGFncwRzbGsDZ >> 3JlZW4tY2VudGVy> >> > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > --------------------------------- > Take the Internet to Go: Yahoo!Go puts the Internet in your pocket: mail, > news, photos & more. >

2 1

RE: Database Population problem with mysql
by Josh Howlett 21 Aug '07

21 Aug '07

Post mysql.sql to the list. josh. > -----Original Message----- > From: ram [mailto:talk2ram@gmail.com] > Sent: 21 August 2007 16:29 > To: FreeRadius users mailing list > Cc: Josh Howlett > Subject: Re: Database Population problem with mysql > > > > On 8/21/07, Josh Howlett <Josh.Howlett(a)ja.net> wrote: > > > (42000) at line 15: Invalid default value for 'AcctStartTime' > > Try using a valid value for this. > > > Hi > > what is the correct value for that record > > as per the document iam populating > > iam using mysql > > mysql Ver 14.12 Distrib 5.0.32, for pc-linux-gnu (i486) > using readline 5.2 > > on debian > > any suggestions > > ram > >

2 1

RE: Database Population problem with mysql
by Josh Howlett 21 Aug '07

21 Aug '07

> (42000) at line 15: Invalid default value for 'AcctStartTime' Try using a valid value for this. josh.

2 1

I am a first timer !
by Joshua Mashiane 21 Aug '07

21 Aug '07

Hi I am a first timer in this Freeradius server, i have managed to configure my server on a centos machine which is runniny Asterisk. The problem comes when i have to configure it so Windows XP machine can connect, i have followed lots and lots of tutorial i don't even remember what i did, but the proble still remains. I am not sure if i created the certificates right or what. The first error that i get is something like {mohwiti.co.za/no-password attribute} Now this is what i am getting TLS Alert write:fatal:error:unknow CA TLS accept:error in SSLv3 read client certificate B Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails I don't know what that means Kind Regards

2 1

Database Population problem with mysql
by ram 21 Aug '07

21 Aug '07

Hi iam trying to populate mysql datatabase iam getting following error any suggstions mysql -u root -ppassword radius < mysql.sql ERROR 1067 (42000) at line 15: Invalid default value for 'AcctStartTime' line 15 looks like below AcctStartTime datetime NOT NULL default '0000-00-00 00:00:00', AcctStopTime datetime NOT NULL default '0000-00-00 00:00:00', ram

1 0

RE: PAM Radius
by Josh Howlett 21 Aug '07

21 Aug '07

Hi Sayan, I think I have tried this previously, and it was possible (on Linux/glibc anyway - YMMV with other unices). TBH, I don't really see the point in using RADIUS when you'll (probably) want to use LDAP anyway for nss resolution, so you might as well just use LDAP for PAM. josh. > -----Original Message----- > From: > freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. > org > [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre eradius.org] On Behalf Of Sayan S > Sent: 20 August 2007 14:04 > To: FreeRadius users mailing list > Subject: Re: PAM Radius > > Thanks Alan for the quick response. > I am referring to realm here, as RADIUS support realms, and > we are using RADIUS to authenticate the users to Linux, so > seems like we need to have all users contained in the same realm. > > Is having username in user@realm form a valid unix format? I > was thinking the first part of the user@realm should be the > unix username though the radius request is sent as > user@realm. Otherwise we need to have a comprehensive > RADIUS-username@realm to Unix-userid mapping. > > regards, > sayan > > Alan DeKok <aland(a)deployingradius.com> wrote: > > Sayan S wrote: > > Greetings, I am very new to RADIUS and PAM RADIUS. > > I am trying to configure PAM Radius to authenticate > users on a Linux > > host. I would like to know, how to configure PAM > Radius to authenticate > > users from different realms, as the current > configuration doesn't seem > > to take realm. > > You don't use realms in Unix logins. > > > please help me with this as I have configured users > to be part of > > different realms on radius server and now want to > authenticate all those > > users to the same Linux host. > > You just login as "user@realm". That might work. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > ________________________________ > > Park yourself in front of a world of choices in alternative vehicles. > Visit the Yahoo! Auto Green Center. > <http://us.rd.yahoo.com/evt=48246/*http://autos.yahoo.com/gree n_center/;> _ylc=X3oDMTE5cDF2bXZzBF9TAzk3MTA3MDc2BHNlYwNtYWlsdGFncwRzbGsDZ > 3JlZW4tY2VudGVy> >

2 1

Chap password to user password
by Carl aniams 21 Aug '07

21 Aug '07

hi Alan, i was able to fix it in chillispot by uncommenting the user password thanks a lot for your assistance -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

1 0

session updates
by Fred Zinsli 21 Aug '07

21 Aug '07

Hi Everyone I have managed to build an RPM from source 1.1.7 to install on FC5, freeradius+mysql Freeradius starts up properly without errors and the user can logon and logout as expected. However, when the screen is presented to the user showing the current session details, nothing is updated as expected, only thye clock cycles over. This is a hotcakes install. I have no idea on what to look for. Any comments would be most helpfull Regards Fred

3 4

Help configuring FreeRadius with PPPD and ntlm_auth
by Bruce Marriner 20 Aug '07

20 Aug '07

I am setting up a Linux VPN for Windows clients via L2TP/IPSEC. I had everything working using basic PPPD chap-secrets authentication via MSCHAPv2 and am trying to add on the Radius part. I’ve read a bunch of how-to’s but they all seem to be wrote for a different setup or different versions and many of them have incorrect statements about what is or is not in the config files ☺ I have samba configured and winbindd running. I tried to follow the instructions from the below links which are for PPTP not L2TP but both systems use PPPD for the username/pass authentication. http://wiki.freeradius.org/PopTop http://www.members.optushome.com.au/~wskwok/poptop_ads_howto_8.htm I can run ntlm_auth as the radius user and it runs okay. impasse ~ # sudo -u radiusd /usr/bin/ntlm_auth --request-nt-key --domain=ameristarfence.com --username=supersecretuser password: NT_STATUS_OK: Success (0x0) On all examples of setting up FreeRadius with VPN configurations against AD they all just say to basicly.. change the radiusd.conf file to turn on mppe in the mschap section and setup winbindd so it works. But I read some place that I also need EAP or.. PEAP to get this to work. I’m not sure if that’s required and that’s my primary question right now? Does anyone know the specific things I need to setup so freeradius can authenticate via the ntlm_auth tool back to PPPD? Below is the versions of everything. Last night I got frustrated and removed freeradius and reinstalled it with all fresh new config files. Followed the poptop guide on freeradius wiki site again and am not surprisingly getting the same response. Below is what the radius server is saying about all this :) I see the part where it sets the authtype to CHAP. And I think that should be MS-CHAP but I don't really know (obviously). Any help would be very appreciated :) ----------------------------------------------------------------------------- impasse ~ # radiusd -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32774, id=123, length=94 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "supersecretuser" CHAP-Challenge = 0xafd50494421ab0f8cc743432bbd7000278ee8748078c2b CHAP-Password = 0x8a3ab7e348bc7de701db2207475d474831 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rlm_chap: Setting 'Auth-Type := CHAP' rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. rlm_chap: login attempt by "supersecretuser" with CHAP password rlm_chap: Could not find clear text password for user supersecretuser Login incorrect (rlm_chap: Clear text password not available): [supersecretuser/<CHAP-Password>] (from client localhost port 0) rad_recv: Access-Request packet from host 127.0.0.1:32774, id=123, length=94 Sending Access-Reject of id 123 to 127.0.0.1 port 32774 ----------------------------------------------------------------------------- Below is a list of versions and compile features (via Gentoo USE statements) ----------------------------------------------------------------------------- samba-3.0.24-r3 USE="acl kerberos ldap oav pam python readline syslog winbind -async -automount -caps -cups -doc -examples -fam -quotas (-selinux) -swat" freeradius-1.1.6 USE="debug kerberos ldap mysql pam snmp ssl -edirectory -firebird -frascend -frnothreads -frxp -postgres -udpfromto" 0 kB xl2tpd-1.1.10 0 kB openssl-0.9.8e-r1 USE="bindist sse2 zlib -emacs -test" 0 kB strongswan-2.8.4 USE="ldap nat -curl -smartcard" 0 kB ppp-2.4.4-r9 USE="pam radius -activefilter -atm -dhcp -eap-tls -gtk -ipv6 -mppe-mppc" 0 kB Linux impasse 2.6.21-gentoo-r4 #11 SMP Tue Aug 14 16:29:27 CDT 2007 i686 Intel(R) Pentium(R) D CPU 3.20GHz GenuineIntel GNU/Linux

2 1

Certificate verification
by abhishek singh 20 Aug '07

20 Aug '07

I am using Free radius to perform EAP_TLS negotiations. When we send client certificates for validations, does free radius imposes any depth on the certification validation. What i mean to say , if the certificate is self signed , then certificate will not be accepted by the Free radius. If the free radius imposes depth, the what is the value for the depth ? Thanks in advance

2 1