September 2007 - Freeradius-Users - lists.freeradius.org

Freeradius+Active directory - router login authentciation
by Rakesh Jha 05 Sep '07

05 Sep '07

For Cisco router login /enable authentication I want to use active directory authentication. I have installed Red Hat Linux 4 (2.6.9-5.EL #1) with Samba. I have also installed OpenSSL 0.9.8e 23 Feb 2007 and FreeRadius 1.1.7. I see RHL OS installation also put openssl (some old version of 2003) in /usr/bin directory. After following FreeRADIUS Tutorial for AD integration I am not able to start radius daemon as it complains - radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1962] Unknown module "eap". radiusd.conf[1909] Failed to parse authenticate section. Please advise what am I missing? While compiling openssl and freeradius I am using default option. Somewhere I read - "you want to use TLS or TTLS or PEAP, but have compiled the server without TLS support. Install openssl and the corresponding development libraries (often called openssl-devel) and recompile the server." Also one link advises to configure freeradius as following - ./configure --with-rlm-eap-tls-include-dir=/usr/kerberos/include/ Here problem is that I donot see /usr/kerberos/include path. Please suggest the right option for compiling openssl, freeradius and advisory. Thanks & regards, Rakesh Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

Freeradius+Active directory - router login authentciation
by Rakesh Jha 05 Sep '07

05 Sep '07

For Cisco router login /enable authentication I want to use active directory authentication. I have installed Red Hat Linux 4 (2.6.9-5.EL #1) with Samba. I have also installed OpenSSL 0.9.8e 23 Feb 2007 and FreeRadius 1.1.7. I see RHL OS installation also put openssl (some old version of 2003) in /usr/bin directory. After following FreeRADIUS Tutorial for AD integration I am not able to start radius daemon as it complains - radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1962] Unknown module "eap". radiusd.conf[1909] Failed to parse authenticate section. Please advise what am I missing? While compiling openssl and freeradius I am using default option. Somewhere I read - "you want to use TLS or TTLS or PEAP, but have compiled the server without TLS support. Install openssl and the corresponding development libraries (often called openssl-devel) and recompile the server." Also one link advises to configure freeradius as following - ./configure --with-rlm-eap-tls-include-dir=/usr/kerberos/include/ Here problem is that I donot see /usr/kerberos/include path. Please suggest the right option for compiling openssl, freeradius and advisory. Thanks & regards, Rakesh Attention: Any non-official business related views, opinions and other information presented in this electronic mail are solely those of the sender/author. Burgan Bank does not endorse or accept responsibility for their opinions. If you are not the addressed indicated in this mail or responsible for delivering this message to the intended, you should delete this message and notify the sender immediately. ------------------------------------------------------- Burgan Bank S.A.K www.burgan.com

1 0

Freeradius and php script
by Khaldon manIP 04 Sep '07

04 Sep '07

Hi all, I finally found out how to launch a script after authentication: I have first created a module exec modatt { wait = yes program = "/home/raduser/test.php %{User-Name} " input_pairs = request output_pairs = reply } and then I have added it in instantiate and authorize section here is the php script (test.php): #!/usr/bin/php <?php $argv = $_SERVER['argv']; if ( $argv[1] == "toto") echo "Session-Timeout:=100"; else echo "Session-Timeout:=50"; ?> But I still have a problem: the session-timeout attribute is not sent to the NAS. The debug output is hereunder: Tue Sep 4 17:26:57 2007 : Debug: Exec-Program output: Session-Timeout:=100 Tue Sep 4 17:26:57 2007 : Debug: Exec-Program-Wait: value-pairs: ,Session-Timeout:=100 Tue Sep 4 17:26:57 2007 : Error: Exec-Program-Wait: /home/raduser/test.php %{User-Name} : unparsable reply Tue Sep 4 17:26:57 2007 : Debug: Exec-Program: returned: 0 But I really don't know why because I execute a sh script (instead of a php script), it works very well!! here is my sh script (test.sh): #!/bin/sh if [ $1 == "toto" ]; then echo "Session-Timeout:=100" else echo "Session-Timeout:=53" fi debug trace: Tue Sep 4 17:58:00 2007 : Debug: Exec-Program output: Session-Timeout:=100 Tue Sep 4 17:58:00 2007 : Debug: Exec-Program-Wait: value-pairs: Session-Timeout:=100 Tue Sep 4 17:58:00 2007 : Debug: Exec-Program: returned: 0 I don't see any difference between the scripts (except one is working and the other one not).... Please, advise me... Many Thanks

2 1

Weird Problem
by Sofia Silva 04 Sep '07

04 Sep '07

First of all i want to say i'm sorry for attaching so many messages, my problem is that i don't have a clueof where is the problem. When i run radlogin and write the username and the password i get this: login: testuser Password: RADIUS: Authentication failure local: Authentication failure login: testuser Password: RADIUS: Authentication OK Starting. RADIUS_SERVICE_TYPE = NAS-Prompt-User RADIUS_USER_NAME = testuser As you can see, in the first try it doesn't work but in the second try it does!!! I don't undersatnd why this is happening. I attach the messages of the server in verbose mode. I would appreciate a lot if somebody could help me, thanks a lot, Sofía ad_recv: Access-Request packet from host 10.220.5.32:1025, id=168, length=66 --- Walking the entire request list --- Waking up in 31 seconds... Thread 3 got semaphore Thread 3 handling request 2, (1 handled so far) Service-Type = Login-User User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.220.5.32 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 radius_xlat: '/var/log/radius/radacct/10.220.5.32/auth-detail-20070904' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.220.5.32/auth-detail-20070904 modcall[authorize]: module "auth_log" returns ok for request 2 modcall[authorize]: module "attr_filter" returns noop for request 2 rlm_realm: No '/' in User-Name = "testuser", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "IPASS" returns updated for request 2 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "suffix" returns noop for request 2 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "ntdomain" returns noop for request 2 rlm_realm: Request already proxied. Ignoring. modcall[authorize]: module "NULL" returns noop for request 2 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 2 users: Matched entry DEFAULT at line 16 modcall[authorize]: module "files" returns ok for request 2 modcall[authorize]: module "etc_passwd" returns ok for request 2 modcall[authorize]: module "etc_shadow" returns ok for request 2 rlm_passwd: Added Group-Name: 'users' to reply_items rlm_passwd: Added Group-Name: 'video' to reply_items rlm_passwd: Added Group-Name: 'dialout' to reply_items modcall[authorize]: module "etc_group" returns ok for request 2 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 2 modcall: leaving group authorize (returns updated) for request 2 Processing the pre-proxy section of radiusd.conf modcall: entering group pre-proxy for request 2 radius_xlat: '/var/log/radius/radacct/10.220.5.32/pre-proxy-detail-20070904' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/radius/radacct/10.220.5.32/pre-proxy-detail-20070904 modcall[pre-proxy]: module "pre_proxy_log" returns ok for request 2 modcall: leaving group pre-proxy (returns ok) for request 2 Sending Access-Request of id 1 to 10.220.5.33 port 1645 Service-Type = Login-User User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.220.5.32 NAS-Port = 0 Proxy-State = 0x313638 Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 10.220.5.33:1647, id=1, length=71 Ignoring request from unknown client 10.220.5.33:1647 Waking up in 31 seconds... rad_recv: Access-Request packet from host 10.220.5.32:1025, id=168, length=66 Ignoring duplicate packet from client linuxclient:1025 - ID: 168, due to outstanding proxied request 2. --- Walking the entire request list --- Re-sending Access-Request of id 1 to 10.220.5.33 port 1645 Service-Type = Login-User User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.220.5.32 NAS-Port = 0 Client-IP-Address = 10.220.5.32 Stripped-User-Name = "testuser" Realm = "NULL" Realm = "NULL" Proxy-State = 0x313638 Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.220.5.33:1647, id=1, length=71 Ignoring request from unknown client 10.220.5.33:1647 Waking up in 5 seconds... --- Walking the entire request list --- Re-sending Access-Request of id 1 to 10.220.5.33 port 1645 Service-Type = Login-User User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.220.5.32 NAS-Port = 0 Client-IP-Address = 10.220.5.32 Stripped-User-Name = "testuser" Realm = "NULL" Realm = "NULL" Proxy-State = 0x313638 Waking up in 5 seconds... rad_recv: Access-Request packet from host 10.220.5.33:1647, id=1, length=71 Ignoring request from unknown client 10.220.5.33:1647 Waking up in 5 seconds... --- Walking the entire request list --- Server rejecting request 2. marking authentication server 10.220.5.33:1645 for realm NULL dead marking authentication server 10.220.5.33:1645 for realm DEFAULT dead Waking up in 0 seconds... --- Walking the entire request list --- Sending Access-Reject of id 168 to 10.220.5.32 port 1025 Cleaning up request 2 ID 168 with timestamp 46ddb600 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 10.220.5.32:1025, id=169, length=66 --- Walking the entire request list --- Waking up in 31 seconds... Thread 4 got semaphore Thread 4 handling request 3, (1 handled so far) Service-Type = Login-User User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = 10.220.5.32 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 radius_xlat: '/var/log/radius/radacct/10.220.5.32/auth-detail-20070904' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.220.5.32/auth-detail-20070904 modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "attr_filter" returns noop for request 3 rlm_realm: No '/' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "IPASS" returns noop for request 3 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 3 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "NULL" returns noop for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 users: Matched entry DEFAULT at line 16 modcall[authorize]: module "files" returns ok for request 3 modcall[authorize]: module "etc_passwd" returns ok for request 3 modcall[authorize]: module "etc_shadow" returns ok for request 3 rlm_passwd: Added Group-Name: 'users' to reply_items rlm_passwd: Added Group-Name: 'video' to reply_items rlm_passwd: Added Group-Name: 'dialout' to reply_items modcall[authorize]: module "etc_group" returns ok for request 3 rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval" returns notfound for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 3 modcall[authenticate]: module "unix" returns ok for request 3 modcall: leaving group authenticate (returns ok) for request 3 Login OK: [testuser/testuser] (from client linuxclient port 0) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 3 radius_xlat: '/var/log/radius/radacct/10.220.5.32/reply-detail-20070904' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.220.5.32/reply-detail-20070904 modcall[post-auth]: module "reply_log" returns ok for request 3 modcall: leaving group post-auth (returns ok) for request 3 Sending Access-Accept of id 169 to 10.220.5.32 port 1025 Service-Type = NAS-Prompt-User Finished request 3 Going to the next request Thread 4 waiting to be assigned a request _________________________________________________________________ Visita MSN Latino Entretenimiento: ¡música, cine, chismes, TV y más...! http://latino.msn.com/entretenimiento/

1 0

Authorization in RADIUS, Authorization in freeradius
by George Beitis 04 Sep '07

04 Sep '07

Hi everyone, I have a general question regarding Authorization in the RADIUS protocol and how it is implemented in freeradius. What does the RADIUS protocol refer to when it talks about Authorization, does it actually refer to users being probably authorized after being authenticated, using the protocol? Are there RADIUS specific attributes that are for authorization? (not authentication). There are ways of implementing authorization into freeradius, but do those simply overwrite the authentication decision? DIAMETER provides such authorization messeges from my understanding but the RADIUS protocol does not talk about any, is this correct? thank you very much regards George

11 19

FreeRadius dictionary
by yangcuilin 04 Sep '07

04 Sep '07

Hi, I wan to configure dictionary both on server side and client side. My step is: 1. Put dictionary file "dictionary.prosoft" to /usr/share/freeradius. And put its path to dictionary. The attached is my dictionary file. 2. I use a kind of radius client named "TinyRadius". Try several times, error occurred. So who can tell me the step in detail? Appreciated very much. Rock

2 1

What I have to modify to get X-Ascend-Session-Svr-Key value?
by Jaume 04 Sep '07

04 Sep '07

Hello! I'm running FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu under Fedora Core 6 and I'm trying to save the X-Ascend-Session-Svr-Key to a DB to later create a Disconnect Message with a PHP script. I've modified the sql.conf and the tables of the Mysql but X-Ascend-Session-Svr-Key is always blank : accounting_start_query = "INSERT into ACCOUNTING SET\ `User-Name` = '%{User-Name}',\ `Calling-Station-Id` = '%{Calling-Station-Id}',\ `Called-Station-Id` = '%{Called-Station-Id}',\ `NAS-IP-Address` = '%{NAS-IP-Address}',\ `NAS-Port` = '%{NAS-Port}',\ `Timestamp Start` = NOW(),\ `Acct-Unique-Session-Id` = '%{Acct-Unique-Session-Id}',\ `X-Ascend-Session-Svr-Key` = '%{X-Ascend-Session-Svr-Key}' " What I have to modify to get X-Ascend-Session-Svr-Key value? Thanks!

2 1

Problem withrlm_password to authenticate user against passwd like file
by Valery V. Bobrov 04 Sep '07

04 Sep '07

Hello! I've got passwd file format is (username:password_in_md5: the rest field is not nessasary) test2:$1$kjhFHrsb$pS2AZBTcE3m3HNguFhgVs/:0:0::0:0:/none:/none:/none crypto format: md5 I read FAQ: Can I use rlm_password to authenticate user against BLA-BLA-BLApasswd? A: Probably you can, if BLA-BLA-BLA stores password in some format supported by RADIUS, for example cleartext, NT/LM hashes, crypt, Netscape MD5 format. You have to set authtype to corresponding type, for example authtype = NS-MTA-MD5 for Netscape MD5. in radiusd.conf there is a passwd module(see below) My question is what "format = " in file should I use in order to use my passwd file above? Should I write something in section " Authentication" authenticate { ? I need all users authenticate via my passwdor file/ What should i do for that? Thank you in advance. Yours faithfully, Valery e-mail vb(a)uvttk.ru # passwd module allows to do authorization via any passwd-like # file and to extract any attributes from these modules # # parameters are: # filename - path to filename # format - format for filename record. This parameters # correlates record in the passwd file and RADIUS # attributes. # # Field marked as '*' is key field. That is, the parameter # with this name from the request is used to search for # the record from passwd file # Attribute marked as '=' is added to reply_itmes instead # of default configure_itmes # Attribute marked as '~' is added to request_items # # Field marked as ',' may contain a comma separated list # of attributes. # authtype - if record found this Auth-Type is used to authenticate # user # hashsize - hashtable size. If 0 or not specified records are not # stored in memory and file is red on every request. # allowmultiplekeys - if few records for every key are allowed # ignorenislike - ignore NIS-related records # delimiter - symbol to use as a field separator in passwd file, # for format ':' symbol is always used. '\0', '\n' are # not allowed # # An example configuration for using /etc/smbpasswd. # #passwd etc_smbpasswd { # filename = /etc/smbpasswd # format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" # authtype = MS-CHAP # hashsize = 100 # ignorenislike = no # allowmultiplekeys = no #}

1 0

Question about book
by Marinko Tarlac 03 Sep '07

03 Sep '07

Hello. I'm new here... What (free)radius book do you recommend? I found AAA (by Madjid Nakhjiri) and Radius (O'Reilly) but they are not so good as I thought.

1 0

nas / usergroup?
by Genis Pujol Hamelink 03 Sep '07

03 Sep '07

Hello, I've been browsing the wiki looking for information on how to set up different domains or authentication groups, but couldn't find how to link a nas to a usergroup (is community in the nas table equivalent to GroupName?)... What I want is to define several groups and that only users in a group can autenticate through a nas from that group. regards, Genís La información de este correo electrónico es confidencial, personal e intransferible y sólo está dirigida a la(s) dirección(es) indicada(s) arriba. Si usted lee este mensaje por equivocación, le informamos que está prohibida su divulgación, uso o distribución, completos o parciales; le rogamos que lo notifique inmediatamente al remitente y borre el mensaje original junto con sus ficheros anexos sin leerlo ni grabarlo. Gracias. La informació d'aquest correu electrònic és confidencial, personal i intransferible, i només està dirigida a l'adreça(ces) indicada(des). Si vostè llegeix aquest missatge per error, l'informem que n'està prohibida la propagació, l'ús o la distribució, complets o parcials; li demanem que ho notifiqui immediatament a la persona que li ha enviat i esborri el missatge original amb les dades adjuntes sense llegir-lo ni desar-lo. Gràcies. This e-mail contains confidential information. The information is intended for exclusive use by the abovementioned recipient. If you have received this e-mail in error, please notify us immediately to arrange for the confidential information to be returned to us. We hereby inform you that it is strictly prohibited to disclose, copy, distribute or take any action based on this information. Thank you.

2 1