January 2008 - Freeradius-Users - lists.freeradius.org

Can use "auth" with radclient but not "status"
by Stephane Bortzmeyer 06 Feb '08

06 Feb '08

I believe that my Free Radius server is working, since I can query it successfully with "auth": % echo "User-Name = bortzmeyer\nUser-Password = foobar" | radclient jezabel auth mysharedsecret Received response ID 187, code 2, length = 44 Service-Type = Framed-User ... % echo "User-Name = bortzmeyer\nUser-Password = wrong" | radclient jezabel auth mysharedsecret Received response ID 189, code 3, length = 20 But "status" always fail: % echo "NAS-port = 1" | radclient jezabel status mysharedsecret radclient: no response from server for ID 198 (Same thing with 12 instead of status) On the server, running with -X, I just get: WARNING: Insecure packet from host 10.1.82.1: Packet does not contain required Message-Authenticator attribute Free Radius 1.1.7, Debian "lenny" OS

2 3

Error on radius
by Ackbar Joolia 05 Feb '08

05 Feb '08

Hi, I am getting this error in my radius log, do you know why this is so and how to get this resolved? 'The maximum number of threads (32) are active, cannot spawn new thread to handle request' Also, do people know what is the maximum simultaneous incoming authentication calls that the radius process can handle? Or what ways can be adopted to deal with this? Thanks Ackbar No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

7 17

UserName, Password + MAC authentication using Cisco's BBSM 5.3
by javkhlanbaatar＠newcomsystems.mn 04 Feb '08

04 Feb '08

Hello, I'm using Freeradius 1.1.17 version with Cisco's BBSM. With MySqL database too. I've storing username, passwords in mysql db. For now, authentication is OK. I want to check MAC address of users while they are authenticating. Inmy radcheck table: | id | UserName | Attribute | op | Value | +----+-------------+--------------------+----+-------------------+ | 3 | java | Password | == | password | | 18 | java | Calling-Station-Id | == | aa-bb-cc-dd-ee-ff | Also, BBSM's snmp is enabled. So I can get users' MAC addresses. I want Radius server checks username, password and MAC addresses at the same time when the user authenticate. Without Calling-Station-Id, authentication is OK. When I add Calling-Station-Id, the user cannot authenticate. In which table, do I enter this attribute? Also i cannot close or deactivate user session when I want to. When i removing from BBSM Mysql db, session is still open. Or can I put expiration time at every 03 o'clock? Could someone help me abt these?

6 10

Sql_log against postgresql
by Roy Walker 03 Feb '08

03 Feb '08

Have 2.0 running against a Postgresql database. The sql_log code looks like it functions differently than the sql statements in the postgres driver (stop packets are another insert instead of an update). Has anyone already changed out the sql lines match the way it works without sql_log, don't see why it would be an issue... if you have would you mind sharing it? PS Nice to see the column names were corrected in 2.0 (between MySql and Postgresql schemas). Thanks, Roy

2 1

pap "Cleartext-Password", sql etc...
by Andrew Long 01 Feb '08

01 Feb '08

When I have (radcheck) attribute `User-Password', authentication succeeds but we see the following: rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "elmaroma_cn3000" with CHAP password rlm_chap: Using clear text password "aromaescape" for user elmaroma_cn3000 authentication. rlm_chap: chap user elmaroma_cn3000 authenticated succesfully ++[chap] returns ok If I change the attribute to `Cleartext-Password', authentication fails and I see: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type CHAP auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "elmaroma_cn3000" with CHAP password rlm_chap: Cleartext-Password is required for authentication ++[chap] returns invalid auth: Failed to validate the user. Login incorrect (rlm_chap: Clear text password not available): [elmaroma_cn3000/<CHAP-Password>] (from client cn3000_aroma port 0 cli 00-02-6F-xx-xx-92) The "users" file ---------------------- DEFAULT Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP --------------------- authorize { preprocess chap mschap suffix unix files sql expiration logintime noresetcounter dailycounter monthlycounter daypasscounter pap} authenticate { pap chap mschap} Thanks muchly, Andrew Long EWS

3 9

deactivate ldap.attrmap
by Sebastian Heil 01 Feb '08

01 Feb '08

Hello, we are using freeradius 2.0.1 on SLES 10. Our users are authorized and authenticated via ldap against a Novell eDirectory. When i look at a trace on the eDirectory, i see a lot of attributes, the Freeradius-Server wants to get from the directory. But we don't have any of these attributes in the directory, and we don't need them. So, i tried to comment out the line #dictionary_mapping = ${confdir}/ldap.attrmap in the radiusd.conf, but the server still wants to get the attributes from the directory. So, i commented out all the lines in the file ldap.attrmap, which doesn't work... The server still wants to have a least one active line in the file. ----------- rlm_ldap: dictionary mappings file /etc/raddb/ldap.attrmap did not contain any mappings /etc/raddb/radiusd.conf[637]: Instantiation failed for module "ldap" ----------- Is there a way to deactivate the ldap.attrmap file? Thanks a lot! Sebastian -- GMX FreeMail: 1 GB Postfach, 5 E-Mail-Adressen, 10 Free SMS. Alle Infos und kostenlose Anmeldung: http://www.gmx.net/de/go/freemail

5 13

Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy (forward) request as PAP
by Joakim Lindgren 31 Jan '08

31 Jan '08

Hi all, thanks for your explanation earlier! I need your help with EAP-TTLS and PAP. I have earlier setup EAP-PEAP/EAP-TTLS and EAP-TLS working OK! I tried configuring the TTLS-PAP inner and outer tunnel but it will not work (and yes I have searched the forum, as always ;-) Here are my explanation of what I´m trying to do: A. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "OTHER" (LOCAL) domain then the EAP-TTLS tunnel is ended and validated against the LDAP. (And yes, I didn´t name the server ;-) B. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "SECURSERVER" domain then the EAP-TTLS tunnel is ended and PAP is proxied to other Radius (Nr 2). I have tried several different conf. and as best I see requests coming to Radius Nr2 but the´re encrypted (Wireshark). The config files looks like this (as for now, thanks in advance!): ================================================================================================ eap.conf ======== eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = password private_key_file = ${raddbdir}/certs/jaysCA2/osuse-freeradius/server_keycert.pem certificate_file = ${raddbdir}/certs/jaysCA2/osuse-freeradius/server_keycert.pem CA_file = ${raddbdir}/certs/jaysCA2/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } mschapv2 { } } ===END EAP====================================================================================== ================================================ users ======== DEFAULT FreeRADIUS-Proxied-To !* 127.0.0.1, Proxy-To-Realm := LOCAL DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := "SECURACCESS", Auth-Type := PAP DEFAULT Auth-Type != LDAP ================================================ ================================================ Proxy.conf ======== realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm SECURACCESS { type = radius authhost = 192.168.1.75:1812 accthost = 192.168.1.75:1813 secret = toor # nostrip } ================================================ ================================================================================================ radiusd.conf ======== ... modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { use_mppe = yes require_encryption = yes require_strong = yes } ldap { server = "192.168.1.71" identity = "cn=admin,o=Contonso" password = "toor" basedn = "o=Contonso" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = yes tls_mode = no tls_cacertfile = /etc/raddb/certs/eDirCerts/edirectory_ROOT_Cert_DER.pem dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = nspmPassword tls_require_cert = "allow" timeout = 4 timelimit = 3 net_timeout = 1 port = 389 edir_account_policy_check=yes } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } ... authorize { preprocess chap mschap suffix ntdomain eap files ldap pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } post-auth { ldap Post-Auth-Type REJECT { ldap } } ===END radiusd.conf================================================================================ ================================================ clients.conf ======== client 192.168.1.0/24 { secret = toor shortname = private-network-1 } ================================================

2 2

SQL / replacement of users file
by James Taylor 31 Jan '08

31 Jan '08

Hello list! I think I have an easy one here. I currently am administering several Radius sites for Dynamic VLAN access based on the user id's (HW Address) of workstations. I am wanting to make this process easier to handle and import this data into a SQL database so that I can manage my clients more effectively than using a text based file for the network access control. Is this possible? Can SQL store the appropriate RADIUS information (VLAN ID tags, MAC Address, and Identifiers) so that I don't need to use the USERS file any longer? Any pointers would be greatly appreciated! Thank you all! James

2 1

WPA and EAP-TTLS oddity
by William Bulley 31 Jan '08

31 Jan '08

I swear this has worked for me in the past! Scenario: +-----------------------------------+ | ThinkPad T42 with D-Link DWL-G660 | | (ath0) on FreeBSD 6.2-STABLE | | running wpa_supplicant 0.4.8 | +-----------------------------------+ ^ 802.1X | EAP-TTLS v +---------------------------------------+ | Cisco 1131AG 802.11a/b/g AP IOS 12.4 | +---------------------------------------+ ^ EAP-TTLS | RADIUS v +-----------------------------------+ | FreeRADIUS 1.1.7_2 on FreeBSD 7.0 | +-----------------------------------+ The configs are at the end of this message. It almost works, but the behaviour changes depending on the case (uppercase/lowercase) of the "phase2" value! In both cases below ("auth=PAP" and "auth=pap") the EAP-TTLS session has been established. In one case, I get an ERROR because "PAP" is unknown. In the other case ("pap"), FreeRADIUS cannot locate the cleartext password ("password"). What am I missing? Is this an issue with wpa_supplicant(8) itself? Has anyone gotten EAP-TTLS to work with simple PAP inside the tunnel? About two years ago, I had this working (using PAP inside the tunnel) but it was an early version of wpa_supplicant(8) and probably FreeBSD 4.x or early 5.x =*=*=*=*=*=*=*=*=*= wpa_supplicant.conf =*=*=*=*=*=*=*=*=*=*=*=*= ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 network={ ssid="testing" key_mgmt=WPA-EAP eap=TTLS anonymous_identity="anonymous" identity="foo" password="password" phase2="auth=PAP" } =*=*=*=*=*=*=*=*=*= FreeRADIUS eap.conf =*=*=*=*=*=*=*=*=*=*=*= eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = yes tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } } =*=*=*=*=*=*=*=*= simplified radiusd.conf =*=*=*=*=*=*=*=*=*=*= [snip] unimportant stuff omitted [/snip] $INCLUDE ${confdir}/clients.conf $INCLUDE ${confdir}/eap.conf instantiate { } authorize { preprocess auth_log eap files pap } authenticate { eap } preacct { preprocess acct_unique } accounting { detail } post-auth { reply_log } =*=*=*=*=*=*=*=*= debug output snippet with phase2="auth=PAP" =*=*=*=*=*=*=*=*=*= rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/radacct/127.0.0.1/auth-20080131' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-20080131 modcall[authorize]: module "auth_log" returns ok for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 users: Matched entry foo at line 217 modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "pap" returns updated for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type pap auth: type "PAP" ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. auth: Failed to validate the user. Trying to look up name of unknown client 127.0.0.1. Login incorrect: [foo/password] (from client UNKNOWN-CLIENT port 260 cli 00-xx-xx-xx-xx-xx) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. =*=*=*=*=*=*=*=*= debug output snippet with phase2="auth=pap" =*=*=*=*=*=*=*=*=*= rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. TTLS: Got tunneled identity of foo TTLS: Setting default EAP type for tunneled EAP session. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 radius_xlat: '/var/log/radacct/127.0.0.1/auth-20080131' rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-%Y%m%d expands to /var/log/radacct/127.0.0.1/auth-20080131 modcall[authorize]: module "auth_log" returns ok for request 5 rlm_eap: EAP packet type response id 6 length 8 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry foo at line 217 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: No such EAP type md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Trying to look up name of unknown client 127.0.0.1. Login incorrect: [foo/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 261 cli 00-xx-xx-xx-xx-xx) TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls TTLS: Freeing handler for user foo rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. =*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*= This one has me stumped. :-( Regards, web... -- William Bulley Email: web(a)umich.edu

3 2

Issue reading from detail to sql (buffered-sql virtual server)
by Nick Freeman 31 Jan '08

31 Jan '08

Hi, I'm trying to get my detail file picked up by multiple virtual servers and relayed to multiple PostgreSQL backends. The detail file writes fine, however the detail reader will only ever write one entry to the Postgres DB when it starts. The config I have for the virtual server in question is below: server local_logger { listen { type = detail filename = ${radacctdir}/detail load_factor = 20 } preacct { preprocess acct_unique files } accounting { sql_logger1 } } I have verified that sql_logger1 isn't the problem, if I put that after the detail directive in another virtual server data gets written to the database every time. It looks like my local_logger never picks anything up (except once on startup). Looking at server starting in debug mode I see this: listen { type = "detail" listen { filename = "/var/log/freeradius/radacct/detail" load_factor = 20 } } Is this normal? The listen directive is in the same format as the other virtual servers but this is the only one which has nested listens in the server startup. Thanks in advance, Nick

2 5