January 2008 - Freeradius-Users - lists.freeradius.org

duplicate ip address ippool problem
by as3ad jamous 26 Jan '08

26 Jan '08

freeradius assign duplicate ip address , i using ippool module and file, for example user1 get the IP1 and some times (not always ) user2 get the same IP1 so LNS see duplicate ip address and drop the new user (no high load at radius but some times on database may be some load ),i dont know why freeradius retrun the used ip ,may it not sotre it at the ippool files : session-db and ip-index ? but whyfrom the side of the LNS i can see the authentication and accounting is okand acknowledged about authentication and accountingif there problem from side of database , the ippool store the datat at local files at radius server and there is no problem of high cpu load or system load on it , I would be grateful if you can assist me in identifying why this happens, and how I can rectify this problemthank you in advance. i look forward to your reply. _________________________________________________________________ Helping your favorite cause is as easy as instant messaging. You IM, we give. http://im.live.com/Messenger/IM/Home/?source=text_hotmail_join

1 0

certificates in FR 2.0.1 on windows doesnt works
by orion 26 Jan '08

26 Jan '08

hi to all. created the certificates with the default config files in FR 2.0.1 with ./bootstrap created the client certificate with make client the import of the ca.pem and server.crt in winxp is OK. they link with each-other ok ( ca->server ) the import of client.p12 is ok but it doesnt have a valid link it is ca->server->client and the details of the server certificate tells that "is not authorized to issue certificates" . the client certificates tells that is issued by the server not by the ca. the question is : the client certificate should be issued by the server or by the ca? if its to be issued by the ca then the Makefile in cert dirs have to be modified. in fact after modified the Makefile and client.cnf and re-importing them in xp then the linkage is ok. ( ca->client ) is this a prob ? or what ?

4 10

Hello, and a (hopefully) simple question
by Vlad Sedov 25 Jan '08

25 Jan '08

Hey folks. Right now, we use freeradius to authenticate simple pap/chap PPP clients. When a username/password is rejected, radius simply send back a reject message to the NAS. Is it possible to change this behavior so that a failed auth attempt gets accepted with an alternate IP pool instead of being rejected? the idea is to force suspended users through a web proxy that tells them that they have a billing issue, instead of rejecting their connection altogether. Any help would be appreciated.... Vlad

7 11

simple Ldap-group search
by cxu 25 Jan '08

25 Jan '08

Background: When a user associated with the ssid Guest, the user will authenticate against a FreeRadius server. If he has a university account, the FreeRadius server will authenticate him via LDAP. If he does not have a university account, the FreeRadius server will do the authentication with a guest account database. Goal: To reduce the chance to do the LDAP search, the LDAP-group search is successful if the user is in the LDAP and no matter which LDAP group he is in. My shot and the problem: I am trying to do a wildcard search in LDAP-Group search, but it looks like the wildcard could not work. Related entries in the file users, <omitted> DEFAULT Called-Station-Id =~ ".*Guest", myldap-Ldap-Group == "*", Autz-Type := Ldap1, Auth-Type := Ldap1 DEFAULT Called-Station-Id =~ ".*Guest", Group == "guest", Autz-Type := Web, Auth-Type := System <omitted> Debug output, <output omitted> rlm_ldap: performing search in ou=people,dc=myuniv,dc=ca, with filter (&(cn=*)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUnique Names)(uniquemember=)))) <output omitted> rlm_ldap::groupcmp: Group * not found or user not a member rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [cxu] (from client localhost port 0) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Questions: 1. Is there any way to make the wildcard LDAP-group search work? 2. Whether unlang could be applied here and how? 3. Any advice? Thanks! Andrew

2 1

SSH-login authentication, using Active Directory credentials.
by suraj shankar 25 Jan '08

25 Jan '08

Hi; For a long time now, I have been trying to unify the login credentials, in a heterogeneous environment. While I am aware of the few available options, I have decided against them, for varied reasons. In the last few days, I have been able to produce the effect which I desired, using pam_radius_auth and IAS. All is well, and I am able to SSH-login using my Active directory login credentials. But before I take this to production, I would like to know if this approach is safe - the IAS setting that works says "Unencrypted authentication (PAP)". >From here http://lists.cistron.nl/pipermail/freeradius-users/2006-July/055010.html, I understand that pam_radius_auth 'encrypts' the password. But if a user has the privileges to change the /etc/raddb/server file (and point it to a freeradius server), wouldn't he/she be able to siphon off the credentials? Our setup would disallow direct 'root' logins, over SSH. However, once the user logs in using his/her credentials, they would then be allowed to do a sudo or a privileges escalation. Thereby, opening the possibility of a /etc/raddb/server edit. I know worse things can happen with superuser privileges; however, I am not worried of the bad that can happen to the client machines. Is there a better way, using radius? Please suggest. If this query is a rerun, pointers/references would do. Thank you. Regards, suraj. ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

4 5

eap and users file
by theSnail 25 Jan '08

25 Jan '08

I have only this entry in users file: DEFAULT Auth-Type := Accept raiudsd -X users: Matched entry DEFAULT at line 1 but it still try to authenticate against ldap. So the question is: users file and EAP-ttls + PAP schema can work togher? thanks -- View this message in context: http://www.nabble.com/eap-and-users-file-tp15086647p15086647.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

IP Pool defined, but radius does not hand out an IP address.
by Andrew D Kirch 25 Jan '08

25 Jan '08

When I connect a client to freeradius the client authenticates, gets an accept/accept, but does not get an IP address. I've tried it with the Group and Pool-Name directives in each client's block, and I've tried it with them in a DEFAULT by themselves. Neither has handed out an IP address. System vitals: radius:/etc/freeradius# uname -a Linux radius 2.6.18-5-686 #1 SMP Mon Dec 24 16:41:07 UTC 2007 i686 GNU/Linux radius:/etc/freeradius# cat /etc/debian_version 4.0 radius:/etc/freeradius# freeradius -v freeradius: FreeRADIUS Version 1.1.3, for host i486-pc-linux-gnu, built on Dec 16 2006 at 23:48:11 # radtest umcc xxxxxx localhost 0 xxxxxxx Sending Access-Request of id 144 to 127.0.0.1 port 1812 User-Name = "umcc" User-Password = "bts10200" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=144, length=44 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP radius.log: Thu Jan 24 11:20:51 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jan 24 11:20:51 2008 : Info: Ready to process requests. Thu Jan 24 11:32:33 2008 : Auth: Login OK: [umcc] (from client localhost-testing port 0) users: umcc User-Password == "xxxxxx" Service-Type = Framed-User, Framed-IP-Netmask = 255.255.255.255, Group == main_pool, Pool-Name := "main_pool", Framed-Protocol = PPP, Framed-Compression = Van-Jacobsen-TCP-IP radiusd.conf (pertinent sections) ippool main_pool { range-start = 208.64.35.2 range-stop = 208.64.35.254 netmask = 255.255.255.255 cache-size = 253 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = yes maximum-timeout = 0 } accounting { detail unix radutmp main_pool } post-auth { main_pool }

4 5

Novice user. Authenticate against Radius Server
by German Anguiano Bayardo 24 Jan '08

24 Jan '08

Hi guys. I'm a beginner with the Radius protocol. I've been using Linux for a while now, so I hope it doesn't take me too long to catch the idea. Sorry in advance if a make some stupid questions. Ok, here I go. I'm in a new job. My boss told me that they attempted to setup a Hotspot for free public access. But they want the users to register with us (this is a government office) for usage statistics, accounting, etc. They say the only missing part is a Radius Server where to authenticate the users. The steps are as follows: 1.- The user uses his laptop to access Internet, open the web browser and get a Welcome Page, where they have to login 2-. When they give user an password, the access point verifies it against a Radius Server, just for access statistics purposes. 3.- If it's a valid user, he/she can have access to Internet. Some sort of that is the idea. Nothing sophisticated, only that users must be registered. Can anyone point me to the right path ?? Thanks in advance... German Anguiano B. _________________________________________________________________ ¡Actúa tu película favorita y gana fabulosos premios! http://cine.prodigymsn.com/nanometraje

3 2

Blank spaces after username - problem with accounting - MySql database.
by Marinko Tarlac 24 Jan '08

24 Jan '08

Hi there... It is me again... Few days ago, I wrote about my problem with accounting. Problem is that accounting doesn't work for some users. In this case it is "test.user"... After some investigation with log files (holly radiusd -X), I can see that problem is in username. As you can see (line marked with *-*-*-*-*-*-*), some blank spaces were added to username. I'm not sure how is this possible and who adds this blank spaces (Mikrotik as nas or radius server?). Log file is truncated but I believe you can see where is the problem. ------------------------------------------------------------------------------------------------- LOG STARTS Finished request 13 Going to the next request Waking up in 5 seconds... rad_recv: Access-Request packet from host 192.168.15.2:48263, id=86, length=145 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 23427 NAS-Port-Type = Ethernet User-Name = "test.user " *-*-*-*-*-*-* (notice blank spaces before closing ") .... rlm_realm: No '@' in User-Name = "test.user ", looking up realm NULL *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") .... ... radius_xlat: 'test.user ' *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") rlm_sql (sql): sql_set_user escaped user --> 'test.user ' *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'test.user ' ORDER BY id' *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") ..... rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 14 rlm_chap: login attempt by "test.user " with CHAP password *-*-*-*-*-*-* (NOTICE BLANK SPACE BEFORE CLOSING ") rlm_chap: Using clear text password "testpassword" for user test.user authentication. rlm_chap: chap user test.user authenticated succesfully *-*-*-*-*-*-* (user with blank spaces doesn't exist anywhere and especially not in radcheck table and authentication was successful ????) modcall[authenticate]: module "chap" returns ok for request 14 modcall: leaving group CHAP (returns ok) for request 14 .............. radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('814054d0', '8ff2e3a7022d4a99', 'test.user ', '', '192.168.15.2', '23427', 'Ethernet', '2008-01-21 23:41:06', '0', '0', 'RADIUS', '', '', '0', '0', 'ht1', '00:19:66:11:59:F7', '', 'Framed-User', 'PPP', '192.168.15.212', '0', '0')' ------------------------------------------------------------------------------------------------- LOG ENDS p.s. As I can see in debug lines, raddacct table has been filled with wrong username so I searched for username "test.user " and I can see his traffic. I can solve this problem with small scheduler script who will replace "test.user " with "test.user" but who knows... Maybe tomorrow I will have more spaces and other signs in username ??? One is sure. MySql seems fine and only solution I can do now is to make querry "UPDATE radacct SET UserName='test.user' WHERE UserName='test.user '"; FR is 1.1.4 and I will update it and see what's going on...

5 14

how to enable ldap during authentication
by Tomasz Zieleniewski 24 Jan '08

24 Jan '08

Hi, I am using version 2.0.2-pre I would like to use ldap for freeradius authentication. I couldn't find anything on web about this topic. I have ldap module in the authorize section in my default virtual server. I see in the debug that ldap module returns ok during authorization please point me what do I have to do to use ldap olso for authentication is it enough to put ldap invocation in authentication section? below debug from authorization thanks a lot for any help! regards -tomasz rlm_ldap: waiting for bind result ... request 1 done rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Touki,ou=People,dc=touk,dc=pl, with filter (mail=tzl(a)touk.pl) request 2 done rlm_ldap: Added User-Password = {MD5}SNNMxdM+Zfvr//0yEp0DuA== in check items rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute userPassword as RADIUS attribute Cleartext-Password == "{MD5}SNNMxdM+Zfvr//0yEp0DuA==" rlm_ldap: looking for reply items in directory... rlm_ldap: user tzl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok

4 6