November 2008 - Freeradius-Users - lists.freeradius.org

HELP: Windows IAS / FreeRADIUS Proxy problem
by clive gould 23 Nov '08

23 Nov '08

Can anybody help please? We use a FreeRADIUS proxy for authenticating DSpace with MS AD via MS IAS Our ITNS team have just rebuilt the IAS server after it suffered a hardware failure failed and since the rebuild it is now rejecting FreeRADIUS proxy requests. IAS will still respond to my Moodle PHP RADIUS authentication module, but since the rebuild is rejecting authentication requests from the FreeRADIUS proxy (yes the new shared secret is correct and I'm logging on with the same id to both systems :) I'm using MSCHAP for authentication with FreeRADIUS. I am wondering if the problem could be to do with http://technet.microsoft.com/en-us/library/cc786978.aspx#BKMK_5 ? Comments/suggestions very gratefully received :))) Thanks Clive

2 1

rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf
by hsuan 23 Nov '08

23 Nov '08

Hi all : I have install freeradius-server-2.1.1 and I want use LDAP to do authentication. But when I using "radius -X" to start the radius server ,and in the client I using "radtest ldapuser ldapuser radius_server_ip 0 secret" , The server shown the message : rad_recv: Access-Request packet from host radius_client_ip port 35833, id=168, length=60 User-Name = "ldapuser" User-Password = "ldapuser" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "ldapuser", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[unix] returns updated [sql] expand: %{User-Name} -> ldapuser [sql] sql_set_user escaped user --> 'ldapuser' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ldapuser' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ldapuser' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User ldapuser not found ++[sql] returns notfound [ldap] performing user authorization for ldapuser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=ldapuser) [ldap] expand: o=My Org,c=UA -> o=My Org,c=UA rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=Manager,o=My Org,c=UA/hsuan to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Invalid user: [ldapuser/ldapuser] (from client my_radius_client_pc port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ldapuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 168 to radius_server_ip port 35833 Waking up in 4.9 seconds. Cleaning up request 2 ID 168 with timestamp +1020 The error looks like "rlm_ldap: LDAP login failed: check identity, password settings in ldap section of radiusd.conf rlm_ldap: (re)connection attempt failed , what's the problem ?? " Regards, Vicky

2 7

Re: Problem in setting up radius database in sql
by Alexandre Chapellon 22 Nov '08

22 Nov '08

your freeradius seems to be compiled/installed without the mysql extensions rlm_sql_mysql

5 8

rlm_chap: Password check failed
by Marwan Sultan 21 Nov '08

21 Nov '08

Hello All, I'm installing a new FreeBSD server. MySql4.1 php5, Chillispot All working fine. I have installed freeradius-1.1.7_2 when I authinticate throu chillispot it always fails with follow rlm_chap: Setting 'Auth-Type := CHAP'rlm_sql (sql): Reserving sql socket id: 4rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "manager" with CHAP password rlm_chap: Using clear text password "emanager09" for user manager authentication. rlm_chap: Password check failedrad_recv: Access-Request packet from host 127.0.0.1:61467, id=0, length=217Sending Access-Reject of id 0 to 127.0.0.1 port 61467 When password..Ofcourse is correct. Please note i have copied radiusd.conf clients.conf and sql.conf from a diffrent server which is working perfectly. into this new server "identical servers" but its not working anymore.. when I use ntradping for test use..password works fine I have tried to search FAQ i couldnot find it..sorry. Im sure its a small tweak somewhere..PLEASE advise where is excatly as i need this server to be uptonight :( What makes me wonder...the same configuration works on diffrent server and here doesnot ..but its same files.. THANK YOU M. SUltan. _________________________________________________________________ Access your email online and on the go with Windows Live Hotmail. http://windowslive.com/Explore/Hotmail?ocid=TXT_TAGLM_WL_hotmail_acq_access…

1 0

ldap backend and Realm
by Mustapha Bouikhif 21 Nov '08

21 Nov '08

Hi folk, I have Freeradius 2.1.1 and openldap 2.3.27-8 installed in 2 diff servers. My radius server is used to authenticate users from differents relams (lets say 8) against one ldap server. My ldap server has 8 different basedn which holds users from the realms. I want to use unlang to configure radiusd to use a specific ldap module configuration based on the realm of the user connected to the wireless network. Can I use unlang with (switch %{Realm}statement) to do so ? Thanks for any clues and help. -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

6 19

New entry for Interim packet
by Tony Spencer 20 Nov '08

20 Nov '08

Hello Our setup is as follows: Centos 5.2 FreeRADIUS Version 2.0.2 MySQL Version: 4.1.20 We are using FreeRadius for our ADSL users and its working fine. Except when it comes to working out the usage stats for each user at the end of each month. Its easy to do with all sessions that started in the previous month and have a Stop status. But it's difficult when a session rolled over to the next month because the status is Alive. We're trying to find a why to make FreeRadius: Enter a new entry into the Radacct table for a session for an Interim update Mark the previous session with a stop Status and update the OctetsIn and OctetsOut for that session with the current value. Set the new session OctetsIn and OctetsOut at zero until the next update and then it starts from the beginning again. However we can't find a way of making FreeRadius: Run 2 sql statements in the same update. Set the new session counter to zero and not roll over the next updates Octets. We have found the following site: http://www.netexpertise.eu/en/freeradius/daily-accounting.html with a way of doing this within MySQL with procedures, but apparently this only works with MySQL 5. Having installed MySQL 5 on a test server and importing our Radius database we tried running the first procedure but get an error: ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'DECLARE COUNTER_LIMIT BIGINT(12)' at line 1 mysql> SET COUNTER_LIMIT = POW(2,32); ERROR 1193 (HY000): Unknown system variable 'COUNTER_LIMIT Has anyone any ideas on how to do what we require or has anyone had any luck with the instructions on the URL? Thanks in advance. Tony

5 9

oracle stored procédure
by Alexandre Chapellon 20 Nov '08

20 Nov '08

I'm still trying to setup freeradius authentication with oracle stored procedure. I have a procedure that return data as i expected it to be returned in an sqlplus client: SQL> SELECT hss_radcheck_func('khoa@mana','bas3_SE') FROM DUAL; HSS_RADCHECK_FUNC('K -------------------- CURSOR STATEMENT : 1 CURSOR STATEMENT : 1 ID USERNAME ATTRIBUTES VALUE OP ---------- -------------------------------- ------------------ -------------------------------- -- 1 khoa@mana Cleartest-Password mudafuka == 2 khoa@mana Simultaneous_Use 1 := Unfortunatly, when freeradius calls the procedure, it gives me an error saying: rlm_sql_oracle: fetch failed in sql_fetch_row: ORA-00932: inconsistent datatypes: expected CHAR got DTYCWD What is weird is that we force the procedure to return data as CHAR (except for ID which is a NUMBER): here is the nd of the procedure... OPEN resultSet FOR SELECT to_number('1') as ID, to_char(name) as username, to_char('Cleartest-Password') as attributes, to_char(password) as value, to_char('==') as operator FROM dual union SELECT to_number('2') as ID, to_char(name) as username, to_char('Simultaneous_Use') as attributes, to_char(loginlimit) as value, to_char(':=') as operator FROM dual return resultSet; I know this is very Oracle related but I am totally stuck now wth this problem, and so trying to find help, where i can... Someone who already setup oracle auth may help.... thx

2 1

/etc/shadow
by Norman Zhang 20 Nov '08

20 Nov '08

My current radius installation permits radius daemon read-only access to /etc/shadow. But this introduces security risks. -rw-r--r-- 1 root root 6514 Nov 18 16:52 /etc/shadow I have been told to consider MySQL back-end. Is there a way to pull the existing local users/passwords in MySQL? Or I have recreate every user plus password in MySQL? Norman

2 3

How possible is this???
by Martin MacLeod-Brown 20 Nov '08

20 Nov '08

After playing around with Freeradius and LDAP integration we have decided to try and simplify things to avoid the 'big bang approach' as we are not confident enough to go the whole way. My current thinking for our wired network is to add the MAC-addresses of all our desktop machines (2500 PC/laptops) into LDAP with the MAC-address being both the user name and password. We would then try FreeRadius and MAC-Authentication - how feasible is this and are there any gotcha's? I am going to start googling the best way to this, although most of the links seem to relate to wireless rather than wired setups. Can someone help by typing a simple list of the steps I need to follow so I can google and hopefully work out how to do this? Im thinking Import the Mac addresses into LDAP List the IP of all our edge switches in clients.conf Configure the shared secret Configure radiusd.conf to talk to the LDAP server - partially done Set up switches to query the radius server Are there any good how-to's on radius and mac-auth? We are looking to keep things as simple as possible so we can get used to using radius, before thinking about deploying 802.1x and I am desperate to avoid having to use IAS Many thanks Martin Martin Macleod-Brown | Infrastructure Engineer - Networks & Security Direct line +44 (0)20 7000 7772 | Email mmacleod(a)london.edu www.london.edu ______________________________________________________________________ This email has been scanned by the MessageLabs Email Security System on behalf of the London Business School community. For more information please visit http://www.messagelabs.com/email ______________________________________________________________________

3 2

Setting VLAN based on Certificate Issuer
by Edgar Fuß 20 Nov '08

20 Nov '08

I thought this was a FAQ but apparently it isn't. I have an 1.1.7 FreeRADIUS server up and running with EAP/TLS. Now, I would like to put clients into different VLANs based on who signed their certificate. Is there a way to set the Tunnel-Private-Group-Id attribute based on the certificate issuer? Is the Rlm_eap module able to export any information on the certificate chain? Switching to 2.1.1 wouldn't be a problem for me I suppose. Thanks for any help.

2 1