February 2008 - Freeradius-Users - lists.freeradius.org

Step 1: Configuring PAP fails with: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by Russell D. Mitchell 26 Feb '08

26 Feb '08

I've installed freeradius-server-2.0.2 onto a Fedora Core-5 machine, and tried to perform the first step as described in: http://deployingradius.com/documents/configuration/pap.html. Both radiusd and radtest were executed with root priviledges. The only change to config files was to add 'bob Cleartext-Password := "hello"' to /etc/raddb/users, to the top of the file. As you can see at the end of the radiusd output, the failure appears to be due to: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. But, I thought this was supposed to 'just work'. Here's the output from 'radtest bob hello localhost 0 testing123' Sending Access-Request of id 172 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=172, length=20 And here's the output from 'radisud -X': Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32775, id=172, length=55 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1:32775 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 47c459c7 Nothing to do. Sleeping until we see a request.

3 7

RE: PEAP LDAP password problem
by Alexey Eronko 26 Feb '08

26 Feb '08

I want to setup two WIFI networks: MAC Filter with EAP-PEAP. MAC Filter with WEP. Another very important question is : can I use MAC and EAP-PEAP simultaneously in one network. Alexey Eronko -----Original Message----- From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or g] On Behalf Of Alexey Eronko Sent: Tuesday, February 26, 2008 5:30 PM To: FreeRadius users mailing list Subject: RE: PEAP LDAP password problem Thank you for detailed explanation. I'll try to reenter all users password in NTpassword attribute. Could someone give me link to appoporate openldap guide. Where I can find howto do MAC filtering on Freeradius? Thank you -----Original Message----- From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or g] On Behalf Of Alan DeKok Sent: Tuesday, February 26, 2008 2:10 PM To: FreeRadius users mailing list Subject: Re: PEAP LDAP password problem Alexey Eronko wrote: > I have huge problem that I need to ask 200 users to reenter there passwords > in OpenLDAP. Then I guess you're not going to deploy PEAP. > Another problem is that I'm not sure that I can store two kind of password > simultaneously(nt and crypt). Yes, you can. They can go into two separate fields in LDAP. > Maybe someone know how to convert ldap passwords to nt hash? :) or I need to > reenter all passwords. You need to re-enter all of the passwords. OR convince the Windows users to install a supplicant such as SecureW2. > [AE:] The point is that my 200 users already have windows(active directory) > accounts and they know password. <sigh> If you had said this at the start, it would have simplified it a lot. Go read the Wiki for how to configure FreeRADIUS to authenticate PAP against AD. Or, see my web site. There are examples there, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: PEAP LDAP password problem
by Alan DeKok 26 Feb '08

26 Feb '08

Alexey Eronko wrote: > I have huge problem that I need to ask 200 users to reenter there passwords > in OpenLDAP. Then I guess you're not going to deploy PEAP. > Another problem is that I'm not sure that I can store two kind of password > simultaneously(nt and crypt). Yes, you can. They can go into two separate fields in LDAP. > Maybe someone know how to convert ldap passwords to nt hash? :) or I need to > reenter all passwords. You need to re-enter all of the passwords. OR convince the Windows users to install a supplicant such as SecureW2. > [AE:] The point is that my 200 users already have windows(active directory) > accounts and they know password. <sigh> If you had said this at the start, it would have simplified it a lot. Go read the Wiki for how to configure FreeRADIUS to authenticate PAP against AD. Or, see my web site. There are examples there, too. Alan DeKok.

2 1

Assignment for Attributes in external Scripts
by niall el-assaad 26 Feb '08

26 Feb '08

Hi, I am writing an external script to be run based upon an authentication. When the script returns output I am unsure as to what the assignment operators do, for example when should I use += vs := vs = If I look at the exec-program-wait sample script I see: echo "Reply-Message += \"Hello, %u\"," echo "Reply-Message += \"PATH=$PATH\"," echo Framed-IP-Address = 255.255.255.255 Is this documented anywhere? thanks, niall

4 5

Setting up a new database schema
by johnson elangbam 26 Feb '08

26 Feb '08

Hi, I am trying to make a new database schema in Ms Sql in order to read the user name and password only, how do I change the SQL queries in the coniguration files, i've change in the dialup.conf of mssql directory. Is there any configuration file to change so that it can be read only from my customize table.. Regards Elangbam Johnson

2 1

Re: PEAP LDAP password problem
by Alan DeKok 26 Feb '08

26 Feb '08

Alexey Eronko wrote: > Thanks for you replay. > > According with this link : > http://deployingradius.com/documents/protocols/compatibility.html. > > I need EAP-GTC. Huh? How did you conclude that? All you need to do is to put the NT hash into LDAP, as you said. You do NOT need to use EAP-GTC. > I'm not sure that my Proxim AP700 support this kind of EAP. Access points don't care about EAP methods. > Is this suitable method for WIFI network? > I still want to use user/password authentication for windows users thought > openLDAP(crypt) password. You don't. You put the NT hash into the OpenLDAP database. > How can I make sure that my Access Point can use EAP-GTC? Access points don't do EAP. Supplicants use EAP. > Or the only one way that I need is move to Windows Radius(IAS)? I have no idea why you think that will help. The web page I pointed you to says *nothing* about operating systems or RADIUS server implementations. If you have crypt'd passwords then you CANNOT do normal PEAP. Moving to Windows will make no difference. Alan DeKok.

2 1

Re: PEAP LDAP password problem
by Phil Mayers 26 Feb '08

26 Feb '08

Alexey Eronko wrote: > Thanks for you replay. > > According with this link : > http://deployingradius.com/documents/protocols/compatibility.html. > > I need EAP-GTC. I'm not sure that my Proxim AP700 support this kind of EAP. APs should not care. All EAP types (that generate crypto keys) should work > Is this suitable method for WIFI network? Yes, it generates crypto keys > I still want to use user/password authentication for windows users thought > openLDAP(crypt) password. Windows built-in supplicant does not support EAP-GTC. EAP-TTLS is also suitable for PAP, and the free SecureW2 supplicant can be installed. > > How can I make sure that my Access Point can use EAP-GTC? Test it. > > Or the only one way that I need is move to Windows Radius(IAS)? IAS cannot do PEAP/MS-CHAP against unix crypts either - it is impossible. However, if you have the option of using IAS you may have an NT/Active Directory domain. If so you can use samba + winbind + ntlm_auth + rlm_mschap

1 0

Re: rlm_ldap and large AD structure issue
by Capelle, Mark (PCMC-GB) 26 Feb '08

26 Feb '08

I have been using FR since around the .4 release days, so they will have to fight pretty hard to get me to dump it for ACS. :-) I looked into this but unfortunately messing with the AD schema attributes is usually frowned upon. Another FR user suggested I create multiple LDAP statements each pointing to a lower OU in the tree that is not so large. This seems like a logical idea except I can't seem to make it work right in 2.0.0. I know I have done this in a previous FR version, but I am stumped at this point. Here are the relevant portions - Radiusd.conf: modules { ldap a { ####### Active Directory LDAP Setup ####### server = *.*.*.1 #port = 3268 identity = "cn=***,ou=***,dc=***,dc=***" password = * basedn = "ou=a,dc=***,dc=***" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 10 timelimit = 10 net_timeout = 1 edir_account_policy_check = no } ldap b { ####### Active Directory LDAP Setup ####### server = *.*.*.1 #port = 3268 identity = "cn=***,ou=***,dc=***,dc=***" password = * basedn = "ou=b,dc=***,dc=***" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 10 timelimit = 10 net_timeout = 1 edir_account_policy_check = no } ldap c { ####### Active Directory LDAP Setup ####### server = *.*.*.1 #port = 3268 identity = "cn=***,ou=***,dc=***,dc=***" password = * basedn = "ou=c,dc=***,dc=***" filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 timeout = 10 timelimit = 10 net_timeout = 1 edir_account_policy_check = no } Sites-available/default: authorize { # The ldap module will set Auth-Type to LDAP if it has not # already been set #ldap a b c } authenticate { # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Auth-Type LDAP { a b c } The debug from radiusd -X: Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host *.*.*.* port 32856, id=154, length=60 User-Name = "testuser" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '\' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=testuser) expand: ou=a,dc=***,dc=*** -> ou=a,dc=***,dc=*** rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to *.*.*.*:389, authentication 0 rlm_ldap: bind as cn=***,ou=***,dc=***,dc=***/*** to *.*.*.*:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=a,dc=***,dc=***, with filter (sAMAccountName=testuser) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[a] returns notfound rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=testuser) expand: ou=b,dc=***,dc=*** -> ou=b,dc=***,dc=*** rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to *.*.*.*:389, authentication 0 rlm_ldap: bind as cn=***,ou=***,dc=***,dc=***/*** to *.*.*.*:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=b,dc=***,dc=***, with filter (sAMAccountName=testuser) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[b] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=testuser) expand: ou=c,dc=***,dc=*** -> ou=c,dc=***,dc=*** rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to *.*.*.*:389, authentication 0 rlm_ldap: bind as cn=***,ou=***,dc=***,dc=***/*** to *.*.*.*:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=c,dc=***,dc=***, with filter (sAMAccountName=testuser) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[c] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [testuser/testing] (from client PCMCRADIUS2 port 1) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 154 to *.*.*.* port 32856 Waking up in 4.9 seconds. Cleaning up request 0 ID 154 with timestamp +9 Ready to process requests. >Alan DeKok wrote: >Capelle, Mark (PCMC-GB) wrote: >> I have an issue since pointing FR to a point higher in my AD tree >> (which will return more objects). I get the following error in my FR >> logs when I try to authenticate a user: >> >> Fri Feb 22 10:37:14 2008 : Error: rlm_ldap: ldap_search() failed: >> Operations error > That's usually do to internal AD redirects, IIRC. > See also doc/rlm_ldap, which talks about "operations error". >> Has anyone else encountered this and found a solution? I am fighting >> like hell to not install the corporate standard Cisco ACS box at my >> site, but if I can?t manage to get this working I may have to finally >> cave L. > Ugh. Most sites I hear about are moving away from commercial products to FreeRADIUS. > Alan DeKok.

2 1

Re: PEAP LDAP password problem
by Alan DeKok 26 Feb '08

26 Feb '08

Alexey Eronko wrote: > Hi! > I have several services who use LDAP (openldap). For example Linux(via > pam),apache,svn. > On my ldap server passwords stored in encrypted hash. > Do I right understand you that I need add another field(nt hash) for radius > authorization? Yes: http://deployingradius.com/documents/protocols/compatibility.html > Another important question for my is : Does freeradius support MAC > filtering. I need this feature for my WIFI network. Yes. Alan DeKok.

2 1

rlm_dbm can not work?
by Hangjun He 26 Feb '08

26 Feb '08

Hi, I am using freeRADIUS 1.1.6. I can not let rlm_dbm work. Result of rlm_dbm_cat: [root@Jack-Linux raddb]# pwd /usr/local/etc/raddb [root@Jack-Linux raddb]# rlm_dbm_cat -f users.db "hhe4" Cleartext-Password := "hhe123" Reply-Message = "Hello" "hhe123" Cleartext-Password := "hhe123" Reply-Message = "Hello" [root@Jack-Linux raddb]# [root@Jack-Linux raddb]# ls users.* users.db.dir users.db.pag [root@Jack-Linux raddb]# Debug message: Module: Loaded dbm dbm: usersfile = "/usr/local/etc/raddb/users.db" Module: Instantiated dbm (dbm) Listening on authentication *:1812 Listening on accounting *:1813 ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1033, id=26, length=58 User-Name = "hhe123" User-Password = "hhe123" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_dbm: try open database file: /usr/local/etc/raddb/users.db rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add hhe123 to user list rlm_dbm: User <hhe123> not foud in database Remove hhe123 from user list sm_parse_user.c: check for loops Add DEFAULT to user list rlm_dbm: User <DEFAULT> not foud in database Remove DEFAULT from user list modcall[authorize]: module "dbm" returns notfound for request 0 modcall: leaving group authorize (returns noop) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Sending Access-Reject of id 26 to 127.0.0.1 port 1033 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 26 with timestamp 47c220be Nothing to do. Sleeping until we see a request. John. --------------------------------- 雅虎邮箱传递新年祝福，个性贺卡送亲朋！

2 3