April 2008 - Freeradius-Users - lists.freeradius.org

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

I'll try to test it using a longer password. doing the radtest my configuration works but when I try to login using the normal way, it is not authenticating. ----- Original Message ---- From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 3, 2008 13:17:36 Subject: Re: freeradius_2.0.3+mysql SANDY KALUGDAN wrote: > thanks for replying. > for testing purposes, i've use 's' as the password. > SQL password for user sandy is really 's' (a) you didn't type "s" as the user's password on the client (b) the client is broken, and does not do CHAP properly (c) the code in FreeRADIUS is broken, and does not do CHAP properly. There are few other options. Perhaps try a longer password. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

Freeradius, EAP-PEAP, LDAP and users file...
by Marco Gaiarin 03 Apr '08

03 Apr '08

[i'm not subscribed to this list, so, please, put me on CC] I've just setup a 'test installation' of freeradius in a debian etch box (using freeradius with 1.1.3 recompiled by me to support EAP-TLS). In my environments there's ever a LDAP server that serve, among other thinks, also a samba3 server using standard stuff (smbldap-tools, ...). Clearly my users are mostly (ahem, totally ;( ) windows XPsp2. Firstly i've setup all the stuff using winbind/ntlm_auth to do the MS-CHAP auth, but because i know that in LDAP the NT-Password hare simply stored, and looking at the (deprecated) /etc/smbpasswd module with the aid of some google, i've finally reached a good (for me) working point: ldap module extract NT-Password and give it to mschap module for authentication, with the bonus of group filtering, all in LDAP (i've disabled 'unix')... The strange, the only strangeness i've found, are that i was forced to insert an explicitly 'deny' rule in users file, eg my users are: DEFAULT Service-Type == Framed-User, Ldap-Group == "ced" DEFAULT Service-Type == Framed-User, Ldap-Group == "diramm" DEFAULT Service-Type == Framed-User, Ldap-Group == "ricerca" DEFAULT Service-Type == Framed-User, Ldap-Group == "*", Auth-Type := Reject Reply-Message = "Gruppo non autorizzato" if i remove the last entry, user got authenticated. But users file was 'no match, no party'? What i'm missing? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)sv.lnf.it tel +39-0434-842711 fax +39-0434-842797

4 7

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

thanks for replying. for testing purposes, i've use 's' as the password. SQL password for user sandy is really 's' SANDY KALUGDAN wrote: > rlm_chap: Using clear text password s for user sandy authentication. > rlm_chap: Pasword check failed There really isn't much else to say. Is the user's password really one-letter "s" ? If not, what *is* the password, and why is the SQL server only returning "s"? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

here is a portion of the radiusd -X output rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_chap: login attempt by "sandy" with CHAP password rlm_chap: Using clear text password s for user sandy authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 1 modcall: group Auth-Type returns reject for request 1 auth: Failed to validate the user. ----- Original Message ---- From: "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Thursday, April 3, 2008 12:00:20 Subject: Re: freeradius_2.0.3+mysql Hi, > I'm new in using the marvelous work but I can't seem to authenticate properly using my current conf files. I've done my home work by reading all the howtos + wiki I can but still I'm stuck with authenticating my users. > Expert comments will be highly appreciated. please send radiusd -X , not your config! alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

I'm new in using the marvelous work but I can't seem to authenticate properly using my current conf files. I've done my home work by reading all the howtos + wiki I can but still I'm stuck with authenticating my users. Expert comments will be highly appreciated. /etc/raddb/radiusd.conf instantiate { exec expr } authorize { preprocess chap mschap suffix sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } } preacct { preprocess acct_unique suffix files } accounting { detail unix sql radutmp } session { radutmp } post-auth { } pre-proxy { } /etc/raddb/clients.conf client 127.0.0.1 { secret = testing123 shortname = localhost } client 192.168.182.1/24 { secret = testing123 shortname = private-network-1 } /etc/raddb/proxy.conf proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = yes } realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL secret = testing123 } realm NULL { type = radius authhost = LOCAL accthost = LOCAL secret = testing123 } Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: freeradius_2.0.3+mysql
by SANDY KALUGDAN 03 Apr '08

03 Apr '08

here is a portion of the radiusd -X output rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_chap: login attempt by "sandy" with CHAP password rlm_chap: Using clear text password s for user sandy authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 1 modcall: group Auth-Type returns reject for request 1 auth: Failed to validate the user. Send instant messages to your online friends http://uk.messenger.yahoo.com

1 0

radius server cannot handle external request
by xia sihua 03 Apr '08

03 Apr '08

Hi, I have installed the latest freeradius server (version: 2.0.3) on my Fedora Core 5 i386 PC. Now it can work ok when I use "radtest test test localhost 0 testing123" to test local user from local. And under debug mode "radiusd -X" the server can print out relevant handle info. However, Configure another machine as a RADIUS client and send out request, and the server is silent, and stop "Ready to process requests.". That means the server cannot handle external radius request. The start info as follows: [root@localhost raddb]# radiusd -X FreeRADIUS Version 2.0.3, for host i686-redhat-linux-gnu, built on Mar 28 2008 at 18:56:20 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default.old including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 172.28.99.51 { require_message_authenticator = no secret = "test" shortname = "172.28.99.51" } client 172.28.137.233 { require_message_authenticator = no secret = "tellabs" shortname = "172.28.137.233" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "tls" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/FreeradiusRsaPrivkey.pem" certificate_file = "/etc/raddb/certs/FreeradiusSignedCert.pem" CA_file = "/etc/raddb/certs/SpirentSignedCert.pem" private_key_password = "radius" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random.txt" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on proxy address * port 1814 Ready to process requests. I have added the user lametest into users file. clients.conf also add client machine IP address (172.28.99.51) and secret. BTW, I send out request radisu packets using default UDP destination port 1812 (same as server authentication listen port). I use Wireshark and can capture the radius request packet. And it is right request, but server cannot handle it and print anything on termination. I'm confused. Could you give me some suggestion. -- Best regards！ walter *************************************** Nothing is impossible! ***************************************

3 2

Mapping ldap attribute with radius attribute...howto?
by Eric Martell 02 Apr '08

02 Apr '08

Hi, I mapped my ldap attribute in the ldap.attrmap file as replyItem rCidx roleid And in the dictionary file I mapped it as ATTRIBUTE rCidx 3000 string I am using NTRadPing to test the authorization. I see in the log, radius attribute is mapped to ldap attribute and returning valid value rlm_ldap: LDAP attribute roleid as RADIUS attribute rCidx = "111111" but I did not see it in the Sending Access-Accept reply to NAS. I read rlm_ldap doc but not quite sure how to configure this. Please help. Thanks and Regards. rad_recv: Access-Request packet from host 216.2.193.1 port 42523, id=2, length=34 User-Name = "0014F846C199" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "0014F846C199", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for 0014F846C199 expand: %{Stripped-User-Name} -> expand: %{User-Name} -> 0014F846C199 expand: (&(did=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(did=0014F846C199)) expand: ou=roles,o=entitlement -> ou=roles,o=entitlement rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap://e.net:1389, authentication 0 rlm_ldap: bind as uid=appuser,ou=appadm,o=entitlement/**** to ldap://e.net:1389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=roles,o=entitlement, with filter (&(did=0014F846C199)) rlm_ldap: looking for check items in directory... rlm_ldap: LDAP attribute radiusAuthType as RADIUS attribute Auth-Type == Accept rlm_ldap: looking for reply items in directory... rlm_ldap: LDAP attribute roleid as RADIUS attribute rCidx = "111111" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user 0014F846C199 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Login OK: [0014F846C199/<via Auth-Type = Accept>] (from client samir port 0) Sending Access-Accept of id 2 to 216.2.193.1 port 42523 Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 4.0 seconds. Cleaning up request 0 ID 2 with timestamp +3 Ready to process requests. --------------------------------- You rock. That's why Blockbuster's offering you one month of Blockbuster Total Access, No Cost.

2 6

Hints & Huntgroups
by Dean Smith 02 Apr '08

02 Apr '08

Should I be able to either.... 1) Set a Huntgroup via the huntgroups file (matching on NAS-IP-Address) and use that in the Hints file as a match (Huntgroup-Name == "blah") or 2) Set a Hint in the hints file and use that to define as the match for the Huntgroup Currently testing on FreeRADIUS Version 1.1.0 and the files seem to be parsed independently so attributes modified/added in one aren't visible in the other ? Essentially I'd like to set both a huntgroup and perform some username substitution in hints on queries from the same set of NAS. I can define the full set of NAS in both files of course but was hoping to only define the list of NAS-IP-Address once. Ideally set the Huntgroup first and then use the Huntgroup-Name in the Hints file. Thanks Dean Smith

2 1

Re: Users cant connect Freeradius 2.0.2
by Gustavo Chavelas 02 Apr '08

02 Apr '08

Hi Alan. My old version is 1.1.3-1.2 and it's installed in other server. I think that 2.0.2 version is the newest but i have try to install 2.0.3 I don't use the same config files, i was to configure all files again. Regards. Message: 8 Date: Wed, 2 Apr 2008 19:05:47 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Users cant connect Freeradius 2.0.2 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20080402180547.GB2566(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Firstly, i have to install a new server and my freeradius 2.0.2 it's running > now. > Bur I have a new problem. > > With last version, my freeradius work fine, but with this new version, the > users can't connect. > > I'm attaching the raddiusd -X so, you've just installed 2.0.2 (why not 2.0.3???) - and your old version was working. what was your old version? did you just use the same config files? alan ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 36, Issue 15 ************************************************

2 1