May 2008 - Freeradius-Users - lists.freeradius.org

Manually Creating a RADIUS Accounting packet
by Etienne Pretorius 14 May '08

14 May '08

Hello List, I have FreeRadius accepting the packet and inserting all the values - except for NAS-Port-Id - into the accounting database. Could someone perhaps point out what attribute is missing.... for it to log the NAS-Port-Id. php code: pack("C",$code). //Packet Type Code (=Accounting-Request) pack("C",$identifier). //Packet identifier pack("CC",$length/256,$length%256). //Packet Length pack("a*",$request_authenticator). //Request Authenticator pack("CCCCCC",40,6,0,0,0,2). //Acct-Status-Type (=Stop) pack("CCCCCC",46,6,0,0,0,1). //Acct-Session-Time (=1) pack("CCa*",44,2+strlen($session),$session). //Acct-Session-Id pack("CCa*",1,2+strlen($username),$username). //User-Name pack("CCCCCC",4,6, $nas_ip[0],$nas_ip[1],$nas_ip[2],$nas_ip[3]). //NAS-IP-Address pack("CCa*",87,2+strlen($port),$port). //NAS-Port-Id pack("CCCCCC",61,6,0,0,0,5); //NAS-Port-Type (=Virtual) -- Kind Regards Etienne Pretorius

1 0

User-Password formats
by niall el-assaad 14 May '08

14 May '08

Hi, I have a setup with freeradius where it is launching an external script to authenticate users. When doing PAP authentication against the radius server I receive the %{User-Password} and pass it to my script. However when using a cisco wireless lan controller it seems not to pass User-Password as the text, it encodes it in another format. I'm wondering if anyone knows what format this is. >From a radiusd -X I get the following when it works rad_recv: Access-Request packet from host 10.10.76.3:32769, id=12, length=119 User-Name = "cisco(a)cisco.com" User-Password = "password" Service-Type = Login-User NAS-IP-Address = 10.10.76.2 NAS-Identifier = "Franciscan-2" Airespace-Wlan-Id = 1 Calling-Station-Id = "10.10.76.135" Called-Station-Id = "10.10.76.3" So it passes my script the password in plain text and when I use the Cisco WLC it fails and I get rad_recv: Access-Request packet from host 10.10.76.2:32769, id=12, length=119 User-Name = "cisco(a)cisco.com" User-Password = "]\313\347C\223\240\350\351\275!\307L\300\210" Service-Type = Login-User NAS-IP-Address = 10.10.76.2 NAS-Identifier = "Franciscan-2" Airespace-Wlan-Id = 1 Calling-Station-Id = "10.10.76.135" Called-Station-Id = "10.10.76.2" My script obviously gets passed "]\313\347C\223\240\350\351\275!\307L\300\210" Does anyone know what format this is? Or how I can convert it to get the password in plain text format? thanks, niall

3 10

RE:huntgroups are failing auth - missing Chap Password
by Terry Pelley 14 May '08

14 May '08

OK, I must be missing something here, likely due to my limited experience with FreeRADIUS. After re-reading the instructions in the users file the only thing I can see that is relevant when using huntgroups is an entry for a user that has no User-Password attribute assigned which I assume means that the default Auth-Type System will kick in and look the password up in an other file someplace. What I don't know is the location of this file and how to go about adding the password for my users. Is the use of a huntgroups file the best way for me to accomplish what I am trying to do? I want to limit user Bob so that he can only login from one specific access point. Thanks for the previous advice and in advance for any more. BTW: Sorry if this posting has broken the original thread. >Read instructions in users file about which password attribute should you >be using. User-Password is wrong for 1.1.7. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 14/9/2007, "Terry Pelley" <Terry.Pelley at ocdsb.ca> pie: > >FreeRADIUS Version 1.1.7 > >I am using the FreeRADIUS.net Windows version of the software. at least >for the time being. > >I am trying to set up a very basic single user account for a very specific >purpose and have created the account as follows. > >hunttest User-Password == "hunttest", Huntgroup-Name == "hunttest" > >My huntgroups file has a huntgroup called hunttest with a single NAS IP >Address listed as follows. > >public NAS-IP-Address == 10.252.9.2 > >when the user huntest attempts to authenticate it fails. My RADIUS Log >shows the following entry. > >Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text >password not available): [hunttest/<CHAP-Password>] (from client NAS04 >port 5 cli 00-1E-8C-0E-8E-70) >Wed May 7 15:07:25 2008 : Auth: Login incorrect (rlm_chap: Clear text >password not available): [hunttest/<CHAP-Password>] (from client NAS04 >port 5 cli 00-1E-8C-0E-8E-70) > >Can some one tell me what is wrong. I am simply trying to create a config >that will allow the user hunttest to authenticate only if the request >comes from the client NAS04. Perhaps a huntgroup is not the best way to do >this.

3 5

RADIUS Attribute: NAS-Port what is the true Length?
by Etienne Pretorius 14 May '08

14 May '08

Hello List, Probably not the right place to ask but I would like to know if someone could explain to me the following: According to RFC2138, the maximum range for the NAS-Port is 16 bits, so with the Type and Length fields to total length is 6 octets. But with FreeRadius's SQL Schema the NAS-PortId field is a varchar(15) and I see it being used. The dictionary.rfc2138 just states it is an integer so what is the maximum range on the NAS-Port field? If it has been changed, could someone point me to the correct RFC. -- Kind Regards Etienne Pretorius

1 1

Multiple ldap servers
by Jean Frontin 14 May '08

14 May '08

Hello, After several hours of research I don't understand howto configure FreeRadius to use two ldap servers. With only one ldap server all is OK ! I run FreeRadius 1.1.7 under Fedora core 8. Below I present you a radiusd.conf extract and a logof a session. In the og I put a start at the beginning of lines which I don't understand. Thanks you for your help ---- radiusd.conf extracts modules { ldap ldap1 { ... } ldap ldap2 { ... } ... } authorize { ... Autz-Type ldap_1 { ldap1 } Autz-Type ldap_2 { ldap2 } ... } authenticate { ... Auth-Type ldap_1 { ldap1 } Auth-Type ldap_2 { ldap2 } ... } ... ----------- log extracts rlm_ldap: Registering ldap_groupcmp for ldap1-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap1 * rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. ... rlm_ldap: Registering ldap_groupcmp for ldap2-Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap2 * rlm_ldap: Over-riding set_auth_type, as we're not listed in the "authenticate" section. ... modcall: leaving group authorize (returns ok) for request 0 * auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [myname/password] (from client XXX port 0) -- Jean Frontin System team I R I T Université Paul-Sabatier 118, rte de Narbonne 31062 Toulouse cedex 9 France tel (33)(0)5 61 55 63 03 mail frontin(a)irit.fr

2 1

Version 2 running on Red Hat 5
by Dubreuil, Gilles 14 May '08

14 May '08

All, Is someone being able to run version 2 on Red Hat 5.x? ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. ********************************************************************** _____________________________________________________________________ This e-mail has been scanned for viruses by MCI's Internet Managed Scanning Services - powered by MessageLabs. For further information visit http://www.mci.com

3 2

Re: Load testing tool recommendation
by Anders Holm 14 May '08

14 May '08

Hmm.. I *am* referencing the radius server with FQDN ... Lemme flip that switch and see what I get to play with ... Good catch .. It's letting me ship some more packets through per second.. no final figures yet, but starting to hit 5k pkts/sec, though the radius server is still not sweating nearly as much as I want it to (sitting between 12-15% CPU, and client system is maxing itself out trying to keep up, and the clients is a bigger machine than the server) ... //anders ----- Original Message ----- From: "A L M Buxey" <A.L.M.Buxey(a)lboro.ac.uk> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, May 13, 2008 2:55:56 PM GMT +00:00 GMT Britain, Ireland, Portugal Subject: Re: Load testing tool recommendation Hi, > Nope, no wireless involved. > > Good thought though! :) its not doing DNS lookups each time is it? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Re: A way to use LDAP only for authentication
by Alan DeKok 13 May '08

13 May '08

Konstantin KABASSANOV wrote: > Using PEAP/mschapv2 with openldap through freeradius, I'd like to know if > there is a way to allow all users in the authorize section of radiusd.conf > (without doing ldap requests) and make the ldap request only in the > authenticate section. It is useful for instance to avoid multiple ldap > requests during authorization process in particular when a number of > radius-request/challenges are exchanged between Access points and radius > server. In 2.0.4, you can run the LDAP module only for the inner tunneled request. See raddb/sites-enabled/inner-tunnel. Alan DeKok.

1 0

rpmbuild error freeradius-client-1.1.6.tar.bz2
by city perl 13 May '08

13 May '08

Hello Fedora core 5 rpm -Uvh freeradius-client-1.1.6-0.i386.rpm /var/tmp/rpm-tmp.72946: line 1: fg: no job control error: %post(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 rpm -e freeradius-client /var/tmp/rpm-tmp.45576: line 1: fg: no job control error: %postun(freeradius-client-1.1.6-0.i386) scriptlet failed, exit status 1 --------------------------------------------- radiusclient.spec 1.rename freeradius-client-snapshot freeradius-client 2.marking #%doc doc/* BUGS COPYRIGHT README README.radexample rpmbuild -bb radiusclient.spec --------------------------------------------- Summary: FreeRADIUS Client Software Name: freeradius-client Version: 1.1.6 Release: 0 Obsoletes: radiusc radiusclient radiusclient-ng Group: Productivity/Networking/Radius/Clients License: Artistic License Packager: Peter Nixon URL: http://www.freeradius.org/ Source0: %{name}-%{version}.tar.bz2 BuildRoot: %{_tmppath}/%{name}-%{version}-build Prefix: %{_prefix} Requires: %{name}-libs = %{version}-%{release} %description A portable, easy-to-use and standard compliant library suitable for developing free and commercial software that need support for a RADIUS protocol (RFCs 2128 and 2139). %package libs Summary: A portable, easy-to-use and standard compliant library for RADIUS protocol (RFCs 2128 and 2139). Group: Development/Libraries %description libs The package contains the shared library of FreeRADIUS Client %package devel Summary: Header files, libraries and development documentation for %{name}. Group: Development/Libraries Requires: %{name}-libs = %{version}-%{release} %description devel This package contains the header files, static libraries and development documentation for %{name}. You need to install %{name}-devel if you want to develop applications using %{name}. %if 0%{?suse_version} > 930 %debug_package %endif %prep %setup -q %build %define localstatedir /var/lib rm missing %if 0%{?suse_version} > 900 %{suse_update_config -f} %endif libtoolize --force aclocal automake -ac autoconf CFLAGS="$RPM_OPT_FLAGS -Wall" \ CXXFLAGS="$RPM_OPT_FLAGS -Wall -fmessage-length=0" \ %configure \ --localstatedir=%{localstatedir} \ --enable-shadow \ --with-secure-path make %install [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} make "DESTDIR=$RPM_BUILD_ROOT" install rm -f $RPM_BUILD_ROOT/%{_sbindir}/login.radius rm -f login.radius/Makefile* rm -f login.radius/migs/Makefile* rm -f %{buildroot}%{_libdir}/*.la %post %{run_ldconfig} %postun %{run_ldconfig} %clean [ "%{buildroot}" != "/" ] && rm -rf %{buildroot} %files %defattr(-, root, root) #%doc doc/* BUGS COPYRIGHT README README.radexample %dir %{_sysconfdir}/radiusclient %{_sysconfdir}/radiusclient/dictionary %{_sysconfdir}/radiusclient/dictionary.* %config(noreplace) %{_sysconfdir}/radiusclient/radiusclient.conf %config(noreplace) %{_sysconfdir}/radiusclient/issue %config(noreplace) %{_sysconfdir}/radiusclient/port-id-map %config(noreplace) %{_sysconfdir}/radiusclient/servers %{_sbindir}/* %files libs %defattr(-, root, root) %{_libdir}/*.so.* %{_libdir}/*.so %files devel %defattr(-, root, root) %{_libdir}/*.a %{_includedir}/*.h %changelog * Sun Jan 06 2008 Peter Nixon - Update to match upcoming freeradius-client release * Sun Nov 19 2006 Peter Nixon - Converted spec from radiusclient package to work with FreeRADIUS Client - Split out separate -devel and -libs packages * Wed Jan 25 2006 - mls(a)suse.de - converted neededforbuild to BuildRequires * Thu Nov 18 2004 - ro(a)suse.de - fixed file list * Sat Jan 10 2004 - adrian(a)suse.de - add %%defattr * Thu Jul 31 2003 - mjancar(a)suse.cz - use %%run_ldconfig * Thu May 29 2003 - mjancar(a)suse.cz - remove Makefiles from documentation * Wed May 28 2003 - mjancar(a)suse.cz - update to 0.3.2 - move localstatedir to /var/lib - remove unpackaged files from buildroot * Wed Apr 02 2003 - ro(a)suse.de - fixed patch radiusclient-0.3.1-fix.dif * Tue Apr 02 2002 - postadal(a)suse.cz - fixed to compile with autoconf-2.53 * Wed Mar 20 2002 - postadal(a)suse.cz - secfix (VU#589523 -buffer overflow in the function that calculates message digests) - fixed login.expamle, README.SuSE * Thu Jan 10 2002 - cihlar(a)suse.cz - use %%{_libdir} * Tue Nov 06 2001 - cihlar(a)suse.cz - fixed to compile with automake 1.5 * Wed Jun 06 2001 - cihlar(a)suse.cz - fixed to compile with new libtool * Mon Mar 26 2001 - cihlar(a)suse.cz - moved whole files from dif - fixed to compile * Wed Nov 29 2000 - smid(a)suse.cz - renamed: raduisc => radiusclient * Wed May 24 2000 - cihlar(a)suse.cz - fixed to compile - added BuildRoot * Sun Apr 09 2000 - bk(a)suse.de - added suse update config macro * Mon Sep 13 1999 - bs(a)suse.de - ran old prepare_spec on spec file to switch to new prepare_spec. * Thu Jun 10 1999 - kukuk(a)suse.de - Remove %%dir for doc tree * Sun Mar 01 1998 - tmg(a)suse.de - README.SuSE again * Tue Feb 10 1998 - tmg(a)suse.de - initial spec file - fixed paths in radiusclient.conf - login.example - simplistic example login.radius script - README.SuSE

1 0

Re: A way to use LDAP only for authentication
by Ivan Kalik 13 May '08

13 May '08

Yes. List ldap only in inner-tunel. Ivan Kalik Kalik Informatika ISP Dana 13/5/2008, "Konstantin KABASSANOV" <Konstantin.Kabassanov(a)lip6.fr> piše: >Hello, > >Using PEAP/mschapv2 with openldap through freeradius, I'd like to know if >there is a way to allow all users in the authorize section of radiusd.conf >(without doing ldap requests) and make the ldap request only in the >authenticate section. It is useful for instance to avoid multiple ldap >requests during authorization process in particular when a number of >radius-request/challenges are exchanged between Access points and radius >server. > >Thanks. > >Konstantin >_____________________________________________________________________ > >Konstantin KABASSANOV >LIP6/CNRS >104, avenue du Président Kennedy, 75016 Paris, France >Phone: +33 (0) 1 44 27 71 26 Fax: +33 (0) 1 44 27 74 95 > >E-mail: konstantin(a)kabassanov.com Web: http://www.kabassanov.com >Certificate: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html >_____________________________________________________________________ > > >

1 0