June 2008 - Freeradius-Users - lists.freeradius.org

Proxy help
by David Mitchell 02 Jul '08

02 Jul '08

I've having a problem getting the proper attributes set on my response packets when using a proxy. If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance, -David Mitchell -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 10

Nthashes with smbencrypt
by Eduardo Cavalcanti 02 Jul '08

02 Jul '08

I want to create password hashes of the LDAP users. I need this because peap/mschapv2 doesn't read encrypted passwords, but nt hashes. I can use smbencrypt to do this but I don't know how to do. Anyone knows how to create nt hashes using smbencrypt?? thanks.

2 2

Problem with regular expressions in users file (v.2.0.x)
by Massimo Pistoni 01 Jul '08

01 Jul '08

Hi all, I was using freeradius version 1.1.1 for a long time on a Scientific Linux v. 5.1 OS and it works fine. Now I am trying to update to the new version 2.0.5. I've converted all the necessary config files (in the /etc/raddb/ directory tree) getting successful authentication. Unfortunately I 've problems with the regular expressions used in the users file, that seems to not work at all. In my radius.conf file exist the following directives: regular_expressions = yes extended_expressions = yes Moreover the ./configure seems to have found the regex.h module and included it at compilation time. The symptom is that the third (but also the fourth for simpler tries) of the following users statements does not match in the case of authentication based on a <username@suffix> style (with Suffix =! "lnf.infn.it"): ----------------------------------------------------------------------------- DEFAULT Auth-Type = Kerberos, Suffix == "lnf.infn.it" DEFAULT Auth-Type = Kerberos, Suffix == "LNF.INFN.IT" DEFAULT Auth-Type := Reject, Suffix =~ "@", Suffix !~ "@(.+\\.|)(infn\\.it|INFN\\.IT)$" DEFAULT Auth-Type := Reject, Suffix =~ "@" ----------------------------------------------------------------------------- I tried several other syntax way, but it seems that regular expressions are disabled. The same users file is regularly working in the version 1.1.1 and 1.1.7 installed on the same system. Can someone help me? Thanks, bye, Massimo -- / | / _____/ / | / _____/ | / / / | / / / / | / / / | / / / | / ___/ _____/ / / | / ___/ / | / / / | / / / / | / / / | / ______/ _/ __/ _/ _/ _/ __/ _/ _/ __/ Massimo Pistoni phone: (+39)-06-9403.2372/2355 Computing Service fax: (+39)-06-9403.2649 LNF-INFN e-mail: Massimo.Pistoni(a)lnf.infn.it Via Enrico Fermi, 40 www: http://www.lnf.infn.it/ I-00044 Frascati, Italy

2 2

user expiration problem
by Umar 01 Jul '08

01 Jul '08

Hi ... im just wondering if my configuration is correct. I tried to disable a user through Expiration attribute but its not working. I am using 2.0.5 FreeRadius. here is the mysql output. | id | username | attribute | op | value | +----+----------+---------------+----+-------------+ | 1 | test | User-Password | == | test | | 2 | test | Expiration | := | 22 Jan 2006 Is there any other changes required? Please Help Regards, Umar Draz -- View this message in context: http://www.nabble.com/user-expiration-problem-tp18193568p18193568.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Accounting cisco commands
by Everton Diniz 01 Jul '08

01 Jul '08

Hi all, I´m looking for config the radius to accounting all commands that user do on cisco device. I didn´t find any documents with this sample. Anybody have this? Tks, Everton

2 1

openLDAP & freeRADIUS
by William E. Russell 30 Jun '08

30 Jun '08

All, I am currently working with openLDAP and freeRADIUS. I have correctly set up freeRADIUS to read from my openLDAP. I can't seem to authenticate my user. I have narrowed down the error to a single line, "rlm_eap_mschapv2: Invalid response type 4". From my hours of searching online, I have realized that all this means is that there was an error in the response packet. I have no idea what error could have occurred. I believe it may have to do with the password_attribute. I read something documentation that said there was some issue with LDAP and passing a cleartext password. Also, as you can see, I am using EAP/PEAP with MSCHAP. Any body have any insight in to this type of thing? If I could just get some help on how to set up the LDAP and RADIUS, that would be great - I have read just about every single tutorial so please don't direct me to one of those. I need someone who has a similar set up - what did you use for password attribute? William William E. W. Russell Member of Technical Staff (Software Development) 198 Brighton Avenue Long Branch, New Jersey 07740 Home #: 732-752-2037 Cell #: 732-744-6483

5 9

EAP method in logs
by Sergio Belkin 30 Jun '08

30 Jun '08

Hi, I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs... Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 13

Re : Active Directory Integration
by pingouin osmolateur 30 Jun '08

30 Jun '08

So I have to modify the first request from the client to use MS-CHAP request ? Because in my database for the User-Name, I have the following mysql> select * from radcheck ; +----+----------------------------------------+-----------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------------------------------------+-----------+----+---------+ | 10 | TOTO@MYDOMAIN | Auth-Type | := | MS-CHAP | +----+----------------------------------------+-----------+----+---------+ 1 row in set (0.00 sec) So what I have to do ? Do you have a link for Active Directory Integration ? Thanks for you help ----- Message d'origine ---- De : Phil Mayers <p.mayers(a)imperial.ac.uk> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Juin 2008, 13h53mn 23s Objet : Re: Active Directory Integration This: > rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=108 > User-Name = "TOTO@MYDOMAIN" > User-Password = "toto" > Cisco-AVPair = "shell:priv-lvl=1" > NAS-IP-Address = 192.48.19.111 ...is not an MS-CHAP request, as the later debug tells you: > modcall: entering group MS-CHAP for request 0 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: No MS-CHAP-Challenge in the request > modcall[authenticate]: module "mschap" returns reject for request 0 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 2

Re : Where are th DH and Random files?
by Reveal MAP 30 Jun '08

30 Jun '08

Thank you, i found them ---------------------------------------------------------------- Please see raddb/certs. There are documentation files, example files, and scripts used to create all of the other files in that directory. > I just would like someone to give me the lines, how to create theses two > files. > And could it be included in the package like with the previous versions. They are. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

1 0

Where are th DH and Random files?
by Reveal MAP 30 Jun '08

30 Jun '08

Hi all, running "radiusd -X" i have that error at the end of the output: ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/certs/aaa.pem" certificate_file = "/etc/raddb/certs/certs/aaa.pem" CA_file = "/etc/raddb/certs//CA/ca.pem" private_key_password = "*****" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) rlm_eap_tls: Error loading randomness rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[280]: Failed to find module "eap". /etc/raddb/sites-enabled/default[227]: Errors parsing authenticate section. } } Errors initializing modules radiusserver:/etc/raddb # radiusserver:/etc/raddb # ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ My conclusion: maybe "random" file is missing (that is so) and it might be the same with dh file. these two files are not created by the scripts included in FR-2.0.5 that i am testing now. I just would like someone to give me the lines, how to create theses two files. And could it be included in the package like with the previous versions. Thank you. _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1