July 2008 - Freeradius-Users - lists.freeradius.org

Can't find directory
by Ivan Markic 03 Jul '08

03 Jul '08

Hy i'm beginner in Linux and freeradius. Can someone help pe because, when i finish my instalationn of freeradius i can't fint etc/raddb/ directory in etc???!!! Best regards! -- Ivan Markic

5 4

checkrad not called after upgrade to 2.x
by oz 02 Jul '08

02 Jul '08

P.S. Sorry, I posted to the developers-list, but I meant the users-list, so here it should be discussed: M. S. wrote: > Can I put this in bugzilla? Seems like simultaneous use is completely broken in 2.x which is a fairly significant feature. To me checkrad seems to be broken too. I'm using 2.0.5 without virtual servers. Checkrad says, my NAS is Unknown when it is invoked, although I have it in my clients.conf: client testerx { ipaddr = 212.x.x.x secret = xxxxxxx nastype = erx } radiusd -X [...] auth: user supplied User-Password matches local User-Password +- entering group session expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp expand: %{User-Name} -> smith checkrad: Unknown NAS 212.x.x.x, not checking ++[radutmp] returns ok Multiple logins (max 1) [MPP attempt]: [smith] (from client testerx port 1610612780 cli #erx705#E60#44) Found Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Sending Access-Reject of id 88 to 212.x.x.x port 50000 Reply-Message := "\r\nYou are already logged in - access denied\r\n\n" Finished request 2. [...] For our customers I have Simultaneous-Use := 1 in my users-file and checkrad is invoked, when a stale session in radutmp is found: # radwho -ir smith,04279558,PPP,S1610612780,Wed 12:2,212.x.x.x,x.x.x.x It is possible, that in 2.0.3 checkrad was ok, because I noticed no problems with Simultaneous-Use there ... but maybe accidentally. Is it really a bug in freeradius-2.0.5? oz

2 4

Dear freeradius-users@lists.freeradius.org July 86 OFF!
by VIAGRA � Official Site 02 Jul '08

02 Jul '08

1 0

change session-timeout
by sub 02 Jul '08

02 Jul '08

Hello everybody, I looked around a bit but without success. I currently use freeradius for several services and I have the following scenario: - a user is authenticated through a NAS; - due to some event my application/script or something recalculate the Session-Timeout value, normally decreasing it of X seconds. Can I send the updated value of the Session-Timeout attribute to the NAS? Thanks, -- sub

2 1

Proxy help
by David Mitchell 02 Jul '08

02 Jul '08

I've having a problem getting the proper attributes set on my response packets when using a proxy. If I authenticate locally with something like this in users: username Cleartext-Password password Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", it works fine. The Service-Type and Reply-Message get sent off to the NAS and life is good. However, if I activate a NULL realm and proxy the authentications out, it no longer works. My users file looks more like this: DEFAULT Service-Type = Administrative-User, Reply-Message = "Authorized Users Only", Judging from the post-proxy-detail and reply-detail logs it looks like the proxy server is dropping all the attributes and my server doesn't put them back? Is that correct? And is that the way it's supposed to work? Thanks in advance, -David Mitchell -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 10

how to remove double quote in access-accept answere
by Thomas LAVIGNE 02 Jul '08

02 Jul '08

Hello, Does anybody know how to remove the "" in the answere arround presto ? Please find here an example of the access-accept answere sended by my FreeRadius server. ---BEGINING--- Sending Access-Accept of id 6 to 212.xx.xx.xx port xxx Redback-Subscriber-Profile-Name := "presto" Service-Type := Framed-User Framed-Protocol := PPP Framed-IP-Address := 255.255.255.254 ---END--- Thank you very much, Regards, Thomas

2 1

intermediate ca @ radius
by Sergio Yébenes Moreno 02 Jul '08

02 Jul '08

I've posted a problem verifying client certicicate, because this is signed by an intermediate ca, this signed by root ca. Both intermediate and root are public authorities and I don't have any of two private keys, only my client provate key. Te point is very simple, having intermediate.pem and root.pem, I've just done this: cp intermediate.pem intermediateBoth.pem cat root.pem >> rootBoth.pem yeah....I'm wood about this. Access control based on DNI (National Document of Identity) ....mmmmm.....I like this Now, there are 2 more intermediate ca's, and I've read that freeradius can be configured with a number of virtual servers. Each one will have her rootBoth_x.pem ca_file. I'm wood with this forum also. Thanks

1 0

Re: [Fwd: LDAP CHAP born again]
by Ryan Setiawan H 02 Jul '08

02 Jul '08

Alan DeKok wrote: >>> Try installing 2.0.5 in a separate directory and configuring it. Odds >>> are it will work. >> >> in time I will try install it, but if i can't make this ( LDAP CHAP ) >> clear... definitely I will encounter the same problem again :) > > 2.0.5 has many, many fixes that aren't in 1.1.7. Some things that are >difficult to impossible in 1.1.7 are easy in 2.0.5. > > Alan DeKok. right now I have already installed 2.0.3 because the dependency just like 1.1.7 :D waw lot of change I see ... but here we go the debug User-Name = "testing" CHAP-Password = 0xee8f74f97f724f06e54a9862f98ccef299 +- entering group authorize ++[preprocess] returns ok rlm_chap: Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for testing expand: (uid=%u) -> (uid=testing) expand: ou=dialup,dc=zzz,dc=com -> ou=dialup,dc=zzz,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.11.17:389, authentication 0 rlm_ldap: bind as memberUid=radius,ou=admin,dc=zzz,dc=com/radiusjuga to 192.168.11.17:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=dialup,dc=zzz,dc=com, with filter (uid=testing) rlm_ldap: Password header not found in password Testing10 for user testing rlm_ldap: Added User-Password = Testing10 in check items ------cut------ added user-password = Testing10 in check item .... this is the debug output difference compare to 1.1.7 ------cut------ rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "testing" with CHAP password rlm_chap: Using clear text password "Testing10" for user testing authentication. rlm_chap: chap user testing authenticated succesfully ++[chap] returns ok Login OK: [testing/<CHAP-Password>] (from client local port 0) Finished request 0. Going to the next request Waking up in 4.9 seconds. It's just work :D thanks Alan however there is this strange string "Please update your configuration so that the "known good" clear text password is in Cleartext-Password, and not in User-Password." after I digging the freeradius.org, I see people also have this minor problem, and in a mail you say to change the attribute userpassword to cleartext-password. but in openldap schema v3 there isn't any attribute called cleartext-password... is there any explanation for this ... everyone if you don't mind :) . still digging in openldap forum :) Thanks Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

freeradius with wpa/wpa2 and win xp home
by Piotr Salwerowicz 02 Jul '08

02 Jul '08

hello I have problem with freeradius 2.x with wpa/wpa2 and win xp home sp2. I try to make 802.1x + wpa/wpa2 on my ap linksys/dd-wrt. The supplicants are windows xp home with sp2 with patch wpa/wpa2. On my access points i set wpa/wpa2 enterprise/mix/radius and every time i have in logs: "Sending Access-Challenge of..." and its not connect I setup my freeradius on base this site: http://www.tldp.org/HOWTO/8021X-HOWTO/freeradius.html to set up freeradius, but there is some problem, its don't work thanks for any help it's my logs from freeradius: Cleaning up request 2696 ID 0 with timestamp +51465 User-Name = "alan" NAS-IP-Address = 10.0.0.7 Called-Station-Id = "0016b6c92839" Calling-Station-Id = "0018f8368ad4" NAS-Identifier = "0016b6c92839" NAS-Port = 40 Framed-MTU = 1400 State = 0xe31b561ae01f4f79765637cf0502aac5 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xc748764c47aff91a6202064c0d293641 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "alan", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.0.0.7 port 2061 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe31b561ae71e4f79765637cf0502aac5 Finished request 2697. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2697 ID 0 with timestamp +51465 Ready to process requests. and my conf radiusd.conf (...) hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf snmp = no $INCLUDE snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ authorize { preprocess mschap suffix eap files } authenticate { Auth-Type MS-CHAP { mschap } eap } users : alan User-Password == "alan" eap.conf: eap { default_eap_type = peap tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random } peap { default_eap_type = mschapv2 virtual_server = "inner-tunnel" } mschapv2 { } } cat modules/mschap |grep -v '#' mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes authtype = MS-CHAP } ---------------------------------------------------------------------- Zobacz cala prawde o Lukaszu Podolskim! kliknij >>> http://link.interia.pl/f1e57

4 6

Re : Re : Active Directory Integration
by pingouin osmolateur 02 Jul '08

02 Jul '08

Thanks Alan for your answer I follow your documentation and succeed with the part "Configuring FreeRADIUS to use ntlm_auth" So I want to use "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP", so I delete my user in database. Do I have to keep the following line in my radiusd.conf ? exec ntlm_auth { wait = no program = "/path/to/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } authenticate { ... ntlm_auth ... } Here is my radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } But when I'm testing with a Alcatel client, here what I obtain : rlm_sql (sql): Read entry nasname=192.48.19.111,shortname=NANATESTPRC,secret=titi; rlm_sql (sql): Adding client 192.48.19.111 (NANATESTPRC) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=77 User-Name = "TOTO" User-Password = "toto" Cisco-AVPair = "shell:priv-lvl=1" NAS-IP-Address = 192.48.19.111 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "TOTO", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'TOTO' rlm_sql (sql): sql_set_user escaped user --> 'x073129' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TOTO' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User TOTO not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User TOTO not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.48.19.111 port 49154 Waking up in 4 seconds... But I don't understand how to use a test client to send an MS-CHAP authentication request ? It's seem that i don't have a Auth-Type ? ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Juin 2008, 15h06mn 20s Objet : Re: Re : Active Directory Integration pingouin osmolateur wrote: > So I have to modify the first request from the client to use MS-CHAP request ? No. > Because in my database for the User-Name, I have the following Which is wrong. You were told it is wrong. > So what I have to do ? Delete that row from the database. The documentation tries to make it clear: Setting Auth-Type is wrong. Don't do it. > Do you have a link for Active Directory Integration ? See my web site: http://deployingradius.com Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1