July 2008 - Freeradius-Users - lists.freeradius.org

Réf. : Re: Freeradius 2.0.5 & %{Ldap-UserDn} not correctly expanded ?
by Pierre.Strazza-prestataire＠labanquepostale.fr 02 Jul '08

02 Jul '08

Thanks a lot, that was the point. Pierre Pierre.Strazza-prestataire(a)labanquepostale.fr wrote: > Trying to setup group membership filtering against LDAP group membership > for user authentication and authorization, seems that %{Ldap-UserDn} is > not correctly expanded (shown as blank) in my conf. > Does anyone experienced same problems or has any idea about what is wrong > in my conf ? In 2.0, it's in %{check:LDAP-UserDn}, I think. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html A partir du 30 juin, le siege social et l'adresse postale de La Banque Postale a Paris changent et deviennent: 115, rue de Sevres, 75275 Paris Cedex 06 Le No du standard du Siege Central de la Banque Postale a Paris devient: 01 57 75 60 00 Le papier est un bien precieux, ne le gaspillez pas. N'imprimez ce document que si vous en avez vraiment besoin ! Ce message est confidentiel. Sous reserve de tout accord conclu par ecrit entre vous et La Banque Postale, son contenu ne represente en aucun cas un engagement de la part de La Banque Postale. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee prealablement. Si vous n'etes pas destinataire de ce message, merci d'en avertir immediatement l'expediteur.

1 0

Freeradius 2.0.5 & %{Ldap-UserDn} not correctly expanded ?
by Pierre.Strazza-prestataire＠labanquepostale.fr 02 Jul '08

02 Jul '08

Hello, Trying to setup group membership filtering against LDAP group membership for user authentication and authorization, seems that %{Ldap-UserDn} is not correctly expanded (shown as blank) in my conf. Does anyone experienced same problems or has any idea about what is wrong in my conf ? Here are some revelants parts : radiusd.conf ------------------ module { [...] ldap ldap { server = "myldapserver" identity = "cn=admin,dc=myorg" password = passw basedn = "dc=myorg" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=person)" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap auto_header = yes groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))" # groupmembership_attribute = cn } [...] } [..] Autz-Type LDAP { ldap } expiration logintime pap } authenticate { Auth-Type LDAP { ldap } } [...] users (matching huntgroup name "clientasa") ------------------------------------------------------------------ DEFAULT Huntgroup-Name == "clientasa", Ldap-Group=="ASA", Autz-Type := LDAP DEFAULT Auth-Type := Reject LDAP extract : -------------------- dn: cn=ASA, dc=myorg objectClass: groupOfNames objectClass: posixGroup objectClass: sambaGroupMapping objectClass: top cn: ASA gidNumber: 512 member: uid=test,ou=people,dc=myorg dn: uid=test,ou=people,dc=myorg objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: sambaSamAccount objectClass: shadowAccount objectClass: top cn: test gidNumber: 512 uid: test uidNumber: 0 loginShell: /bin/bash userPassword:: {SSHA}mypassword Debug info ---------------- rad_recv: Access-Request packet from host xxxxx port 1025, id=185, length=109 User-Name = "test" NAS-IP-Address = ip1 Calling-Station-Id = "xxxxxxx" User-Password = "mypassword" NAS-Port = 96 Cisco-AVPair = "ip:source-ip=xxxxxxxxxx" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: Entering ldap_groupcmp() expand: dc=myorg -> dc=myorg WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldapserver:389, authentication 0 rlm_ldap: bind as cn=admin,dc=myorg/ldappassword to ldapserver:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=myorg, with filter (uid=test) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (&(objectClass=GroupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=GroupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=myorg, with filter (&(cn=ASA)(&(objectClass=GroupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group ASA not found or user is not a member. users: Matched entry DEFAULT at line 210 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [test/mypassword] (from client pixasa port 96 cli xxxxxxx) Sending Access-Reject of id 185 to ip1 port 1025 Finished request 0. A partir du 30 juin, le siege social et l'adresse postale de La Banque Postale a Paris changent et deviennent: 115, rue de Sevres, 75275 Paris Cedex 06 Le No du standard du Siege Central de la Banque Postale a Paris devient: 01 57 75 60 00 Le papier est un bien precieux, ne le gaspillez pas. N'imprimez ce document que si vous en avez vraiment besoin ! Ce message est confidentiel. Sous reserve de tout accord conclu par ecrit entre vous et La Banque Postale, son contenu ne represente en aucun cas un engagement de la part de La Banque Postale. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee prealablement. Si vous n'etes pas destinataire de ce message, merci d'en avertir immediatement l'expediteur.

2 1

Nthashes with smbencrypt
by Eduardo Cavalcanti 02 Jul '08

02 Jul '08

I want to create password hashes of the LDAP users. I need this because peap/mschapv2 doesn't read encrypted passwords, but nt hashes. I can use smbencrypt to do this but I don't know how to do. Anyone knows how to create nt hashes using smbencrypt?? thanks.

2 2

Re: [Fwd: LDAP CHAP born again]
by Ryan Setiawan H 02 Jul '08

02 Jul '08

Hi Alan, thanks for your reply Alan Dekok wrote : > If the LDAP server gives FreeRADIUS the clear-text password, then CHAP > should work. yes the LDAP server already gave clear text password, you can see in the debug below >> rad_recv: Access-Request packet from host 192.168.8.88:4609, id=30, >> length=48 >> >> User-Name = "testing" >> CHAP-Password = 0x30e3e28c521fe0d81b988d2475dae76f3f >> ------------cut--------------. >> rlm_ldap: Bind was successful >> rlm_ldap: performing search in ou=dialup,dc=zzz,dc=com, with filter >> (uid=testing) >> rlm_ldap: checking if remote access for testing is allowed by dialupAccess >> rlm_ldap: Password header not found in password Testing1 for user testing > > And does CHAP work for this user? no... what I mean is the module ldap (rlm_ldap) could see the password for user testing.... that is Testing1 ( yes this is the password ) the LDAP should pass this clear text password ( Testing1 ) for module CHAP to authenticate >> also there is clue >> where parameter like >> password_header = "{clear}" >> password_attribute = userPassword >> password_radius_attribute = "User-Password" >> must be set.... but how? > > in the "ldap" section of radiusd.conf, where the LDAP parameters are >configured. yes I've configure that string in radiusd.conf section ldap... for password_attribute, clearly it must contain userPassword ( attribute the LDAP server keeps the password ) but how about password_radius_attribute ? from the faq password_radius_attribute is radius attribute where the user password will be stored after being extracted from LDAP is password_radius_attribute should contain string "User-Password" or "Clear-text Password" or maybe "CHAP-Password? what attribute does CHAP read for authentication? >> i'm still trying to read the code ( like rlm_chap.c ) to see what >> attribut does rlm_chap read for the password that was passed by the >> module ldap. but it is so arcane and "debuging code twice hard as >> writing the code at first place" > > Don't read the code. It won't help you. yeah... it killing me ( the code ) :D >> anyone has solution for this matter? > > Try installing 2.0.5 in a separate directory and configuring it. Odds >are it will work. in time I will try install it, but if i can't make this ( LDAP CHAP ) clear... definitely I will encounter the same problem again :) Thank You Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

unlang 'if' expansion
by Pshem Kowalczyk 01 Jul '08

01 Jul '08

Hi, We use freeradius 2.0.5, currently for testing. I've encountered a weird problem with if expansion: config: server local_logger { listen { type = detail filename = ${radacctdir}/detail_local load_factor = 20 } listen { type = acct ipaddr = * port = 1822 secret = xxxxxx } accounting { if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop"){ ok } else{ sql_localhost } } } debug: detail_recv: Read packet from /var/log/freeradius/radacct/detail_local User-Name = "roatt" NAS-Port = 117440512 NAS-IP-Address = 10.119.255.91 Framed-IP-Address = xx.yy..135.238 Filter-Id = "normal" NAS-Identifier = "akl-grafton-bras2" Acct-Status-Type = Interim-Update Acct-Delay-Time = 23 Acct-Input-Octets = 2253089 Acct-Output-Octets = 26743952 Acct-Session-Id = "akl-gra07000000000000e3b284039482" Acct-Authentic = RADIUS Acct-Session-Time = 27000 Acct-Input-Packets = 20268 Acct-Output-Packets = 27407 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Event-Timestamp = "Jul 2 2008 10:26:27 NZST" NAS-Port-Type = Virtual Calling-Station-Id = "GigabitEthernet 10/0.90810:9-810#587203901#INFA290611:RIC-RAN-21 to RIC-ETH51 port 2/1/1##pppoe 00:90:d0:6a:aa:eb#" NAS-Port-Id = "slot=7;subslot=0;port=0;vlanid=0;" Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IPv4 Tunnel-Server-Endpoint:0 = "10.176.0.230" Tunnel-Client-Endpoint:0 = "222.152.43.30" Service-Type = Framed-User Framed-Protocol = PPP Huawei-IPHost-Addr = "xx.yy.135.238 ff:ff:ff:ff:ff:ff" Huawei-Input-Peak-Rate = 0 Huawei-Input-Average-Rate = 0 Huawei-Output-Peak-Rate = 0 Huawei-Output-Average-Rate = 0 Huawei-Priority = 0 Huawei-Connect-ID = 39482 Huawei-Domain-Name = "ihug-ubs" Huawei-Qos-Profile-Name = "default" Proxy-State = 0x313134 Huntgroup-Name = "ADSL" Acct-Unique-Session-Id = "c5f44e1423b4012a" server local_logger { +- entering group accounting ++? if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") expand: %{Acct-Session-Time} -> 27000 ? Evaluating ("%{Acct-Session-Time}" == 0 ) -> FALSE Skipping ("%{Acct-Delay-Time}" == 0 ) ++? if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") -> TRUE ++- entering if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") +++[ok] returns ok ++- if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") returns ok ++ ... skipping else for request 1: Preceding "if" was taken } # server local_logger As you can see the first condition evaluates to FALSE (which is expected, but then the whole expression turns TRUE, which is somewhat unexpected. The reason for having that condition is to filter out packets that have 0 session time that cause issues with rlm_sql. If I re-write to condition like this: accounting { if ("%{Acct-Session-Time}" == 0){ if ("%{Acct-Delay-Time}" == 0){ if ("%{Acct-Status-Type}" == "Stop"){ ok } else{ sql_localhost } } else{ sql_localhost } } else{ sql_localhost } } it works as expected, just looks ugly :-( kind regards Pshem

2 2

Proxy Timeout Behavior
by David Mitchell 01 Jul '08

01 Jul '08

I'm trying to figure out how to have FreeRadius not send an authentication failed response if it can't reach a proxy. What I would prefer is that it simply not respond at all. That would allow my NAS to fall back to using a local password if my proxy is down or unreachable. A quick look at the source to event.c makes it appear that sending the reject is hard coded. Is there some way around this that I'm missing? Thanks in advance, -David Mitchell -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 3

Re : Re : Active Directory Integration
by pingouin osmolateur 01 Jul '08

01 Jul '08

Thanks Alan for your answer I follow your documentation and succeed with the part "Configuring FreeRADIUS to use ntlm_auth" So I want to use "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP", so I delete my user in database. Do I have to keep the following line in my radiusd.conf ? exec ntlm_auth { wait = no program = "/path/to/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } authenticate { ... ntlm_auth ... } Here is my radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } But when I'm testing with a Alcatel client, here what I obtain : rlm_sql (sql): Read entry nasname=192.48.19.111,shortname=NANATESTPRC,secret=titi; rlm_sql (sql): Adding client 192.48.19.111 (NANATESTPRC) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=77 User-Name = "TOTO" User-Password = "toto" Cisco-AVPair = "shell:priv-lvl=1" NAS-IP-Address = 192.48.19.111 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "TOTO", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'TOTO' rlm_sql (sql): sql_set_user escaped user --> 'x073129' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TOTO' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User TOTO not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User TOTO not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.48.19.111 port 49154 Waking up in 4 seconds... But I don't understand how to use a test client to send an MS-CHAP authentication request ? It's seem that i don't have a Auth-Type ? ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Juin 2008, 15h06mn 20s Objet : Re: Re : Active Directory Integration pingouin osmolateur wrote: > So I have to modify the first request from the client to use MS-CHAP request ? No. > Because in my database for the User-Name, I have the following Which is wrong. You were told it is wrong. > So what I have to do ? Delete that row from the database. The documentation tries to make it clear: Setting Auth-Type is wrong. Don't do it. > Do you have a link for Active Directory Integration ? See my web site: http://deployingradius.com Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

NAS-Post in Netgear Accounting-Packet
by Wolfgang Burger 01 Jul '08

01 Jul '08

Hi list, please have a look at this Accounting-Request. It was sent by a netgear WG102 WLAN-Access-Point: rad_recv: Accounting-Request packet from host 192.168.1.133 port 1033, id=48, length=194 Service-Type = Framed-User Acct-Status-Type = Stop User-Name = "burgerw" Framed-MTU = 1488 Acct-Session-Id = " 2" Acct-Authentic = RADIUS Acct-Session-Time = 159 Acct-Terminate-Cause = User-Request Acct-Delay-Time = 0 Called-Station-Id = "061B2F76F3B6:MPIIB-Guests" Calling-Station-Id = "0019E3D7B020" Framed-IP-Address = 192.168.20.34 NAS-Identifier = "netgear3" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" NAS-IP-Address = 192.168.1.133 NAS-Port = 0 NAS-Port-Id = "STA port # 0" The output of "radwho -R": User-Name = "burgerw" Acct-Session-Id = " 2" NAS-IP-Address = 192.168.1.133 NAS-Port = 1 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 359 Calling-Station-Id = "0019E3D7B020" The error: rlm_radutmp: Logout for NAS netgear3 port 0, but no Login record Is the Access-Point sending the wrong NAS-Port? If so, I would contact Netgear. I just want to confirm what`s the problem. Thanks and best regards Wolfgang Burger Mit freundlichen Grüßen Wolfgang Burger <burgerw(a)immunbio.mpg.de> Max-Planck-Institut fuer Immunbiologie Scientific Data Processing Unit (+00 49) 761 / 5108 461 Stuebeweg 51 D-79108 Freiburg Germany

2 2

Problem with regular expressions in users file (v.2.0.x)
by Massimo Pistoni 01 Jul '08

01 Jul '08

Hi all, I was using freeradius version 1.1.1 for a long time on a Scientific Linux v. 5.1 OS and it works fine. Now I am trying to update to the new version 2.0.5. I've converted all the necessary config files (in the /etc/raddb/ directory tree) getting successful authentication. Unfortunately I 've problems with the regular expressions used in the users file, that seems to not work at all. In my radius.conf file exist the following directives: regular_expressions = yes extended_expressions = yes Moreover the ./configure seems to have found the regex.h module and included it at compilation time. The symptom is that the third (but also the fourth for simpler tries) of the following users statements does not match in the case of authentication based on a <username@suffix> style (with Suffix =! "lnf.infn.it"): ----------------------------------------------------------------------------- DEFAULT Auth-Type = Kerberos, Suffix == "lnf.infn.it" DEFAULT Auth-Type = Kerberos, Suffix == "LNF.INFN.IT" DEFAULT Auth-Type := Reject, Suffix =~ "@", Suffix !~ "@(.+\\.|)(infn\\.it|INFN\\.IT)$" DEFAULT Auth-Type := Reject, Suffix =~ "@" ----------------------------------------------------------------------------- I tried several other syntax way, but it seems that regular expressions are disabled. The same users file is regularly working in the version 1.1.1 and 1.1.7 installed on the same system. Can someone help me? Thanks, bye, Massimo -- / | / _____/ / | / _____/ | / / / | / / / / | / / / | / / / | / ___/ _____/ / / | / ___/ / | / / / | / / / / | / / / | / ______/ _/ __/ _/ _/ _/ __/ _/ _/ __/ Massimo Pistoni phone: (+39)-06-9403.2372/2355 Computing Service fax: (+39)-06-9403.2649 LNF-INFN e-mail: Massimo.Pistoni(a)lnf.infn.it Via Enrico Fermi, 40 www: http://www.lnf.infn.it/ I-00044 Frascati, Italy

2 2

user expiration problem
by Umar 01 Jul '08

01 Jul '08

Hi ... im just wondering if my configuration is correct. I tried to disable a user through Expiration attribute but its not working. I am using 2.0.5 FreeRadius. here is the mysql output. | id | username | attribute | op | value | +----+----------+---------------+----+-------------+ | 1 | test | User-Password | == | test | | 2 | test | Expiration | := | 22 Jan 2006 Is there any other changes required? Please Help Regards, Umar Draz -- View this message in context: http://www.nabble.com/user-expiration-problem-tp18193568p18193568.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6