August 2008 - Freeradius-Users - lists.freeradius.org

Possible bug in shipped configuration file.
by Maurizio Cimaschi 14 Aug '08

14 Aug '08

Hi, I don't know if this has been reported/discussed before, but it happened to me last week. I was trying to setup a freeradius (2.0.5) to authenticate requests from my access point (using WPA Enterprise) aganist an LDAP server. It was working fine using the "radclient", but the requests from the AP were buonced claiming that no authentication metod was set. I checked the configuration file more than once, googled a lot but was unable to solve. After almost a day of trying, I noticed a line in the debug (radiusd -X) that said something about proxying. So I remembered to have seen a statement in the "inner-server" configuration: #update control { # Proxy-To-Realm := LOCAL #} In the configuration file installed by the installation procedure that part was uncommented; adding the comments was enough to make the server work. I'm not an expert in this application and I don't know why that part was uncommented, but, may I suggest to uncomment that part in the configuration file ? Thank you for your great work. Bye.

2 4

Re: Prefix/Suffix not working (FR 2.0.5, CentOS 5, System Auth)
by Steve Weaver 13 Aug '08

13 Aug '08

Alan DeKok writes: > > Steve Weaver wrote: > > The problem I'm having is that we have a lot of legacy users still > > logging in with "Pusername" for PPP connections. I've tried to set it > > up in both the users file and the hints file (separately) and get the > > same result. No matter what I do, it tries to authenticate (System > > auth type) the username "Pusername" instead of "username". > > Hmm... that functionality seems to have been lost somehow. > > I've commited a one-line fix. Please grab the latest version from > git.freeradius.org. It should now work. > That took care of it. Thanks! -SW -- Steven Weaver sweaver(a)inebraska.com IT Director (402) 434-8680 x101 Internet Nebraska http://www.inebraska.com/

1 0

Prefix/Suffix not working (FR 2.0.5, CentOS 5, System Auth)
by Steve Weaver 13 Aug '08

13 Aug '08

I'm having a strange problem I hope you can help me figure out. We're finally moving from an ancient Livingston RADIUS to FreeRADIUS. I compiled and installed version 2.0.5 on a freshly installed CentOS 5 box, read all the documentation I could find, installed our old users file and adapted it until it now (mostly) works correctly. System info: # radiusd -v radiusd: FreeRADIUS Version 2.0.5, for host i686-redhat-linux-gnu, built on Aug 5 2008 at 15:40:15 # uname -a Linux ****.*******.com 2.6.18-92.1.6.el5 #1 SMP Wed Jun 25 13:49:24 EDT 2008 i686 i686 i386 GNU/Linux The problem I'm having is that we have a lot of legacy users still logging in with "Pusername" for PPP connections. I've tried to set it up in both the users file and the hints file (separately) and get the same result. No matter what I do, it tries to authenticate (System auth type) the username "Pusername" instead of "username". If I add a user named "Pusername" everything works correctly. It hits the right default entry and authenticates fine, so it's just not stripping off the "P" when authenticating. I have also tried suffixes (".ppp") to test if it was just the prefix that wasn't working. Same problem. We're not using any realms, proxying, LDAP, SQL, etc at this time. Just a very simple single RADIUS server reading from a users file and authenticating against the system password file. I first tried to set it up in the users file. I commented out everything in the hints file. Here's what the DEFAULT entry looks like in the users file: DEFAULT Auth-Type := System, Prefix == "P" User-Service-Type = Framed-User, Session-Timeout = 36000, Idle-Timeout = 600, Port-Limit = 1, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Netmask = 255.255.255.255, Framed-Routing = None, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP I attempt to authenticate: # radtest Psweaver ******** localhost 0 testing123 Sending Access-Request of id 43 to 127.0.0.1 port 1645 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1645, id=43, length=20 Things are working otherwise; without the "P" it works fine: # radtest sweaver ******** localhost 0 testing123 Sending Access-Request of id 223 to 127.0.0.1 port 1645 User-Name = "sweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1645, id=223, length=56 Session-Timeout = 36000 Idle-Timeout = 600 Port-Limit = 1 Service-Type = Login-User Login-IP-Host = ***.***.***.*** Login-Service = Rlogin With the "P", here's the output of radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 35915, id=175, length=6 0 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 expand: %t -> Tue Aug 12 10:10:44 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Psweaver", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 3526 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type System auth: type "System" +- entering group authenticate ++[unix] returns notfound auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Psweaver attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 175 to 127.0.0.1 port 35915 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 175 with timestamp +1013 Ready to process requests. Note that it's matching line 3526, which is indeed the DEFAULT entry I listed above. If I move prefix information to the hints file, I end up with this in the hints file: DEFAULT Prefix == "P", Strip-User-Name = Yes Hint = "PPP" and this in the users file: DEFAULT Auth-Type := System, Hint == "PPP" User-Service-Type = Framed-User, Session-Timeout = 36000, Idle-Timeout = 600, Port-Limit = 1, Framed-Protocol = PPP, Framed-Address = 255.255.255.254, Framed-Netmask = 255.255.255.255, Framed-Routing = None, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP Test fails: # radtest Psweaver ******** localhost 0 testing123 Sending Access-Request of id 161 to 127.0.0.1 port 1645 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1645, id=161, length=20 radiusd -X output: rad_recv: Access-Request packet from host 127.0.0.1 port 35924, id=161, length=60 User-Name = "Psweaver" User-Password = "********" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize hints: Matched DEFAULT at 65 ++[preprocess] returns ok expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20080812 expand: %t -> Tue Aug 12 10:44:04 2008 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Psweaver", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound users: Matched entry DEFAULT at line 3526 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type System auth: type "System" +- entering group authenticate ++[unix] returns notfound auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> Psweaver attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 161 to 127.0.0.1 port 35924 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 161 with timestamp +4 Ready to process requests. It hits line 65 in the hints file (my "P" entry), and line 3526 in the users file (my "PPP" entry.) When using the hints file, it even logs this to the detail file showing that it's been stripped: Tue Aug 12 10:44:04 2008 Packet-Type = Access-Request User-Name = "Psweaver" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Stripped-User-Name = "sweaver" Hint = "PPP" Either way, everything works if I add a Psweaver entry to the password file, and not if I don't. I'm out of ideas. Anyone have any I can borrow? :) TIA, SW -- Steven Weaver sweaver(a)inebraska.com IT Director (402) 434-8680 x101 Internet Nebraska http://www.inebraska.com/

3 3

Freeradius + OpenLDAP
by Ivan . 13 Aug '08

13 Aug '08

Hi Does any have any links to some decent "how tos" for integrating OpenLDAP into freeradius for user management? Thanks Ivan

3 3

Error compiling FreeRadius-2.0.5
by Ums 13 Aug '08

13 Aug '08

Hi I have Red Hat Linux release 8.0 and i am trying to install free radius 2.0.5 fresh getting the following errors while doing a make after the ./configure any inpur with be greatly appreciated rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin -fno-rtti -fno-exceptions "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/radius_snmp.o .libs/session.o .libs/smux.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /freeradius-server-2.0.5/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -ldl -Wl,--rpath -Wl,/usr/local/lib .libs/threads.o: In function `setup_ssl_mutexes': /freeradius-server-2.0.5/src/main/threads.c:217: undefined reference to `OpenSSL_add_all_algorithms' /freeradius-server-2.0.5/src/main/threads.c:220: undefined reference to `CRYPTO_num_locks' /freeradius-server-2.0.5/src/main/threads.c:226: undefined reference to `CRYPTO_num_locks' /freeradius-server-2.0.5/src/main/threads.c:230: undefined reference to `CRYPTO_set_id_callback' /freeradius-server-2.0.5/src/main/threads.c:231: undefined reference to `CRYPTO_set_locking_callback' .libs/threads.o: In function `request_handler_thread': /freeradius-server-2.0.5/src/main/threads.c:497: undefined reference to `ERR_remove_state' collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/freeradius-server-2.0.5/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/freeradius-server-2.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/freeradius-server-2.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/freeradius-server-2.0.5' make: *** [all] Error 2 Thanks much, Ums

2 1

oracle support
by Alexandre Chapellon 12 Aug '08

12 Aug '08

Hello, I can see that oracle can be used to store accounting data ippool and others stuff like this but nothing about authenticating request with users and password stored in oracle database..... how can i manage to do this?

1 1

Cleartext Password not clear
by Stéven Le Bras 12 Aug '08

12 Aug '08

Hi there, I'm attempting to log in chillispot with freeradius but when I send the couple username / password with a cleartext password in user-password to freeradius through chillispot, radiusd respond : rad_recv: Access-Request packet from host 127.0.0.1 port 36710, id=47, length=263 ChilliSpot-Version = "1.0.12" User-Name = "testuser" User-Password = "\177\326=\343\017\021e\247B4ޣ\202<6\001" NAS-IP-Address = 10.1.0.1 Service-Type = Login-User Framed-IP-Address = 10.1.0.4 Calling-Station-Id = "00-13-CE-8C-0F-AF" Called-Station-Id = "00-09-6B-D8-9A-C6" NAS-Identifier = "nas01" Acct-Session-Id = "48a18af500000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Location-ID = "isocc=,cc=,ac=,network=SYS_TECH," WISPr-Location-Name = "HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3990/logoff" Message-Authenticator = 0x8bd17fcc4a6acc6cac5026615e4545b5 [...] auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject (the password is "plop") but i want that freeradius can read the password without transform it. Is it possible or do you think it could be chillispot that transform it ? Thank's -- Stéven

2 3

Multiple Attribute checks with sql module
by Alexander Koeppe 12 Aug '08

12 Aug '08

Hello List, I want to set up freeradius as a proxy for cisco management and dot1x. The attribute to check is NAS-Port-Type. If it's "Ethernet" it's a dot1x request and has to be proxied by one realm configured in proxy.conf. Else it has to be proxied to another realm also configured in proxy.conf for one-time-password authentication. Further if a specific NAS requests, the request should be accepted by the proxy itself. I got this already working with the users file looking like DEFAULT NAS-Port-Type==Ethernet,NAS-IP-Address==1.1.1.1,Auth-Type:=Accept DEFAULT NAS-Port-Type==Ethernet,Proxy-To-Realm:=Realm1 DEFAULT NAS-IP-Address==1.1.1.1,Auth-Type:=Accept DEFAULT Proxy-To-Realm:=Realm2 But I doesn't get this working using the sql module. My database structure looks like mysql> select * from radcheck; +----+----------+---------------+----+-------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+-------+ | 2 | testuser | Password | == | test | | 4 | DEFAULT | NAS-Port-Type | =* | | +----+----------+---------------+----+-------+ 2 rows in set (0.00 sec) mysql> select * from usergroup; +----+----------+------------+ | id | UserName | GroupName | +----+----------+------------+ | 2 | DEFAULT | ProxyMgt | | 3 | DEFAULT | ProxyDOT1x | +----+----------+------------+ 1 row in set (0.00 sec) mysql> select * from radgroupcheck; +----+------------+----------------+----+----------+ | id | GroupName | Attribute | op | Value | +----+------------+----------------+----+----------+ | 4 | ProxyMgt | NAS-Port-Type | == | Virtual | | 5 | ProxyMgt | Proxy-To-Realm | := | Mgt | | 6 | ProxyDOT1x | NAS-Port-Type | == | Ethernet | | 7 | ProxyDOT1x | Proxy-To-Realm | := | PortSec | +----+------------+----------------+----+----------+ 4 rows in set (0.00 sec) mysql> select * from radgroupreply; Empty set (0.00 sec) With this sql configuration, the server proxy management requests but not dot1x requests. In debug it says "No matching entry in the database for request from user". Despite the acceptance of specific NAS requests. The reason I want to realize this configuration with the sql module is, that changes are possible without HUP the process. I've read the documentation which is available for the sql module but the examples described there are not that complex to help with my problem. Can anyone help me to realize the above mentioned configuration of the users file with the sql module? Thanks in advance Cheers Alex

1 0

What is the certificate that I installed on the notebook?
by Martin Silvero 12 Aug '08

12 Aug '08

/certs/ in the folder many licences, what is that I installed on the notebook and as set? thanks!!! -- -- Silvero Martin

1 0

Help needed for radrelay under 1.1.3
by Ryan 12 Aug '08

12 Aug '08

Hi All, Need some help on radrelay for 1.1.3 if possible. I have a radius setup whereby there are two radius, one for authorization/authentication and one for accounting. The one doing authorization/authentication will relay the accounting detail using radrelay to the other radius which will update to sql. Currently I'm having some problem with the relaying, it does not seems to be working as the detail file which is suppose to be cleared as entries are relayed is getting filled up. I noticed that the radrelay process is not forking the detail.work file at all. Have tried running radrelay in debug mode but was not able to find any error other than the following rad_verify: Received Accounting-Response packet from client xxx.xxx.xxx.xxx port 1813 with invalid signature (err=2)! (Shared secret is incorrect.) Both radius are running 1.1.3. The error is rather strange as I'm sure that the shared secret is correct. Best Regards, Ryan

2 1