September 2008 - Freeradius-Users - lists.freeradius.org

Hmm... 2.1.0 && radmin
by Alan DeKok 07 Sep '08

07 Sep '08

Looking at this a little more, it looks like a bug crept in at the last minute that prevents radmin from working. <sigh> I'll issue 2.1.1 on Monday. It's been an interesting week. Alan DeKok.

3 4

rlm_unix
by Mark Jones 06 Sep '08

06 Sep '08

I am installing a new server running freeradius 2.0.5 to replace a server running 1.1.7. In our unique situation I have until now been using the rlm_unix module in multiple instances to read about 5 different passwd/shadow file combinations. This was fine until 2.05 were the ability to specify the path to those files has been removed. I know it is suppose to be replaced with the rlm_passwd module but was hoping there was an easier way. Mark Jones London Operations Managed Network Systems 171 Queens Ave Suite 515 London Ontario N6A 5J7 519-679-5207

2 5

Simultaneous login Issue on Freeradius
by Praveen Kumar 06 Sep '08

06 Sep '08

Hi, I am a newbie for FreeRadius. I need some information on freeradius regarding my requirement for authentication and session control. I want to setup the system like.. 1 One centralized server running on a Linux machine for authentication. 2 Client Linux machine in the network which should connect to the server whenever any user log in into the machine. 3 Once authenticated, the user should be allowed the single-sign on. 4 The session for that user should be restricted to one in simultaneous log in. i.e The user which is already log in should not be allowed to login into other machine in the network. 5 The machine should not allow any user to log in by using the local log in setting (/etc/passwd). i.e The machine should be connected the network or Internet for log in. I found that freeradius has the feature of authentication and session control, but not sure that the above setup can be supported and how to configure freeradius for this. Thanks in advance for the reply. Waiting for the reply. Regards Manoj

4 6

Re: sqlcounters for traffic
by Alexandre Chapellon 05 Sep '08

05 Sep '08

Edvin Seferovic a écrit : > > rlm_sqlcounter: Sent Reply-Item for user scott, > Type=Session-Traffic-Limit, value=12792 > > Which part don’t you understand? Sqlcounter returned it. How does the > log part of the RADIUS Packet looks like? It should contain the > “Session-Traffic-Limit” if it can be found in the dictionary, right? > What i don't understand is that i cannot find this in the sent reply, whereas it seems to be processed correctly by the module. > > > E:S > > > > *From:* > freeradius-users-bounces+edvin.seferovic=kolp.at(a)lists.freeradius.org > [mailto:freeradius-users-bounces+edvin.seferovic=kolp.at@lists.freeradius.org] > *On Behalf Of *Alexandre Chapellon > *Sent:* Samstag, 06. September 2008 01:53 > *To:* FreeRadius users mailing list > *Subject:* sqlcounters for traffic > > > > I want to se sqlcounters to count bytes transferred from clients so > that i manage quota. > Aiming this i configured the following counter: > > sqlcounter bytesQuota { > counter-name = traffic_quota > check-name = Max-Traffic > reply-name = Session-Traffic-Limit > sqlmod-inst = mysqldb > key = User-Name > reset = hourly > query = "SELECT SUM(acctinputoctets + acctoutputoctets) FROM > radacct WHERE UserName='%{%k}'" > } > > My first problem is that the Session-Traffic-Limit (from the redback > dictionnary) is not returned. I can't see it neither in the output of > radtest nor with radsniff. > Yet, looking at the output of radiusd -X i can see it's correctly > understood by freeradius: > > rlm_sqlcounter: Check item is greater than query result > rlm_sqlcounter: Authorized user scott, check_item=12000, counter=10891 > rlm_sqlcounter: Sent Reply-Item for user scott, > Type=Session-Traffic-Limit, value=12792 > ++[bytesQuota] returns ok > > Does anyone has a clue? > > Alexandre Chapellon a écrit : > > You're right, adding the name of my sqlcounter in the instantiate > section lake it works. > thx :) > > Alan DeKok a écrit : > > Alexandre Chapellon wrote: > > > whenever i launch freeradius -X I get the folloawing error: > > /etc/freeradius/users[205]: Parse error (check) for entry scott: Invalid > > octet string "101" for attribute name "Max-Traffic" > > > > > The modules are initialized in *order*. The sqlcounter module creates > the attributes on the fly. But... it can't do this if it hasn't been > run yet. > > > > Line 205 is the line where user scott is defined in users files. > > I have tryed setting up my own dictionnary (which i think shouldn't be > > needed) with the Max-Traffic attribute defined as interger > > > > VENDOR ME > > ATTRIBUTE Max-Traffic 1 integer > > > > > That isn't the correct dictionary file format, but it's not relevant, > either. > > > > But that doesn't help. I have read all over the web that sqlcounter with > > mysql are considered as stable enough for production , so am quite > > surprised of this issue... > > Any idea? > > > > > List "sqlcounter" in the "instantiate" section. It will be > initialized before the "users" file is read. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > ------------------------------------------------------------------------ > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Freeradius Usage
by Jesse Stone 05 Sep '08

05 Sep '08

Thank you for the quick response. I may not have mentioned this previously but I am by no means a linux/networking expert. The company I work for is pro-MS. Recently, I got the urge to get back into Linux and here I am. My thinking (in regards to network structure) was that I wanted applications intended to the public as far away from my local lan as posible. The local lan requires the app server though- OpenVPN, Samba (as a PDC), misc other things so I wanted it available to the local lan but not to the DMZ. My main questions though are with Freeradius. My setup is for "hobby" purposes only and already I would have difficulty telling you exactly which users have access to what. I want to using a technology like Freeradius or LDAP create 1 central place on the app server that EVERYTHING would authenication to. In a perfect world, the end result would be that I could type something like this: select %user% from permissionsDB and be returned something like this: SSH: NO, OpenVPN: YES, Samba: %Specific group% (which indicates shares available), Shell Access: No, ect Basically, I want a setup where I can easilly scale upwards without having to "teach" each new application how to use a DB. Freeradious also can authenicate my wireless users when would also be great as for all I know, half my bandwidth is being used by my neighbors. -Jesse On Fri, Sep 5, 2008 at 4:34 PM, Edvin Seferovic <edvin.seferovic(a)kolp.at>wrote: > Hi, > > > > excuse me for asking, but why dont you set up the AppServer in your DMZ ? > you could have ( what I call ) the T – structure > > > > >< --- INTERNET --> GATEWAY ( server1 ) <---> LOCAL LAN > > I > > I DMZ > > I > > SERVER2 + APPServer > > > > It depends how your users use the gateway and how are they suppose to > connect to the Internet. > > > > Regards, > > E:S > > > > > > *From:* freeradius-users-bounces+edvin.seferovic=kolp.at@ > lists.freeradius.org [mailto:freeradius-users-bounces+edvin.seferovic<freeradius-users-bounces%2Bedvin.seferovic> > =kolp.at(a)lists.freeradius.org] *On Behalf Of *Jesse Stone > *Sent:* Samstag, 06. September 2008 01:25 > *To:* FreeRadius users mailing list > *Subject:* Freeradius Usage > > > > Hi All, > > > > I am new to this mailing list and am about to ask a probably very silly > question. Please feel free to direct me to resources that'll help me answer > them. > > > > I want to setup the following: > > > > Gateway [server1] > > - nic1 = Internet > > - nic2 = DMZ [server2] > > - nic3 = Router w/ Wireless -> App Server [Server3] (FREERADIUS > SERVER HERE) -> Local Lan > > > > I read a lot about both Freeradius and LDAP and cannot determine if either > can accomplish my goals. > > > > What I want is: > > > > 1) 1 central place where all user authenication takes place: SSH, Shell > Access, Samba, OpenVPN, Mumble, Any other app that requires user > administration. > > 2) This information stored in a SQL type database so that I can build my > own custom apps to report on user usage, performance ect. > > 3) My router has wireless and I have enabled the security features. I > would still like authenication to take place before a wireless user is > allowed on the network. > > > > For example, > > > > Currently, I have this: Router w/ Wireless -> App Server [Server3] + Local > Lan > > > > I want this: Router w/ Wireless -> App Server [Server3] -> Local Lan > > > > Is Freeradius the best approach for my needs? Do I need anything else? > > > > -Jesse > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Freeradius Usage
by Jesse Stone 05 Sep '08

05 Sep '08

Hi All, I am new to this mailing list and am about to ask a probably very silly question. Please feel free to direct me to resources that'll help me answer them. I want to setup the following: Gateway [server1] - nic1 = Internet - nic2 = DMZ [server2] - nic3 = Router w/ Wireless -> App Server [Server3] (FREERADIUS SERVER HERE) -> Local Lan I read a lot about both Freeradius and LDAP and cannot determine if either can accomplish my goals. What I want is: 1) 1 central place where all user authenication takes place: SSH, Shell Access, Samba, OpenVPN, Mumble, Any other app that requires user administration. 2) This information stored in a SQL type database so that I can build my own custom apps to report on user usage, performance ect. 3) My router has wireless and I have enabled the security features. I would still like authenication to take place before a wireless user is allowed on the network. For example, Currently, I have this: Router w/ Wireless -> App Server [Server3] + Local Lan I want this: Router w/ Wireless -> App Server [Server3] -> Local Lan Is Freeradius the best approach for my needs? Do I need anything else? -Jesse

2 1

Window domain (win server 2k3) ----- Free-Radius ----- NAS ------- Access Point )))) ((((( STA
by Le Sang 05 Sep '08

05 Sep '08

Dear all, I tried to configure free-radius for authenticate user on window domain but i couldn't find the solutions for this behavior. Here is my topology: Window domain (win server 2k3) ----- Free-Radius ----- NAS ------- Access Point )))) ((((( STA 1/. On domain I had groups: administrator with full privileges and user with limitted privilege. 2/. On free-radius: Used the document showed on http://deployingradius.com with authenticate type was NTLM. 3/. On NAS: I provided ip address of RAS and port authen & accouting right. My problem happened below: - On Radius i could test users on domain successfully. - On NAS: + First: in NAS had textboxes for testing users. In this I could authenticate for users on window domain success. + Second: using users in the first one i talked (above) login to NAS with auth through RAS. My problem happened at here. I couldn't login to NAS. After that, I used command "radiusd -x" and always got the message: access reject. I found up in the debugging output and saw: process login to NAS of user was sent to radius. But the radius could not use user's attributes to compare with attributes of this user on domain. Can anybody please help me on this problem? Thanks.

3 2

CA certificates
by jehan procaccia 05 Sep '08

05 Sep '08

hello, we are running our own PKI with a 3 level hierarchy: it-master-class1(self-signed) -> it-ca-class2 -> it-ca-class3. it-ca-class3 signed our radius server (radiux-pkiit-2008.pem) In eap.conf file in the tls section I have tls { private_key_password = secret private_key_file = ${certdir}/radiux-pkiit-2008.key.pass.pem certificate_file = ${certdir}/radiux-pkiit-2008.pem CA_file = ${certdir}/ca-chain-institut-telecom_long.crt } unfortunaltly, securew2 windows clients configure to check certificates and having it-master-class1 in it's CA list don't accept our TLS security :-( . It tells that it received a bad certificate from the server !?. I wonder if I didn't made a misconfiguration in radiusd/eap/tls section above . certificate_file point to our radius SSL-server certificate CN=radius.it-sudparis.eu but what the CA_file should point what in our case ? the it-master-class1 CA root certificate ? the it-ca-class3 CA which signed our radius server ? a bundle of the 3 CA (as it is now !) ? , in which order class1-2-3 ? class 3-2-1 ? in pem ? , der ? short or long CA files (by these I mean only what is between --BEGIN CERTIFICATE-- and --END CERTIFICATE-- or plus the "blabla" above ) ?. Perhaps only certificate_file = ${certdir}/radiux-pkiit-2008.pem could be used, but in that case radiux-pkiit-2008.pem should contain the radius server certificate + a bundle of the 3 CA, in which order ? short or long ? ... You see I have lots of possibilities and interogation !. I'am much more used to configure SSL in apache ssl.conf, to me it is clear as the directive are self explained : SSLCertificateFile /etc/pki/tls/certs/server-2008.pem SSLCertificateKeyFile /etc/pki/tls/private/server-2008.key SSLCertificateChainFile /etc/pki/tls/certs/ca-chain-institut-telecom.crt SSLCACertificateFile /etc/pki/tls/certs/itrootca-class1.crt in eap.conf I don't see any distinction between the httpd equivalents : SSLCertificateChainFile and SSLCACertificateFile I also use openssl s-client to test my servers certs setting openssl s_client -host mutuel.it-sudparis.eu -port 443 But I cannot do the same for radius ? openssl s_client -host radius.it-sudparis.eu -port 1812 => socket: Connection refused :-( . Thanks for your help .

1 0

huntgroup question
by Hans Bornemann 05 Sep '08

05 Sep '08

Hi, For some NAS i want to restrict the access for a single realm. For other NAS every realm is allowed. So I put in huntgroups: huntgroups: notebook NAS-IP-Address == 123.123.123.123, User-Name =~(a)willi.de This is only working, if the user has a Huntgroup-Name entry in the users file. users: bob Cleartext-Password := "hello", Huntgroup-Name =~note Is that correct? I understand the docs so, that the radius first looks into the hints file, than huntgroup and after that the realm is looked up. Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

1 0

MSCHAP Authentication and LDAP Group Membership checking
by kesm0724 05 Sep '08

05 Sep '08

Hello All, I am very, very new to Freeradius (as well as Radius) ;) - disclaimer. We are trying to move away from using IAS to Freeradius. We have approx 50 switches/routers which I have not had a problem with getting to work with Freeradius including group checking using LDAP. The issue I have is getting our Cisco VPN Concentrator to authenticate users who are in a certain Active Directory group. I have configured Samba to join our domain - all that is working without issue. The problem apparently is when logging in via the Cisco VPN client: Here is my debug: ad_recv: Access-Request packet from host 10.2.1.6 port 1059, id=83, length=191 User-Name = "voila\\webtest" NAS-Port = 1151 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "123.201.6.78" Calling-Station-Id = "123.201.6.76" Tunnel-Client-Endpoint:0 = "123.201.6.76" MS-CHAP-Challenge = 0x0ebafb8a5ab6b2be73f9a983a6a3f5d3 MS-CHAP2-Response = 0x0000db98fa3162973c0f68121500631c0c8d00000000000000005808068d4047ef8a58e79d488a62d41e89128aabd6d88c52 NAS-IP-Address = 10.2.1.6 NAS-Port-Type = Virtual +- entering group authorize ++[preprocess] returns ok expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.2.1.6/auth-detail-20080904 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.2.1.6/auth-detail-20080904 expand: %t -> Thu Sep 4 17:55:54 2008 ++[auth_log] returns ok ++[chap] returns noop rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok rlm_realm: No '@' in User-Name = "voila\webtest", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_realm: No '"' in User-Name = "voila\webtest", looking up realm NULL rlm_realm: No such realm "NULL" ++[ntdomain] returns noop ++[unix] returns notfound rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=voila\5cwebtest) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=voila\5cwebtest) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=voila\5cwebtest) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=voila\5cwebtest) rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for voila\webtest WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=voila\5cwebtest) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=voila\5cwebtest) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type mschap auth: type "MSCHAP" +- entering group MS-CHAP rlm_mschap: No Cleartext-Password configured. Cannot create LM-Password. rlm_mschap: No Cleartext-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for webtest with NT-Password expand: --domain=%{mschap:NT-Domain} -> --domain=voila expand: --username=%{mschap:User-Name} -> --username=webtest mschap2: 0e expand: --challenge=%{mschap:Challenge:-00} -> --challenge=dcdc37024aecaec1 expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=5808068d4047ef8a58e79d488a62d41e89128aabd6d88c52 Exec-Program output: NT_KEY: 1E79BE41DB018B9E293DA357E6E5EA0D Exec-Program-Wait: plaintext: NT_KEY: 1E79BE41DB018B9E293DA357E6E5EA0D Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok Login OK: [voila\\webtest] (from client VPN port 1151 cli 123.111.6.76) +- entering group post-auth ++[exec] returns noop Sending Access-Accept of id 83 to 10.2.1.6 port 1059 MS-CHAP2-Success = 0x00533d31364230314341364638323331333730333334393432393943303539423539334346434433314336 MS-MPPE-Recv-Key = 0x5e34def484a9a9c160f712e90322bca0 MS-MPPE-Send-Key = 0x2f644ea60d80525ed0b13527ca916aae MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 83 with timestamp +888 Ready to process requests. It appears that MSCHAP is used to verify the password but LDAP is not properly checking the "VPN-Users" AD group....I believe it is not stripping the domain portion off correctly as I see the domain name appended to (sAMAccountName=voila\5cwebtest) My users File entries: (The first entry I would like to be used by the concentrator to search the group and if the user is a member allow them access - of course authenticating the provided password) DEFAULT LDAP-Group == "vpn-users" Fall-Through = Yes This entry is for our network switches/routers - this appears to be working without any issue. DEFAULT LDAP-Group == "Radius-Admin" Service-Type = Login-User, cisco-avpair = "shell:priv-lvl=15", Fall-Through = Yes If I login from my network devices it performs the ldap searches without issue and authenticates/authorizes the user - You can see this below: rlm_ldap: performing search in dc=voila,dc=com, with filter (&(cn=vpn-users)(|(&(objectClass=group)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))(&(objectClass=GroupOfNames)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group vpn-users rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 178 rlm_ldap: Entering ldap_groupcmp() expand: dc=voila,dc=com -> dc=voila,dc=com expand: (|(&(objectClass=group)(member=%{check:LDAP-UserDn}))(&(objectClass=GroupOfNames)(member=%{check:LDAP-UserDn}))) -> (|(&(objectClass=group)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))(&(objectClass=GroupOfNames)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (&(cn=Radius-Admin)(|(&(objectClass=group)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom))(&(objectClass=GroupOfNames)(member=CN\3dzkms\2cCN\3dUsers\2cDC\3dvoila\2cDC\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group Radius-Admin rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 181 ++[files] returns ok rlm_ldap: - authorize rlm_ldap: performing user authorization for zkms WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=zkms) expand: dc=voila,dc=com -> dc=voila,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=voila,dc=com, with filter (sAMAccountName=zkms) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? rlm_ldap: user zkms authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type LDAP auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: login attempt by "zkms" with password "Omitted" rlm_ldap: user DN: CN=zkms,CN=Users,DC=voila,DC=com rlm_ldap: (re)connect to control.voila.com:389, authentication 1 rlm_ldap: bind as CN=zkms,CN=Users,DC=voila,DC=com/Omitted to control.voila.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user zkms authenticated succesfully Thanks in advance for any pointers..... -- View this message in context: http://www.nabble.com/MSCHAP-Authentication-and-LDAP-Group-Membership-check… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1