February 2009 - Freeradius-Users - lists.freeradius.org

FreeRADIUS and Active Directory
by Tomas 19 Feb '09

19 Feb '09

Dear all, I'm trying to setup my FreeRADIUS to verify user credentials from windows AD (at the moment I'm using users file). I have no experience in joining Linux based machine to windows domain, I had a look at few guides and found that the easiest way is to use "likewise-open". I've joined my radius server to the domain and noticed that likewise did not use samba's winbind or ntml_auth. Which according to wiki I've been reading is a must to enable authentication using AD. http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO Can I install winbind and samba manually, or should I start again and not use likewise-open at all? Thanks for your help! Tomas

4 10

Radius Server with WPA not working for me
by sankalpk 19 Feb '09

19 Feb '09

Hi All, I am new to Radius Servers and have a Project to get Radius Server configured in the organization for authenticating users through an Access Point which is based on Mikrotik. I have setup freeradius (version 1.0.1) server and have defined a user in the "users" file. When I test the configuration using the "radtest" command, it works fine and says "Access-Accept". However, when I try to authentcate the user through the access point, I am prompted for Username and Password at the client, but Debug mode on radius server shows "request rejected". It says "no User-Password attribute". (However, the the debug mode is showing correct Username as entered from the client) I checked lot of Forums, but none of the solutions worked for me. I have stored user password in clear-text in the users file. Also, I am not using any certificate (TLS) in the setup. The confiurations are as follows: _*Radius Server:*_ ################################################################################## _*radiusd.conf:*_ ################################################################################## *_modules_*{ pap { encryption_scheme = clear } pap md5{ encryption_scheme = md5 } } chap { authtype = CHAP } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } _*authenticate*_ { eap } _*authorize*_ { preprocess eap files } ################################################################################## ################################################################################## _*eap.conf*_ ################################################################################## eap { default_eap_type = mschapv2 mschapv2 { Auth-Type = PAP } } ################################################################################## _*users*_ ################################################################################## "radtest1" Cleartext-Password == "password" #(also tried User-Password instead of Cleartext-password, but no luck !!) ################################################################################## _*clients.conf*_ ################################################################################## client 192.168.xxx.xxx { secret = test shortname = private-network nastype = other } ################################################################################## ################################################################################## _*Access Point Configuration:*_ ################################################################################## Network Authentication: WPA with Radius Data Encryption: TKIP Have given Radius Server IP, Port and shared key(Which is same as mentioned in clients.conf) ################################################################################## _*Client Machine Configuration:*_ ################################################################################## The client machine is a Windows Vista OS, and have the following configurations for Wireless Network: Security Type: WPA-Enterprise Encryption: TKIP Authentication Method: PEAP (Secured Password MSCHAPv2) ################################################################################## _*Debug mode of Radius Server says this:*_ User-Name = "radtest1" NAS-IP-Address = 192.168.1.254 NAS-Port = 0 Called-Station-Id = "00-21-DE-00-17-B2:Wireless1" Calling-Station-Id = "00-19-D2-AD-4A-BF" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000d017261647465737431 Message-Authenticator = 0x2376aab3c18a8a9cbe0320fc1add824a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched radtest1 at 100 modcall[authorize]: module "files" returns ok for request 6 modcall: group authorize returns updated for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 0 to 192.168.104.168:3111 EAP-Message = 0x010200221a0102001d10f60a0398e4f61c9beba89b3dbcefde677261647465737431 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc02709d0e2c702124f02a4d451d0a59d Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.104.168:3111, id=0, length=159 Sending duplicate reply to client private-network:3111 - ID: 0 Re-sending Access-Challenge of id 0 to 192.168.104.168:3111 --- Walking the entire request list --- Would appreciate if someone could suggest me the resolution for the problem. ALso, if someone can get me a working copy of freeradius server with Mikrotik (or otherwise Linksys) Access Point, it would be of great help. Thanks and Regards, SaN sankalpk(a)tulip.net DISCLAIMER: This e-mail and any files transmitted with it are for the sole use of the intended recipient(s) and may containconfidential and privileged information. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies and the original message. Any unauthorized review, use, disclosure, dissemination, forwarding, printing or copying of this email or any action taken in reliance on this e-mail is strictly prohibited and may be unlawful. The recipient acknowledges that Tulip Telecom Limited is unable to exercise control or ensure or guarantee the integrity of/overthe contents of the information contained in e-mail transmissions and further acknowledges that any views expressed in this message are those of the individual sender and no binding nature of the message shall be implied or assumed unless the sender does so expressly with due authority of Tulip Telecom Limited. Before opening any attachments please check them for viruses! and defects.

2 1

different ldap with different accept and reject
by Hegedus Gabor 19 Feb '09

19 Feb '09

Hi all, I have a question. Now I use 3-4 different LDAP. users file: DEFAULT NAS-Port-Type == "Async", Auth-Type :="LDAP1", Autz-Type = "LDAP1" exec-program-wait ="test_1.php" DEFAULT NAS-Port-Type == "Wireless-802.11", Autz-Type := "LDAP2" exec-program-wait ="test_2.php" DEFAULT NAS-Port-Type == "Virtual", Auth-Type :="LDAP3", Autz-Type = "LDAP3" exec-program-wait ="test_3.php" #but it runs every times when matches. I want run scripts depend on access or reject, not every time. how can i configure it. for example: LDAP1+reject -> 1_reject.php LDAP1+accept -> 1_accept.php LDAP2+reject -> 2_reject.php LDAP2+accept -> 2_accept.php LDAP3+reject -> 3_reject.php LDAP3+accept -> 3_accept.php Thanks for help bye Gabor

2 1

Re: FW: upgraded from freeradius 1.1.3 to 2.0.4
by Alan DeKok 19 Feb '09

19 Feb '09

Frank van den Diepstraten wrote: > Well, I didn't expect this kind of reactions. I tried to give as > much information as I had. You didn't expect to be told that automatic upgrades across major versions wasn't supported? > First of all I upgraded to the newest > packages of debian etch before I did a dist-upgrade to lenny. > With the latest version of etch it still worked. The latest > version in debian lenny is the 2.0.4 which I am running now. > I do use the groupreply option (but no groupcheck option > because the check has been done already in the usercheck option) That is not a supported configuration. See doc/rlm_sql, especially section 1, item #5. It explains how the server works. The groupcheck && groupreply configuration items work together to obtain a result. You can't simply delete one, and expect the other to work properly. Alan DeKok.

1 0

Re: FW: upgraded from freeradius 1.1.3 to 2.0.4
by A.L.M.Buxey＠lboro.ac.uk 19 Feb '09

19 Feb '09

Hi, > Well, I didn't expect this kind of reactions. I tried to give as much information as I had. First of all I upgraded to the newest packages of debian etch before I did a dist-upgrade to lenny. With the latest version of etch it still worked. The latest version in debian lenny is the 2.0.4 which I am running now. I do use the groupreply option (but no groupcheck option because the check has been done already in the usercheck option) so the mail of Alan doesn't solve the problem. The complete debug text is underneath, hopefully this makes it a bit more clear. Sorry for the inconvenience: basically, when you migrate from 1.x to 2.x you need to manually update the configuration rather than cut'n'paste the config over - primarily to ensure correct behaviour, but also, the config is massively different for various new functions - you should be using the sites-enabled/* system and if you dont see/edit the new configs, you wont see the new features and capabilities. this is very similar to apache 1.x to 2.x upgrades > WARNING: Found User-Password == "...". > WARNING: Are you sure you don't mean Cleartext-Password? > WARNING: See "man rlm_pap" for more information. > rlm_sql (sql): User found in radcheck table change your oper and attribute Cleartext-Password := instead of User-Password == if you dont use groups, then change read_groups = yes to read_groups = no (and then, as per the inline docs, If set to 'no' the user MUST have Fall-Through = Yes in the radreply table) another reason to look at the default config files is they ahve lots and lots of details/help and descriptions - all too often I see config files that have been stripped bare and rejigged eg sql radius-sql { database = "mysql" driver = "rlm_sql_${database}" server = "localhost" login = "database-user" password = "password-we-use" radius_db = "radius-database" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" deletestalesessions = yes sqltrace = yes sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 50 connect_failure_retry_delay = 60 nas_table = "nas" readclients = yes $INCLUDE /opt/freeradius-3.1.4/sql/${database}/dialup.conf } does that help the administrator or operator? nope. i dont think so. alan

1 0

Using Exec-Program-Wait for MOTP (mobile OTP) with MSCHAPv2
by Fabiano 19 Feb '09

19 Feb '09

Hello, Does anyone know where I can find some information on how to use the following in freeradius ? I have an external shell script which awaits arguments (username, clear password, and other arguments) and returns an answer for validation. The problem is that I cannot find any lead on how to do this while using MSCHAPv2... And I am not sure how to do this with Exec-Program-Wait. Is this possible without rewriting the module in C ? Is there any way to have the cleartext password sent to the external script ? Thanks a lot Fab

4 9

Re: FW: upgraded from freeradius 1.1.3 to 2.0.4
by Alan DeKok 19 Feb '09

19 Feb '09

Frank van den Diepstraten wrote: > For a few years now, I use a freeradius/mysql server for the > authentication of users which logon with their dsl line. This always > went perfect till I tried to upgrade the machine from debian etch to > debian lenny. The freeradius version went from 1.1.3 to 2.0.4. When I > upgraded user couldn’t login anymore. Umm... you upgraded software across a major version number, and you didn't do the migration manually? We've made serious attempts to make the configuration similar, but it is *not* the same. Automated upgrades are simply not possible. Also, 2.0.4 is an old version. You want to use a more recent one. > I didn’t change anything in the config file which we used on the 1.1.3 > version of freeradius. That's BAD. You need to *upgrade* the configuration, not just blindly copy it over. > While searching for this error I found something about the > groupchecktable which we never used. In the config this option is marked > out: ... > And in the database is no table called radgroupcheck because I never > used it. So.. not using that shouldn't break the server. > How can I get my freeradius working again and simply don’t let it do a > thing with the groupcheck (which I guess is the problem of the empty > expand which I see in debug mode) Find out what the real problem is. Looking at *part* of the debug log doesn't help. Some expansions are *allowed* to be empty. Alan DeKok.

2 1

Re: FW: upgraded from freeradius 1.1.3 to 2.0.4
by tnt＠kalik.net 19 Feb '09

19 Feb '09

>I didn't change anything in the config file which we used on the 1.1.3 >version of freeradius. I guess something goes wrong with the empty expand >message in debug mode. > > > >While searching for this error I found something about the groupchecktable >which we never used. In the config this option is marked out: > > > >#groupcheck_table = "radgroupcheck" > > > >And in the database is no table called radgroupcheck because I never used >it. > > > >So because of that there's no query at the "Authorization Queries" section >related to the groupcheck (authorize_group_reply_query) > > > >How can I get my freeradius working again and simply don't let it do a thing >with the groupcheck (which I guess is the problem of the empty expand which >I see in debug mode) > Read a few more lines in sql.conf and you will find out how not to use groups. read_groups = no Ivan Kalik Kalik Informatika ISP

1 0

FW: upgraded from freeradius 1.1.3 to 2.0.4
by Frank van den Diepstraten 19 Feb '09

19 Feb '09

Hi all, For a few years now, I use a freeradius/mysql server for the authentication of users which logon with their dsl line. This always went perfect till I tried to upgrade the machine from debian etch to debian lenny. The freeradius version went from 1.1.3 to 2.0.4. When I upgraded user couldn't login anymore. I put on the debugging and saw an empty expand which looks like: rlm_sql (sql): User found in radcheck table expand: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username ='dsluser' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='dsluser' expand: -> After that is see the message: rlm_sql (sql): Error generating query; rejecting user rlm_sql (sql): Error processing groups; rejecting user rlm_sql (sql): Released sql socket id: 62 ++[sql] returns fail I didn't change anything in the config file which we used on the 1.1.3 version of freeradius. I guess something goes wrong with the empty expand message in debug mode. While searching for this error I found something about the groupchecktable which we never used. In the config this option is marked out: #groupcheck_table = "radgroupcheck" And in the database is no table called radgroupcheck because I never used it. So because of that there's no query at the "Authorization Queries" section related to the groupcheck (authorize_group_reply_query) How can I get my freeradius working again and simply don't let it do a thing with the groupcheck (which I guess is the problem of the empty expand which I see in debug mode) Met vriendelijke groet, Frank van den Diepstraten | system / networkengineer | Concepts ICT T +31 (0)76 522 15 55 | F +31 (0)76 531 05 31 St. Ignatiusstraat 265 4817 KK Breda, The Netherlands <http://www.concepts-ict.nl> www.concepts-ict.nl Please consider the environment before printing this e-mail. Disclaimer De informatie verzonden met dit e-mail bericht is uitsluitend bestemd voor de geadresseerden gebruik van deze informatie door anderen dan de geadresseerde is verboden. Openbaarmaking, vermenigvuldiging, verspreiding en/of verstrekking van deze informatie aan derden is niet toegestaan. Concepts ICT en/of de aan haar gelieerde ondernemingen staat niet in voor juiste en volledige overbrenging van de inhoud van een verzonden e-mail, noch voor tijdige ontvangst daarvan. U wordt verzocht, indien het bericht niet voor u bestemd is, het retour te sturen naar de afzender. Wij wijzen iedere aansprakelijkheid af in verband met mogelijke gevolgen en/of schade van een juiste en volledige verzending en ontvangst van de inhoud van deze e-mail. Overeenkomsten en andere verplichtingen kunnen Concepts ICT slechts binden indien deze schriftelijk, per brief of telefax zijn aangegaan. Uit dit e-mail bericht kunnen derhalve geen (contractuele) verplichtingen voor Concepts ICT ontstaan.

1 0

Pool-Name woes with sqlippool
by Simon Earthrowl 18 Feb '09

18 Feb '09

Hi all, I have, what I think is a simple problem, with a simple answer that doesn't work. The environment I am supply authentication requests to, require that I respond with a fixed IP address in each NAS domain. eg NAS-IP-Addresses 192.168.1.0/28 should get an IP from the pool 10.0.0.0/16 While NAS-IP-Addresses 192.168.1.128/28 should get an IP from the 10.1.0.0/16 Users have no control from which of NASs they come into. All the normal user name/password stuff works fine (many thanks!) What I would love to do is set up Huntgroups (OK so that bit works too!) and then in the sqlippool.conf just assign pool-name = %{Huntgroup-Name} This doesn't work, and all I get is pool-name is undefined. Does anyone have any ideas? Kind regards Simon

2 7