April 2009 - Freeradius-Users - lists.freeradius.org

RE: Adding vendor specefic attributes
by anoop c 27 Apr '09

27 Apr '09

Hi Is it possible to configure vendor specific attributes in Free RADIUS. Please guide where can I edit the configuration. I am using MAC authentication by editing the user file shown below. '020a6-5a7fd9 Auth-Type:=Local,User-Password=="secret" MAC authentication is working and I would like to add a vendor specific attribute. Regards Anoop Get your world in your inbox! Mail, widgets, documents, spreadsheets, organizer and much more with your Sifymail WIYI id! Log on to http://www.sify.com ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com

3 2

%RADIUS-4-RADIUS_ALIVE %RADIUS-4-RADIUS_DEAD help
by ramesh p 27 Apr '09

27 Apr '09

I'm getting the following messges/alarms from freereadius server version 1.1.6. and when i oberserved the radiusd process it's stopped. Why this happens? Apr 26 00:18:44.498: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:18:50.777: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. Apr 26 00:18:50.777: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:18:59.133: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. Apr 26 00:18:59.133: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:19:04.765: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. Apr 26 00:19:04.765: %RADIUS-4-RADIUS_ALIVE: RADIUS server 10.199.32.34:0,1813 is being marked alive. Apr 26 00:19:11.293: %RADIUS-4-RADIUS_DEAD: RADIUS server 10.199.32.34:0,1813 is not responding. ... Please share the information. Regards, Rams..

1 0

Freeradius on windows
by Mitul Modi 27 Apr '09

27 Apr '09

hi i have installed freeradius version 1.0.3 on windows xp. any body have resource to generate certificates on windows. thanks, mitul modi

2 2

pam_radius_auth configuration options
by F. Soriano 24 Apr '09

24 Apr '09

Hi list, I browsed quite a long time all previous threads and various material available on the web, with no success. So maybe someone can help wit this... I am using the latest available release of FreeRADIUS on my Linux server (RHEL 5.3, x86_64), with authentication against local users file. This works like a charm so far. Authentication is set up in this order: pam_radius_auto.so, then pam_unix.so. Is there a way to configure the pam_radius_auto.so module so that as long as the FreeRADIUS daemon is up and running, authentications will be *only* performed against FreeRADIUS, and all other authentication methods are ignored (even if this account exists locally, not in FreeRADIUS)? Of course, if FreeRADIUS is stopped or does not respond anymore, authentication against regular Linux files would work. I am only looking to make it work for the login process (local ttys). This is an example of my /etc/pam.d/login file: --snip-- #%PAM-1.0 auth [user_unknown=ignore success=ok ignore=ignore default=bad] pam_securetty.so auth [success=done new_authtok_reqd=done authinfo_unavail=ignore ignore=ignore default=die] pam_radius_auth.so ruser debug auth required pam_unix.so use_first_pass #auth include system-auth account required pam_nologin.so #account required pam_radius_auth.so #account include system-auth --snip-- I also tried with the "localifdown" keyword: --snip-- auth [success=done new_authtok_reqd=done ignore=ignore default=die] pam_radius_auth.so localifdown ruser debug --snip-- without success... Let's suppose I have a centralized account "remote-admin", and FreeRADIUS is the only one to know its password. Now I have another account, "local-admin", that is not declared within /etc/raddb/users file, but only in local /etc/passwd and /etc/shadow. With the first example, when FreeRADIUS is up, I can log in as remote-admin, and the logs shows that pam_radius_auth got clearance from radiusd. I can also log in as "local-admin", no matter if radiusd is up or not (the logs show that radiusd failed to respond, but that pam_unix accepted the credentials and then granted login). Thanks for your clues. Regards, Frank Créez votre adresse électronique prenom.nom(a)laposte.net 1 Go d'espace de stockage, anti-spam et anti-virus intégrés.

1 0

about /usr/local/sbin/checkrad
by Tseveendorj 24 Apr '09

24 Apr '09

Hello, Do I understand right or not about checkrad? Please drive me right direction. radius# checkrad Usage: checkrad nas_type nas_ip nas_port login session_id What is nas_port ? is it mean 1645, 1646 ? I found the session_id from cisco router with following command hostname#sh pppoe session all Total PPPoE sessions 3 *session id: 184* local MAC address: 001d.46c7.2630, remote MAC address: 00e0.a666.51eb virtual access interface: Vi2.2, outgoing interface: Gi0/0.1 206389 packets sent, 185625 received 246455857 bytes sent, 20392801 received is it ? Best regards, Tseveen.

4 3

eap-peap inner outer identity
by Per Hermansson 24 Apr '09

24 Apr '09

Hi I'm having troubles setting up EAP-PEAP with freeradius (2.1.0) + hostapd (0.6.9) + wpa_supplicant (0.6.6) What I've done is mostly to follow http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html Which basically is to update eap.conf to use peap and add my login details to the users file: "testuser" User-Password == "Secret149" The problem is that I always get the following output from freeradius -X upon connecting: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 45567, id=1, length=168 User-Name = "0016dbd4b7d5" User-Password = "0016dbd4b7d5" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00-21-91-F3-D2-21:My-radius" Calling-Station-Id = "00-16-EA-E5-C8-E6" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" ... No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. I've tried to search for the problem and I think it has to do with inner and outer identity since the User-Name is set to my MAC address. One solution suggested was to use virtual servers and have different users files for the outer and inner identity. But I haven't found an examples explaining how to do this. Per

5 8

Interesting new feature
by Alan DeKok 24 Apr '09

24 Apr '09

I've checked in some code to git that allows HUP to reload virtual server configurations. For now, all it does is reload the authorize, authenticate, accounting, pre-proxy, etc. sections. It does NOT reload listen sections, client sections, or anything else. However, it now allows you to update the policies in the virtual server configuration on the fly. If there is an error loading one of the virtual servers, then the NEW configuration for that virtual server is ignored, and the server keeps using the OLD (i.e. working) configuration. While there hasn't been a large demand for this feature, it's one step along the way to a complete reload on HUP, which *has* been requested. Alan DeKok.

3 4

Re: Hello Alan
by Glen Millard 23 Apr '09

23 Apr '09

On Thu, Apr 23, 2009 at 15:34, Glen Millard <glenmillard(a)gmail.com> wrote: > How are you sir? > > I will post this to the group if you want , but this is making me crazy: > > I am wondering the best way to troubleshoot this. > > Installing FreeRADIUS on CentOS 5: > radiusd: FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr > 23 2009 at 14:17:48 > > When I start it for the first time, it builds all of the 'fake' certs okay > and runs properly. > > (I am not sure if this would be an OpenSSL error or FreeRADIUS error. > What would you think the best way to troubleshoot this would be? > Or do you have any helpful hints?) > > However, when I attempt to build real certs, I see the following: > > > > > > > FreeRADIUS Version 2.1.5, for host i686-pc-linux-gnu, built on Apr 23 2009 at 14:17:48 > Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. > > There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A > PARTICULAR PURPOSE. > You may redistribute copies of FreeRADIUS under the terms of the > GNU General Public License v2. > Starting - reading configuration files ... > > including configuration file /usr/local/etc/raddb/radiusd.conf > including configuration file /usr/local/etc/raddb/proxy.conf > including configuration file /usr/local/etc/raddb/clients.conf > including files in directory /usr/local/etc/raddb/modules/ > > including configuration file /usr/local/etc/raddb/modules/acct_unique > including configuration file /usr/local/etc/raddb/modules/chap > including configuration file /usr/local/etc/raddb/modules/attr_rewrite > including configuration file /usr/local/etc/raddb/modules/preprocess > > including configuration file /usr/local/etc/raddb/modules/ippool > including configuration file /usr/local/etc/raddb/modules/pap > including configuration file /usr/local/etc/raddb/modules/checkval > including configuration file /usr/local/etc/raddb/modules/expiration > > including configuration file /usr/local/etc/raddb/modules/files > including configuration file /usr/local/etc/raddb/modules/realm > including configuration file /usr/local/etc/raddb/modules/sql_log > including configuration file /usr/local/etc/raddb/modules/linelog > > including configuration file /usr/local/etc/raddb/modules/detail.log > including configuration file /usr/local/etc/raddb/modules/logintime > including configuration file /usr/local/etc/raddb/modules/digest > including configuration file /usr/local/etc/raddb/modules/krb5 > > including configuration file /usr/local/etc/raddb/modules/inner-eap > including configuration file /usr/local/etc/raddb/modules/mschap > including configuration file /usr/local/etc/raddb/modules/perl > including configuration file /usr/local/etc/raddb/modules/attr_filter > > including configuration file /usr/local/etc/raddb/modules/etc_group > including configuration file /usr/local/etc/raddb/modules/counter > including configuration file /usr/local/etc/raddb/modules/smsotp > including configuration file /usr/local/etc/raddb/modules/radutmp > > including configuration file /usr/local/etc/raddb/modules/unix > including configuration file /usr/local/etc/raddb/modules/exec > including configuration file /usr/local/etc/raddb/modules/ldap > including configuration file /usr/local/etc/raddb/modules/passwd > > including configuration file /usr/local/etc/raddb/modules/mac2ip > including configuration file /usr/local/etc/raddb/modules/detail > including configuration file /usr/local/etc/raddb/modules/sradutmp > including configuration file /usr/local/etc/raddb/modules/wimax > > including configuration file /usr/local/etc/raddb/modules/otp > including configuration file /usr/local/etc/raddb/modules/policy > including configuration file /usr/local/etc/raddb/modules/smbpasswd > including configuration file /usr/local/etc/raddb/modules/detail.example.com > > including configuration file /usr/local/etc/raddb/modules/mac2vlan > including configuration file /usr/local/etc/raddb/modules/always > including configuration file /usr/local/etc/raddb/modules/expr > including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login > > including configuration file /usr/local/etc/raddb/modules/echo > including configuration file /usr/local/etc/raddb/modules/pam > including configuration file /usr/local/etc/raddb/eap.conf > including configuration file /usr/local/etc/raddb/policy.conf > > including files in directory /usr/local/etc/raddb/sites-enabled/ > including configuration file /usr/local/etc/raddb/sites-enabled/control-socket > including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel > > including configuration file /usr/local/etc/raddb/sites-enabled/default > including dictionary file /usr/local/etc/raddb/dictionary > main { > prefix = "/usr/local" > localstatedir = "/usr/local/var" > > logdir = "/usr/local/var/log/radius" > libdir = "/usr/local/lib" > radacctdir = "/usr/local/var/log/radius/radacct" > hostname_lookups = no > max_request_time = 30 > cleanup_delay = 5 > > max_requests = 1024 > allow_core_dumps = no > pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > checkrad = "/usr/local/sbin/checkrad" > debug_level = 0 > proxy_requests = yes > log { > > stripped_names = no > auth = no > auth_badpass = no > auth_goodpass = no > } > security { > max_attributes = 200 > reject_delay = 1 > status_server = yes > } > } > radiusd: #### Loading Realms and Home Servers #### > > proxy server { > retry_delay = 5 > retry_count = 3 > default_fallback = no > dead_time = 120 > wake_all_if_all_dead = no > } > home_server localhost { > ipaddr = 127.0.0.1 > port = 1812 > type = "auth" > > secret = "testing123" > response_window = 20 > max_outstanding = 65536 > require_message_authenticator = no > zombie_period = 40 > status_check = "status-server" > ping_interval = 30 > check_interval = 30 > > num_answers_to_alive = 3 > num_pings_to_alive = 3 > revive_interval = 120 > status_check_timeout = 4 > irt = 2 > mrt = 16 > mrc = 5 > mrd = 30 > } > home_server_pool my_auth_failover { > type = fail-over > > home_server = localhost > } > realm example.com { > auth_pool = my_auth_failover > } > realm LOCAL { > } > radiusd: #### Loading Clients #### > client localhost { > ipaddr = 127.0.0.1 > > require_message_authenticator = no > secret = "testing123" > nastype = "other" > } > radiusd: #### Instantiating modules #### > instantiate { > Module: Linked to module rlm_exec > Module: Instantiating exec > > exec { > wait = no > input_pairs = "request" > shell_escape = yes > } > Module: Linked to module rlm_expr > Module: Instantiating expr > Module: Linked to module rlm_expiration > Module: Instantiating expiration > > expiration { > reply-message = "Password Has Expired " > } > Module: Linked to module rlm_logintime > Module: Instantiating logintime > logintime { > reply-message = "You are calling outside your allowed timespan " > > minimum-timeout = 60 > } > } > radiusd: #### Loading Virtual Servers #### > server inner-tunnel { > modules { > Module: Checking authenticate {...} for more modules to load > Module: Linked to module rlm_pap > > Module: Instantiating pap > pap { > encryption_scheme = "auto" > auto_header = no > } > Module: Linked to module rlm_chap > Module: Instantiating chap > Module: Linked to module rlm_mschap > Module: Instantiating mschap > > mschap { > use_mppe = yes > require_encryption = no > require_strong = no > with_ntdomain_hack = no > } > Module: Linked to module rlm_unix > Module: Instantiating unix > unix { > radwtmp = "/usr/local/var/log/radius/radwtmp" > > } > Module: Linked to module rlm_eap > Module: Instantiating eap > eap { > default_eap_type = "md5" > timer_expire = 60 > ignore_unknown_eap_types = no > cisco_accounting_username_bug = no > max_sessions = 2048 > > } > Module: Linked to sub-module rlm_eap_md5 > Module: Instantiating eap-md5 > Module: Linked to sub-module rlm_eap_leap > Module: Instantiating eap-leap > Module: Linked to sub-module rlm_eap_gtc > Module: Instantiating eap-gtc > > gtc { > challenge = "Password: " > auth_type = "PAP" > } > Module: Linked to sub-module rlm_eap_tls > Module: Instantiating eap-tls > tls { > rsa_key_exchange = no > dh_key_exchange = yes > > rsa_key_length = 512 > dh_key_length = 512 > verify_depth = 0 > pem_file_type = yes > private_key_file = "/usr/local/etc/raddb/certs/server.pem" > certificate_file = "/usr/local/etc/raddb/certs/server.pem" > > CA_file = "/usr/local/etc/raddb/certs/ca.pem" > private_key_password = "rifywbi!" > dh_file = "/usr/local/etc/raddb/certs/dh" > random_file = "/usr/local/etc/raddb/certs/random" > > fragment_size = 1024 > include_length = yes > check_crl = no > cipher_list = "DEFAULT" > make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" > cache { > enable = no > lifetime = 24 > > max_entries = 255 > } > } > rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt > rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem > rlm_eap: Failed to initialize type tls > > /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". > /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. > > } > } > Errors initializing modules > > > >

3 4

Centos 5.3 problem
by Apostolos Pantsiopoulos 23 Apr '09

23 Apr '09

I was running freeradius 2.0.5 on my Centos 5.2 server using rlm_perl. When I upgraded to 5.3 I get : "rlm_perl: perl_parse failed: /billing/bin/billing.pl not found or has syntax errors." I googled it and found that this may be caused by libperl.so not being linked properly or Data::Dumper that needs to be recompiled. I have done everything that the mailing list suggested but the problem persists. Any ideas -- ------------------------------------------- Apostolos Pantsiopoulos Kinetix Tele.com R & D email: regs(a)kinetix.gr -------------------------------------------

2 2

how to Simultaneous-Use
by Tseveendorj 23 Apr '09

23 Apr '09

Hello, Following packages installed on my server. FreeRADIUS 2.1.4 Perl 5.8.9 p5-SNMP_Session-1.12 p5-Net-Telnet-3.03 MySQL-5.0.77 I decided to use SNMP_Session and BER modules. When I'm executing checkrad by hand then I got following message. # checkrad cisco 192.168.0.60 1645 tseveen 40 SNMP Error: Received SNMP response with error code error status: noSuchName index 1 (OID: 1.3.6.1.4.1.9.2.9.2.1.18.1645) SNMPv1_Session (remote host: "192.168.0.60" [192.168.0.60].161) community: "public" request ID: -17216476 PDU bufsize: 8000 bytes timeout: 2s retries: 5 backoff: 1) at /usr/local/sbin/checkrad line 221 checkrad: No SNMP answer from cisco. checkrad: not found! I thought maybe OID is not compatible for my router c3825. is it ? Can you please provide more information about NAS port and Session ID ? Tseveen.

3 4