July 2009 - Freeradius-Users - lists.freeradius.org

wrt54g and freeradius
by Gustavo Marcello 30 Jul '09

30 Jul '09

Hello everyone. I need to contact someone who knows how to do or able to use a lynksys WRT54G to authenticate users against a freeradius server, I am having trouble implementing it. I already have the freeradius to work well with a mysql database and try radtest works fine. But wanting to do this through the WRT54G does not work. I need someone who can help me. (I have the default configuration files.) I think it is important to stress that I want the users not authenticate can not access the network, ie, I do not want to use a hotspot system ... I want to deny access to the router if you do not have username and password. I already have a wifidog work well with freeradius and LDAP, but I do not like the solution because users access the network before authenticating. Moreover, to implement this workaround, I could not use the WRT54G because it has little memory and does not enter the open-wrt. I had to use WRT54GL, which are very difficult to find in Argentina. Thanks! Gustavo.

2 2

Re: groupcmp fails during tunneled request
by Matthieu Lazaro 30 Jul '09

30 Jul '09

2 5

mschap auth for multiple realms off different domain ctlrs?
by Ross Wheeler 30 Jul '09

30 Jul '09

I've inherited a system which now needs changed and I can't seem to make it do it! I'm sure it can, but I'm just not familiar enough with FreeRadius to know how to coax it into doing what I need. Its a fairly old system, FreeRADIUS Version 1.1.3 Remote users connect to the host using windows VPN client, hence MS-CHAPv2, call terminates on mpd running on freebsd which auths from using freeradius on the same host. That all works. Problem is, the client has been like the borg and assimilated another company and needs to support their roaming users too. so now users log in as user and the request is done via ntlm request to their primary domain controller 10.1.1.1 in realm company1.local This is configured in krb5.conf as far as I can determine. FreeRadius also looks for a specific group membership with "--require-membership-of=company1-vpn-users" I now need to support (additionally) another set of users logging in as otheruser who will need to specify their realm as company2 I can get freeradius to "see" otheruser(a)company2.local and it splits the username and realm out (as seen with radiusd -X) but what I can't figure out is how to tell it to still use the "local" auth but to know that it now has to use "company2.local" for its realm, to ask 10.1.1.3 instead of 10.1.1.1, and to look for group membership of "company2-vpn-users". I thought I could perhaps use a variable and set that within a specific realm{} definition during auth, but I can't see how to define/use variables other than attributes offered or returned. I have used ntlm_auth --request-nt-key --username=user --password=xxx --domain=COMPANY1.LOCAL --require-membership-of=COMPANY1-VPN-USERS ntlm_auth --request-nt-key --username=otheruser --password=xxx --domain=COMPANY2.LOCAL --require-membership-of=COMPANY2-VPN-USERS and I get the right answers, so looks like the settings in my krb5.conf are working, but I just can't see how to get freeradius to make the request this way. (Yes, I know the correct request will use --challenge= and --nt-response= but I'm "assuming" if I can get the rest of the request right, it'll "just work") Any help please? I've googled and tried more things than I can document here without driving you nuts! RossW

3 3

/usr/local/sbin/radiusd -X problem
by shivashankar 30 Jul '09

30 Jul '09

hi All, i am using freeradius2.1.6 on solaris 10 when i run server i am getting following error bash-3.00# /usr/local/sbin/radiusd -X FreeRADIUS Version 2.1.6, for host sparc-sun-solaris2.10, built on Jul 30 2009 at 20:25:20 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.0.0/24 { require_message_authenticator = no secret = "testing123-1" shortname = "private-network-1" } client 192.168.0.0/16 { require_message_authenticator = no secret = "testing123-2" shortname = "private-network-2" } client 10.232.170.228/16 { require_message_authenticator = no secret = "testing123" shortname = "private-network-2" } client 10.232.170.228 { require_message_authenticator = no secret = "testing123" shortname = "liv1" nastype = "livingston" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } /usr/local/etc/raddb/certs/bootstrap: make: not found /usr/local/etc/raddb/certs/bootstrap: openssl: not found Exec-Program output: Exec-Program: returned: 1 rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Errors initializing modules plz hlp me out -- View this message in context: http://www.nabble.com/-usr-local-sbin-radiusd--X-problem-tp24737309p2473730… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

urgent
by RANDRIAMAMPIONONA José Johnny 30 Jul '09

30 Jul '09

Greetings, It makes two days that I tried to find something about dialupadmin installation (with LDAP) but it was in vain. I thought that I can replace it with something like phpRadmin but phpRadmin web site doesn't work(maybe in my country or...): I was not able to download the source. It will be helpfull if someone gives me some steps to follow or some web site where I can find a guide ... Best regards ... Free 4ever! -- JJohnny R. vasiana09(a)gmail.com

2 1

Received radius reply from wrong address
by Oguzhan Kayhan 30 Jul '09

30 Jul '09

Hi, i have 2 virtual servers with 2 ip addresses on same subnet.. For ex for virtserver1 192.168.1.10 virtserver2 192.168.1.11 I have a NAS Server (on a different ip subnet) with 2 different configs running on 2 different interfaces also. But as i see i got the msg Received radius reply from wrong address from them whenever i try to send a req to radius for authentication. It seems like radius answers back to the nas from first interface instead of replying from the original source address. Isnt radius suppose to reply with the same destination address it receives??? It is FreeRADIUS Version 2.0.5

3 4

Re: Freeradius-Users Digest, Vol 51, Issue 132
by Gilbert Lo 30 Jul '09

30 Jul '09

Thank you for your message. I am away until August 7th. I will respond to your message on my return . For urgent matters, please contact helpdesk(a)stgeorges.bc.ca . Cheers, Gilbert Lo

1 0

RE: rlm_perl problems]
by sigor＠blic.net 30 Jul '09

30 Jul '09

Igor wrote: >I have tried 2.1.7 and got same error. I will try to compile it with >--enable-developer and see if i can find out anything from gdb output. >I realy don't know why would this happen because exactly the same setup worked on >older releases. All i did was to compile the new version (2.1.6) and then copy >old raddb dir. I am not sure why i got so many "no debugging symbols found" but i did per doc/bugs instructions. This is gdb output: gdb radiusd GNU gdb Fedora (6.8-27.el5) Copyright (C) 2008 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "i386-redhat-linux-gnu"... (no debugging symbols found) (gdb) set logging file gdb-radiusd.log (gdb) set logging on Copying output to gdb-radiusd.log. (gdb) set args -X -x -n radiusd_dialup -l /var/log/radius/dialup/radius.log (gdb) run Starting program: /usr/local/freeradius/sbin/radiusd -X -x -n radiusd_dialup -l /var/log/radius/dialup/radius.log (no debugging symbols found) (no debugging symbols found) [Thread debugging using libthread_db enabled] [New Thread 0xb7fe0ad0 (LWP 11159)] GOT CLONE -1208087856 0x9c56290 Program received signal SIGSEGV, Segmentation fault. 0x0041a0f5 in rlmperl_call (instance=0x9a0d5e0, request=0x9cad318, function_name=0x9a07258 "authorize") at rlm_perl.c:708 708 exitstatus = POPi; (gdb) info threads * 1 Thread 0xb7fe0ad0 (LWP 11159) 0x0041a0f5 in rlmperl_call (instance=0x9a0d5e0, request=0x9cad318, function_name=0x9a07258 "authorize") at rlm_perl.c:708 (gdb) thread apply all bt full Thread 1 (Thread 0xb7fe0ad0 (LWP 11159)): #0 0x0041a0f5 in rlmperl_call (instance=0x9a0d5e0, request=0x9cad318, function_name=0x9a07258 "authorize") at rlm_perl.c:708 sp = (SV **) 0x9cc8088 vp = <value optimized out> exitstatus = 0 n_a = 46 rad_reply_hv = (HV *) 0x9cb58a8 rad_check_hv = (HV *) 0x9c88500 rad_config_hv = <value optimized out> rad_request_hv = (HV *) 0x9c93e9c rad_request_proxy_hv = (HV *) 0x9c8bd68 rad_request_proxy_reply_hv = (HV *) 0x9cb58cc interp = <value optimized out> #1 0x08061834 in modcall () No symbol table info available. #2 0x0805e790 in indexed_modcall () No symbol table info available. #3 0x0805ea7c in module_authorize () No symbol table info available. #4 0x0804e37f in rad_authenticate () No symbol table info available. #5 0x0806c5fa in radius_handle_request () No symbol table info available. #6 0x0806450c in thread_pool_addrequest () No symbol table info available. #7 0x08069969 in event_socket_handler () No symbol table info available. #8 0x00154085 in fr_event_loop (el=0x9c528d8) at event.c:400 ef = (fr_event_fd_t *) 0x9c52988 i = 1 rcode = 1 when = {tv_sec = 1248559880, tv_usec = 267216} wake = <value optimized out> read_fds = {fds_bits = {1048576, 0 <repeats 31 times>}} #9 0x0806a666 in radius_event_process () No symbol table info available. #10 0x080625d6 in main () No symbol table info available. (gdb)

5 11

Re: [RE]Problem with proxied accounting
by Ivan Kalik 29 Jul '09

29 Jul '09

> We have just upgraded to FreeRADIUS 2.1.6, but unfortunately the problem > persists: > > > > Server1/: > total 1008236 > -rw------- 1 root root 714751062 Jul 29 11:53 detail-20090729 > -rw------- 1 root root 316653344 Jul 29 07:29 detail.work <= stuck! > > > We got sometimes the following message for Server2: > > Thu Jul 23 15:00:45 2009 : Proxy: No outstanding request was found for > proxy reply from home server <Server2 IP address> port 1813 - ID 142 > And several messages for Server1: > > Wed Jul 29 11:36:53 2009 : Error: Rejecting request 3993531 due to lack of > any response from home server <Server1 IP address> port 1813 > Wed Jul 29 11:36:53 2009 : Error: PROXY: Marking home server <Server1 IP > address> port 1813 as zombie (it looks like it is dead). > Wed Jul 29 11:37:28 2009 : Info: Suspicious proxy state... continuing > Wed Jul 29 11:37:30 2009 : Error: Rejecting request 3998634 due to lack of > any response from home server <Server1 IP address> port 1813 > <...> > > > > In an attempt to force the revival of Server1, we scheduled the execution > of the following command every minute: > > radmin -e "set home_server state <Server1 IP address> 1813 alive" > Ugh, don't do that. > > > But still, it seems to stuck ... I checked with "tcpdump port 1813 and > host <Server1 IP address>" that even though the details.work for Server1 > is freezed, FreeRADIUS is sending accounting requests to Server1 and it is > receiving accounting responses. > > > > # tcpdump port 1813 and host <Server1 IP address> > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes > 11:39:27.667255 IP <FreeRADIUS IP address>.1814 > Server1.radius-acct: > RADIUS, Accounting Request (4), id: 0x0c length: 202 > 11:39:27.675969 IP Server1.radius-acct > <FreeRADIUS IP address>.1814: > RADIUS, Accounting Response (5), id: 0x0c length: 20 > <...> Is there a firewall blocking requests? Server1 is sending responses but they are not reaching the proxy. Ivan Kalik Kalik Informatika ISP

1 0

Re: Captive portal: can I use chap or pap in conjunction with ntlm_auth?
by john 29 Jul '09

29 Jul '09

>> >> Is there a way for me to use pap with users stored in Active Directory? > > Yes. If you followed AD integration document you have already done that. > Now, the best way to integrate that with accounts stored elsewhere (files, > sql, ldap, etc.) is to create failover after pap in authorize section of > default virtual server (instead of forcing it in users file): > > if(!Auth-Type) { > update control { > Auth-Type = "ntlm_auth" > } > } > Awesome. Thank you that worked like a charm! John

2 1