July 2009 - Freeradius-Users - lists.freeradius.org

CPU selection for highest performance
by Padam J Singh 23 Jul '09

23 Jul '09

3 3

using (finding) mysql
by Rakotomandimby Mihamina 23 Jul '09

23 Jul '09

(some MTA problems... re send) Hi, I would like my freeradius to use PG SQL (no UNIX /etc/passwd nor users flat file) in /etc/freeradius/sites-enabled/default [...] # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module in radiusd.conf. # # unix # Read the 'users' file files # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd [...] The file containing the 'sql' module: /etc/freeradius/sql.conf When I launch "freeradius -X" I got about finding the 'sql' module...: radius20:/etc/freeradius# freeradius -X FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Sep 7 2008 at 17:42:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql/postgresql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 4 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 41.204.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "quarante_un_deux_cent_quatre" nastype = "livingston" login = "!root" password = "someadminpas" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } /etc/freeradius/sites-enabled/default[153]: Failed to find module "sql". /etc/freeradius/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 1

freeradius2 using ldap/users file
by fous 23 Jul '09

23 Jul '09

hi i'm using radiusd: FreeRADIUS Version 2.1.6, for host i386-portbld-freebsd7.2 server configured with ldap. this works fine. we've got few users which would like to authorize via users file. but my radius always searches for the password in the ldap. is this behaviour normal? (these users have account in ldap and also in users file, but with different passwords) is there any way to go through? :) (i couldn't find anything) thaks for help fous -- View this message in context: http://www.nabble.com/freeradius2-using-ldap-users-file-tp24589272p24589272… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Re: Freeradius-Users Digest, Vol 51, Issue 100
by jaswinder kaur 23 Jul '09

23 Jul '09

Hello Ivan, Yes, It is a Upcoming project. I would appreciate whatever help I get from you or any reference to where I can get more information from. We have our users on the aaaa.example.com domain and are in edirectory environment. But our users are going to share a big part of the building with another company who are a totally different domain controlled by active directory. Our management wants us to create a radius infrastructure so that a user irrespective of their company, plug their laptop in a available socket, and gets put into the right domain and all the other network services based on their login credentials. Many Thanks, Jas Message: 4 Date: Thu, 23 Jul 2009 10:14:59 +0100 (BST) From: "Ivan Kalik" <tnt(a)kalik.net> Subject: Re: Freeradius With edirectory and Active directory To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <53179.194.176.105.44.1248340499.squirrel(a)webmail.kalik.net> Content-Type: text/plain;charset=utf-8 > Is it possible to have freeradius integrated in a environment with two > totally different domains, one controlled by edirectory and the other by > active directory? Yes. You will need to create two mschap instances (one with ntlm_auth and one without) and failover in Auth-Type MS-CHAP. Auth-Type MS-CHAP { mschap_default { reject = 2 } if(reject) { mschap_ad } } Where mschap_default is a copy of default mschap module while mschap_ad has ntlm_auth line enabled. This applies to AD + anything else (ldap, sql, users file stored passwords). If you are going to have pap requests as well you should add failover to ntlm_auth after pap: if(!Auth-Type) { update control { ntlm_auth } } Is there interest for this? I can write a guide how to combine authentication of AD stored accounts with those stored elsewhere (ldap, sql, users file). Ivan Kalik Kalik Informatika ISP ------------------------------ Yahoo! recommends that you upgrade to the new and safer Internet Explorer 8. http://downloads.yahoo.com/in/internetexplorer/

1 0

using (finding) mysql
by Rakotomandimby Mihamina 23 Jul '09

23 Jul '09

Hi, I would like my freeradius to use PG SQL (no UNIX /etc/passwd nor users flat file) in /etc/freeradius/sites-enabled/default [...] # Pull crypt'd passwords from /etc/passwd or /etc/shadow, # using the system API's to get the password. If you want # to read /etc/passwd or /etc/shadow directly, see the # passwd module in radiusd.conf. # # unix # Read the 'users' file files # Look in an SQL database. The schema of the database # is meant to mirror the "users" file. # # See "Authorization Queries" in sql.conf sql # If you are using /etc/smbpasswd, and are also doing # mschap authentication, the un-comment this line, and # configure the 'etc_smbpasswd' module, above. # etc_smbpasswd [...] The file containing the 'sql' module: /etc/freeradius/sql.conf When I launch "freeradius -X" I got about finding the 'sql' module...: radius20:/etc/freeradius# freeradius -X FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Sep 7 2008 at 17:42:33 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql/postgresql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 4 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 41.204.0.0/16 { require_message_authenticator = no secret = "testing123" shortname = "quarante_un_deux_cent_quatre" nastype = "livingston" login = "!root" password = "someadminpas" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } /etc/freeradius/sites-enabled/default[153]: Failed to find module "sql". /etc/freeradius/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 2

mysqld connecting problem
by shivashankar 23 Jul '09

23 Jul '09

hi, miboss3# /usr/sfw/sbin/mysqld Fatal error: Please read "Security" section of the manual to find out how to run mysqld as root! 090723 7:23:37 Aborting 090723 7:23:37 /usr/sfw/sbin/mysqld: Shutdown Complete please help me -- View this message in context: http://www.nabble.com/mysqld-connecting-problem-tp24620450p24620450.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Freeradius With edirectory and Active directory
by jaswinder kaur 23 Jul '09

23 Jul '09

Hello All, Is it possible to have freeradius integrated in a environment with two totally different domains, one controlled by edirectory and the other by active directory? Thanks, Sam See the Web's breaking stories, chosen by people like you. Check out Yahoo! Buzz. http://in.buzz.yahoo.com/

2 1

Guide: Upgrading to version 2
by Alan DeKok 23 Jul '09

23 Jul '09

I've written a 40 page guide on how to upgrade from version 0.X to the latest version of the server. It is currently available to customers of Network RADIUS who have purchased support agreements. The document covers all of the configuration items in radiusd.conf, and also the common modules. It documents when the configuration first appeared, and how its behavior changed over time. For configurations that have been deprecated or removed, it documents suggested replacements. It talks about how to manage the upgrade process, along with potential downgrades if something goes wrong. If anyone else is interested in the document, please email me privately: aland(a)networkradius.com I need to decide what else to do with the document. Knowing how many people are interested in it is a first step. Alan DeKok.

2 2

FR1 -> FR2: authenticate_query
by Rakotomandimby Mihamina 23 Jul '09

23 Jul '09

I am in the process of migrating from freeradius v1.4 to v2 I am running Debian Lenny, all installed from packages. I am first trying to merge the configuration. I use Postgresql behind. In the v1: ####################################################################### # Authentication Query ####################################################################### #authenticate_query = "SELECT Value,Attribute FROM ${authcheck_table} \ # WHERE UserName = '%{User-Name}' AND ( Attribute = 'User-Password' OR Attribute = 'Crypt-Password' ) \ # ORDER BY Attribute DESC" authenticate_query = "We put ours here....." # Postauth query # postauth_query = "INSERT INTO radreply (username, attribute,op,value) VALUES ('%{SQL-User-Name}', 'Session-Timeout', '=','100')" I did not find 'authenticate_query' in the v2 default 'postegressql/dialup.conf' file. Have I just to add what we have in v1? -- Architecte Informatique: Administration Systeme, Recherche & Developpement + 261 32 11 401 65 Pensez a l'environnement avant d'imprimer ce message

2 1

Re: Connecting freeRadius to openLDAP
by Mackey, Theral 22 Jul '09

22 Jul '09

The docs do tend to gloss over the bits about how to get the needed password into your LDAP store (besides just saying cleartext or LN/NT). First, check that the user you have setup for ldap to use has auth (not read) access to the userPassword attribute, which I think is true since you said radtest works for ldap users. That user (and really only that user (hopefully not using the superuser)) should also be able to read the LM/NT password fields ( access to attrs=sambaLMPassword,sambaNTPassword by ssf=128 dn.exact="cn=LdapProxyUser,dc=example,dc=com" read by self write by * none, the ssf=128 only allows if ssl/tls is used). These fields are in the samba.schema file, which you will have to go look for (usually in the samba package), and are typically labeled sambaLMPassword and sambaNTPassword, depending on which version of that schema you get. Edit the ldap.attrmap file to match the field names, should be obvious what to change in there, if needed. Add the sambaSamAccount class to your users*, and once the fields are there, use the samba password util to generate the hashes by hand (cant remember its name, smbpasswd?), use the perl Cypt::SmbHash module to build a perl-script to hash them, or look in the contrib/ dir of the openldap source for the smbk5pwd module** that will autogen and sync the hashes whenever someone changes their pw (if pw changes are set to use ldap exop). Since you are using the Atlassian openLDAP, Im guessing the module option is out, though you can probably recompile openLDAP from source with the module and just make sure their schemas are put in place and use a slapcat ldiff to repopulate, or create a separate LDAP tree and tell the atlassian stuff to auth to it instead, or use crowd... Once LM/NT passwords are good, just turn on mschapv2 and have an SSL cert ready for it with the windowsxp v3 extensions and it should "just work" after all that ;) . -T * sambaSID is a required value for this schema, if you don't already have SIDs for your users (AD assigns them in Windoze land), and no grand scheme for this to be critical, something like S001-100-$uidNumber works well **compiling this requires either heimdal dev libs present during compile, or editing the makefile and src to disable the heimdal lib includes (and thus krb5 (kerberos) hash support). This also means, if you add the krb5 schema to ldap, you can use this module to sync your kerberos pass as well. ----- Original Message ----- Date: Wed, 22 Jul 2009 10:54:57 -0500 (CDT) From: Eric Bourkland <eric.bourkland(a)trustedconcepts.com> Subject: To: tnt(a)kalik.net, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <10598636.13761248278097270.JavaMail.root(a)tci01.managed.contegix.com> Content-Type: text/plain; charset=utf-8 What would be the best solution since freeRadius currently can't get the password out of my openLDAP unless it is using PAP, it gets the password in the request via PEAP. I would like to avoid having to tell everyone with a windows client that they need to install SecureW2. What would be nice is if it was smart enough to recieve the request in multiple formats/protocols and then translate it into multiple formats/protocols to query out to flat file/DB/LDAP or AD instead of just passing the request along. Although there is the risk of something getting messed up with scripts converting protocols and there are probably a million different scenarios out there. Maybe I'm missing something since I'm still new to Radius. Is the easiest thing to do is to monkey with the openLDAP schema and add some cleartext password attributes? If I get this done is there some place in one of the config files that I need to update to look for a particular password attribute when Radius tries to do the authentication or does it figure it out for itself? I have been beating my head against a wall for about a week on this and the documentation mocks me by always saying it just works.

1 0