August 2009 - Freeradius-Users - lists.freeradius.org

Password in Radius Debug
by Cody Jarrett 17 Mar '10

17 Mar '10

I notice the password during supplicant connects to the radius server are displayed in plain text. Is there a way to disable this? -- Cody Jarrett IT Freedom cody.jarrett(a)itfreedom.com Office: 512.419.0070 Fax: 512.419.0080

5 5

Re: Re: rlm_perl behavior
by Borislav Dimitrov 03 Mar '10

03 Mar '10

Hello, I just subscribed so I won't be able to quote properly but I hope at least the message is associated with the right thread (I found it on the web archive of the mailing list). I've been using FreeRADIUS for about 4 year now and it is a wonderful product - there's no question why you're No 1! For the past years of using and developing rlm_perl modules for FreeRADIUS, I've only been astonished and happy because of the new functionalities etc that the development team have been adding to the new releases. This all ended with this crippling

6 20

get attributes from multiple AD domains
by John 29 Jan '10

29 Jan '10

I follow up this link to set up freeRADIUS talk to AD, http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO It can work and can get VLAN attribute from AD through LDAP module (ldap_search). But we need to support 2 AD domains. NTLM_auth can work in multiple domains. But we can not get attributes from multiple domains. Anyone can give me some advice? Thanks. John. ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

3 3

Re: Decoupled accounting
by Devinder Singh 20 Jan '10

20 Jan '10

Hi Ivan Ok i managed to install ca.der and client.p12 on my XP When i run radiusd -X i get rad_recv: Access-Request packet from host 203.121.4.59 port 6001, id=30, length=216 User-Name = "devinder(a)palettemm.com" NAS-IP-Address = 203.121.4.59 Called-Station-Id = "00-20-a6-6c-49-9d:palstaff" Calling-Station-Id = "00-04-23-7b-56-b9" NAS-Identifier = "ORiNOCO-AP-700-6c-49-9d" State = 0xf30ae66df60debd09c91249e7b82f0a9 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0207002c0d000116030100205a6f866d20eb642ddc9f404f90d8650422eb751e7bb0199a016bb14e384df6fa Message-Authenticator = 0x06206416bbe520db012eb924f72ba75e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "palettemm.com" for User-Name = "devinder(a)palettemm.com" [suffix] No such realm "palettemm.com" ++[suffix] returns noop [eap] EAP packet type response id 7 length 44 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry devinder(a)palettemm.com at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 03b2], Certificate --> verify error:num=20:unable to get local issuer certificate [tls] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> devinder(a)palettemm.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 30 to 203.121.4.59 port 6001 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.8 seconds. Cleaning up request 0 ID 24 with timestamp +83 Cleaning up request 1 ID 25 with timestamp +83 Cleaning up request 2 ID 26 with timestamp +83 Cleaning up request 3 ID 27 with timestamp +83 Cleaning up request 4 ID 28 with timestamp +83 Cleaning up request 5 ID 29 with timestamp +83 Waking up in 1.0 seconds. Cleaning up request 6 ID 30 with timestamp +83 Ready to process requests. Users File "devinder(a)palettemm.com" Auth-Type := EAP DEFAULT Auth-Type := Reject Reply-Message = "Authentication Failed" 2009/8/3 Ivan Kalik <tnt(a)kalik.net>: >> Do i copy this file to the XP and install ca.der >> >> ca.der and client.p12 > > Yes. > > Ivan Kalik > Kalik Informatika ISP > > -- Devinder

1 5

Different realms for different databases
by liran tal 20 Dec '09

20 Dec '09

Hey, To allow authentication of different realms for 2 different databases the setup for the authentication is quite straight forward with the Autz-Type directive as follows: authenticate { ... Autz-Type SQL_EXAMPLE2 { sql_example2 } ... } Although the same trick wouldn't work for the accounting { } section as it complains on the Autz-Type directive: Error: ERROR: Cannot find a configuration entry for module "Autz-Type". Error: radiusd.conf[2089] Unknown module "Autz-Type". Error: radiusd.conf[2058] Failed to parse accounting section. What would be the way to configure accounting for the different realms in their correct databases? FreeRADIUS 1.1.7 and MySQL 5. Regards, Liran.

3 9

RE: Building a test tool
by Vinit Karandikar 22 Oct '09

22 Oct '09

Not sure how radclient will help, Tim. Based on my limited exposure, I get the impression that I can use radclient to simulate 1 network element (like the PDSN). I'm trying to simulate 10 different ones simultaneously. As mentioned in my initial email, I need the tool to simulate the PDSN, the Pre-Paid Server and hosts of other network elements (possibly 10 such like the Foreign AAA, the Carrier Exchange and so on...) Am I underestimating what the radclient can do ? > Message: 2 > Date: Mon, 1 Jun 2009 11:34:19 -0700 > From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> > Subject: RE: Building a test tool > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4a241f34.16538c0a.1328.ffffa6b7(a)mx.google.com> > Content-Type: text/plain; charset="us-ascii" > > Use the radclient tool. You can create test files that have the attributes > for the radius packets and feed them to radclient. > > NAME > radclient - send packets to a RADIUS server, show reply > > SYNOPSIS > radclient [-d raddb_directory] [-c count] [-f file] [-i id] [-n > num_requests_per_second] > [-p num_requests_in_parallel] [-r num_retries] [-s] [-S > shared_secret_file] [-t timeout] > [-qvx] server {acct|auth|status|disconnect|auto} secret > > DESCRIPTION > radclient is a radius client program. It can send arbitrary radius > packets to a radius > server, then shows the reply. It can be used to test changes you made > in the configura- > tion of the radius server, or it can be used to monitor if a radius > server is up. > > radclient reads radius attribute/value pairs from it standard input, > or from a file spec- > ified on the command line. It then encodes these attribute/value > pairs using the dictio- > nary, and sends them to the remote server. > > The User-Password and CHAP-Password attributes are automatically > encrypted before the > packet is sent to the server. > > Tim > > >> -----Original Message----- >> From: freeradius-users- >> bounces+tim.sylvester=networkradius.com(a)lists.freeradius.org >> [mailto:freeradius-users- >> bounces+tim.sylvester=networkradius.com(a)lists.freeradius.org] On Behalf >> Of Vinit Karandikar >> Sent: Monday, June 01, 2009 11:25 AM >> To: freeradius-users(a)lists.freeradius.org >> Subject: Building a test tool >> >> Hello folks, >> >> I'm new to Free Radius and would like to use it to build a test tool >> for >> testing a AAA server. >> >> I'd like the test tool to simulate (say) 10 network elements that talk >> to a AAA server >> - using threads on different ports that are controlled by the main >> thread. >> >> Some of these will initiate traffic to the AAA server (like the one >> simulating the PDSN). >> Others will receive traffic and talk back to the AAA server (like the >> one simulating the Pre-paid Server). >> >> I'm sure I'm not going to find something like this in the wild. So I'm >> planning to write code to do the above. >> >> I was wondering if there are bits of code that I can shamelessly pilfer >> from or use as a starting point. >> >> Any tips are plenty welcome... >> >> Thanks in advance to all, >> -Vinit >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > >

3 2

Re:Help with md5 database encryption (Oscar Trejo)
by Oscar Trejo 11 Oct '09

11 Oct '09

The version of the freeradius is v 1.1.0 I hope these is what you ask me. Thanks !!! > What freeradius version is this? > > Ivan Kalik > Kalik Informatika ISP > > > Dana 23/9/2008, "Oscar Trejo" <racso83(a)gmail.com> piše: > > >Hi, I had a freeradius server working, but only when the password are > saved > >on the database on plain-text with out encryption, my question is about > how > >to save the instructions on the table radcheck and radgroupcheck to work > >with Password encryption MD5. > > > >My working free radius tables had > > > >radcheck > >+----+----------+-----------+----+--------+ > >| id | UserName | Attribute | op | Value | > >+----+----------+-----------+----+--------+ > >| 3 | oscar | Password | == | uno | > >+----+----------+-----------+----+--------+ > > > >radgroupcheck > >+----+-----------+-----------+----+-------+ > >| id | GroupName | Attribute | op | Value | > >+----+-----------+-----------+----+-------+ > >| 1 | dinamico | Auth-Type | := | Local | > >+----+-----------+-----------+----+-------+ > > > > > > > >When i had the password with simple plaint text with out encryption the > >result is the next > > > >Auth: Login OK: [oscar/uno] (from client ##### port ########## cli > >##:##:##:##:##:##) > > > > > > > >But I want to save the password with MD5 encryption, the freeradius load > >correctly the module pap, chap and eap with out errors, but when i try to > >change the configuration for example : > > > >radcheck > >+----+----------+-----------+----+--------+ > >| id | UserName | Attribute | op | Value | > >+----+----------+-----------+----+--------+ > >| 3 | oscar | MD5-Password | == | 1eaa8bb195869a23f081acbb5bf08527 | > >+----+----------+-----------+----+--------+ > > > >radgroupcheck > >+----+-----------+-----------+----+-------+ > >| id | GroupName | Attribute | op | Value | > >+----+-----------+-----------+----+-------+ > >| 1 | dinamico | Auth-Type | := | PAP | > >+----+-----------+-----------+----+-------+ > > > > > >the free radius log gave me the next error: > > > > > >Error: rlm_sql_getvpdata: database query error > >Info: rlm_sql (sql): No matching entry in the database for request from > user > >[oscar] > >Auth: Login incorrect: [oscar/uno] (from client ##### port ########## cli > >##:##:##:##:##:##) > > > > > > > > > >But i need the encryption with MD5, any suggestion > > > >Before any answer I gave you thanks for the help > > >

5 6

Proxying accounting to create a "tee"
by John Morrissey 07 Oct '09

07 Oct '09

I'm looking to process RADIUS accounting locally (SQL) as well as proxy it to a remote host (to some third party software that also wants to receive a copy of all accounting). Is this possible with FreeRADIUS? john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

7 30

Problem with radzap
by Pierre-henri Baraffe 01 Oct '09

01 Oct '09

Hello, I have a mistake with my freeradius. On server with 1.1.7 the command : "radzap -u username -P port-nas 127.0.0.1 secret" work with no problem On a new server with FR 2.0.5, with the same command i have this error radclient:: failed to get value I have no more message with the "-x" option and nothing in the log. I have the same things if i replace "127.0.0.1" by "localhost" my client.conf client localhost { ipaddr = 127.0.0.1 secret = secret require_message_authenticator = no shortname = localhost nastype = other # localhost isn't usually a NAS... } I don't understand. Thanks for your help. ph

3 3

Accounting copying to specific systems
by Joe Maimon 27 Sep '09

27 Sep '09

Certain systems need copies of accounting data, but I only want to send a subset of accounting to the appropriate system. I dont want to change the way the server updates the sql accounting and local detail files. I want something like this acct.hints DEFAULT Client-IP-Address == "1.2.3.4", Hint := "FILTER-1" DEFAULT Client-IP-Address == "1.2.3.5", Hint := "FILTER-1" DEFAULT Client-IP-Address == "5.6.7.8", Hint := "FILTER-2" DEFAULT Client-IP-Address == "5.6.7.9", Hint := "FILTER-2" acct.users DEFAULT Hint == "FILTER-1", Copy-To := "filter-1-system" DEFAULT Hint == "FILTER-2", Copy-To := "filter-2-system" Where both filter-1-system and filter-2-system are defined in proxy.conf and obviously Copy-To is wishful thinking. Am I headed in the right direction or is there a better way to do this? Thanks, Joe

3 18