February 2010 - Freeradius-Users - lists.freeradius.org

Radius + PostgreSQL + MD5 Passwords
by Phillip Smith 08 Feb '10

08 Feb '10

Well I've spent the better part of the last 9 hours trying to figure this out, but I can't seem to get it.... What I am trying to do: Central FreeRADIUS server with PostgreSQL database for remote ChilliSpot appliances to auth against. My problem: I'm strongly against storing passwords in clear text so I want the passwords in PostgreSQL to be MD5 or SHA1 hashed. Everything I've read through Google seems to be indicating that for any form of encryption to work between the client and server, that the database has to use clear text passwords. I have successfully got the FreeRADIUS + PostgreSQL combination working with clear text, but I can not make the move to hashed passwords. 1) It what I am trying to do possible? 2) If so, is it possible without any significant drawbacks? 3) Any pointers in the right direction to how to achieve what I am after? Cheers, ~p

3 6

NAS Client Behind a NAT Router
by Fahd Kasri 08 Feb '10

08 Feb '10

Hi, Suppose I have a client that's behind a NAT router and uses a Freeradius server that's on another network. What ports (if any) should be redirected to the client in order to have full functionality? Thanks. -- Fahd

2 5

Run user defined scripts on client connect and disconnect
by Josh Willmarth 08 Feb '10

08 Feb '10

Hello, I have a radius server setup with version 2.1.8. Is there a way that I can have custom scripts run each time a user successfully connects to and disconnects from my radius server? If so, what environment variables can be passed to these scripts? Sorry if I missed this in the documentation, but I was unable to find the exact answer I am looking for. Thank you, Josh Willmarth

4 4

Invitation to connect on LinkedIn
by Eduardo Gui 08 Feb '10

08 Feb '10

LinkedIn ------------Eduardo Gui requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Eduardo Accept invitation from Eduardo Gui http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… View invitation from Eduardo Gui http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… ------------------------------------------ DID YOU KNOW that LinkedIn can find the answers to your most difficult questions? Post those vexing questions on LinkedIn Answers to tap into the knowledge of the world's foremost business experts: http://www.linkedin.com/e/ask/inv-23/ ------ (c) 2010, LinkedIn Corporation

1 0

Too many closing braces / Errors reading
by Teguh Kurniawan 08 Feb '10

08 Feb '10

Hello, I need your advice. What's wrong with my configuration ? # radiusd -X FreeRADIUS Version 2.1.8, for host i686-pc-linux-gnu, built on Feb 7 2010 at 21:14:00 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf /usr/local/etc/raddb/clients.conf[172]: Too many closing braces Errors reading /usr/local/etc/raddb/radiusd.conf Best regards, Teguh

2 3

EAP-AKA support in FreeRadius?
by hongjianli.nudt＠gmail.com 07 Feb '10

07 Feb '10

Hi, list, Anybody konw if EAP-AKA is supported in FreeRadius? If do, Where do I find some information about it? TKS! 2010-02-08

1 0

Freeradius + External PHP script
by X.x - x.X 07 Feb '10

07 Feb '10

Hello everyone :) I'm having some problems with Freeradius, which I'm sure some folks here will know how to solve. :) Version: 2.0.4 (debian custom build to support SSL) Objective: Upon receiving a request with a username & password (from NAS), Freeradius should invoke an external script (PHP in this case). Script should look-up the username/password, and based on some internal logic return an Access-Accept or Access-Reject. In case of a Access-Accept, script should also provide some VLAN information. Prefered method is EAP/TTLS. I haven't been able to find much info on this subject (maybe I'm looking in wrong place?). This is what I have so far (only the important parts): *radiusd.conf* exec php { wait = yes program = "/usr/bin/php -f myscript.php" input_pairs = request output_pairs = reply } *site-enabled/default* authenticate { Auth-Type TEST { php } *users* DEFAULT Auth-Type := TEST *myscript.php* (simplified version) <?php $user = getenv("USER_NAME"); $password = getenv("USER_PASSWORD"); if ($user == "test" && $password == "test") { echo "Access-Accept"; echo "Tunnel-Type = 13," echo "Tunnel-Medium-Type = 6," echo "Tunnel-Private-Group-Id = 1" } else echo "Access-Reject"; ?> The echo-part in myscript.php is obviously wrongly implemented, so please help.. With the above mentioned, invoking the script works, but always returns Access-Accepted packet (testing with radtest utility). _________________________________________________________________ Hotmail: Free, trusted and rich email service. https://signup.live.com/signup.aspx?id=60969

2 2

Upgrade from 1.3 to 2.0
by Account for FreeRadius mail list 06 Feb '10

06 Feb '10

Hello, We just upgraded one of our FreeRadius servers from 1.3 to 2.0 (part of a debian upgrade from Etch to Lenny). Anyway one of the problems I'm having is updating the "proxy.conf" file. It states that one should move away from the "realm" entry to the "home_server" entry. So I have changed this entry in the proxy.conf file: realm somedomain.net { type = radius authhost = wendy.somedomain.net:1645 accthost = LOCAL secret = ItsSecret nostrip } to: home_server somedomain.net { type = auth virtual_server = wendy.somedomain.net port = 1645 secret = ItsSecret response_window = 7 zombie_period = 40 status_check = status-server check_interval = 20 num_answers_to_alive = 3 } I had tried the "ipaddr =" command as well. Anyway the authentication request to the wendy.somedomain.net server is not getting through using this new "home_server" entry. What am I doing wrong" Thanks, Ken

2 1

problem with freeradius daemon start
by Eddy Ruiz Azcuy 06 Feb '10

06 Feb '10

Hi friends , I'm trying to install freeradius in Debian Lenny for using WPAEnterprise in a Trendnet AP. I downloaded the latest stable version (2.1.8),created the packages with dpkg-buildpackage -b -uc. that created the following modules der freeradius-dialupadmin_2.1.8+git_all.deb freeradius-postgresql_2.1.8+git_i386.deb p12 freeradius_2.1.8+git_i386.changes freeradius-iodbc_2.1.8+git_i386.deb freeradius-server-2.1.8 pass freeradius_2.1.8+git_i386.deb freeradius-krb5_2.1.8+git_i386.deb freeradius-utils_2.1.8+git_i386.deb pem freeradius-common_2.1.8+git_all.deb freeradius-ldap_2.1.8+git_i386.deb libfreeradius2_2.1.8+git_i386.deb freeradius-dbg_2.1.8+git_i386.deb freeradius-mysql_2.1.8+git_i386.deb libfreeradius-dev_2.1.8+git_i386.deb I installed the .deb files with dpkg -i but when tried to start freeradius with /usr/sbin/freeradius -X to debug the process I receive the following message: Please If anyone could shed any light on this.It would be appreciated Thanks in advance. ==================================================================================================================================================== nas1:/usr/src# /usr/sbin/freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Feb 5 2010 at 16:17:03 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } rlm_eap: SSL error error:02001002:system library:fopen:No such file or directory rlm_eap_tls: Error reading certificate file /etc/freeradius/certs/server.pem rlm_eap: Failed to initialize type tls /etc/freeradius/eap.conf[17]: Instantiation failed for module "eap" /etc/freeradius/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /etc/freeradius/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section.

2 1

ldap Deprecated conditional expansion
by Harry Hoffman 05 Feb '10

05 Feb '10

Hi All, I keep seeing this in the logs: [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details I assume it's from this filter: [ldap] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(!(inetCOS=802.1x_disabled))) -> (&(uid=hh52)(!(inetCOS=802.1x_disabled))) but I'm not sure what uid=%{Stripped-User-Name:-%{User-Name} should be set to instead. Any ideas? Cheers, Harry

2 1