March 2010 - Freeradius-Users - lists.freeradius.org

accounting on msql
by omega bk 15 Mar '10

15 Mar '10

hi, just want to manage accounting on mysql so i coyed the schema.sql in /etc/freeradius, did mysql -u root -p accounting < schema.sql and i got this. *ERROR 1064 (42000) at line 17: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '[radacct] ( [RadAcctId] [numeric](21, 0) IDENTITY (1, 1) NOT NULL , [AcctSessi' at line 1* i compare the schema.sql to one at http://wiki.freeradius.org/MS-SQL_DDL_script , nothing changed. somebody as a clue? thanks

2 1

Dynamically assign realm name when using DEFAULT realm
by Jer Peterson 15 Mar '10

15 Mar '10

I am using FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu I am trying to take the username of a format 'realm/username' and have FreeRADIUS take the 'realm' and pass it on in a sql query using %{Realm} and take the 'username' and pass it on with %{SQL-User-Name}. I have found I can do a DEFAULT realm, but the realm is passed on as DEFAULT instead of the name of the realm that was tried. Is there a better way to get the realm the user entered and pass it on in a SQL query? I have a SQL table with usernames and locations. When a user authenticates I want the username to match the username field only if the realm matches the location field in the database. Jer

1 0

ldap auto header MS-CHAPv2
by omega bk 15 Mar '10

15 Mar '10

hi, how can i handle encrypted users's ldap password ? pap reckognize my ssha1 from base64 encoding => because of the auto_header to yes but it looks like MS-CHAP does not kwow how to deal with... [ldap] Added User-Password = {SSHA}2FJYOM+C3mqL2g6wOhcLfjMY2XdoQ4bi in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Cleartext-Password == "{SSHA}2FJYOM+C3mqL2g6wOhcLfjMY2XdoQ4bi" [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing SSHA1-Password from base64 encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject thank u

3 4

Re: MS-CHAP2-Response is incorrect + invalid NT-Password
by omega bk 15 Mar '10

15 Mar '10

sorry for spamming, i just want to understand *OpenLDAP knows the clear text password:* [ldap] userPassword -> Cleartext-Password == "test " [ldap] userPassword -> NT-Password == 0x7465737420 *=> supposed to be the hash password* [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} *Is the inner tunnel part of the MSCHAPv2 is failing because it doesn't kwow the way of dealing with the password supplied ?* *Adding into ldap.attrmap the userPassword -> NT-Password is enough to produce a correct NT hash password? *[mschap] Invalid NT-Password * * [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE

3 8

Hi,
by Axel Grimm 15 Mar '10

15 Mar '10

Hi i have little question. I use Freeradius with mysql an a dd-wrt Linksys Router as NAS. How can i setup a MAC Adress auth that user do not need login and Passwort ? THX Axel

2 1

Re: MS-CHAP2-Response is incorrect + invalid NT-Password
by omega bk 15 Mar '10

15 Mar '10

hello, i'm still stuck and don't know how to make it work i added in ldap.attrmap: checkItem Cleartext-Password userPassword checkItem NT-password userPassword but i stil have: [ldap] expand: %{User-Name} -> bernard [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=bernard) [ldap] expand: dc=example,dc=com -> dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=example,dc=com, with filter (cn=bernard) [ldap] Added User-Password = test in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> NT-Password == 0x7465737420 [ldap] userPassword -> Cleartext-Password == "test " [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} *[mschap] Invalid NT-Password [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect* ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject I don't understand why i still got an invalid NT-Password. thanks for your help

1 1

LDAP, old TCP connections, and retry
by Justin Steward 14 Mar '10

14 Mar '10

Hi Guys, A few quick questions on tweaking rlm_ldap for freeradius. Question 1: The LDAP server which the radius server attempts to connect to is located behind a firewall which kills TCP connections that have been idle for 30 minutes. FR then tries to do a lookup using a connection that has been open and idle for half an hour or more, and the firewall drops the now invalid connection. How can I force an idle timeout on LDAP connections in FR? Question 2: >From the information I have been given, it appears that if the connection times out, LDAP does not attempt to retry. Is there a way to force FR to make 1 or 2 attempts at retrying the connection before giving up on LDAP? The current situation is causing many headaches trying to log in, and the client is reluctant to relax their firewall for a number of reasons. Many Thanks, Justin Steward

2 4

Access-Reject packet from host 127.0.0.1 port 1812, id=29, length=34
by Suman Dash 14 Mar '10

14 Mar '10

Hi, I am unable to locally authenticate a user from users file. Below is the log : Server : rad_recv: Access-Request packet from host 127.0.0.1 port 37881, id=29, length=57 User-Name = "suman" User-Password = "hello" NAS-IP-Address = 20x.20x.20x.20x NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "suman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry suman at line 90 [files] expand: Hello, %{User-Name} -> Hello, suman ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "hello" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> suman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.10 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 29 to 127.0.0.1 port 37881 Reply-Message = "Hello, suman" Waking up in 4.9 seconds. Cleaning up request 2 ID 29 with timestamp +164 Ready to process requests. Radtest sudo radtest suman hello 127.0.0.1 0 testing123 Log Sending Access-Request of id 203 to 127.0.0.1 port 1812 User-Name = "suman" User-Password = "hello" NAS-IP-Address = 204.232.205.196 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=203, length=34 Reply-Message = "Hello, suman" Please let me know what i am doing wrong as i am a complete starter. Thanks and Regards Suman Dash

3 5

RE: fradius v2.1.7 Simultaneous-Use
by Mark 13 Mar '10

13 Mar '10

Hi list, I have been trying to find out more information regarding the use of the Simultaneous-Use option for FreeRadius. I have been checking google and most guides seem to point to /etc/raddb/sql.conf and to uncomment the appropriate lines. However, I have not been able to find the Simultaneous-Use option in on my radius server's sql.conf. Does anyone know if that may have been moved to somewhere else or did I miss something on the installation? The distro for the server in question is fedora11. Any help would be much appreciated. Kind regards, Mark

3 2

upgrade from 1.1.8 to 2.1.8 problem
by Roar Pettersen 13 Mar '10

13 Mar '10

Hi ! We have used FreeRadius 1.1.X with sucess for several years and it is time to upgrade to the vesion 2. In 1.1.8 we used "post_proxy_authorize = yes" in proxy.conf to read the users file after we got a access-accept from the home server. I know that the "post_proxy_authorize" is history in version 2.1.8. Could anybody tell me how to assign a static ip address after we get a access-accept ? I have read the example for the ippool, but I can't see how to assign static ip adress will work with ippol. This is the 1.1.8 config : proxy.conf : post_proxy_authorize = yes users : username(a)domain.com NAS-IP-Address == 10.0.0.1, Service-Type == Framed-User, User-Name := "username(a)domain.com" Framed-Protocol = PPP, Framed-IP-Address = 192.168.1.100, Framed-IP-Netmask = 255.255.255.255, Framed-MTU = 1392 -- Med vennlig hilsen / Regards; Roar Pettersen Universitetet i Bergen - The University of Bergen Nygardsgt. 5 - N-5020 BERGEN - Norway

2 1