March 2010 - Freeradius-Users - lists.freeradius.org

Modifying FreeRADIUS queries [from the wiki]
by Jeff Wark 11 Mar '10

11 Mar '10

I apologize if this is a trivial question, but I cannot find an explanation regarding my specific question. I have seen the following entry in the wiki regarding taking into account Gigawords: *snip* Modify FreeRADIUS Queries Secondly, modify the accounting queries in sql.conf to make the SQL database perform the computation that is required to merge the two values sent as attributes by the NAS into one single 64-bit integer stored in the database. All occurrences of '%{Acct-Input-Octets}' need to be replaced with: '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}' The same thing needs to be done for '%{Acct-Output-Octets}': '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' *snip* I understand the left shifting of the Gigawords value and the subsequent 'or'-ing of the Acct-Input-Octets value to produce one 64-bit value. The part that confuses me is the repeated occurrence of the ':-0' at the end of each variable. What is the purpose of this? I have seen it on other pages used with other variable substitutions. I have also seen the above Gigawords entry done without the ':-0' [only once though]. I would rather understand the purpose behind the entry rather than blindly copying it. If there is a wiki page or FAQ entry that I have missed regarding this syntax, I would love to know about it. Thanks for the input. -Jeff Wark

2 1

PAP + ??NT challange??
by Rosario Lumia 11 Mar '10

11 Mar '10

Hi to all. I've this configuration: - freeradius 2.x - in mysql i have user "rosario" with attribute "NT-Passwors" and value "NTHash of my password" when i try to use radtest works greatlly. But i have a web library the try to authenticate the same user "rosario" but in "user-password" it put (i think) an NT-challenge password. This is the log of freeradius. rad_recv: Access-Request packet from host 127.0.0.1 port 51435, id=32, length=85 NAS-Identifier = "radius2" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "rosario" User-Password = "\202\204\005\340-\275\341\344u\351-\310L$\260\242" +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100311 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20100311 expand: %t -> Thu Mar 11 15:31:56 2010 ++[auth_log] returns ok ++[mschap] returns noop [ntdomain] No '\' in User-Name = "rosario", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [suffix] No '@' in User-Name = "rosario", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop expand: %{User-Name} -> rosario [sql] sql_set_user escaped user --> 'rosario' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'rosario' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'rosario' ORDER BY id expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'rosario' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> rosario [sql_meeting] sql_set_user escaped user --> 'rosario' rlm_sql (sql_meeting): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rosario' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='rosario' rlm_sql (sql_meeting): Released sql socket id: 4 [sql_meeting] User rosario not found ++[sql_meeting] returns notfound WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> rosario [sql_biblio] sql_set_user escaped user --> 'rosario' rlm_sql (sql_biblio): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rosario' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='rosario' rlm_sql (sql_biblio): Released sql socket id: 4 [sql_biblio] User rosario not found ++[sql_biblio] returns notfound WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> rosario [sql_signum] sql_set_user escaped user --> 'rosario' rlm_sql (sql_signum): Reserving sql socket id: 4 expand: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'rosario' ORDER BY id expand: SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}' -> SELECT GroupName FROM usergroup WHERE UserName='rosario' rlm_sql (sql_signum): Released sql socket id: 4 [sql_signum] User rosario not found ++[sql_signum] returns notfound [pap] Normalizing NT-Password from hex encoding ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "???�-��u�-�L$��" [pap] Using NT encryption. [pap] rlm_mschap: NT-Hash: ???�-��u�-�L$�� [pap] rlm_mschap: NT-Hash: Result: 9bf2e48c667225847414c60fd3b16ce0 expand: %{mschap:NT-Hash ???�-��u�-�L$��} -> 9bf2e48c667225847414c60fd3b16ce0 [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: NT password check failed): [rosario] (from client localhost port 0 cli 127.0.0.1) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 32 to 127.0.0.1 port 51435 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 51435, id=32, length=85 Sending duplicate reply to client localhost port 51435 - ID: 32 Sending Access-Reject of id 32 to 127.0.0.1 port 51435 Waking up in 4.9 seconds. Cleaning up request 0 ID 32 with timestamp +7 Ready to process requests. I think that rlm_pap try to hashing a not cleartext-password and so it doesn't work. How can I tell to rlm_pap to do the right thing, otherwise to try to hash a cleartect-password and do something (that i don't know) if not? Thanks. Rosario -- Rosario L.

2 2

Issue with radmin command
by Abhilash Shastry -X (abshastr - Infosys at Cisco) 11 Mar '10

11 Mar '10

Hi all, I am not able to use the "set" or "add" command when using radmin. Could you please provide me a pointer on the same. This is the error which i am getting. radmin> add help ERROR: You do not have write permission. See "mode = rw" in /usr/local/var/run/radiusd/radiusd.sock radmin> help add <command> - do sub-command of add debug <command> - debugging commands hup [module] - sends a HUP signal to the server, or optionally to one module inject <command> - commands to inject packets into a running server reconnect - reconnect to a running server terminate - terminates the server, and cause it to exit set <command> - do sub-command of set show <command> - do sub-command of show stats <command> - do sub-command of stats radmin> terminate This is the output from radiusd -X command Finished request 2. Going to the next request Waking up in 4.9 seconds. radmin> stats client 10.89.149.204 Waking up in 0.6 seconds. Cleaning up request 2 ID 77 with timestamp +667 Ready to process requests. radmin> stats client auth Ready to process requests

4 4

FreeRadius/LDAP Generic Reply Attribute
by Joel Prine 11 Mar '10

11 Mar '10

Hello, I need to pass an odd reply attribute back to my Cisco router to limit DSL users speeds on the interface. I am moving from radiator to freeradius, we are going this fine on radiator from a mysql database. The ldap entry in the directory is radiusReplyItem: Cisco-Avpair = lcp:interface-config#1=rate-limit input 512000 96000 96000 conform-action continue exceed-action drop It appears that it is being truncated at the "#" sign, is this field too long? or is a special character messing it up, is there anyway i can escape the special character if so? Thanks for any help! Here is the DEBUG, I have bolded the lines i noticed.... ********************* rad_recv: Access-Request packet from host 72.2.95.130 port 1645, id=121, length=94 Framed-Protocol = PPP User-Name = "jprine@suitedsl" User-Password = "overout22" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "4/0/0/0" Service-Type = Framed-User NAS-IP-Address = 72.2.95.130 +- entering group authorize {...} ++[preprocess] returns ok [suffix] Looking up realm "suitedsl" for User-Name = "jprine@suitedsl" [suffix] No such realm "suitedsl" ++[suffix] returns noop [ldap] performing user authorization for jprine@suitedsl [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> jprine@suitedsl [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=jprine@suitedsl) [ldap] expand: dc=suite224,dc=net -> dc=suite224,dc=net [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=suite224,dc=net, with filter (uid=jprine@suitedsl) [ldap] looking for check items in directory... [ldap] userPassword -> Cleartext-Password == "{CRYPT}$1$j83AynGz$QIU88xh94V3ocCI.zT/1R1" [ldap] looking for reply items in directory... [ldap] radiusFramedIPAddress -> Framed-IP-Address = 72.2.84.77 [ldap] extracted attribute Cisco-AVPair from generic item Cisco-Avpair = lcp:interface-config#1=rate-limit input 512000 96000 96000 conform-action continue exceed-action drop [ldap] Setting Auth-Type = LDAP [ldap] user jprine@suitedsl authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] login attempt by "jprine@suitedsl" with password "overout22" [ldap] user DN: cn=jprine@suitedsl,ou=freeradius,dc=suite224,dc=net [ldap] (re)connect to 127.0.0.1:389, authentication 1 [ldap] bind as cn=jprine@suitedsl,ou=freeradius,dc=suite224,dc=net/overout22 to 127.0.0.1:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user jprine@suitedsl authenticated succesfully ++[ldap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 121 to 72.2.95.130 port 1645 Framed-IP-Address = 72.2.84.77 Cisco-AVPair = "lcp:interface-config" Finished request 30. Any questions, please let me know. Thank You, Joel Prine Systems Engineer MCSE, CCNA, CSE Conneaut Telephone / Suite224 Internet Phone: (440) 593.7160 Fax: (440) 599.2230 JPrine(a)suite224.net<mailto:JPrine@suite224.net> [cid:image001.jpg@01CA262C.F8CBE910] 1 [cid:image002.jpg@01CA262C.F8CBE910] ________________________________ P.O. Box 579 | Conneaut, Ohio 44030 | Ph: (440) 593.7113 | TF Ph: (888) 566.7113 | Fax: (440) 599.2230 ________________________________

2 4

freeradius and openldap
by omega bk 11 Mar '10

11 Mar '10

hello all, after all, my freeradius server is working so fine ( i'm glad) thanks for all of u taking time to help me. i can successfully authenticate my users in users file with Cleartext-Password. so know i'd like to authenticate my users through openldap, men that i won't put all my users in users's file. thus, i put on users file DEFAULT Autz-Type := LDAP Tunnel-Type = VLAN, Tunnel-Medium-type = IEEE-802, Tunnel-Private-Group-ID = 100 but i think it is not the correct way to do. so how can i authenticate all my users directly through ldap? in my radiusd.conf i added ldap { server = "10.75.128.251" identity = "cn=manager,dc=example,dc=com" password = test basedn = "dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } in authorize : authorize { preprocess chap mschap suffix eap { ok = return } unix files * ldap* expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { ldap } eap } and the debug output is: ####################### radtest:# freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Mar 10 2010 at 13:50:12 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.20.253 { require_message_authenticator = no secret = "testinglinagora" shortname = "switchlabo" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/etc/freeradius/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } /etc/freeradius/users[72]: Parse error (check) for entry DEFAULT: Unknown value LDAP for attribute Autz-Type Errors reading /etc/freeradius/users /etc/freeradius/radiusd.conf[1117]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[111]: Failed to find module "files". /etc/freeradius/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. Thank u for helping me.

1 2

Determine number of client requests sent to the free radius server
by R C 10 Mar '10

10 Mar '10

Hi, Is there a way to determine how many client requests are being received by the free radius server? thanks, rc

4 5

ldap group auth - always allowing user.
by devnull 10 Mar '10

10 Mar '10

I still have to better figure out how to correctly search for "VPN Users", but it will still allow access if it does not find a user in that group. I have the following in: postauth_users Shouldn't the "DEFAULT Auth-Type := Reject" reject that user since it did not find him in the group? DEFAULT Ldap-Group == "VPN USERS", Auth-Type := Accept DEFAULT Auth-Type := Reject Fall-Through = no In debug I can see, Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] login attempt by "vtest" with password "test1234" [ldap] user DN: uid=vtest,ou=People, dc=company, dc=dom [ldap] (re)connect to company-bk1.company.dom:389, authentication 1 [ldap] bind as uid=vtest,ou=People, dc=company, dc=dom/test1234 to company-bk1.company.dom:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user vtest authenticated succesfully ++[ldap] returns ok +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=People,dc=company,dc=dom -> ou=People,dc=company,dc=dom [files] expand: (|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=People,dc=company,dc=dom, with filter (&(ou=VPN USERS)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames)(uniquemember=)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group VPN USERS not found or user is not a member. [files] postauth_users: Matched entry DEFAULT at line 2 ++[files] returns ok Thanks, Kyle

1 0

Freeradius with Active Directory
by Whitmarsh Mark (Leeds Teaching Hospitals NHS Trust) 10 Mar '10

10 Mar '10

Hi, I am following the tutorial at: http://deployingradius.com/documents/configuration/active_directory.html but have hit a problem. Everything works up to and including the command line test using ntlm_auth but after I create the file raddb/modules/ntlm_auth and make the changes to raddb/sites-enabled/default , raddb/sites-enabled/inner-tunnel and the users file I get an error when running radiusd -X Error is: /etc/raddb/modules/ntlm_auth[9]: Failed to link to module 'rlm_ntlm_auth': file not found I have confirmed that the ntlm_auth file does exist in etc/raddb/modules/ I am running Freeradius 2.1.6 on OpenSuse 11.2 Here is the debug output: FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Nov 20 2009 at 09:43:24 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/krb5 including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client xxx.xxx.xxx.xxx { require_message_authenticator = no secret = "testing123" shortname = "self" } client xxx.xxx.xxx.xxx { require_message_authenticator = no secret = "testing123" shortname = "marks-pc(vm)" } client xxx.xxx.xxx.xxx/23 { require_message_authenticator = no secret = "testing123" shortname = "CiscoSwitches" nastype = "cisco" } client xxx.xxx.xxx.xxx/23 { require_message_authenticator = no secret = "testing123" shortname = "CiscoSwitches" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } /etc/raddb/modules/ntlm_auth[9]: Failed to link to module 'rlm_ntlm_auth': file not found /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "ntlm_auth". /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Errors initializing modules Can anybody tell me where I am going wrong? Thanks, Mark. ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in reliance on its contents: to do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and GSI recipients NHSmail provides an email address for your career in the NHS and can be accessed anywhere For more information and to find out how you can switch, visit www.connectingforhealth.nhs.uk/nhsmail ********************************************************************************************************************

4 8

freeradius chap auth with ldap
by Eric Eric 10 Mar '10

10 Mar '10

How freeradius does chap auth using ldap server ? In pap, it binds with user's clear password to ldap server, and ldap server sends success bind if pawword is true. When using chap, how it can bind to ldap server? Does it send chap password to the ldap server? Is it needed another software with freeradius+ldap server(for example 389 DS) for doing chap authentication?

2 1

LDAP groups and attributes
by Jethro Carr 10 Mar '10

10 Mar '10

hi all, I have setup a FreeRadius server which is authenticating against an OpenLDAP database. It's all working very nicely and I have it setup with radius attributes being stored inside the LDAP database for each user. However, what would be nice, would be to have the ability to store radius attributes against groups that the user belongs to, so that when radius queries the user, it gets all the attributes for all the groups that the user belongs to. I've had a look through the rlm_ldap documentation which has some configuration options for groups, however it seems to me that this is for authenticating users based on which group they are in, rather than being able to fetch attributes from the groups that the user belongs to? Is this understanding correct, or am I missing something? thanks in advance for any help! :-) FreeRadius version is 1.1.3 (RHEL 5 build) if that's important. regards, jethro -- Jethro Carr www.jethrocarr.com/index.php?cms=blog www.amberdms.com

3 4