January 2011 - Freeradius-Users - lists.freeradius.org

Radius authentication problem.
by vijay s sheelavantar 27 Jan '11

27 Jan '11

Hello Friends,I have intalled RADIUS server on one machine which has fedora 10. I have installed freeradius-server-2.1.10 on it(server machine IP 10.150.110.42). I have one more machine with redhat linux on which i have installed pam_radius-1.3.17(client machine IP 10.150.113.4). I have done the follwoing configuration at both sides SERVER SIDE. users file "vijay"    Auth-Type := Local, Cleartext-Password == "123qwe", NAS-IP-Address == "10.150.113.4"           Reply-Message = "Hello, %u" clients.confclient 127.0.0.1 {secret          = testing123shortname       = localhostnastype     = other}client 10.150.113.4/24 {        secret          = testing123        shortname       = private-network-1} client 10.150.110.42/24 {        secret          = testing123        shortname       = private-network-1} I have not changed anything in radiusd.conf. CLIENT SIDE/etc/pam.d/sshdauth       sufficient   pam_radius_auth.so /etc/raddb/server# server[:port] shared_secret      timeout (s)127.0.0.1       testing123              110.150.110.42   testing123              3other-server    other-secret            3 /etc/ssh/sshd_configUsePAM yes Above mentioned is my configuration. when i try to connect client with SSH it is not sending a request for authenticating user to RADIUS server. kindly let me know what else configuration i have to do, or if there are any mistakes in my configuration plz help to correcr it. Thank you. Regards, VIJAY S.

2 1

Question on Virtual Servers and inner-tunnel
by Brett Littrell 26 Jan '11

26 Jan '11

Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE

4 5

Trying to strip the Windows Domain name from a login
by Brett Littrell 26 Jan '11

26 Jan '11

Hi All, I am trying to strip the domain name from a userid in the most efficient way possible, I am using version 2.1.1. I have tried using the hints file with regular expressions. ex. DEFAULT User-Name =~ "([A-Za-z1-9]+)" User-Name := "%{2}" In regexbuddy it is showing that it shows two matches, I specify the second match and in the debug output it fails and does not show any username. I then found another reference to strip the domain from the LDAP module as shown below: filter = "(cn=%{mschap:User-Name:-%{User-Name}} # filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am using MSChapV2 and it seems to pass the correct username to the LDAP server it looks like there is some other place I need to strip the domain besides the ldap lookup, that or the replies are using the stripped name and it is failing that way as well. Either way it still is not working. If I un-comment the stripped-user-name and use a supplicant that strips the domain prior to sending it, it does work so Radius is working, just now with standard windows supplicant on XP. Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.17.17.66port 1645, id=198, length=157 User-Name = "LPDOT1XTEST\\dotxuser" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1C-B1-5A-8E-05" Calling-Station-Id = "64-31-50-6E-DA-7A" EAP-Message = 0x0202001a014c50444f543158544553545c626c69747472656c6c Message-Authenticator = 0x7041a9eaea23f1896725936e06e3f1dc NAS-Port-Type = Ethernet NAS-Port = 50005 NAS-IP-Address = 10.20.90.37 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "LPDOT1XTEST\dotxuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 26 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for LPDOT1XTEST\dotxuser [ldap] expand: (cn=%{mschap:User-Name:-%{User-Name}} -> (cn=dotxuser [ldap] expand: ou=users,o=musd -> ou=users,o=musd rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.17.17.1:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder2.b64 rlm_ldap: bind as cn=ldproxy,ou=somecx,o=cx/password! to 172.17.17.1:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,o=musd, with filter (cn=dotxuser rlm_ldap: ldap_search() failed: Bad search filter: (cn=dotxuser [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> LPDOT1XTEST\dotxuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 172.17.17.66port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +20 Ready to process requests. An yes I am pretty new to freeradius. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE

2 3

Re: OT: email fail [was Re: Question on Virtual Servers and inner-tunnel]
by Gary Gatten 26 Jan '11

26 Jan '11

Hmmm, build/use a different email system? Genius! Why didn't I think of that.... ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Wed Jan 26 02:56:23 2011 Subject: OT: email fail [was Re: Question on Virtual Servers and inner-tunnel] Gary Gatten <Ggatten(a)waddell.com> wrote: > > And I don't have control over what our half dozen email processors do > to my email after I send it. > You live in a country that prevents you using any other SMTP server other than the one allocated to you? Unable to get a freebie email address (Gborg) that comes with SMTP submission? Unable to run your own SMTP server and/or buy your own domain. That's a terrible place to live, let me know so I know never to visit. If that's not the case, learn to use a non-(a)waddell.com email address though you undoubtedly have. Cheers -- Alexander Clouter .sigmonster says: Everything ends badly. Otherwise it wouldn't end. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 26 Jan '11

26 Jan '11

Did you read the part where I said I was just giving him $hit? OP did, and he got it. And I don't have control over what our half dozen email processors do to my email after I send it. But, just for you I'll see what I can do. Thanks. ----- Original Message ----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Wed Jan 26 00:49:27 2011 Subject: Re: Question on Virtual Servers and inner-tunnel Gary Gatten <Ggatten(a)waddell.com> wrote: > [-- multipart/alternative, encoding 7bit, 1 lines --] > > [-- text/plain, encoding base64, charset: utf-8, 38 lines --] > > That's a stupid question for someone with so many certs! ;) jus givn ya $hit. > > [snipped] > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > > > [-- text/html, encoding base64, charset: utf-8, 48 lines --] > > [-- text/plain, encoding 7bit, charset: us-ascii, 2 lines --] > ...says the guy sending HTML emails with a retarded 'disclaimer' attached to all outbound email. Before you pick on someone, please learn how to use your email client, it otherwise leaves you looking like a puppy curling one out on the carpet. Cheers -- Alexander Clouter .sigmonster says: Beam me up, Scotty! It ate my phaser! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 26 Jan '11

26 Jan '11

That's a stupid question for someone with so many certs! ;) jus givn ya $hit. AKAIK it's not hard coded. In a config file somewhere is probably something like: if request type is 'x' then server inner-tunnel. Its been some time since I looked at the conf files so I can't say for sure which one and where. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:18:57 2011 Subject: Question on Virtual Servers and inner-tunnel Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

4 3

Re: Question on Virtual Servers and inner-tunnel
by Gary Gatten 25 Jan '11

25 Jan '11

You could define new ones, change the existing one, both, etc. Generally speaking the default config just "works" unless you're doing something interesting. I can't say how/what you should do without knowing more about it. And then "I" prolly still can't, but others could. Since you're so self motivated, perhaps you could draft curriculum and tests for an FR cert? ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:50:53 2011 Subject: Re: Question on Virtual Servers and inner-tunnel So I guess the follow up question is then, if I want to create multiple virtual servers, I am going to have to find this config file if I want those servers to deal with the inner-tunnel requests or are you suppose to just define another server in the inner-tunnel file if you want a second virtual server that deals with inner-tunnel requests? That was a lot of certs? I have a lot more, those are just the most recent....HeHe... I would attempt a cert in freeradius so I can pick it up faster but I never heard of a class for it much less a certification or training materials... Thanks for the fast response. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE >>> On Tuesday, January 25, 2011 at 3:40 PM, in message <13923_1295998812_4D3F5F5C_13923_216_1_D9B37353831173459FDAA836D3B43499AE519C4B(a)WADPMBXV0.waddell.com>, Gary Gatten <Ggatten(a)waddell.com> wrote: That's a stupid question for someone with so many certs! ;) jus givn ya $hit. AKAIK it's not hard coded. In a config file somewhere is probably something like: if request type is 'x' then server inner-tunnel. Its been some time since I looked at the conf files so I can't say for sure which one and where. ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Tue Jan 25 17:18:57 2011 Subject: Question on Virtual Servers and inner-tunnel Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

New to the lists
by Tim McNabb 25 Jan '11

25 Jan '11

Hi all. Looking forward to picking your brains regarding FreeRADIUS as I'm kinda new to it. I took over administrative duties for the person who previously took care of our network and I'm trying to work with some of the FreeRADIUS settings and update to a newer version in the process. Current version is 1.0.4 (I know, it ancient), however also in the middle of a CentOS build while hoping to deploy that latest version of FreeRADIUS. I have a curious question though. Since the current version is substantially older than what we're moving to, how will this affect the sql database? Will I be able to install the newest version of FreeRADIUS and just perform a mysql dump from the old server to the new one? Thanks in advance, -Tim

4 5

SQL issue
by David Peterson 25 Jan '11

25 Jan '11

I am having a strange issue with the latest upgrade to the "Stable" version. It appears as though Freeradius is using a username of radius instead of the root user I have configured in sql.conf. Is there another area I should be looking for user name and password configuration? The only changes I made were to the dictionary.wimax and re-compile to move to the newer version. Debug: Tue Jan 25 11:53:38 2011 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius Tue Jan 25 11:53:38 2011 : Error: rlm_sql_mysql: Mysql error 'Access denied for user 'radius'@'localhost' (using password: YES)' David

2 2

Parse error after Freeradius Migration (Ascend binary attribute)
by tobias.gruenewald 25 Jan '11

25 Jan '11

Hello, I am working on migrating from freeradius 1.1.0 (manually compiled) to 2.1.8 (from Ubuntu repository). Right now I am stuck with the parsing of the configuration files. The files are working flawless on the old server but lead to a parsing error on startup on the new. I tried delving into the source code but didn't have the time to really understand all called functions. I'm not sure where the error is, because the formatting of the filter looks quite right to me. I'm pasting the error and the relevant portion of the configuration file, in hope someone sees where my problem is. # cat /var/log/freeradius/radius.log Error: users.smart[11]: Parse error (reply) for entry user: failed to parse Ascend binary attribute: failed to parse Ascend binary attribute: # cat users.smart user User-Password := "password" Service-Type = Framed-User, Framed-Protocol = PPP, Ascend-Assign-IP-Pool = 1, Framed-Netmask = "255.255.255.255", Ascend-Metric = 1, Framed-Routing = None, Ascend-Idle-Limit = 3600, Ascend-Route-IP = Route-IP-Yes, Ascend-Data-Filter = "ip in drop udp dstport = 9", Ascend-Data-Filter = "generic in forward 0 0 0" Regards, Tobias -- View this message in context: http://freeradius.1045715.n5.nabble.com/Parse-error-after-Freeradius-Migrat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4