August 2011 - Freeradius-Users - lists.freeradius.org

pptp and freeradius
by saeed1803 24 Aug '11

24 Aug '11

>Hi dear friends >I have a problem with configuration vpn & freeradius >When I connect with Windows clients, displayed this error : host 127.0.0.1 port 38970, id=139, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0x089bd88d04fc9c4263f9ef8c0b7680d6 MS-CHAP2-Response = 0x5c00f40d55fc21260615b32b54a23b2b85cc00000000000000008ae59dc6918fdc10855be5c58cf809be14426f2fba994eea Calling-Station-Id = "192.168.56.100" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 38970 MS-CHAP-Error = "\\E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +592 >Tell me how do I solve this problem, please >I really need your help

2 1

Adding default Realms in users without Realms
by joaocdc＠gmail.com 24 Aug '11

24 Aug '11

Hello everybody I have a doubt and I'm not finding answers on the Internet. I have a freeradius server operating normally, it is a proxy for several Realms, with each Realm leads the user to a different authentication database, so far okay. What I need now is to get users coming to the radius without realm, and add a default realm. I need to do this early on in the authentication processing, so that the other conditions that rely on authentication of the existence of a realm can function correctly. Can anyone help me with this issue? Thank you. -- João Paulo de Lima Barbosa

2 4

OT: Cisco Disconnect-Request packets
by Jonathan Gazeley 24 Aug '11

24 Aug '11

Hi all, Not directly related to FreeRADIUS but I gather people here have some experience with Cisco WiSMs and 802.1x. I'm trying to use radclient to craft a Disconnect-Request packet to disconnect a user on an 802.1x network. I've checked the RFCs for the Disconnect-Request packets and I believe I am providing all the necessary attributes to disconnect a user, however the WiSM always responds: rad_recv: Disconnect-NAK packet from host 172.17.107.211 port 3799, id=219, length=26 Error-Cause = Missing-Attribute I am sending packets like these: Sending Disconnect-Request of id 219 to 172.17.107.211 port 3799 User-Name = "jg4461" Calling-Station-Id = "00:1b:63:08:b4:eb" Framed-IP-Address = 172.21.107.197 Called-Station-Id = "00:21:55:ac:5b:60:ResNet-Wireless" NAS-Port-Id = "29" NAS-Port-Type = Async Acct-Session-Id = "jg44614ddcd9e6/00:1b:63:08:b4:eb/222935" NAS-IP-Address = 172.17.107.211 NAS-Port = 29 NAS-Identifier = "wism11" So, does anyone know which attributes I must send to disconnect a user in this way? Is there an easier way of doing it? Many thanks, Jonathan

3 4

pptp and freeradius
by saeed1803 24 Aug '11

24 Aug '11

Hi dear friends I have a problem with configuration vpn & freeradius When I connect with Windows clients, displayed this error : host 127.0.0.1 port 38970, id=139, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0x089bd88d04fc9c4263f9ef8c0b7680d6 MS-CHAP2-Response = 0x5c00f40d55fc21260615b32b54a23b2b85cc00000000000000008ae59dc6918fdc10855be5c58cf809be14426f2fba994eea Calling-Station-Id = "192.168.56.100" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 38970 MS-CHAP-Error = "\\E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +592 Tell me how do I solve this problem, please I really need your help

1 0

pptp and freeradius
by saeed1803 24 Aug '11

24 Aug '11

Hi dear friends I have a problem with configuration vpn & freeradius When I connect with Windows clients, displayed this error : host 127.0.0.1 port 38970, id=139, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0x089bd88d04fc9c4263f9ef8c0b7680d6 MS-CHAP2-Response = 0x5c00f40d55fc21260615b32b54a23b2b85cc00000000000000008ae59dc6918fdc10855be5c58cf809be14426f2fba994eea Calling-Station-Id = "192.168.56.100" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 38970 MS-CHAP-Error = "\\E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +592 Tell me how do I solve this problem, please I really need your help

1 0

compiling pam radius module
by g17jimmy 24 Aug '11

24 Aug '11

I am trying to get pam radius module to work but the module does not seem to be encrypting properly. When I test using radtest authentication works, but when attempting a pam authentication the password shows as garbage. I have verified that the shared secret I'm using is the same for both configurations. I will post debug logs shortly. -- View this message in context: http://freeradius.1045715.n5.nabble.com/compiling-pam-radius-module-tp47271… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Fw: RADIUS does not send reply for all groups the user is a member of
by Det Det 23 Aug '11

23 Aug '11

----- Forwarded Message ----- From: Det Det <det.explorer(a)yahoo.com> To: Fajar A. Nugraha <list(a)fajar.net> Sent: Tuesday, August 23, 2011 3:37 PM Subject: Re: RADIUS does not send reply for all groups the user is a member of Thanks Fajar! I just added the fall-through. I leave the priority as is. Worked! Thanks! ________________________________ From: Fajar A. Nugraha <list(a)fajar.net> To: Det Det <det.explorer(a)yahoo.com>; FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, August 23, 2011 3:10 PM Subject: Re: RADIUS does not send reply for all groups the user is a member of On Tue, Aug 23, 2011 at 1:53 PM, Det Det <det.explorer(a)yahoo.com> wrote: > Hi there, > here is the SQL and debug logs from radius. > > mysql> select * from radusergroup; > +---------------------------+-----------+----------+ > | username | groupname | priority | > +---------------------------+-----------+----------+ > | user1(a)mydomain.com | defgroup | 1 | > user1(a)mydomain.com | dynamic | 1 | > +---------------------------+-----------+----------+ It'd be easier if you use different priorities. Since the debug log shows it's using "defgroup", try changing "dynamic"'s priority to "2" ... > mysql> select * from radgroupreply; > +----+-----------+-------------------+----+-----------------+ > | id | groupname | attribute | op | value | > +----+-----------+-------------------+----+-----------------+ > | 1 | defgroup | Framed-MTU | = | 1500 | > | 2 | defgroup | Service-Type | = | Framed-User | > | 3 | defgroup | Port-Limit | = | 1 | > | 7 | dynamic | Framed-IP-Netmask | = | 255.255.255.255 | > | 6 | dynamic | Framed-IP-Address | = | 255.255.255.254 | > +----+-----------+-------------------+----+-----------------+ ... and add a radgroupreply entry like defgroup | Fall-Through | = | Yes -- Fajar

1 0

RADIUS does not send reply for all groups the user is a member of
by Det Det 23 Aug '11

23 Aug '11

Hi, user1 is a member of group1 and group2. both group1 and group2 has replies in radgroupreply table. when freeradius query for radusergroup, it will only get the first group the user is a member of and will proceed to get the reply attributes for that group as below. query1: SELECT groupname FROM radusergroup WHERE username = 'user1(a)domain.com' ORDER BY priority query2: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group1' ORDER BY id from the debug, it does not do this query query3: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id any idea why? i am very sure that query 1 returns more that one value (that is 2 groups, group1 and group2) thanks, det

2 3

PAP Auto Header
by Det Det 23 Aug '11

23 Aug '11

Hi, I set PAP module as below. In my DB, user attribute is User-Password. Value of User-Password is an MD5 or CRYPT password. Shouldn't auto-header=yes able to detect the encryption scheme used in the password? What will the auto-header setting for if I still have to specifically set attributes such as MD5-Password or Cleartext-Password, etc. pap { auto_header = yes } thanks, det

2 3

Acct-Multi-Session-Id parameter with SQL
by Martin 22 Aug '11

22 Aug '11

Hi, I am trying to use Acct-Multi-Session-Id parameter with SQL and i don't see it in the radacct table. Any ideea how I should do this? In radacct files exists Mon Aug 22 00:00:05 2011 Acct-Status-Type = Interim-Update WiMAX-Hotline-Indicator = "active" WiMAX-IP-Technology = Reserved-0 Acct-Session-Id = "00-17-c4-3d-41-ea3020\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000" Acct-Multi-Session-Id = "18ed983f3c2371c6f4bc692e0c89dffe" Framed-IP-Address = 10.91.91.10 User-Name = "{am=1}gogu(a)domain.ro" Calling-Station-Id = "00-17-c4-3d-41-ea" NAS-Identifier = "IonM" NAS-IP-Address = 192.168.60.122 WiMAX-BS-Id = 0x000003000008 Framed-Pool = "USB" Event-Timestamp = "Aug 5 2011 00:07:52 EEST" WiMAX-GMT-Timezone-offset = 0 Acct-Session-Time = 300 Acct-Authentic = RADIUS Acct-Unique-Session-Id = "13ef07adccdde161" Timestamp = 1313960405 Request-Authenticator = Verified Regards, Ion

2 1