September 2011 - Freeradius-Users - lists.freeradius.org

htpasswod authentication.
by Agent Smith 09 Sep '11

09 Sep '11

Can FR do htpasswd file based auth? Ideally I'd like to define users in users file with their crypto password right from htpasswd. Is this possible? how would a user file look like. I searched the docs and all I found was 'cleartext password' but I won't know that since its htpasswd.

2 2

Trying to remove a suffix
by Brett Littrell 09 Sep '11

09 Sep '11

Hi All, I hate to post this here, I am sure there is a fairly simple thing to do this but I have been looking and can't seem to find how to do it. So we have users that typically login with a relative context. So there is a base context set to say ou=HS1.o=students, then they type in their name with a relative context, so it may be jsmith.y2012, with our network it sends to the server jsmith.y2012.hs1.students and logs in just fine. The problem we are having is that freeradius is getting the jsmith.y2012 as the username and trying to send that to ldap that first does not understand "." and second the ldap side is a flattened tree to speed up lookups so there is no sub-context. So the solution would seem to be to strip everything after the '.' so "jsmith.y2012" becomes just "jsmith". So I have been approaching it from this side and have tried using hints and attr_rewrite to do it. I am sure I missed something in each of them because it seems either should work, especially after reading a lot of the archived threads. So this is what I have done so far: created a "relative_username" module and placed it in /etc/raddb/modules directory. Contents are : attr_rewrite relative_username{ attribute = User-Name searchin = packet searchfor = ".y2012" replacewith = "" ignore_case = yes max_matches = 1 append = no } This is just for testing, I originally tried a regex expression of "searchfor =~ "^\w*" and "searchfor = "^\w*" but the unlang equal for regex poped with an error and the regual = I do not think recognized regex so I assumed that meant the regex was not supported in this module. Anyway, I have been testing the rewrite with a literal for a specific user to just see if it will work and does not seem to work. From here I call the relative_username in the /etc/raddb/sites_enabled/Radsite file in the Authorize section authorize { relative_username With this everything loads find and running radiusd -X I see that it is still trying to send the info to the LDAP server as jsmith.y2012 and of course it is failing. So on the hints side I was a little unsure of how it worked so I tried : DEFAULT User-Name =~ "^\w+" User-Name := "%{1}" That also did not seem to have an affect. So I am sure I am either barking up the wrong tree with both of these approaches or I am missing something in here. I should also mention, if I do not use the relative context the users authenticates just fine all is good in the world, it is just that darn trailing .y2012 that is the issue. Sorry ahead of time if this is really a stupid question, I am still learning freeradius (which I think is awesome)... So the debug log is below but it basically shows a object not found. rad_recv: Access-Request packet from host 10.2.2.100 port 36360, id=239, length=65 User-Name = "jsmith.y2012" User-Password = "123454" NAS-IP-Address = 10.2.2.100 NAS-Port = 1813 +- entering group authorize {...} [preprocess] expand: %{User-Name} -> jsmith.y2012 ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "jsmith.y2012", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for jsmith.y2012 [ldap] expand: (cn=%{mschap:User-Name:-%{User-Name}}) -> (cn=jsmith.y2012) [ldap] expand: o=musd -> o=musd rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.###.###.###:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder2.b64 rlm_ldap: bind as cn=#######,ou=Radius,o=servers/######### to 10.###.###.###:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=musd, with filter (cn=jsmith.y2012) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jsmith.y2012 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 239 to 10.2.2.100 port 36360 Waking up in 4.9 seconds. Cleaning up request 0 ID 239 with timestamp +10 Ready to process requests. Brett Littrell Network Manager Milpitas Unified School District blittrell(a)musd.org Ph# (408)635-2600 X6086 Fax# (408)635-2632 CISSP, MCNE, CCVP, CCSP, Project+,MCITP/EA

1 2

Odd issue with auth-type:ldap
by Michael Holstein 09 Sep '11

09 Sep '11

Using .. FreeRADIUS Version 2.0.4, for host i486-pc-linux-gnu, built on Sep 7 2008 at 23:35:34 ^^ .. that is what Debian 5.0.6 (Lenny) had in packages. I have LDAP enabled as an auth-type (for ipsec-tools using libradius, since it sends cleartext password and I have AD as backend). I also process mschapv2 (for l2tp/ipsec connections). This works correctly *only* if I enable LDAP debugging. {radiusd.conf} ldap_debug = 0xFFFF Whereby I get : (for ISPEC) rlm_ldap: user XXXX authorized to use remote access ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok or (for L2TP/PPP) Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys ++[mschap] returns ok *HOWEVER* .. if I disable the debug directive, I get : rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Debugging what goes on in the background, the underlying complaint is "must bind to perform.." in case #2. The first case (from a pcap trace) does to the search as defined user (in radiusd.conf) and then bind as the "found" DN, so it's not as if debugging forces a valid return on all queries. Any ideas? Related question .. is there an easier way to pass plaintext (to Radius) credentials into AD (and determine group membership) like auth_ntlm does? .. I know how to call ntlm_auth with plaintext credentials and return a success but can't seem to get freeradius to use that as an auth-type. TIA, Michael Holstein Cleveland State University

3 3

Error in Activation Attribute
by Det Det 09 Sep '11

09 Sep '11

Hi, I have Activation attribute in radcheck table (which has a date VALUE) in old RADIUS server. I don't find this attribute in FreeRADIUS. I get this error. any idea? Failed to create the pair: Invalid octet string "Mar 09 2010 " for attribute name "Activation" thanks det

3 2

PAP-ascii (is it safe to use)?
by Matthew Benjamin 08 Sep '11

08 Sep '11

Can someone tell me if PAP-ASCII is safe to use as an password encryption protocol? -- mB.

3 2

Freeradius and LDAP keepalive
by Angel L. Mateo 08 Sep '11

08 Sep '11

Hello, I have a freeradius 2.1.10 running in a ubuntu (10.04) server. My users are in a ldap directory. The problem I have is that openldap server has an idle timeout (if there is more than this time with an idle connection, openldap closes the connection). So I want to know if there is some way to configure a keepalive on the ldap connection of freeradius. I have found in http://freeradius.1045715.n5.nabble.com/rlm-ldap-amp-TCP-KeepAlive-td279507… that it seems to be code to do this. I have checked this code with code from version 2.1.10 and it is there, but I think I have to configure something because connections are closed and I have logs like: Sep 7 12:12:51 vulpes22 freeradius[21497]: RADIUS Requested access: <myuser@mydomain> (0) Sep 7 12:12:51 vulpes22 freeradius[21497]: [ldap-email] ldap_search() failed: LDAP connection lost. Sep 7 12:12:51 vulpes22 freeradius[21497]: [ldap-email] Attempting reconnect Sep 7 12:12:51 vulpes22 freeradius[21497]: Login OK: [<myuser@mydomain>] (from client XXXXXXX port 10000) freeradius is working (it reconnects with the ldap without any problem), but I want to avoid this error. Is there any way to configure this keepalive? -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 868887590 Fax: 868888337

2 5

you have already logged in
by Zero Cool 08 Sep '11

08 Sep '11

Dear All hi all.. is anybody can tell me pls about radius authentication failed .... if anyof my users got disconnect, he will not able to get login radius ... they got that msg you have already logged in,, im not in good that so culdnt change that option... pls help me thanks

2 1

RADIUS client configuratio-1.1.6n steps
by vikraman.p36＠wipro.com 08 Sep '11

08 Sep '11

Hi , I have downloaded and installed RADIUS server -2.1.11 and RADIUS client-1.1.6. To run the server I used the command radiusd -X. Please let me know the configuration part for RADIUS client , run RADIUS client, in which file I need to specify the username ,password and secret password. Please do not print this email unless it is absolutely necessary. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com

2 3

References for New RADIUS Names/Old RADIUS Names
by Det Det 08 Sep '11

08 Sep '11

Hi, Any idea where I can see list of new names for those RADIUS attributes/values that's been obsoleted. Just want to confirm, for example, Framed-Filter-Id is obsolete, is Filter-Id a replacement to that? thanks! det

2 3

Specifying Any Port for RADIUS Client
by Det Det 08 Sep '11

08 Sep '11

Hi, I want to connect to RADIUS server using RADIUS client software, not through NAS. Using RADIUS client software such as radperf will generate different port numbers when connecting to the RADIUS server. How do I place client information in NAS table such that I am able to specify IP and "any ports". When client connects to RADIUS server, server will just respond with, Ignoring request to authentication address * port 1812 from unknown client 192.168.0.10 port 52268 thanks! det

2 3