October 2012 - Freeradius-Users - lists.freeradius.org

Regarding pam_radius_auth to be integrated with busybox
by Deep Shah 09 Nov '12

09 Nov '12

Hi, I am trying to integrate linux-pam library and pam_radius_auth module to my busybox 1.17.3 version. I want to login through radius server on the host machine. I am using power pc as my board. I have configured the files of configuration as below. *client.conf* * (conf file)* client 192.168.100.26 { secret = testing123 } *user (conf file)* test Auth-Type := PAP, Cleartext-Password := "testpass" Reply-Message = "Hello, %{User-Name}, you have successfully authenticated your login" I am getting request on the server side but some error is coming on the server of password mismatch. Please find the below log for the same. rad_recv: Access-Request packet from host 192.168.100.26 port 2970, id=106, length=69 User-Name = "test" User-Password = "C\2758\330E\345RZ\3707\227\001\265[\202H" NAS-Identifier = "login" NAS-Port = 1945 NAS-Port-Type = Virtual Service-Type = Authenticate-Only # Executing section authorize from file /usr/local/etc/raddb//sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test at line 54 [files] expand: Hello, %{User-Name}, you have successfully authenticated your login -> Hello, test, you have successfully authenticated your login ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /usr/local/etc/raddb//sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "C�8�E�RZ�7??�[?H" [pap] Using clear text password "testpass" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb//sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 106 to 192.168.100.26 port 2970 Reply-Message = "Hello, test, you have successfully authenticated your login" Waking up in 4.9 seconds. Cleaning up request 1 ID 106 with timestamp +37 Ready to process requests. Can you please suggest what might be the issue is? I am getting password as not readable string when I have used the correct password in radius client and radius server. Regards, Deep

5 14

Re: ntlm_auth child domain
by Alan Buxey 07 Nov '12

07 Nov '12

I'd say use ntlm_auth with 2 instances of MSCHAP module - using unlang and fail-through mechanism...so if MSCHAP instance 1 fails then it tries instance 2 We used this mechanism when migrating from one AD to another alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 3

rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS
by Darren Shea 31 Oct '12

31 Oct '12

I'm trying to migrate a running FreeRADIUS server (on FreeBSD 7) to a virtualized system (on FreeBSD 9). I've got the MySQL database working, and I have copied over the raddb files from the old system to the new one. Unfortunately, radiusd drops out with the error in the subject. It looks like the working system has no problem with tunneling EAP/TTLS through the TTLS tunnel, but this new system is balking. I've read the documentation and examined the FAQ, but no luck. Google is shedding no light on this problem either. Any suggestions? Full radiusd -X output on non-working server ---------------------------------------------------- vBSD1# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "freeradius" main: group = "freeradius" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = yes main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms listen: port = 1645 listen: type = "auth" listen: port = 1646 listen: type = "acct" radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "ttls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/aaasvr_key.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/aaasvr_cert.pem" tls: CA_file = "/usr/local/etc/raddb/certs/cacert_aaasvr.pem" tls: private_key_password = "password" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "ttls" ttls: copy_request_to_tunnel = yes ttls: use_tunneled_reply = yes rlm_eap_ttls: Cannot tunnel EAP-Type/ttls inside of TTLS rlm_eap: Failed to initialize type ttls radiusd.conf[17]: eap: Module instantiation failed. radiusd.conf[2037] Unknown module "eap". radiusd.conf[1984] Failed to parse authenticate section. Partial radiusd -X output on working server ---------------------------------------------------- Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/aaasvr_key.pem" certificate_file = "/usr/local/etc/raddb/certs/aaasvr_cert.pem" CA_file = "/usr/local/etc/raddb/certs/cacert_aaasvr.pem" private_key_password = "password" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "ttls" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Thank you, Darren ECPI Western Broadband

2 1

LDAP attribute mapping
by Arran Cudbard-Bell 31 Oct '12

31 Oct '12

Quick poll. For 3.0 the ldap module will be moving away from using the ldap.attrmap file and instead use a config based mapping. There are a few ways we are considering for organising the mapping. We can use something like the existing unlang: update control { Cleartext-Password := userpassword } update reply { User-Name = radiusUserName } update outer.reply { Reply-Message = radiusReplyMessage } Or something like rlm_rest and rlm_cache: update { control:Cleartext-Password := userpassword reply:User-Name = radiusUserName reply.outer:User-Name = radiusUserName } It really depends on whether people are actually using the full ldap.attrmap, or whether they're just pulling out one or two attributes. Each approach is as efficient as the other performance wise, so it comes down to which one people prefer. Any thoughts? -Arran

5 7

ntlm_auth child domain
by Menard, Yannick 31 Oct '12

31 Oct '12

Hi, I just recently installed an freeradius server , joined the domain and im currently able with ntlm_auth and radtest to authenticate user from our Active directory but I am unable to authenticate using our child domain. For exemple our domain is toto.prive, child domain child.toto.prive I need users from any of those 2 domain to authenticate to our radius. How would I do that in the ntlm_auth module, here is what I have right now: program = "/usr/bin/ntlm_auth --request-nt-key --domain=toto.prive --username=%{mschap:User-Name} --password=%{User-Password}" I am on centos 6.3, I use freeradius rpm from yum. With this config I am able to authenticate a toto.prive user but I am unable to authenticate a child.toto.prive user. Thank you, Yannick Ménard ---------------------------------------------------------------------------------------------------------- Ce courriel a été filtré par ModusGate et Webshield afin de le certifier comme légitime et exempt de virus.

1 0

mysql Connection error
by QASIM RAO 31 Oct '12

31 Oct '12

hi, i am having a problem in free radius, when i connect free radius with db by using ip of db server it is not connecting with db database is installed on localhost so when i give db sever="localhost" it connects with db... please help me in this why radius is doing this ??? regards,

5 7

CentOS 6.3 and FreeRadius - can't authenticate to Unix
by Jacobs, Joseph 30 Oct '12

30 Oct '12

Hello, I'm a new user to Linux and Freeradius. I'm trying to set up Freeradius to authenticate against the local Linux user accounts. I'm having issues getting the "radtest" tool to authenticate against local users in the unix system. I'm using CentOS 6.3 - 64bit (uname - a output Linux Joe2dot0-freeradius 2.6.32-279.el6.x86_64 #1 SMP Fri Jun 22 12:19:21 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux) (Contents of the "etc/redhat-release" file CentOS release 6.3 (Final)) I used YUM to install Freeradius2 (2.1.12-4.el6_3) Here's the output of the "yum list installed" command freeradius.x86_64 2.1.12-4.el6_3 @updates freeradius-utils.x86_64 2.1.12-4.el6_3 @updates I installed the packages as 'root' I'm running 'radtest' while logged in a root. The users file is configured as follows: joe2 Auth-Type := System (I've tried this with both := and =) bob Cleartext-Password := "hello" When I run "radtest bob hello localhost 0 testing1234" *********Successful*********** (I don't use quotes when I input to linux) Here is the debug output from the radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 54241, id=124, length=73 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0x0333c5040a7f6b1a6051a1543e5bf4ea # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry bob at line 8 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "hello" [pap] Using clear text password "hello" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 124 to 127.0.0.1 port 54241 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 124 with timestamp +78 Ready to process requests. When I run "radtest joe2 secret localhost 0 testing1234" (I don't use quotes when I input to linux) *************Access-Reject from the server******************** Here is the debug output from the radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 40697, id=134, length=74 User-Name = "joe2" User-Password = "secret" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Message-Authenticator = 0xcf3011a6da2e12ec1e1a66746be3c6ad # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "joe2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry joe2 at line 6 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = System # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} ++[unix] returns notfound Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> joe2 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 134 to 127.0.0.1 port 40697 Waking up in 4.9 seconds. Cleaning up request 2 ID 134 with timestamp +212 Ready to process requests. I think I'm having an issue with freeradius reading the shadow file for the passwords, but then again, I'm not sure. One of the steps involved putting the group for freeradius to be "shadow" but there is no "shadow" group in the group file in CentOS 6.3. Here are the output for the ls - l in the etc directory for the password files -rw-r--r--. 1 root root 1579 Oct 29 15:26 passwd ----------. 1 root root 1110 Oct 29 15:26 shadow I also did confirm that I can log into my server using joe2 / secret password. Any help would be appreciated. Thanks, Joe This message and any attachments are intended only for the use of the addressee and may contain information that is privileged and confidential. If the reader of the message is not the intended recipient or an authorized representative of the intended recipient, you are hereby notified that any dissemination of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by e-mail and delete the message and any attachments from your system.

4 6

User authorize with Perl-Script
by Oliver Werner 30 Oct '12

30 Oct '12

Hello, I'm useing FreeRADIUS in Version 2.1.10. I would configure my Switch-Ports Mac-Based. When a Computer wired a Perl-Script should check the Username and gives VLAN back. For a simple Test i don't have some conditions in the Script only outputs: use strict; use warnings; use DBI; ### SwitchUser ### my $pass = $ARGV[0]; print 'Access-Accept'; print 'Cleartext-Password := "'.$pass.'"'; exit 0; my modules/exec looks here: exec { wait = yes program = "/usr/bin/perl /usr/local/test.pl %{User-Name}" input_pairs = request output = reply shell_escape = yes } and my sites-enabled/switch its this: authorize { exec expiration chap } authenticate { chap } post-auth { exec } When i wired with my PC Log Says following: # Executing section authorize from file /etc/freeradius/sites-enabled/switchport +- entering group authorize {...} [php] expand: %{User-Name} -> aa:bb:cc:dd:ee:ff Exec-Program output: Access-AcceptCleartext-Password := "aa:bb:cc:dd:ee:ff" Exec-Program-Wait: plaintext: Access-AcceptCleartext-Password := "aa:bb:cc:dd:ee:ff" Exec-Program: returned: 0 ++[php] returns ok ++[expiration] returns noop [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/switchport +- entering group authenticate {...} [chap] login attempt by "aa:bb:cc:dd:ee:ff" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. } # server switchport Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Anyone knows what is wrong in my Configuration?

3 3

Re: LDAP attribute mapping
by Bruce Nunn 30 Oct '12

30 Oct '12

I pull out only the attributes I need and change ldap.attrmap to match my schema. Personally, I can live with either config method. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> wrote: >Quick poll. > >For 3.0 the ldap module will be moving away from using the ldap.attrmap file and instead use a config based mapping. > >There are a few ways we are considering for organising the mapping. > >We can use something like the existing unlang: > >update control { > Cleartext-Password := userpassword >} > >update reply { > User-Name = radiusUserName >} > >update outer.reply { > Reply-Message = radiusReplyMessage >} > >Or something like rlm_rest and rlm_cache: > >update { > control:Cleartext-Password := userpassword > reply:User-Name = radiusUserName > reply.outer:User-Name = radiusUserName >} > >It really depends on whether people are actually using the full ldap.attrmap, or whether they're just pulling out one or two attributes. Each approach is as efficient as the other performance wise, so it comes down to which one people prefer. > >Any thoughts? > >-Arran > > > > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Ideal SO and hardware for FreeRadius+MySQL
by fknet 30 Oct '12

30 Oct '12

Hello people! What's the ideal Hardware (processor+memory) to run FreeRadius+MySQL for authentication of 3000 PPPoE users? Thanks Fabrício F Kammer

5 10