March 2012 - Freeradius-Users - lists.freeradius.org

Cannot authenticate TinyRadius with freeRadius
by ulislam.raihan 15 Mar '12

15 Mar '12

Hi All, I am using Tiny Radius client to authenticate with freeRadius Server. But from freeRadius server(version 2.1.10) it can not read the password.I am getting following msg from freeRadius server. The user name is testing. Password is password. Secret is testing123. I have test the username and password with radtest that comes with freeRadius and it works. The entry in users file is following. *testing Cleartext-Password == "password"* I will be very great full to you . if any one ca tell me how to fix it. Thanks Raihan *Msg from FreeRadius Server* rad_recv: Access-Request packet from host 127.0.0.1 port 49851, id=1, length=59 User-Name = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 123 User-Password = "\317\356`\275\277\377d%q\321\341o2خ\303" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry testing at line 49 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "��`��d%q��o2خ�" [pap] Using clear text password "password" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 1 to 127.0.0.1 port 49851 Waking up in 4.9 seconds. Cleaning up request 5 ID 1 with timestamp +364 *JAVA source code* import java.io.IOException; import org.tinyradius.*; import org.tinyradius.packet.AccessRequest; import org.tinyradius.packet.RadiusPacket; import org.tinyradius.util.RadiusClient; import org.tinyradius.util.RadiusException; public class JavaRadiusClient { /** * @param args */ public static void main(String[] args) { // TODO Auto-generated method stub //JavaRadiusClient jrc = new JavaRadiusClient(); //jrc.secndAuthentication(); RadiusClient rc = new RadiusClient("localhost"," testing123"); try { if (rc.authenticate("testing", "password")) { System.out.println("Authnticated"); } else System.out.println("Not Authnticated"); } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } public void secndAuthentication(){ RadiusClient rc = new RadiusClient("localhost"," testing123"); AccessRequest ar = new AccessRequest("testing", "password"); //ar.setAuthProtocol(AccessRequest.AUTH_CHAP); // or AUTH_PAP ar.setAuthProtocol(AccessRequest.AUTH_PAP); // or AUTH_PAP ar.addAttribute("NAS-IP-Address", "127.0.0.1"); ar.addAttribute("NAS-Port" ,"123"); RadiusPacket response; try { response = rc.authenticate(ar); if (response.getPacketType() == RadiusPacket.ACCESS_ACCEPT) { System.out.println("Authnticated"); } } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/Cannot-authenticate-TinyRadius-with… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

SQL_LOG Interim Update missing "partial" config error? huh?
by Christiaan Rademan 15 Mar '12

15 Mar '12

Greetings Everyone, I am using FreeRadius + mySQL + SQLIPPOOL. FreeRADIUS Version 2.1.11. The start and stop accounting records work fine. My issue is I keep getting the following in the logs: Tue Mar 13 22:18:33 2012 : Info: [sql_log] Couldn't find an entry Interim-Update in the config section. Any idea why the interim-updates not working? I have looked through the configuration, I cant find what config section it refers too? I mean the stuff should all be configured as per default for interim update sql query etc is still in raddb/sql/mysql/dialup.conf what special configuration do I have todo? Or where can I go read about it? Please advice! Many thanks! -- Christiaan Rademan - JNCIE #661 Mobile: +27 83 419 2078 E-mail: christiaan.rademan(a)gmail.com

3 3

FreeRADIUS 1.1.2 -> 2.1.12 migration steps
by Martin Mielke 15 Mar '12

15 Mar '12

All, At my new working place I have inherited a FR 1.1.3 running on CentOS 5.6. Beyond being outdated and unsupported, this FR setup is causing a lot of problems so I plan a migration to RHEL5 and FR 2.1.12. I've been searching but I cannot find a procedure describing which steps to follow in order to migrate from one server/version to another. Can someone please shed some light or point me in the right direction? TIA, Martin

9 13

Very large environment depending on FreeRadius
by Christiaan Rademan 15 Mar '12

15 Mar '12

Greetings guys, Need advice before going live: I have deployed a FreeRadius server in an environment with 2,491,000 subscribers. GGSN 2,491,000 MSISDN subscribers. 3 APN(s). 1 APN will be authenticated locally: 830 000 subscribers 1 APN will be proxied for: 1,660,000 subscribers 1 APN another will be proxied for: 1,660,000 subsicbers. BRAS for PPPOE is 1000 subscribers. We tested the configuration and it was working, with attribute filters on proxy etc.. for all our requirements. Using MYSQL Backend and SQL IP Pool to hand out IP addresses for localally authenticated. Also have a secondary standby FreeRadius, with mysql replication using a bunch of additional scripts I wrote to handle redundancy and consistency checks. The system is running live for the 1000 subscribers. We about to swing over the 2,491,000 mobile subscribers... Can you please advice me on anything I should watch out for or plan for? Should I be worried about tuning the ports? listening on multiple ports for auth+acct? anything strange? Any tips??? :-) go mad, i need to ensure this runs smoothly... System is running on Ubuntu Linux Server. -- Christiaan Rademan - JNCIE #661 Mobile: +27 83 419 2078 E-mail: christiaan.rademan(a)gmail.com

3 3

Cannot authenticate TinyRadius with freeRadius
by ulislam.raihan 15 Mar '12

15 Mar '12

Hi All, I am using Tiny Radius client to authenticate with freeRadius Server. But from freeRadius server(version 2.1.10) it can not read the password.I am getting following msg from freeRadius server. The user name is testing. Password is password. Secret is testing123. I have test the username and password with radtest that comes with freeRadius and it works. The entry in users file is following. *testing Cleartext-Password == "password"* I will be very great full to you . if any one ca tell me how to fix it. Thanks Raihan *Msg from FreeRadius Server* rad_recv: Access-Request packet from host 127.0.0.1 port 49851, id=1, length=59 User-Name = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 123 User-Password = "\317\356`\275\277\377d%q\321\341o2خ\303" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry testing at line 49 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "��`��d%q��o2خ�" [pap] Using clear text password "password" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 1 to 127.0.0.1 port 49851 Waking up in 4.9 seconds. Cleaning up request 5 ID 1 with timestamp +364 *JAVA source code* import java.io.IOException; import org.tinyradius.*; import org.tinyradius.packet.AccessRequest; import org.tinyradius.packet.RadiusPacket; import org.tinyradius.util.RadiusClient; import org.tinyradius.util.RadiusException; public class JavaRadiusClient { /** * @param args */ public static void main(String[] args) { // TODO Auto-generated method stub //JavaRadiusClient jrc = new JavaRadiusClient(); //jrc.secndAuthentication(); RadiusClient rc = new RadiusClient("localhost"," testing123"); try { if (rc.authenticate("testing", "password")) { System.out.println("Authnticated"); } else System.out.println("Not Authnticated"); } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } public void secndAuthentication(){ RadiusClient rc = new RadiusClient("localhost"," testing123"); AccessRequest ar = new AccessRequest("testing", "password"); //ar.setAuthProtocol(AccessRequest.AUTH_CHAP); // or AUTH_PAP ar.setAuthProtocol(AccessRequest.AUTH_PAP); // or AUTH_PAP ar.addAttribute("NAS-IP-Address", "127.0.0.1"); ar.addAttribute("NAS-Port" ,"123"); RadiusPacket response; try { response = rc.authenticate(ar); if (response.getPacketType() == RadiusPacket.ACCESS_ACCEPT) { System.out.println("Authnticated"); } } catch (IOException e) { // TODO Auto-generated catch block e.printStackTrace(); } catch (RadiusException e) { // TODO Auto-generated catch block e.printStackTrace(); } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/Cannot-authenticate-TinyRadius-with… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

Using freeRadius with OTP and gateway
by Mercier Valentin 15 Mar '12

15 Mar '12

Hi everyone, I'm using Freeradius 2.1.12 on a server Debian. I have an another server Debian with Coovachilli (captive portal) and an Access Point based on Ruckus OS. When my users connected on the AP, a web page is coming with a formular to connect. Then the user enter is information (username and password) and Coovachilli made the authentication on the radius and this is working fine. Now I want to make something different, when the user connected on the AP, I want that he received a little formular, then he need to enter a username (not know on the radius) and i want the radius to create a One Time Password and send it to the user (on an another webpage). And the user send this OTP via SMS to a smsm gateway to finish the authentication, is that possible, and if yes, could someone explain to me how I can make it ? For the gateway sms I am using SMSLib (java library) on the same server as freeradius. Best regards and sorry for my bad english (from switzerland). -- Mercier Valentin

4 5

radius.log rotation
by Shreya Shah 15 Mar '12

15 Mar '12

Hi, How can we rotate radius.log file ? -Shreya.

2 1

Creating Certificates for EAP
by suggestme 15 Mar '12

15 Mar '12

Hi, I am trying to create certificates in Freeradius going inside /usr/local/etc/raddb/certs. I need these certificates for EAP-TTLS authentication for wireless access points. As suggested in deployingradius.com and README inside /usr/local/etc/raddb/certs; I tried to create "Test Certificates" for testing purpose at first. I tried the command "make" inside /usr/local/etc/raddb/certs, but it doesn't do anything, i.e. doesn't show any certificates building. Also I tried "./bootstrap" going inside the same certs directory; it also doesn't do anything. I don't see any certificates like "root CA" that has been built after I run "make" or "./bootstrap" command inside certs directory. I have already installed "openssl" in my machine with freebsd in which freeradius server is installed. Is there anything I am missing? Your suggestions would be greately appreciated. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Creating-Certificates-for-EAP-tp556… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

Question about certs and Microsoft
by Scott McLane Gardner 14 Mar '12

14 Mar '12

In the beginning of the cert documentation, it says: The Microsoft "XP Extensions" will be automatically included in the server certificate. Without those extensions Windows clients will refuse to authenticate to FreeRADIUS. But I use a certificate authority, so later on in the documentation, it says: If you have an existing certificate authority, and wish to create a certificate signing request for the server certificate, edit server.cnf as above, and type the following command. $ make server.csr You will have to ensure that the certificate contains the XP extensions needed by Microsoft clients. How do I go about ensuring this? Do I have to request them to be added from the CA?

3 9

pam_radius_auth x86_64 password garbled RHEL/CENTOS 5.8
by Judd Maltin 14 Mar '12

14 Mar '12

Hi Folks, I'm compiling my pam_radius_auth on x86_64 source and getting the following in my logs: Mar 14 12:57:29 app2 sshd[12858]: pam_radius_auth: Got user name jmaltin@<ip_removed_by_poster> Mar 14 12:57:29 app2 sshd[12858]: pam_radius_auth: Sending RADIUS request code 1 Mar 14 12:57:29 app2 sshd[12858]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1005286112. Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: RADIUS server 127.0.0.1 failed to respond Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: DEBUG: get_ipaddr(Add) returned 0. Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: Failed looking up IP address for RADIUS server Add (errcode=9) Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1005286112. Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: Got RADIUS response code 3 Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: authentication failed Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: Got user name jmaltin@<removed_by_poster> Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: Got password ^M^?INCORRECT Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: Sending RADIUS request code 1 Mar 14 12:57:30 app2 sshd[12858]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1005286112. Mar 14 12:57:31 app2 sshd[12858]: pam_radius_auth: RADIUS server 127.0.0.1 failed to respond Mar 14 12:57:31 app2 sshd[12858]: pam_radius_auth: DEBUG: get_ipaddr(Add) returned 0. Mar 14 12:57:31 app2 sshd[12858]: pam_radius_auth: Failed looking up IP address for RADIUS server Add (errcode=9) Mar 14 12:57:31 app2 sshd[12858]: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 1005286112. Mar 14 12:57:31 app2 sshd[12858]: pam_radius_auth: Got RADIUS response code 3 Mar 14 12:57:31 app2 sshd[12858]: pam_radius_auth: authentication failed Mar 14 12:57:31 app2 sshd[12858]: Failed password for invalid user jmaltin(a)voxel.net from <ip_removed_by_poster> port 44398 ssh2 What's the magic way to compile this for x86_64? Notice I added the -m64 to try to force 64 bit. [root@app2 pam_radius-1.3.17]# make cc -Wall -fPIC -m64 -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function ‘talk_radius’: pam_radius_auth.c:886: warning: pointer targets in passing argument 6 of ‘recvfrom’ differ in signedness pam_radius_auth.c: In function ‘pam_sm_authenticate’: pam_radius_auth.c:1102: warning: assignment from incompatible pointer type cc -Wall -fPIC -m64 -c -o md5.o md5.c ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so [root@app2 pam_radius-1.3.17]# Thanks folks! -- Judd Maltin T: 917-882-1270 F: 501-694-7809 A loving heart is never wrong.

2 2