May 2013 - Freeradius-Users - lists.freeradius.org

RE: Radclient receives response messages from different source port than destination port of request messages
by rosario.mattera＠accenture.com 28 May '13

28 May '13

Thanks Alan for your response. Anyway I can't modify RADIUS server configuration because does not belongs to my domain. The domain administrator told me that RADIUS server responds using a different source port because of Proxy-State attribute is used in the Access-Request. Is there a way to force "radclient" to recognize that response? I have to edit the source files? Regards, Rosario -----Original Message----- From: freeradius-users-bounces+rosario.mattera=accenture.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+rosario.mattera=accenture.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: martedì 28 maggio 2013 16:49 To: FreeRadius users mailing list Subject: Re: Radclient receives response messages from different source port than destination port of request messages rosario.mattera(a)accenture.com wrote: > I use radclient to send Access-Request messages to a RADIUS server > (towards 1812 port), which responds with Access-Accept messages with a > different source port number (e.g. 28120). So radclient prints out: > > rad_recv: Access-Accept packet from host 10.130.159.200 port 28120, > id=20, length=266 > > radclient: received response to request we did not send. (id=20 socket > 3) > > radclient: no response from server for ID 20 socket 3 > > How can I solve this problem? Fix the RADIUS server so that it responds correctly. No amount of poking the client will make the RADIUS server use the correct port. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

2 1

Radclient receives response messages from different source port than destination port of request messages
by rosario.mattera＠accenture.com 28 May '13

28 May '13

Hi everyone, I use radclient to send Access-Request messages to a RADIUS server (towards 1812 port), which responds with Access-Accept messages with a different source port number (e.g. 28120). So radclient prints out: rad_recv: Access-Accept packet from host 10.130.159.200 port 28120, id=20, length=266 radclient: received response to request we did not send. (id=20 socket 3) radclient: no response from server for ID 20 socket 3 How can I solve this problem? Regards, Rosario ________________________________ This message is for the designated recipient only and may contain privileged, proprietary, or otherwise confidential information. If you have received it in error, please notify the sender immediately and delete the original. Any other use of the e-mail by you is prohibited. Where allowed by local law, electronic communications with Accenture and its affiliates, including e-mail and instant messaging (including content), may be scanned by our systems for the purposes of information security and assessment of internal compliance with Accenture policy. ______________________________________________________________________________________ www.accenture.com

2 1

Freeradius: change user passwords through pam_radius
by Roberto Carna 28 May '13

28 May '13

Dear, I have a Linux box authenticating SSH users against Freeradius. It works OK. When the users go into the Linux box via SSH, I need them to change their own radius passwords. For this reason, I edited the /etc/pam.d/passwd file as follow: passwordsufficient pam_radius_auth.so above the following line password include system-auth

3 5

help
by Giovanni Perna 28 May '13

28 May '13

I send an access request( to port 1812), the server send the response (same sent port) but radclient log: radclient: received response to request we did not send. (id=20 socket 3) after 3 retry: radclient: no response from server for ID 20 socket 3 Access-REQUEST sent: User-Name=TESTT003-010300.001-11.71 Calling-Station-Id=00:22:D2:02:22B:E2|999999T00000001 Acct-Session-Id=AAAAAAAAAAAAAAAA-00000001 Proxy-State=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Can someone help me? -- Giovanni

2 2

rlm_sql_oracle:libclntsh.so.11.1: cannot open shared object file
by Okis Chuang 28 May '13

28 May '13

Hi guys, I'm now trying to build another "FreeRADIUS 2.2.0" with rlm_sql_oracle which using Oracle "instantclient 11.2.0.3.0" and backend "Oracle 11g". And the OS version is Linux x86_64 (including CentOS 6.2 & RHEL Server 5 Tikanga). I've tried many times following step by step on google. Unfortunately all i got was the error like below: -- Could not link driver rlm_sql_oracle: libclntsh.so.11.1: cannot open shared object file: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /opt/freeRADIUS-CoA/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /opt/freeRADIUS-CoA/etc/raddb/sites-enabled/default[191]: Failed to find "sql" in the "modules" section. /opt/freeRADIUS-CoA/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. -- I have no idea why it couldn't link libclntsh.so.11.1. I think I must be wrong in some way but just couldn't find the way out... Here are my installation steps: 1. ./configure --prefix=/opt/freeRADIUS --with-oracle-lib-dir=/usr/lib/oracle/11.2/client64/lib --with-oracle-include-dir=/usr/include/oracle/11.2/client64 and the following are configure logs -- === configuring in ./drivers/rlm_sql_oracle (/home/okis/freeradius-server-2.2.0/src/modules/rlm_sql/./drivers/rlm_sql_or acle) configure: running /bin/sh ./configure '--prefix=/opt/freeRADIUS-Oracle' '--with-oracle-include-dir=/usr/include/oracle/11.2/client64/' '--with-oracle-lib-dir=/usr/lib/oracle/11.2/client64/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for oci.h... checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed yes yes configure: creating ./config.status config.status: creating Makefile -- 2. make Making all in rlm_sql_oracle. gmake[9]: Entering directory `/home/okis/freeradius-server-2.2.0/src/modules/rlm_sql/drivers/rlm_sql_orac le' gmake[9]: Nothing to be done for `all'. gmake[9]: Leaving directory `/home/okis/freeradius-server-2.2.0/src/modules/rlm_sql/drivers/rlm_sql_orac le' It looks like *Nothing* done here. 3. make install After doning those regular steps, and finishing all config setup(e.g. uncomment $INCLUDE sql.conf, sql in authorize section; set up sql.conf), I tried to run radius -X, but like I said before, it failed to link .so file. Hence, I did the following steps again. 4. (1)cd ./src/modules/rlm_sql/drivers/rlm_sql_oracle (2)./configure --with-oracle-lib-dir=/usr/lib/oracle/11.2/client64/lib --with-oracle-include-dir=/usr/include/oracle/11.2/client64 (3)make -- /home/okis/freeradius-server-2.2.0/libtool --mode=compile gcc -I/home/okis/freeradius-server-2.2.0 -I/home/okis/freeradius-server-2.2.0/src -I//usr/include/oracle/11.2/client64 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/home/okis/freeradius-server-2.2.0/libltdl -I../.. -I/home/okis/freeradius-server-2.2.0/src/ -I/usr/include/oracle/11.2/client64 -c sql_oracle.c mkdir .libs gcc -I/home/okis/freeradius-server-2.2.0 -I/home/okis/freeradius-server-2.2.0/src -I//usr/include/oracle/11.2/client64 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/home/okis/freeradius-server-2.2.0/libltdl -I../.. -I/home/okis/freeradius-server-2.2.0/src/ -I/usr/include/oracle/11.2/client64 -c sql_oracle.c -fPIC -DPIC -o .libs/sql_oracle.o sql_oracle.c: In function 'sql_error': sql_oracle.c:66: warning: pointer targets in passing argument 5 of 'OCIErrorGet' differ in signedness //usr/include/oracle/11.2/client64/ociap.h:7265: note: expected 'OraText *' but argument is of type 'char *' sql_oracle.c: In function 'sql_init_socket': sql_oracle.c:179: warning: pointer targets in passing argument 4 of 'OCILogon' differ in signedness //usr/include/oracle/11.2/client64/ociap.h:7143: note: expected 'const OraText *' but argument is of type 'char *' sql_oracle.c:179: warning: pointer targets in passing argument 6 of 'OCILogon' differ in signedness //usr/include/oracle/11.2/client64/ociap.h:7143: note: expected 'const OraText *' but argument is of type 'char *' sql_oracle.c:179: warning: pointer targets in passing argument 8 of 'OCILogon' differ in signedness //usr/include/oracle/11.2/client64/ociap.h:7143: note: expected 'const OraText *' but argument is of type 'char *' sql_oracle.c: In function 'sql_query': sql_oracle.c:253: warning: pointer targets in passing argument 3 of 'OCIStmtPrepare' differ in signedness //usr/include/oracle/11.2/client64/ociap.h:7163: note: expected 'const OraText *' but argument is of type 'char *' sql_oracle.c: In function 'sql_select_query': sql_oracle.c:311: warning: pointer targets in passing argument 3 of 'OCIStmtPrepare' differ in signedness //usr/include/oracle/11.2/client64/ociap.h:7163: note: expected 'const OraText *' but argument is of type 'char *' gcc -I/home/okis/freeradius-server-2.2.0 -I/home/okis/freeradius-server-2.2.0/src -I//usr/include/oracle/11.2/client64 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/home/okis/freeradius-server-2.2.0/libltdl -I../.. -I/home/okis/freeradius-server-2.2.0/src/ -I/usr/include/oracle/11.2/client64 -c sql_oracle.c -o sql_oracle.o >/dev/null 2>&1 /home/okis/freeradius-server-2.2.0/libtool --mode=link gcc -release 2.2.0 \ -module -export-dynamic -L/usr/lib/oracle/11.2/client64/lib -o rlm_sql_oracle.la \ -rpath /opt/FR-Oracle/lib sql_oracle.lo -L/usr/lib/oracle/11.2/client64/lib -lclntsh -lnnz11 gcc -shared .libs/sql_oracle.o -L/usr/lib/oracle/11.2/client64/lib -lclntsh -lnnz11 -Wl,-soname -Wl,rlm_sql_oracle-2.2.0.so -o .libs/rlm_sql_oracle-2.2.0.so (cd .libs && rm -f rlm_sql_oracle.so && ln -s rlm_sql_oracle-2.2.0.so rlm_sql_oracle.so) ar cru .libs/rlm_sql_oracle.a sql_oracle.o ranlib .libs/rlm_sql_oracle.a creating rlm_sql_oracle.la (cd .libs && rm -f rlm_sql_oracle.la && ln -s ../rlm_sql_oracle.la rlm_sql_oracle.la) -- (4)make install -- # make install if [ "xrlm_sql_oracle" != "x" ]; then \ /home/okis/freeradius-server-2.2.0/libtool --mode=install /home/okis/freeradius-server-2.2.0/install-sh -c -c \ rlm_sql_oracle.la /opt/FR-Oracle/lib/rlm_sql_oracle.la || exit $?; \ rm -f /opt/FR-Oracle/lib/rlm_sql_oracle-2.2.0.la; \ ln -s rlm_sql_oracle.la /opt/FR-Oracle/lib/rlm_sql_oracle-2.2.0.la || exit $?; \ fi /home/okis/freeradius-server-2.2.0/install-sh -c -c .libs/rlm_sql_oracle-2.2.0.so /opt/FR-Oracle/lib/rlm_sql_oracle-2.2.0.so (cd /opt/FR-Oracle/lib && { ln -s -f rlm_sql_oracle-2.2.0.so rlm_sql_oracle.so || { rm -f rlm_sql_oracle.so && ln -s rlm_sql_oracle-2.2.0.so rlm_sql_oracle.so; }; }) /home/okis/freeradius-server-2.2.0/install-sh -c -c .libs/rlm_sql_oracle.lai /opt/FR-Oracle/lib/rlm_sql_oracle.la /home/okis/freeradius-server-2.2.0/install-sh -c -c .libs/rlm_sql_oracle.a /opt/FR-Oracle/lib/rlm_sql_oracle.a chmod 644 /opt/FR-Oracle/lib/rlm_sql_oracle.a ranlib /opt/FR-Oracle/lib/rlm_sql_oracle.a PATH="$PATH:/sbin" ldconfig -n /opt/FR-Oracle/lib ---------------------------------------------------------------------- Libraries have been installed in: /opt/FR-Oracle/lib If you ever happen to want to link against installed libraries in a given directory, LIBDIR, you must either use libtool, and specify the full pathname of the library, or use the `-LLIBDIR' flag during linking and do at least one of the following: - add LIBDIR to the `LD_LIBRARY_PATH' environment variable during execution - add LIBDIR to the `LD_RUN_PATH' environment variable during linking - use the `-Wl,--rpath -Wl,LIBDIR' linker flag - have your system administrator add LIBDIR to `/etc/ld.so.conf' See any operating system documentation about shared libraries for more information, such as the ld(1) and ld.so(8) manual pages. ---------------------------------------------------------------------- -- While it still cannot work now...Anyone has any recommendation about this? If needed any other information for debugging, please let me know directly. Any help would be appreciate!! Okis.

2 2

SSH PAM authentication before local authentication
by Roberto Carna 27 May '13

27 May '13

Dear, finally I could implement the SSH PAM authentication of Linux users against a Freeradius server. Everything was OK, I had to create a local user in my Linux server (without password) and the authentication was against my freeradius server. The clients com efrom other boxes, both windos and linux. But now, suppose the freeradius server is offline, how can I tell the Linux server that if Freeradius is offline it has to authenticate in local mode (local PAM). In this way, I have to have a special user in my Linux server to access it through SSH in case freeradius is off. Thanks a lot, Roberto

2 1

CHAP only configuration
by Navodit Bhardwaj 27 May '13

27 May '13

Hi Can someone guide me how to set CHAP only authentication. I am using following entry in my users.conf username Auth-Type := Local, Password := password Fall-Through = Yes Can someone help me with detail steps for configuring CHAP -- br, Navodit Bhardwaj Hughes Systique Corporation

5 6

Testing failure during setup
by Elizabeth Fife 27 May '13

27 May '13

Hi All I am ready for an earbending likely from Alan but for the record I have read the debug and done as much searching as my brain can handle before this post I am setting up free radius 2.2.0 on two Ubuntu Servers server12 (192.168.0.92) and server13 (192.168.0.93). So far I have installed latest freeradius version 2.2.0 on each server and added a test user in the file users: username = user1 password = secret I have the added each machine as a client of the other for testing in clients.conf they both have the shared secret aaabbb With the following testing command on server12 (192.168.0.92) ( echo "User-Name = \"user1\""; \ echo "Cleartext-Password = \"secret\""; \ echo "EAP-Code = Response"; \ echo "EAP-Id = 210"; \ echo "EAP-Type-Identity = \"user1\""; \ echo "Message-Authenticator = 0x00"; ) | \ radeapclient -x 192.168.0.93 auth aaabbb I see on that same machine the following output Sending Access-Request packet to host 192.168.0.93 port 1812, id=125, length=0 User-Name = "user1" Cleartext-Password = "secret" EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = 0x7573657231 Message-Authenticator = 0x00 EAP-Message = 0x02d2000a017573657231 Received Access-Challenge packet from host 192.168.0.93 port 1812, id=125, length=80 EAP-Message = 0x01d300160410b96bc21423da6e34055a25bd522be5f4 Message-Authenticator = 0x0881b25f760ebcfb4a9e2a6fc18ee4e1 State = 0x79e3295879302d94ae994e3671a52576 EAP-Id = 211 EAP-Code = Request EAP-Type-MD5-Challenge = 0x10b96bc21423da6e34055a25bd522be5f4 Sending Access-Request packet to host 192.168.0.93 port 1812, id=126, length=57 User-Name = "user1" Cleartext-Password = "secret" EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 EAP-Type-MD5-Challenge = 0x10a6ecf77fb2601ce855274efb4523b6d7 State = 0x79e3295879302d94ae994e3671a52576 EAP-Message = 0x02d300160410a6ecf77fb2601ce855274efb4523b6d7 rad_verify: Received packet from 192.168.0.93 with invalid Message-Authenticator! (Shared secret is incorrect.) I have server13 (192.168.0.93) running in debug and its out put is below. It seems to end by successfully sending Sending Access-Accept of id 126 to 192.168.0.92 port 40535 Admittedly for some reason (?timing) there seems to be a duplicate rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 but it too is ultimately accepted Sending duplicate reply to client server12 port 40535 - ID: 126 Sending Access-Accept of id 126 to 192.168.0.92 port 40535 How do I reconcile this is it working or not (Sub question why are there two requests?) Debuging output from server13 (192.168.0.93) server13:~$ cat /tmp/debug.txt FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Apr 29 2013 at 12:57:54 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/mods-enabled/ including configuration file /etc/freeradius/mods-enabled/counter including configuration file /etc/freeradius/mods-enabled/chap including configuration file /etc/freeradius/mods-enabled/detail.example.com including configuration file /etc/freeradius/mods-enabled/unix including configuration file /etc/freeradius/mods-enabled/dhcp_sqlippool including configuration file /etc/freeradius/mods-enabled/pap including configuration file /etc/freeradius/mods-enabled/ntlm_auth including configuration file /etc/freeradius/mods-enabled/sqlcounter_expire_on_login including configuration file /etc/freeradius/mods-enabled/ippool including configuration file /etc/freeradius/mods-enabled/preprocess including configuration file /etc/freeradius/mods-enabled/attr_rewrite including configuration file /etc/freeradius/mods-enabled/sradutmp including configuration file /etc/freeradius/mods-enabled/mschap including configuration file /etc/freeradius/mods-enabled/expiration including configuration file /etc/freeradius/mods-enabled/wimax including configuration file /etc/freeradius/mods-enabled/soh including configuration file /etc/freeradius/mods-enabled/cache including configuration file /etc/freeradius/mods-enabled/expr including configuration file /etc/freeradius/mods-enabled/realm including configuration file /etc/freeradius/mods-enabled/cui including configuration file /etc/freeradius/mods-enabled/perl including configuration file /etc/freeradius/mods-enabled/ldap including configuration file /etc/freeradius/mods-enabled/radrelay including configuration file /etc/freeradius/mods-enabled/policy including configuration file /etc/freeradius/mods-enabled/echo including configuration file /etc/freeradius/mods-enabled/dynamic_clients including configuration file /etc/freeradius/mods-enabled/digest including configuration file /etc/freeradius/mods-enabled/always including configuration file /etc/freeradius/mods-enabled/smsotp including configuration file /etc/freeradius/mods-enabled/checkval including configuration file /etc/freeradius/mods-enabled/linelog including configuration file /etc/freeradius/mods-enabled/etc_group including configuration file /etc/freeradius/mods-enabled/detail.log including configuration file /etc/freeradius/mods-enabled/redis including configuration file /etc/freeradius/mods-enabled/attr_filter including configuration file /etc/freeradius/mods-enabled/smbpasswd including configuration file /etc/freeradius/mods-enabled/passwd including configuration file /etc/freeradius/mods-enabled/detail including configuration file /etc/freeradius/mods-enabled/otp including configuration file /etc/freeradius/mods-enabled/logintime including configuration file /etc/freeradius/mods-enabled/radutmp including configuration file /etc/freeradius/mods-enabled/mac2vlan including configuration file /etc/freeradius/mods-enabled/mac2ip including configuration file /etc/freeradius/mods-enabled/acct_unique including configuration file /etc/freeradius/mods-enabled/inner-eap including configuration file /etc/freeradius/mods-enabled/krb5 including configuration file /etc/freeradius/mods-enabled/rediswho including configuration file /etc/freeradius/mods-enabled/files including configuration file /etc/freeradius/mods-enabled/replicate including configuration file /etc/freeradius/mods-enabled/exec including configuration file /etc/freeradius/mods-enabled/sql_log including configuration file /etc/freeradius/mods-enabled/pam including configuration file /etc/freeradius/mods-enabled/opendirectory including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/freeradius" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client server12 { ipaddr = 192.168.0.92 netmask = 32 require_message_authenticator = no secret = "aaabbb" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/mods-enabled/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/mods-enabled/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/mods-enabled/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/mods-enabled/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/mods-enabled/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/mods-enabled/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/mods-enabled/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/mods-enabled/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/mods-enabled/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/mods-enabled/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius/huntgroups reading pairlist file /etc/freeradius/hints Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/mods-enabled/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/mods-enabled/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius/users reading pairlist file /etc/freeradius/acct_users reading pairlist file /etc/freeradius/preproxy_users Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/mods-enabled/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/mods-enabled/detail detail { detailfile = "/var/log/freeradius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/mods-enabled/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/mods-enabled/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/freeradius/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 50043 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=125, length=57 User-Name = "user1" Message-Authenticator = 0x7db7801ac036b755a1f837e5f569d423 EAP-Message = 0x02d2000a017573657231 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 210 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry user1 at line 173 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 125 to 192.168.0.92 port 40535 EAP-Message = 0x01d300160410b96bc21423da6e34055a25bd522be5f4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x79e3295879302d94ae994e3671a52576 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=125, length=57 Sending duplicate reply to client server12 port 40535 - ID: 125 Sending Access-Challenge of id 125 to 192.168.0.92 port 40535 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 User-Name = "user1" Message-Authenticator = 0xe3405f0eb17fbb3e31b973ea45563b7b State = 0x79e3295879302d94ae994e3671a52576 EAP-Message = 0x02d300160410a6ecf77fb2601ce855274efb4523b6d7 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 211 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry user1 at line 173 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 126 to 192.168.0.92 port 40535 EAP-Message = 0x03d30004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.0.92 port 40535, id=126, length=87 Sending duplicate reply to client server12 port 40535 - ID: 126 Sending Access-Accept of id 126 to 192.168.0.92 port 40535 Waking up in 4.9 seconds. Cleaning up request 0 ID 125 with timestamp +16 Cleaning up request 1 ID 126 with timestamp +16 Ready to process requests.

2 1

user from particular NAS-IP-Address
by Pete Ashdown 26 May '13

26 May '13

I'm trying to restrict a guest user from a single NAS-IP-Address via "users" and I can't get it to work. Doesn't work: test NAS-IP-Address == "127.0.0.1" Auth-Type := Accept test NAS-IP-Address == "127.0.1.1" Auth-Type := Accept Works, but it isn't restricted by NAS: test Auth-Type := Accept I've also tried "Calling-Station-ID == 127.0.1.1" to no avail. Also, how would I do this for a group of NAS IP addresses? Is it possible to assign them to a group in "clients.conf" that can be later checked against in "users"? Where is the documentation of what can be tested against in the "users" file?

4 5

Re: Auth-Type = Reject not being obeyed
by Matthew Melbourne 26 May '13

26 May '13

I think Phil's diagnosis is correct; 'Auth-Type := Reject' requires the ':=' operator to reject a CHAP authentication. Unfortunately, it's not always easy to place a live production system in debug mode, hence the initial "is this something stupid" question :) (And apologies for the lack of a subject line in the original post). Cheers, Matt -----Original Message----- Date: Fri, 24 May 2013 17:31:29 +0100 From: Phil Mayers <p.mayers(a)imperial.ac.uk> To: freeradius-users(a)lists.freeradius.org Subject: Re: Auth-Type = Reject not being obeyed Message-ID: <519F95E1.6010100(a)imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 24/05/13 17:19, Alan Buxey wrote: > The only difference I can see is that the first example uses a > plain-text password, and the RADIUS on the LNS is using CHAP? > > The backend database has "=" in the 'op' field (and not ":="), so the > returned attribute is "Auth-Type = Reject" and not "Auth-Type := > Reject", but it is correctly rejected using radtest/radclient, and I > believe the "=" operand to be correct. You might have this: authorize { ... chap sql ... } ..and Auth-Type is already set by chap, hence "=" doesn't overwrite it. Anyway, you're not correct that "=" is the right operator; ":=" means "force" i.e. set this attribute to this value, always, and that's what you want to do here, right? "=" means "set if unset" As has also been pointed out - show "radiusd -X" for a problem auth (and set a subject line...)

2 1