June 2013 - Freeradius-Users - lists.freeradius.org

inactive users can authenticate
by Mihajlo Joksimovic 28 Jun '13

28 Jun '13

Hi there, i have an uptodate Debian derivate with samba4. The base_filter rule in the modules/ldap file is not accepted. There i gave sambaacctflags but nothing happens. still all users get accepted. in Base_filter I can write what I want, it always like skips this point. So everyone can login, also the disabled accounts. Kind regards Mihajlo -- Adfinis SyGroup AG Mihajlo Joksimovic, System Engineer Güterstrasse 86 | CH-4053 Basel Tel. 061 333 80 33

7 13

rlm_perl not found
by Thomas Hermarij Maimann Andersen 28 Jun '13

28 Jun '13

Hi, I have a yum install free radius which I'm trying to use the perl module. I am following the examples/instructions here http://wiki.freeradius.org/modules/Rlm_perl But I'm getting an error when starting radiusd. server { # from file /etc/raddb/radiusd.conf modules { Module: Creating Auth-Type = Perl Module: Creating Auth-Type = ntlm_auth Module: Creating Auth-Type = LDAP Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load /etc/raddb/modules/perl[7]: Failed to link to module 'rlm_perl': file not found /etc/raddb/sites-enabled/default[51]: Failed to load module "perl". /etc/raddb/sites-enabled/default[51]: Failed to parse "perl" entry. Any help on how to resolve this? -- Med venlig hilsen / With best regards Thomas Andersen Systems and Network Administrator IT University in Copenhagen Rued Langgaards Vej 7 2300 København S Phone: +45 72185249 ________________________________________________________________ **NEVER DISCLOSE YOUR PASSWORD OR SHOE SIZE - NOT EVEN TO YOUR DENTIST**

2 1

Authenticate without password or wrong password
by Omer Faruk SEN 27 Jun '13

27 Jun '13

Hi , I want some certain users to authenticate even if they don't provide a password or the password they enter is not right. Can you guide me on this please? I think I must put a user in to a group and if the user is in that group I am to authenticate them even if they don't provide password or the password they provide is not true. Regards.

4 8

freeradius outer identity
by val john 27 Jun '13

27 Jun '13

Hi guys , i have freeradius server that authenticate with LDAP and set up was working fine , but when the client specifies the outer identity (some dummy user name ) Radius server taking that dummy user name as actual username , because of that LDAP authentication fails . (Authentication proceeds working file if the client not specifying any outer identity) Can you guys please advice , how to fix this issue Thank You John

2 1

eap sim authorization problem
by raptor raptor 27 Jun '13

27 Jun '13

Hi all, i have read anything about my problem, but i dont get any idea to solve in FR i get message like this : "rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org : 0 " "[sim_files] returnnot found " it's my log: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=215 User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000038013135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x538ea4f0fa860dbb61c7d2c88dbd8474 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 61 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x013d0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7239b8fc7204aacaafa19b7e0dac3020 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=265 Cleaning up request 0 ID 0 with timestamp +206 User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0x7239b8fc7204aacaafa19b7e0dac3020 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023d0058120a000007050000a6be580955eb9db84b9cd0ba4ac9ec71100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x7dd9b0c763e8fc3783f00303952476cb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 61 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim rlm_eap_sim: subtype= 10 start. +++> EAP-sim decoded packet: User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0x7239b8fc7204aacaafa19b7e0dac3020 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023d0058120a000007050000a6be580955eb9db84b9cd0ba4ac9ec71100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x7dd9b0c763e8fc3783f00303952476cb EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000a6be580955eb9db84b9cd0ba4ac9ec71 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 62 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x013e0050120b0000010d0000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f0b050000f9e2857eab3d7c389db0c2455af08b29 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7239b8fc7307aacaafa19b7e0dac3020 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +206 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=215 User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000038013135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0xdca4e2db7c20e750a430bef09ea6aebb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 87 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x01570014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb8d25eafbda3700c521f1ba966c28c6 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=265 Cleaning up request 2 ID 0 with timestamp +231 User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org " NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0xfb8d25eafbda3700c521f1ba966c28c6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02570058120a000007050000b6356c32e13a775e4150d27fa12bd917100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x3152ae01c462863ab1e119e0c24eac50 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 87 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim rlm_eap_sim: subtype= 10 start. +++> EAP-sim decoded packet: User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0xfb8d25eafbda3700c521f1ba966c28c6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02570058120a000007050000b6356c32e13a775e4150d27fa12bd917100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x3152ae01c462863ab1e119e0c24eac50 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000b6356c32e13a775e4150d27fa12bd917 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 88 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x01580050120b0000010d0000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f0b0500003b9af2c5246ca03fede9d65a01cda8e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb8d25eafad53700c521f1ba966c28c6 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 0 with timestamp +231 Ready to process requests. Thanx for your time and your answer

6 29

Users credentials?
by pedro moreno 26 Jun '13

26 Jun '13

Hi, I would like to know if is possible to do this simple app: Like a hotspot, the basic operation is u create user credentials(username+password), them user make the connection to your wifi network and the system request the credentials. I would like to know if I can send in the backgroud the user credentials? I mean, once the user access our network, if he click 1 button the system let him navigate, the click operation is to send a username+password automatically, can freeradius let me send this credentials with a php app in the background? Last question, can I close user connection went ever I want to? example, if user don't accept our terms close his connection automatically. Is possible? FreeRADIUS 2.x. Thanks!!!

3 3

Re: Changed Attributes
by George Innocent 26 Jun '13

26 Jun '13

Hi Experts I have checked the dictionary files and the attributes which are in existance; but i still get this error when i run debug mode. /usr/local/etc/raddb/users[157]: Parse error (check) for entry Alc-IPsec-Interface: Unknown attribute "" requires a hex string, not "private_ipsec" Errors reading /usr/local/etc/raddb/users /usr/local/etc/raddb/modules/files[7]: Instantiation failed for module "files" /usr/local/etc/raddb/sites-enabled/default[170]: Failed to load module "files". /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. root@Radius-pst:~# The profile of my user is: steve Cleartext-Password := "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 192.168.1.2, Framed-IP-Netmask = 255.255.255.0, Alc-IPsec-Interface = private_ipsec, Alc-IPsec-SA-Lifetime = 1200, Alc-IPsec-SA-Encr-Algorithm = aes128, Alc-IPsec-SA-Auth-Algorithm = sha1 Rgds On 24 June 2013 22:04, <A.L.M.Buxey(a)lboro.ac.uk> wrote: > Hi, > > > But when i comment the attributes the radtest is successful > > did you check my other statement: > > > 3) ensure that these attributes that you are using are in a > dictionary > > file and that the dictionary file is being read by the server when > it > > starts > > well? > > alan > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Regards: George Innocent.

5 8

RE:Not able to build FreeRadius on Solaris 10
by Rama Krishna 25 Jun '13

25 Jun '13

Hi Fazar, Thanks for your inputs. Build steps on the given URL page are still not sufficient for Solaris 10. Hence, I tried to install the already built binary using your link. It failed to install one of the dependencies for FreeRadius package and throwed following errors. ========== BEGINNING OF THE ERROR taken from "pkgutil -a CSWfreeradius" ========== ## Installing part 1 of 1. /opt/csw/share/doc/cas_texinfo/license /usr/sadm/install/scripts/i.cswtexinfo ERROR: attribute verification of </usr/sadm/install/scripts/i.cswtexinfo> failed pathname does not exist /usr/sadm/install/scripts/r.cswtexinfo ERROR: attribute verification of </usr/sadm/install/scripts/r.cswtexinfo> failed pathname does not exist [ verifying class <none> ] ERROR: attribute verification of </usr/sadm/install/scripts/i.cswtexinfo> failed pathname does not exist ERROR: attribute verification of </usr/sadm/install/scripts/r.cswtexinfo> failed pathname does not exist Installation of <CSWcas-texinfo> partially failed. ========== BEGINNING OF THE ERROR taken from "pkgutil -a CSWfreeradius" ========== Linux installation went thru fine. Hence, we are sticking with Linux based FreeRadius server for now. Regards, Rama -----Original Message----- From: freeradius-users-bounces+rlinga=zhone.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+rlinga=zhone.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Tuesday, June 25, 2013 12:44 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 98, Issue 81 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Not able to build FreeRadius on Solaris 10 (Rama Krishna) 2. Re: Not able to build FreeRadius on Solaris 10 (Fajar A. Nugraha) 3. Re: Username/Host authorization (nicolas.clo(a)ricoh-industrie.fr) 4. github & freeradius.org (Dagia Dorjsuren) ---------------------------------------------------------------------- Message: 1 Date: Mon, 24 Jun 2013 16:20:14 -0700 From: Rama Krishna <RLinga(a)zhone.com> To: freeradius-users(a)lists.freeradius.org Subject: Not able to build FreeRadius on Solaris 10 Message-ID: <0MOX005OD7HR7200(a)priority.oak.zhone.com> Content-Type: text/plain; charset="us-ascii" Hi There, I am trying to build FreeRadius 2.2 on Solaris 10 by following the steps given in below link. http://coova.org/JRadius/FreeRADIUS In that process, make is giving the following errors. Can someone help fixing these? Is there a ready to execute binary for FreeRadius for Solari 10 that I could download? gambit-12 { zms_release_2.4_gambit_gvu } >ls freeradius-server-2.2.0 freeradius-server-2.2.0.tar pax_global_header gambit-9 { zms_release_2.4_gambit_gvu } >cd freeradius-server-2.2.0gambit-10 { zms_release_2.4_gambit_gvu } >lsCOPYRIGHT Makefile config.guess debian libtool.m4 redhatCREDITS README config.log dialup_admin ltmain.sh scriptsINSTALL VERSION config.status doc man shareLICENSE acinclude.m4 config.sub install-sh mibs srcMake.inc aclocal.m4 configure libltdl missing suseMake.inc.in autogen.sh configure.in libtool raddb todogambit-11 { zms_release_2.4_gambit_gvu } >makemake[1]: Entering directory `/home/rlinga/freeRadius/freeradius-server-2.2.0'Making all in libltdl...make[2]: Entering directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'/usr/local/bin/make all-ammake[3]: Entering directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'/bin/bash ./libtool --tag=CC --mode=compile gcc -DHAV! E_CONFIG_H -I. -I. -I. -g -O2 -c -o ltdl.lo ltdl.c gcc -DHAVE_CONFIG_H -I. -I. -I. -g -O2 -c ltdl.c -fPIC -DPIC -o .libs/ltdl.oltdl.c: In function `tryall_dlopen':ltdl.c:2450: parse error before `data'ltdl.c:2452: `data' undeclared (first use in this function)ltdl.c:2452: (Each undeclared identifier is reported only onceltdl.c:2452: for each function it appears in.)make[3]: *** [ltdl.lo] Error 1make[3]: Leaving directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'make[2]: *** [all] Error 2make[2]: Leaving directory `/home/rlinga/freeRadius/freeradius-server-2.2.0/libltdl'make[1]: *** [libltdl] Error 2make[1]: Leaving directory `/home/rlinga/freeRadius/freeradius-server-2.2.0'make: *** [all] Error 2 Thanks, Rama

1 0

Building RPMS from main branch 3.x relase
by Divyesh Raithatha 25 Jun '13

25 Jun '13

Hello, Has anyone successfully built RPM's from the main branch 3.x? I am trying to build one but keep on running into errors. Similar to the ones I saw with the version 2.x.x branch (regarding version numbers, patches, libray file names) until the changes were pushed by Fajar on May 9th. redhat: package all modules in freeradius RPM ?ed336742a6? Browse code ?fajarnugraha authored May 09, 2013 redhat: only keep the last changelog from original spec file ?5240ada0f2? Browse code ?fajarnugraha authored May 09, 2013 redhat: package everything in freeradius rpm ?bcae31b171? Browse code ?fajarnugraha authored May 09, 2013 redhat: removed obsolete patches ?bc38b7d591? Browse code ?fajarnugraha authored May 09, 2013 redhat: README was renamed to README.rst ?766fd283ca? Browse code ?fajarnugraha authored May 09, 2013 redhat: refresh freeradius-cert-config.patch ?69d798819b? Browse code ?fajarnugraha authored May 09, 2013 redhat: add "make" to BuildRequires list ?50d0bf530b? Browse code ?fajarnugraha authored May 09, 2013 redhat: bump version in specfile to 2.2.1 ?561e929be6? Browse code ?fajarnugraha authored May 09, 2013 Thanks

4 3

github & freeradius.org
by Dagia Dorjsuren 25 Jun '13

25 Jun '13

Hello, I am a bit confused. What is the difference between github-freeradius https://github.com/FreeRADIUS/freeradius-server AND freeradius.org? I think the number of difference between them such as radius database table structure and etc...

2 1