- Freeradius-Users - lists.freeradius.org

Segfaulting with rlm_perl
by Norman Elton 02 Sep '11

02 Sep '11

I'm beginning the process of replacing a home-grown RADIUS server with freeradius, a good idea on many many fronts. The server will interact with our backend databases in order to determine attributes to inject into the access-accept messages. For initial development, I've begun work on a perl script that is interacting with freeradius 2.1.10. I'm a little alarmed that a malfunctioning perl script can segfault the entire server. I was hoping that freeradius could compartmentalize a failing script, restarting it as necessary. Admittedly, during development, my scripts are not production-ready, and there are lots of safety checks that simply aren't there. But I'm worried that, going into production, we'll discover an unexpected corner-case that crashes our entire radius infrastructure (not a good thing). Is the best practice simply to make sure you're scripts are bullet-proof? Or is there a more stable method of interacting with an external resource? I chosen rlm_perl because the script didn't need to be instantiated every time (as with rlm_exec), but perhaps we'd be better off relying on rlm_exec if it is more tolerant of corner-case failures. Thanks, Norman

5 7

cisco 3825 authentication error
by Dom 02 Sep '11

02 Sep '11

That is why I am so confused. I do have this user in the users file and even tested authentication using NTradping and it works fine going directly from the Internet to the radius server. However when I try to authenticate via the LNS I see this error. any idea's. Message: 4 Date: Fri, 02 Sep 2011 09:54:50 +0200 From: Bj?rn Mork<bjorn(a)mork.no> Subject: Re: cisco 3825 authentication error To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID:<87r53zjs51.fsf(a)nemi.mork.no> Content-Type: text/plain; charset=utf-8 Dom<dversace(a)tekcorner.ca> writes: > [pap] WARNING! No "known good" password found for the user. Looks good so far, but you need to tell freeradius the password for this user... E.g. by adding something like this to the "users" file: aewais(a)domain.com Cleartext-Password := "password" or configure some database backend or whatever. It's all in the docs Bj?rn * /To/:freeradius-users@lists.freeradius.org <mailto:freeradius-users%40lists.freeradius.org> * /Subject/: cisco 3825 authentication error * /From/: Dom <dversace(a)tekcorner.ca <mailto:dversace%40tekcorner.ca>> * /Date/: Thu, 01 Sep 2011 15:45:02 -0400 * /Reply-to/: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org <mailto:freeradius-users%40lists.freeradius.org>> * /User-agent/: Mozilla/5.0 (Windows NT 6.1; rv:6.0.1) Gecko/20110830 Thunderbird/6.0.1 ------------------------------------------------------------------------ I am trying to terminate vpdn sessions through our cisco 3825 usingfreeradius. I am new to this whole process and I was hoping to get someassistance with the missing configuration.Below is the error message I am receiving when trying to authenticatevia the router.rad_recv: Access-Request packet from host 64.34.66.5 port 1645, id=19,length=135 Framed-Protocol = PPP User-Name = "aewais(a)domain.com" User-Password = "password" Calling-Station-Id = "bas203300000455" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 532 NAS-Port-Id = "Uniq-Sess-ID532" Service-Type = Framed-User NAS-IP-Address = 64.34.66.5 # Executing section authorize from file/etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "domain.com" for User-Name = "aewais(a)domain.com" [suffix] No such realm "domain.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user.Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request:Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aewais(a)domain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 19 to 64.34.66.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 19 with timestamp +381 Ready to process requests.

2 1

Radius with mysql issue
by cktan 02 Sep '11

02 Sep '11

Hi All, Need help a bit, I've several freeradius (2.x) servers with mysql as backend running for several services. Lately I noticed there is 1 of the radius who will accept any password so long the user account is exist in radcheck. Still trying to trace where the problem is, and would appreciate if someone can share with me is any. Cheers, CK -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 8

Help: Error in PEAP configuration
by Andrei M. Castillo 02 Sep '11

02 Sep '11

Hi guys, I encountered this error when starting radiusd -X trying to make it work with peap. Can you help me fix this or give me an idea how to? Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } rlm_eap: No such sub-type for default EAP type peap /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/inner-tunnel[237]: Failed to load module "eap". /usr/local/etc/raddb/sites-enabled/inner-tunnel[190]: Errors parsing authenticate section. I followed this procedure in installing freeradius with openssl. ======================= Installation of OpenSSL 0.9.8j: ======================= $ wget http://www.openssl.org/source/openssl-0.9.8j.tar.gz $ tar xzf openssl-0.9.8j.tar.gz $ cd openssl-0.9.8j $ ./config --prefix=/usr/local/openssl shared $ make $ sudo make install ====================== Installation of Freeradius 2.14: ====================== $ wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.3.tar.gz $ tar xzf freeradius-server-2.1.3.tar.gz $ cd freeradius-server-2.1.3 $ ./configure --with-openssl --with-openssl-includes=/usr/local/openssl/include/ --with-openssl-libraries=/usr/local/openssl/lib/ $ make $ sudo make install PS: If needed, do a "sudo ldconfig", and in case of error consult the file "config.log". Thank you. Drei

2 1

Using EAP-PEAT as authentiction type. How to save None-cleartext password?
by 2394263740 02 Sep '11

02 Sep '11

Hello, I'm using free radius server 2.1.11 on Linux Enterprise Server 6.1. OS: Linux Enterprise Server 6.1 Radius: free radius server 2.1.11 Database: Mysql The users are using WIFI devices connect to the WIFI network. The authentiction type is being used is EAP-PEAP. Can you please give some advise, to save none-cleartext password in MySQL database radcheck table? Thanks! Tom

2 1

cisco 3825 authentication error
by Dom 02 Sep '11

02 Sep '11

I am trying to terminate vpdn sessions through our cisco 3825 using freeradius. I am new to this whole process and I was hoping to get some assistance with the missing configuration. Below is the error message I am receiving when trying to authenticate via the router. rad_recv: Access-Request packet from host 64.34.66.5 port 1645, id=19, length=135 Framed-Protocol = PPP User-Name = "aewais(a)domain.com" User-Password = "password" Calling-Station-Id = "bas203300000455" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 532 NAS-Port-Id = "Uniq-Sess-ID532" Service-Type = Framed-User NAS-IP-Address = 64.34.66.5 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "domain.com" for User-Name = "aewais(a)domain.com" [suffix] No such realm "domain.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aewais(a)domain.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 19 to 64.34.66.5 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 19 with timestamp +381 Ready to process requests.

2 1

EAP-TLS/PEAP authentication problem(can not reply correct attribute)
by gary 02 Sep '11

02 Sep '11

Hi All I have NAS client which support WISPr standard working with freeradius 2.1.10+MySQL 5.5 install on Fedora OS. I create my test certificate and configure EAP-TLS/PEAP authentication well in my setup. I am using WINDOWS XP as client pc it can pass authentication but freeradius can not reply correct attribute I configured such as bandwidth control. I noticed in the reply attribute the vendor is Microsoft not WISPr. I wonder if this is WINDOWS default setting how can I modify so that FR can reply the correct attribute I configured? Best Regards Gary BROWAN COMMUNICATIONS INC. Tel:886-3-600-6899 ext.4842 Fax:886-3-597-2970 e-mail:gary.yang@browan.com

3 5

Using encrypted passwords in users file
by sundoo 02 Sep '11

02 Sep '11

Hello, I'm new to FreeRadius and to linux. Maybe this question will sound stupid, but I really need you help. I have a server running freeradius. These are some outputs of the configuration: *etc/freeradius/radiusd.conf* # passwd = /etc/passwd shadow = /etc/shadow # group = /etc/group */etc/freeradius/users* test1 Auth-Type := Crypt-Local, User-Password := "$1$NzW2iwkn$ygDcJgb4WhAEqQYfySFkj/" Service-Type = Administrative-User, Cajun-Service-Type := 3, */etc/shadow* test1:$1$cnEh49V6$Q.68mw.3P5rgmsfhbo/iC1:15217:0:99999:7::: I would like to change the password for the user test1. But in the users file I see only the encrypted password. Where is the original password stored ? How do I change it ? Thanks a lot for your help. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-encrypted-passwords-in-users-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

None
by det.explorer＠yahoo.com 02 Sep '11

02 Sep '11

Hi, Is it possible to proxy based on a group the user belongs to? Or attribute? Or based on NAS from where the request was received? Aside from REALM, is there any other criteria that can be used to decide whether or not to proxy a request? Thanks, Det

4 4

Example configuration that proxy PEAP MSCHAPv2 to an IAS server
by Glenn Machin 01 Sep '11

01 Sep '11

I using radiusd: FreeRADIUS Version 2.1.11. I cannot seem to get the RHEL5 (2.6.18-238.9.1.el5) ntlm_auth program to properly authenticate the challenge and nt-response packets. If I set the password using clear-text and also set MS-CHAP-Use-NTLM-Auth, the authentication works fine. The version of ntlm_auth is Version 3.5.4-0.83.el5 So my next step is to try to filter PEAP MSCHAPv2 requests and proxy them off to an IAS server. However I still want PEAP GTC packets handled on this server. Anyone doing such a thing? If so can you tell me how you set up eap.conf, sites-enabled/inner-tunnel and sites-enabled/default, or any other configuration files? Thanks

5 9