- Freeradius-Users - lists.freeradius.org

Documentation about Freeradius + Openldap
by Alejandro Gandara 25 Aug '11

25 Aug '11

Hi list, Im new in this list and implementig Freeradius. Im installing and configuring Freeradius 2.1.10 over Linux Debian Squeeze. We have designed a quite difficult architecture to authenticate users. I've been looking for many hours for advance and specific documentation to manage freeradius, such as "Roles", "Access", "List access" "Profiles" , how merge everything with ldap. I didnt get the expected results in google, so ill be very gratefull if someone could give me some link or doc or even name of books to buy. Thanks list for the help and your patience. Regards, Alejandro Gándara Álvarez Junior System Administrator

2 4

Fwd: Auth configuration help
by Dom 25 Aug '11

25 Aug '11

-------- Original Message -------- Subject: Auth configuration help Date: Wed, 24 Aug 2011 21:53:46 -0400 From: Dom <dversace(a)tekcorner.ca> To: freeradius-users(a)lists.freeradius.org I was hoping someone could help. We have a cisco 3825 with radius server pointed to our freeradius installation. When I test radius authentication using NTRadping using CHAP authentication everything works fine. However when we try to connect via a standard dsl connection we get these failures. I was hoping someone could help point me in the right direction to fix the issue. Thanks rad_recv: Access-Request packet from host 64.34.66.5 port 1645, id=26, length=134 Framed-Protocol = PPP User-Name = "aewais(a)domain.ca" User-Password = "password" Calling-Station-Id = "bas105300000096" Connect-Info = "1000000000" NAS-Port-Type = Virtual NAS-Port = 26 NAS-Port-Id = "Uniq-Sess-ID26" Service-Type = Framed-User NAS-IP-Address = 64.34.xxxx.xxxx # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "tekcorner.ca" for User-Name = "aewais(a)domain.ca" [suffix] No such realm "domain.ca" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> aewais(a)domain.ca attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 26 to 64.34.xxx.xxx port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 26 with timestamp +97 Ready to process requests.

3 2

pptp and freeradius
by saeed1803 24 Aug '11

24 Aug '11

>Hi dear friends >I have a problem with configuration vpn & freeradius >When I connect with Windows clients, displayed this error : host 127.0.0.1 port 38970, id=139, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0x089bd88d04fc9c4263f9ef8c0b7680d6 MS-CHAP2-Response = 0x5c00f40d55fc21260615b32b54a23b2b85cc00000000000000008ae59dc6918fdc10855be5c58cf809be14426f2fba994eea Calling-Station-Id = "192.168.56.100" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 38970 MS-CHAP-Error = "\\E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +592 >Tell me how do I solve this problem, please >I really need your help

2 1

Adding default Realms in users without Realms
by joaocdc＠gmail.com 24 Aug '11

24 Aug '11

Hello everybody I have a doubt and I'm not finding answers on the Internet. I have a freeradius server operating normally, it is a proxy for several Realms, with each Realm leads the user to a different authentication database, so far okay. What I need now is to get users coming to the radius without realm, and add a default realm. I need to do this early on in the authentication processing, so that the other conditions that rely on authentication of the existence of a realm can function correctly. Can anyone help me with this issue? Thank you. -- João Paulo de Lima Barbosa

2 4

OT: Cisco Disconnect-Request packets
by Jonathan Gazeley 24 Aug '11

24 Aug '11

Hi all, Not directly related to FreeRADIUS but I gather people here have some experience with Cisco WiSMs and 802.1x. I'm trying to use radclient to craft a Disconnect-Request packet to disconnect a user on an 802.1x network. I've checked the RFCs for the Disconnect-Request packets and I believe I am providing all the necessary attributes to disconnect a user, however the WiSM always responds: rad_recv: Disconnect-NAK packet from host 172.17.107.211 port 3799, id=219, length=26 Error-Cause = Missing-Attribute I am sending packets like these: Sending Disconnect-Request of id 219 to 172.17.107.211 port 3799 User-Name = "jg4461" Calling-Station-Id = "00:1b:63:08:b4:eb" Framed-IP-Address = 172.21.107.197 Called-Station-Id = "00:21:55:ac:5b:60:ResNet-Wireless" NAS-Port-Id = "29" NAS-Port-Type = Async Acct-Session-Id = "jg44614ddcd9e6/00:1b:63:08:b4:eb/222935" NAS-IP-Address = 172.17.107.211 NAS-Port = 29 NAS-Identifier = "wism11" So, does anyone know which attributes I must send to disconnect a user in this way? Is there an easier way of doing it? Many thanks, Jonathan

3 4

pptp and freeradius
by saeed1803 24 Aug '11

24 Aug '11

Hi dear friends I have a problem with configuration vpn & freeradius When I connect with Windows clients, displayed this error : host 127.0.0.1 port 38970, id=139, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0x089bd88d04fc9c4263f9ef8c0b7680d6 MS-CHAP2-Response = 0x5c00f40d55fc21260615b32b54a23b2b85cc00000000000000008ae59dc6918fdc10855be5c58cf809be14426f2fba994eea Calling-Station-Id = "192.168.56.100" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 38970 MS-CHAP-Error = "\\E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +592 Tell me how do I solve this problem, please I really need your help

1 0

pptp and freeradius
by saeed1803 24 Aug '11

24 Aug '11

Hi dear friends I have a problem with configuration vpn & freeradius When I connect with Windows clients, displayed this error : host 127.0.0.1 port 38970, id=139, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "test" MS-CHAP-Challenge = 0x089bd88d04fc9c4263f9ef8c0b7680d6 MS-CHAP2-Response = 0x5c00f40d55fc21260615b32b54a23b2b85cc00000000000000008ae59dc6918fdc10855be5c58cf809be14426f2fba994eea Calling-Station-Id = "192.168.56.100" NAS-IP-Address = 127.0.1.1 NAS-Port = 1 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: test [mschap] Told to do MS-CHAPv2 for test with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 139 to 127.0.0.1 port 38970 MS-CHAP-Error = "\\E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 139 with timestamp +592 Tell me how do I solve this problem, please I really need your help

1 0

compiling pam radius module
by g17jimmy 24 Aug '11

24 Aug '11

I am trying to get pam radius module to work but the module does not seem to be encrypting properly. When I test using radtest authentication works, but when attempting a pam authentication the password shows as garbage. I have verified that the shared secret I'm using is the same for both configurations. I will post debug logs shortly. -- View this message in context: http://freeradius.1045715.n5.nabble.com/compiling-pam-radius-module-tp47271… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Fw: RADIUS does not send reply for all groups the user is a member of
by Det Det 23 Aug '11

23 Aug '11

----- Forwarded Message ----- From: Det Det <det.explorer(a)yahoo.com> To: Fajar A. Nugraha <list(a)fajar.net> Sent: Tuesday, August 23, 2011 3:37 PM Subject: Re: RADIUS does not send reply for all groups the user is a member of Thanks Fajar! I just added the fall-through. I leave the priority as is. Worked! Thanks! ________________________________ From: Fajar A. Nugraha <list(a)fajar.net> To: Det Det <det.explorer(a)yahoo.com>; FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, August 23, 2011 3:10 PM Subject: Re: RADIUS does not send reply for all groups the user is a member of On Tue, Aug 23, 2011 at 1:53 PM, Det Det <det.explorer(a)yahoo.com> wrote: > Hi there, > here is the SQL and debug logs from radius. > > mysql> select * from radusergroup; > +---------------------------+-----------+----------+ > | username | groupname | priority | > +---------------------------+-----------+----------+ > | user1(a)mydomain.com | defgroup | 1 | > user1(a)mydomain.com | dynamic | 1 | > +---------------------------+-----------+----------+ It'd be easier if you use different priorities. Since the debug log shows it's using "defgroup", try changing "dynamic"'s priority to "2" ... > mysql> select * from radgroupreply; > +----+-----------+-------------------+----+-----------------+ > | id | groupname | attribute | op | value | > +----+-----------+-------------------+----+-----------------+ > | 1 | defgroup | Framed-MTU | = | 1500 | > | 2 | defgroup | Service-Type | = | Framed-User | > | 3 | defgroup | Port-Limit | = | 1 | > | 7 | dynamic | Framed-IP-Netmask | = | 255.255.255.255 | > | 6 | dynamic | Framed-IP-Address | = | 255.255.255.254 | > +----+-----------+-------------------+----+-----------------+ ... and add a radgroupreply entry like defgroup | Fall-Through | = | Yes -- Fajar

1 0

RADIUS does not send reply for all groups the user is a member of
by Det Det 23 Aug '11

23 Aug '11

Hi, user1 is a member of group1 and group2. both group1 and group2 has replies in radgroupreply table. when freeradius query for radusergroup, it will only get the first group the user is a member of and will proceed to get the reply attributes for that group as below. query1: SELECT groupname FROM radusergroup WHERE username = 'user1(a)domain.com' ORDER BY priority query2: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group1' ORDER BY id from the debug, it does not do this query query3: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'group2' ORDER BY id any idea why? i am very sure that query 1 returns more that one value (that is 2 groups, group1 and group2) thanks, det

2 3