- Freeradius-Users - lists.freeradius.org

Unable to Authenticate users
by john decot 17 Dec '10

17 Dec '10

Hi, I am planing to use freeradius for authentication for lan users. The following are the radcheck parameters: mysql> select * from radcheck; +----+----------+--------------------+----+------------------------------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------------------------------+ | 17 | test1 | User-Password | := | $1$q79.qtrm$gD6D4znw2uBGIU0K3mt/1/ | | 9 | test | Cleartext-Password | := | password1234 | +----+----------+--------------------+----+------------------------------------+ 2 rows in set (0.00 sec) 　 The user test can authenticate as it is clear text password but when i try to authenticate user test1 I got error like Found Auth-Type = CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! and failed. I would like to implement password with encrypted as user test1. So, could you please help me how to resolve this issue. Thanking you, Regards, John

2 2

Possible memory leak in rlm_sql?
by Brian Candler 17 Dec '10

17 Dec '10

I noticed something in rlm_sql.c function rlm_sql_process_groups(). group_list is allocated at the top of the function, but sql_grouplist_free(&group_list) is only called at the end. All the various error exits don't call it. ISTM that's going to leak memory in event of errors, but perhaps I have overlooked something which prevents that. Regards, Brian.

2 1

query
by karnik jain 17 Dec '10

17 Dec '10

Hi, I have downloaded the free radius server and successfully installed on linux machine.. Can you please tell me that does your this implimentation supports the US-ASCII to UTF-8 conversion as you are saying this is compliant to RFC 2865 ? thanks and regards, karnik jain

3 10

nas table and virtual servers?
by Jiann-Ming Su 17 Dec '10

17 Dec '10

Does the nas table work with virtual servers? That is, what is the nas configuration equivalent of the following config? client my_switch { ipaddr = 192.168.201.154 secret = abc.123 virtual_server = my_virtual_server } On startup, freeradius reads from the nas table and loads the clients listed there. But, those clients don't know which virtual server to connect to. Thanks for any tips and insights.

2 2

Password oddity
by discgolfer72 16 Dec '10

16 Dec '10

Set up FreeRadius on SLES 10. Using the NTRadPing utility we can authenticate to our back end LDAP server (eDirectory) w/o problem. However, when we enabled Radius authentication on two separate Wireless access points (Linksys WRT54 and DLink WBR 1310), they both fail authentication because the password they pass (or how FreeRadius interprets the password) changes one letter of the password. For example, we set up a radtest user with a password of radtest. FreeRadius server in debug shows the request come in but passes a password value of aadtest. So, as a test we changed the password to aadtest for the radtest user. The password then came across as badtest. So, we thought we'd change the password to cadtest to see what would happen. Now the password was sent/received as aadtest again. Using NTRadPing utility, we see the request come in, get processed and then login....... Running FreeRadius 1.1.0 as this is the version that Novell "supports." Please don't yell at me on this. Their documentation is based on this version and not the latest version....... Has anyone seen this behavior before and if so, know how to fix it? TIA!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Password-oddity-tp3307174p3307174.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 13

FreeRadius + MySQL characters being converted to HEX
by Steve Staples 16 Dec '10

16 Dec '10

I do apologize if this has been asked (I did search, but found nothing definitive, or it was my poor searching skills). We are storing all the radius accounting into MySQL, and thus far, have not had any real issues. I was asked the other day, why some of the cisco-avpairs attributes were showing up like: connect-progress=3DLAN Ses Up there were some other attributes that get these =HEX values passed and stored, and what I am wondering is, is that in the flat files, it gets stored as connect-progress=LAN Ses Up ('=3D' translates to '=') but in MySQL, it gets parsed/translated to the '=3D' style. How do I go about storing this as the '=' and not the '=3D' as well as all the other attribute values that get parsed/translated to hex characters? It doesn't appear to be the MySQL that is changing it, it looks like it is from the FreeRadius side... but I could be wrong. Thanks in advance, Steve.

2 2

Query
by karnik jain 16 Dec '10

16 Dec '10

Ok, I understood your point. But as per RFC 2865, what is the meaning of then "UTF-8 encoded 10646 [7] characters", the [7]? 7 stands for what over here? And one more thing as per RFC 2865, 1) As per this new RFC only only we need to support US-ASCII not any other character set, right? 2) Does free RADIUS only supporting US-ASCII or all universal character set?

2 1

Re: FreeRADIUS - no service!
by Alan Buxey 16 Dec '10

16 Dec '10

1.1.0 ? And this is your ONLY problem? At least upgrade to 1.1.8 - but if you want my help you'll need to be running the current release 2.1.x train Alan ----- Reply message ----- From: "Александр Чурсин" <achursin86(a)gmail.com> Date: Wed, Dec 15, 2010 14:29 Subject: FreeRADIUS - no service! To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Ok, thanks for explanation. The RADIUS version is 1.1.0 In the accounting section of the radiusd.conf we have: accounting { #detail #acct_unique ################################################# # Vladikavkaz OSE Acct-Type OSE { acct_unique group { sqlacct { fail = 1 # ok = return } OSE { fail = 1 ok = return } } # sql_log } ################################################# and so on anologous to these constructions with #### as a delimeter ... So, no "sql" mentioned... I'am sorry, but it's unclear for me where to put the wrapper. Alexander - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

5 4

freeradius and change-password / password aging
by ap 16 Dec '10

16 Dec '10

Hi list, is there a possibility to ensure "change password on next logon" or a message "password expires in next 3 days"? Which are the reqirements on supplicant or NAS? Best regards, ap.

2 1

multiple usergroups failing; freeradius 2.1.10 + Cisco-AVPairs
by michael＠jarrett.id.au 16 Dec '10

16 Dec '10

Hi, During a rebuild of our Radius servers from an old freeradius 1.x install to 2.1.10, we've lost ability to push multiple usergroups to our Cisco LNS: MySQL: radcheck: id UserName Attribute op Value 9791 test@realm Password := {clear}somepass radgroupreply: id GroupName Attribute op Value 161 VRF-TEST Cisco-AVPair += ip:vrf-id=TEST 162 VRF-TEST Cisco-AVPair += ip:ip-unnumbered=loopback25 2211 QOS-PROFILE Cisco-AVPair += ip:sub-qos-policy-out=TEST-QOS-PROFILE radreply: id UserName Attribute op Value 124561 test@realm Framed-IP-Netmask = 255.255.255.255 124571 test@realm Framed-IP-Address = 1.1.1.1 usergroup: UserName GroupName priority test@realm VRF-TEST 1 test@realm QOS-PROFILE 2 debugging Radius on the Cisco shows (amongst other things): RADIUS: Vendor, Cisco [26] 21 RADIUS: Cisco AVpair [1] 15 "ip:vrf-id=TEST" RADIUS: Vendor, Cisco [26] 35 RADIUS: Cisco AVpair [1] 29 "ip:ip-unnumbered=loopback25" If you set QOS-PROFILE to priority 0 for example, it will then only pick up the QOS-PROFILE usergroup, not both. Setting both usergroups to same priority yeilds the same results; only applying the first, never both. To rule out the Cisco i've performed a tcpdump on Radius itself; I can only see freeradius sending one usergroup in the Access-Accept response. This is also a fresh freeradius install via FreeBSD ports; no configuration was carried over from the previous install except for MySQL DB credentials. Thoughts?

1 1