- Freeradius-Users - lists.freeradius.org

Need help Configuring Radius and Ldap
by James Winter 07 Dec '10

07 Dec '10

My apologies before hand if this is an easy fix, but I have been working on configuring a radius server on and off now for a few weeks. As a note, I have Radius 2.1.10 installed and I am trying to authenticate using Ldap as the user database. I have little to no experience in both Radius and Ldap, but I have been reading up and looking for documents that explain the process well. The majority of documents that I did find were on an older version of radius, or were not pertinent to my situation. The following is a copy of my screen when I try authenticating a remote device to the radius server, please let me know if this helps(or if you would like more information on my config) Thanks in advance, - James # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [files] users: Matched entry DEFAULT at line 58 ++[files] returns ok [ldap] performing user authorization for jwn6657 [ldap] expand: (samaccountname=%{User-Name}) -> (samaccountname=jwn6657) [ldap] expand: cn=Users,dc=ds,dc=saintjoe,dc=edu -> cn=Users,dc=ds,dc=saintjoe,dc=edu [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=Users,dc=ds,dc=saintjoe,dc=edu, with filter (samaccountname=jwn6657) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user jwn6657 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/raddb/sites-enabled/default +- entering group ntlm_auth {...} [2010/12/03 10:14:58.799575, 1] param/loadparm.c:6494(map_parameter) Unknown parameter encountered: "idmap domains" [2010/12/03 10:14:58.799645, 0] param/loadparm.c:7588(lp_do_parameter) Ignoring unknown parameter "idmap domains" [2010/12/03 10:14:58.799870, 1] param/loadparm.c:6494(map_parameter) Unknown parameter encountered: "master browser" [2010/12/03 10:14:58.799883, 0] param/loadparm.c:7588(lp_do_parameter) Ignoring unknown parameter "master browser" Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 186 to 131.93.254.2 port 4844 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 186 with timestamp +452 Ready to process requests.

3 9

send accounting data
by Sokvantha YOUK 07 Dec '10

07 Dec '10

Dear All, I would like to configure freeradius server to send accounting data to other server. Could any one advice me or show me how can I achieve this method? -- YOUK Sokvantha Tell: (855) 89896589 email: sokvantha(a)gmail.com

1 0

Re: [RESOVLED] Re: customize Post-Auth-Type REJECT
by jaydorado 07 Dec '10

07 Dec '10

Newbie here.. I badly need help!! This is exactly what I want to achieve. But it isn't clear to me as to where to place those configurations. Should it be in the authorize section?? or in the sqlcounter module? Could someone post their configurations please.. Thanks so much in advance.. Regards, Jay -- View this message in context: http://freeradius.1045715.n5.nabble.com/RESOLVED-customize-Post-Auth-Type-R… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

Crosspost [hostap, freeradius] Can I send "temporary failure" or "wpa tls has failed, so shove them on a vlan" ?
by Christ Schlacta 07 Dec '10

07 Dec '10

I want an option to do some sort of "your authentication is pending administrative approval. a message has been sent to the administrators, please try again in a few minutes". AND an option to sya "your authentication has failed completely, I'm sending you to a separate vlan" namely, the situation is as follows: I've got an interface available on a separate AP to allow users to register for and acquire a certificate. The certificate is bound to a single hostname and mac address. THere are two failure conditions: 1) the user has bad or no credentials in this case the user should be sent to a captive vlan where all they can do is connect to the registration webpage to acquire a certificate and bind it to their wifi MAC address. 2) the user has good credentials but fails "MAC" authentication. The mac address will go through some level of processing, which will result in either "adding" the mac address to their account and succeeding, or triggering a "We have to send a request for review to the administrators" and sending the user to a separate vlan with a "explain why you have so many MAC addresses" website. Not sure how to configure hostapd and freeradius together to do this.

2 3

syntax to add mac addresses of users file
by Viirydiianah Robles 06 Dec '10

06 Dec '10

hello! i have ubuntu 10.4 and freeradius-server-2.1.10 Recently i made some changes to the users file, to be able to register users via their MAC addresses in which use the following syntax : jesssi cleartext-password :="chispas" service-type= framed-user, framed-protocol =ppp, # framed-ip-address = 172.163.1.12 # framed-ip.netmask = 255.255.255.0 # framed-routing = broadcast-listen, # framed-filter-id="std.ppp", # framed-mtu =1500, Called-Station-Id = "00-0F-CF-BC-2A-9A:3Com", (this is the line that adds) Calling-Station-Id = "00-17-37-FA-B2-EB", (this is the line that adds) framed-compression = van-jacobsen-tcp-ip someone could help me or give me a different syntax to add the mac addresses in the users file? thank you -Viridiana Ambriz Robles

3 3

Issue installing FreeRadius with openSSL support on a CentOS Sever
by Hanavan, John (John) 06 Dec '10

06 Dec '10

Hi All, We have been trying to install FreeRadius with openSSL support on to a CentOS Sever without much success. The version of FreeRadius and CentOS are listed below. FreeRadius Version: 2.1.10 CentOs Version: CentOs release 5.3 The commands that we are using to start the installation are. ./configure --with-openssl --with-openssl-libraries=/usr/local/ssl/lib --with-openssl-includes=/usr/local/ssl/include --with-rlm-counter-lib-dir=/usr/lib The output that indicates installation failure of openSSL support are shown below (The full output is in the attached file). configure: skipping test for openssl/ssl.h === configuring in src/modules/rlm_dbm (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_dbm) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for ndbm.h... no checking for gdbm/ndbm.h... no checking for gdbm-ndbm.h... no checking for dbm in default lib... no checking for dbm_open in -lndbm... no checking for dbm_open in -lgdbm... no checking for dbm_open in -lgdbm_compat... no configure: creating ./config.status config.status: creating Makefile === configuring in ./types/rlm_eap_peap (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_eap/./types/rlm_eap_peap) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in ./types/rlm_eap_ttls (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_eap/./types/rlm_eap_ttls) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for OpenSSL support... no configure: creating ./config.status config.status: creating Makefile config.status: creating config.h config.status: config.h is unchanged === configuring in ./types/rlm_eap_ikev2 (/root/Desktop/temp/freeradius-server-2.1.10/src/modules/rlm_eap/./types/rlm_eap_ikev2) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-openssl' '--with-openssl-libraries=/usr/local/ssl/lib' '--with-openssl-includes=/usr/local/ssl/include' '--with-rlm-counter-lib-dir=/usr/lib' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking how to run the C preprocessor... gcc -E checking for grep that handles long lines and -e... /bin/grep checking for egrep... /bin/grep -E checking for ANSI C header files... yes checking for sys/types.h... yes checking for sys/stat.h... yes checking for stdlib.h... yes checking for string.h... yes checking for memory.h... yes checking for strings.h... yes checking for inttypes.h... yes checking for stdint.h... yes checking for unistd.h... yes checking malloc.h usability... yes checking malloc.h presence... yes checking for malloc.h... yes checking for ikev2_set_log_callback in -leap-ikev2... no checking EAPIKEv2/connector.h usability... no checking EAPIKEv2/connector.h presence... no checking for EAPIKEv2/connector.h... no configure: creating ./config.status config.status: creating Makefile We are just trying to get EAP-TLS support enabled on our FreeRadius Sever. It should be relatively straight forward, one would think, to successfully enable this feature requiring openSSL support. I hope someone can tell us what it is we are doing wrong. Regards, John Hanavan

2 1

Re: application to share resources with my mac users
by Gary Gatten 06 Dec '10

06 Dec '10

NFS? ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org <freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org> To: freeradius-users(a)lists.freeradius.org <freeradius-users(a)lists.freeradius.org> Sent: Mon Dec 06 15:37:01 2010 Subject: application to share resources with my mac users hello greetings to all such I have a question regarding the free radius, the situation is as follows: installed on my ubuntu computer operating system. then install and configure free radius and my mac users, as well as clients and the access point. and my question is: there is any application or through an interface selected files and folders you want to share my users that gave high above? Thanks in advance and have nice day. <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

application to share resources with my mac users
by alejandra arceo estrada 06 Dec '10

06 Dec '10

hello greetings to all such I have a question regarding the free radius, the situation is as follows: installed on my ubuntu computer operating system. then install and configure free radius and my mac users, as well as clients and the access point. and my question is: there is any application or through an interface selected files and folders you want to share my users that gave high above? Thanks in advance and have nice day.

1 0

FreeRadius + FreeBSD + ipv6
by Johann Hugo 06 Dec '10

06 Dec '10

Hi I'm busy with a FreeRadius Eduroam setup, but it only works with ipv4 and not with ipv6. My Setup: wifi-client <--> my-FreeRadius-proxy <---> eduroam-proxy <---> remote-site My server: FreeBSD 8.1-STABLE with freeradius-2.1.10_1 that was build from the ports, with ipv6 enabled. Here is a list of things that I've noticed when I run radiusd -X Regards Johann ------------------------------------------------------------------------------------------------------------ 1) FreeRadius with only an ipv4 listen section in radiusd.conf. (no ipv6) #listen { # type = auth # ipv6addr = :: # port = 0 #} ganymede# sockstat | grep 1812 freeradius radiusd 61076 5 udp4 *:1812 *:* FreeRadius tries to send Access-Request packets to the ipv6 address of edurom- proxy-server (eduroam0.sanren.ac.za) when I use it's dns name in proxy.conf. Sending Access-Request of id 172 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 User-Name = "nren_radius_test(a)ru.ac.za" NAS-IP-Address = 146.64.25.55 Called-Station-Id = "0016b6d9211b" Calling-Station-Id = "0015af8e3baa" NAS-Identifier = "0016b6d9211b" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001e016e72656e5f7261646975735f746573744072752e61632e7a61 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 It works fine if I use the ipv4 address (no dns) for eduroam0.sanren.ac.za. ------------------------------------------------------------------------------------------------------------ 2) FreeRadius with both an ipv4 and an ipv6 listen section in radiusd.conf. listen { type = auth ipv6addr = :: port = 0 } ganymede# sockstat | grep 1812 freeradius radiusd 61076 5 udp4 *:1812 *:* freeradius radiusd 61076 6 udp6 *:1812 *:* Running radiusd -X I can see it tries to send out ipv6 requests. Sending Access-Request of id 229 to 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 User-Name = "nren_radius_test(a)ru.ac.za" NAS-IP-Address = 146.64.25.55 Called-Station-Id = "0016b6d9211b" Calling-Station-Id = "0015af8e3baa" NAS-Identifier = "0016b6d9211b" NAS-Port = 31 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201001e016e72656e5f7261646975735f746573744072752e61632e7a61 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 But I don't see anyting with tcpdump. After a while I get the following message in radiusd: WARNING: Internal sanity check failed in event handler for request 13: Discarding the request! Ready to process requests. ------------------------------------------------------------------------------------------------------------ 3) FreeRadius with both an ipv4 and an ipv6 listen section in radiusd.conf, but with a specific ipv6 address configured. listen { type = auth ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0 } radiusd -X stops with the following error: Failed binding to authentication address 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812: Can't assign requested address /usr/local/etc/raddb/radiusd.conf[32]: Error binding to port for 2001:4200:ffff:14:5054:17ff:fe36:5d3d port 1812 ----------------------------------------------------------------------------------------------------------------- ## radiusd.conf -- FreeRADIUS server configuration file. ###################################################################### prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/local/lib/freeradius-2.1.9 pidfile = ${run_dir}/${name}.pid user = freeradius group = freeradius max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { type = auth #ipaddr = * ipv6addr = :: #ipv6addr = 2001:4200:ffff:14:5054:17ff:fe36:5d3d port = 0 } listen { type = acct ipaddr = * # ipv6addr = :: port = 0 } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE ${confdir}/eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ ######################################################################

4 11

Help, authentication problems!!
by miha- 06 Dec '10

06 Dec '10

Hello, I am having problems with authentication. I chacked secret on NAS and on Radius server. Bouth are some but the radius is keep telling to check the secret. What could be worng or I am missing ? Thanks!!! This is configuration on nas. ##----- Activate RADIUS connection setProperty com.centile.connectors.aaa.watchdog.enable false setProperty com.centile.connectors.aaa radius setProperty com.centile.connectors.aaa.localserv intraswitch setProperty com.centile.connectors.aaa.localpass b (secret) setProperty com.centile.connectors.aaa.remotserv 1.2.3.4 setProperty com.centile.connectors.aaa.remotport 1812 setProperty com.centile.connectors.aaa.calltype any -- This is in cliente.cong client 212.13.228.58 { secret = b shortname = intraswitch nastype = cisco 1. Sample If I typed wrong pass in sql for user authentication I see password from user connection (12345) but it is wrong (12 in sql). In sample 2 I put right pass in sql for user, but you can see that is the radius is showing me that is encrypted and saying me WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! . why? 1. Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "12345" [pap] Using clear text password "12" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file 2. ap] returns noop [sql] expand: %{User-Name} -> 081609000 [sql] sql_set_user escaped user --> '081609000' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '081609000' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '081609000' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '081609000' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'static' ORDER BY id [sql] User found in group static [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'static' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "þqL?%" [pap] Using clear text password "12345" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 081609000 attr_filter: Matched entry DEFAULT at line 11 -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-authentication-problems-tp3293… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1