- Freeradius-Users - lists.freeradius.org

Freeradius + LDAP auth
by Old Eduardo 24 Nov '10

24 Nov '10

Sorry list, but i try to configure this in few weeks and no get sucess. Realy need help for list. im try to all sites in google, but no get sucess. i try this: http://blog.yufeng.net/index.php/2010/07/debian-poptop-freeradius-openldap/ http://wiki.freeradius.org/Rlm_ldap http://mhoran.wordpress.com/2007/11/25/freeradius-on-freebsd-and-openldap/ my debug only appears: rad_recv: Access-Request packet from host 10.12.60.32 port 35717, id=31, length=64 User-Name = "ipe-dp" User-Password = "7\271D\250yhG'E\361\t{\237\366S\347" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Framed-Protocol = PPP Tue Nov 23 07:37:24 2010 : Debug: +- entering group authorize Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 0 Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 0 Tue Nov 23 07:37:24 2010 : Debug: ++[preprocess] returns ok Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: - authorize Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: performing user authorization for ipe-dp Tue Nov 23 07:37:24 2010 : Debug: expand: (uid=%u) -> (uid=ipe-dp) Tue Nov 23 07:37:24 2010 : Debug: expand: dc=policiacivil,dc=rs,dc=gov,dc=br -> dc=policiacivil,dc=rs,dc=gov,dc=br Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: attempting LDAP reconnection Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: (re)connect to ldap.intra proxy.intra localhost:389, authentication 0 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: bind as uid=vpnpptp,ou=sistemas,dc=policiacivil,dc=rs,dc=gov,dc=br/dfjk129!@ to ldap.intra proxy.intra localhost:389 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: waiting for bind result ... Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: Bind was successful Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: performing search in dc=policiacivil,dc=rs,dc=gov,dc=br, with filter (uid=ipe-dp) Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: Added User-Password = {SSHA}dd3MzvDRyDeyeuDkPTy391H3FX2vynZl in check items Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: No default NMAS login sequence Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: looking for check items in directory... Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: LDAP attribute sambaNTPassword as RADIUS attribute NT-Password == 0x3244413944423342333039463632333434374232384536393635374142333642 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: LDAP attribute sambaLMPassword as RADIUS attribute LM-Password == 0x3845433036323546444141393630353041414433423433354235313430344545 Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: LDAP attribute cn as RADIUS attribute Group == "ipe-dp" Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: looking for reply items in directory... Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: user ipe-dp authorized to use remote access Tue Nov 23 07:37:24 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Nov 23 07:37:24 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Tue Nov 23 07:37:24 2010 : Debug: ++[ldap] returns ok Tue Nov 23 07:37:24 2010 : Debug: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Nov 23 07:37:24 2010 : Debug: !!! Replacing User-Password in config items with Cleartext-Password. !!! Tue Nov 23 07:37:24 2010 : Debug: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Nov 23 07:37:24 2010 : Debug: !!! Please update your configuration so that the "known good" !!! Tue Nov 23 07:37:24 2010 : Debug: !!! clear text password is in Cleartext-Password, and not in User-Password. !!! Tue Nov 23 07:37:24 2010 : Debug: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Tue Nov 23 07:37:24 2010 : Debug: auth: type Local Tue Nov 23 07:37:24 2010 : Debug: auth: user supplied User-Password does NOT match local User-Password Tue Nov 23 07:37:24 2010 : Debug: auth: Failed to validate the user. Tue Nov 23 07:37:24 2010 : Auth: Login incorrect: [ipe-dp/7\271D\250yhG'E\361\t{\237\366S\347] (from client BrasilTelecom port 1812) Tue Nov 23 07:37:24 2010 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Tue Nov 23 07:37:24 2010 : Debug: Delaying reject of request 0 for 1 seconds Tue Nov 23 07:37:24 2010 : Debug: Going to the next request Tue Nov 23 07:37:24 2010 : Debug: Waking up in 0.9 seconds. Tue Nov 23 07:37:25 2010 : Debug: Sending delayed reject for request 0 Sending Access-Reject of id 31 to 10.12.60.32 port 35717 Tue Nov 23 07:37:25 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Reject packet from host 10.12.60.32 port 1812, id=31, length=20 rad_verify: Received Access-Reject packet from client 10.12.60.32 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) attention to auth type Local! WHY Local if i put in configuration to auth type LDAP? Sorry, i dont understand . Please help. Sorry for my bad english.

3 18

WiFi-Users / AP / Freeradius / Active-Directory
by Manuel Lamora 24 Nov '10

24 Nov '10

Hello everybody, I'm trying to setup the following setup. Wifi-Users should have access to the Access-Point when connecting with 802.1x (PEAP) and their Active-Directory-Account. Everything seems to work but clients cannot connect. I hope that someone could point me to my configuration mistake or give me further information where my problem resists. Thanks a lot in advance. Regards, Manuel Freeradius-Version : freeradius-server-2.1.9-1.7.i586 clients.conf with Accesspoint as a client: client 172.24.0.2 { secret = ******************* shortname = tunnel-3 nastype = other } wbinfo -a tuser%********* plaintext password authentication succeeded challenge/response password authentication succeeded ntlm_auth --request-nt-key --domain=SCS-NT --username=tuser --password=1passwort* NT_STATUS_OK: Success (0x0) In users file I have set now : DEFAULT Auth-Type = ntlm_auth radtest tuser ********* localhost 0 testing123 Sending Access-Request of id 132 to 127.0.0.1 port 1812 User-Name = "tuser" User-Password = "*********" NAS-IP-Address = 172.24.0.113 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=132, length=20 Starting the server with /usr/sbin/radiusd -X radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 172.24.0.2 { require_message_authenticator = no secret = "###################" shortname = "tunnel-3" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=SCS-NT --username=%{mschap:User-Name} --password=%{User-Password}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-SCS-NT} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. ###################################################################### ###################################################################### First connect of a Windows-Client with user inst. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=233, length=142 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02010010015343532d4e545c696e7374 Message-Authenticator = 0x82f0744dde0b55a114ce2f8c9ad3a53e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 16 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 44 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 233 to 172.24.0.2 port 1672 EAP-Message = 0x010200160410b800e23c327d070babda5440b83449ca Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62d8dbfa4763ae991f0fa4312 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=234, length=150 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 State = 0x2d8fbba62d8dbfa4763ae991f0fa4312 Message-Authenticator = 0x3d7a4fa0b7403e4eb6fd176cc82cf0ed +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 44 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 234 to 172.24.0.2 port 1672 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62c8ca2a4763ae991f0fa4312 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=235, length=231 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203005719800000004d16030100480100004403014ced306e1c4adb3d4aa8f39fc989daf0 6b7debe9c53ad8f44d9cf85bcc37f7da00001600040005000a00090064006200030006001300 12006301000005ff01000100 State = 0x2d8fbba62c8ca2a4763ae991f0fa4312 Message-Authenticator = 0x977a1ef017b18a24365f696e4ffb768c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 87 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 77 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0048], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0031], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 235 to 172.24.0.2 port 1672 EAP-Message = 0x0104040019c0000008a216030100310200002d03014ced306f6ad45cd2b5af8e314b52e10e 4de253d26fd93fe24eb8ed3f12f929aa000004000005ff01000100160301085e0b00085a0008 570003a6308203a23082028aa003020102020101300d06092a864886f70d0101050500308193 310b3009060355040613024652310f300d060355040813065261646975733112301006035504 071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e312030 1e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024060355 0403131d4578616d706c65204365727469666963617465204175 EAP-Message = 0x74686f72697479301e170d3130313132333134313533395a170d3131313132333134313533 395a307c310b3009060355040613024652310f300d0603550408130652616469757331153013 060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c6520 5365727665722043657274696669636174653120301e06092a864886f70d010901161161646d 696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f00 3082010a0282010100cd9faa1657088905b7ef37030f9f10f4acc72b4fb54b593dd4f4e59a34 aeae75d5ba2edfd2cc2690dc8eb88284cb10460f3983ca55af87 EAP-Message = 0x6ad7d63b37c4e4aeaaba70d7dbb828f23ed8dcf44bed922c66ac81643ea0355b251e18073d f3017697c1388fde20db7c7a4986a3682272044265c5f36cf15785221c39372d231bdbe96156 e2fe7e9645e71c4ea0a701b017cf033556cfbb4792f0e5ce14e6865104c2cd8b30f4e324d7dc 849d3546f2e21c2ae8a5c0e6187e216122621204175cfb2cbb0dd16d912b1f44f05238837518 c78a99588d5d5e2fe2ba7c1d365b36ff9192a79dded81bc10a81cbfbfc32d97291c5a20e0423 7febc44e1d6a1b8e86067bc30203010001a317301530130603551d25040c300a06082b060105 05070301300d06092a864886f70d0101050500038201010004fe EAP-Message = 0xe92adfd12c15035baba3ffffeee195e1428bf9715fbf0ef781b7e85cada065a78bf823b88a eec6bc3b67d1ec42d758c5ea1d16bace3ace1b6638f335a440cec3b01523892210520e1961c9 39a1d83f614698447a86564455f360784e05352dcf1eaf5a2fd62d0e9933136ff972bc5b75f7 bc4506ccf905e476c0af9865062b11161488bff753dd0e29bace5d01c9ebf4ff7f969d0d71f4 f11b8bf6096a03ea472e6b17bfdc78591620d5d070f04dc18488787aee1df0ba6fffee64ca68 c302ab4e650f6d98e462b22f3b9c79d866cc1c76a06a911b099dd5acf58c4526e749f2f9b76e 3a553180ac9762544c1aa0244ced68f5ccedbe9524731930d897 EAP-Message = 0x7c0004ab308204a73082038f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62f8ba2a4763ae991f0fa4312 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=236, length=150 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 State = 0x2d8fbba62f8ba2a4763ae991f0fa4312 Message-Authenticator = 0x6e97590c4d270aba01cfeb24814b0dc6 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 236 to 172.24.0.2 port 1672 EAP-Message = 0x010503fc1940a003020102020900c83083d5f969607c300d06092a864886f70d0101050500 308193310b3009060355040613024652310f300d060355040813065261646975733112301006 035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e 3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d31263024 0603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e 170d3130313132343135323233365a170d3131313132343135323233365a308193310b300906 0355040613024652310f300d0603550408130652616469757331 EAP-Message = 0x12301006035504071309536f6d65776865726531153013060355040a130c4578616d706c65 20496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f 6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72 69747930820122300d06092a864886f70d01010105000382010f003082010a0282010100e635 de9cfdf5138774c61db62af4030d6c2e0fa16d2b32d5604bc5b0d183fe151aa9c8c40b099170 76a816aeeedeca498b3a86e9ea262b5d119c40ccadc3fed7e7a27f3e7c90eb7963e8b22295fe 46b26081fcb27f0c75666eeb59433aeae672a5d2a0e4ffc637a4 EAP-Message = 0x7a67a9ec4686061fb76289017e020dfc5a470ba00f4a3f9f09c351a60b19b404229642d34a 66dc17c30f85e88403b11c141965c66d1f41c19bd3d171fbdeaffec605619c065ec731e1ec03 113ab0a169d17dd125b2f654ba76f301ef01164d1e15c13e291c742dd6f488373a645e34e7a3 1e035719dd97b78f3ca24f47dff94ffc1ef177cf868797790d84de107e009f2bf714d6eef1b9 c90203010001a381fb3081f8301d0603551d0e0416041494a9d6739159773c049f83f718cd41 0133e7c3fa3081c80603551d230481c03081bd801494a9d6739159773c049f83f718cd410133 e7c3faa18199a48196308193310b300906035504061302465231 EAP-Message = 0x0f300d060355040813065261646975733112301006035504071309536f6d65776865726531 153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d01090116 1161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043 6572746966696361746520417574686f72697479820900c83083d5f969607c300c0603551d13 040530030101ff300d06092a864886f70d010105050003820101006df485af7c40e594d6bf84 f59e929b6e7453bea850b2779ca4f69f1dbf13b6c5c0e9c0341f478e4569dfa8abbf47967acd 4a7b64b446e02c03fee653c2860da577b648ca3152fbf386ca92 EAP-Message = 0x934b8abcb4ea3bdd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62e8aa2a4763ae991f0fa4312 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 172.24.0.2 port 1672, id=237, length=150 User-Name = "SCS-NT\\inst" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "RalinkAP1" NAS-Port = 0 Called-Station-Id = "00-1A-8C-07-BE-81" Calling-Station-Id = "00-1C-BF-B1-DF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 State = 0x2d8fbba62e8aa2a4763ae991f0fa4312 Message-Authenticator = 0x6affd650e887650568615a8f0ba11d7e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "SCS-NT\inst", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 237 to 172.24.0.2 port 1672 EAP-Message = 0x010600bc19000ac6f2571787135ef92e7bee24970a6a167246b46795b516de48d6caeac159 8a5416171a183b903fc2cdc8527dda8c6294389cee6158073332d9720b89f35c9826a2997560 d9484d0809681953f980cbfce4c2f1117dc893e8d5338933c294f234ec731677abe133b7077c 1f9f2194c48b36a41cf41936ebaf81662e75691b3ece44a5d3cec5f2c5d0ccd36c833708f689 bc755c662cca303b6a68b1b1de9e3e9d9755f8c885b4902955b5180316030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d8fbba62989a2a4763ae991f0fa4312 Finished request 4. Going to the next request

2 1

(no subject)
by paulina santillan mendez 24 Nov '10

24 Nov '10

Hello I have already installed and configured freeradius in Ubuntu operating system, how to add users through my MAC address?

1 0

Problem with FreeRADIUS + PPPoE + Mikrotik
by Pableus 24 Nov '10

24 Nov '10

Hello, I have a FreeRADIUS server doing authentication and accounting with ADSL and with wireless users. The wireless users are connected to a MikroTik which is running a PPPoE server. There are absolutely no problems with the ADSL users, but the PPPoE users are constantly losing their connections and then reconnecting. En average, the length of sessions varies between 1 and 10 minutes and most times shows "Acct-Termination-Cause = User-Request". I've checked the status of the wireless link but everything seems to be right. There are other wireless users in the same neighbourhood and some of them have this problem and others do not. Thank you very much for any suggestions you can provide. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Problem-with-FreeRADIUS-PPPoE-Mikro… Sent from the FreeRadius - User mailing list archive at Nabble.com.

8 13

Expiration stored on sql
by yzy-oui-fi 24 Nov '10

24 Nov '10

I have a doubt... I'm using freeradius from Ubuntu 8.04. if i have to store an expiration date i stored some thing like that: username Attribute op Value someuser Expiration := 24 Nov 2010 13:58 I have a check to a Wifigator server and i see that they stored it as a timestamp (in secondes)... Who is right? who is wrong? regards

2 4

problem with rlm_perl
by sameer khan 24 Nov '10

24 Nov '10

hey ppl i m trying to authenticate with rlm_perl using chap with following perl script but doesn't seem to work. i m guessing chap-password should be in hex (0x) format but doesn't seem to be in. hope some one can help me out Best Regards my $want_password="123";my $given_password;my $given_chap_challenge; $given_password=$RAD_REQUEST{'CHAP-Password'};$given_chap_challenge=$RAD_REQUEST{'CHAP-Challenge'}; $given_password =~ s/^0x//;$given_chap_challenge =~ s/^0x//;my $chap_password = pack("H*", $given_password);my $chap_challenge = pack("H*", $given_chap_challenge);my $md5 = new Digest::MD5; $md5->reset;$md5->add(substr($chap_password, 0, 1));$md5->add($want_password);$md5->add($chap_challenge); my $digest = $md5->digest();my $subby = substr($chap_password,1);my $subby2 = substr($chap_password,0,1);if ($digest ne substr($chap_password, 1)) {#return 0; #Bad pass returning 0 $RAD_REPLY{'Reply-Message'} = "Denied access for invalid password";} }else {#return 1; # Pass is OK Returning 1 return RLM_MODULE_OK;} rlm_perl: Added pair User-Name = support-5rlm_perl: Added pair CHAP-Password = \010\235\243\232\006h\376\024\374ã¢µÊ?\021_\372rlm_perl: Added pair CHAP-Challenge = \220?\251\314\033\2067g\204z'Ú?\201X3rlm_perl: Added pair NAS-IP-Address = 221.132.115.82rlm_perl: Added pair NAS-Port = 1812rlm_perl: Added pair Reply-Message = Denied access for invalid passwordrlm_perl: Added pair Auth-Type = Perl++[perl] returns rejectFailed to authenticate the user.Login incorrect: [support-5/<CHAP-Password>] (from client localhost port 1812)Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> support-5 attr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 0 for 1 secondsGoing to the next requestWaking up in 0.9 seconds.Sending delayed reject for request 0Sending Access-Reject of id 8 to 127.0.0.1 port 49716

2 3

After ntlm_auth VSA is not sent. Without HTML this time
by Sipes, Nathan 23 Nov '10

23 Nov '10

I hit send a little too quickly last time, before I changed the format to text. I am having two problems and not sure where to look >From the Users file userjeff Cleartext-Password := "BADPASS" Juniper-Local-User-Name = "engineer", Service-Type = Login-User, Reply-Message = "Hello, %{User-Name}", Fall-Through = Yes 1. With the DEFAULT Auth-Type = ntlm_auth The nas gets an accept back but the attribute Juniper-Local-User-Name is not passed back ad_recv: Access-Request packet from host 10.34.250.14 port 51941, id=158, length=71 User-Name = "userjeff" User-Password = "some_password" NAS-Identifier = "LKWDCO93S14-lab" NAS-IP-Address = 10.34.250.14 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] expand: %t -> Tue Nov 23 15:44:34 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "userjeff", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "userjeff", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = ntlm_auth +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=userjeff [ntlm_auth] expand: --password=%{User-Password} -> --password=some_password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok Login OK: [userjeff] (from client default-network port 0) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.34.250.14/reply-detail-20101123 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.34.250.14/reply-detail-20101123 [reply_log] expand: %t -> Tue Nov 23 15:44:34 2010 ++[reply_log] returns ok ++[exec] returns noop Sending Access-Accept of id 158 to 10.34.250.14 port 51941 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 158 with timestamp +15 Ready to process requests. 2. With the DEFAULT Auth-Type = ntlm_auth commented out PAP isn't happy and I get eady to process requests. rad_recv: Access-Request packet from host 10.34.250.14 port 62435, id=126, length=71 User-Name = "userjeff" User-Password = "some_password" NAS-Identifier = "LKWDCO93S14-lab" NAS-IP-Address = 10.34.250.14 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] expand: %t -> Tue Nov 23 15:57:13 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "userjeff", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "userjeff", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry userjeff at line 107 [files] expand: Hello, %{User-Name} -> Hello, userjeff ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. Login incorrect: [userjeff/some_password] (from client default-network port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> userjeff attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 126 to 10.34.250.14 port 62435 Reply-Message = "Hello, userjeff" >From radius -X Nathan Sipes Sr. Network Design Specialist Tel: 303-914-4996 FAX: 303-763-3510 Kinder Morgan 370 Van Gordon St Lakewood, CO 80228 Nathan_Sipes(a)kindermorgan.com

1 0

FreeRADIUS with NTLM Auth not returning VSA after successful auth
by Sipes, Nathan 23 Nov '10

23 Nov '10

I am having two problems and not sure where to look >From the Users file userjeff Cleartext-Password := "BADPASS" Juniper-Local-User-Name = "engineer", Service-Type = Login-User, Reply-Message = "Hello, %{User-Name}", Fall-Through = Yes 1. With the DEFAULT Auth-Type = ntlm_auth a. The nas gets an accept back but the attribute Juniper-Local-User-Name is not passed back cat /var/log/radius/radacct/10.34.250.14/reply-detail-20101123 Tue Nov 23 15:44:34 2010 Packet-Type = Access-Accept 2. With the DEFAULT Auth-Type = ntlm_auth commented out PAP isn't happy and I get eady to process requests. rad_recv: Access-Request packet from host 10.34.250.14 port 62435, id=126, length=71 User-Name = "userjeff" User-Password = "some_password" NAS-Identifier = "LKWDCO93S14-lab" NAS-IP-Address = 10.34.250.14 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] expand: %t -> Tue Nov 23 15:57:13 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "userjeff", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "userjeff", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry userjeff at line 107 [files] expand: Hello, %{User-Name} -> Hello, userjeff ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. Login incorrect: [userjeff/some_password] (from client default-network port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> userjeff attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 126 to 10.34.250.14 port 62435 Reply-Message = "Hello, userjeff" >From radius -X ad_recv: Access-Request packet from host 10.34.250.14 port 51941, id=158, length=71 User-Name = "userjeff" User-Password = "some_password" NAS-Identifier = "LKWDCO93S14-lab" NAS-IP-Address = 10.34.250.14 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.34.250.14/auth-detail-20101123 [auth_log] expand: %t -> Tue Nov 23 15:44:34 2010 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "userjeff", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "userjeff", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 94 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = ntlm_auth +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=userjeff [ntlm_auth] expand: --password=%{User-Password} -> --password=some_password Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok Login OK: [userjeff] (from client default-network port 0) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.34.250.14/reply-detail-20101123 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.34.250.14/reply-detail-20101123 [reply_log] expand: %t -> Tue Nov 23 15:44:34 2010 ++[reply_log] returns ok ++[exec] returns noop Sending Access-Accept of id 158 to 10.34.250.14 port 51941 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 158 with timestamp +15 Ready to process requests.

1 0

Clients.conf file seems not working
by Wagner Pereira 23 Nov '10

23 Nov '10

Hi, folks. My scenario has a Cisco NAS authenticating in a Debian lenny running FreeRADIUS (which is using the /etc/passwd method). I must to give access to some users just in a specific NASes. I noticed that, even if I haven't the entry in clients.conf file for my NAS, like that... client 10.0.0.2/32 { secret = test shortname = edge } ...I am able to access my device. So I understand that this clients.conf isn't useful in that scenario. Am I right? Att, -- Wagner Pereira PoP-SP/RNP - Ponto de Presença da RNP em São Paulo CCE/USP - Centro de Computação Eletrônica da Universidade de São Paulo http://www.pop-sp.rnp.br Tel. (11) 3091-8901 fone@RNP: 10158902

2 1

MAC-Authentication from Mysql
by David Seira 23 Nov '10

23 Nov '10

Hi list. I'm trying to implement MAC-Authentication directly from a Mysql database. I follow the wiki page http://wiki.freeradius.org/Mac-Auth for authenticate macs from a file. I want to authenticate macs reading the authorized macs from a mysql database. I understand that in the radcheck table I need to put the macs like this: username attribute op value ======= ====== == ==== 00:11:22:33:44:55 Cleartext-Password := 00:11:22:33:44:55 I don't know where put the sql instruction for read macs from database. Is in the post-auth section? How can I do this? Regards, David

4 7