- Freeradius-Users - lists.freeradius.org

Sporadic Windows 802.1x-PEAP-MSchapv2 failures solved with 2.1.10
by Cannady, Mike 15 Nov '10

15 Nov '10

I just wanted to let everyone know that the 2.1.10 release fixed a sporadic problem that we were having with PEAP-MSchapv2 and 802.1x. We had several PCs that would work only sometimes with freeradius, but they would always work with Microsoft's IAS. I would move a problem PC from a switch authenticating with windows to another switch authenticating through freeradius and back and the problem stayed with the freeradius one. I was running 2.1.7 at the time. I installed 2.1.10 to get to the latest version before using this list for help, just to have it fix the problem. I suspect bug#17 was the issue. If the issue hadn't been solved, we were preparing to go to two MS server datacenter servers to do just the radius work (we have a *lot* of switches) which I thought was a lot of overkill and wouldn't give us the flexibility to do what we plan with the radius server in the future. Now we don't need the MS servers now! Thanks a bunch!!!! You made me very happy! Mike Cannady ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

2 1

Logical OR with Check Attributes
by Gary T. Giesen 15 Nov '10

15 Nov '10

Is there any way to perform a logical OR with the check attributes (specifically with the NAS-IP-Address)? What I'd like to do is to authenticate the user if it's coming from one of a list of NAS-IP-Address values, and reject otherwise. Is this possible? GG

3 3

Mysql Socket Timeout
by Rhommel Lamas 15 Nov '10

15 Nov '10

Is there anyway i can configure Mysql timeout on the sockets connection?, it has come to my attention that if i configure Radius With redundant options, it takes too long to close all sockets and on consequence Freeradius freeze until all connections are tested.

1 0

Found Auth-Type = LDAP WARNING: Unknown value specified for Auth-Type.
by Neal Vadekar 15 Nov '10

15 Nov '10

i am using freeradius 2.1.7 on centos 5.5, i have configured openldap and wish to have authentication/authorization against this datasource. i have configured my radius.conf as follows: authorize { preprocess files ldap } # authenticate { Auth-Type LDAP { ldap } } i have configured my users file as follows: test55 Cleartext-Password := "test55" DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Auth-Type := LDAP Fall-Through = 1 i have configured my modules/ldap file as follows: ldap { server = "localhost" identity = "cn=Manager,dc=example,dc=com" password = secret basedn = "ou=users,dc=example,dc=com" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap password_attribute = userPassword } i have setup openldap with a user in users.example.com called testldap with a cleartext password of testldap when i run “radtest testldap testldap localhost 10 testing123” the out put is as follows: rad_recv: Access-Request packet from host 127.0.0.1 port 40626, id=223, length=60 User-Name = "testldap" User-Password = "testldap" NAS-IP-Address = 172.16.159.11 NAS-Port = 10 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testldap", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 212 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = LDAP WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testldap attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 223 to 127.0.0.1 port 40626 Waking up in 4.9 seconds. Cleaning up request 0 ID 223 with timestamp +4 Ready to process requests. line 212 is my “DEFAULT Auth-Type := LDAP” line in the users file no connection attempt is made against my openldap server. I do not understand why i get the following error: Found Auth-Type = LDAP WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. i can tell you when i use radtest with the test55 user directly defined in the users file, it works, also, when I use a unix user in the passwd/shadow files it also works. there also appears to be no entry in the dictonary file about ldap, but i don’t yet know enough to know if that is relevant. please assist, i wish to understand why this radtest does not work when all the documentation I can find as I currently understand them suggest it should work. Neal

2 1

seems there is no nas for pptp+ppp
by Spacelee 14 Nov '10

14 Nov '10

I have checked the naslist, and there is no ppp, what should I choose? -- *Space Lee*

2 1

Custom message question
by Deepak 14 Nov '10

14 Nov '10

Hi, I am using chillispot with freeradius (rpm package from centos 5.5). I am getting the message "Your maximum never usage time has been reached" when expired user tries to login. What I wanted to do is change that message to some friendly message like "Your account has expired." or something like that. I am using Access Period counter for user time limit. In "counter.conf" documentation I saw that the message can be changed by using "reply-message". I tired it but nothing changed. Is there a way to change this message? Thanks Deepak

1 0

freeradius and Cisco VPN IPSEC profiles authentication
by Jevos, Peter 12 Nov '10

12 Nov '10

Hi , I tried to setup configuration from different sources from the web, but it's not easy I have cisco vpn access server where are more IPSEC proflles ( groups ). They should be authenticated against Freeradius. One profile called Group1 should be authenticated against ntlm_auth_vpn ( already working), others against vpn_auth_name So my Users file is: DEFAULT Auth-Type := ntlm_auth_vpn, NAS-IP-Address == 10.1.1.252 Tunnel-Type = "ESP", Tunnel-Private-Group-ID = "Group1", Tunnel-Password = "cisco", Cisco-Avpair="ipsec:dns-servers=10.1.1.6 10.1.1.7", Cisco-Avpair="ipsec:addr-pool=vpn_pool", Cisco-Avpair="ipsec:inacl=101", Cisco-Avpair="ipsec:key-exchange=ike", Cisco-Avpair="ipsec:key-exchange=preshared-key", Service-Type = Framed-User, Framed-Protocol = PPP, DEFAULT Auth-Type := vpn_auth_name, , NAS-IP-Address == 10.1.1.252 Service-Type = Framed-User, Framed-Protocol = PPP, Fall-Through = Yes Point is that the group Group1 should be authenticated against ntlm_auth_vpn, other groups against vpn_auth_name However this config doesn't work, debug lokks strange ( takes only first Cisco Avpair attribute ), probably something wrong In the config Thanks fro your help pet

4 23

Re: Output from Exec-Program-Wait in users file
by Craig Campbell 12 Nov '10

12 Nov '10

I think I found the issue. One of the value pairs being returned used a name not defined in the dictionary file. The new name is similar leading me to suspect the old name was deprecated and eventually replaced with a more clear name. Thanks all! -craig ----- Original Message ----- From: Craig Campbell To: FreeRadius users mailing list Sent: Friday, November 12, 2010 6:24 AM Subject: Output from Exec-Program-Wait in users file Hi, am migrating from an ancient radius install to FreeRADIUS Version 2.1.8 The system uses a custom authentication binary which we access from the users file via, DEFAULT NAS-IP-Address == "192.168.1.100", Auth-Type := Accept, Simultaneous-Use := 1 Exec-Program-Wait = "/usr/local/sbin/auth -X -U -u 5882626 -- %{User-Name} %{User-Password} %{%{Called-Station-Id}:-Missing} %{%{NAS-IP-Address}:-Missing} %{%{Calling-Station-Id}:-Missing} %{%{NAS-Port-Type}:-Missing} %{Vendor-Specific}" , Fall-Through = no On the old version, the output from the EXEC was sent back in the Accept packet.. Now is looks like the stdout form the Exec-Program-Wait is not being send back but either dropped or misplaced. ++[sql] returns ok +- entering group post-auth {...} Exec-Program output: Framed-Compression=Van-Jacobsen-TCP-IP Framed-Routing=None Framed-MTU=1500 Framed-IP-Netmask=255.255.255.0 Framed-Protocol=PPP Service-Type=Framed-User Idle-Timeout=1800 Session-Timeout=86400 ERX-Virtual-Router=SOMEROUTER ERX-Ingress-Policy-Name=COMFORT_UP ERX-Egress-Policy-Name=COMFORT_DOWN Exec-Program-Wait: plaintext: Framed-Compression=Van-Jacobsen-TCP-IP Framed-Routing=None Framed-MTU=1500 Framed-IP-Netmask=255.255.255.0 Framed-Protocol=PPP Service-Type=Framed-User Idle-Timeout=1800 Session-Timeout=86400 ERX-Virtual-Router=SOMEROUTER ERX-Ingress-Policy-Name=COMFORT_UP ERX-Egress-Policy-Name=COMFORT_DOWN Exec-Program: returned: 0 ++[exec] returns noop Sending Access-Accept of id 248 to 192.168.1.100 port 50000 Finished request 0. Is there a way to direct the output from the Exec-Program into the Accept packet? As far as we can tell, we are sending back and empty Accept packet. The values are calculated by the auth binary, so hard coding them would be very difficult. It's after 1am here, so I hope this won't seem obvious in the morning. Any hints would be greatly appreciated. Thanks so much, -craig ------------------------------------------------------------------------------ Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 5612 (20101111) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 5614 (20101112) __________ The message was checked by ESET Smart Security. http://www.eset.com __________ Information from ESET Smart Security, version of virus signature database 5614 (20101112) __________ The message was checked by ESET Smart Security. http://www.eset.com

1 0

Output from Exec-Program-Wait in users file
by Craig Campbell 12 Nov '10

12 Nov '10

Hi, am migrating from an ancient radius install to FreeRADIUS Version 2.1.8 The system uses a custom authentication binary which we access from the users file via, DEFAULT NAS-IP-Address == "192.168.1.100", Auth-Type := Accept, Simultaneous-Use := 1 Exec-Program-Wait = "/usr/local/sbin/auth -X -U -u 5882626 -- %{User-Name} %{User-Password} %{%{Called-Station-Id}:-Missing} %{%{NAS-IP-Address}:-Missing} %{%{Calling-Station-Id}:-Missing} %{%{NAS-Port-Type}:-Missing} %{Vendor-Specific}" , Fall-Through = no On the old version, the output from the EXEC was sent back in the Accept packet.. Now is looks like the stdout form the Exec-Program-Wait is not being send back but either dropped or misplaced. ++[sql] returns ok +- entering group post-auth {...} Exec-Program output: Framed-Compression=Van-Jacobsen-TCP-IP Framed-Routing=None Framed-MTU=1500 Framed-IP-Netmask=255.255.255.0 Framed-Protocol=PPP Service-Type=Framed-User Idle-Timeout=1800 Session-Timeout=86400 ERX-Virtual-Router=SOMEROUTER ERX-Ingress-Policy-Name=COMFORT_UP ERX-Egress-Policy-Name=COMFORT_DOWN Exec-Program-Wait: plaintext: Framed-Compression=Van-Jacobsen-TCP-IP Framed-Routing=None Framed-MTU=1500 Framed-IP-Netmask=255.255.255.0 Framed-Protocol=PPP Service-Type=Framed-User Idle-Timeout=1800 Session-Timeout=86400 ERX-Virtual-Router=SOMEROUTER ERX-Ingress-Policy-Name=COMFORT_UP ERX-Egress-Policy-Name=COMFORT_DOWN Exec-Program: returned: 0 ++[exec] returns noop Sending Access-Accept of id 248 to 192.168.1.100 port 50000 Finished request 0. Is there a way to direct the output from the Exec-Program into the Accept packet? As far as we can tell, we are sending back and empty Accept packet. The values are calculated by the auth binary, so hard coding them would be very difficult. It's after 1am here, so I hope this won't seem obvious in the morning. Any hints would be greatly appreciated. Thanks so much, -craig -------------------------------------------------------------------------------- Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 5612 (20101111) __________ The message was checked by ESET Smart Security. http://www.eset.com

1 0

Radius Client password not accepted
by Azam Zia 12 Nov '10

12 Nov '10

Hi, I am using free radius for communication between asterisk voip server and database. I have everything setup on same machine which has Centos 5.4. My problem is that when i send request from client to server the radius password is not accepted, also when i see radius packets in wireshark i see that accountstatus type value is not correct. I have checked the password at client and server are same. Please help i have been trying to solve this issue for the past 15 days. Regards Azam

2 1