- Freeradius-Users - lists.freeradius.org

Distriubtion Recommendation
by Johnson, Neil M 03 Nov '10

03 Nov '10

Which Linux Distro is recommended for running FreeRadius 2.1 ? I'm looking to avoid having to compile Samba by hand. Thanks. -Neil -- Neil Johnson Network Engineer Information Technology Services The University of Iowa 319 384-0938 neil-johnson(a)uiowa.edu

4 4

Problem suppressing timestamp/Request-Athenticator in detailed logging
by Janet Plato 03 Nov '10

03 Nov '10

Greetings, I am running freeradius 2.1.7 and attempting to have limited details in my detail logfile. I edited modules/detail to include the header I like, and added just about everything else to the suppress stanza. I get mostly what I want, but it still prints Timestamp and Request-Athenticator, but logs an error that those are not valid values and cannot suppress them. Does anyone have any suggestions on where I might have gone astray? I am getting the following error in /var/log/radius/radius.log Wed Nov 3 14:25:41 2010 : Info: rlm_detail: WARNING: No such attribute Timestamp: Cannot suppress printing it. Wed Nov 3 14:25:41 2010 : Info: rlm_detail: WARNING: No such attribute Request-Authenticator: Cannot suppress printing it. The following is the suppress stanza of /etc/raddb/modules/detail, note that I suppress those two items. detail { # stuff header = "%S %{Acct-Unique-Session-Id} %n: User %u from %i %{Acct-Status-Type}" # stuff suppress { User-Password Acct-Session-Id User-Name Acct-Authentic Acct-Terminate-Cause Acct-Session-Time Acct-Status-Type Calling-Station-Id Service-Type NAS-IP-Address NAS-Port NAS-Port-Id NAS-Port-Type Acct-Delay-Time Acct-Unique-Session-Id Timestamp Request-Authenticator } I get the following in the detail file, note that I get Timestamp and Request-Authenticator which I am trying to stop: 2010-11-03 14:20:35 23e0e50bb883d1a1 146.151.161.4: User plato from 144.92.67.114 Stop Timestamp = 1288812035 Request-Authenticator = Verified 2010-11-03 14:25:47 f93811307e83dc9d 146.151.161.4: User plato from 144.92.67.114 Start Timestamp = 1288812347 Request-Authenticator = Verified I have manually shutdown the server and ran it with radiusd -X and it says basically the same thing: ... Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/detail-%Y%m%d" header = "%S %{Acct-Unique-Session-Id} %n: User %u from %i %{Acct-Status-Type}" detailperm = 420 dirperm = 493 locking = no log_packet_header = no } rlm_detail: WARNING: No such attribute Timestamp: Cannot suppress printing it. rlm_detail: WARNING: No such attribute Request-Authenticator: Cannot suppress printing it. Module: Instantiating attr_filter.accounting_response ... I've looked for extra spaces and non-printed characters in the config, but that does not seem to be it. Does anyone have any suggestions on where to look? Cheers, Janet, who can be reached at techgrrl2003 at yahoo dot com.

2 1

Help on passing parameter to exec
by nghiapt 03 Nov '10

03 Nov '10

Hi all, At first, to the people who is working on FreeRADIUS, you're doing an awesome, awesome job! Ok, so I'm having this configuration: in sites-available/default: [...] preacct { # Echo here yields WARNING and doesn't catch Session-Timeout # echo if (Acct-Status-Type == "Start"){ acctstart } if (Acct-Status-Type == "Stop"){ acctstop } [...] where acctstart and acctstop is 2 exec modules, defined like this: exec acctstart { wait = yes program = "/accounting_start_sh.sh %{User-Name} %{reply:Session-Timeout}" input_pairs = reply output_pairs = reply shell_escape = yes } exec acctstop { wait = yes program = "/accounting_stop_sh.sh %{User-Name} input_pairs = reply output_pairs = reply shell_escape = yes } Basically, the shell script is to ssh and terminate stuff in NAS after Session-Timeout seconds have passed (Don't ask, but NAS doesn't support Session-Timeout so we need to do it this way). The problem is, when we have a run, the debug yield: [...] Sending Access-Accept of id 121 to 127.0.0.1 port 45280 Reply-Message = "Hello, test" Session-Timeout = 94 Finished request 0. Going to the next request Waking up in 4.7 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 45280, id=123, length=155 NAS-Identifier = "OpenVPN.localhost.localdomain" User-Name = "test" NAS-Port = 27 Service-Type = Dialout-Framed-User Framed-Protocol = PPP Acct-Status-Type = Start Framed-IP-Netmask = 255.255.248.0 Acct-Session-Id = "OpenVPN.localhost.localdomain.as0t1.1288162180.5521.27" Framed-IP-Address = 5.5.8.25 NAS-Port-Type = Virtual +- entering group preacct {...} ++? if (Acct-Status-Type == "Start") ? Evaluating (Acct-Status-Type == "Start") -> TRUE ++? if (Acct-Status-Type == "Start") -> TRUE ++- entering if (Acct-Status-Type == "Start") {...} [acctstart] WARNING! Input pairs are empty. No attributes will be passed to the script [acctstart] expand: %{User-Name} -> test [acctstart] expand: %{reply:Session-Timeout} -> expr: syntax error Exec-Program output: test is scheduled to be terminated after min(s) Exec-Program-Wait: plaintext: test is scheduled to be terminated after min(s) Exec-Program: returned: 0 [...] Note the 2 bold lines, the Session-Timeout isn't passed to the acctstart exec, leading to shellscript doesn't run correctly. My question is can I somehow pass the Session-Timeout value from the Access-Accept packet to this section of preaccounting? FYI, I'm using sql counter (the default noresetcounter) to calculate the Session-Timeout. Thanks a lot in advance, N. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-on-passing-parameter-to-exec-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

None
by Влад Власов 03 Nov '10

03 Nov '10

Hello everyone, Please help me I try to setup FreeRadius as proxy. I want to extract MSCHAPv2 auth from EAP-PEAP/MSCHAPv2 ,and proxy only MSCHAPv2 request to another radius server ,that does not work with a EAP-PEAP. changed only the following items:

1 0

dot1x with samba workstation accounts part two
by steffo76＠gmx.de 02 Nov '10

02 Nov '10

Hi list, I am new here and would like to respond to a message which has been sent before I was subscribed: https://lists.freeradius.org/pipermail/freeradius-users/2010-June/msg00432.… I ran into the same problem and might have a solution that satisfies both sides, I added a configuration option to modules/mschap which is called "enforce_user_flag". With this patch the following happens: If the disabled flag is set, it rejects anyway. If the enforce_user_flag is not set or set to 'yes', mschap checks for the presence of the user flag (this has been the behaviour so far). If enforce_user_flag is set to 'no', mschap checks for the presence of the „workstation trust account“ „server trust account“ or „normal user account“. If one of them is present it is satisfied with the flags. With this solution mschap behaves like it did before with out of the box settings but is able to honor the workstation or server trust account flags if the configuration option is set accordingly. There would be no need to disable the check of the 'disabled' flag. It is probably not the best code ever but maybe it helps someone. Regards Stephan

1 0

Building freeradius from source
by Nirmal Guhan 02 Nov '10

02 Nov '10

Hi, Am trying to compile freeradius (freeradius-server-2.1.10) for my own distro (based on 2.6.32 kernel from kernel.org) and running into compilation errors. : libtool: link: `rlm_eap_md5.lo' is not a valid libtool object gmake[9]: *** [rlm_eap_md5.la] Error 1 Please let me know a way to fix this. Also, radiusd seems to be pulling in many shared libraries. Do I need to compile them from source myself or are there any short cuts (if someone has tried this before) ? I know compiling it for Fedora or a similar distro is easier but unfortunately that won't help me. Note that I just need simple password (cleartext) based authentication leaving out the crypto stuff. Thanks, Nirmal

2 3

Authenticating agains AD issues
by Johnson, Neil M 02 Nov '10

02 Nov '10

I've been following the reciepe on the "Deploying RADIUS" web site, but I have been unable to get an iPhone or Laptop to authenticate to wireless. It appears from the log that ntlm_auth is behaving correctly but the the challenge continues. I'm running 2.1.9 on Fedora 12 using the demonstration certificates. Here is the last part of the log file: Thanks in advance. -Neil [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for nmjoo with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> IOWA\nmjoo [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User- Name:-None}} -> --username=IOWA\nmjoo [mschap] mschap2: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> -- challenge=13fe382b60e3bba9 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> -- nt-response=24bf15cdc812e5f7fb9723f21143bb775b24a1914870caf0 Exec-Program output: NT_KEY: 0FD5C0593F3B79F0478DB821B51BCB38 Exec-Program-Wait: plaintext: NT_KEY: 0FD5C0593F3B79F0478DB821B51BCB38 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010a00331a0309002e533d36463744463330464436383432423542423738463736454339423230454534453639434431463338 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9b59f55f9a53ef43871eb82ef0802a05 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010a00331a0309002e533d36463744463330464436383432423542423738463736454339423230454534453639434431463338 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x9b59f55f9a53ef43871eb82ef0802a05 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 112 to 128.255.11.74 port 32768 EAP-Message = 0x010a005b19001703010050f59dec82774ce4b8dc5bb542e29881b2cb321a7136c39e4f1a498708fa2515da475f29ec726bd310dd96ab7ae6de4a85f079285567b375a7fa02d137f9d0d2adcf75dc887c91c50a41e041c13b370882 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa489d972ac83c05d8d6d2302f3fa3977 Finished request 17. Going to the next request Waking up in 3.2 seconds. Cleaning up request 0 ID 95 with timestamp +9 Cleaning up request 1 ID 96 with timestamp +9 Cleaning up request 2 ID 97 with timestamp +9 Cleaning up request 3 ID 98 with timestamp +9 Cleaning up request 4 ID 99 with timestamp +9 Cleaning up request 5 ID 100 with timestamp +9 Cleaning up request 6 ID 101 with timestamp +9 Cleaning up request 7 ID 102 with timestamp +9 Cleaning up request 8 ID 103 with timestamp +9 Waking up in 1.0 seconds. Cleaning up request 9 ID 104 with timestamp +10 Cleaning up request 10 ID 105 with timestamp +10 Cleaning up request 11 ID 106 with timestamp +10 Cleaning up request 12 ID 107 with timestamp +10 Cleaning up request 13 ID 108 with timestamp +10 Cleaning up request 14 ID 109 with timestamp +10 Cleaning up request 15 ID 110 with timestamp +10 Cleaning up request 16 ID 111 with timestamp +10 Cleaning up request 17 ID 112 with timestamp +10 Ready to process requests. -- Neil Johnson Network Engineer Information Technology Services The University of Iowa Work: 319 384-0938 Mobile: 319 540-2081 Fax: 319 355-2618 E-mail: neil-johnson(a)uiowa.edu

5 13

RE: Problem with LDAP and SSHA password
by Maurice James 01 Nov '10

01 Nov '10

I posted a working config for your exact problem last week. Take Johns advice. Thanks -----Original Message----- From: freeradius-users-bounces+midnightsteel=msn.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] On Behalf Of Rafal Kaminski Sent: Monday, November 01, 2010 10:59 AM To: freeradius-users(a)lists.freeradius.org Subject: Re: Problem with LDAP and SSHA password W dniu 11/1/10 3:56 PM, Rafał Kamiński pisze: > Hi, > > I configured Freeradius + Ldap and ssha Password like userPassword but > when I try connect I have this debug log: > > ---CUT--- Ok - my bad :) I clicked "Send" fast. ---CUT--- Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: LDAP attribute userPassword as RADIUS attribute Password == "{SHA}izxUUJlzMp1DyX5R9DSblXZBpjI=" Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: LDAP attribute userPassword as RADIUS attribute User-Password == "{SHA}izxUUJlzMp1DyX5R9DSblXZBpjI=" Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: looking for reply items in directory... Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: user rafal.kaminski authorized to use remote access Mon Nov 1 14:53:39 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[ldap] returns ok Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling expiration (rlm_expiration) for request 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from expiration (rlm_expiration) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[expiration] returns noop Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling logintime (rlm_logintime) for request 0 Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from logintime (rlm_logintime) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[logintime] returns noop Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Mon Nov 1 14:53:39 2010 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[pap] returns noop Mon Nov 1 14:53:39 2010 : Debug: rad_check_password: Found Auth-Type EAP Mon Nov 1 14:53:39 2010 : Debug: auth: type "EAP" Mon Nov 1 14:53:39 2010 : Debug: WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Mon Nov 1 14:53:39 2010 : Debug: auth: Failed to validate the user. Mon Nov 1 14:53:39 2010 : Auth: Login incorrect: [rafal.kaminski/<via Auth-Type = EAP>] (from client 192.168.37.3 port 0) Mon Nov 1 14:53:39 2010 : Debug: Found Post-Auth-Type Reject Mon Nov 1 14:53:39 2010 : Debug: +- entering group REJECT Mon Nov 1 14:53:39 2010 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Mon Nov 1 14:53:39 2010 : Debug: expand: %{User-Name} -> rafal.kaminski Mon Nov 1 14:53:39 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Nov 1 14:53:39 2010 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Mon Nov 1 14:53:39 2010 : Debug: ++[attr_filter.access_reject] returns updated Mon Nov 1 14:53:39 2010 : Debug: Delaying reject of request 0 for 1 seconds Mon Nov 1 14:53:39 2010 : Debug: Going to the next request Mon Nov 1 14:53:39 2010 : Debug: Waking up in 0.9 seconds. Mon Nov 1 14:53:40 2010 : Debug: Sending delayed reject for request 0 Sending Access-Reject of id 217 to 192.168.37.3 port 1812 ---END-CUT--- Where is the problem? Thanks for help, because I can't resolve that problem for 2-3 days :( -- Rafal Kaminski System Administrator Young Internet GmbH Torstraße 35 10119 Berlin Germany - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Problem with LDAP and SSHA password
by Rafał Kamiński 01 Nov '10

01 Nov '10

Hi, I configured Freeradius + Ldap and ssha Password like userPassword but when I try connect I have this debug log: ---CUT--- -- Rafal Kaminski System Administrator Young Internet GmbH Torstraße 35 10119 Berlin Germany

4 4

Dynamic VLAN Assignment based on a certificate, not a user.
by Бисер Миланов 01 Nov '10

01 Nov '10

Hello! Some time ago Alan mentioned that the new 2.1.10 version will support such a thing. However, I can't seem to find it in the docs. Can anyone shed some light on how that can be done with the new functionality? ----------------------------------------------------------------- Вижте последните новини във Vesti.bg! http://www.vesti.bg/

2 1