- Freeradius-Users - lists.freeradius.org

Newbie
by Schwartz, Curtis H. (GSFC-443.0)[SGT, INC] 21 Sep '10

21 Sep '10

New download of Freeradius 2.1.9. Compiled and accepted all defaults. This is right out the box and the first self test is failing. Can anyone provide some helpful hints? Followed directions: Edit the users file, and add the following line of text at the top, before anything else: testing Cleartext-Password := "password" Start the server in debugging mode (radiusd -X), and run radtest from another terminal window: $ radtest testing password 127.0.0.1 0 testing123 Server rejects with the following debug: rad_recv: Access-Request packet from host 127.0.0.1 port 60552, id=144, length=59 User-Name = "testing" User-Password = "password" NAS-IP-Address = x.x.x.x NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 144 to 127.0.0.1 port 60552 Waking up in 4.9 seconds.

3 3

which samba version / patch for Active Directory 2008
by Neil Prockter 21 Sep '10

21 Sep '10

Hello If someone who has a working freeradius samba ntlm_auth AD 2008 setup could let me know which version of samba they are using and which patches it might help me a great deal. I have a working configuration freeradius + samba 3.0.37 + Active Directory 2003. Our Active Directory servers are in the process of moving to 2008 and the 3.0.37 does not return the correct/same keys when looking at a upgraded AD server. I have it pointed to our last AD 2003 server and it work there. I've setup samba 3.4.8 with the patch https://bugzilla.samba.org/attachment.cgi?id=5894 (which needed a little changing to match line number changes). The session keys (if thats what they are) returned by running ntlm_auth on the 2 setups are different (I've put a wrapper script around it so that I can catch them being returned). If I run ntlm_auth repeatedly with the same challenge and nt-response the ones returned by the broken setup seem to change every few minutes whereas the working one stays the same. Thanks in advance, Neil Please access the attached hyperlink for an important electronic communications disclaimer: http://www.lse.ac.uk/collections/planningAndCorporatePolicy/legalandComplia…

5 8

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 20 Sep '10

20 Sep '10

Estaré ausente de la oficina desde el 20/09/2010 y no volveré hasta el 26/09/2010. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Accesos_SOR@telefonica (900 111 245 opción 3, 2) o Jose Manuel Gomez Perez (jmgomez(a)telefonica.es) ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

convert mac adresses to lower case
by PENZ Robert 20 Sep '10

20 Sep '10

Hi! I'm running # rpm -qa | grep radius freeradius2-mysql-2.1.7-7.el5 freeradius2-2.1.7-7.el5 freeradius2-python-2.1.7-7.el5 freeradius2-utils-2.1.7-7.el5 and I've different switch types. Some send the MAC address lower case the others upper case. For switches which send it lower it case it works (as the macs are stored lower case in the db). How can I convert them all in the clear text password attribute to lower case? The attr_rewrite module looks good, but the only way I see is to have 6 rewrite rules each replacing one letter, but that seems inefficient. The matching in the SQL Database works case insensitive and returns a row but the pap check logs following: rlm_sql (sql): Released sql socket id: 1 +++[sql] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "0025B3A013AA" [pap] Using clear text password "0025b3a013aa" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. I tried to remove pap but then I get following +++[sql] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. Hope someone can help me. Thx! Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

6 7

still not working (newbie for radius)
by gahn 20 Sep '10

20 Sep '10

Hi all: I apologize for the emails for such simple issue...:) it is still not working. I have done all of your guys advised and tried to read through the documents, but...:( here is my "client.conf" file: client 192.168.255.138 { secret = testing123 nastype = juniper } for my "users" file: bob Auth-Type := Local User-Password = "bob", Juniper-Local-User-Name = "labrat" I started radius with "radiusd -X" and also started tcpdump process. here is what i got from freerediaus debugging: rad_recv: Access-Request packet from host 192.168.255.138 port 54462, id=202, length=57 User-Name = "bob" User-Password = "bob" NAS-Identifier = "lab-r8" NAS-IP-Address = 150.150.0.1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry bob at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 202 to 192.168.255.138 port 54462 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.255.138 port 54462, id=202, length=57 Sending duplicate reply to client r8 port 54462 - ID: 202 Sending Access-Reject of id 202 to 192.168.255.138 port 54462 Waking up in 2.9 seconds. Cleaning up request 0 ID 202 with timestamp +11 rad_recv: Access-Request packet from host 192.168.255.138 port 54462, id=202, length=57 User-Name = "bob" User-Password = "bob" NAS-Identifier = "lab-r8" NAS-IP-Address = 150.150.0.1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "bob", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry bob at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bob attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 202 to 192.168.255.138 port 54462 Waking up in 4.9 seconds. Cleaning up request 1 ID 202 with timestamp +18 Ready to process requests. for tcpdump: 17:07:11.998936 IP 192.168.255.138.54462 > 192.168.255.128.radius: RADIUS, Access Request (1), id: 0xca length: 57 17:07:14.999487 IP 192.168.255.138.54462 > 192.168.255.128.radius: RADIUS, Access Request (1), id: 0xca length: 57 Interestingly, I only saw 'Access Request" came in, but I didn't see Access Reject messages. any help would be greatly appreciated. gahn

4 9

Use both SQL and SQL-LOG
by Marius Pesé 20 Sep '10

20 Sep '10

Hi everyone, I'm using mySQL to log accounting data, and also want to save the queries (not the packets) to a text file to use with a different program. Since that is both in sites-enabled/default, they seem to be mutually exclusive. Or maybe I'm just a bit blind - it's Friday after all. Any hint would be appreciated. Regards Marius

2 3

dictionary vendor options
by PENZ Robert 20 Sep '10

20 Sep '10

Hi! I'm running # rpm -qa | grep radius freeradius2-mysql-2.1.7-7.el5 freeradius2-2.1.7-7.el5 freeradius2-python-2.1.7-7.el5 freeradius2-utils-2.1.7-7.el5 and I copied following into the /etc/raddb/dictionary VENDOR Extreme 1916 ATTRIBUTE Extreme-CLI-Authorization 201 integer Extreme ATTRIBUTE Extreme-Shell-Command 202 string Extreme ATTRIBUTE Extreme-Netlogin-Vlan 203 string Extreme ATTRIBUTE Extreme-Netlogin-Url 204 string Extreme ATTRIBUTE Extreme-Netlogin-Url-Desc 205 string Extreme ATTRIBUTE Extreme-Netlogin-Only 206 integer Extreme ATTRIBUTE Extreme-User-Location 208 string Extreme ATTRIBUTE Extreme-Netlogin-Vlan-Tag 209 integer Extreme ATTRIBUTE Extreme-Netlogin-Extended-Vlan 211 string Extreme ATTRIBUTE Extreme-Security-Profile 212 string Extreme VALUE Extreme-CLI-Authorization Disabled 0 VALUE Extreme-CLI-Authorization Enabled 1 VALUE Extreme-Netlogin-Only Disabled 0 VALUE Extreme-Netlogin-Only Enabled 1 which seems ok for me but the freeradius thinks otherwise as I get including dictionary file /etc/raddb/dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary[37]: unknown option "Extreme" Does anyone know the problem with my config? thx! Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

2 2

2 Called-Station-Id authorize unlang filtering question
by tmihalicek 20 Sep '10

20 Sep '10

Hi everyone ... I need to put up a certain scenario for radius. I have 2 Called-Station-Id numbers 111111 an 122222, first number should always be accepted for auth users, the second one should be accessed after the user hits 10 hours quota on first number. I was wonder if this configuration is the right way. server dialup { authorize { preprocess expiration logintime if (Called-Station-Id == "111111") { sql_dialup pap } elsif (Called-Station-Id == "122222" && "%{sql_dialup: SELECT SUM(acctsessiontime) FROM radacct_dialup \ WHERE YEAR(acctstarttime) = YEAR(CURDATE()) AND MONTH(acctstarttime) = MONTH(CURDATE()) \ AND username = '%{SQL-User-Name}' HAVING SUM(acctsessiontime) < 36000}") { sql_dialup pap update control { Auth-Type := Reject } update replay { Reply-Message := "10 hour quota still not reached" } elsif (Called-Station-Id == "122222" && "%{sql_dialup: SELECT SUM(acctsessiontime) FROM radacct_dialup \ WHERE YEAR(acctstarttime) = YEAR(CURDATE()) AND MONTH(acctstarttime) = MONTH(CURDATE()) \ AND username = '%{SQL-User-Name}' HAVING SUM(acctsessiontime) >= 36000}") { sql_dialup pap update control { Auth-Type := Accept } update replay { Reply-Message := "10 hour quota reached, access accepted" } else { reject } } ... post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject update reply { Reply-Message := "Access denied" } } } } -- View this message in context: http://freeradius.1045715.n5.nabble.com/2-Called-Station-Id-authorize-unlan… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

How to access proxy-reply:Packet-Type in if condition
by Chidanand 20 Sep '10

20 Sep '10

Hi, I am using freeRadius 2.1.9 version. I am trying to update proxy-reply message with additional attributes, I want to do it only if proxy-reply is Access-Accept. I see %{proxy-reply:Packet-Type} returns "Access-Accept" but I am not able to form a if condition, I see following error: Thu Sep 16 12:20:24 2010 : Info: +- entering group post-proxy {...} Thu Sep 16 12:20:24 2010 : Info: expand: %{proxy-reply:Packet-Type} -> Access-Accept Thu Sep 16 12:20:24 2010 : Info: ++[proxy-reply] returns noop Thu Sep 16 12:20:24 2010 : Info: ++? if (proxy-reply:Packet-Type == "Access-Accept") Thu Sep 16 12:20:24 2010 : Info: (Attribute proxy-reply:Packet-Type was not found) Thu Sep 16 12:20:24 2010 : Info: [eap] No pre-existing handler found Thu Sep 16 12:20:24 2010 : Info: ++[eap] returns noop Thu Sep 16 12:20:24 2010 : Info: Found Auth-Type = Accept Thu Sep 16 12:20:24 2010 : Info: Auth-Type = Accept, accepting the user Thu Sep 16 12:20:24 2010 : Info: +- entering group post-auth {...} Thu Sep 16 12:20:24 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 11 to 192.168.6.181 port 32771 Framed-Protocol = PPP Service-Type = Framed-User EAP-Message = 0x030c0004 Class = 0x482404d3000001370001c0a8073f01cb53194e942c94000000000000020f MS-CHAP-Domain = "\001TESTAD" MS-CHAP2-Success = 0x01533d33374341363935353838313541433741463032344131333733453832463730424238413846433033 MS-MPPE-Send-Key = 0x6690415a2581f6721c2bd5b7248693f972bd3c750929bb4ab85eccba612b34ee MS-MPPE-Recv-Key = 0x2a32a3e3f8e828d049c41b18dc8ef342720afe4de007074eb3c880de24a51ba3 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "Access-Accept" Thu Sep 16 12:20:24 2010 : Info: Finished request 11. Thu Sep 16 12:20:24 2010 : Debug: Going to the next request Thu Sep 16 12:20:24 2010 : Debug: Waking up in 4.8 seconds. Can we really access proxy-reply:Packet-Type using unlang? Please help me solving this problem. Thanks,Chidanand

3 4

Two or more freeradius server
by Spacelee 20 Sep '10

20 Sep '10

# RADIUS server to use for authentication requests. this config # item can appear more then one time. if multiple servers are # defined they are tried in a round robin fashion if one # server is not answering. # optionally you can specify a the port number on which is remote # RADIUS listens separated by a colon from the hostname. if # no port is specified /etc/services is consulted of the radius # service. if this fails also a compiled in default is used. authserver ip1:1812 authserver ip2:1812 I use pptp+ppp+freeradius+mysql and in the radiusclient.conf, it set two authsever server, so that it's round robin. but in fact, when I stop ip1, ip2 is up, it's ok, and then i stop ip2, ip1 is up, it's not ok what's the problem, have you met before ? -- *Space Lee*

1 1