- Freeradius-Users - lists.freeradius.org

Save Passwords Encrypted in DB
by Nasser Heidari 06 Sep '10

06 Sep '10

Hi, I want to save encrypted passwords in DB. As I reviewed mailing list , it looks that I don't need major changes on my Freeradius and DB records. Currently my users password in database is like this : +------------+---------------+------------------+----+------------------ ----+ | id | UserName | attribute | op | value | +------------+---------------+------------------+----+------------------ ----+ | 10001 | nasser | User-Password | := | plainpass | +------------+---------------+------------------+----+------------------ ----+ And I authenticate users with pap module . I've changed DB entry to this : # openssl passwd -1 plainpass $1$n.cKdTKy$.N.o9XkpX.RkCHC5EbZds/ +------------+---------------+------------------+----+------------------ ------------------------------------------+ | id | UserName | attribute | op | value | +------------+---------------+------------------+----+------------------ ------------------------------------------+ | 10001 | nasser | Crypt-Password | := | $1$n.cKdTKy$.N.o9XkpX.RkCHC5EbZds/ | +------------+---------------+------------------+----+------------------ ------------------------------------------+ But no success, also I add Password-With-Header := "{crypt}" to my sql.conf but no success ! Do I missing something ? What kind of changes do I need? My Freeradius Version is 2.1.7 Thanks in advance.

2 4

RADIUS reading LDAP attributes
by Sigurd Foshaug 04 Sep '10

04 Sep '10

Hi all, I have a freeradius 2.1.3 running and I can successfully authenticate users. I would like to use a users LDAP attribute so I can provide them with different permissions on the proxy server. I have currently mapped a RADIUS attribute to the LDAP attribute and it successfully reads the attribute when a user is authenticating. >From radiusd -X: rlm_ldap: description -> My-Local-LDAP-Comment = "STAFF" So the user in question has STAFF as a comment in his ldap description attribute. I have added the My-Local-LDAP-Comment into the raddb/dictionary file like this: ATTRIBUTE My-Local-LDAP-Comment 3000 string and in the raddb/ldap.attrmap I have added: replyItem My-Local-LDAP-Comment description Now, what I am failing to understand is how I can get the proxy server to receive the My-Local-LDAP-Comment attribute from RADIUS, so I can make rules depending on its contents? Any suggestions on what to do, or which documentation to read would be appreciated. Thanks, Sigurd

2 2

Re: detail configuration file: how to save lines
by Alan DeKok 04 Sep '10

04 Sep '10

Stefan A. wrote: > I have a detail configuration file, which has several sections for different > files, to be handled by different listener > > As the NASses are GGSNs, which are sending more than 40 attributes, I will > save space on HD and will remove unneeded attributes using suppress. > Do I have to put every attribute in every detail-x configuration area or is > there a kind of template to do this? read raddb/templates.conf Alan DeKok.

2 1

Configure PEAP on FreeRadius using openssl.
by Stephane Brodeur 03 Sep '10

03 Sep '10

Hi, I am trying to configure FreeRADIUS for the PEAP authentication method. I am using the following link to set up the FreeRADIUS server: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO This documents indicates that the file radiusd.conf should include the following entry: authtype = MS-CHAP It also refers to the utilization of the CA.all script The version of FreeRADIUS running on version 5.5 does not have any entry for authtype = MS-CHAP in radiusd.conf file and does not have CA.all script. Is there anybody kind enough to tell me if it is possible that my version of FreeRADIUS, do not know how to find it, does not need the authtype = MS-CHAP entry in radiusd.conf file I also would like to know if we can used something equivalent to CA.all script and how can we modify eap.conf accordingly. Any information on what CA.all script or any equivalent is all about would also be really helpful. Thanks Stephane

2 1

..::Block username after 3 failed authentications::..
by Alfonso Alejandro Reyes Jiménez 03 Sep '10

03 Sep '10

Hi Everyone. I was wondering if there's some way to block the brute force attack. for example block the username after 3 invalid password attempts. This could be possible? if it's possible how? Thanks in advance. Regards. Alfonso.

2 2

Freeradius Authentication
by jorge88 03 Sep '10

03 Sep '10

Good afternoon, I wanted to make the following question to see if someone can help me. Is it possible to configure freeradius to consult users in two different tables within the same database? Otherwise, is it possible to associate a user name to a NAS so it will not be logging in from another NAS differently? Thank you very much -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-Authentication-tp2802389… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

..::Huntgroup Issues::..
by Alfonso Alejandro Reyes Jiménez 03 Sep '10

03 Sep '10

Hi, I'm trying to use the huntgroup feature on the freeradius software with out luck. I think I'm missing something that's why I'm sending this email maybe you can help me. Right now I have the following files: huntgroups file at the end: squid NAS-IP-Address == 127.0.0.1 users file at the end: alfonso Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "squid" clients.conf at the end: client 127.0.0.1 { secret = xxxxxxxxxxx shortname = squid } When I try with the radtest to log in, I get an access-reject. Here's the client side response: [root@mscitum raddb]# radtest alfonso testing localhost 10 xxxxxxx Sending Access-Request of id 134 to 127.0.0.1 port 1812 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 Here's the output of the debug, it seems that it doesn't find the config file. rad_recv: Access-Request packet from host 127.0.0.1:36858, id=134, length=59 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "alfonso", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 134 to 127.0.0.1 port 36858 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 134 with timestamp 4c7319f1 Nothing to do. Sleeping until we see a request. May be I'm missing to enable some feature, thanks in advance for your help. Regards Alfonso.

3 4

Problem with rlm_perl
by Nasser Heidari 03 Sep '10

03 Sep '10

Dear Folks, Apologies for previous unwanted / half complete email, We are using a perl module to record and save clients MAC address to DB. In situations that cisco-av-pair is not included in RADIUS packet, We are replacing it with 0000.0000.0000. Everything is working just fine in test environment but when running on production servers the recorded MAC address for those clients without cisco-av-pair attribute in their packet is not 0000.0000.0000 but it's a wrong MAC which belongs to another packet received seconds ago. We even captured all the RADIUS traffic sent form NASes and replayed it in our test environment but everything was working fine again. The only difference is our test environment is 32bit and production is 64bit. We suspect even something wrong with 32/64 bit or a threading issue with perl module on 64 bit platform. Anyone seen something like this before or anything special regarding 64bit / perl multi-threading? Current version: radiusd: FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Mar 31 2010 at 00:14:28 We also have perl compiled with multi-threading support : v5.8.8 built for x86_64-linux-thread-multi best regards,

1 0

Re: Freeradius-Users Digest, Vol 65, Issue 8
by t.drollinger＠i-motion.de 03 Sep '10

03 Sep '10

Ich bin von Freitag den 03.09.2010 bis Freitag den 24.09.2010 nicht im Haus und kann Ihre Nachricht erst am Montag den 27.09.2010 bearbeiten. In dringenden Fällen wenden Sie sich bitte an meinen Kollegen Herrn Böhm (E-Mail: r.boehm(a)i-motion.de) Mit freundlichen Grüßen Tobias Drollinger

1 0

Error compiling over Solaris
by Fernando Calvelo Vazquez 02 Sep '10

02 Sep '10

Hi folk: I'm trying to compile 'freeradius-2.1.9' over Solaris 10 platform. No errors during './configure' execution But I get this messages when I execute 'gmake' command gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -L/usr/lib/ -L/usr/local/libexec/openldap/ -L/usr/local/lib/ -L/opt/csw/lib/ -L/opt/csw/lib/engines/sparcv9/ -L/lib/ /usr/local/source/freeradius-server-2.1.9/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt /opt/csw/lib/libltdl.so -lncurses -lsunmath -lm /opt/csw/lib/libintl.so -L/opt/csw/lib -lc -ldl -L/usr/openwin/lib /opt/csw/lib/libiconv.so -R/usr/local/freeradius-2.1.7/lib -R/opt/csw/lib -R/usr/lib/ -R/usr/local/libexec/openldap/ -R/usr/local/lib/ -R/opt/csw/lib/ -R/opt/csw/lib/engines/sparcv9/ -R/lib/ Undefined first referenced symbol in file ERR_clear_error .libs/threads.o OPENSSL_add_all_algorithms_noconf .libs/threads.o CRYPTO_set_locking_callback .libs/threads.o CRYPTO_num_locks .libs/threads.o CRYPTO_set_id_callback .libs/threads.o ERR_remove_state .libs/threads.o lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src/main' gmake[3]: *** [main] Error 2 gmake[3]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/local/source/freeradius-server-2.1.9/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/usr/local/source/freeradius-server-2.1.9' gmake: *** [all] Error 2 Any clues with library could be causing the crash? Cheers, Swatzy.

2 2