- Freeradius-Users - lists.freeradius.org

MySQL works for radtest, not IRL - Users file always works
by Huckle Berry 16 Aug '10

16 Aug '10

I'm in a bit of an odd situation here, I have a freeradius 2.1.8 server (installed from the ubuntu 10.04 repo) that I'm using in conjunction with a DD-WRT v24-SP2 (on wrt54g v5) NAS. I've generated certs for two users RadiusUser and RadiusSQL and installed both on a windows 7 ultimate box along with the CA. RadiusUser is in the Users file with a bare-bones configuration: RadiusUser Cleartext-Password: "RadiusUser" RadiusSQL is in a MySQL database with a similiar configuration: SELECT * FROM radcheck; +----+-----------+--------------------+----+-----------+ | id | username | attribute | op | value | +----+-----------+--------------------+----+-----------+ | 1 | RadiusSQL | Cleartext-Password | := | RadiusSQL | +----+-----------+--------------------+----+-----------+ radtest for both users works on server, but from the windows 7 client only RadiusUser can log in. After looking at RadiusSQL's debug, it seems the sql module isn't ever consulted... Debugs for both users can be posted on request.

2 3

Can't Install Freeradius 2.1.9
by Zhang Shukun 16 Aug '10

16 Aug '10

hi , all i want to install Freeradius. but error occur as follow, Could you tell me what's wrong? ------------------------------------------------------------------------------------------------------------------------------------------------------------------ ..... rm -f .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT creating .libs/radiusdS.c (cd .libs && gcc -g -O2 -c -fno-builtin "radiusdS.c") rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /home/zsk/freeradius-server-2.1.9/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lpthread -lcrypt /usr/lib/libltdl.so -lssl -lcrypto -ldl .libs/modules.o: In function `setup_modules': /home/zsk/freeradius-server-2.1.9/src/main/modules.c:1358: undefined reference to `lt__PROGRAM__LTX_preloaded_symbols' collect2: ld returned 1 exit status make[4]: *** [radiusd] 错误 1 make[4]:正在离开目录 `/home/zsk/freeradius-server-2.1.9/src/main' make[3]: *** [main] 错误 2 make[3]:正在离开目录 `/home/zsk/freeradius-server-2.1.9/src' make[2]: *** [all] 错误 2 make[2]:正在离开目录 `/home/zsk/freeradius-server-2.1.9/src' make[1]: *** [src] 错误 2 make[1]:正在离开目录 `/home/zsk/freeradius-server-2.1.9' make: *** [all] 错误 2 ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- -- Thanks & Regards Sucan

1 0

Fwd: FreeRadius2&MySQL
by Student University 15 Aug '10

15 Aug '10

Dears , I am planing to migrate from Aradial to FreeRadius2 and i currently have 10000 subscribers so can please guide me of how i can setup the freeradius 2 with MYSQL to be 100% ready for such production ,,,, Thanks in advanced ,,,

6 9

SqlCounter reload after initial authentication
by tadiguy＠verizon.net 14 Aug '10

14 Aug '10

I'm using Freeradius + Chillispot+MySql for hotspot. Sqlcounter noresetcounter works fine for prepaid access time, however the counter is loaded only once when the user first authenticate. This means that even if Max-All-Session changes after initial logon (as it happens when the user adds more credit) the user is session is still terminated at the end of the initial count down. How can I force Freeradius sqlcounter to re-load and begin counting down when Max-All-Session is updated after initial authentication? If this is not possible any workaround or hacks to accomplish this behaviour will be greatly appreciated. Thanks.

3 2

pam_auth_radius - Map radius user to local account?
by Cory Johnson 14 Aug '10

14 Aug '10

Greetings, I have several Linux and BSD servers that I would like to authenticate against my FreeRADIUS server. My question is, do I have to create unix users on each server that match the names of the radius user that I am logging as? For example, could users logging in via radius be automatically "mapped" to a single unix account, no matter what RADIUS credentials they used? Or maybe give users a different unix account depending on the LDAP group they are in? If anyone can point me in the right direction that'd be great. Or if I, in fact, do not want to do this, please let me know. =) --CJ

1 0

FreeRadius and Redundant LDAP Problems
by Kory Wheatley 13 Aug '10

13 Aug '10

am trying to setup what I thought should be a fairly simple Freeradius configuration but I am having problems. Simply put I would like FreeRadius to authenticate against our LDAP servers and look into a couple groups to see if the user is authorized. I would also like to have redundant ldap servers so that if one went down for maintenance or other reasons users could still authenticate. I can get Freeradius to work with one LDAP server, but when I try to implement the redundant I have not had any success. According to the debug log, it is find the group the user belongs to correctly, but instead of setting the Auth-Type to LDAP it is setting it to PAP and rejecting. When I configure the system for one LDAP server to Auth-Type is LDAP and everything works. It is probably something simple that I am missing, and would appreciate any suggestions. I have included the debug log below and the configuration files, I have removed all the comments out of the configuration files to be under the 100k size restriction for the list. Thanks Output from request in debugging mode: rad_recv: Access-Request packet from host 127.0.0.1 port 47611, id=245, length=60 User-Name = "testuser" User-Password = "testpassword" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [ldap-server1] Entering ldap_groupcmp() [files] expand: ou=people,o=test,o=isp -> ou=people,o=test,o=isp [files] expand: %{Stripped-User-Name} -> [files] ... expanding second conditional [files] expand: %{User-Name} -> testuser [files] expand: (uid=%{%{Stripped-User-Name}:- %{User-Name}}) -> (uid=testuser) [ldap-server1] ldap_get_conn: Checking Id: 0 [ldap-server1] ldap_get_conn: Got Id: 0 [ldap-server1] attempting LDAP reconnection [ldap-server1] (re)connect to ldapserver.somedomain.com:389, authentication 0 [ldap-server1] bind as uid=testuser, ou=people, o=test, o=isp/testpassword to ldapserver.somedomain.com:389 [ldap-server1] waiting for bind result ... [ldap-server1] Bind was successful [ldap-server1] performing search in ou=people,o=test,o=isp, with filter (uid=testuser) [ldap-server1] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquem ember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=uid\3dtestuser\2cou\3dpeople\2co\3dtest\2co\3disp))(&(o bjectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestuser\2cou\3dpeople\2co\3dtest\2co\3disp))) [ldap-server1] ldap_get_conn: Checking Id: 0 [ldap-server1] ldap_get_conn: Got Id: 0 [ldap-server1] performing search in cn=DialupFS,ou=Groups,o=test,o=isp, with filter (|(&(objectClass=GroupOfNames)(member=uid\ 3dtestuser\2cou\3dpeople\2co\3dtest\2co\3disp))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestuser\2cou\3dpeople\2co\ 3dtest\2co\3disp))) rlm_ldap::ldap_groupcmp: User found in group cn=DialupFS,ou=Groups,o=test,o=isp [ldap-server1] ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 166 ++[files] returns ok ++- entering policy redundant {...} [ldap-server1] performing user authorization for testuser [ldap-server1] expand: %{Stripped-User-Name} -> [ldap-server1] ... expanding second conditional [ldap-server1] expand: %{User-Name} -> testuser [ldap-server1] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [ldap-server1] expand: ou=people,o=test,o=isp -> ou=people,o=test,o=isp [ldap-server1] ldap_get_conn: Checking Id: 0 [ldap-server1] ldap_get_conn: Got Id: 0 [ldap-server1] performing search in ou=people,o=test,o=isp, with filter (uid=testuser) [ldap-server1] looking for check items in directory... [ldap-server1] sambaNtPassword -> NT-Password == 0x4234354137334235383034463441323531343346353339333433413430363642 [ldap-server1] sambaLmPassword -> LM-Password == 0x3036323444434332394538433236434346463137333635464146314646453839 [ldap-server1] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap-server1] user testuser authorized to use remote access [ldap-server1] ldap_release_conn: Release Id: 0 +++[ldap-server1] returns ok ++- policy redundant returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testpassword" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 245 to 127.0.0.1 port 47611 Reply-Message = "FS User Authorized" Waking up in 4.9 seconds. Cleaning up request 0 ID 245 with timestamp +48 Ready to process requests. Default File: authorize { preprocess chap mschap User File: DEFAULT ldap-server1-Ldap-Group == "cn=DialupFS,ou=Groups,o=test,o=isp" Reply-Message = "FS User Authorized" DEFAULT ldap-server1-Ldap-Group == "cn=DialupST,ou=Groups,o=test,o=isp" Reply-Message = "ST User Authorized" DEFAULT ldap-server2-Ldap-Group == "cn=DialupFS,ou=Groups,o=test,o=isp" Reply-Message = "FS User Authorized" DEFAULT ldap-server2-Ldap-Group == "cn=DialupST,ou=Groups,o=test,o=isp" Reply-Message = "ST User Authorized" DEFAULT Auth-Type := Reject Reply-Message = "User Not Authorized" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP ldap module file: ldap ldap-server1 { server = "ldapserver.somedomain.com" identity = "uid=raduser, ou=people, o=test, o=isp" password = testpassword basedn = "ou=people,o=test,o=isp" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueName s)( uniquemember=%{control:Ldap-UserDn})))" } ldap ldap-server2 { server = "ldapserver2.somedomain.com" identity = "uid=raduser, ou=people, o=test, o=isp" password = testpassword basedn = "ou=people,o=test,o=isp" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueName s)( uniquemember=%{control:Ldap-UserDn})))" } The radiusd.conf file: prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = ${exec_prefix}/lib pidfile = ${run_dir}/${name}.pid max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 } listen { ipaddr = * port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr ldap-server1 ldap-server2 expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ suffix eap { ok = return } unix files redundant { ldap-server1 ldap-server2 } expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { redundant { ldap-server1 ldap-server2 } } eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap }

4 11

Stripping a realm in EAP
by David Peterson 13 Aug '10

13 Aug '10

We have a working radius server and are trying to authenticate using EAP-TTLS with a stripped username. The username sent is 8888(a)WiMAX.com, the realm is defined without the nostrip option. However once it's inside the inner-tunnel, the username and domain are authenticated against the sql server instead of the stripped username. We are using a local proxy for the realm. David

1 0

simultaneous logins
by tyllerd 13 Aug '10

13 Aug '10

Hi, I have searched on the mailing list and I see that it is suggested to limit simultaneous users by doing user,simultaneous-use,:=,1 I just need to know does this limit user to one login on freeradius or on that nas? as I add this value into the radcheck table. and I try login twice from the same NAS, but the second login fails. Then I try login from one NAS and then again from another NAS and it works. So does simultaneous-use only tell the NAS to let user X login once or is supposed to be server side? Do I need to right a script to do it server side? Thank you -- View this message in context: http://old.nabble.com/simultaneous-logins-tp29426841p29426841.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Freeradius2 + LDAP of Lotus Notes
by rrperez 13 Aug '10

13 Aug '10

I have configured my Freeradius2 server to authenticate in an LDAP server that is used by Lotus Notes. I'm having a problem even though it bind successfully because there is no password attribute in the LDAP server of Lotus Notes. Does it mean that Lotus Notes doesn't store the password of its users in the LDAP server? -- View this message in context: http://old.nabble.com/Freeradius2-%2B-LDAP-of-Lotus-Notes-tp29426192p294261… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Password Policy - Expired Password - mschap
by Theparanoidone Theparanoidone 13 Aug '10

13 Aug '10

Greetings~ We are using FreeRadius 2.1.3 (on snow leopard server). All users are authenticating with vlan assignments correctly; however, if you enable the ldap/(opendirectory) option to "require user to change password on next login" the client is unable to connect. The client login screen will not proceed to prompt the user for a new password; it's simply rejected. If you remove the password policy forcing a password reset, then the user can authenticate. In other words, it appears radius (mschap / ntlm_auth) is specifically rejecting the user if the user has a password reset flag set. Here is a snippet from the radius server debug log: Failed auth: ======= Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] No NT-Password configured. Trying OpenDirectory Authentication. [mschap] OD username_string = adouglas, OD shortUserName=adouglas (length = 8) rlm_mschap: authentication failed -14161 ++[mschap] returns reject Failed to authenticate the user. } # server inner-tunnel [ttls] Got tunneled reply code 3 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "142" [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> adouglas attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 15 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 15 Sending Access-Reject of id 245 to 10.0.200.3 port 53907 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 ======= Success auth: ======= Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] No NT-Password configured. Trying OpenDirectory Authentication. [mschap] OD username_string = adouglas, OD shortUserName=adouglas (length = 8) [mschap] dsDoDirNodeAuth returns stepbuff: S=67322D06B7A0A7BB9EBC681EAAEE6FB197CDDCB2 (len=40) ++[mschap] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "142" MS-CHAP2-Success = 0xa9533d36373332324430364237413041374242394542433638314541414545364642313937434444434232 [ttls] Got tunneled Access-Accept ======= One last thing to note, if we specifically allow all users to authenticate (as described in the FAQ with DEFAULT AuthType := Accept), the client login screen will proceed to prompt the user to update a new password. Is there a way to handle password policies (either by ignoring it during mschap, or adding a pre/post filter of some sort)? Any help would greatly be appreciated, thanks in advance, --jsmith

3 9