- Freeradius-Users - lists.freeradius.org

Freeradius 2.1.7 mschap2 depreciated condition
by Iain Grant 11 May '10

11 May '10

I am trying to build a radius server on a Licencesed RedHat ES 5.5 with the stock Freeradius 2.1.7 rpms. The problem is %{Stripped-User-Name} does not seem to be working properly. If I run radius -X I can see the following [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for OURUSER(a)scri.ac.uk with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: %{User-Name:-None} -> OURUSER(a)scri.ac.uk [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=OURUSER(a)scri.ac.uk [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] expand: --domain=%{%{mschap:NT-Domain}:-OURDOMAIN} -> --domain=OURDOMAIN [mschap] mschap2: 04 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=13b2ecc29de42369 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=f55853d43f231f154755ce89ca3136f13929f36d728dbfd9 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Note : I've changed the username and domain name in the above. Is this fixable with a configuration file ? I have already got a working Centos 5.5 server using freereadius 2.1.8, but I want to move it to RedHat too match all the other infrastructure servers. Also I'm writing a build document for the system so that someone else has a document to follow in the future. Thanks iain Iain Grant Linux System Administrator Scottish Crop Research Institute Invergowrie Dundee DD2 5DA Tel : 01382 562731 x 2605 ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

2 2

Freeradius 2.1.7 mschap2 depreciated condition
by Iain Grant 11 May '10

11 May '10

Solved it, I had not added my realms to the bottom of proxy.conf. Once changed everything is working. Thanks iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

1 0

RE: Freeradius-Users Digest, Vol 61, Issue 37
by Iain Grant 11 May '10

11 May '10

>> The problem is %{Stripped-User-Name} does not seem to be working properly. >here was a chhange to conditional expansions some time back....the output you see is just a warning....if you 'man >unlang' you can see how such a condition should be written.....the default config that ships with 2.1.8 should have >this fixed....but just check your modules/* files for where this is used... mschapv2 or ntlm_auth from memory This is strange as I have compared the modules/mschap files on both systems ( radius 2.1.8 on centos and radius 2.1.7 on RH ES 5.5 ) and they are identical !!! In fact I even cut and pasted the ntlm line from the working radius to the redhat radius server. Has someone else built a RedHat radius 2.1.7 server to point to an Windows ADS ?? Thanks Iain ______________________________________________________ SCRI, Invergowrie, Dundee, DD2 5DA. The Scottish Crop Research Institute is a charitable company limited by guarantee. Registered in Scotland No: SC 29367. Recognised by the Inland Revenue as a Scottish Charity No: SC 006662. DISCLAIMER: This email is from the Scottish Crop Research Institute, but the views expressed by the sender are not necessarily the views of SCRI and its subsidiaries. This email and any files transmitted with it are confidential to the intended recipient at the e-mail address to which it has been addressed. It may not be disclosed or used by any other than that addressee. If you are not the intended recipient you are requested to preserve this confidentiality and you must not use, disclose, copy, print or rely on this e-mail in any way. Please notify postmaster(a)scri.ac.uk quoting the name of the sender and delete the email from your system. Although SCRI has taken reasonable precautions to ensure no viruses are present in this email, neither the Institute nor the sender accepts any responsibility for any viruses, and it is your responsibility to scan the email and the attachments (if any). ______________________________________________________

2 1

radiusd: segmentation fault
by Коньков Евгений 11 May '10

11 May '10

Help pls to resolve problem why radiusd segfault or give clue kes# radiusd -v radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.1, built on Jan 6 2009 at 10:52:08 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. kes# uname -a FreeBSD kes.net.ua 7.1-RELEASE FreeBSD 7.1-RELEASE #0: Sat Jan 3 01:15:39 EET 2009 kes@in.lan:/usr/obj/usr/src/sys/KES_KERN_v7 i386 I did not find any radiusd.core files in the system =( if any other infomation may usefull I can send Thank you

3 2

RE: framedipaddress
by Paweł Pogorzelski 11 May '10

11 May '10

Meru Networks Support replied me that "...Framed-IP-Address is not one of the attributes that we support." Is there anything that I can do? -- Best regards Paweł Pogorzelski e-mail: ppogorzelski(a)gmail.com

3 2

Re: The client does not connect _*_*_*_
by hafthanhf 11 May '10

11 May '10

Alan DeKok-2 wrote: > > Martin Silvero wrote: >> Thu Sep 25 12:49:16 2008 : Debug: Ignoring request to authentication >> address * port 1812 from unknown client 10.0.42.250 > > Well... did you add that IP as a client in raddb/clients.conf? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > hi Alan, I have the same problem with Martin, plz help me.. I added something in the raddb/clients.conf file as follow: client ipipgw { ipaddr = 192.168.6.201 secret = testing123 shortname = c3725 nastype = cisco login = user password = userpass } -- View this message in context: http://old.nabble.com/The-client-does-not-connect-_*_*_*_-tp19672841p284688… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 9

Freeradius 2.1.6: Store Cisco device "enable" password in Postgresql DB
by Difan Zhao 11 May '10

11 May '10

Hey guys, This should be a quick one. When I "enable" on a Cisco device, it sends a request with username "$enab15$". rad_recv: Access-Request packet from host 172.17.254.100 port 1645, id=92, length=84 NAS-IP-Address = 172.17.254.100 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "$enab15$" Calling-Station-Id = "172.17.1.1" User-Password = "password" Service-Type = Administrative-User I used to store the username and password in the "users" file and it was working fine: $enab15$ Cleartext-Password := "password" Now I am trying to move this user from the file to the postgresql DB and my "radcheck" table looks like: radius=# select * from radcheck; id | username | attribute | op | value ----+----------+--------------------+----+----------- 1 | $enab15$ | Cleartext-Password | := | password And it doesn't work. Then I am checking the debug and I found that the "$" in the username was interpreted to something like "=24": [sql] expand: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = '=24enab15=24' ORDER BY id Then I changed the username to this "=24enab15=24" and now it works. I am just curious how freeradius or %{SQL-User-Name} treats special characters in "username"... Is there a way to treat them AS-IS? Thank you! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. www.guest-tek.com Email: difan.zhao(a)guest-tek.com Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514

3 5

radius not recieving username from cisco
by Athiqur Rahman 11 May '10

11 May '10

Hi, I have an as5300 IOS Version 12.2 and FreeRADIUS Version 2.1.8 When I open ppp connection to from windows xp laptop to my as5300 it is not sending the login credentials to the FreeRadius. FeeRadius says the username attribute was not found below is the snippet of debug output rad_recv: Accounting-Request packet from host 192.168.0.57 port 1646, id=211, length=97 NAS-IP-Address = 192.168.0.57 NAS-Port = 182 NAS-Port-Type = Async Called-Station-Id = "02081131234" Calling-Station-Id = "2075176623" Acct-Status-Type = Start Service-Type = Framed-User Acct-Session-Id = "0000006E" Framed-Protocol = PPP Acct-Delay-Time = 0 +- entering group preacct {...} ++[preprocess] returns ok *[acct_unique] WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistent * [acct_unique] Hashing 'NAS-Port = 182,Client-IP-Address = 217.73.64.57,NAS-IP-Address = 217.73.64.57,Acct-Session-Id = "0000006E",' [acct_unique] Acct-Unique-Session-ID = "93340c227b9a5bca". ++[acct_unique] returns ok [suffix] Proxy reply, or no User-Name. Ignoring. ++[suffix] returns ok ++[files] returns noop below is my aaa configuration. I just want to contact the radius for ppp connections aaa new-model aaa authentication login default local aaa authentication ppp default group radius aaa authorization network default none aaa accounting send stop-record authentication failure aaa accounting network default start-stop group radius

2 1

want client but not localhost
by dorra aa 11 May '10

11 May '10

Hello. I installed the radius on a computer and finally the test is successful locally. Now I want to do the test on another computer client.Should i install the Radius on this computer I'm writing ?or just in the terminal powered the second command: radtest .... But this does not work.because even if I install I get two Radius servers. I still do not understand this idea. Thank you for the enlightenment _________________________________________________________________ Hotmail: Trusted email with Microsoft’s powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

1 0

2.1.8 doesn't include the certs/ directory for the debian package build
by liran tal 10 May '10

10 May '10

Hey Alan, Just a heads up for the next release. The 2.1.8 version doesn't include the certs/ directory files when building the debian package. Would be cool if you could push this change in the repo for the time being. Regards, Liran.

2 1