- Freeradius-Users - lists.freeradius.org

Re: Reply-Message
by Neville 17 Jan '10

17 Jan '10

> Message: 1 > Date: Sat, 16 Jan 2010 20:55:45 -0000 > From: "Neville" <nev(a)itsnev.co.uk> > Subject: Reply-Message > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <1C54F0ABDAFE4EF7B9F3F9D4EC3EFBAC@NevPC> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > Is there any way to get the reply message loaded into a SQL TABLE, which a > user can then query on to see the last reply based on there username? > > Thx > Nev >

1 0

Re: Reply-Message
by Neville 17 Jan '10

17 Jan '10

> Message: 1 > Date: Sat, 16 Jan 2010 20:55:45 -0000 > From: "Neville" <nev(a)itsnev.co.uk> > Subject: Reply-Message > To: <freeradius-users(a)lists.freeradius.org> > Message-ID: <1C54F0ABDAFE4EF7B9F3F9D4EC3EFBAC@NevPC> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > Is there any way to get the reply message loaded into a SQL TABLE, which a > user can then query on to see the last reply based on there username? > > Thx > Nev >

1 0

Reply-Message
by Neville 16 Jan '10

16 Jan '10

Hi, Is there any way to get the reply message loaded into a SQL TABLE, which a user can then query on to see the last reply based on there username? Thx Nev

2 1

How to get accounting data from freeRadius server using freeradius client
by Rahul Panwar 16 Jan '10

16 Jan '10

Hi, Is it possible to get the accounting data from the radius server using radius client in NAS and how? I am using freeradius server 2.X for collecting all the billing data (in radacct log files) of VOIP calls. Then generate bills using our software. But sometime the accounting data required in NAS (VOIP server) also, how can i get this data on NAS from radius server? Thanks, Rahul Panwar

3 6

PAP/SSHA plus MS-CHAP on 2.17
by Eric Swanson 16 Jan '10

16 Jan '10

Y'all: Maybe this question obvious for somebody, but I haven't been able to find an answer so far. I'd appreciate any help on this. I'm setting up freeradius 2.17 with OpenLDAP on CentOS 5.3 (using the pre-built RPM repository from http://people.redhat.com/jdennis/freeradius-rhel-centos) The system need to authenticate at least two different ways by RADIUS (plus several others by LDAP, but that's all working fine). Currently one is working and the other is not. I've worked with freeradius/LDAP setups before, but it's been a couple years since I last did it from scratch. One client needs to talk MS-CHAP, and that's working great. If it matters I'm happy to post logs of these sessions happening, but I presume that's irrelevant. The other client needs to talk PAP, and it's not working right at all. In keeping with the frequent advice of this group, I've kept the config files as pristine as I can. Here are all the changes I've made since I last reverted to the default files: [/etc/raddb]# diff ./sites-available/default.DIST ./sites-available/default 170c170 < # ldap --- > ldap [/etc/raddb]# diff ./modules/ldap.DIST ./modules/ldap 33c33 < server = "ldap.your.domain" --- > server = ".org" 36c36 < basedn = "o=My Org,c=UA" --- > basedn = "dc=my,dc=office,dc=org" 116c116 < # password_attribute = userPassword --- > password_attribute = userPassword [/etc/raddb]# diff ./modules/pap.DIST ./modules/pap 17c17 < auto_header = no --- > auto_header = yes [/etc/raddb]# diff ./clients.conf.DIST ./clients.conf 101c101 < secret = testing123 --- > secret = SharedSecret 234a235,240 > > client 172.16.0.0/24 { > secret = SharedSecret > shortname = office-network > } > [/etc/raddb]# In fiddling over the past few days I've achieved several different failure modes, but here's what a session looks like now: rad_recv: Access-Request packet from host 172.16.0.1 port 1078, id=36, length=82 User-Name = "testuser" User-Password = "user" Service-Type = Authenticate-Only NAS-Identifier = "VPNSRV" Message-Authenticator = 0x8e--censored--db +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated ++[files] returns noop [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> testuser [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [ldap] expand: dc=my,dc=office,dc=org -> dc=my,dc=office,dc=org rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to muggins.my.office.org:389, authentication 0 rlm_ldap: bind as / to muggins.my.office.org:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=my,dc=office,dc=org, with filter (uid=testuser) [ldap] Added User-Password = {SSHA}i9--censored--JI in check items [ldap] looking for check items in directory... rlm_ldap: sambaNtPassword -> NT-Password == 0x4338--censored--4531 rlm_ldap: sambaLmPassword -> LM-Password == 0x4637--censored--4545 [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "user" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 36 to 172.16.0.1 port 1078 Waking up in 4.9 seconds. The part that seems strange to me is that the system clearly identifies the type of passwords we are using ("Normalizing SSHA1-Password from base64 encoding" seems proof enough of that), but a couple lines later PAP has decided to use CRYPT encryption for some reason. I can't imagine what I've done to make the system believe it should use CRYPT instead of SSHA. I've been developing a range of crazy theories as to what might be going on, but I think it's time for me to see what y'all have to say. Thanks in advance for any guidance. E.

4 10

Re: Problem running radiusd -X
by blaqb0x 16 Jan '10

16 Jan '10

Try disabling tls support in the eap.conf file. -BB karozans wrote: > > Hi I am a novice user of linux. I need to install and use freeradius. I > have openSuse 11.1 and am logged in as root. > > I have installed freeradius using yast and the installation seemed to go > fine. When I run radiusd -X I get the following problem. > > unable to write 'random state' > dh: Permission denied > make: *** [dh] Error 1 > Exec-Program output: openssl dhparam -out dh 1024 > Exec-Program-Wait: plaintext: openssl dhparam -out dh 1024 > Exec-Program: returned: 2 > rlm_eap: Failed to initialize type tls > /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" > /etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". > /etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate > section. > > Not sure what to do from here. > > thanks > -- View this message in context: http://old.nabble.com/Problem-running-radiusd--X-tp27181112p27185636.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re:A special user to matcheon all usernames
by zhongwei feng 16 Jan '10

16 Jan '10

hi, pang jiacai: try this : in authorize section : redundant { sql files } in users file : DEFAULT Auth-Type := Accept Session-Timeout := 300 　　 > >Hi,all: > I want to kown how to configure a special user to match all usernames .I just want to authorize sussessfully even though the username don't exist.this is for emergency while my database is destoryed,I will let all user pass through without authorizing.please give me the detail steps. thanks. > >

1 0

A special user to matcheon all usernames
by pang_jiacai 16 Jan '10

16 Jan '10

Hi,all: I want to kown how to configure a special user to match all usernames .I just want to authorize sussessfully even though the username don't exist.this is for emergency while my database is destoryed,I will let all user pass through without authorizing.please give me the detail steps. thanks.

2 1

Problems with XPsp3 and FreeRADIUS
by Seth 15 Jan '10

15 Jan '10

I have a strange problem where the initial 802.1X authentication is successful, but then fails subsequent auth attempts. This is using Windows XP sp3 PEAP/MS-Chapv2, FreeRADIUS 2.1.3, with Active Directory running on a Windows2003 server. I noticed the following discrepency in the RADIUS logs. The two auth attempts are identical until this part: Successful Info: Found Auth-type = EAP Info: +- entering group authenticate (...) Info: [eap] Request found,released from list Info: [eap] EAP/peap* *Info: [eap] processing type peap Info: [peap] processing EAP-TLS Info: [peap] eaptls_verify returned 7 Info: [peap] Done initial handshake Info: [peap] eaptls_process returned 7 Info: [peap] EAPTLS_OK Info: [peap] Session established. Decoding tunneled attributes. Info: [peap] Received EAP-TLV response. Info: [peap] Success Info: [peap] Using saved attributes from the original Access-Accept Unsuccessful Info: Found Auth-type = EAP Info: +- entering group authenticate (...) Info: [eap] Request found,released from list Info: [eap] EAP/mschapv2* *Info: [eap] processing type mschapv2 Info: [mschapv2] +-entering group MS-CHAP (...) Info: [mschap] No Cleartext-Password configured. Cannot create LM-Password. Info: [mschap] No Cleartext-Password configured. Cannot create NT-Password. Info: [mschap] Told to do MS-CHAPv2 for seth with NT-Password ... Info: Debug: Exec-Program output: Logon failure (0xxc000006d) Info: Debug: Exec-Program-Wait: plaintext: Logon failure (0xxc000006d) Info: Debug: Exec-Program: returned 1 Info: [mschap] External script failed. Info: [mschap] FAILED: MS-CHAP2-Response is incorrect Info: ++[mschap] returns reject Info: [eap] Freeing handler Info: ++[eap] returns reject Info: Failed to authenticate the user. Why is one auth request using the mschapv2 group and the other PEAP? Both are from the same client on the same switchport. Has anyone else run into this type of problem? Is there a configuration on the supplicant or Active Directory that could cause this? More information if necessary: from modules.conf eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/cert_privkey.key certificate_file = ${raddbdir}/cert_certificate. pem CA_file = ${raddbdir}/cert_ca_cert.pem dh_file = /etc/raddb/certs/dh random_file = /etc/raddb/certs/random fragment_size = 1024 include_length = yes check_crl = no check_cert_cn = %{Stripped-User-Name:-%{User-Name}} peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes } mschapv2 { } } Thanks, /Seth

4 5

Problems with configuration Cisco -> freeradius
by michi-bazi 15 Jan '10

15 Jan '10

Hello everybody, my first post here, hope you are able to help me. Honestly said I am a little bit confused. Here is my problem: I tried to setup the freeradius for cisco authentication. Sadly it didn't work. My reference how to configure was this: http://evilrouters.net/2008/11/19/configuring-freeradius-to-support-cisco-a… To my bad it didn't work. Here is what I have typed into the config files: users: cisco Auth-Type: = System Service-Type = NAS-Prompt-User, # cisco-avpair =”shell:priv-lvl=15” radiusd.conf: user = root group = root clients.conf: client 192.168.101.0/26 { secret =Test_1 shortname = site_a nastype = cisco } The switch is configured: aaa new-model ! ! aaa authentication login default group radius local aaa authentication login localauth local aaa authentication ppp default if-needed group radius local aaa authorization exec default group radius local aaa authorization network default group radius local aaa accounting delay-start vrf default aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius aaa accounting system default start-stop group radius ! ip radius source-interface Vlan1 vrf default radius-server host 192.168.128.246 auth-port 1812 acct-port 1813 key Test_1 ! control-plane Ping is running through. When I type show ip aaa to the switch I get this: sh aaa servers RADIUS: id 2, priority 1, host 192.168.128.246, auth-port 1812, acct-port 1813 State: current UP, duration 49s, previous duration 0s Dead: total time 0s, count 13 Quarantined: No Authen: request 76, timeouts 76 Response: unexpected 0, server error 0, incorrect 0, time 0ms Transaction: success 0, failure 19 Author: request 0, timeouts 0 Response: unexpected 0, server error 0, incorrect 0, time 0ms Transaction: success 0, failure 0 Account: request 60, timeouts 60 Response: unexpected 0, server error 0, incorrect 0, time 0ms Transaction: success 0, failure 15 Elapsed time since counters last cleared: 6d23h35m site_mgt_manchester# Would be great if you could help me, don't know what's wrong. Best regards Michael -- View this message in context: http://old.nabble.com/Problems-with-configuration-Cisco--%3E-freeradius-tp2… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3