- Freeradius-Users - lists.freeradius.org

chilli + freeradius + mysql : Password check failed
by David BiTx0 30 Nov '09

30 Nov '09

Hi all, I have a problem, where I work, I installed a system wifi hotspot (chillispot+freeradius+mysql), all in one machine (debian lenny) for external workers. The problem is that freeradius does not understand the password it receives from chillispot L Fri Nov 27 16:13:30 2009 : Info: [chap] Using clear text password "P1s0S" for user 9799-8798-3665-6561 authentication. Fri Nov 27 16:13:30 2009 : Info: [chap] Password check failed P1s0S is the good passwd !!! This well written in the MySQL . I think that chillispot is using PAP instead of CHAP, I've looked at the code file hotspotlogin.php : --------------------------- hotspotlogin.php ----------------------------------------------------- $response = md5("\0" . $_GET['Password'] . $newchal); $newpwd = pack("a32", $_GET['Password']); $pappassword = implode ("", unpack("H32", ($newpwd ^ $newchal))); ---------------------------- FIN ------------------------------------------------------------------ I don’t now. Thanks J -------- radius –XXX -------------- Fri Nov 27 15:35:29 2009 : Debug: Waking up in 4.9 seconds. Fri Nov 27 15:35:34 2009 : Info: Cleaning up request 12 ID 0 with timestamp +5614 Fri Nov 27 15:35:34 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 192.168.65.99 port 54942, id=0, length=229 User-Name = "9799-8798-3665-6561" CHAP-Challenge = 0x6f2ac78657926dd875b49f0178ce89d7 CHAP-Password = 0x00a2d83146dc31d330e294298fafb575c2 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.4 Calling-Station-Id = "00-1C-BF-D3-88-70" Called-Station-Id = "00-0E-7F-FE-01-F9" NAS-Identifier = "nas01" Acct-Session-Id = "4b0fec8100000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x368ff43e6530b497663e3e8b09be3ea8 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Fri Nov 27 16:13:30 2009 : Info: +- entering group authorize {...} Fri Nov 27 16:13:30 2009 : Info: ++[preprocess] returns ok Fri Nov 27 16:13:30 2009 : Info: [chap] Setting 'Auth-Type := CHAP' Fri Nov 27 16:13:30 2009 : Info: ++[chap] returns ok Fri Nov 27 16:13:30 2009 : Info: ++[mschap] returns noop Fri Nov 27 16:13:30 2009 : Info: [suffix] No '@' in User-Name = "9799-8798-3665-6561", looking up realm NULL Fri Nov 27 16:13:30 2009 : Info: [suffix] No such realm "NULL" Fri Nov 27 16:13:30 2009 : Info: ++[suffix] returns noop Fri Nov 27 16:13:30 2009 : Info: [eap] No EAP-Message, not doing EAP Fri Nov 27 16:13:30 2009 : Info: ++[eap] returns noop Fri Nov 27 16:13:30 2009 : Info: ++[unix] returns notfound Fri Nov 27 16:13:30 2009 : Info: ++[files] returns noop Fri Nov 27 16:13:30 2009 : Info: [sql] expand: %{User-Name} -> 9799-8798-3665-6561 Fri Nov 27 16:13:30 2009 : Info: [sql] sql_set_user escaped user --> '9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 2 Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '9799-8798-3665-6561' ORDER BY id Fri Nov 27 16:13:30 2009 : Info: [sql] User found in radcheck table Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '9799-8798-3665-6561' ORDER BY id Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '9799-8798-3665-6561' ORDER BY priority Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '1hora' ORDER BY id Fri Nov 27 16:13:30 2009 : Info: [sql] User found in group 1hora Fri Nov 27 16:13:30 2009 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '1hora' ORDER BY id Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Released sql socket id: 2 Fri Nov 27 16:13:30 2009 : Info: ++[sql] returns ok Fri Nov 27 16:13:30 2009 : Info: ++[expiration] returns noop Fri Nov 27 16:13:30 2009 : Info: ++[logintime] returns noop Fri Nov 27 16:13:30 2009 : Info: [pap] Found existing Auth-Type, not changing it. Fri Nov 27 16:13:30 2009 : Info: ++[pap] returns noop Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Entering module authorize code Fri Nov 27 16:13:30 2009 : Debug: sqlcounter_expand: 'SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}'' Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{User-Name}' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Debug: sqlcounter_expand: '%{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'}' Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] sql_xlat Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: %{User-Name} -> 9799-8798-3665-6561 Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] sql_set_user escaped user --> '9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' -> SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561' Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 1 Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] row[0] returned NULL Fri Nov 27 16:13:30 2009 : Debug: rlm_sql (sql): Released sql socket id: 1 Fri Nov 27 16:13:30 2009 : Info: [noresetcounter] expand: %{sql:SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='9799-8798-3665-6561'} -> Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: No integer found in string "" Fri Nov 27 16:13:30 2009 : Info: ++[noresetcounter] returns noop Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Entering module authorize code Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Fri Nov 27 16:13:30 2009 : Info: ++[dailycounter] returns noop Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Entering module authorize code Fri Nov 27 16:13:30 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Fri Nov 27 16:13:30 2009 : Info: ++[monthlycounter] returns noop Fri Nov 27 16:13:30 2009 : Info: Found Auth-Type = CHAP Fri Nov 27 16:13:30 2009 : Info: +- entering group CHAP {...} Fri Nov 27 16:13:30 2009 : Info: [chap] login attempt by "9799-8798-3665-6561" with CHAP password Fri Nov 27 16:13:30 2009 : Info: [chap] Using clear text password "P1s0S" for user 9799-8798-3665-6561 authentication. Fri Nov 27 16:13:30 2009 : Info: [chap] Password check failed Fri Nov 27 16:13:30 2009 : Info: ++[chap] returns reject Fri Nov 27 16:13:30 2009 : Info: Failed to authenticate the user. Fri Nov 27 16:13:30 2009 : Info: Using Post-Auth-Type Reject Fri Nov 27 16:13:30 2009 : Info: +- entering group REJECT {...} Fri Nov 27 16:13:30 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 9799-8798-3665-6561 Fri Nov 27 16:13:30 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Fri Nov 27 16:13:30 2009 : Info: ++[attr_filter.access_reject] returns updated Fri Nov 27 16:13:30 2009 : Info: Delaying reject of request 13 for 1 seconds Fri Nov 27 16:13:30 2009 : Debug: Going to the next request Fri Nov 27 16:13:30 2009 : Debug: Waking up in 0.9 seconds. Fri Nov 27 16:13:31 2009 : Info: Sending delayed reject for request 13 Sending Access-Reject of id 0 to 192.168.65.99 port 54942 Fri Nov 27 16:13:31 2009 : Debug: Waking up in 4.9 seconds. Fri Nov 27 16:13:36 2009 : Info: Cleaning up request 13 ID 0 with timestamp +7896 Fri Nov 27 16:13:36 2009 : Debug: Ready to process requests. ------------------------------ FIN ------------------------------------------------------------------- _________________________________________________________________ Windows Live: Friends get your Flickr, Yelp, and Digg updates when they e-mail you. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

4 5

custom script for access
by d.tom.schmitt＠L-3com.com 30 Nov '09

30 Nov '09

I am new to using freeRADIUS. I tried to post a similar message on the 26th of October but got no responses - thought maybe I messed it up as my first posting. I can create a flat-file and have get successful access using radtest. I have a CentOS 5.2 system running freeRADIUS version 1.1.3. Soon to be upgraded to 5.3. I need to setup an account on the freeRADIUS server that can be accessed by another system as a radius server - not the problem. I then need to have freeRADIUS call a bash shell (or Perl) script that checks additional credentials before allowing or rejecting the user's access. This check can take a multiple seconds to complete so I don't want the original radius request to timeout (not sure if it will though). Think of it as taking the time to have someone lookup and enter a PIN+TOKEN string but after the fact. A very simple example would be: I need to have freeradius verify the passed login/password. (In this case, the password may not be needed to verify access as the script would do the actual validation. Not sure if this is even possible.) Then have freeradius call the script either on the same or another server. Depending upon the outcome determined by the script - either allow or deny the user access. So even if the login/password were correct, the account could be denied from another source. An easy script for testing could be as simple as: If the minute is EVEN = allow in and say an appropriate message If the minute is ODD = do not allow access and say an appropriate message I have read most of the .conf files but am still confused about proxy, etc. Is there a HOW-TO that shows a simple script example? Thanks, Tom Schmitt Senior IT Staff - R&D

2 5

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 30 Nov '09

30 Nov '09

At 06:24 PM 11/25/2009, Ivan Kalik wrote: >Configure AD as ldap server in ldap module (.raddb/modules/ldap). >Then add to users file: > >DEFAULT Ldap-Group == "max_priv_level" or whatever is your group called > Service-Type = NAS-Prompt-User, > cisco-avpair = "shell:priv-lvl=15" closer! First, if I use the account directly: testuser Cleartext-Password := "testpass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" I get auth. (so the cisco at least is right, and the base LDAP must be ok, because I get an LDAP success). But when I switch to : DEFAULT Ldap-Group == "Infrastructure" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" I get in the logs a failure to find the group: [ldap] performing user authorization for testuser [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> testuser [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=ciscorsteeves) [ldap] expand: OU=Enterprise,DC=int,DC=example,DC=com -> OU=Enterprise,DC=int,DC=example,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Enterprise,DC=int,DC=example,DC=com, with filter (uid=testuser) rlm_ldap: object not found ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ My suspicion is something wrong between base_filter and filter. Sigh.

2 3

Re: Re: Error= Expecting section start brace '{' after "FreeRADIUS Version"
by Yagnesh Dave 30 Nov '09

30 Nov '09

Hi, Thanks for the quick answer. I removed nohup.out and its not throwing that error. But now it is throwing this error. It would be great if you can point out the solution. ############################################### bash-3.00# tail nohup.out simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Could not link driver rlm_sql_mysql: ld.so.1: radiusd: fatal: rlm_sql_mysql.so: open failed: No such file or directory Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[161]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. Errors initializing modules bash-3.00# ############################################################ Thanks and Regards, Yagnesh Dave. On Mon, 30 Nov 2009 15:20:18 +0530 wrote >Hi, > Hi Everyone, > > I was trying to set-up mysql for logging the accounting logs for the users. I followed the instruction on http://www.frontios.com/freeradius.html and also on http://wiki.freeradius.org/SQL_HOWTO. The I tried to run the FreeRadius server. It did not start and was giving this error as given below, > ############################################################### > including configuration file /usr/local/etc/raddb/sites-enabled/default > including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel > including configuration file /usr/local/etc/raddb/sites-enabled/control-socket > including configuration file /usr/local/etc/raddb/sites-enabled/nohup.out > /usr/local/etc/raddb/sites-enabled/nohup.out[1]: Expecting section start brace '{' after "FreeRADIUS Version" > Errors reading /usr/local/etc/raddb/radiusd.conf > bash-3.00# > ################################################################ as Josip has said - you have a file called 'nohup.out' in your sites-enabled directory. this is a special directory that can only contain FreeRADIUS virtual server files (because it basically loads in sites-enabled/* as servers... this file is messing it up. remove it. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Making certs for Windows users
by Peter Carlstedt 30 Nov '09

30 Nov '09

Hello everyone. I got some questions regarding how to make a certificate that works towards windows clients while running Freeradius with PEAP. Well I have read on the wiki for Freeradius about making a standalone cert for windows clients (root cert) but why do i need that installed on the windows clients when i want to run peap? Isn´t peap meant to work in the way that you shouldnt have to install stand alone certs in the users computers? Anyway... I dont really understand what it is that i need to do to make real certificates, I´ve read the "readme" file in raddb/certs but dont understand what it says. I have got ca.cnf anf ca.pem etc since i started the radius server the first time where it said that it made some certs, which i guess it test certificates... the readme file only says that i should remove the old ones but when i try to get into the certs folder through the terminal it says i do not have permission to go into that folder.. Im using Ubuntu Desktop and I dont know a way to get into the folder with the root other than typing "sudo cd certs" which do not work. :/ Can I ignore the part which says that I need to remove the certs created when i run the server the first time and just do changes in the ca.cnf? As a sidenote, I´ve never worked with certificates before, I know what they are meant to do but more than that i dont know. Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live Hotmail: Your friends can get your Facebook updates, right from Hotmail®. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

Error= Expecting section start brace '{' after "FreeRADIUS Version"
by Yagnesh Dave 30 Nov '09

30 Nov '09

Hi Everyone, I was trying to set-up mysql for logging the accounting logs for the users. I followed the instruction on http://www.frontios.com/freeradius.html and also on http://wiki.freeradius.org/SQL_HOWTO. The I tried to run the FreeRadius server. It did not start and was giving this error as given below, ############################################################### including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/nohup.out /usr/local/etc/raddb/sites-enabled/nohup.out[1]: Expecting section start brace '{' after "FreeRADIUS Version" Errors reading /usr/local/etc/raddb/radiusd.conf bash-3.00# ################################################################ Please help me to overcome this. Thanks and Regards, Yagnesh Dave.

3 2

Remote access control in freeradius with mysql
by cktan 30 Nov '09

30 Nov '09

Dear all, I've a freeradius server running with LDAP as the Authentication and Authorization where else Accounting running on Mysql. It was working well at the moment and I'm looking to migrate from LDAP to run fully in Mysql. Question is I need to have control on remote access for certain users. In LDAP, I used to have "dialupAccess" attribute to control the access for user and I can't find it in Mysql. I come across to radreply table but not sure which attribute should I use to have authorization for user to access. Looking for your kind information in this matter. Regards -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 1

Re: Exec and ntlm_auth
by freeradius＠corwyn.net 30 Nov '09

30 Nov '09

At 05:57 PM 11/25/2009, Rick Steeves wrote: >I have the cisco configured per that guide already . However, I >don't want to put user / password info in the users file, because >that would defeat part of the model of centralized authentication to >AD. So I want that to feed authentication back to radius > AD as well. Perhaps my question is how to integrate Per User Privilege Level You can also send the privilege level (enable mode is level 15) for individual users as a reply item to automatically put them into that level with cisco-avpair = "shell:priv-lvl=15" You can do this with an entry in your users file similar to the following youruser Cleartext-Password := "somepass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" into the AD part, instead of into the users file? I had planned to just use AD security groups .... rick >Rick

3 8

:= Condition deprecated
by Casartello, Thomas 30 Nov '09

30 Nov '09

I've been getting the message about the := condition being deprecated soon. I was wondering if there's going to be another alternative way to accomplish the following: In my users file I have this: DEFAULT Airespace-Wlan-Id == 3, Auth-Type := ldap DEFAULT Essentially what this accomplishes is that if that attribute is 3, then they're trying to authenticate through one of our ssids which has web authentication. When it's web authentication it comes through as PAP, and I have this line to tell it to use LDAP authentication. The clients on the other SSID (Which would have the number 4) authenticate via 802.1x so those will come through as PEAP-MSCHAPv2. I just want to know an alternative way I can accomplish this once the ":=" conditional goes away. Thomas E. Casartello, Jr. Staff Assistant - Wireless/Linux Administrator Information Technology Wilson 105A Westfield State College (413) 572-8245 Red Hat Certified Technician (RHCT)

4 5

EAP advanced auth. methods problem
by Tomas Pelka 29 Nov '09

29 Nov '09

Hey guys, have a problem with "advanced" EAP authentication methods including PEAP, EAP-TLS, EAP-TTLS-MD5/MSCHAPV2. Certs was created with the makefile included in freeradius sources. All my experiments ending with: decapsulated EAP packet (code=4 id=4 len=4) from RADIUS server: EAP Failure Runnin as, for example ./eapol_test -c test_tls.conf -a192.168.56.3 -p1812 -stesting123 -r1 Output, eap.conf and test_tls.conf attached. Simple PAP and EAP-MD5 working properly, other EAP methods (PEP, TLS, TTLS-MD5, TTLS-MSCHAPV2) crashing on failure mentioned above. Thanks for your advices. -- Tom

5 18