- Freeradius-Users - lists.freeradius.org

Database Problem
by Paul Ryszka 30 Oct '09

30 Oct '09

Hello, I am using FreeRadius v 1.1.3 (lastest in the cenOS) and everything is going quite ok but I am not sure how to construct database tables to use for authorization (I am using MS SQL as a backend) I get the connection to database and can do queries against it so at this point it is standard ODBC connection that is working. I cannot choose the right attributes to put to the database for authentication to happened. I always get "unknown attribute" no matter if I use "Cleartext-Password" or "Auth-Type". That are two that I found in various documentation on the web. Obviously authentication fails. I would really appriciate if you would be able to tell me how the simplest (user/password with nothing extra returned back) authentication can be done using database backend. Regards Paul

3 6

Filter Access-Challenge Attributes
by Ben Wiechman 30 Oct '09

30 Oct '09

Is the following stub for filtering Access-Challenge attributes from sites-available/default for future use? # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post_auth # handled # override the "updated" code from attr_filter # } # } Uncommenting the lines causes the server to fail to start because that instance of the attr_filter module isn't defined. However subsequent testing (and a quick dive into the code) show that attr_filter isn't supported in the authenticate section. Should this stub simply be ignored at this point or am I missing something? Ben

2 2

Asking to Ana Gallardo
by C. Diego Raffaelli A. 30 Oct '09

30 Oct '09

Querida Ana: Un gusto compartir contigo un mailing list. Lamentablemente, no tengo la solucion a tu problema, se que seguramente esperas eso, lo siento :( Mas al contrario tengo una pregunta. Has instalado FreeRadius en Debian y ademas has creado un NAS (Netw. autentication server? ) Esto te servira para que, por ejemplo usuarios tuyos se autentiquen en el Radius y el NAS les de acceso a ciertos dispositivos? te pregunto esto porque yo necesito implementar algo asi, tengo una red LAN que se extiende por la ciudad y necesito brindar nombre de usuario y contraseña para gestionar no tanto el tiempo, sino el ancho de banda que se les provee y ademas poder dar de baja o reconectar su usuario. Nosotros usamos esto para brindar internet. Yo estoy intentando hacerlo en OpenBSD ya que tengo un manual que indica casi todos los servicios (DHCP; DNS... y varios otros,,, EXCEPTO FREE RADIUS! ) :( Me gustaria saber no el "como" lo instalaste en Debian, sino para que lo estas usando y si estas usando un NAS.,,, una base de datos. Gracias por tu respuesta. PD.- Sorry for my...... SPANISH!!!! xD -- = = = = = Carlos Diego Raffaelli A. MSN: carlosdiego.ra(a)hotmail.com

2 1

"double" realm problem
by mr typo 30 Oct '09

30 Oct '09

Hello all, i do have a problem with our freeradius configuration and i have no idea how to solve it. we do have one realm configured domainname.com which works perfectly. every user who wants to authenticate with a different realm is proxied to an outside radius. server. the setup works fine. we do have some mobile devices who send something like: username@company.com@wlan.mnc003.mc username@company.com@Verisign... . . we send these requests to our proxy and the proxy sends it back to us,.... from my understanding i cant solve it with a regex in the proxy.conf, right? since the "realm" is just the string after the last @? anyone has an idea how i can process such request in my company.com realm? inside the realm i strip everything out, so it should work then. any ideas?kind regards -euroreg

6 23

SSL_read failed in a system call (-1), TLS session fails
by Guk Victor 30 Oct '09

30 Oct '09

Hello all, We're running FreeRADIUS 1.1.3 with EAP/TTLS (openSSL 0.9.8d) on Red Hat 5.1. The server will come up and process clients for a few days, but, every now and then it begins denying all auth-requests with the following error: Error: rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Auth: Login incorrect: [host/user/<no User-Password attribute>] A restart makes the server happy and it goes back to properly auth'ing clients. Thanks in advance!

3 2

NotBefore, NotAfter or Date attributes fot temporary accounts
by Daniele Albrizio 30 Oct '09

30 Oct '09

In an old post Alan DeKok said he would patch freeradius to support temporary accounts using attributes like Date > "January 1 2010 13:00" Date > "January 12 2010 13:00" or Not-Before := "January 1 2010 13:00" Not-After := "January 12 2010 13:00" Somebody knows if such a feature has ever been included in Freeradius? Expiration attribute doesn't permit a "not-before" behaviour, Login-Time attribute doesn't permit month/year specification. Daniele Albrizio ======================== Old Post =============================== > -----Message d'origine----- > De : > [EMAIL PROTECTED] > radius.org > [EMAIL PROTECTED] > sts.freeradius.org] De la part de Alan DeKok > Envoyé : lundi 11 décembre 2006 19:47 > À : FreeRadius users mailing list > Objet : Re: NotBefore and Epiration (was Temporary Accounts), > Enhancement proposal > > > Thibault Le Meur wrote: > > > Enhancement proposal > > ==================== > > > > Why not implement the NotBefore part in the FR server code as it is > > already done for Expiration ? > > Or, add a "Date" attribute, that will compare against the > current date. You can then use configurations like: > > Date > "January 12 2006 13:00" > > And it should Just Work. Sure, this is a simpler way to do so. The only difference will be that the reply message will not say "Password has expired" or "Password not valid yet"... which, as far as I am concerned is not very important ;-) > I'll see if I can get a patch into 1.1.4. Thanks a lot... Thibault

2 3

problem regular expressions in hints file
by Ana Gallardo 30 Oct '09

30 Oct '09

Hello, I'm using Debian and Freeradius 2.0.4-3 I want to use the hints file to add an attribute named Intentos-Reject. I would like to use only one DEFAULT entry to match with @domain.es and with @ temp.domain.es If I use this DEFAULT entry the request don't match: #/etc/freeradius/hints DEFAULT Suffix =~ "@(temp\.)?domain.es$", Strip-User-Name = Yes Intentos-Reject = ... ###DEFAULT Suffix == "@domain.es" ### Intentos-Reject = ... ###DEFAULT Suffix == "@temp.domain.es" ### Intentos-Reject = ... If I use this other DEFAULT entry the request match but Freeradius doesn't add Stripped-User-Name and I can't authenticate: DEFAULT User-Name =~ "@(temp\.)?domain.es$", Strip-User-Name = Yes Intentos-Reject = ... ###DEFAULT Suffix == "@domain.es" ### Intentos-Reject = ... ###DEFAULT Suffix == "@temp.domain.es" ### Intentos-Reject = ... I don't know if I can use regular expressions with Suffix/Preffix atributes. Thank you very much and sorry for my english. -- ____________________ Ana Gallardo Gómez ____________________

2 5

Proxy Accounting
by adia 29 Oct '09

29 Oct '09

Dear All, We have FreeRADIUS Version 2.1.1 installed with mysql. Some of our users are authenticated via an external radius so we have configured a realm and proxy. All works well except accounting. The Freeradius does not seems to be sending the accounting to the remote server (local accounting to mysql works fine). This is the configuration we used: File realm: realm one { format = suffix delimiter = "#" ignore_default = no ignore_null = no } File proxy.conf: home_server pri_home_server { type = auth+acct ipaddr = x.x.x.x port = 1812 secret = ****** response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server sec_home_server { type = auth+acct ipaddr = y.y.y.y port = 1812 secret = ****** response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 } home_server_pool auth_failover_pool { type = fail-over home_server = pri_home_server home_server = sec_home_server } realm users{ type = radius auth_pool = auth_failover_pool acct_pool = auth_failover_pool nostrip } When using tcpdump on the server we don’t see any accounting request being issued by the radius. Your help please. Regards, Adi. -- View this message in context: http://www.nabble.com/Proxy-Accounting-tp26090474p26090474.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

Time connected
by Sergio Belkin 29 Oct '09

29 Oct '09

Hi, Sorry for the stupid question, but I'd want to get how many time every user is connected, please could you provide some kind of guideliness? Using Version 2.1.1. Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 4

Probably simple problem
by Paul Ryszka 29 Oct '09

29 Oct '09

Hello, I have problem that looks strange to me and probably is obvious but I can't find the solution. I try to authenticate freeradius against AD using ntlm auth : [root@localhost] /usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=test --password=abcd123! NT_STATUS_OK: Success (0x0) debug log : [root@localhost raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) exec: wait = yes exec: program = "/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=%{mschap:User-Name} --password=%{User-Password} " exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (ntlm_auth) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:58984, id=180, length=56 User-Name = "test" User-Password = "abcd123!" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 64 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ntlm_auth auth: type "ntlm_auth" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '/usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=test --password=abcd123! ' Exec-Program: /usr/bin/ntlm_auth ntlm_auth --request-nt-key --domain WEBANGEL --username=test --password=abcd123! Exec-Program output: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program-Wait: plaintext: NT_STATUS_WRONG_PASSWORD: Wrong Password (0xc000006a) Exec-Program: returned: 1 rlm_exec (ntlm_auth): External script failed modcall[authenticate]: module "ntlm_auth" returns fail for request 0 modcall: leaving group authenticate (returns fail) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 180 to 127.0.0.1 port 58984 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 180 with timestamp 4ae8c52e Nothing to do. Sleeping until we see a request. So I am puzzled a little bit because even if I copy the ntlm_auth line from debug output it returns access granted and it gives wrong password from within radius Any help would be appreciated. Thank You. Paul Ryszka

2 4