- Freeradius-Users - lists.freeradius.org

Freeradius2 configuration challenges ( Binding IP address & failure of radtest
by adaigle＠vl.videotron.ca 16 Oct '09

16 Oct '09

Hello I am new with FreeRadius and trying to get Freeradius2, version 2.1.7 running on top of CentOS , to do a simple test with WLAN users. First off all, I am not able to configure the raduis server with an IP address . I am getting the following message: [root@localhost Alain]# /usr/sbin/radiusd -i 192.168.1.123 -p 1812 -X FreeRADIUS Version 2.1.7, for host i386-redhat-linux-gnu, built on Sep 18 2009 at 10:59:17 radiusd: #### Opening IP addresses and Ports #### Failed binding to authentication address 192.168.1.123 port 1812: Cannot assign requested address There appears to be another RADIUS server running on the authentication port 1812 Second when I leave 127.0.0.1 in the radiusd.conf file and I use localhost. I get the following message doing a radtest : [root@localhost Alain]# radtest steve testing localhost 1812 testing123 Sending Access-Request of id 170 to 127.0.0.1 port 1812 User-Name = "steve" User-Password = "testing" NAS-IP-Address = 127.0.0.1 NAS-Port = 1812 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=170, length=20 The following is what appear on the radiusd debug screen: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Thanks for your help ! Al

4 11

Re: Several LDAP searches
by Francisco Javier Valdera Garcia 16 Oct '09

16 Oct '09

Ivan Kalik escribió: >>>> I am configuring a freeradius server (version 2.1.7). I need two listen >>>> sections, both to authenticate users using the same LDAP server. The >>>> thing is that I need to do different searches with different filters, >>>> depending on which listen section is asked. What is the best way to >>>> configure this, if there is one? I have read the documentation, the >>>> wiki >>>> and the configuration files and I couldn't figure it out. >>>> >>>> >>> Configure two ldap instances and use them in virtual servers listen >>> sections point to. >>> >>> >> Thanks for the help, but I'm pretty new at freeRadius, can anyone tell >> me how do I do this? >> > > http://wiki.freeradius.org/Rlm_sql#Instances > > Same applies to ldap or any other module. If you are using groups: > > http://wiki.freeradius.org/Rlm_ldap#Group_Support > > Ivan Kalik > Kalik Informatika ISP > > Thanks a lot, Ivan, it worked like a charm :D. Greetings, Francisco Javier.

1 0

Users and groups with Microsoft AD
by Mr. You 16 Oct '09

16 Oct '09

Hello, I've tried searching the web before actually submitting this post in order to cover all angles. I know it's possible for freeradius to authenticate against Microsoft AD groups, users, etc. However, is it possible to authenticate by combining groups? In other words, can freeradius authenticate against users AND groups? I would like to say only members of computers AND users are allowed to authenticate against freeradius while all others are rejected. Is this even possible? Or, is there something about using peap and combining groups that will not allow this to occur? Currently I'm running freeradius 2.1.6 on freebsd 7.2 and windows 2003. Thanks!

2 1

Several LDAP searches
by Francisco Javier Valdera Garcia 16 Oct '09

16 Oct '09

Hello, I am configuring a freeradius server (version 2.1.7). I need two listen sections, both to authenticate users using the same LDAP server. The thing is that I need to do different searches with different filters, depending on which listen section is asked. What is the best way to configure this, if there is one? I have read the documentation, the wiki and the configuration files and I couldn't figure it out. Thanks in advance.

2 2

Freeradius + OpenLdap + WindowsXP(Wifi)
by Kleber Larroyd 15 Oct '09

15 Oct '09

Freeradius 1.1.7 Openldap Windows XP SP2 (WPA-TKIP / Protected EAP (PEAP)) Have any idea ? Where can i find the solution ? When i trying connect freeradius server with wireless over access point i get this error: Tue Oct 13 12:00:45 2009 : Debug: Finished request 7 Tue Oct 13 12:00:45 2009 : Debug: Going to the next request Tue Oct 13 12:00:45 2009 : Debug: Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.155.123:1812, id=77, length=117 User-Name = "kleberl" NAS-IP-Address = 192.168.155.123 NAS-Port-Type = Wireless-802.11 State = 0xcdb24b80885193f00e1673d06eb7859c EAP-Message = 0x029600261900170301001b8cfe319046bdc5f99d42805f852d4695a57e722889822c7a01be3f Message-Authenticator = 0x9d1262ea1db0eca8f5ecaaee93e7ff1d Tue Oct 13 12:00:45 2009 : Debug: Processing the authorize section of radiusd.conf Tue Oct 13 12:00:45 2009 : Debug: modcall: entering group authorize for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "preprocess" returns ok for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "chap" returns noop for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "mschap" returns noop for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_realm: No '@' in User-Name = "kleberl", looking up realm NULL Tue Oct 13 12:00:45 2009 : Debug: rlm_realm: No such realm "NULL" Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "suffix" returns noop for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: - authorize Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: performing user authorization for kleberl Tue Oct 13 12:00:45 2009 : Debug: radius_xlat: '(uid=kleberl)' Tue Oct 13 12:00:45 2009 : Debug: radius_xlat: 'ou=People,dc=stars,dc=net' Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: performing search in ou=People,dc=stars,dc=net, with filter (uid=kleberl) Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: looking for check items in directory... Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: looking for reply items in directory... Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: user kleberl authorized to use remote access Tue Oct 13 12:00:45 2009 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "ldap" returns ok for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: EAP packet type response id 150 length 38 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation Tue Oct 13 12:00:45 2009 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authorize]: module "eap" returns updated for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall: leaving group authorize (returns updated) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rad_check_password: Found Auth-Type EAP Tue Oct 13 12:00:45 2009 : Debug: auth: type "EAP" Tue Oct 13 12:00:45 2009 : Debug: Processing the authenticate section of radiusd.conf Tue Oct 13 12:00:45 2009 : Debug: modcall: entering group authenticate for request 8 Tue Oct 13 12:00:45 2009 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: Request found, released from the list Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: EAP/peap Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: processing type peap Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Authenticate Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_tls: processing TLS Tue Oct 13 12:00:45 2009 : Debug: eaptls_verify returned 7 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_tls: Done initial handshake Tue Oct 13 12:00:45 2009 : Debug: eaptls_process returned 7 Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: EAPTLS_OK Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Session established. Decoding tunneled attributes. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Received EAP-TLV response. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Tunneled data is valid. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: Handler failed in EAP/peap Tue Oct 13 12:00:45 2009 : Debug: rlm_eap: Failed in EAP select Tue Oct 13 12:00:45 2009 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall[authenticate]: module "eap" returns invalid for request 8 Tue Oct 13 12:00:45 2009 : Debug: modcall: leaving group authenticate (returns invalid) for request 8 Tue Oct 13 12:00:45 2009 : Debug: auth: Failed to validate the user. Tue Oct 13 12:00:45 2009 : Debug: Delaying request 8 for 1 seconds Tue Oct 13 12:00:45 2009 : Debug: Finished request 8 Tue Oct 13 12:00:45 2009 : Debug: Going to the next request Tue Oct 13 12:00:45 2009 : Debug: Waking up in 6 seconds... Tue Oct 13 12:00:51 2009 : Debug: --- Walking the entire request list --- Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 0 ID 69 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 1 ID 70 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 2 ID 71 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 3 ID 72 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 4 ID 73 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 5 ID 74 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 6 ID 75 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 7 ID 76 with timestamp 4ad4961d Sending Access-Reject of id 77 to 192.168.155.123 port 1812 EAP-Message = 0x04960004 Message-Authenticator = 0x00000000000000000000000000000000 Tue Oct 13 12:00:51 2009 : Debug: Cleaning up request 8 ID 77 with timestamp 4ad4961d Tue Oct 13 12:00:51 2009 : Debug: Nothing to do. Sleeping until we see a request. # --------------- EAP.CONF ---------------- eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } mschapv2 { } tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/cert-srv.pem CA_file = ${raddbdir}/certs/demoCA/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes # proxy_tunneled_request_as_eap = yes } } # ---------- RADIUSD.CONF----------------- ldap { server = "localhost" identity = "cn=admin,dc=stars,dc=net" password = secret55 basedn = "ou=People,dc=stars,dc=net" filter = "(uid=%u)" start_tls = no #access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } authorize { preprocess chap mschap suffix ldap eap } authenticate { Auth-Type PAP { pap } Auth-Type MS-CHAP { mschap } eap } # -----------USERS ------------------ DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP _________________________________________________________________ Você sabia que com o Hotmail você tem espaço ilimitado para guardar seus e-mails? Começe a usar já! http://www.microsoft.com/brasil/windows/windowslive/products/hotmail.aspx

4 4

dialup_admin query problem
by Whorled Services 15 Oct '09

15 Oct '09

I am using dialup_admin 1.80 from within the current freeradius 2.1.7 release. freeradius is working fine, and some dialup_admin menu selections are working correctly. One that isn't is User Statistics. I have configured dialup admin to not use the 'totacct' table by setting "general_stats_use_totacct: no" in admin.conf When I select User Statistics, dialup_admin is still running a query for fields in the totacct table: 091015 10:08:21 22 Connect freeradius@localhost on 22 Init DB radius 22 Query EXPLAIN SELECT * FROM nas 22 Query SELECT * FROM nas 22 Init DB radius 22 Query EXPLAIN SELECT * FROM radacct WHERE acctdate >= '2009-10-08' AND acctdate <= '2009-10-15' ORDER BY connnum desc 22 Query SELECT * FROM radacct WHERE acctdate >= '2009-10-08' AND acctdate <= '2009-10-15' ORDER BY connnum desc The table name 'radacct' is correct. The query for field 'acctdate' is incorrect, that field is in 'totacct' & not present in 'radacct'. I know one solution is to set "general_stats_use_totacct: yes" & run the tot_stats scripts daily, but that it is not working with the 'radacct' table makes me concerned that I may have a configuration issue that could lead to further problems. Is there some other configuration option needed to make this work properly? TIA Linux version 2.6.27.27 (root@darkstar) (gcc version 4.2.4) #1 SMP Wed Jul 22 07:27:34 AKDT 2009 apache 2.2.13 php 5.2.10 zend 3.3.9 mysql 5.0.67 FreeRADIUS Version 2.2.0, for host i686-pc-linux-gnu, built on Dec 5 2008 at 10:35:21 dialup_admin 1.80 -- Be Yourself @ mail.com! Choose From 200+ Email Addresses Get a Free Account at www.mail.com!

1 0

Good number of Max Connections to run freeradius
by Alisson 15 Oct '09

15 Oct '09

What is a good number of max_connections on Mysql to run FreeRadius? i'm using max_connections=500 -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

2 2

Re: PAP / ntlm_auth fails unless "DEFAULT Auth-Type = ntlm_auth" in users.
by Ivan Kalik 15 Oct '09

15 Oct '09

> I've been jacking around trying to fix this for several hours - but no > go. I've RTFM several times, and read several docs such as: > http://wiki.freeradius.org/Combining_authentication_of_AD_accounts_%28nt > lm_auth%29_with_accounts_stored_elsewhere > > > > When I say "fix" - it's always been "broken" - it's never worked without > the DEFAULT entry in users. Most all my accounts are in AD so the > DEFAULT works for me, but I'm using this issue as a learning > opportunity, but instead it's just a frustration opportunity. > > > > I'll post all my confs (2.1.6) and -X output if needed, but just looking > for some hints to help determine why when the process fails through to > PAP, it won't use ntlm_auth - it will only use "files" Post the debug. Ivan Kalik Kalik Informatika ISP

2 1

Postgres
by Sparkes, David 15 Oct '09

15 Oct '09

Hi, I would like to get Freeradius working with a PostgreSQL database: are there any handy HOWTOs or Tutorials that explain how to do this? I am running RedHet EL5. Relevant Packages: freeradius2.x86_64 2.1.7-2.el5 installed freeradius2-libs.x86_64 2.1.7-2.el5 installed freeradius2-postgresql.x86_64 2.1.7-2.el5 installed freeradius2-python.x86_64 2.1.7-2.el5 installed freeradius2-utils.x86_64 2.1.7-2.el5 installed postgresql.x86_64 8.1.11-1.el5_1.1 installed postgresql-libs.i386 8.1.11-1.el5_1.1 installed postgresql-libs.x86_64 8.1.11-1.el5_1.1 installed postgresql-server.x86_64 8.1.11-1.el5_1.1 installed Regards, Dave

5 10

To proxy, or not to proxy, that is the question ...
by Dean, Barry 15 Oct '09

15 Oct '09

I currently run two virtual servers, one for our local secure wireless and one for eduroam customers. The local one receives RADIUS packets from Bradford Campus Manager, which is responsible for Network Access Control and stamps Auth-OK replies with the VLAN for the user. What I want to do is combine these wireless services, so that we just have eduroam. The functionality we will need, will be: The requests will come to the eduroam server address. if (no domain specified) then who are ya? fi if (domain is non-local) then proxy to user's home site. fi if (domain is local AND authenticating from a local NAS) then authenticate locally by proxy to Bradford Campus Manager (Campus Manager will receive the stripped user@realm as user and proxy to the local server address) else authenticate and return ACK/NACK to remote server in usual way for one of our users visiting remote site fi The part I am not sure how to do is the last part, a conditional proxy based on source NAS. I assume I need to dip into unlang, but can I put that into the proxy.conf file? realm local.site.ac.uk { if( NAS-IP-Address ~= /192.168.*/ ) then # match my likely clients... set-up A else set-up B fi } Or whatever (I don't speak unlang, yet!), or have I got to determine the source of the request somewhere else and use unlang to re-write the realm to some special sentinel value that would be caught in proxy.conf like: realm local.site.ac.uk { do the normal thing } realm special.local.site.ac.uk { do the clever NAC proxy stuff } As usual, thanks for your time and hope someone can steer me in the right direction before my head explodes. (Yes I did read the docs, didn't help in this case!) ---------------------- Barry Dean Principal Programmer/Analyst Networks Group Computing Services Department

3 3