- Freeradius-Users - lists.freeradius.org

NAS IPs
by Irina 17 Aug '09

17 Aug '09

Hello, We need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina ===========================

1 0

Problem authenticating cleartext-passwords locally and proxy realms
by mikoi 17 Aug '09

17 Aug '09

Hello. I want freeradius to authenticate users with Cleartext-Password locally and proxy others with realms. I use SQL for users, groups, nas and huntgroups. The problem: When logging in with the user with Cleartext-Password all passwords are accepted. The proxied users need the correct password. What am i missing? Please help. My set up consists of: AAA Client -> Freeradius 2.1.6 with MySQL -> RADIUS-server ##sites-enabled/default authorize section # SQL query huntgroups update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" } # # # SQL query Proxy-To-Realm # update control { Proxy-To-Realm := "%{sql:select authserver from authmethod where username =\"%{User-Name}\"}" } radhuntgroup table: mysql> select * from radhuntgroup; +----+-------------+--------------+-----------+ | id | groupname | nasipaddress | nasportid | +----+-------------+--------------+-----------+ | 4 | VPN-service | x.x.x.x | NULL | radgroupcheck table: mysql> select * from radgroupcheck; +----+-----------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+-------------+ | 8 | VPN-AUTH | Huntgroup-Name | == | VPN-Service | | 9 | VPN-AUTH | Auth-Type | := | Accept | usergroup table; mysql> select * from usergroup; +--------------+-----------+----------+ | UserName | GroupName | priority | +--------------+-----------+----------+ | testuser | VPN-AUTH | 0 | | safewordtest | VPN-AUTH | 0 | +--------------+-----------+----------+ users-file # On no match, the user is denied access. DEFAULT Auth-Type := Reject Users are defined in radcheck. testuser is to be authenticated locally safewordtest is to be proxied (table authmethod). mysql> select * from radcheck; +----+--------------+--------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+----------+ | 33 | testuser | Cleartext-Password | := | testuser | | 39 | safewordtest | Cleartext-Password | := | testttsd | +----+--------------+--------------------+----+----------+ mysql> select * from authmethod; +--------------+------------+----------+ | username | authserver | priority | +--------------+------------+----------+ | safewordtest | Safeword | 1 | +--------------+------------+----------+ Debug: Incorrect username/password. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=38, length=70 User-Name = "testuser" User-Password = "wrongpasswordibelieve" NAS-IP-Address = x.x.x.x +- entering group authorize {...} ++[preprocess] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}" -> select groupname from radhuntgroup where nasipaddress="x.x.x.x" rlm_sql (sql): Reserving sql socket id: 3 sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}"} -> VPN-Service ++[request] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select authserver from authmethod where username ="%{User-Name}" -> select authserver from authmethod where username ="testuser" rlm_sql (sql): Reserving sql socket id: 2 SQL query did not return any results rlm_sql (sql): Released sql socket id: 2 expand: %{sql:select authserver from authmethod where username ="%{User-Name}"} -> ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 204 ++[files] returns ok [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN-AUTH' ORDER BY id [sql] User found in group VPN-AUTH [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'VPN-AUTH' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop WARNING: You set Proxy-To-Realm = , but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' [sql] expand: %{User-Password} -> wrongpasswordibelieve [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'wrongpasswordibelieve', 'Access-Accept', '2009-08-13 21:01:08') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'wrongpasswordibelieve', 'Access-Accept', '2009-08-13 21:01:08') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 38 to x.x.x.x port 1812 Class := 0x6f753d7672663337302c6f753d72657472726565 Finished request 0. -- View this message in context: http://www.nabble.com/Problem-authenticating-cleartext-passwords-locally-an… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

Authentication with mschap
by Eric Bourkland 17 Aug '09

17 Aug '09

Need some help pointing me in the right direction. I think I know what the problem is but I don't know where to look. I think the problem is my freeRadius server and openLDAP server are not talking perfectly. I am trying to do MS-chapv2 authentication so that windows machines can connect to out access point without having to install additional software. One of the glaring things that jumps out at me is that in the logs/debugging it says message-Authenticator = 0x000000... It looks like it is trying the correct authentication ... Told to do MS-CHAPv2 for test.user with NT-Password FAILED: No NT/LM-Password. Cannot perform authentication. FAILED: MS-CHAP2-Response is incorrect. ... and then error message peap got tunnel reply code3 MS-CHAP-Error = "\007E=691 R=1" Okay that message is pretty clear to me, but I do have an NT-Password in sambaNTPassword and is populate/stored in NT hash format and there is a maping in ldap.attrmap checkItem NT-Password sambaNtPassword I haven't done anything funky with the config files like setting Authe-Type = to anything I've read enough that it is a big no no. The only thing I've done is uncomment a few things so that it will use ldap. And everything works when I use radtest so I know my connection to my ldap server is okay but radtest is using a different protocol as I've been learning through this whole experience. If anyone can point me in the right direction I would greatly appreciate it. Thanks,

2 4

Sending DHCP message when DHCP-Message-Type = 0
by Sergey Korobkov 17 Aug '09

17 Aug '09

Using version from GIT. When DHCP-Message-Type = 0 the server must not sending reply. But in this code set DHCP-Message-Type value from 0 to 1024 and reply sending to client. src/main/dhcpd.c ... vp = pairfind(request->reply->vps, DHCP2ATTR(53)); /* DHCP-Message-Type */ if (vp) { request->reply->code = vp->vp_integer; if (request->reply->code < PW_DHCP_OFFSET) { request->reply->code += PW_DHCP_OFFSET; } } ... I think it must be something like this: if (vp) { request->reply->code = vp->vp_integer; if ((request->reply->code < PW_DHCP_OFFSET) && (request->reply->code != 0)) { request->reply->code += PW_DHCP_OFFSET; } }

2 1

Escaping things
by Stun Box 17 Aug '09

17 Aug '09

Hello everybody, I'm doing some tests with wpa_supplicant(freebsd) + aironet 1252 + freeradius2.1.6 (freebsd portage). And I have a mystery I can not explain. I test 2 user with a domain. This is my configuration files for wpa_supplicant. They have just their first user letter mismatching. USER_TEST ========== network={ ssid="test_wifi" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="DOMAIN\test" password="test" } USER_NEST ========== network={ ssid="test_wifi" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="DOMAIN\nest" password="test" } And this is the access and accounting request for both of them : USER_TEST ACCESS-REQ ===================== rad_recv: Access-Request packet from host 192.168.9.30 port 1645, id=232, length=231 User-Name = "DOMAIN\\test" Framed-MTU = 1400 ... USER_TEST ACCOUNT-REQ ====================== rad_recv: Accounting-Request packet from host 192.168.9.30 port 1646, id=144, length=229 Acct-Session-Id = "000002F0" Called-Station-Id = "00-24-97-B6-86-40" Calling-Station-Id = "00-19-5B-35-D0-96" Cisco-AVPair = "ssid=test_wifi" Cisco-AVPair = "vlan-id=568" Cisco-AVPair = "nas-location=unspecified" User-Name = "DOMAIN\\test" ... USER_NEST ACCESS-REQ ===================== rad_recv: Access-Request packet from host 192.168.9.30 port 1645, id=222, length=231 User-Name = "DOMAIN\\nest" Framed-MTU = 1400 ... USER_NEST ACCOUNT-REQ ====================== rad_recv: Accounting-Request packet from host 192.168.9.30 port 1646, id=146, length=233 Acct-Session-Id = "000002F2" Called-Station-Id = "00-24-97-B6-86-40" Calling-Station-Id = "00-19-5B-35-D0-96" Cisco-AVPair = "ssid=test_wifi" Cisco-AVPair = "vlan-id=14" Cisco-AVPair = "nas-location=unspecified" User-Name = "DOMAIN\nest" ... The mystery is why there is two backslash for each "User-Name" excepted in the accounting request ? (I ask, because it does the mess in my sql base for accounting). Thanks for reading, G.

2 6

weird rlm_radutmp errors .. radiusd process sleeping
by ramesh p 17 Aug '09

17 Aug '09

Hi All, getting the following errors in the radius log: Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1239, but no Login record Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 712, but no Login record Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 659, but no Login record Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 3783, but no Login record Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1964, but no Login record Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2438, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 3183, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2423, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1491, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 3822, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2381, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1842, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1064, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 214, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas xx.xx.xx.xx] Mon Aug 17 05:45:40 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2489, but no Login record Mon Aug 17 05:45:40 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas xx.xx.xx.xx] Mon Aug 17 05:45:40 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2113, but no Login record Mon Aug 17 05:45:40 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:40 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2887, but no Login record Mon Aug 17 05:45:40 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:40 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Radius server is flooded with the above message and after some time radiusd process sleeping. mysql db not logging records at all. What's the remedial action? Is there any problem in NAS? Please help. Thanks, Rams.

1 0

Re: String Validation
by Neville 16 Aug '09

16 Aug '09

>> If a connection that comes in with a GROUP NAME from SQL of "USUK-XX" >> or "WUK-XX" and I want to strip of the "-XX", how would I do this with >> ulang so I only validate the following? > > Using the regexp feature, you can match part of an attribute then > reference it later, like so: > if (SQL-GROUP =~ /(.*)-XX/) { > update request { > SQL-GROUP := "%{1}" > } > } > > --Mike Thx Mike, Sorry, I don't think my example help as XX could be ANYTHING. E.g. USUK-5GB ; USUK-1GB ; USUK-10GB, so looking to STRIP everying after the "-" and including the "-" to the end of the string. The reason for doing this as I only want to validate against the first part of the String, otherwise the Nested IF Statment will be Huge. If your able, would appreciate if you can update the IF statement below to reflect what I'm trying to do. if(SQL-GROUP == "USUK") { ok } elsif(NAS-IP-Address == AAA.BBB.CCC.DDD && SQL-GROUP == "WUK") { ok } else { reject } Thx in advance Nev

2 1

String Validation
by Neville 16 Aug '09

16 Aug '09

Hi, If a connection that comes in with a GROUP NAME from SQL of "USUK-XX" or "WUK-XX" and I want to strip of the "-XX", how would I do this with ulang so I only validate the following? if(SQL-GROUP == "USUK") { ok } elsif(NAS-IP-Address == AAA.BBB.CCC.DDD && SQL-GROUP == "WUK") { ok } else { reject } Thx in advance Nev

2 1

Request for opinion - central admin user server LDAP+FreeRADIUS
by Andres Kaaber 15 Aug '09

15 Aug '09

Hello all I'm assigned with a project to make a central admin user database for all kind of servers / devices you can imagine (routers, switches, firewalls, linux servers, windows servers, databases, etc.). The point is that when a news employee arrives you just make him a user in this database, maybe check which type of devices he can and all the devices are configured to authenticate users against this db. We have over 200 switches alone in our company so making user accounts in every single one of them and when this dude leaves to disable all of them is huge (or impossible) work. So I thought a linux server LDAP+FreeRADIUS for authentication sounds quick, easy and good solution, or not? There is no problem with servers Linux and Windows servers can authenticate against radius. Most popular DB -s can do this also (Oracle, MySQL, PostgresSQL). I don't know about Cisco switches and roters but as far I found in google there should be no problems the same goes for juniper devices. So what do you think? Or maybe you know a free software solution for this kind of problem already? Sun identity management is one that i checked out but it seems too bloated and complicated. So what are your thoughts? -- Andres Kaaber

5 5

radius.log with timestamp in filename
by RadiusGuy 15 Aug '09

15 Aug '09

Hi all, I'm using FreeRADIUS Version 2.0.4 and i would like to have timestamps within the filename of the radius.log, i.e. radius.log-20090804. For the other logfiles, like the detailfile, this is the default setting in the radiusd.conf: detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d In good faith I have tried the same thing with the radius.log... file = ${logdir}/radius.log-%Y%m%d but it didn't work. Freeradius then creates a logfile with the explicit name radius.log-%Y%m%d, but not with the timestamp of the actual day. Can anyone help? Thanks in advance! -- View this message in context: http://www.nabble.com/radius.log-with-timestamp-in-filename-tp24804436p2480… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2