- Freeradius-Users - lists.freeradius.org

Re: Connecting freeRadius to openLDAP
by Mackey, Theral 22 Jul '09

22 Jul '09

The docs do tend to gloss over the bits about how to get the needed password into your LDAP store (besides just saying cleartext or LN/NT). First, check that the user you have setup for ldap to use has auth (not read) access to the userPassword attribute, which I think is true since you said radtest works for ldap users. That user (and really only that user (hopefully not using the superuser)) should also be able to read the LM/NT password fields ( access to attrs=sambaLMPassword,sambaNTPassword by ssf=128 dn.exact="cn=LdapProxyUser,dc=example,dc=com" read by self write by * none, the ssf=128 only allows if ssl/tls is used). These fields are in the samba.schema file, which you will have to go look for (usually in the samba package), and are typically labeled sambaLMPassword and sambaNTPassword, depending on which version of that schema you get. Edit the ldap.attrmap file to match the field names, should be obvious what to change in there, if needed. Add the sambaSamAccount class to your users*, and once the fields are there, use the samba password util to generate the hashes by hand (cant remember its name, smbpasswd?), use the perl Cypt::SmbHash module to build a perl-script to hash them, or look in the contrib/ dir of the openldap source for the smbk5pwd module** that will autogen and sync the hashes whenever someone changes their pw (if pw changes are set to use ldap exop). Since you are using the Atlassian openLDAP, Im guessing the module option is out, though you can probably recompile openLDAP from source with the module and just make sure their schemas are put in place and use a slapcat ldiff to repopulate, or create a separate LDAP tree and tell the atlassian stuff to auth to it instead, or use crowd... Once LM/NT passwords are good, just turn on mschapv2 and have an SSL cert ready for it with the windowsxp v3 extensions and it should "just work" after all that ;) . -T * sambaSID is a required value for this schema, if you don't already have SIDs for your users (AD assigns them in Windoze land), and no grand scheme for this to be critical, something like S001-100-$uidNumber works well **compiling this requires either heimdal dev libs present during compile, or editing the makefile and src to disable the heimdal lib includes (and thus krb5 (kerberos) hash support). This also means, if you add the krb5 schema to ldap, you can use this module to sync your kerberos pass as well. ----- Original Message ----- Date: Wed, 22 Jul 2009 10:54:57 -0500 (CDT) From: Eric Bourkland <eric.bourkland(a)trustedconcepts.com> Subject: To: tnt(a)kalik.net, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <10598636.13761248278097270.JavaMail.root(a)tci01.managed.contegix.com> Content-Type: text/plain; charset=utf-8 What would be the best solution since freeRadius currently can't get the password out of my openLDAP unless it is using PAP, it gets the password in the request via PEAP. I would like to avoid having to tell everyone with a windows client that they need to install SecureW2. What would be nice is if it was smart enough to recieve the request in multiple formats/protocols and then translate it into multiple formats/protocols to query out to flat file/DB/LDAP or AD instead of just passing the request along. Although there is the risk of something getting messed up with scripts converting protocols and there are probably a million different scenarios out there. Maybe I'm missing something since I'm still new to Radius. Is the easiest thing to do is to monkey with the openLDAP schema and add some cleartext password attributes? If I get this done is there some place in one of the config files that I need to update to look for a particular password attribute when Radius tries to do the authentication or does it figure it out for itself? I have been beating my head against a wall for about a week on this and the documentation mocks me by always saying it just works.

1 0

Re: Connecting freeRadius to openLDAP
by Eric Bourkland 22 Jul '09

22 Jul '09

I am not using AD, it is OpenLDAP that comes with Zimbra. Zimbra is an e-mail client that uses regular ole openLdap as it's authentication and attribute store. I have been able to get a lot of good information from your site but I haven't been able to find the key piece of information I need, or at least it hasn't jummped out at me yet. Right now it looks like I have a few options but I don't know if any of them are viable, get OpenLDAP to store it's password as clear text, don't really like this idea but may have to. See if there is a way to somehow get an innter tunnel to use ttls/pap to connect to the ldap server and perfrom authentication that way since it appears that PAP authentication does work. But I don't know if there can be a change in crypt for the authentication from the client which uses MSCHAPv2/PEAP and PAP. and lastly is to see if I can add NT/LM tags to my ldap server. I haven't been able to find what is the best option or how to do any of the above just yet. I thought that what I am trying to do is pretty straight forward but it doesn't seem to be that way. Client connect to Access point/router and the client has to use MSCHAPv2/PEAP and then have the Access Point connect to Radius and then to my OpenLDAP for authentication. If anyone has any other ideas I am open to suggestions. Thanks, ----- Original Message ----- From: "Alan DeKok" <aland(a)deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, July 21, 2009 4:21:57 PM GMT -05:00 US/Canada Eastern Subject: Re: Connecting freeRadius to openLDAP Eric Bourkland wrote: > below is my debug file. The interesting thing is when I am trying to do an ldap search it doesn't list the password attribute Are you using Active Directory? If so, please understand that it is NOT an LDAP server. You will need to use Samba to do authentication against AD. See my web page (deployingradius.com) for complete instructions. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Re: Connecting freeRadius to openLDAP
by Eric Bourkland 22 Jul '09

22 Jul '09

Thanks for the help, What fields am I going to have to populate in the radius schema? I don't see a password attribute in there? where do I set that attribute in Radius, or is it automatic? The additional schema will be problematic since the admin UI for my openLDAP won't support it, but that is another issue I'll deal with later, I will just have to add the attributes behind the scenes for the time being. Thanks, ----- Original Message ----- From: "Ivan Kalik" <tnt(a)kalik.net> To: "Eric Bourkland" <eric.bourkland(a)trustedconcepts.com> Sent: Wednesday, July 22, 2009 12:04:09 PM GMT -05:00 US/Canada Eastern Subject: Re: Connecting freeRadius to openLDAP > Is the easiest thing to do is to monkey with the openLDAP schema and add > some cleartext password attributes? Yes, you should use radius schema with the radius server. Add the whole radius schema. Ivan Kalik Kalik Informatika ISP

1 0

simultaneous checking
by Kanwar Ranbir Sandhu 22 Jul '09

22 Jul '09

Hi All, During testing (we're not live yet), a co-worker made some changes to dialup.conf to get simultaneous checking working with our NAS (Juniper E-120, I believe). I haven't been updated on whether or not the simultaneous check actually works (just got back from vacation), but I'd like to know from people here if the edits made are even a good idea. Here are the changes made to dialup.conf config (i.e. the "#" lines are things commented out that the default dialup.conf file has enabled, and anything else listed below is actually changed): # accounting_update_query_alt = " \ # INSERT INTO ${acct_table1} \ # (acctsessionid, acctuniqueid, username, \ # realm, nasipaddress, nasportid, \ # nasporttype, acctstarttime, acctsessiontime, \ # acctauthentic, connectinfo_start, acctinputoctets, \ # acctoutputoctets, calledstationid, callingstationid, \ # servicetype, framedprotocol, framedipaddress, \ # acctstartdelay, xascendsessionsvrkey) \ # VALUES \ # ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ # '%{SQL-User-Name}', \ # '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ # '%{NAS-Port-Type}', \ # DATE_SUB('%S', \ # INTERVAL (%{%{Acct-Session-Time}:-0} + \ # %{%{Acct-Delay-Time}:-0}) SECOND), \ # '%{Acct-Session-Time}', \ # '%{Acct-Authentic}', '', \ # '%{%{Acct-Input-Gigawords}:-0}' << 32 | \ # '%{%{Acct-Input-Octets}:-0}', \ # '%{%{Acct-Output-Gigawords}:-0}' << 32 | \ # '%{%{Acct-Output-Octets}:-0}', \ # '%{Called-Station-Id}', '%{Calling-Station-Id}', \ # '%{Service-Type}', '%{Framed-Protocol}', \ # '%{Framed-IP-Address}', \ # '0', '%{X-Ascend-Session-Svr-Key}')" # accounting_start_query = " \ # INSERT INTO ${acct_table1} \ # (acctsessionid, acctuniqueid, username, \ # realm, nasipaddress, nasportid, \ # nasporttype, acctstarttime, acctstoptime, \ # acctsessiontime, acctauthentic, connectinfo_start, \ # connectinfo_stop, acctinputoctets, acctoutputoctets, \ # calledstationid, callingstationid, acctterminatecause, \ # servicetype, framedprotocol, framedipaddress, \ # acctstartdelay, acctstopdelay, xascendsessionsvrkey) \ # VALUES \ # ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', \ # '%{SQL-User-Name}', \ # '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', \ # '%{NAS-Port-Type}', '%S', NULL, \ # '0', '%{Acct-Authentic}', '%{Connect-Info}', \ # '', '0', '0', \ # '%{Called-Station-Id}', '%{Calling-Station-Id}', '', \ # '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', \ # '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" simul_count_query = "SELECT COUNT(*) \ FROM radippool \ WHERE framedipaddress = '%{Framed-IP-Address}' \ AND nasipaddress = '%{NAS-IP-Address}'" # simul_verify_query = "SELECT radacctid, acctsessionid, username, \ # nasipaddress, nasportid, framedipaddress, \ # callingstationid, framedprotocol \ # FROM ${acct_table1} \ # WHERE username = '%{SQL-User-Name}' \ # AND acctstoptime IS NULL" -- Kanwar Ranbir Sandhu Linux 2.6.27.25-170.2.72.fc10.x86_64 x86_64 GNU/Linux 17:08:41 up 2 days, 23:39, 4 users, load average: 0.19, 0.23, 0.27

5 21

RE:" Radius Log authenticate the user but error 691"
by amritap sinha 22 Jul '09

22 Jul '09

Dear freeradiusus user, I have implemented freeradius server in RHCL 4 with mysql database. My problem is that radius log authenticate the user but modem shows error 691 in windows XP OS. debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server hotradius { ipaddr = 192.168.1.78 port = 1814 type = "auth" secret = "iSign" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = hotradius } realm hotradius { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client 192.168.1.78 { require_message_authenticator = no secret = "iSign" shortname = "192.168.1.78" nastype = "other" } client 192.168.1.9 { require_message_authenticator = no secret = "password" shortname = "192.168.1.9" nastype = "other" } client 192.168.1.80 { require_message_authenticator = no secret = "admin123" shortname = "iacsras.com" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "chap" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "7392" login = "root" password = "root" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/usr/local/var/log/radius/sqltrace.sql" readclients = yes deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Grou p}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Grou p}' ORDER BY id" accounting_onoff_query = " UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timest amp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctsto pdelay = %{%{Acct-Delay-Time}:-0} WHERE acctstoptime IS NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = " UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input- Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octe ts}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{S QL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoct ets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctsta rtdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-I d}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Ti me}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Inp ut-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calli ng-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = " INSERT INTO radacct (ac ctsessionid, acctuniqueid, username, realm, nasip address, nasportid, nasporttype, acctstarttime, acctsto ptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calle dstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdela y, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Re alm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S' , NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', ' ', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{%{Acct-Delay-Time}:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query_alt = " UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time }:-0}', connectinfo_start = '%{Connect-Info}' WHERE accts essionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Na me}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = " UPDATE radacct SET acct stoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutp utoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct -Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}' , connectinfo_stop = '%{Connect-Info}' WHERE acctsessio nid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name} ' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = " INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, naspor tid, nasporttype, acctstarttime, acctstoptime, acctses siontime, acctauthentic, connectinfo_start, connectinfo_stop, accti nputoctets, acctoutputoctets, calledstationid, callingstationid, ac ctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-S ession-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port -Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session -Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '% S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Inf o}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct -Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{C alling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Ser vice-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{ %{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime IS NULL" postauth_query = "INSERT INTO radpostauth (use rname, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap -Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789.-_: /" } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:7392/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, t ype, secret FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 Module: Linked to module rlm_sqlcounter Module: Instantiating noresetcounter sqlcounter noresetcounter { counter-name = "Max-All-Session-Time" check-name = "Max-All-Session" key = "User-Name" sqlmod-inst = "sql" query = "SELECT SUM(AcctSessionTime) FROM radacct WHERE UserName='%{%k}' " reset = "never" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789.-_: /" } rlm_sqlcounter: Reply attribute set to Session-Timeout. rlm_sqlcounter: Counter attribute Max-All-Session-Time is number 11273 rlm_sqlcounter: Check attribute Max-All-Session is number 11274 rlm_sqlcounter: Current Time: 1248265519 [2009-07-22 17:55:19], Next reset 0 [20 09-07-22 17:00:00] rlm_sqlcounter: Current Time: 1248265519 [2009-07-22 17:55:19], Prev reset 0 [20 09-07-22 17:00:00] Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NA S-Port" } Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/det ail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking session {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 192.168.1.78 port = 1812 } listen { type = "acct" ipaddr = 192.168.1.78 port = 1813 } Listening on authentication address 192.168.1.78 port 1812 Listening on accounting address 192.168.1.78 port 1813 Listening on proxy address 192.168.1.78 port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.80 port 8504, id=65, length= 69 User-Name = "test" CHAP-Password = 0x021457cf2419b9ff168b9d6460759a7f8b Service-Type = Framed-User Framed-Protocol = PPP NAS-IP-Address = 192.168.1.80 NAS-Port = 4 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 160 [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radchec k WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE usern ame = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radrepl y WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE usern ame = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE use rname = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test' ORDER BY prio rity rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group authenticate {...} [chap] login attempt by "test" with CHAP password [chap] Using clear text password "test" for user test authentication. [chap] chap user test authenticated succesfully ++[chap] returns ok Login OK: [test/<CHAP-Password>] (from client iacsras.com port 4) Sending Access-Accept of id 65 to 192.168.1.80 port 8504 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 65 with timestamp +66 Ready to process requests. Thanks & Regards Amritap Sinha

2 1

RE: Freeradius-Users Digest, Vol 51, Issue 94
by Hanno Schupp 22 Jul '09

22 Jul '09

I basically got it working, but need to compile a new image as the Nanostation requires some extra settings. The standard config runs it as a bridge or station and not a s a standalone Access Point connected to a modem. However, to run Chillifire we need the Nanostation running like an Access Point (other wise it can be just a transparent bridge (or wireless repeater). I saw it has a lot of wireless settings as well, including antenna type and direction. So the nut has been cracked in principle but now requires a bit of fine tuning to work 'out of the box'. Cheers Hanno -----Original Message----- From: freeradius-users-bounces+hanno.schupp=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+hanno.schupp=gmail.com@lists.freeradius.org ] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Wednesday, 22 July 2009 10:00 p.m. To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 51, Issue 94 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..."

2 1

Problem with proxied accounting
by Cristina Miyata 22 Jul '09

22 Jul '09

Dear FreeRADIUS Users, We are using Freeradius 2.1.1 and we send accounting RADIUS to 2 different servers called Server1 and Server2. In order to do so, we created two proxy servers and 3 detailed accouting logs: detail (stored in the server), detail1 (processed by the proxy server that send accounting to Server1) and detail2 (processed by the proxy server that send accounting to Server2). For a while, the proxy serves works fine. Then one of them starts logging reject request due to lack of any response from home server <Server1 IP address> port 1813: Tue Jul 21 22:03:29 2009 : Error: Rejecting request 38447540 due to lack of any response from home server <Server1 IP address> port 1813 Tue Jul 21 22:03:29 2009 : Error: PROXY: Marking home server <Server1 IP address> port 1813 as zombie (it looks like it is dead). The proxy server for Server2 also stops working from time to time, but doesn't log any errors in "radius.log" file. The details file for the proxy gets larger and larger, and it seems to be consumed very very slowly (can see accounting being sent to Server2) or not consumed (simply stops sending accouting to Server2) by the proxy server: total 4265476 -rw------- 1 root root 1246037041 Jul 20 23:59 detail-20090720 -rw------- 1 root root 3117400401 Jul 21 21:49 detail-20090721 -rw------- 1 root root 107664 Jul 20 16:59 detail.work Server's CPU utilization is low and memory utilization is high (4GB in use and 33MB free). Does anyone has a clue what is going on with our FreeRADIUS? Really don't know what to do. Appreciate any help. Thanks, Cristina Miyata

2 1

Re: Connecting freeRadius to openLDAP
by Eric Bourkland 21 Jul '09

21 Jul '09

Yes, I am trying to do MSCHAPv2 from the laptop. If the below is true why am I able to do a successful Radtest user password server 0 secret on the radius server? I believe the password is plain text but I'm not 100% positive, I am able to connect other software such as Confluence to it with open passwords. Thanks, ----- Original Message ----- From: "Phil Mayers" <p.mayers(a)imperial.ac.uk> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Tuesday, July 21, 2009 12:35:42 PM GMT -05:00 US/Canada Eastern Subject: Re: Connecting freeRadius to openLDAP Eric Bourkland wrote: > I can attach any of my config files but what I have done is rebuilt a > whole new server RHEL4.7-ES, with freeRadius v2.1.6 installed. with In all probability, your LDAP database either: 1. Does not contain the plaintext password, or NT/LM hash. 2. Does not give the plaintext password or NT/LM hash to FreeRadius because of LDAP ACLs. ...and you are trying to do PEAP/MSCHAPv2. If so, you need to correct this, because PEAP/MSCHAPv2 requires either: 1. FreeRadius have the plaintext password 2. FreeRadius have the NT/LM hash 3. FreeRadius be able to call an RPC on a domain controller (via the "ntlm_auth" helper config option on the "mschap" module) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

Connecting freeRadius to openLDAP
by Eric Bourkland 21 Jul '09

21 Jul '09

I'm relatively new to freeRadius and I'm getting very frustrated trying to get it to Authenticate with my openLDAP, I'm sure it is a small configuration change but I can't find where it is and I'm beating my head against a wall. FreeRadius does not "just work" as the instructions imply. All I am trying to do is setup my freeRadius so that you have to authenticate from a laptop to the 802.11. I can attach any of my config files but what I have done is rebuilt a whole new server RHEL4.7-ES, with freeRadius v2.1.6 installed. with this install all I have done is changed the ldap module file to point to my ldap file and uncommented LDAP in the Authorize and Authenicate sections from /sites-available/default and added my Access point to the clients file. I've read this in the various instructions found over the internet and it is supposed to just work. After I've made these changes I can successfully "Access-Accept" using radtest on the server and if I add a test user to the Users file I can "Access-Accept" from my laptop all the way through the router and gain access but I cannot get an ldap user to authenticate through. I have tried various things such as changing default-eap-type to peap in eap.conf Since I tried a few other options to get it to work that is why I built a whole new server to start from scratch since it sounds like making changes is a bad idea. What config files or debugging should I post to try and get some assistance on this issue. Thanks,

2 1

how send more parameters?
by Tony P. 21 Jul '09

21 Jul '09

need send to check values like calling-station-id ?? just use by default radtest virtual-radius:~# radtest emperor 123 localhost 1 testing123 Sending Access-Request of id 209 to 127.0.0.1 port 1812 User-Name = "emperor" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Framed-Protocol = PPP Re-sending Access-Request of id 209 to 127.0.0.1 port 1812 User-Name = "emperor" User-Password = "123" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Framed-Protocol = PPP rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=209, length=20 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=209, length=20 radclient: received response to request we did not send. i use auth into ldap and account into mysql and works.. now need send more parameters like calling-stations-id or session-time.. how can i do that like test radclient virtual-radius:~# radclient localhost acct testing123 Acct-Session-Id = "6000006B" User-Name = "emperor" NAS-IP-Address = 192.168.3.5 NAS-Port-Id = 1 NAS-Port = 1 NAS-Port-Type = Async Acct-Status-Type = Start Connect-Info = "46000 LAPM/V42BIS" Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.5.66 Acct-Delay-Time = 0 Received response ID 183, code 5, length = 20 regards Tony

3 2