- Freeradius-Users - lists.freeradius.org

sshd authentication
by maxim maxim 23 Jun '09

23 Jun '09

i try to do sshd authentication to external radius through a pam. on my linux i have freeradius client my packages: pam 1.0, pam_radius-1.3.17, openssh-4.3p2, freeradius-client-snapshot-20080830 my /etc/pam.d/sshd look like this: #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so auth include system-auth #auth sufficient /lib/security/pam_radius_auth.so account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so My shared secret is configured in /etc/raddb/server file. The radiusclient.conf configured too sshd_config file: # $OpenBSD: sshd_config,v 1.73 2005/12/06 22:38:28 reyk Exp $ # This is the sshd server system-wide configuration file. See # sshd_config(5) for more information. # To disable tunneled clear text passwords, change to no here! PasswordAuthentication no ChallengeResponseAuthentication yes UsePAM yes Subsystem sftp /home/max/openssh-4.3p2/pc86//libexec/sftp-server when i try to connect to sshd i have log message of wrong password, i check it too on side of radius server.

2 2

Re : Radius+Huwaei switch + auto VLan Assignment issue
by Attou eric 23 Jun '09

23 Jun '09

Thanks very much for your answers. In our eap section, we had the following : copy_request_to_tunnel = no use_tunneled_reply = no Since we change these to : copy_request_to_tunnel = yes use_tunneled_reply = yes The Access-Accept message send VLAN attributes as below : Sending Access-Accept of id 43 to 192.168.100.5 port 5001 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Private-Group-Id:0 = "2" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN User-Name = "toto" MS-MPPE-Recv-Key = 0x69f0f1c436ccbe11df23099070ca2c3ceb6116c3246344a8d2c78c96a68fa146 MS-MPPE-Send-Key = 0x6aad292ef955ae61e910e51a9ae7d2b903f5e123c48dc4cc0e12f713490d2aa3 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Mon Jun 22 16:08:39 2009 : Debug: Finished request 10. Mon Jun 22 16:08:39 2009 : Debug: Going to the next request Mon Jun 22 16:08:39 2009 : Debug: Waking up in 4.0 seconds. Unfortunatly, the switch still not switching the port from VLAN 1 to VLAN 2. Maybe there is other misconfigurations on our switch or another settings in radius configurations ? Any ideas to help please! Best regards. ________________________________ De : "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 22 Juin 2009, 11h29mn 47s Objet : Re: Radius+Huwaei switch + auto VLan Assignment issue hi, have you set the copy tunnel = yes for the PEAP section in eap.conf? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 6

Help needed : dynamic pooling not working properly
by josgeorge thaikudathil 23 Jun '09

23 Jun '09

Hi , i am getting dynamic ip's but ip is not assigned from the pool i given .Can you please give me some suggestion i had given *ippool main_pool {* * # range-start,range-stop: The start and end ip # addresses for the ip pool range-start =10.143.71.15 range-stop =10.143.71.25* ** But i got output as Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Framed-IP-Address = 192.168.2.40 and i found this ips will varies with nas port -- Thanks and regards Jos george. 9844459056

1 0

Acct Output and Input Gigawords
by Eric 23 Jun '09

23 Jun '09

Hi, RFC2869 says that Input and Output gigaword shoud be sent from NAS to radius server. Now new versions of freeradius support gigaword. Should NAS supports gigaword?

2 1

Any free Java APIs to access freeRadius server?
by kpani 22 Jun '09

22 Jun '09

Hi, I am using freeRadius server for authentication. I am able to authenticate for ssh login. I want to authenticate my java application using radius server. Is there any java libraries/APIs available to access and authenticate directly. Please advise me. Thanks in advance. Regards, Dhandapani -- View this message in context: http://www.nabble.com/Any-free-Java-APIs-to-access-freeRadius-server--tp241… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 5

rlm_python - Unresponsive child
by Mike Tkachuk 22 Jun '09

22 Jun '09

Hello Freeradius-users, I'm trying to use Freeradius 2.1.6 release with rlm_python (python 2.6.2) on FreeBSD. I use default radiusd_test.py bundled with rlm_python. All is fine when I start radius in debug mode with -X, however in normal forked mode next error appear: Error: WARNING: Unresponsive child for request 0, in module python component authenticate < few seconds later > Info: [python] Child is still stuck for request 0 Any ideas what can be wrong? How to debug this? And is rlm_python ok for commercial productional environment? What other problems I can face? Thanks. -- Mike Tkachuk

3 6

NAS-IP-Address modified during Access-Request process
by kevin leblanc 22 Jun '09

22 Jun '09

Hi everybody, I have a big problem in freeradius installed in version 1.1.4 on RHEL 5, and today it's the third day i'm looking for a solution :( Here is the problem: I configured Freeradius to look in openldap directory to auth and auth an user. The authentication phase is OK During the auth phase, a ldap search is done : if the user is member of a group identified by the host ip he wants to connect, the user is authorized. The problem is here : freeradius receives an Access-Request packet with a NAS-IP-Address (the good one) and to search in the ldap, it doesn't send the ip received in the packet but another one ! Why this attribute is modified ? Is there any cache (the other ip comes from another equipment) ? Thanks for any helpful idea Here are /etc/raddb/users (I also tried with ldap-group == "%{NAS-IP-Address}" ) -------------------------------------------------------- DEFAULT ldap-group == "%{Client-Ip-Address}", Auth-Type := LDAP Service-Type = 1, Fall-Through = no DEFAULT Auth-Type := Reject Fall-Through = no, Reply-Message = "You are not authorized to log in to this host :(" -------------------------------------------------------- /etc/raddb/clients.conf -------------------------------------------------------- client 126.50.0.0/8 { secret = secretsecret shortname = shortname } -------------------------------------------------------- radius LOG (with radiusd -X) -------------------------------------------------------- rad_recv: Access-Request packet from host *126.50.0.148*:1645, id=17, length=82 NAS-IP-Address = *126.50.0.148* NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "testadmin" Calling-Station-Id = "XX.XX.XX.XX" User-Password = "XXXXXXXXX" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=example,dc=com' radius_xlat: '(uid=testadmin)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testadmin) rlm_ldap: ldap_search() failed: LDAP connection lost. rlm_ldap: Attempting reconnect rlm_ldap: attempting LDAP reconnection rlm_ldap: closing existing LDAP connection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as uid=radius,ou=applications,dc=example,dc=com/radiuspass to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testadmin) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (&(cn=* 126.50.0.147* )(|(&(objectClass=GroupOfNames)(member=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=uid\3dtestAdmin\2cuid\3dtest01\2cou\3dusers\2cdc\3dexample\2cdc\3dcom)))) rlm_ldap::ldap_groupcmp: User found in group 126.50.0.147 rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 4 rlm_ldap: - authorize rlm_ldap: performing user authorization for testadmin radius_xlat: '(uid=testadmin)' radius_xlat: 'dc=example,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=example,dc=com, with filter (uid=testadmin) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testadmin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: leaving group authorize (returns ok) for request 4 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 4 rlm_ldap: - authenticate rlm_ldap: login attempt by "testadmin" with password "XXXXXXXXX" rlm_ldap: user DN: uid=testAdmin,uid=test01,ou=users,dc=example,dc=com rlm_ldap: (re)connect to 127.0.0.1:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: starting TLS rlm_ldap: bind as uid=testAdmin,uid=test01,ou=users,dc=example,dc=com/XXXXXXXXX to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user testadmin authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 4 modcall: leaving group LDAP (returns ok) for request 4 Login OK: [testadmin/XXXXXXXXX] (from client petitnom port 1 cli 126.100.100.6) Sending Access-Accept of id 17 to 126.50.0.148 port 1645 Service-Type = Login-User Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... -------------------------------------------------------- -- KeV

2 3

RE: rlm_raw not included in compile
by Eric Geier 22 Jun '09

22 Jun '09

Thank you, Johan. I'll give it a try. > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of Johan Meiring > Sent: Monday, June 22, 2009 9:26 AM > To: FreeRadius users mailing list > Subject: Re: rlm_raw not included in compile > > Eric Geier wrote: > > Johan, > > > > I'm a Linux/freeradius newbie, and I don't understand what you meant > by "had > > to run autogen.sh first". > > > > I had to do the following: > > 1) dump rlm_raw in src/modules > 2) run "touch src/modules/rlm_raw/configure" from the freeradius source > root directory. > 3) run "./autoconf.sh" from the freeradius source root directory. > 4) I use debian so I edited debian/rules > looked for the "configure" line, and added: > --with-modules=rlm_raw \ > --with-experimental-modules \ > If you do a manual compile, add this to you configure line. > If you use something else, ask them how to add it to configure. > > > > I'm actually using 1.1.7.so I don't think I need to make the two > changes you > > mentioned. > > > > Also, what did you mean by "touch src/modules/rlm_raw/configure" and > "added > > rlm_raw to debian configure by editing debian/rules" in a previous > post? > > > > Thanks! > > Eric > > > >> -----Original Message----- > >> From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > >> [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] > On > >> Behalf Of Johan Meiring > >> Sent: Friday, May 29, 2009 12:16 PM > >> To: FreeRadius users mailing list > >> Subject: Re: rlm_raw not included in compile > >> > >> Alan DeKok wrote: > >>>> Does anyone have a clue how to add rlm_raw to the current git tar > >> file? > >>> $ tar -zxf freeradius-server-2.1.7.tar.gz > >>> << add rlm_raw >> > >>> $ tar -zcf freeradius-server-2.1.7.tar.gz freeradius-server-2.1.7 > >>> > >> It wasn't that simple because rlm_raw did not contain a configure > >> script. > >> > >> You had to run autogen.sh first. > >> > >> > >>>> PS:he rlm_raw I'm using comes from > >>>> http://lists.cistron.nl/pipermail/freeradius-devel/2005- > >> January/007873.html > >>> That was before version 2.0 was released. You'll likely have to > >>> update the module to use the new API's && header files in 2.0. > >>> > >> Using my "copy and paste" method of c coding (I know VERY little > about > >> c) I maneged to copy the code from the old rlm_raw into rlm_example. > >> > >> I needed to make two changes to get it to compile. > >> > >> 1) replace strNcpy with strncpy > >> 2) replace radlib_safeprint with fr_print_string > >> > >> It compiled and IT WORKS!!! > >> > >>> Alan DeKok. > >> > > > -- > > > Johan Meiring > Cape PC Services CC > Tel: (021) 883-8271 > Fax: (021) 886-7782 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - www.avg.com > Version: 8.5.339 / Virus Database: 270.12.87/2195 - Release Date: > 06/22/09 06:54:00

1 0

FreeRADIUS as a general authentication system
by Lloyd 22 Jun '09

22 Jun '09

Hi FreeRADIUS list, In our "system" there is a need for an authentication server. The required characteristics of the server are *) The authentication client will be a custom built one. It may be running on *NIX,Windows and Mac. Is it possible to write a client using the FreeRADIUS client library? (The client will have much more other functionalities, not related to authentication) *) Is it possible to extentd the server? As an example, in our case, each time a client wants to communicate with other clients, it will request a "session key" to the server, and the server will send the key to all clients which take part in the communication. (The aim of this is to encrypt the communication session with the new session key generated, so that only the clients who know the session key can decrypt the message) So, is it possible to introduce a key generation system as well as a "request interpretation" system to the FreeRADIUS server? *) Or is there a better way inplemented in FreeRADIUS to accomplish the above requirements? Thanks in advance, Lloyd ______________________________________ Scanned and protected by Email scanner

2 1

freeradius on 64 bits
by Rakotomandimby Mihamina 22 Jun '09

22 Jun '09

Hi all, I see FreeRADIUS is Debian packaged for amd64 http://packages.debian.org/search?keywords=freeradius&searchon=names&suite=… Are there limitations or known bugs about using it on x86_64 (intel/amd only)? -- Architecte Informatique: Administration Système, Recherche et Développement. Phone: +261 33 11 207 36

5 4