- Freeradius-Users - lists.freeradius.org

Windows Authentication and Authorization via LDAP on FreeRadius v 2.1.4 Configuration Help!!!
by Edwin Isada 24 Mar '09

24 Mar '09

Hello All, Excuse me for my lack of knowledge with Linux and FreeRadius. I hardly have any experience and I've been using version 1.1.3 for the past few weeks and had authentication working properly for Cisco devices. I decided to install the latest version 2.1.4 and forgot to save all my configuration for 1.1.3. Hopefully I'll learn my lesson next time =) The radiusd.conf file from what I recall looks totally different. I inserted my ldap information in the modules section, but running the basic debug I'm seeing an error "No authenticate method (Auth-Type). Even running the recommended radtest it's failing in reviewing the debug. I believe I'm missing authenticate config. If so do I need to modify another file or add it to radiusd.conf? I'm a little lost here if someone can point me the right direction and hopefully I can proceed with getting authorization working afterwards. Let me know if you need any additional information. I've added the debug info below. Another quick question has anyone configured this for F5 devices? rad_recv: Access-Request packet from host 127.0.0.1 port 1027, id=254, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [test] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 254 to 127.0.0.1 port 1027 Waking up in 4.9 seconds. Cleaning up request 0 ID 254 with timestamp +783 Thanks, Ed

4 6

CHAP authentication issue
by Alan Cooper 24 Mar '09

24 Mar '09

I am trying to migrate from a working Freeradius 1.1.3 installation to a 2.1.x (currently trying .4) and I'm hitting problem getting CHAP authentication to work. I use the users file to authenticate DSL users via a Cisco LNS device - chap doesn't think it's getting the password from the users file in plaintext. My users file entry looks like this: # saf1975(a)lumisondsl2.co.uk ADSL: saf1975 Cleartext-Password = "mypassword", NAS-IP-Address = 193.29.223.253 Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 84.19.252.194, Framed-IP-Netmask = 255.255.255.255, Cisco-AVPair = "ip:dns-servers=212.20.226.130 212.20.226.194", Cisco-AVPair += "ip:route#1=84.19.253.96 255.255.255.224 84.19.252.194", Cisco-AVPair += "ip:route#2=84.19.255.64 255.255.255.224 84.19.252.194", Cisco-AVPair += "ip:route#3=217.30.117.96 255.255.255.248 84.19.252.194" As I'm dealing with multiple domains, I strip out the domain names coming in from the LNS in proxy.conf. Can anyone explain why CHAP isn't getting a plaintext password and what I need to do to resolve? It appears to come through plaintext to the other 1.1.3 server... Debug output:- Ready to process requests. rad_recv: Access-Request packet from host 193.29.223.253 port 1645, id=8, length=123 Framed-Protocol = PPP User-Name = "saf1975(a)lumisondsl2.co.uk" CHAP-Password = 0x015912a2d9f792df9c9b61107520a7967d NAS-Port-Type = Virtual NAS-Port = 2208 NAS-Port-Id = "Uniq-Sess-ID2208" Connect-Info = "1696000" Service-Type = Framed-User NAS-IP-Address = 193.29.223.253 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "lumisondsl2.co.uk" for User-Name = "saf1975(a)lumisondsl2.co.uk" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "saf1975" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' [files] users: Matched entry DEFAULT at line 22474 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "saf1975" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [saf1975(a)lumisondsl2.co.uk/<CHAP-Password>] (from client dsl-gw port 2208) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> saf1975(a)lumisondsl2.co.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 8 to 193.29.223.253 port 1645

2 3

modules instance name restrictions
by Thibault Le Meur 24 Mar '09

24 Mar '09

Hi, I recently came up with a small issue concerning modules instances name (especially when they set Auth-Type). * I defined my own pap module with the name 'pap-myorg' and expected it to set Auth-Type to PAP-MYORG, but in fact it wasn't setting the Auth-Type at all (moreover I saw no notice in the log about not beeing able to set the Auth-Type). * I changed the instance name to 'papmyorg' and now the module sets the Auth-Type to PAPMYORG. I tried to find in the doc where the restrictions on module instances names were defined, but didn't found any reference to this. And given the fact that some standard modules have specific chars such as '_' or '-', I thought there was little constraints. Is there any module instance naming convention written somewhere in the provided documentation (or online)? Maybe be it could be interresting to have a warning in the radius debug log in order to notice the administrator that Auth-Type wasn't set due to module naming restrictions? Best regards, Thibault

2 1

PAM-Radius authentication issue on Ubuntu 7.4: can not authenticate SSH users not present in /etc/passwd
by Hu, Fengliang (Procurve Networking) 24 Mar '09

24 Mar '09

Hi, I was trying to find a PAM-Radius mailing list and it seems that this is the best one. A Ubuntu 7.4 box needs to be configured such that SSH users will be authenticated against an external FreeRadius server. FreeRadius server version is 1.1.7-1build4. The Ubuntu box uses OpenSSH 4.3-p2 and /etc/ssh/sshd_config is set to "UsePAM yes". I downloaded PAM_Radius 1.3.17. Below is the procedure that I use Radius to authenticate a user in /etc/passwd (/etc/shadow doesn't have the password for that user). 1. FreeRadius server configures its clients.conf and user file to include a new user called "test1". 2. On my Ubuntu 7.4 box, add a user with command "useradd" to add a user "test1" but don't set a password. So the user "test1" on the Ubuntu box will be inactive. 3. Configure /etc/pam.d/ssh on the Ubuntu box to use "auth sufficient pam_radius_auth.so" 4. Also update the /etc/raddb/server on the Ubuntu box to point to the remote Radius server IP. 5. Try ssh test1@ubuntu box and it worked. Also monitored the Free Radius logging and it did show that the Access-Request packets went to Radius server. So step 1-5 worked well for me. Note that at step 2, the user account to be authenticated is added to /etc/passwd. The issue is: if step 2 is omitted, SSH login will fail. ACCESS_REQUEST packets with INCORRECT password were even sent to the Radius server. Further troubleshooting showed that PAM_Radius module got a bad password from PAM. I did some research from the website and some emails dated in 2006 said that PAM_Radius can only authenticate user accounts in /etc/passwd file. Is that right? Many thanks in advance, Feng

2 1

PAM module unknown
by Robert Svensson 24 Mar '09

24 Mar '09

Hi, I can compile the FreeRADIUS PAM module without any errors. But when I try to use it I always get a module unknown error. For example: AUTH-PAM: BACKGROUND: user 'john' failed to authenticate: Module is unknown This is how I compiled the module: gcc -fPIC -c pam_radius_auth.c gcc -shared -o pam_radius_auth.so pam_radius_auth.o -lpam What did I do wrong?

1 0

RE: fake user and unregistered user forwarding
by Ümit AYDINLI(Teknotel) 24 Mar '09

24 Mar '09

Hi, First, Sorry for bad English. I need a idea.Im using freeradius on cisco equipment and mrtg tool. Remote users are come other virtual-access interface.Cannot receve remote users data traffics. How can do assign static virtual-access interface on remote users.That is possible? Regards.

2 3

Expiration vs WISPr-Session-Terminate-Time
by Santiago Balaguer García 24 Mar '09

24 Mar '09

Hi, Today I did some test with radreply.WISPr-Session-Terminate-Time and radcheck.Expiration. It is supposed both attributes do the same, but Expiration is from AAA server side, meanwhile Session-Terminate-Time is from NAS side. However, there is a difference if you want to to set a username with Session-Timeout (johndoe, Session-Timeout, :=, 3600) since the NAS rewrite the Session-Timeout according to the Date in Session-Terminate-Time. This behaviour does not happen with Expiration attribute. Do you confirm this? _________________________________________________________________ ¿Quieres ver los mejores videos de MSN? Enciende Messenger TV http://messengertv.msn.com/mkt/es-es/default.htm

1 0

Re: freeRaidus-PAM:: .so file error
by krishna Mohan 24 Mar '09

24 Mar '09

> Why are you developing something for a server version years out of date??? Why not use current version? Read doc/bugs about how to debug this.One of the products am working with is using FR 1.1.5The same .so library is working for another FR1.1.5 which is compiled.pamtester is displaying segmentation fault soon after invoking pam_start().Thanks,Sri.

1 0

How to log failed login attempts?
by bastardinho69 24 Mar '09

24 Mar '09

Hi, i am using FreeRADIUS 2.0.5. Successfull logins into cisco routers are logged great (using Accounting), but i need to log also the failed attempts. In /var/log/radius.log radius does log the failed attempts, BUT if in clients.conf i have created client as 10.0.0.0/8 (a network, not a host), then in the log file i will see the NAS ip address 10.0.0.0/8, which is not enough. I need to see the exact NAS ip address. It would be insane to add every single router into the clients.conf file, so i assume there is a way how to solve this. I hope u guys can help me, i will appreciate it ;) Thanks.

2 1

freeRaidus-PAM:: .so file error
by krishna Mohan 24 Mar '09

24 Mar '09

Hi,Am using freeradius 1.1.5 with pam configured.Wrote my pam application (mypam.so) file and trying to authenticate a user.No compilation errors while generating .so library.But getting "segmentation fault" error radiusd is executing a request.Btw,I have two setups; one with source compiled (fr1.1.5-tar.gz) and other rpm installed (fr1.1.5-i386.rpm). The generated .so is working perfectly with setup1.Earlier, got "PAM unable to resolve symbol: pam_sm_authenticate PAM unable to resolve symbol: pam_sm_setcred" error.  Added two dummy routines for both pam_sm_authenticate() and pam_sm_setcret(), to the pam auth module, so that they always return success.radiusd -X output:-------------------rad_recv: Access-Request packet from host 127.0.0.1:32768, id=19, length=46        User-Name = "john90"        User-Password = "password"  Processing the authorize section of radiusd.confmodcall: entering gr! oup authorize for request 0  modcall[authorize]: module "preprocess" returns ok for request 0radius_xlat:  '/var/log/radius/radacct/detail-20090324'rlm_detail: /var/log/radius/radacct/detail-%Y%m%d expands to /var/log/radius/radacct/detail-20090324  modcall[authorize]: module "detail" returns ok for request 0radius_xlat:  'john90'rlm_sql (sql): sql_set_user escaped user --> 'john90'radius_xlat:  'SELECT id,UserName,Attribute,AES_DECRYPT(Value,'IMAGRadSqlKey'),op FROM radcheck WHERE Username = 'john90' ORDER BY id'rlm_sql (sql): Reserving sql socket id: 3radius_xlat:  'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op  FROM radgroupcheck,usergroup WHERE usergroup.Username = 'john90' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id'radius_xlat:  'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'john90' ORDER BY id'radius_xlat:&n! bsp; ''rlm_sql (sql): Released sql socket id: 3  modcall[authoriz e]: module "sql" returns ok for request 0rlm_pap: Found existing Auth-Type, not changing it.  modcall[authorize]: module "pap" returns noop for request 0modcall: leaving group authorize (returns ok) for request 0  rad_check_password:  Found Auth-Type pamauth: type "PAM"  Processing the authenticate section of radiusd.confmodcall: entering group authenticate for request 0pam_pass: using pamauth string <radiusd> for pam.conf lookupSegmentation faultAppreciate your help in resolving this.

2 1