- Freeradius-Users - lists.freeradius.org

VMPS compile error with freeradius-server-2.1.4
by Christopher Sheldon 25 Mar '09

25 Mar '09

Hello I'm getting a compile error with 2.1.4 when building --without-vmps The issue looks to be src/main/listen.c:1795. It seems to be missing the #ifdef WITH_VMPS and the accompanying #endif. Sorry if this has been mentioned before. Thanks, Chris. -- csh(a)ninex.net

2 1

custom sql query
by Sandra H. 25 Mar '09

25 Mar '09

Hello, We have a database that contains usernames and password that we want to auth from using a web app we have. I have tried all kinds of config's in the sql.conf file and still get fails I have turned on sqltrace and here is the error we currently get, its not much... rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 Right now to retrieve username and password...(sql script) we use this from sql query select Username, Password from Contact where length(Username) > 0; How do I slap that into sql.conf to make it work for simply just username/password auth? Any help would be appreciated.

3 2

Re: SAML support for freeRadius
by ALVAREZ SANTANA, LUIS MIGUEL 25 Mar '09

25 Mar '09

Hi Stefan and everybody I´m trying to get an architecture of federation-id in which are involved, layer 2 communications, RADIUS (like FreeRadius) and IdP server, but I have some doubts about it. Searching for information I read this thread, and I decided claim for help.I´m really interested in scenarios 2&3 which were described before > 2) a user logs in with a non-SAML credential. FreeRADIUS should be able > to use a SAML-enabled backend to verify these credentials. > 3) a user logs in with a non-SAML credential. FreeRADIUS uses a non-SAML > backend, but transports a SAML assertion to the user which the user can > later use to enter SAML-enabled resources. In fact, what I was wondering is if it would be possible a mixture between secenarios 2 and 3, I mean, a user logs in with a non-SAML credential (x509 certificate), FreeRADIUS verify the credentials in a SAML-enabled backend (IdP), AND transports a SAML assertion to the user which the user can later use to enter SAML-enabled resources. ¿Is there any way for getting a succesful "SAML-conversation" between FreeRADIUS and an IdP, in which the assertions were sent to FreeRADIUS and since there to the client (in layer 2)? As regards to the use of a layer 2 protocol/method to send SAML attributes, I´ve heard about DAIDALOS that uses PEAPv2 to send and receive SAML assertions between the edges of an EAP layer 2 communication. I´m not sure the latter is contradictory with your previous answer > In that case though, the equally sad answer is that > there is no defined transport to send SAML within RADIUS. What you'd > need then is a means to send SAML payloads in RADIUS attributes. The > most logical way of doing so would be some kind of "EAP-SAML" - but such > a thing doesn't exist as an IETF standard today. So if authenticating > via SAML assertions is something you want to do - please present your > use case loudly to IETF people - they might listen and get going :-) Does it mean that is not possible send SAML assertions in any EAP-method, or only has to do with SAML payloads in RADIUS attributes? Thank you very much for your attention and sorry for that awful English language that I have. Greetings Luis M. Álvarez -- Universidad Carlos III de Madrid

1 0

problem with ldap authentication
by Frank Bonnet 25 Mar '09

25 Mar '09

hello I'm in trouble with a debian version of freeradius I've installed chillispot and freeradius packages but it won't work for LDAP users it fails with such error messages : Mon Mar 23 16:41:05 2009 : Auth: Login incorrect: [xxxxxxxx/<CHAP-Password>] (from client localhost port 31 cli 00-13-02-AE-F1-01) Any help/idea welcome Thanks you .

5 24

copy-acct-to-home-server
by Emmanuel Rafaralahisoa 25 Mar '09

25 Mar '09

Hi all, I wish to configure 1 proxy radius server and 2 backend radius servers. One backend server is the real database for aauth and billing. The other one is inside a traffic shapper. I want to duplicate all accounting packets to this trafic shapper. After reading many times the proxy.conf and /sites-availables files, I can not forward all request to the traffic shaper until now. Does someone has a clear example for this kind of configuration? Regards. Emmanuel Rafaralahisoa Data Telecom Service.

3 6

Seqfault with multiple
by JDL 25 Mar '09

25 Mar '09

Hello to Alan and the rest of the list. I wanted to report this to the bug tracker but it appears to be down right now so I am sending it to the list. I had a situation where I needed to remove all of the attributes from a reply except for Service-Type to one specific client. Unlang seemed to be perfect for this. It should be as simple as the following. if (Client-IP-Address == "192.168.10.20") { update reply { Framed-Protocol == '' Framed-IP-Address == 0.0.0.0 Framed-IP-Netmask == 0.0.0.0 Idle-Timeout == 999 Session-Timeout == 999 Port-Limit == 999 Cisco-AVPair == '' Service-Type := Authenticate-Only } } However, when I try to do this, radiusd segfaults when attempting to run this block. I tried several tests and I could sometimes get up to two lines with "==" operators in an update block to work. However, adding more than two or three would cause a segfault. I was finally able to use the following workaround under 2.1.4. This workaround did not work under 2.1.3. if (Client-IP-Address == "192.168.10.20") { update reply { Framed-Protocol == '' } update reply { Framed-IP-Address == 0.0.0.0 } update reply { Framed-IP-Netmask == 0.0.0.0 } update reply { Idle-Timeout == 999 } update reply { Session-Timeout == 999 } update reply { Port-Limit == 999 } update reply { Cisco-AVPair == '' } update reply { Service-Type := Authenticate-Only } } My system is CentOS 5.2 32-bit. Hope this helps. Thanks, Jim L.

3 5

FreeRADIUS / ippool / Wireless
by Tim Gustafson 25 Mar '09

25 Mar '09

Hi, I'm using FreeRADIUS 2.1.3 on FreeBSD 7.1 to authorize users on my Cisco 1200 WAPs. I was wondering if it is possible to use ippools to assign client IPs rather than having them use DHCP, and I Googled around a bit and found a message that said this can't be done. I was curious if it can't be done because it's just something that fundamentally cannot work, or was it something that couldn't be done at the time, but perhaps can be done now or in the future? If it can't be done, I would love to hear any feedback people have about how to map wireless users to IP addresses. Has anyone else figured out a way to be able to record this kind of data without resorting to matching MAC addresses from the radius accounting records with data in a DHCP server log? Tim Gustafson BSOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 1

monitoring FR's EAP/PEAP capabilities...
by sth 24 Mar '09

24 Mar '09

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi there, Has anyone written code to test FR's EAP/PEAP functionality that would work with MS-CHAPv2? I see that 'radeapclient' will do MD5, but need to monitor FreeRADIUS talking to its oracle though rlm_mschap. Something that tested just MS-CHAPv2 would be fine, too, although it seems like rlm_mschap only ever exists inside EAP in the standard FR configs. I'm just looking to see if attempting to write something like this would constitute "reinventing the wheel". (FreeRADIUS 2.1.3 on RHEL 4.7; rlm_mschap modified to work with the unfortunately-named KCRAP[1].) Cheers, - -sth [1] http://www.spock.org/kcrap sam hooker|sth@noiseplant.com|http://www.noiseplant.com I have received the love Internet dispatch. -spam -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAknJOboACgkQX8KByLv3aQ2sxgCgn4/oh9/obWTL+VnCVKjYOlGB QxcAnRxrlz4hbEXbdy4CB3WQOub6rZR/ =XdxX -----END PGP SIGNATURE-----

2 1

Windows Authentication and Authorization via LDAP on FreeRadius v 2.1.4 Configuration Help!!!
by Edwin Isada 24 Mar '09

24 Mar '09

Hello All, Excuse me for my lack of knowledge with Linux and FreeRadius. I hardly have any experience and I've been using version 1.1.3 for the past few weeks and had authentication working properly for Cisco devices. I decided to install the latest version 2.1.4 and forgot to save all my configuration for 1.1.3. Hopefully I'll learn my lesson next time =) The radiusd.conf file from what I recall looks totally different. I inserted my ldap information in the modules section, but running the basic debug I'm seeing an error "No authenticate method (Auth-Type). Even running the recommended radtest it's failing in reviewing the debug. I believe I'm missing authenticate config. If so do I need to modify another file or add it to radiusd.conf? I'm a little lost here if someone can point me the right direction and hopefully I can proceed with getting authorization working afterwards. Let me know if you need any additional information. I've added the debug info below. Another quick question has anyone configured this for F5 devices? rad_recv: Access-Request packet from host 127.0.0.1 port 1027, id=254, length=56 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [test] (from client localhost port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 254 to 127.0.0.1 port 1027 Waking up in 4.9 seconds. Cleaning up request 0 ID 254 with timestamp +783 Thanks, Ed

4 6

CHAP authentication issue
by Alan Cooper 24 Mar '09

24 Mar '09

I am trying to migrate from a working Freeradius 1.1.3 installation to a 2.1.x (currently trying .4) and I'm hitting problem getting CHAP authentication to work. I use the users file to authenticate DSL users via a Cisco LNS device - chap doesn't think it's getting the password from the users file in plaintext. My users file entry looks like this: # saf1975(a)lumisondsl2.co.uk ADSL: saf1975 Cleartext-Password = "mypassword", NAS-IP-Address = 193.29.223.253 Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 84.19.252.194, Framed-IP-Netmask = 255.255.255.255, Cisco-AVPair = "ip:dns-servers=212.20.226.130 212.20.226.194", Cisco-AVPair += "ip:route#1=84.19.253.96 255.255.255.224 84.19.252.194", Cisco-AVPair += "ip:route#2=84.19.255.64 255.255.255.224 84.19.252.194", Cisco-AVPair += "ip:route#3=217.30.117.96 255.255.255.248 84.19.252.194" As I'm dealing with multiple domains, I strip out the domain names coming in from the LNS in proxy.conf. Can anyone explain why CHAP isn't getting a plaintext password and what I need to do to resolve? It appears to come through plaintext to the other 1.1.3 server... Debug output:- Ready to process requests. rad_recv: Access-Request packet from host 193.29.223.253 port 1645, id=8, length=123 Framed-Protocol = PPP User-Name = "saf1975(a)lumisondsl2.co.uk" CHAP-Password = 0x015912a2d9f792df9c9b61107520a7967d NAS-Port-Type = Virtual NAS-Port = 2208 NAS-Port-Id = "Uniq-Sess-ID2208" Connect-Info = "1696000" Service-Type = Framed-User NAS-IP-Address = 193.29.223.253 +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] Looking up realm "lumisondsl2.co.uk" for User-Name = "saf1975(a)lumisondsl2.co.uk" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "saf1975" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' Invalid operator for item Group: reverting to '==' [files] users: Matched entry DEFAULT at line 22474 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "saf1975" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Login incorrect (rlm_chap: Clear text password not available): [saf1975(a)lumisondsl2.co.uk/<CHAP-Password>] (from client dsl-gw port 2208) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> saf1975(a)lumisondsl2.co.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 8 to 193.29.223.253 port 1645

2 3