- Freeradius-Users - lists.freeradius.org

ownership change
by Norbert Wegener 14 Dec '08

14 Dec '08

Upgrading from 2.1.1 to 2.1.3 on a Suse10.2 system and restarting radiusd with the identical configuration showed the following message: We do not own /var/run/radiusd/radiusd.sock. ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 12. Dez 16:18 /var/run/radiusd/radiusd.sock That fits to the entries user = radiusd group = radiusd in radiusd.conf. Removing radiusd.sock and restarting radiusd solved the problem. 2.1.3 obviously changed the ownership: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 root radiusd 0 12. Dez 16:20 /var/run/radiusd/radiusd.sock Shouldn't the ownership still be radiusd.radiusd ? Norbert Wegener -- ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Norbert Wegener Siemens IT Solutions and Services GmbH & Co. OHG SIS GO GIO NW PSU2 Kruppstraße 16 D-45128 Essen Phone : +49 (0) 201 816-3116 Fax. : +49 (0) 201 816-5581284 mailto:norbert.wegener@siemens.com Siemens IT Solutions and ServicesGmbH & Co. OHG Offene Handelsgesellschaft, Sitz der Gesellschaft: München; Registergericht: München, HRA 69235; Geschäftsführende Gesellschafterin: Siemens Business Services Beteiligungs-GmbH, Geschäftsführer: Christoph Kollatz, Vorsitzender; Jürgen Frischmuth, Michael Schulz-Drost; Sitz der Gesellschaft: München; Registergericht: München, HRB 50462; Weitere Gesellschafter: Siemens Business Services Investment GmbH & Co. KG, Sitz der Gesellschaft: München; Registergericht: München, HRA 86893; Persönlich haftende Gesellschafterin der Siemens Business Services Investment GmbH & Co. KG: Siemens Business Services Beteiligungs-GmbH, Geschäftsführer: Christoph Kollatz, Vorsitzender; Jürgen Frischmuth, Michael Schulz-Drost; Sitz der Gesellschaft: München; Registergericht: München, HRB 50462 WEEE-Reg.Nr. DE 88294312

2 2

RE: freeradius not responding on machine specific IPs
by Jason Wittlin-Cohen 13 Dec '08

13 Dec '08

Kevin, The relevant line is: "> rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.)" The shared secret to authenticate a client to the RADIUS server (for RADIUS, not EAP traffic) is either not set, or you're using the wrong secret. By default there is no shared secret set for localhost. Edit clients.conf, search for 127.0.0.1. You'll find a line that looks like: ipaddr = 127.0.0.1 Now, add this line beneath: secret = secret Restart freeradius and try again. The message should go away. Remember, you're still going to get an access-reject response unless you setup the user account and password your authenticating with in the "users" file. Jason -- Jason Wittlin-Cohen Yale Law School, Class of 2010 jason.wittlin-cohen(a)yale.edu

3 4

FreeRADIUS and LDAP Groups
by Tim Gustafson 13 Dec '08

13 Dec '08

Now that I have FreeRADIUS authenticating users via MSCHAPv2 and the sambaNTPassword attributes, the next step in my project is to limit the system so that only users in certain user groups can log in. I'm using posixGroup groups, not groupOfNames or groupOfUniqueNames. In my modules/ldap files I have: groupname_attribute = "cn" groupmembership_attribute = "memberUid" groupmembership_filter = "(memberUid=%{Stripped-User-Name:-%{User-Name}})" In my users I have DEFAULT LDAP-Group == foo However, even with these configuration options set, anyone with a valid login and password can authenticate right now. In my "radiusd -X" I see: rlm_ldap: performing search in dc=blah, with filter (&(cn=foo)(memberUid=test)) rlm_ldap: object not found or got ambiguous search result But it then goes on the authenticate the user anyhow: rlm_ldap: user test authorized to use remote access I looked around on Google, and I see -lots- of stuff about configuring LDAP group checks, but I haven't found anything that's all too helpful right now. Is there some option that I have to set to tell the system to ignore a user that's not in the proper group? And then the follow-up question to this will be: is it possible to configure FreeRADIUS to check for membership in more than one group? Put another way, how can I let the system authenticate users in the "foo" group -or- in the "bar" group? Tim Gustafson SOE Webmaster UC Santa Cruz tjg(a)soe.ucsc.edu 831-459-5354

2 3

Sending Accounting Response
by Padam J Singh 13 Dec '08

13 Dec '08

Hello, According to the RFC 2866, it is possible to send back attributes to an accounting update packet sent from a NAS. What I have done is this: The authorization and authentication queries are basically calls to a stored procedure in postgres that returns a set of table type which contains the attribute, operator and value (for authorization), and encrypted password for authentication. I can write a stored procedure to return a set of attributes to send back in an accounting start/update/stop, but all the queries given as examples in the default dialup.conf are update queries that do not return any attribute. How do I configure the postgres module to return the attributes to the NAS? The NAS is an application I have written that parses all attributes sent back after an auth-request and acct-start/update/stop. Thanks, Padam -- PGP Id 9EED2E09

1 0

accounting bug in Mikrotik
by Santiago Balaguer García 12 Dec '08

12 Dec '08

Hi, I am working with freeradius and mikrotik gateway for a long time, but recently I detect in my PostgreSQL database, in radacct table some inconsistencies. First af all, I say that I have the standard configuration file (postgres.sql) for accounting queries. My problem is sometimes the field acctstoptime is full when the user is connected. I can see the user in my hotspot as alive session. What is my problem? the issue is all interim update queries are rejected because the SQL update query does not find the folloing SQL WHERE: AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND FramedIPAddress= '%{Framed-IP-Address}' AND AcctStopTime IS NULL because AcctStopTime = '<date>' When this field is fill in? Another thing is when the acctsopttime is not null, too the acctterminatecause = '' (it is a blank, instad of a NULL value) . Thanks. _________________________________________________________________ Descarga el nuevo Messenger, más divertido que nunca. http://download.live.com/

4 6

freeradius not responding on machine specific IPs
by kevin 12 Dec '08

12 Dec '08

I was loathe to ask a newbie question, but it appears I have one. How does one configure freeradius to listen on all IPs specific to a machine? I have a remote Ubuntu 7.10 server (32bit) which I want to use for authentication via freeradius. It (freeradius 1.1.6-2) installed all nice and is running properly in default config, or it would seem. I cannot get a response when a remote authenticate is made. When I ssh into the server, it appropriately responds to the following: > root@server3:/home/kevin# radtest fred wilma 127.0.0.1 1812 mysecret > Sending Access-Request of id 1 to 127.0.0.1 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > Re-sending Access-Request of id 1 to 127.0.0.1 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=1, length=20 > rad_verify: Received Access-Reject packet from client 127.0.0.1 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) When I try radtest on the network IP, it fails, as per: > root@server3:/home/kevin# radtest fred wilma 192.168.3.199 1812 mysecret > Sending Access-Request of id 5 to 192.168.3.199 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 > Re-sending Access-Request of id 5 to 192.168.3.199 port 1812 > User-Name = "fred" > User-Password = "wilma" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1812 etc... I have tried setting the listen in Radiusd.conf to be the network IP of the machine (x.x.3.199), but that gave the same results. Any thoughts on what this n00b is doing wrong? Thanks, Kevin

2 2

rpmbuild errors 2.1.3-0
by Andrew Long 12 Dec '08

12 Dec '08

I'm back again trying to build the latest into rpm for our CentOS 5.x servers. I have edited the spec file so Name: freeradius and repacked the tgz so it is freeradius-2.1.3.tar.gz but I get [along@host SPECS]$ rpmbuild -ba --nobuild freeradius.spec Processing files: freeradius-2.1.3-0 error: File not found: /var/tmp/freeradius-root/etc/pam.d/radius error: File not found: /var/tmp/freeradius-root/etc/logrotate.d/radiusd error: File not found: /var/tmp/freeradius-root/etc/rc.d/init.d/radiusd error: File not found by glob: /var/tmp/freeradius-root/etc/raddb/* error: File not found: /var/tmp/freeradius-root/usr/share/doc/freeradius-2.1.3 error: File not found by glob: /var/tmp/freeradius-root/usr/bin/* error: File not found: /var/tmp/freeradius-root/usr/share/freeradius error: File not found by glob: /var/tmp/freeradius-root/usr/lib/* error: File not found by glob: /var/tmp/freeradius-root/usr/share/man/*/* error: File not found by glob: /var/tmp/freeradius-root/usr/sbin/* error: File not found by glob: /var/tmp/freeradius-root/usr/include/freeradius/* error: File not found: /var/tmp/freeradius-root/var/log/radius error: File not found: /var/tmp/freeradius-root/var/log/radius/radacct error: File not found: /var/tmp/freeradius-root/var/run/radiusd Processing files: freeradius-debuginfo-2.1.3-0 error: Could not open %files file /home/along/rpmbuild/BUILD/freeradius-2.1.3/debugfiles.list: No such file or directory RPM build errors: File not found: /var/tmp/freeradius-root/etc/pam.d/radius File not found: /var/tmp/freeradius-root/etc/logrotate.d/radiusd File not found: /var/tmp/freeradius-root/etc/rc.d/init.d/radiusd File not found by glob: /var/tmp/freeradius-root/etc/raddb/* File not found: /var/tmp/freeradius-root/usr/share/doc/freeradius-2.1.3 File not found by glob: /var/tmp/freeradius-root/usr/bin/* File not found: /var/tmp/freeradius-root/usr/share/freeradius File not found by glob: /var/tmp/freeradius-root/usr/lib/* File not found by glob: /var/tmp/freeradius-root/usr/share/man/*/* File not found by glob: /var/tmp/freeradius-root/usr/sbin/* File not found by glob: /var/tmp/freeradius-root/usr/include/freeradius/* File not found: /var/tmp/freeradius-root/var/log/radius File not found: /var/tmp/freeradius-root/var/log/radius/radacct File not found: /var/tmp/freeradius-root/var/run/radiusd Could not open %files file /home/along/rpmbuild/BUILD/freeradius-2.1.3/debugfiles.list: No such file or directory BTW - my last build was via rpmbuild: $ rpm -qv freeradius freeradius-2.0.3-0 Thank you. And look forward to a few more questions... -- I never think of the future - it comes soon enough. - Albert Einstein

1 1

Forging a RADIUS request within a module
by Geoffroy Arnoud 12 Dec '08

12 Dec '08

Hi all, During authentication process, I need to send an Accounting-Start to a network equipment when the authentication is successful (when processing the Access-Request), before sending the Access-Accept back. Is it possible to create the Accounting-Request from inside a module and "post it" as an event, to let FreeRADIUS core manage processing/sending? If not, I will have to trigger an external radiusclient to do the job. Thanks for your answers. Geoff.

5 6

Re: domain security problem
by tnt＠kalik.net 12 Dec '08

12 Dec '08

>here is the debug: (user-test- who is not in domain Well, he was found in AD. And in that domain. And with correct password. >[mschap] expand: --domain=%{mschap:NT-Domain} -> --domain=TEST >[mschap] expand: --username=%{mschap:User-Name} -> --username=test >[mschap] mschap2: 10 > >[mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ad923676ac4c1b76 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2b4dda1057bbf603f10d79c87e09e6203b600788c29e7ff5 >Exec-Program output: NT_KEY: 2066656E05C22F3A995AD9ECFED913D6 >Exec-Program-Wait: plaintext: NT_KEY: 2066656E05C22F3A995AD9ECFED913D6 >Exec-Program: returned: 0 >[mschap] adding MS-CHAPv2 MPPE keys >++[mschap] returns ok >MSCHAP Success Ivan Kalik Kalik Informatika ISP

2 8

Problem with Freeradius and WiMAX
by Kristoffer Milligan 12 Dec '08

12 Dec '08

Good day list This is my first post to the list, so let me open by congratulating on a great piece of software. I'm impressed. I have the pleasure of working with WiMAX and a system called 4motion. We have chosen to use FreeRadius as our AAA server, but are experiencing some problems. http://pastebin.com/m269e9250 As far as I can tell, everything is fine till I get the "[eap] NAK asked for unsupported type 21" error? Could anyone give me any pointer or ideas about what I am doing wrong, and how I can fix it? Sincerely, Kristoffer Milligan

2 1