- Freeradius-Users - lists.freeradius.org

freeradius password expiry
by yangcuilin 06 Dec '08

06 Dec '08

My requirement: 1. At FreeRADIUS (java) client side, judge the current user whether is password expiry in advance. If user password is expiry, prompt user to change password. My question: FreeRADIUS have an attribute of "Expiration" to judge whether the password is expiry, but can I get value of "Expiration" in advance? 2. User can send request (which is the FreeRADIUS attribute of "Expiration") to FreeRADIUS Server. My question: How do I change the value of FreeRADIUS attribute of "Expiration"? Two questions. Thanks in advance.

6 14

Using Realm as a check item
by Lisa Casey 06 Dec '08

06 Dec '08

Hi, I am attempting to use my Freeradius users file to restrict certain users to a specific realm. In my users file, I have several default realms specified near the top as so: DEFAULT Realm == realm1.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 DEFAULT Realm == realm2.com Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500, Fall-Through = 1 Next I have users entries as so: lisa Auth-Type = Local, Password == xxxxxxx Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500 susan Auth-Type = Local, Password == xxxxxxx Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500 I would like to restrict lisa to realm1.com only. So I modified lisa's entry in the users file like so: lisa Realm == realm1.com, Auth-Type = Local, Password == xxxxxxx Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 255.255.255.254, Framed-IP-Netmask = 255.255.255.255, Framed-Routing = None, Framed-Compression = None, Framed-MTU = 1500 It doesn't work. In my radius.log I get: Fri Dec 5 12:59:05 2008 : Auth: Login incorrect: [lisa/xxxxxxx] (from client rad03.globalpops.com port 1282 cli 423784xxxx) Fri Dec 5 12:59:11 2008 : Auth: Login incorrect: [lisa/xxxxxx] (from client rad04.globalpops.com port 1282 cli 423784xxxx) I have tried leaving out Auth-Type, I've changed Password == to Cleartext-Password == but none of that helped. I can authenticate as lisa with no realm specified in the users file as a check item, buit as soon as I add that in, I can no longer authenticate. Any idea what I'm doing wrong or why this isn't working for me? Thanks, Lisa

3 3

FreeRADIUS Server 2.1.3 has been released
by Alan T DeKok 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 It turns out that the archive of 2.1.2 was packaged incorrectly. As a result, we're releasing 2.1.3. Sorry for the inconvenience. Alan DeKok. Project Leader -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQCVAwUBSTlchqkul4vkAkl9AQLMiAP+KzBhJ4xkLeDRPHQLUsrrOsoqBMW8PgRJ NKurXlYQ1AGAuNBN83b7HKy7RWjzSZTTwwPi4wa+YXSfrWUaCpWXlVgEWdRwU69M v+BUYr8DbTCL8Gd1hEvfmGBJgqtSr/fkC3BrrPqiDBQY3Sz8zG/23Q0JjahSB2Xx kZ2TA+W7p1s= =7gwn -----END PGP SIGNATURE-----

2 1

Radius log files
by David Blackman 05 Dec '08

05 Dec '08

I have included a clip from the radius log file that shows both allow and a deny. The problem that I'm having is that I need to log info that I can track back to the computer that logged on. Can I get the mac address or computer name of the computer written to the log file? I see that the computer name is logged when the user is denied. Thu Dec 4 07:01:37 2008 : Auth: Login incorrect: host/paolo-laptop/<via Auth-Type = EAP>] (from client linksys port 0 via TLS tunnel) Thu Dec 4 07:01:37 2008 : Auth: Login incorrect: host/paolo-laptop/<via Auth-Type = EAP>] (from client linksys port 44) Thu Dec 4 07:14:17 2008 : Auth: Login OK: [bradatea/<via Auth-Type = EAP>] (from client linksys port 0 via TLS tunnel) Thu Dec 4 07:14:17 2008 : Auth: Login OK: [bradatea/<via Auth-Type = EAP>] (from client linksys port 44)

2 3

Re: Radius log files
by Martin Silvero 05 Dec '08

05 Dec '08

Hi I have the same logout when I do "radiusd -X" If I find a solution or some I telll you. if you find some tellme =) Bye!

1 0

FreeRADIUS Server Version 2.1.2 has been released
by Alan T DeKok 05 Dec '08

05 Dec '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 We are pleased to announce the release of version 2.1.2 of the FreeRADIUS server. The focus of this release is stability. ftp://ftp.freeradius.org:/pub/freeradius/freeradius-server-2.1.2.tar.bz2 ftp://ftp.freeradius.org:/pub/freeradius/freeradius-server-2.1.2.tar.bz2.sig We have also created a "stable" tree on git.freeradius.org. This tree will be used to release versions 2.1.2 and following. The "master" tree will be used for additional, experimental features. There are a number of important new features coming over the next year. Splitting development in this way helps to manage the trade-off of features versus stability. We would like to thank Coverity for providing static analysis scanning that highlighted a number of issues. These issues do not have security implications, but they can affect stability. Alan DeKok Project Leader The complete changelog is below. - ----------------------------------------------------- Feature Improvements: * Allow running with "user=radiusd" and binding to secure sockets. * Start sending Status-Server "are you alive" messages earlier, which helps with proxying multiple realms to a home server. * Removed thread pool code from rlm_perl. It's not necessary. * Added example Perl configuration to raddb/modules/perl * Force OpenSSL to support certificates with SHA256. This seems to be necessary for WiMAX certs. Bug fixes: * Fix Debian patch to allow it to build. * Fix potential NULL dereference in debugging mode on certain platforms for TTLS and PEAP inner tunnels. * Fix uninitialized memory in handling of vendor definitions * Fix parsing of quoted (but non-string) attributes in the "users" file. * Initialize uknown NAS IP to 255.255.255.255, rather than 0.0.0.0 * use SUN_LEN in control socket, to avoid truncation on some platforms. * Correct internal handling of "debug condition" to prevent it from being over-written. * Check return code of regcomp in "unlang", so that invalid regular expressions are caught rather than mishandled. * Make rlm_sql use <ltdl.h>. Addresses bug #610. * Document list "type = status" better. Closes bug #580. * Set "default days" for certificates, because OpenSSL won't do it. This closes bug #615. * Reference correct list in example raddb/modules/ldap. Closes #596. * Increase default schema size for Acct-Session-Id to 64. Closes #540. * Fix use of temporary files in dialup-admin. Closes #605 and addresses CVE-2008-4474. * Addressed a number of minor issues found by Coverity. * Added DHCP option 150 to the dictionary. Closes #618. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iQCVAwUBSTezVakul4vkAkl9AQJLJQP/bFRE4r9EJHfSbdiqe0WBdJF1PudwHs97 JwlI/cF8D2AkNULWP9wAWruCrInEPlj9AjqLNjtfq+7ap5tfJC0diAFm7cMfiX2y SlbOfeoDmnAJ8q7tCZa5Q3t5gRuGmyjR9ANa0dqSemz6p+whgM9KPDvM8xX8fH8r uaoy5OdZYEo= =73eF -----END PGP SIGNATURE-----

2 2

radtest nasname IP address support?
by schilling 05 Dec '08

05 Dec '08

Hi, radiusd: FreeRADIUS Version 1.1.7 radiusd nasname could be host name only. It would be convenient if it could also be ip as radiusserver in radtest. Is it supported in new version? Thanks. Schilling

3 3

Problems with wifi authentication: [mschap] No Cleartext-Password configured...
by Leonardo Marques 05 Dec '08

05 Dec '08

Hi guys, I'm with problems on my first radius authentication server for wireless clients. I've made some progress, but now I'm with problems that I don't know how to solve. I want to use the NIS user database. Freeradius version: 2.1.1, compiled from source on mandriva 2008.1 (yes, i don't like mandriva, but i have to use it) With radtest, I already can authenticate with users located on /etc/raddb/users/ , /etc/passwd and NIS' users: Example: leonardolocal@lcc56:~$ radtest leonardo lalala 172.16.0.2 0 xpto Sending Access-Request of id 65 to 172.16.0.2 port 1812 User-Name = "leonardo" User-Password = "radius1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 172.16.0.2 port 1812, id=65, length=20 leonardolocal@lcc56:~$ radtest usuario1 lalala 172.16.0.2 0 xpto Sending Access-Request of id 57 to 172.16.0.2 port 1812 User-Name = "usuario1" User-Password = "senha1" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 172.16.0.2 port 1812, id=57, length=20 leonardolocal@lcc56:~$ radtest localradius lalala 172.16.0.2 0 xpto Sending Access-Request of id 135 to 172.16.0.2 port 1812 User-Name = "localradius" User-Password = "radius1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 172.16.0.2 port 1812, id=212, length=20 Until here, everything was ok, the problems begins when I try authenticate through wireless access point: The PEAP doesn't work. And by TTLS/MSCHAPv2 works, but only for users located on the /etc/raddb/users file, and not for NIS' or passwd' users. Error that happens when a I try connect with TTLS/MSCHAPv2 and with user not listed on the /etc/raddb/users file: Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for leonardo with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. I've uploaded the /etc/raddb/radiusd.conf,/ etc/raddb/eap.conf, module /etc/raddb/modules/mschap and also a log from the radiusd -X with a login try which generates the above error and the radiusd startup on the server: http://ivete.fis.unb.br/fradius/ I've found on google a discussion, on this list (http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg48660.…) which a guy had the same error than me, but he was using the ldap database as user's database. And I don't understood what procedures he used to solve his problems. Please, if somebody have some tip, tell me, I don't know what to do anymore :/ Sorry for the poor english. Thanks in advance, -- --------------------------- Leonardo Marques --------------------------- Blog: BeNerd.analyx.org Website: www.analyx.org

2 2

rlm_perl
by Saeed Akhtar 05 Dec '08

05 Dec '08

Hi all, I have problem in rlm_perl module.... I found a documentation which says that rlm_perl is not in default modules of freeradius so you have to add a value "rlm_perl" in src/modules/stable before configuring freeradius. I added that. Now in wiki of freeradius, I read rlm_perl and do what ever he says. But i got an error, as I never found DEFAULT Auth-Type = System.. so I added my own entry of DEFAULT Auth-Type = Perl. But now when I execute it, it gives following error: /usr/local/etc/raddb/users[61]: parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type Error reading /usr/local/etc/raddb/users I just want to install rlm_perl and use it in accounting section, so that I can count its packets in and out.and time usage of user and make my own decisions. Can anyone please help me, I'll be Thankful Regards, Saeed Akhtar

2 1

radius user queries for uid anonymous in ldap
by Sergio Belkin 05 Dec '08

05 Dec '08

Hi, I use freeradius with EAP-TTLS y EAP-PEAP, below there is ldap log, I wonder why radius "bothers" to query for anonymous uid and not only for uid into the tunnel Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 fd=15 ACCEPT from IP=123.45.67.89:56075 (IP=0.0.0.0:636) Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 fd=15 TLS established tls_ssf=256 ssf=256 Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=0 BIND dn="cn=freeradius,ou=applications,dc=cadorna,dc=edu" method=128 Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=0 BIND dn="cn=freeradius,ou=applications,dc=cadorna,dc=edu" mech=SIMPLE ssf=0 Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=0 RESULT tag=97 err=0 text= Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=1 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=anonymous)" Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=1 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=1 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=2 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=anonymous)" Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=2 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:26 sinclair slapd[11285]: conn=1264 op=2 SEARCH RESULT tag=101 err=0 nentries=0 text= Dec 3 08:54:27 sinclair slapd[11285]: conn=1264 op=3 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=glinde)" Dec 3 08:54:27 sinclair slapd[11285]: conn=1264 op=3 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:27 sinclair slapd[11285]: conn=1264 op=3 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 3 08:54:28 sinclair slapd[11285]: conn=1264 op=4 SRCH base="ou=people,dc=cadorna,dc=edu" scope=2 deref=0 filter="(uid=jinfan)" Dec 3 08:54:28 sinclair slapd[11285]: conn=1264 op=4 SRCH attr=radiusPassword radiusAllowed Dec 3 08:54:28 sinclair slapd[11285]: conn=1264 op=4 SEARCH RESULT tag=101 err=0 nentries=1 text= Dec 3 08:55:05 sinclair slapd[11285]: conn=1264 fd=15 closed (idletimeout) Does make sense to query for anonymous? Thanks in advance Thanks in advance! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 4