- Freeradius-Users - lists.freeradius.org

sqlcounter returning wrong value?
by liran tal 13 Nov '08

13 Nov '08

Hey, I'm experimenting with some sqlcounter directives in radiusd.conf and chilli as the NAS. I've defined the following sqlcounter stanza for a daily traffic limit: sqlcounter defined in radiusd.conf: (the query was corrected as suggested by tnt on a previous thread on the list, correct me if I got it wrong please) sqlcounter counterChilliSpotMaxDailyOctets { counter-name = ChilliSpot-Max-Daily-Octets check-name = ChilliSpot-Max-Daily-Octets reply-name = ChilliSpot-Max-Total-Octets sqlmod-inst = sql key = User-Name reset = daily error-msg = "Sorry, your maximum traffic usage (download and upload) has exceed the provided limit" query = "SELECT (SUM(AcctInputOctets + AcctOutputOctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } In the authorization phase, I'm seeing the following in debug log: rlm_sqlcounter: Entering module authorize code sqlcounter_expand: 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='%{User-Name}'' radius_xlat: 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'' sqlcounter_expand: '%{sql:SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'}' radius_xlat: Running registered xlat function of module sql for string 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'' rlm_sql (sql): - sql_xlat radius_xlat: 'tester1' rlm_sql (sql): sql_set_user escaped user --> 'tester1' radius_xlat: 'SELECT (SUM(AcctInputOctets)+SUM(AcctOutputOctets)) FROM radacct WHERE UserName='tester1'' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): - sql_xlat finished rlm_sql (sql): Released sql socket id: 2 radius_xlat: '24004370' rlm_sqlcounter: (Check item - counter) is greater than zero rlm_sqlcounter: Authorized user tester1, check_item=26214400, counter=24004370 rlm_sqlcounter: Sent Reply-Item for user tester1, Type=ChilliSpot-Max-Total-Octets, value=26239950 modcall[authorize]: module "counterChilliSpotMaxDailyOctets" returns ok for request 0 The entry in radcheck is as follows: | 346 | tester1 | ChilliSpot-Max-Daily-Octets | := | 26214400 | What happens is that it seems the counter doesn't work as expected. When a user logs in, performs some traffic usage, logs out and logs in again, the replied back attribute for chilli doesn't contain a value which is the remainder of the traffic usage, but something else. According to the radius debug above, if check_item=26214400 and counter=24004370, how come value=26239950? So I'm guessing I'm missing something but I'm too obsessed with the sqlcounter to notice it. (is the subtractation not a normal decimal action?) The FreeRADIUS version used is 1.1.7 Regards, Liran.

6 23

how to sending EAP-Request/Identity in EAP AKA
by Mohammad Belgaumkar 13 Nov '08

13 Nov '08

Hi All, I m using freeradius as EAP AKA server . When i run radiusd ,it waits for requests from peer. If server wants to send "EAP-Request/Identity" then how it should be done? I want the server to request the identity from peer. Please help Thanks Regards Mohammad Arif Belgaumkar L&T Infotech Ltd, Whitefield, Bangalore - 66 Ph - 91-80-66242424 extn 2018 www.Lntinfotech.com ( ) L&T Infotech General Business (+) L&T Infotech Internal Use ( ) L&T Infotech Confidential ( ) L&T Infotech Proprietary Larsen & Toubro Infotech Ltd. www.Lntinfotech.com This Document is classified as: |------| | [X] | |------|L&T Infotech Proprietary |------| | [ ] | |------|L&T Infotech Confidential |------| | [ ] | |------| L&T Infotech Internal Use Only |------| | [ ] | |------|L&T Infotech General Business This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system. ______________________________________________________________________

3 2

rlm_ldap and auto_header
by Tim Palmer 12 Nov '08

12 Nov '08

After fighting with an upgrade from freeradius-1.0.3 to 2.1.1, both do a simple LDAP authorize/PAP authenticate (no tls, no eap, no chap, no inner-tunnel, nothing else), I've stumbled on what seems to fix my problem, and am curious if my fix makes sense, and will continue to be supported. I'm not including full debug output and config files in this post because I'm not looking for help on what I've done wrong, just whether this part of the configuration is valid. I'm happy to provide more detail if its desired. Built from freeradius-server-2.1.1 source, downloaded about 2 weeks ago from the Freeradius main site, on FreeBSD 7-1-PRERELEASE. With 2.1.1, I had no trouble getting rlm_ldap to connect to my OpenLDAP server, and after putting in a Cleartext-Passwrod entry in ldap.attrsmap, rlm_ldap would authorize fine, and everything seemed ok, except I couldn't get pap to understand the encryption scheme: [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "{crypt}$1$Moq9XEC8$PRA5/NGFUrskxI52Nv8rm." [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [test/testing] (from client localhost port 1) No amount of changing settings in modules/pap and other config files would help. I finally noticed in the rlm_ldap debug output "auto_headers = no". So, I set auto_headers = yes in modules/ldap, and login passes. Remove it, and login fails. Is it only some odd ball, simplistic configurations like mine that this should be required? I was unable to find any mention of this as an ldap module setting except in rlm_ldap.c, which I didn't think to look in until after the fact. Thank you for your time, tim

5 11

Failing to authenticate users
by butteryak 12 Nov '08

12 Nov '08

Hmmmm....my eyes are bugging out. This is a new freeradius install/mysql/daloradius/ubuntu. I fail to find any specific as to why my users are failing to authenticate, via a simple radcheck. anyone have another eye and take a peek, and see somthing I'm missing.....the first part of this is all config loading. the access request is located towards the bottem....... I'm pretty sure everything is talking to everything it needs to, but I'm obviously missing somthing most likely obvious. if anyone sees anything.....please let me know..... thanks guys.... cg Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded SQL sql: driver = "rlm_sql_mysql" sql: server = "localhost" sql: port = "" sql: login = "root" sql: password = "XXXXXXX" sql: radius_db = "radius" sql: nas_table = "nas" sql: sqltrace = no sql: sqltracefile = "/var/log/freeradius/sqltrace.sql" sql: readclients = yes sql: deletestalesessions = yes sql: num_sql_socks = 5 sql: sql_user_name = "%{User-Name}" sql: default_user_profile = "" sql: query_on_not_found = no sql: authorize_check_query = "SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_reply_query = "SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = '%{SQL-User-Name}' ORDER BY id" sql: authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" sql: authorize_group_reply_query = "SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = '%{SQL-User-Name}' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id" sql: accounting_onoff_query = "UPDATE radacct SET AcctStopTime='%S', AcctSessionTime=unix_timestamp('%S') - unix_timestamp(AcctStartTime), AcctTerminateCause='%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time}' WHERE AcctSessionTime=0 AND AcctStopTime=0 AND NASIPAddress= '%{NAS-IP-Address}' AND AcctStartTime <= '%S'" sql: accounting_update_query = " UPDATE radacct SET FramedIPAddress = '%{Framed-IP-Address}', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_update_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, XAscendSessionSvrKey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', '0', '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '%{Acct-Delay-Time:-0}', '0', '%{X-Ascend-Session-Svr-Key}')" sql: accounting_start_query_alt = "UPDATE radacct SET AcctStartTime = '%S', AcctStartDelay = '%{Acct-Delay-Time}', ConnectInfo_start = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query = " UPDATE radacct SET AcctStopTime = '%S', AcctSessionTime = '%{Acct-Session-Time}', AcctInputOctets = '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', AcctOutputOctets = '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = '%{Acct-Delay-Time:-0}', ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}'" sql: accounting_stop_query_alt = " INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{Acct-Session-Time:-0} + %{Acct-Delay-Time:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{Acct-Input-Gigawords:-0}' << 32 | '%{Acct-Input-Octets:-0}', '%{Acct-Output-Gigawords:-0}' << 32 | '%{Acct-Output-Octets:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}')" sql: group_membership_query = "SELECT GroupName FROM usergroup WHERE UserName='%{SQL-User-Name}'" sql: connect_failure_retry_delay = 60 sql: simul_count_query = "" sql: simul_verify_query = "SELECT RadAcctId, AcctSessionId, UserName, NASIPAddress, NASPortId, FramedIPAddress, CallingStationId, FramedProtocol FROM radacct WHERE UserName='%{SQL-User-Name}' AND AcctStopTime = 0" sql: postauth_query = "INSERT into radpostauth (user, pass, reply, date) values ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', NOW())" sql: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): - generate_sql_clients rlm_sql (sql): Query: SELECT * FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=testing123 rlm_sql (sql): Adding client 127.0.0.1 (localhost) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:33575, id=29, length=47 User-Name = "sqltest" User-Password = "testpwd" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "sqltest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'sqltest' rlm_sql (sql): sql_set_user escaped user --> 'sqltest' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'sqltest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqltest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'sqltest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqltest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 29 to 127.0.0.1 port 33575 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 29 with timestamp 491a1ba8 Nothing to do. Sleeping until we see a request. -- View this message in context: http://www.nabble.com/Failing-to-authenticate-users-tp20451334p20451334.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

FreeRadius working as a ProxyRadius using PAP protocol
by NGUYEN DANG LUAN, Eric 12 Nov '08

12 Nov '08

Hello, I'm trying to use FreeRadius (server-2.1.1) as a Proxy Radius with PAP protocol. peap,eap,pap pap Client <----------------------> AP <-------------> FreeRadius <--------------> Radius server There's what i have had in my conf files: client.conf: client ***.***.***.*** { secret = pass shortname = LinksysWRT54G nastype = other } proxy.conf: realm NULL { authhost = ***.***.***.***:1645 accthost = ***.***.***.***:1646 secret = pass } users: DEFAULT FreeRADIUS-Proxied-To == ***.***.***.***, Auth-Type := PAP I don't think my proxy radius use the right protocol. I want it to use PAP protocol whe it tries to contact radius server. < radiusd: #### Opening IP addresses and Ports #### < listen { < type = "auth" < ipaddr = * < port = 1645 < } < listen { < type = "acct" < ipaddr = * < port = 1646 < } < Listening on authentication address * port 1645 < Listening on accounting address * port 1646 < Listening on proxy address * port 1647 < Ready to process requests. < < rad_recv: Access-Request packet from host ***.***.***.*** port 1405, id=0, length=180 < Message-Authenticator = 0x1ad77a29ef17ee966a8521f57795f231 < Service-Type = Framed-User < User-Name = "enguyend\000" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < +- entering group authorize {...} < ++[preprocess] returns ok < ++[chap] returns noop < ++[mschap] returns noop < [suffix] No '@' in User-Name = "enguyend", looking up realm NULL < [suffix] Found realm "NULL" < [suffix] Adding Stripped-User-Name = "enguyend" < [suffix] Adding Realm = "NULL" < [suffix] Proxying request from user enguyend to realm NULL < [suffix] Preparing to proxy authentication request to realm "NULL" < ++[suffix] returns updated < [eap] Request is supposed to be proxied to Realm NULL. Not doing EAP. < ++[eap] returns noop < ++[unix] returns notfound < ++[files] returns noop < ++[expiration] returns noop < ++[logintime] returns noop < ++[pap] returns noop < Sending Access-Request of id 210 to ***.***.***.*** port 1645 < Message-Authenticator = 0x00000000000000000000000000000000 < Service-Type = Framed-User < User-Name = "enguyend" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < Proxy-State = 0x30 < Proxying request 0 to home server ***.***.***.*** port 1645 < Sending Access-Request of id 210 to ***.***.***.*** port 1645 < Message-Authenticator = 0x00000000000000000000000000000000 < Service-Type = Framed-User < User-Name = "enguyend" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < Proxy-State = 0x30 < Going to the next request < Waking up in 0.9 seconds. < Waking up in 13.0 seconds. < rad_recv: Access-Request packet from host ***.***.***.*** port 1405, id=0, length=180 < Sending duplicate proxied request to home server ***.***.***.*** port 1645 - ID: 210 < Sending Access-Request of id 210 to ***.***.***.*** port 1645 < Message-Authenticator = 0x00000000000000000000000000000000 < Service-Type = Framed-User < User-Name = "enguyend" < Framed-MTU = 1488 < Called-Station-Id = "00-1D-7E-5F-F7-39:SogetiNET" < Calling-Station-Id = "00-16-6F-AA-80-DD" < NAS-Port-Type = Wireless-802.11 < Connect-Info = "CONNECT 54Mbps 802.11g" < EAP-Message = 0x0200000d01656e677579656e64 < NAS-IP-Address = 192.168.1.1 < NAS-Port = 1 < NAS-Port-Id = "STA port # 1" < Proxy-State = 0x30 < Waking up in 11.0 seconds. < Rejecting request 0 due to lack of any response from home server ***.***.***.*** port 1645 < There was no response configured: rejecting request 0 < Using Post-Auth-Type Reject < +- entering group REJECT {...} < [attr_filter.access_reject] expand: %{User-Name} -> enguyend < attr_filter: Matched entry DEFAULT at line 11 < ++[attr_filter.access_reject] returns updated < Sending Access-Reject of id 0 to ***.***.***.*** port 1405 < Finished request 0. < PROXY: Marking home server ***.***.***.*** port 1645 as zombie (it looks like it is dead). < Waking up in 4.9 seconds. < Cleaning up request 0 ID 0 with timestamp +15 < Ready to process requests. Does anyone have on idea? Thanks Eric NGUYEN

3 7

control panel
by Allan Patrick Ksiaskiewcz 12 Nov '08

12 Nov '08

Hello how are? I would some indication of the control panel, use the dial_up admin, but it is bad, I tested the phpradmin. Outside the two anyone could spend some more? Thanks Allan Patrick Ksiaskiewcz Brazil Guarapuava/PR Novos endereços, o Yahoo! que você conhece. Crie um email novo com a sua cara @ymail.com ou @rocketmail.com. http://br.new.mail.yahoo.com/addresses

4 3

client windows xp machine-only authentication
by alois blasbichler 12 Nov '08

12 Nov '08

Hello I implemented successfully a wireless-access for clients windows xp with authentication of the machine (in a samba domain) and the users (in a samba-domain) to my openldap-DB with freeradius. This works fine. My question : somebody have configured windows xp(SP3) to make only a machine authentication ? I was not able to restrict this. My windows xp-clients makes first a machine-authentication and then allways a user- authentication. It is more a windows-question for a microsoft-mailinglist - i now - but i think a lot of freeradius-users use like me windows-clients and certainly somebody have a solution for me. by luis

1 0

Weird logic issue...
by Arran Cudbard-Bell 12 Nov '08

12 Nov '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, Got a weird condition evaluation issue elsif(\ ("%{Supplicant-Flags}" =~ /^10........$/) || \ (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && \ (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check'))) \ ){ Gets processed as: ++? if ("%{Supplicant-Flags}" == 'notfound') expand: %{Supplicant-Flags} -> ? Evaluating ("%{Supplicant-Flags}" == 'notfound') -> FALSE ++? if ("%{Supplicant-Flags}" == 'notfound') -> FALSE ++? if ("%{Supplicant-Flags}" =~ /^.1........$/) expand: %{Supplicant-Flags} -> ? Evaluating ("%{Supplicant-Flags}" =~ /^.1........$/) -> FALSE ++? if ("%{Supplicant-Flags}" =~ /^.1........$/) -> FALSE ++? elsif (("%{Supplicant-Flags}" =~ /^10........$/) || (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) )) expand: %{Supplicant-Flags} -> ?? Evaluating ("%{Supplicant-Flags}" =~ /^10........$/) -> FALSE expand: %{Supplicant-Flags} -> ??? Evaluating ("%{Supplicant-Flags}" == 'notfound') -> FALSE ??? Skipping ("%{Realm}" == 'local') ??? Skipping ("%{Huntgroup-Name}" != 'auth-proxy') ???? Skipping ("%{Service-Type}" == 'Framed-User') ???? Skipping ("%{Service-Type}" == 'Call-Check') ++? elsif (("%{Supplicant-Flags}" =~ /^10........$/) || (("%{Supplicant-Flags}" == 'notfound') && ("%{Realm}" == 'local') && ("%{Huntgroup-Name}" != 'auth-proxy') && (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) )) -> TRUE So the first condition: ("%{Supplicant-Flags}" =~ /^10........$/) returns false Instead of processing the rest of the conditions FR skips the rest of the conditions and returns true for the entire condition... Interestingly if you take out the nested: (("%{Service-Type}" == 'Framed-User') || ("%{Service-Type}" == 'Call-Check')) Condition and replace it with: ("%{Service-Type}" == 'Framed-User') All is well. So only happens with multiple levels of nesting. This has been a bug since at least version 2.0.4. Thanks, Arran - -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer, Infrastructure Services (IT Services), E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT DDI+FAX: +44 1273 873900 | INT: 3900 GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.8 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iEYEARECAAYFAkka/MsACgkQcaklux5oVKI5DQCfVWJqHf8uOWsVqEKHWPZpFHvc FlcAn14qXPIwsHOOme+q7jT7cNqy9TkK =JXk/ -----END PGP SIGNATURE-----

1 0

snmp problem
by Oguzhan Kayhan 12 Nov '08

12 Nov '08

Hi, I am trying snmp on debian 32 bit. With freeradius 2.0.5. and net-snmp 5.4.1 I did all just like on http://wiki.freeradius.org/SNMP_HOWTO. Changed radiusd.conf as snmp = yes $INCLUDE snmp.con and remove comment on line smux_password = verysecret and added the line on snmpd.conf of snmpdaemon "smuxpeer .1.3.6.1.4.1.11344.1.1.1 verysecret" Enabled smux on snmpd too by removing -smux parameter. But i got the following error on freeradius debug.. SMUX connect try 1 SMUX SMUX open oid: 1.3.6.1.4.1.11344.1.1.1 SMUX open progname: radiusd SMUX open password: verysecret SMUX SMUX register oid: 1.3.6.1.2.1.67.1.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX SMUX register oid: 1.3.6.1.2.1.67.2.1.1.1 SMUX register priority: -1 SMUX register operation: 1 SMUX register message send failed: Broken pipe And also snmpd gives the following error: refused smux peer: oid SNMPv2-SMI::enterprises.11344.1.1.1, descr radiusd Is it a bug regarding to snmp or freeradius? Or did i miss something?

2 2

Re: LDAP & MSCHAP errors
by Simon Palmer 12 Nov '08

12 Nov '08

>>pap against LDAP works fine >>chap against LDAP works fine (With ntradping) > >They used different password. Do you mean chap and MSCHAPv2 require passwords in different formats or something? I can auth CHAP, but with the same username and password can't auth CHAPv2 (with no config change on freeradius) My two debugs show that Debug: rlm_ldap: sambaNtPassword -> NT-Password == 0x4145394341303636374123413937333342303139423034323445363933373332 So the NT-Password is being retrieved from LDAP in both cases. > >>BUT - MSCHAPv2 gives "FAILED: MS-CHAP2-Response is incorrect" >>Am I missing something required for MSCHAP to work? The NT-Password >>seems to be retrieved... >> > >A coorect password. Do you think the has being retrieved from LDAP is wrong then? If I do put in an incorrect password I do get the same error message. Does anyone have Freeradius working with MSCHAP against eDir? > >>Working CHAP debug from ntradping: >> >>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for check items in >>directory... >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: acctFlags -> >>SMB-Account-CTRL-TEXT == "[UX ]" >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaNtPassword -> >>NT-Password == >>0x4145394341303636374133413937333342303139423034323645363933373332 >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: sambaLmPassword -> >>LM-Password == >>0x3635423939303044343142344533363831394631304139333344343836384443 >>Tue Nov 11 10:10:26 2008 : Info: [ldap] looking for reply items in >>directory... >>Tue Nov 11 10:10:26 2008 : Info: [ldap] user testuser authorized to use >>remote access >>Tue Nov 11 10:10:26 2008 : Debug: rlm_ldap: ldap_release_conn: Release >>Id: 0 >>Tue Nov 11 10:10:26 2008 : Info: ++[ldap] returns ok >>Tue Nov 11 10:10:26 2008 : Info: ++[expiration] returns noop >>Tue Nov 11 10:10:26 2008 : Info: ++[logintime] returns noop >>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing NT-Password from hex >>encoding >>Tue Nov 11 10:10:26 2008 : Info: [pap] Normalizing LM-Password from hex >>encoding >>Tue Nov 11 10:10:26 2008 : Info: [pap] Found existing Auth-Type, not >>changing it. >>Tue Nov 11 10:10:26 2008 : Info: ++[pap] returns noop >>Tue Nov 11 10:10:26 2008 : Info: Found Auth-Type = CHAP >>Tue Nov 11 10:10:26 2008 : Info: +- entering group CHAP {...} >>Tue Nov 11 10:10:26 2008 : Info: [chap] login attempt by "testuser" >>with CHAP password > >***** >>Tue Nov 11 10:10:26 2008 : Info: [chap] Using clear text password >>"ommitted" for user testuser authentication. >***** > >>Where did that come from? I don't know - inside tha chap module? It's retrieved from LDAP. I'm using the default modules/chap - it just says: chap { # no configuration } > >>Tue Nov 11 10:10:26 2008 : Info: [chap] chap user testuser >>authenticated succesfully > >>Default configuration in modules/mschap and modules/chap >>In sites-enabled/default >>authorize { >>ldap >>} > >That is obviously untrue from your debug. Just checked again, modules/mschap has nothing unhashed. modules/chap has as above with # no configuration > >Try doing pap with that NT-Password from ldap (remove clear text password >entry wherever it is). Yeah - PAP works perfectly, chap works perfectly, MSCHAP doesn't. Thanks > >Ivan Kalik >Kalik Informatika ISP Mae'r e-bost hwn ac unrhyw ffeiliau atodedig yn gyfrinachol ac at sylw'r unigolyn neu'r sefydliad a enwir uchod. Bydd unrhyw farn neu sylwadau a fynegir yn perthyn i'r awdur yn unig ac ni chynrychiolant o anghenraid farn Coleg Sir Gâr. Os ydych chi wedi derbyn yr e-bost hwn ar gam, rhowch sylw i'r gweinyddwr ar y cyfeiriad canlynol: postmaster(a)colegsirgar.ac.uk Cysidrwch yr amgylchedd - a oes wir angen argraffu'r ebost hwn? This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. Any views or opinions expressed are solely those of the author an d do not necessarily represent those of Coleg Sir Gâr. If you have received this email in error please notify the administrator on the following address: postmaster(a)colegsirgar.ac.uk Please consider the environment - do you really need to print this email?

2 4