- Freeradius-Users - lists.freeradius.org

Problem with ntlm_auth
by Frederik.Niedernolte＠Bertelsmann.de 09 Oct '08

09 Oct '08

I have finished all steps till "user Auth-Type := ntlm_auth" from http://deployingradius.com/documents/configuration/active_directory.html . With this command I get this error message at the end of "/usr/sbin/freeradius -X": /etc/freeradius/users[1]: Parse error (check) for entry MyUser: Unknown value ntlm_auth for attribute Auth-Type Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[111]: Failed to find module "files". /etc/freeradius/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. } } Errors initializing modules The authenticate section in the /etc/freeradius/sites-enabled/default looks like this (only important part): authenticate { # # NTML_AUTH authentication. Auth-Type ntlm_auth { ntlm_auth } What is wrong and what can I do to solve the problem? Thanks in advance. Best regards, F. Niedernolte

6 23

Proxy when database value is set
by Laar, Johan van de 09 Oct '08

09 Oct '08

I've achieved the following: - A user with a username which contains a realm logs in. - Freeradius checks some radius request values like calling-station-id etc. - Freeradius will give a reject or accept depending on the above query. What I cannot achieve is: - Freeradius must proxy to request to a token server but only when it authenticated the user successfully. Any ideas? Thank you in advance. Regards, Johan van de Laar

2 1

RE: EAP-TLS & computer account(not user)
by Guk Victor 09 Oct '08

09 Oct '08

2 1

Startdate for sessions in FreeRadius with MySql?
by Bladan2000 09 Oct '08

09 Oct '08

Hello! We're using FreeRadius 1.1.7 along with MySql on an Ubuntu server. We have a web application to create users for FreeRadius and administrators can set the expire date for when a session should expire. This is achieved with the "Expiration" attribute in the table called RadCheck in the MySql database. However, a customer would like to be able to also set a "start"-date for when the session should become valid i.e. if I set 2008-10-06 it won't be possible to log in before that date. I haven't found a way to do this in FreeRadius. Does anyone have a solution for this? I thought that it might exist an attribute for "Start" as well when there is one for "Expire" but I haven't found any. The only solution I can come up with is some kind of own customized que handling for this altough I would prefer a simple attribute. Any thoughts? Johan -- View this message in context: http://www.nabble.com/Startdate-for-sessions-in-FreeRadius-with-MySql--tp19… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

config mysql with Linux PAM for SSH
by BADAOUI Nasr-Eddine (P) 09 Oct '08

09 Oct '08

Hi all, I've installed an authentication's solution using freeradius, with mysql database on RedHat 4.7. I would like users logging into other Linux Machines to have their login/passwd authenticated using mysql on freeradius server (SSH) I've seen that to authenticate successfully, the login id has to be defined locally on client Linux machines. In summary, is it mandatory to have the login id defined in the client linux machine ? other solutions ? thanks, Nasr-Eddine BADAOUI

3 2

Re: How to forward MAC-authentiation-requests over a FreeRADIUS-proxy to a FreeRADIUS-server?
by Raphael Brüngel 09 Oct '08

09 Oct '08

Hello again, here is the info I collected concerning the “It still doesn’t work” section: ***** FreeRADIUS-proxy ************************************************ ***** users: Standard entry of localhost and DEFAULT Proxy-To-Realm := "RADIUS_REALM" ***** clients.conf: client 192.168.1.58 { secret = testing123 } ***** debug: main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 192.168.1.58 { require_message_authenticator = no secret = "testing123" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server RADIUS_SERVER { ipaddr = 192.168.1.61 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "request" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool RADIUS_SERVER_POOL { type = fail-over home_server = RADIUS_SERVER } realm RADIUS_REALM { auth_pool = RADIUS_SERVER_POOL } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } radiusd: #### Opening IP addresses and Ports #### listen { type = "proxy" ipaddr = 192.168.1.80 port = 1812 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on proxy address 192.168.1.80 port 1812 Ready to process requests. radtest: Local on the proxy: radtest 00-3F-08-27-10-11 00-3f-08-27-10-11 192.168.1.80 1812 testing123 Logfile of proxy: Error: Invalid packet code 1 sent to a proxy port from home server 192.168.1.80 port 40341 - ID 96 : IGNORED From FR-server to proxy: 00-3F-08-27-10-11 00-3f-08-27-10-11 192.168.1.80 1812 testing123 Logfile of proxy: Error: Invalid packet code 1 sent to a proxy port from home server 192.168.1.61 port 42477 - ID 19 : IGNORED ***** FreeRADIUS-server ************************************************ ***** users: Standard entry of localhost ***** clients.conf: client 192.168.1.80 { secret = testing123 } The FreeRADIUS-Server runs fine. I tested it with radtest and with some clients connected to my switch. ***** Comment to the proxy.conf ************************************************ The switch was not configured as home server as you can see – that’s the weird thing. You said that the proxy port is 1814 but the authentication port 1812 is not used by the proxy, correct? Is it incorrect to use port 1812 to receive proxy requests when the switch sends it to 1812, too? Thank you for your help! Best regards, Raphael Brüngel

3 2

On/Off packets
by AHMED KHIDR 08 Oct '08

08 Oct '08

Hi All , Please any one have an idea about this , I am using cisco 1721 to terminate PPPOE sessions and authentication by freeradius , when I reload the router there is no *On/Off* packets sent from cisco , so the users still online on database , How to make my cisco router send *On/Off* packets to radius ?? Regards

3 2

Install error
by Olavo Dietrich 08 Oct '08

08 Oct '08

installing v.2.1.1 I got errors. Any clues ? thanks Duan ./configure ... ... gcc version 4.1.2 20071124 (Red Hat 4.1.2-42) configure:3000: $? = 0 configure:3007: g++ -V >&5 g++: '-V' option must have argument configure:3010: $? = 1 configure:3013: checking whether we are using the GNU C++ compiler configure:3042: g++ -c conftest.cpp >&5 configure:3048: $? = 0 configure:3065: result: yes configure:3070: checking whether g++ accepts -g configure:3100: g++ -c -g conftest.cpp >&5 configure:3106: $? = 0 - Ignored: configure:3205: result: yes configure:3235: checking how to run the C preprocessor configure:3275: gcc -E conftest.c configure:3281: $? = 0 configure:3312: gcc -E conftest.c conftest.c:8:28: error: ac_nonexistent.h: No such file or directory configure:3318: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | /* end confdefs.h. */ | #include <ac_nonexistent.h> configure:3351: result: gcc -E configure:3380: gcc -E conftest.c configure:3386: $? = 0 configure:3417: gcc -E conftest.c conftest.c:8:28: error: ac_nonexistent.h: No such file or directory configure:3423: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | /* end confdefs.h. */ | #include <ac_nonexistent.h> ... .. ... configure:4417: checking whether byte ordering is bigendian configure:4450: gcc -c -g -O2 conftest.c >&5 configure:4456: $? = 0 configure:4488: gcc -c -g -O2 conftest.c >&5 conftest.c: In function 'main': conftest.c:25: error: 'not' undeclared (first use in this function) conftest.c:25: error: (Each undeclared identifier is reported only once conftest.c:25: error: for each function it appears in.) conftest.c:25: error: expected ';' before 'big' configure:4494: $? = 1 configure: failed program was: | /* confdefs.h. */ | #define PACKAGE_NAME "" | #define PACKAGE_TARNAME "" | #define PACKAGE_VERSION "" | #define PACKAGE_STRING "" | #define PACKAGE_BUGREPORT "" | #define STDC_HEADERS 1 | #define HAVE_SYS_TYPES_H 1 | #define HAVE_SYS_STAT_H 1 | #define HAVE_STDLIB_H 1 | #define HAVE_STRING_H 1 | #define HAVE_MEMORY_H 1 | #define HAVE_STRINGS_H 1 | #define HAVE_INTTYPES_H 1 | #define HAVE_STDINT_H 1 | #define HAVE_UNISTD_H 1 | /* end confdefs.h. */ | #include <sys/types.h> | #include <sys/param.h> | | int | main () | { | #if BYTE_ORDER != BIG_ENDIAN | not big endian | #endif | | ; | return 0; | } ... ...

7 16

blocking anonymous outer identity
by Riccardo Veraldi 08 Oct '08

08 Oct '08

Hello, I have some anonymous outer identity in the autentication log of freeradius. I use freeradius version < 2.0 with EAP-TTLS and 802.1x on hte supplicant side. how can I forbid users to use an anonymous identity or to use an outer identity different from the real identity used for authentication/authorization ? I want to force users to use their own real identity based on their real credentials users@domainname without using an outer identity. I want to forbid this because if users use anonymous outer identity in the freeradius log I cannot see who is the user actually autenticating. any hints about this problem of mine ? thank you Rick

2 1

Programming freeradius to react in different way for accepts and rejects
by Diogo Montagner 08 Oct '08

08 Oct '08

Hello all, I'm looking for some tutorial that explain how I can programming the freeradius to work as described below. At my lab environment I have two situations: access-accept (the password is correct) and access-reject (the password is wrong). I would like to programming the freeradius to after the fifth try of an user to authenticate (all five tries was reject), the freeradius authenticate the user within a specific policy for this case. I know how to send different policies to user, but I don't know how to make freeradius answer accept after the fifth try of authentication. Example: user test passwd test123 time: 00:00:00 1st try: test passwd test456 -> radius answer reject 2nd try: test passwd test456 -> radius answer reject 3rd try: test passwd test456 -> radius answer reject 4th try: test passwd test456 -> radius answer reject 5th try: test passwd test456 -> radius answer reject time: 00:05:00 6th try: test passwd test456 -> radius answer accept but athenticate the user in a specific policy to block its access but keep it authenticated. If in five minutes the user has received more than 5 access-reject then I would like to authenticate and block its access with a specific policy. Thanks in advance! ./diogo -montagner

3 6