- Freeradius-Users - lists.freeradius.org

Strange password when authenticating via pppoe-server.
by Maciej Drobniuch 12 Jul '08

12 Jul '08

Hi! Now I have a new problem. When auth via radiusclient, everyting works fine: >radtest steve testing localhost 1813 somesecret Sat Jul 12 12:07:31 2008 : Debug: modsingle[authenticate]: calling pap (rlm_pap) for request 4 Sat Jul 12 12:07:31 2008 : Debug: rlm_pap: login attempt with password "testing" Sat Jul 12 12:07:31 2008 : Debug: rlm_pap: Using clear text password "testing" Sat Jul 12 12:07:31 2008 : Debug: rlm_pap: User authenticated successfully Sat Jul 12 12:07:31 2008 : Debug: modsingle[authenticate]: returned from pap (rlm_pap) for request 4 Sat Jul 12 12:07:31 2008 : Debug: ++[pap] returns ok Sat Jul 12 12:07:31 2008 : Debug: +- entering group post-auth Sat Jul 12 12:07:31 2008 : Debug: modsingle[post-auth]: calling exec (rlm_exec) for request 4 Sat Jul 12 12:07:31 2008 : Debug: modsingle[post-auth]: returned from exec (rlm_exec) for request 4 Sat Jul 12 12:07:31 2008 : Debug: ++[exec] returns noop Sending Access-Accept of id 146 to 127.0.0.1 port 32770 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP I've also tried to auth using this command(and the login is also successful): echo User-Name = "steve", CHAP-Password = "testing" | radclient localhost auth somesecret But when i've had tried to login from a client (windows xp) station using the pppoe-server(on the server) the debug output looks like this: Force PAP(require-pap) on pppoe-server: Sat Jul 12 12:11:23 2008 : Debug: auth: type "PAP" Sat Jul 12 12:11:23 2008 : Debug: +- entering group PAP Sat Jul 12 12:11:23 2008 : Debug: modsingle[authenticate]: calling pap (rlm_pap) for request 7 Sat Jul 12 12:11:23 2008 : Debug: rlm_pap: login attempt with password "ŞĂ23ćtn?? 8šľ1RĄ" Sat Jul 12 12:11:23 2008 : Debug: rlm_pap: Using clear text password "testing" Sat Jul 12 12:11:23 2008 : Debug: rlm_pap: Passwords don't match Sat Jul 12 12:11:23 2008 : Debug: modsingle[authenticate]: returned from pap (rlm_pap) for request 7 Sat Jul 12 12:11:23 2008 : Debug: ++[pap] returns reject Sat Jul 12 12:11:23 2008 : Debug: auth: Failed to validate the user. Sat Jul 12 12:11:23 2008 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Sat Jul 12 12:11:23 2008 : Debug: Found Post-Auth-Type Reject Sat Jul 12 12:11:23 2008 : Debug: +- entering group REJECT Sat Jul 12 12:11:23 2008 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 7 Sat Jul 12 12:11:23 2008 : Debug: expand: %{User-Name} -> steve Sat Jul 12 12:11:23 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Jul 12 12:11:23 2008 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 7 Sat Jul 12 12:11:23 2008 : Debug: ++[attr_filter.access_reject] returns updated Force CHAP(require-chap) on PPPoE server: Sat Jul 12 12:13:04 2008 : Debug: auth: type "CHAP" Sat Jul 12 12:13:04 2008 : Debug: +- entering group CHAP Sat Jul 12 12:13:04 2008 : Debug: modsingle[authenticate]: calling chap (rlm_chap) for request 0 Sat Jul 12 12:13:04 2008 : Debug: rlm_chap: login attempt by "steve" with CHAP password Sat Jul 12 12:13:04 2008 : Debug: rlm_chap: Using clear text password "testing" for user steve authentication. Sat Jul 12 12:13:04 2008 : Debug: rlm_chap: Password check failed Sat Jul 12 12:13:04 2008 : Debug: modsingle[authenticate]: returned from chap (rlm_chap) for request 0 Sat Jul 12 12:13:04 2008 : Debug: ++[chap] returns reject Sat Jul 12 12:13:04 2008 : Debug: auth: Failed to validate the user. Sat Jul 12 12:13:04 2008 : Debug: Found Post-Auth-Type Reject Sat Jul 12 12:13:04 2008 : Debug: +- entering group REJECT Sat Jul 12 12:13:04 2008 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Sat Jul 12 12:13:04 2008 : Debug: expand: %{User-Name} -> steve Sat Jul 12 12:13:04 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Jul 12 12:13:04 2008 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Sat Jul 12 12:13:04 2008 : Debug: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 57 to 127.0.0.1 port 32770 Sat Jul 12 12:13:04 2008 : Debug: Finished request 0. Sat Jul 12 12:13:04 2008 : Debug: Going to the next request Sat Jul 12 12:13:04 2008 : Debug: Waking up in 4.9 seconds. Sat Jul 12 12:13:09 2008 : Debug: Cleaning up request 0 ID 57 with timestamp +8 Sat Jul 12 12:13:09 2008 : Debug: Ready to process requests. What's wrong again? Thanks ! -- ------------------------ Maciej Drobniuch

2 3

Strange password when authenticating via pppoe-server.
by Maciej Drobniuch 12 Jul '08

12 Jul '08

Hi! Now I have a new problem. When auth via radiusclient, everyting works fine: >radtest steve testing localhost 1813 somesecret Sat Jul 12 12:07:31 2008 : Debug: modsingle[authenticate]: calling pap (rlm_pap) for request 4 Sat Jul 12 12:07:31 2008 : Debug: rlm_pap: login attempt with password "testing" Sat Jul 12 12:07:31 2008 : Debug: rlm_pap: Using clear text password "testing" Sat Jul 12 12:07:31 2008 : Debug: rlm_pap: User authenticated successfully Sat Jul 12 12:07:31 2008 : Debug: modsingle[authenticate]: returned from pap (rlm_pap) for request 4 Sat Jul 12 12:07:31 2008 : Debug: ++[pap] returns ok Sat Jul 12 12:07:31 2008 : Debug: +- entering group post-auth Sat Jul 12 12:07:31 2008 : Debug: modsingle[post-auth]: calling exec (rlm_exec) for request 4 Sat Jul 12 12:07:31 2008 : Debug: modsingle[post-auth]: returned from exec (rlm_exec) for request 4 Sat Jul 12 12:07:31 2008 : Debug: ++[exec] returns noop Sending Access-Accept of id 146 to 127.0.0.1 port 32770 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 172.16.3.33 Framed-IP-Netmask = 255.255.255.0 Framed-Routing = Broadcast-Listen Framed-Filter-Id = "std.ppp" Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP I've also tried to auth using this command(and the login is also successful): echo User-Name = "steve", CHAP-Password = "testing" | radclient localhost auth somesecret But when i've had tried to login from a client (windows xp) station using the pppoe-server(on the server) the debug output looks like this: Force PAP(require-pap) on pppoe-server: Sat Jul 12 12:11:23 2008 : Debug: auth: type "PAP" Sat Jul 12 12:11:23 2008 : Debug: +- entering group PAP Sat Jul 12 12:11:23 2008 : Debug: modsingle[authenticate]: calling pap (rlm_pap) for request 7 Sat Jul 12 12:11:23 2008 : Debug: rlm_pap: login attempt with password "ŞĂ23ćtn?? 8šľ1RĄ" Sat Jul 12 12:11:23 2008 : Debug: rlm_pap: Using clear text password "testing" Sat Jul 12 12:11:23 2008 : Debug: rlm_pap: Passwords don't match Sat Jul 12 12:11:23 2008 : Debug: modsingle[authenticate]: returned from pap (rlm_pap) for request 7 Sat Jul 12 12:11:23 2008 : Debug: ++[pap] returns reject Sat Jul 12 12:11:23 2008 : Debug: auth: Failed to validate the user. Sat Jul 12 12:11:23 2008 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Sat Jul 12 12:11:23 2008 : Debug: Found Post-Auth-Type Reject Sat Jul 12 12:11:23 2008 : Debug: +- entering group REJECT Sat Jul 12 12:11:23 2008 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 7 Sat Jul 12 12:11:23 2008 : Debug: expand: %{User-Name} -> steve Sat Jul 12 12:11:23 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Jul 12 12:11:23 2008 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 7 Sat Jul 12 12:11:23 2008 : Debug: ++[attr_filter.access_reject] returns updated Force CHAP(require-chap) on PPPoE server: Sat Jul 12 12:13:04 2008 : Debug: auth: type "CHAP" Sat Jul 12 12:13:04 2008 : Debug: +- entering group CHAP Sat Jul 12 12:13:04 2008 : Debug: modsingle[authenticate]: calling chap (rlm_chap) for request 0 Sat Jul 12 12:13:04 2008 : Debug: rlm_chap: login attempt by "steve" with CHAP password Sat Jul 12 12:13:04 2008 : Debug: rlm_chap: Using clear text password "testing" for user steve authentication. Sat Jul 12 12:13:04 2008 : Debug: rlm_chap: Password check failed Sat Jul 12 12:13:04 2008 : Debug: modsingle[authenticate]: returned from chap (rlm_chap) for request 0 Sat Jul 12 12:13:04 2008 : Debug: ++[chap] returns reject Sat Jul 12 12:13:04 2008 : Debug: auth: Failed to validate the user. Sat Jul 12 12:13:04 2008 : Debug: Found Post-Auth-Type Reject Sat Jul 12 12:13:04 2008 : Debug: +- entering group REJECT Sat Jul 12 12:13:04 2008 : Debug: modsingle[post-auth]: calling attr_filter.access_reject (rlm_attr_filter) for request 0 Sat Jul 12 12:13:04 2008 : Debug: expand: %{User-Name} -> steve Sat Jul 12 12:13:04 2008 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sat Jul 12 12:13:04 2008 : Debug: modsingle[post-auth]: returned from attr_filter.access_reject (rlm_attr_filter) for request 0 Sat Jul 12 12:13:04 2008 : Debug: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 57 to 127.0.0.1 port 32770 Sat Jul 12 12:13:04 2008 : Debug: Finished request 0. Sat Jul 12 12:13:04 2008 : Debug: Going to the next request Sat Jul 12 12:13:04 2008 : Debug: Waking up in 4.9 seconds. Sat Jul 12 12:13:09 2008 : Debug: Cleaning up request 0 ID 57 with timestamp +8 Sat Jul 12 12:13:09 2008 : Debug: Ready to process requests. What's wrong again? Thanks ! -- ------------------------ Maciej Drobniuch

1 0

Freeradius and Cisco (cisco-avpair = "shell:priv-lvl=15" doesn't work)
by Simo 11 Jul '08

11 Jul '08

hello Mailing-List, i'm trying to do the authentication of cisco cat switches with the freeradius. The Authentication works fine, also the authentication of the enable lvl mode (e.g. $enab15$) and the accounting too (the configuration is from the freeradius-wiki cisco artical). But i'm still having a problem with cisco-avpair attribute. I don't know why shell:priv-lvl=15 doesn't work. I want, that the user will be directly logged in to the priv-lvl without doing the enable authentication. i'm using the Version 1.1.7 of Radius (Debian Package) and here ist my configuration (i have switched from sql database to files for debugging ): admin Cleartext-Password := "pass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" and hier is the debugging output of freeradius (freeradius -X): rad_recv: Access-Request packet from host 192.168.178.2:1812, id=23, length=90 NAS-IP-Address = 192.168.178.2 NAS-Port = 2 Cisco-NAS-Port = "tty2" NAS-Port-Type = Virtual User-Name = "admin" Calling-Station-Id = "192.168.178.3" User-Password = "pass" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "admin", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry admin at line 64 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'admin' rlm_sql (sql): sql_set_user escaped user --> 'admin' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'admin' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User admin not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Att ribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupcheck.GroupName O RDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Att ribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'admin' AND usergroup.GroupName = radgroupreply.GroupName O RDER BY radgroupreply.id' rlm_sql (sql): User admin not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "pap" returns updated for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlycounter" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password pass rlm_pap: Using clear text password "pass". rlm_pap: User authenticated successfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: leaving group PAP (returns ok) for request 0 Sending Access-Accept of id 23 to 192.168.178.2 port 1812 Service-Type = NAS-Prompt-User Cisco-AVPair = "shell:priv-lvl=15" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 23 with timestamp 48771d94 Nothing to do. Sleeping until we see a request. And here is the the debuging ouput of the switch: 03:27:12: AAA: parse name=tty3 idb type=-1 tty=-1 03:27:12: AAA: name=tty3 flags=0x11 type=5 shelf=0 slot=0 adapter=0 port=3 channel=0 03:27:12: AAA/MEMORY: create_user (0x80BAD274) user='' ruser='' port='tty3' rem_addr='192.168.178.3' authen_type=ASCII service=LOGIN priv=1 03:27:12: AAA/AUTHEN/START (2153705482): port='tty3' list='' action=LOGIN service=LOGIN 03:27:12: AAA/AUTHEN/START (2153705482): using "default" list 03:27:12: AAA/AUTHEN/START (2153705482): Method=radius (radius) 03:27:12: AAA/AUTHEN (2153705482): status = GETUSER 03:27:16: AAA/AUTHEN/CONT (2153705482): continue_login (user='(undef)') 03:27:16: AAA/AUTHEN (2153705482): status = GETUSER 03:27:16: AAA/AUTHEN (2153705482): Method=radius (radius) 03:27:16: AAA/AUTHEN (2153705482): status = GETPASS 03:27:17: AAA/AUTHEN/CONT (2153705482): continue_login (user='admin') 03:27:17: AAA/AUTHEN (2153705482): status = GETPASS 03:27:17: AAA/AUTHEN (2153705482): Method=radius (radius) 03:27:17: AAA/AUTHEN (2153705482): status = PASS i hope, you kann help me thnx Simo

4 5

RE: about "freeradius accepts anybody"
by Ivan Kalik 11 Jul '08

11 Jul '08

>first, freeradius looks in users file, and only if client is authorized, >checks DNIe. There aren't any problem, only want to show, maybe help >somebody, and to show Ivan Kalik how clients and servers can trust in >different ca's. Oh, but I know exactly what you have done. You have created a list of nonsense user entries in users file and forced Auth-Type Reject on all the rest. And that has nothing to do with server and client certificates being issued bu different CA's. This will work as well: user1 Fall-Through = No user2 Fall-Through = No .. DEFAULT Auth-Type := Reject What I don't understand is why? If you do trust issuer of those certificates why are you "filtering"? And if you don't trust the issuer - why are you using client certificates? Ivan Kalik Kalik Informatika ISP

3 3

licensing question
by Steven Van Ingelgem 11 Jul '08

11 Jul '08

How does the GPL apply to the freeradius plugins? I want to create a freeradius plugin (completely my code), but does the GPL apply to it? I ask because dynamic linking is a very gray area in the GPL field. Thanks for your answer, Steven

3 4

general howto bandwidth control
by mike 11 Jul '08

11 Jul '08

hi folk, we have a little network with some cable modems. all modems use freeradius for authenticating and all useres use a pppoe session against freeradius to connect with the router. this works. now we want a bandwidth limitation for each modem. is this possible with freeradius? or how can we realize this in this enviroment (iptable rules are rejected from me...) ? my /etc/raddb/users looks like: DEFAULT Fall-Through = Yes #modem-client 000723023233 Auth-Type := Local, Cleartext-Password := "anonymous", NAS-Identifier == "000723023114" DS2-profile = 1 i searched for some documentation about this but nothing found. my guess is there is a options that can be inserted here, but where and how... thanks for any hints

3 4

detail records
by Roy Kartadinata 11 Jul '08

11 Jul '08

Hello all, We're using freeradius 2.0.5 in our test environment and noticed that our detail record doesn't have "Freeradius-Proxied-To" information like our current production radius which is still running an old version of freeradius. We currently setup the accounting record to be proxied to a remote radius server and running in debug mode showed that the accounting record was being sent to remote server but nothing in detail record. Is this something I have to specify on a config file? Cheers, Roy Kartadinata

3 6

Re: about EAP using 1.1.7 and 2.0.3
by Ryan Setiawan H 10 Jul '08

10 Jul '08

Alan wrote: > >hi, > > > >as Alan stated - your NAS doesnt seem to be getting > >the responses from your server. some ACL or routing issue? > >(stick a sniffer directly in front of the switch...if > >you need to, you may need to have a 'port mirror' or somesuch > >from the switch that feeds that switch if traffic is on a mgmt > >VLAN and .1q trunking is involved etc. > > > >dont worry about the errors from the ./configure - unless > >you are using any of those technologies (postgresql, oracle, > >TNC or IKEv2) - your server is 'normal' > > > >alan > > > > > >------------------------------ > Hi all, it's partially solve... I'm using a server as radius server and as vlan trunk that feed the switch tagged packet, also the server become gateway... after I using other server for radius, it work.... yeah the 1.1.7 radius is on other machine ( that's why it works )... so it's clear this not about freeradius version. thank alot all for your time Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

1 0

EAP-TTLS / LDAP
by joris 09 Jul '08

09 Jul '08

Hello, After reading the configuration file radiusd.conf, it explicitly says that one can't use LDAP as the authentication backend when you use EAP (in my case, i'm interested in EAP-TTLS). Nonetheless, I can read elsewhere on the web that some people seem to use both EAP and LDAP, so I wonder who is right ? I would use LDAP for storing all my users/password and EAP to protect my users credentials over insecure Wifi. Any advices ? Cheers, Joris

4 4

POP3
by Slava 09 Jul '08

09 Jul '08

Hi, Could anyone tell me if there exists a solution to integrate FR with a POP3 server in order to provide Radius controlled access to mailboxes via POP3? I am currently using cucipop Thank you Slava Shkarupin Kiev, UA

3 3