- Freeradius-Users - lists.freeradius.org

intermediate ca @ radius
by Sergio Yébenes Moreno 02 Jul '08

02 Jul '08

I've posted a problem verifying client certicicate, because this is signed by an intermediate ca, this signed by root ca. Both intermediate and root are public authorities and I don't have any of two private keys, only my client provate key. Te point is very simple, having intermediate.pem and root.pem, I've just done this: cp intermediate.pem intermediateBoth.pem cat root.pem >> rootBoth.pem yeah....I'm wood about this. Access control based on DNI (National Document of Identity) ....mmmmm.....I like this Now, there are 2 more intermediate ca's, and I've read that freeradius can be configured with a number of virtual servers. Each one will have her rootBoth_x.pem ca_file. I'm wood with this forum also. Thanks

1 0

Re: [Fwd: LDAP CHAP born again]
by Ryan Setiawan H 02 Jul '08

02 Jul '08

Alan DeKok wrote: >>> Try installing 2.0.5 in a separate directory and configuring it. Odds >>> are it will work. >> >> in time I will try install it, but if i can't make this ( LDAP CHAP ) >> clear... definitely I will encounter the same problem again :) > > 2.0.5 has many, many fixes that aren't in 1.1.7. Some things that are >difficult to impossible in 1.1.7 are easy in 2.0.5. > > Alan DeKok. right now I have already installed 2.0.3 because the dependency just like 1.1.7 :D waw lot of change I see ... but here we go the debug User-Name = "testing" CHAP-Password = 0xee8f74f97f724f06e54a9862f98ccef299 +- entering group authorize ++[preprocess] returns ok rlm_chap: Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop rlm_realm: No '@' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for testing expand: (uid=%u) -> (uid=testing) expand: ou=dialup,dc=zzz,dc=com -> ou=dialup,dc=zzz,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 192.168.11.17:389, authentication 0 rlm_ldap: bind as memberUid=radius,ou=admin,dc=zzz,dc=com/radiusjuga to 192.168.11.17:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=dialup,dc=zzz,dc=com, with filter (uid=testing) rlm_ldap: Password header not found in password Testing10 for user testing rlm_ldap: Added User-Password = Testing10 in check items ------cut------ added user-password = Testing10 in check item .... this is the debug output difference compare to 1.1.7 ------cut------ rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type CHAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "testing" with CHAP password rlm_chap: Using clear text password "Testing10" for user testing authentication. rlm_chap: chap user testing authenticated succesfully ++[chap] returns ok Login OK: [testing/<CHAP-Password>] (from client local port 0) Finished request 0. Going to the next request Waking up in 4.9 seconds. It's just work :D thanks Alan however there is this strange string "Please update your configuration so that the "known good" clear text password is in Cleartext-Password, and not in User-Password." after I digging the freeradius.org, I see people also have this minor problem, and in a mail you say to change the attribute userpassword to cleartext-password. but in openldap schema v3 there isn't any attribute called cleartext-password... is there any explanation for this ... everyone if you don't mind :) . still digging in openldap forum :) Thanks Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

freeradius with wpa/wpa2 and win xp home
by Piotr Salwerowicz 02 Jul '08

02 Jul '08

hello I have problem with freeradius 2.x with wpa/wpa2 and win xp home sp2. I try to make 802.1x + wpa/wpa2 on my ap linksys/dd-wrt. The supplicants are windows xp home with sp2 with patch wpa/wpa2. On my access points i set wpa/wpa2 enterprise/mix/radius and every time i have in logs: "Sending Access-Challenge of..." and its not connect I setup my freeradius on base this site: http://www.tldp.org/HOWTO/8021X-HOWTO/freeradius.html to set up freeradius, but there is some problem, its don't work thanks for any help it's my logs from freeradius: Cleaning up request 2696 ID 0 with timestamp +51465 User-Name = "alan" NAS-IP-Address = 10.0.0.7 Called-Station-Id = "0016b6c92839" Calling-Station-Id = "0018f8368ad4" NAS-Identifier = "0016b6c92839" NAS-Port = 40 Framed-MTU = 1400 State = 0xe31b561ae01f4f79765637cf0502aac5 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xc748764c47aff91a6202064c0d293641 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "alan", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 4 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.0.0.7 port 2061 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe31b561ae71e4f79765637cf0502aac5 Finished request 2697. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2697 ID 0 with timestamp +51465 Ready to process requests. and my conf radiusd.conf (...) hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = yes } proxy_requests = yes $INCLUDE proxy.conf $INCLUDE clients.conf snmp = no $INCLUDE snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf $INCLUDE sql.conf $INCLUDE sql/mysql/counter.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ authorize { preprocess mschap suffix eap files } authenticate { Auth-Type MS-CHAP { mschap } eap } users : alan User-Password == "alan" eap.conf: eap { default_eap_type = peap tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random } peap { default_eap_type = mschapv2 virtual_server = "inner-tunnel" } mschapv2 { } } cat modules/mschap |grep -v '#' mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes authtype = MS-CHAP } ---------------------------------------------------------------------- Zobacz cala prawde o Lukaszu Podolskim! kliknij >>> http://link.interia.pl/f1e57

4 6

Re : Re : Active Directory Integration
by pingouin osmolateur 02 Jul '08

02 Jul '08

Thanks Alan for your answer I follow your documentation and succeed with the part "Configuring FreeRADIUS to use ntlm_auth" So I want to use "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP", so I delete my user in database. Do I have to keep the following line in my radiusd.conf ? exec ntlm_auth { wait = no program = "/path/to/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } authenticate { ... ntlm_auth ... } Here is my radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } But when I'm testing with a Alcatel client, here what I obtain : rlm_sql (sql): Read entry nasname=192.48.19.111,shortname=NANATESTPRC,secret=titi; rlm_sql (sql): Adding client 192.48.19.111 (NANATESTPRC) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=77 User-Name = "TOTO" User-Password = "toto" Cisco-AVPair = "shell:priv-lvl=1" NAS-IP-Address = 192.48.19.111 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "TOTO", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'TOTO' rlm_sql (sql): sql_set_user escaped user --> 'x073129' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TOTO' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User TOTO not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User TOTO not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.48.19.111 port 49154 Waking up in 4 seconds... But I don't understand how to use a test client to send an MS-CHAP authentication request ? It's seem that i don't have a Auth-Type ? ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Juin 2008, 15h06mn 20s Objet : Re: Re : Active Directory Integration pingouin osmolateur wrote: > So I have to modify the first request from the client to use MS-CHAP request ? No. > Because in my database for the User-Name, I have the following Which is wrong. You were told it is wrong. > So what I have to do ? Delete that row from the database. The documentation tries to make it clear: Setting Auth-Type is wrong. Don't do it. > Do you have a link for Active Directory Integration ? See my web site: http://deployingradius.com Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

Réf. : Re: Freeradius 2.0.5 & %{Ldap-UserDn} not correctly expanded ?
by Pierre.Strazza-prestataire＠labanquepostale.fr 02 Jul '08

02 Jul '08

Thanks a lot, that was the point. Pierre Pierre.Strazza-prestataire(a)labanquepostale.fr wrote: > Trying to setup group membership filtering against LDAP group membership > for user authentication and authorization, seems that %{Ldap-UserDn} is > not correctly expanded (shown as blank) in my conf. > Does anyone experienced same problems or has any idea about what is wrong > in my conf ? In 2.0, it's in %{check:LDAP-UserDn}, I think. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html A partir du 30 juin, le siege social et l'adresse postale de La Banque Postale a Paris changent et deviennent: 115, rue de Sevres, 75275 Paris Cedex 06 Le No du standard du Siege Central de la Banque Postale a Paris devient: 01 57 75 60 00 Le papier est un bien precieux, ne le gaspillez pas. N'imprimez ce document que si vous en avez vraiment besoin ! Ce message est confidentiel. Sous reserve de tout accord conclu par ecrit entre vous et La Banque Postale, son contenu ne represente en aucun cas un engagement de la part de La Banque Postale. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee prealablement. Si vous n'etes pas destinataire de ce message, merci d'en avertir immediatement l'expediteur.

1 0

Freeradius 2.0.5 & %{Ldap-UserDn} not correctly expanded ?
by Pierre.Strazza-prestataire＠labanquepostale.fr 02 Jul '08

02 Jul '08

Hello, Trying to setup group membership filtering against LDAP group membership for user authentication and authorization, seems that %{Ldap-UserDn} is not correctly expanded (shown as blank) in my conf. Does anyone experienced same problems or has any idea about what is wrong in my conf ? Here are some revelants parts : radiusd.conf ------------------ module { [...] ldap ldap { server = "myldapserver" identity = "cn=admin,dc=myorg" password = passw basedn = "dc=myorg" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=person)" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap auto_header = yes groupname_attribute = cn groupmembership_filter = "(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))" # groupmembership_attribute = cn } [...] } [..] Autz-Type LDAP { ldap } expiration logintime pap } authenticate { Auth-Type LDAP { ldap } } [...] users (matching huntgroup name "clientasa") ------------------------------------------------------------------ DEFAULT Huntgroup-Name == "clientasa", Ldap-Group=="ASA", Autz-Type := LDAP DEFAULT Auth-Type := Reject LDAP extract : -------------------- dn: cn=ASA, dc=myorg objectClass: groupOfNames objectClass: posixGroup objectClass: sambaGroupMapping objectClass: top cn: ASA gidNumber: 512 member: uid=test,ou=people,dc=myorg dn: uid=test,ou=people,dc=myorg objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: posixAccount objectClass: sambaSamAccount objectClass: shadowAccount objectClass: top cn: test gidNumber: 512 uid: test uidNumber: 0 loginShell: /bin/bash userPassword:: {SSHA}mypassword Debug info ---------------- rad_recv: Access-Request packet from host xxxxx port 1025, id=185, length=109 User-Name = "test" NAS-IP-Address = ip1 Calling-Station-Id = "xxxxxxx" User-Password = "mypassword" NAS-Port = 96 Cisco-AVPair = "ip:source-ip=xxxxxxxxxx" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_ldap: Entering ldap_groupcmp() expand: dc=myorg -> dc=myorg WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldapserver:389, authentication 0 rlm_ldap: bind as cn=admin,dc=myorg/ldappassword to ldapserver:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=myorg, with filter (uid=test) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (&(objectClass=GroupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=GroupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=myorg, with filter (&(cn=ASA)(&(objectClass=GroupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group ASA not found or user is not a member. users: Matched entry DEFAULT at line 210 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [test/mypassword] (from client pixasa port 96 cli xxxxxxx) Sending Access-Reject of id 185 to ip1 port 1025 Finished request 0. A partir du 30 juin, le siege social et l'adresse postale de La Banque Postale a Paris changent et deviennent: 115, rue de Sevres, 75275 Paris Cedex 06 Le No du standard du Siege Central de la Banque Postale a Paris devient: 01 57 75 60 00 Le papier est un bien precieux, ne le gaspillez pas. N'imprimez ce document que si vous en avez vraiment besoin ! Ce message est confidentiel. Sous reserve de tout accord conclu par ecrit entre vous et La Banque Postale, son contenu ne represente en aucun cas un engagement de la part de La Banque Postale. Toute publication, utilisation ou diffusion, meme partielle, doit etre autorisee prealablement. Si vous n'etes pas destinataire de ce message, merci d'en avertir immediatement l'expediteur.

2 1

Nthashes with smbencrypt
by Eduardo Cavalcanti 02 Jul '08

02 Jul '08

I want to create password hashes of the LDAP users. I need this because peap/mschapv2 doesn't read encrypted passwords, but nt hashes. I can use smbencrypt to do this but I don't know how to do. Anyone knows how to create nt hashes using smbencrypt?? thanks.

2 2

Re: [Fwd: LDAP CHAP born again]
by Ryan Setiawan H 02 Jul '08

02 Jul '08

Hi Alan, thanks for your reply Alan Dekok wrote : > If the LDAP server gives FreeRADIUS the clear-text password, then CHAP > should work. yes the LDAP server already gave clear text password, you can see in the debug below >> rad_recv: Access-Request packet from host 192.168.8.88:4609, id=30, >> length=48 >> >> User-Name = "testing" >> CHAP-Password = 0x30e3e28c521fe0d81b988d2475dae76f3f >> ------------cut--------------. >> rlm_ldap: Bind was successful >> rlm_ldap: performing search in ou=dialup,dc=zzz,dc=com, with filter >> (uid=testing) >> rlm_ldap: checking if remote access for testing is allowed by dialupAccess >> rlm_ldap: Password header not found in password Testing1 for user testing > > And does CHAP work for this user? no... what I mean is the module ldap (rlm_ldap) could see the password for user testing.... that is Testing1 ( yes this is the password ) the LDAP should pass this clear text password ( Testing1 ) for module CHAP to authenticate >> also there is clue >> where parameter like >> password_header = "{clear}" >> password_attribute = userPassword >> password_radius_attribute = "User-Password" >> must be set.... but how? > > in the "ldap" section of radiusd.conf, where the LDAP parameters are >configured. yes I've configure that string in radiusd.conf section ldap... for password_attribute, clearly it must contain userPassword ( attribute the LDAP server keeps the password ) but how about password_radius_attribute ? from the faq password_radius_attribute is radius attribute where the user password will be stored after being extracted from LDAP is password_radius_attribute should contain string "User-Password" or "Clear-text Password" or maybe "CHAP-Password? what attribute does CHAP read for authentication? >> i'm still trying to read the code ( like rlm_chap.c ) to see what >> attribut does rlm_chap read for the password that was passed by the >> module ldap. but it is so arcane and "debuging code twice hard as >> writing the code at first place" > > Don't read the code. It won't help you. yeah... it killing me ( the code ) :D >> anyone has solution for this matter? > > Try installing 2.0.5 in a separate directory and configuring it. Odds >are it will work. in time I will try install it, but if i can't make this ( LDAP CHAP ) clear... definitely I will encounter the same problem again :) Thank You Ryan Setiawan H -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

unlang 'if' expansion
by Pshem Kowalczyk 01 Jul '08

01 Jul '08

Hi, We use freeradius 2.0.5, currently for testing. I've encountered a weird problem with if expansion: config: server local_logger { listen { type = detail filename = ${radacctdir}/detail_local load_factor = 20 } listen { type = acct ipaddr = * port = 1822 secret = xxxxxx } accounting { if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop"){ ok } else{ sql_localhost } } } debug: detail_recv: Read packet from /var/log/freeradius/radacct/detail_local User-Name = "roatt" NAS-Port = 117440512 NAS-IP-Address = 10.119.255.91 Framed-IP-Address = xx.yy..135.238 Filter-Id = "normal" NAS-Identifier = "akl-grafton-bras2" Acct-Status-Type = Interim-Update Acct-Delay-Time = 23 Acct-Input-Octets = 2253089 Acct-Output-Octets = 26743952 Acct-Session-Id = "akl-gra07000000000000e3b284039482" Acct-Authentic = RADIUS Acct-Session-Time = 27000 Acct-Input-Packets = 20268 Acct-Output-Packets = 27407 Acct-Input-Gigawords = 0 Acct-Output-Gigawords = 0 Event-Timestamp = "Jul 2 2008 10:26:27 NZST" NAS-Port-Type = Virtual Calling-Station-Id = "GigabitEthernet 10/0.90810:9-810#587203901#INFA290611:RIC-RAN-21 to RIC-ETH51 port 2/1/1##pppoe 00:90:d0:6a:aa:eb#" NAS-Port-Id = "slot=7;subslot=0;port=0;vlanid=0;" Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IPv4 Tunnel-Server-Endpoint:0 = "10.176.0.230" Tunnel-Client-Endpoint:0 = "222.152.43.30" Service-Type = Framed-User Framed-Protocol = PPP Huawei-IPHost-Addr = "xx.yy.135.238 ff:ff:ff:ff:ff:ff" Huawei-Input-Peak-Rate = 0 Huawei-Input-Average-Rate = 0 Huawei-Output-Peak-Rate = 0 Huawei-Output-Average-Rate = 0 Huawei-Priority = 0 Huawei-Connect-ID = 39482 Huawei-Domain-Name = "ihug-ubs" Huawei-Qos-Profile-Name = "default" Proxy-State = 0x313134 Huntgroup-Name = "ADSL" Acct-Unique-Session-Id = "c5f44e1423b4012a" server local_logger { +- entering group accounting ++? if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") expand: %{Acct-Session-Time} -> 27000 ? Evaluating ("%{Acct-Session-Time}" == 0 ) -> FALSE Skipping ("%{Acct-Delay-Time}" == 0 ) ++? if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") -> TRUE ++- entering if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") +++[ok] returns ok ++- if ("%{Acct-Session-Time}" == 0 && "%{Acct-Delay-Time}" == 0 && "%{Acct-Status-Type}" == "Stop") returns ok ++ ... skipping else for request 1: Preceding "if" was taken } # server local_logger As you can see the first condition evaluates to FALSE (which is expected, but then the whole expression turns TRUE, which is somewhat unexpected. The reason for having that condition is to filter out packets that have 0 session time that cause issues with rlm_sql. If I re-write to condition like this: accounting { if ("%{Acct-Session-Time}" == 0){ if ("%{Acct-Delay-Time}" == 0){ if ("%{Acct-Status-Type}" == "Stop"){ ok } else{ sql_localhost } } else{ sql_localhost } } else{ sql_localhost } } it works as expected, just looks ugly :-( kind regards Pshem

2 2

Proxy Timeout Behavior
by David Mitchell 01 Jul '08

01 Jul '08

I'm trying to figure out how to have FreeRadius not send an authentication failed response if it can't reach a proxy. What I would prefer is that it simply not respond at all. That would allow my NAS to fall back to using a local password if my proxy is down or unreachable. A quick look at the source to event.c makes it appear that sending the reject is hard coded. Is there some way around this that I'm missing? Thanks in advance, -David Mitchell -- ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 3