- Freeradius-Users - lists.freeradius.org

Re : Re : Active Directory Integration
by pingouin osmolateur 01 Jul '08

01 Jul '08

Thanks Alan for your answer I follow your documentation and succeed with the part "Configuring FreeRADIUS to use ntlm_auth" So I want to use "Configuring FreeRADIUS to use ntlm_auth for MS-CHAP", so I delete my user in database. Do I have to keep the following line in my radiusd.conf ? exec ntlm_auth { wait = no program = "/path/to/ntlm_auth ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } authenticate { ... ntlm_auth ... } Here is my radiusd.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } But when I'm testing with a Alcatel client, here what I obtain : rlm_sql (sql): Read entry nasname=192.48.19.111,shortname=NANATESTPRC,secret=titi; rlm_sql (sql): Adding client 192.48.19.111 (NANATESTPRC) to clients list rlm_sql (sql): Released sql socket id: 4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=77 User-Name = "TOTO" User-Password = "toto" Cisco-AVPair = "shell:priv-lvl=1" NAS-IP-Address = 192.48.19.111 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "TOTO", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'TOTO' rlm_sql (sql): sql_set_user escaped user --> 'x073129' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'TOTO' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User TOTO not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'TOTO' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User TOTO not found in radgroupcheck rlm_sql (sql): Released sql socket id: 3 rlm_sql (sql): User not found modcall[authorize]: module "sql" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.48.19.111 port 49154 Waking up in 4 seconds... But I don't understand how to use a test client to send an MS-CHAP authentication request ? It's seem that i don't have a Auth-Type ? ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Juin 2008, 15h06mn 20s Objet : Re: Re : Active Directory Integration pingouin osmolateur wrote: > So I have to modify the first request from the client to use MS-CHAP request ? No. > Because in my database for the User-Name, I have the following Which is wrong. You were told it is wrong. > So what I have to do ? Delete that row from the database. The documentation tries to make it clear: Setting Auth-Type is wrong. Don't do it. > Do you have a link for Active Directory Integration ? See my web site: http://deployingradius.com Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

2 1

NAS-Post in Netgear Accounting-Packet
by Wolfgang Burger 01 Jul '08

01 Jul '08

Hi list, please have a look at this Accounting-Request. It was sent by a netgear WG102 WLAN-Access-Point: rad_recv: Accounting-Request packet from host 192.168.1.133 port 1033, id=48, length=194 Service-Type = Framed-User Acct-Status-Type = Stop User-Name = "burgerw" Framed-MTU = 1488 Acct-Session-Id = " 2" Acct-Authentic = RADIUS Acct-Session-Time = 159 Acct-Terminate-Cause = User-Request Acct-Delay-Time = 0 Called-Station-Id = "061B2F76F3B6:MPIIB-Guests" Calling-Station-Id = "0019E3D7B020" Framed-IP-Address = 192.168.20.34 NAS-Identifier = "netgear3" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" NAS-IP-Address = 192.168.1.133 NAS-Port = 0 NAS-Port-Id = "STA port # 0" The output of "radwho -R": User-Name = "burgerw" Acct-Session-Id = " 2" NAS-IP-Address = 192.168.1.133 NAS-Port = 1 Service-type = Login-User Framed-IP-Address = Acct-Session-Time = 359 Calling-Station-Id = "0019E3D7B020" The error: rlm_radutmp: Logout for NAS netgear3 port 0, but no Login record Is the Access-Point sending the wrong NAS-Port? If so, I would contact Netgear. I just want to confirm what`s the problem. Thanks and best regards Wolfgang Burger Mit freundlichen Grüßen Wolfgang Burger <burgerw(a)immunbio.mpg.de> Max-Planck-Institut fuer Immunbiologie Scientific Data Processing Unit (+00 49) 761 / 5108 461 Stuebeweg 51 D-79108 Freiburg Germany

2 2

Problem with regular expressions in users file (v.2.0.x)
by Massimo Pistoni 01 Jul '08

01 Jul '08

Hi all, I was using freeradius version 1.1.1 for a long time on a Scientific Linux v. 5.1 OS and it works fine. Now I am trying to update to the new version 2.0.5. I've converted all the necessary config files (in the /etc/raddb/ directory tree) getting successful authentication. Unfortunately I 've problems with the regular expressions used in the users file, that seems to not work at all. In my radius.conf file exist the following directives: regular_expressions = yes extended_expressions = yes Moreover the ./configure seems to have found the regex.h module and included it at compilation time. The symptom is that the third (but also the fourth for simpler tries) of the following users statements does not match in the case of authentication based on a <username@suffix> style (with Suffix =! "lnf.infn.it"): ----------------------------------------------------------------------------- DEFAULT Auth-Type = Kerberos, Suffix == "lnf.infn.it" DEFAULT Auth-Type = Kerberos, Suffix == "LNF.INFN.IT" DEFAULT Auth-Type := Reject, Suffix =~ "@", Suffix !~ "@(.+\\.|)(infn\\.it|INFN\\.IT)$" DEFAULT Auth-Type := Reject, Suffix =~ "@" ----------------------------------------------------------------------------- I tried several other syntax way, but it seems that regular expressions are disabled. The same users file is regularly working in the version 1.1.1 and 1.1.7 installed on the same system. Can someone help me? Thanks, bye, Massimo -- / | / _____/ / | / _____/ | / / / | / / / / | / / / | / / / | / ___/ _____/ / / | / ___/ / | / / / | / / / / | / / / | / ______/ _/ __/ _/ _/ _/ __/ _/ _/ __/ Massimo Pistoni phone: (+39)-06-9403.2372/2355 Computing Service fax: (+39)-06-9403.2649 LNF-INFN e-mail: Massimo.Pistoni(a)lnf.infn.it Via Enrico Fermi, 40 www: http://www.lnf.infn.it/ I-00044 Frascati, Italy

2 2

user expiration problem
by Umar 01 Jul '08

01 Jul '08

Hi ... im just wondering if my configuration is correct. I tried to disable a user through Expiration attribute but its not working. I am using 2.0.5 FreeRadius. here is the mysql output. | id | username | attribute | op | value | +----+----------+---------------+----+-------------+ | 1 | test | User-Password | == | test | | 2 | test | Expiration | := | 22 Jan 2006 Is there any other changes required? Please Help Regards, Umar Draz -- View this message in context: http://www.nabble.com/user-expiration-problem-tp18193568p18193568.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

[Fwd: LDAP CHAP born again]
by Ryan Setiawan H 01 Jul '08

01 Jul '08

Hi all, I've research & googling about LDAP and CHAP :D, but until now still don't work ... here the debug, and btw i'm using freeradius-1.1.7_2 : rad_recv: Access-Request packet from host 192.168.8.88:4609, id=30, length=48 User-Name = "testing" CHAP-Password = 0x30e3e28c521fe0d81b988d2475dae76f3f ------------cut--------------. rlm_ldap: Bind was successful rlm_ldap: performing search in ou=dialup,dc=zzz,dc=com, with filter (uid=testing) rlm_ldap: checking if remote access for testing is allowed by dialupAccess rlm_ldap: Password header not found in password Testing1 for user testing -----------cut--------------- * as you can see the radius module rlm_ldap can "see" the password for user testing, here the next one rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testing authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '/' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "IPASS" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "testing" with CHAP password rlm_chap: Could not find clear text password for user testing modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. ----------------cut------------- *this is classic problem, but until now there wasn't any straight answer for this one based on the faq on http://wiki.freeradius.org/index.php/FAQ#How_do_I_make_CHAP_work_with_LDAP.…, it is possible for using chap with ldap backend, also there is clue where parameter like password_header = "{clear}" password_attribute = userPassword password_radius_attribute = "User-Password" must be set.... but how? i'm still trying to read the code ( like rlm_chap.c ) to see what attribut does rlm_chap read for the password that was passed by the module ldap. but it is so arcane and "debuging code twice hard as writing the code at first place" anyone has solution for this matter? -- DISCLAIMER: The contents of this email and attachments are confidential and may be subject to legal privilege. Any unauthorized use, copying, disclosure or communicating any part of it to others is strictly prohibited and may be unlawful. If you are not the intended recipient you must not use, copy, distribute or rely on this email and should please return it immediately to the sender or notify us and delete the email and any attachments from your system. We cannot accept liability for loss or damage resulting from computer viruses. The integrity of email across the Internet cannot be guaranteed and PT BANK NISP, Tbk. will not accept liability for any claims arising as a result of the use of this medium for transmissions by or to PT BANK NISP, Tbk.

2 1

Accounting cisco commands
by Everton Diniz 01 Jul '08

01 Jul '08

Hi all, I´m looking for config the radius to accounting all commands that user do on cisco device. I didn´t find any documents with this sample. Anybody have this? Tks, Everton

2 1

openLDAP & freeRADIUS
by William E. Russell 30 Jun '08

30 Jun '08

All, I am currently working with openLDAP and freeRADIUS. I have correctly set up freeRADIUS to read from my openLDAP. I can't seem to authenticate my user. I have narrowed down the error to a single line, "rlm_eap_mschapv2: Invalid response type 4". From my hours of searching online, I have realized that all this means is that there was an error in the response packet. I have no idea what error could have occurred. I believe it may have to do with the password_attribute. I read something documentation that said there was some issue with LDAP and passing a cleartext password. Also, as you can see, I am using EAP/PEAP with MSCHAP. Any body have any insight in to this type of thing? If I could just get some help on how to set up the LDAP and RADIUS, that would be great - I have read just about every single tutorial so please don't direct me to one of those. I need someone who has a similar set up - what did you use for password attribute? William William E. W. Russell Member of Technical Staff (Software Development) 198 Brighton Avenue Long Branch, New Jersey 07740 Home #: 732-752-2037 Cell #: 732-744-6483

5 9

intermediate CA
by Sergio Yébenes Moreno 30 Jun '08

30 Jun '08

Hi I'm using freeradius-server-2.0.4 with eap-tls. I have a client cert signed by an intermediate authority B.pem . If I put CA_file = "B.pem" in eap.conf, I have this log: ..... rlm_eap_tls: Done initial handshake rlm_eap_tls: <<< TLS 1.0 Handshake [length 05f2], Certificate --> verify error:num=2:unable to get issuer certificate rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler ++[eap] returns reject ..... Looks normal because B.pem is signed by self-signed A.pem I don't know how to put this in eap.conf, TLS section, and also looks like client never sends his certificate.... can anybody help me? I need to use the two certificates because I'm not the signer. Thanks a lot P.D. EspaÃ±a 1 Alemania 0 rules

2 1

EAP method in logs
by Sergio Belkin 30 Jun '08

30 Jun '08

Hi, I use freeradius 2.0.2, and people can use either ttls or peap as they want (or can). I'd want to know if it's possible to see what EAP method are using users through radius logs... Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 13

Re : Active Directory Integration
by pingouin osmolateur 30 Jun '08

30 Jun '08

So I have to modify the first request from the client to use MS-CHAP request ? Because in my database for the User-Name, I have the following mysql> select * from radcheck ; +----+----------------------------------------+-----------+----+---------+ | id | UserName | Attribute | op | Value | +----+----------------------------------------+-----------+----+---------+ | 10 | TOTO@MYDOMAIN | Auth-Type | := | MS-CHAP | +----+----------------------------------------+-----------+----+---------+ 1 row in set (0.00 sec) So what I have to do ? Do you have a link for Active Directory Integration ? Thanks for you help ----- Message d'origine ---- De : Phil Mayers <p.mayers(a)imperial.ac.uk> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 30 Juin 2008, 13h53mn 23s Objet : Re: Active Directory Integration This: > rad_recv: Access-Request packet from host 192.48.19.111:49154, id=0, length=108 > User-Name = "TOTO@MYDOMAIN" > User-Password = "toto" > Cisco-AVPair = "shell:priv-lvl=1" > NAS-IP-Address = 192.48.19.111 ...is not an MS-CHAP request, as the later debug tells you: > modcall: entering group MS-CHAP for request 0 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: No MS-CHAP-Challenge in the request > modcall[authenticate]: module "mschap" returns reject for request 0 - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Une boite mail plus intelligente http://mail.yahoo.fr

3 2