- Freeradius-Users - lists.freeradius.org

Re: rlm_opendirectory (FR 2.0.0)
by Steven Simon 12 Apr '08

12 Apr '08

I build it by adding rlm_opendirectory to the ./src/modules/stable file. Then, run: make distclean ./configure <stuff> etc… Everything you need should be on the desktop OS. Let me know if that is not the case. If you are on desktop, you'll probably want to set up a service access list. The magic group name that gets set up by the admin tools is: com.apple.access_radius. - Steven On Jan 22, 2008, at 7:54 AM, freeradius-users-request(a)lists.freeradius.org wrote: > From: Info <info(a)sparkmediagroup.com> > Date: January 22, 2008 7:50:57 AM PST > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > Subject: rlm_opendirectory (FR 2.0.0) > Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org > > > > > Hello all, > > Quick Qs about the experimental rlm_opendirectory module: > > * Has anyone built in this module successfully? > > * Is it possible to add this in without the other experimental > modules and, if so, what is the proper flag? (Note, I've tried on > separate runs --with-rlm_opendirectory, --enable-rlm_opendirectory, > and --with-modules="rlm_opendirectory" seemingly to no avail.) > > * Does the module need to be built against a server version of the > Framework or should I be able to build this from the libraries on > any os x workstation? > > Cheers, > > Jim

14 31

FW: Hello,
by Johan Nyman 12 Apr '08

12 Apr '08

Hello all! I am trying to get a wireless client to connect to the Freeradius server using WPA & WPA2 Enterprise . I have followed this guide: http://www.smallnetbuilder.com/content/view/30213/98/1/5/ But I am getting a few error messages from the radius console: 1: ++[mschap] returns noop rlm_realm: No '@' in User-Name = "puppypc", looking up realm NULL rlm_realm: No such realm "NULL 2: rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation 3: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because o ++[pap] returns noop I am gussing that any of the above are a hint to what could be the problem, could anyone point me in the right direction here? On where to look/what to change. how to fix. Attaching the entire outtake from the radius console. Thanks for help, Best regards, Johan

5 12

can't make a rpm from radius sources
by Cristian Novac 12 Apr '08

12 Apr '08

Hello all, I have downloaded freeradius-server-2.0.0.tar.gz and after intalling it, I made some code modifications to meet my expectations. Than I compiled again from the "src" directory using make && make install; after this, freeradius worked fine, as I intended; Now I would like to make a rpm from this modified version that I have. Could someone please tell me what steps should I follow in order to achieve this, a rpm from the modified sources. I would also like to preserve the modified configurations from the following files: eap.conf and users; and also two dictionaries that I manually added to the share/freeradius directory. Thank you in advance ! Cristian NOVAC.

2 1

RE: All attributes in rlm_sql_log or rlm_sql ?
by Dean Smith 12 Apr '08

12 Apr '08

Ultimately for the same reasons that rlm_detail exists. I'd like to give my ops guys the ability to see all attributes in requests and replies when they're debugging or monitoring. We want to maintain all records in a single SQL database with access via our existing web frontends...so I'd like the same detail as rlm_detail via the SQl modules. Obviously many ways to achieve it (parse and upload the detail log, dedicated perl module etc.) but my scripting/coding is weak so that will take me longer. Many thanks for the answers and other suggestions given. Dean Dean Smith wrote: > I guess I?m asking is there an unlang equivalent to this snippet from > rlm_detail.c. .. No. I don't see why it makes sense to log all of the attributes as one big line of text in SQL. If you need that, it shouldn't be hard to write a Perl plugin that does it. Alan DeKok. ------------------------------ Message: 8 Date: Thu, 10 Apr 2008 23:30:12 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: "Users" accounts file - was: Re: EAP-TTLS (PAP) not working with NT domain - debian freeradius 1.1.7 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <47FE86E4.1010100(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 James McOrmond wrote: > So, I figured the users file was a logical place.. Yes, if it's used, and if the rest of the policy is fine. > I added a line like this: > > radiustester User-Password := "xoageifo" > > but it's complaining it's not in ldap.. Run it in debugging mode: radiusd -X. Alan DeKok. ------------------------------ Message: 9 Date: Thu, 10 Apr 2008 18:45:15 -0400 (EDT) From: "Tuc at T-B-O-H.NET" <ml(a)t-b-o-h.net> Subject: Re: Restrict to initial NAS used to logon To: freeradius-users(a)lists.freeradius.org Message-ID: <200804102245.m3AMjFCa042294(a)himinbjorg.tucs-beachin-obx-house.com> Content-Type: text/plain; charset=us-ascii > > Tuc at T-B-O-H.NET wrote: > > Looking to restrict a user to only be able to log in > > and re-log in to the initial NAS they first ever logged onto. > > (Hotspot) Looking at the radacct file where it looks like > > the check-items normally go against, I'm not seeing anything I > > can use as an identifier. The nasipaddress is always 0.0.0.0. > > Maybe calledstationid, except if we swap equipment out during > > the lifetime of a users id it won't match. > > > > Is anyone doing anything like this already? > > They usually use equipment that sends a NAS identifier. > Hrm.... I just originally went on the assumption that the sending side was partially braindead, and wasn't sending it. Your comment made me dump a session on 1812 and 1813... 1812: Radius Protocol Code: Access-Request (1) Packet identifier: 0x0 (0) Length: 216 Authenticator: A9A4B05B3C01784A8DF58849DB987135 [The response to this request is in frame 2] Attribute Value Pairs AVP: l=5 t=User-Name(1): tuc AVP: l=18 t=CHAP-Challenge(60): 894209E703975A194529D13926790197 AVP: l=19 t=CHAP-Password(3): 0A6E0AEA789A9A0AF0E2A7F15B04E6A289 AVP: l=6 t=NAS-IP-Address(4): 0.0.0.0 AVP: l=6 t=Service-Type(6): Login-User(1) AVP: l=6 t=Framed-IP-Address(8): 192.168.182.4 AVP: l=19 t=Calling-Station-Id(31): 00-10-A4-10-8D-A6 AVP: l=19 t=Called-Station-Id(30): 00-16-01-91-E9-46 AVP: l=10 t=NAS-Identifier(32): TBOH2173 AVP: l=18 t=Acct-Session-Id(44): 47fe006e00000000 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=6 t=NAS-Port(5): 0 AVP: l=18 t=Message-Authenticator(80): F0AE0A9EE7DAC32F9AA6089A5A9C3A70 AVP: l=40 t=Vendor-Specific(26) v=WISPr(14122) 1813: Radius Protocol Code: Accounting-Request (4) Packet identifier: 0x6 (6) Length: 142 Authenticator: 48DCF71BE50EC2E9ECC17825FB6D2417 [The response to this request is in frame 2] Attribute Value Pairs AVP: l=6 t=Acct-Status-Type(40): Start(1) AVP: l=5 t=User-Name(1): tuc AVP: l=11 t=Class(25): 303730333435363738 AVP: l=19 t=Calling-Station-Id(31): 00-10-A4-10-8D-A6 AVP: l=19 t=Called-Station-Id(30): 00-16-01-91-E9-46 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=6 t=NAS-Port(5): 0 AVP: l=10 t=NAS-Port-Id(87): 00000000 AVP: l=6 t=NAS-IP-Address(4): 0.0.0.0 AVP: l=10 t=NAS-Identifier(32): TBOH2173 AVP: l=6 t=Framed-IP-Address(8): 192.168.182.4 AVP: l=18 t=Acct-Session-Id(44): 47fe006e00000000 So it looks like its sending it, just not making it into the radacct files. :-/ So where to start looking for that? > > Or, use the "Packet-Src-IP-Address" attribute. > Thats gonna take a bit of headscratching to figure out about. :) But thanks for the lead. Tuc ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 36, Issue 76 ************************************************

2 1

Dynamic IP Allocation With Freeradius
by Joel ＠ Gmail 12 Apr '08

12 Apr '08

Dear Friends, Right now I have setup working of freeradius with mysql authentication. I have static & dynamic group created in mysql and all seems working. Currently static IPs are provided by radius with mysql backend. But dynamic IP is provided by Cisco Router. Cisco router is configured as PPPOE/PPPOA. Cisco does all authentication with freeradius. Now what I want is to provided Dynamic IPs with freeradius instead of Cisco. I have searched alot and tried few setting but that didnt worked. Is it possible to configure USERS file and have all dynamic users get dynamically using USERS file ? I checked but wasnt sucessful. Or a solution in mysql itself. For testing i had activated below config in radiusd.conf ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } main_pool in accounting & post-auth modules. doing this and starting the radius gives me segmentation error. Any suggestion please ? Regards, Joel

2 1

Restrict to initial NAS used to logon
by Tuc at T-B-O-H.NET 12 Apr '08

12 Apr '08

Hi, Looking to restrict a user to only be able to log in and re-log in to the initial NAS they first ever logged onto. (Hotspot) Looking at the radacct file where it looks like the check-items normally go against, I'm not seeing anything I can use as an identifier. The nasipaddress is always 0.0.0.0. Maybe calledstationid, except if we swap equipment out during the lifetime of a users id it won't match. Is anyone doing anything like this already? Thanks, Tuc

3 7

RE: Stale Sessions
by Shane McKinley 12 Apr '08

12 Apr '08

No one has any ideas or suggestions? If I can solve this issue I will have a 'perfect' freeradius installation. And FYI I upgraded my server to a dual core 2BG of RAM and still the same issue resides. Thanks, Shane ________________________________ From: Shane McKinley Sent: Tuesday, April 08, 2008 11:17 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: Stale Sessions I have searched and searched, read the archives, etc. I feel that I may have a unique problem and just missing a piece of the puzzle. I have been running freeradius with a mysql database for over a year now. It is very stable and I am generally pleased. I have been having stale session issues on every one of my NASes. They range from Cisco 7200, Cisco 2600, and Livingston Portmasters. They all have stale sessions in the mysql database that never recieve a stop time. I am almost certain there are no network issues because it seems that start packets are never lost or update packets either. This is the aaa config on my Ciscos: aaa new-model ! ! aaa authentication login default local group radius aaa authentication login telnet line aaa authentication ppp default if-needed local group radius aaa authorization network default local group radius aaa authorization network iemcdslauth group radius local aaa accounting delay-start aaa accounting update newinfo aaa accounting network default start-stop group radius aaa session-id common ! radius-server attribute nas-port format d radius-server host X.X.X.X auth-port 1645 acct-port 1646 radius-server key 7 XXXXXXXXXXXXXXX So the question is, why are my NASs not sending stop packets, or why is the freeradius server not processing the stop packets? Is this a common problem? Feel free to also point me to some documents that may be of assistance. Maybe I don't have enough resources to process the commands? I have about 1500 users. This is my setup: openSuSE 10.2 Freeradius 1.1.13 MySQL 5.0.26 128MB RAM Pentium III Thanks for any help, Shane

5 6

PEAP/MS-CHAPv2 authentication to active directory
by Mitchell, Mark 12 Apr '08

12 Apr '08

Hello, I'm trying to get 802.1x authentication going using PEAP/MS-CHAPv2 but cant quite get it going (I think I'm pretty cloise though) so I'm hoping someone here can take a look at my debug output below and perhaps offer some helpful advice. Here's the specifics: Ubuntu 7.10, freeRADIUS 1.1.7, Samba 3.0. Note that there are calls to a freeNAC perl module called check_mac that performs mac-auth-bypass vlan assignment for non-802.1x compliant devices. I've followed the freeNAC instructions and tried some slight variations that I've found posted elsewhere but still not gettting it. I've gotten to the point where I can issue the ntlm_auth command "manually" and authenticate to AD so Samba, Winbind, and Kerberos seem to be OK. When I attempt to get freeRADIUS to do the ntlm_auth for me as described in the freeNAC docs and other web resources like deployingradius.com and the freeradius wiki, I keep getting logon failures. See attached radius debug output below. I'm just attaching the last part of the debug because for one it's quite large and two, it seems to be going well up to a certain point. My EAP-TLS tunnel appears to be getting setup fine but it just act as if my password is wrong. I'm using a Windows XP SP2 client with a recent PEAP patch added and have tried entering username/password/domain both manually and automatically. I am not validating the server cert at this point. Following is the end of the radius debug: . . . rad_recv: Access-Request packet from host 111.111.28.101:1645, id=245, length=264 User-Name = "SANDIA\\mgmitch" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-05-74-43-BD-3F" Calling-Station-Id = "00-0A-E4-23-CD-16" EAP-Message = 0x020800601900170301005590558ffa6f1d6b8a4bad64a0b8958aa4c140f2c145163dc92ee5b73ae341713f0466627a1454f0ad3f787b9ab756c8e07050b693f28f17f721c200525f544119a36d2d30e31ae5db2f44f8636bdc03c4f71a422436 Message-Authenticator = 0xb7b52cd2660e4b2695c96dc035368275 Cisco-NAS-Port = "GigabitEthernet1/4" NAS-Port = 50104 NAS-Port-Type = Ethernet State = 0x5a5253d83424d1e321022fa6ebfd1ece NAS-IP-Address = 111.111.28.101 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 perl_pool: item 0x8062e8a0 asigned new request. Handled so far: 3 found interpetator at address 0x8062e8a0 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x8062e8a0 modcall[authorize]: module "check_mac" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "SANDIA\mgmitch", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 96 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020800491a020800443191a4d2d65459406cb3e67baa8f903a120000000000000000fde26c946d2f343603ffe6e34f2ad40987f990c82eeecf550053414e4449415c6d676d69746368 PEAP: Setting User-Name to SANDIA\mgmitch PEAP: Adding old state with 56 ed PEAP: Sending tunneled request EAP-Message = 0x020800491a020800443191a4d2d65459406cb3e67baa8f903a120000000000000000fde26c946d2f343603ffe6e34f2ad40987f990c82eeecf550053414e4449415c6d676d69746368 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "SANDIA\\mgmitch" State = 0x56ed3aacd660b70c9a6a4fde3b0858f9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 perl_pool: item 0x809a4090 asigned new request. Handled so far: 3 found interpetator at address 0x809a4090 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x809a4090 modcall[authorize]: module "check_mac" returns ok for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "SANDIA\mgmitch", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 8 length 73 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for mgmitch with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=mgmitch' radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=SANDIA' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 8c radius_xlat: '--challenge=3f6d14e36675d931' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=fde26c946d2f343603ffe6e34f2ad40987f990c82eeecf55' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: leaving group authenticate (returns reject) for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x80674b80 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 245 to 111.111.28.101 port 1645 EAP-Message = 0x010900261900170301001b05fb2b4d0b7732c23c08f5b0c933d75f9c6e7c894c6f5eb0b85242 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x975785863b043e267c2ca1d79c291dde Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 111.111.28.101:1645, id=246, length=206 User-Name = "SANDIA\\mgmitch" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-05-74-43-BD-3F" Calling-Station-Id = "00-0A-E4-23-CD-16" EAP-Message = 0x020900261900170301001be11c8a187a3a255b0ded0e8a021d224bce90335e6c02dac30ab5e8 Message-Authenticator = 0xa2889de2b2358293a5d30fd95541b61b Cisco-NAS-Port = "GigabitEthernet1/4" NAS-Port = 50104 NAS-Port-Type = Ethernet State = 0x975785863b043e267c2ca1d79c291dde NAS-IP-Address = 111.111.28.101 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 perl_pool: item 0x8012eae0 asigned new request. Handled so far: 4 found interpetator at address 0x8012eae0 perl_pool total/active/spare [3/0/3] Unreserve perl at address 0x8012eae0 modcall[authorize]: module "check_mac" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "SANDIA\mgmitch", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure. User was rejcted rejected earlier in this session. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 246 to 111.111.28.101 port 1645 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3 seconds... If anyone can help shed light on this, I would sure appreciate it. Thanks, Mark

2 1

NAS sql
by A.L.M.Buxey＠lboro.ac.uk 11 Apr '08

11 Apr '08

hi, any reason why the NAS schema is not part of the database schema? nas.sql and schema.sql rather than just schema.sql? alan

2 3

postgres accounting schema
by A.L.M.Buxey＠lboro.ac.uk 11 Apr '08

11 Apr '08

hi, I wonder how many of you have needed to change the postgres schema for radacct table - the default value of VARCHAR(32) for the AcctSessionId seems to be very low - our user-names are often that long by themselves! (domain and full path when using machine auth for example) I've submitted a patch via the bugs system to put this up to something safer. perhaps time that we all peer through the current supplied values and what we are each using after we've fixed things? If others can start with sane values (no matter if its MySQL, PostgresQL, Orcale etc) then that can only be a good thing for our community. There was also talk about certain indexes and procedures recently. alan

1 0