- Freeradius-Users - lists.freeradius.org

802.1x maschine auth with SSL?
by mrhotstandby＠gmail.com 25 Mar '08

25 Mar '08

Heya, i'm a bit stuck. My xp box should auth with ssl cert - works ok so far. But how to assign vlan? When doing this with user, i put my user + pass into users file - works. But for ssl cert? I want my xp box authentificated by ssl cert and after that, my user should logon to "his" vlan. So that i have a "protected" vlan for "my" boxes (to avoid giving access to my auth server to foreign notebooks) and after that, if someone of my users log in, he will be transfered to his vlan... hope you understand... Thanksalot!

3 5

Re: Freeradius-Users Digest, Vol 35, Issue 80
by srdjan mish 25 Mar '08

25 Mar '08

No, it is ClearText-Password... I told, when I test with same attributes, but with RadiusTest software, it works... I think it is something about NAS Type or something like that....... I can post -X, but it only says Wrong password, nothing more... radiusd -X: ************************************************************************************************ FreeRADIUS Version 2.0.2, for host i686-suse-linux-gnu, built on Mar 10 2008 at 14:15:45 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including configuration file /etc/raddb/snmp.conf including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/dialup1.conf including configuration file /etc/raddb/sql/mysql/dialup2.conf including configuration file /etc/raddb/sql/mysql/counter.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 35000 allow_core_dumps = yes pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no security { max_attributes = 200 reject_delay = 0 status_server = yes } } client Router { ipaddr = 192.168.1.1 netmask = 16 require_message_authenticator = no secret = "secrettest" shortname = "LocalRouter" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server_pool my_auth_failover { type = fail-over home_server = localhost } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_sql Module: Instantiating sql_instance1 sql sql_instance1 { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "lozinka" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 10 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_reply_query = "SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT id, groupname, attribute, value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id" authorize_group_reply_query = "SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id" accounting_onoff_query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = unix_timestamp('%S') - unix_timestamp(acctstarttime), acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = %{%{Acct-Delay-Time}:-0} WHERE acctsessiontime = 0 AND acctstoptime = NULL AND nasipaddress = '%{NAS-IP-Address}' AND acctstarttime <= '%S'" accounting_update_query = "UPDATE radacct SET framedipaddress = '%{Framed-IP-Address}', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_update_query_alt = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctsessiontime, acctauthentic, connectinfo_start, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, servicetype, framedprotocol, framedipaddress, acctstartdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{X-Ascend-Session-Svr-Key}')" accounting_start_query = "" accounting_start_query_alt = "UPDATE radacct SET acctstarttime = '%S', acctstartdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_start = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query = "UPDATE radacct SET acctstoptime = '%S', acctsessiontime = '%{Acct-Session-Time}', acctinputoctets = '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', acctoutputoctets = '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', acctterminatecause = '%{Acct-Terminate-Cause}', acctstopdelay = '%{%{Acct-Delay-Time}:-0}', connectinfo_stop = '%{Connect-Info}' WHERE acctsessionid = '%{Acct-Session-Id}' AND username = '%{SQL-User-Name}' AND nasipaddress = '%{NAS-IP-Address}'" accounting_stop_query_alt = "INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', DATE_SUB('%S', INTERVAL (%{%{Acct-Session-Time}:-0} + %{%{Acct-Delay-Time}:-0}) SECOND), '%S', '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', '%{%{Acct-Input-Gigawords}:-0}' << 32 | '%{%{Acct-Input-Octets}:-0}', '%{%{Acct-Output-Gigawords}:-0}' << 32 | '%{%{Acct-Output-Octets}:-0}', '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{%{Acct-Delay-Time}:-0}')" group_membership_query = "SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority" connect_failure_retry_delay = 2 simul_count_query = "SELECT COUNT(*) FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" simul_verify_query = "SELECT radacctid, acctsessionid, username, nasipaddress, nasportid, framedipaddress, callingstationid, framedprotocol FROM radacct WHERE username = '%{SQL-User-Name}' AND acctstoptime = NULL" postauth_query = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S')" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql_instance1): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_instance1): Attempting to connect to radius@localhost:/radius rlm_sql (sql_instance1): starting 0 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_instance1): Connected new DB handle, #0 rlm_sql (sql_instance1): starting 1 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_instance1): Connected new DB handle, #1 rlm_sql (sql_instance1): starting 2 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_instance1): Connected new DB handle, #2 rlm_sql (sql_instance1): starting 3 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_instance1): Connected new DB handle, #3 rlm_sql (sql_instance1): starting 4 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_instance1): Connected new DB handle, #4 rlm_sql (sql_instance1): starting 5 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #5 rlm_sql_mysql: Starting connect to MySQL server for #5 rlm_sql (sql_instance1): Connected new DB handle, #5 rlm_sql (sql_instance1): starting 6 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #6 rlm_sql_mysql: Starting connect to MySQL server for #6 rlm_sql (sql_instance1): Connected new DB handle, #6 rlm_sql (sql_instance1): starting 7 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #7 rlm_sql_mysql: Starting connect to MySQL server for #7 rlm_sql (sql_instance1): Connected new DB handle, #7 rlm_sql (sql_instance1): starting 8 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #8 rlm_sql_mysql: Starting connect to MySQL server for #8 rlm_sql (sql_instance1): Connected new DB handle, #8 rlm_sql (sql_instance1): starting 9 rlm_sql (sql_instance1): Attempting to connect rlm_sql_mysql #9 rlm_sql_mysql: Starting connect to MySQL server for #9 rlm_sql (sql_instance1): Connected new DB handle, #9 Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating sql_instance2 sql sql_instance2 { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "lozinka" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "INSERT INTO online VALUES('%{User-Name}','%S')" accounting_start_query_alt = "" accounting_stop_query = "DELETE FROM online WHERE username='%{User-Name}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 2 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql_instance2): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_instance2): Attempting to connect to radius@localhost:/radius rlm_sql (sql_instance2): starting 0 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_instance2): Connected new DB handle, #0 rlm_sql (sql_instance2): starting 1 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_instance2): Connected new DB handle, #1 rlm_sql (sql_instance2): starting 2 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_instance2): Connected new DB handle, #2 rlm_sql (sql_instance2): starting 3 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_instance2): Connected new DB handle, #3 rlm_sql (sql_instance2): starting 4 rlm_sql (sql_instance2): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_instance2): Connected new DB handle, #4 Module: Instantiating sql_instance3 sql sql_instance3 { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "radius" password = "lozinka" radius_db = "radius" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "" authorize_reply_query = "" authorize_group_check_query = "" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "UPDATE status SET status=1 where username='%{User-Name}'" accounting_start_query_alt = "" accounting_stop_query = "UPDATE status SET status=0 where username='%{User-Name}'" accounting_stop_query_alt = "" connect_failure_retry_delay = 2 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } rlm_sql (sql_instance3): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql_instance3): Attempting to connect to radius@localhost:/radius rlm_sql (sql_instance3): starting 0 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql_instance3): Connected new DB handle, #0 rlm_sql (sql_instance3): starting 1 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql_instance3): Connected new DB handle, #1 rlm_sql (sql_instance3): starting 2 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql_instance3): Connected new DB handle, #2 rlm_sql (sql_instance3): starting 3 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql_instance3): Connected new DB handle, #3 rlm_sql (sql_instance3): starting 4 rlm_sql (sql_instance3): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql_instance3): Connected new DB handle, #4 Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_ippool Module: Instantiating main_pool ippool main_pool { session-db = "/etc/raddb/db.ippool" ip-index = "/etc/raddb/db.ipindex" key = "%{NAS-IP-Address} %{NAS-Port}" range-start = 192.168.1.100 range-stop = 192.168.1.254 netmask = 255.255.255.255 cache-size = 154 override = no maximum-timeout = 0 } Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1812 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 1812, id=76, length=57 User-Name = "testuser" CHAP-Password = 0xc51357f23c896c36ac81e6237b4934c122 NAS-IP-Address = 212.200.103.3 +- entering group authorize ++[preprocess] returns ok rlm_chap: Setting 'Auth-Type := CHAP' ++[chap] returns ok expand: %{User-Name} -> testuser rlm_sql (sql_instance1): sql_set_user escaped user --> 'testuser' rlm_sql (sql_instance1): Reserving sql socket id: 9 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id rlm_sql (sql_instance1): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser' ORDER BY priority expand: SELECT id, groupname, attribute, value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupcheck WHERE groupname = 'VPNUsers' ORDER BY id rlm_sql (sql_instance1): Released sql socket id: 9 ++[sql_instance1] returns ok rad_check_password: Found Auth-Type CHAP auth: type "CHAP" +- entering group CHAP rlm_chap: login attempt by "testuser" with CHAP password rlm_chap: Using clear text password "nipal28ilula" for user nipalilula authentication. rlm_chap: Password check failed ++[chap] returns reject auth: Failed to validate the user. Login incorrect (rlm_chap: Wrong user password): [nipalilula/<CHAP-Password>] (from client LocalRouter port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 76 to 192.168.1.1 port 1812 Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 4.0 seconds. Cleaning up request 0 ID 76 with timestamp +78 Ready to process requests. ********************************************************************************************* THX in advance.... > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: FreeRad 2.0.2, l2tp & CHAP problem > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <zHhPuP8b.1206438461.5050800.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Is the password in the database encrypted? If it is: > > http://deployingradius.com/documents/protocols/compatibility.html > > If it isn't - post the radiusd -X debug. > > Ivan Kalik > Kalik Informatika ISP >

2 1

Error when testing FreeRadius
by Moses Ndala 25 Mar '08

25 Mar '08

Dear all, I have installed FreeRadius in Windows XP Professional but I keep getting this error ehen testing: radclient:dict_init:couldn't open dictionary "freeradisu/etct/raddb/dictionary":No such file or directory. Is there anyone who has an idea about this error? Thanks in advance. Kind regards Moise Ndala _________________________________________________________________ Express yourself with free Messenger emoticons. Get them today! http://g.msn.ca/ca55/207

2 1

ldap+radius authentication problem
by amir shrestha 25 Mar '08

25 Mar '08

Dear all, I have configured freeradius with ldap backed as given in http://freeradius.org/radiusd/doc/ldap_howto.txt. The user get authorized but the authentication failed. The detail output is here: Ready to process requests. rad_recv: Access-Request packet from host a.b.c.d:3272, id=0, length=47 User-Name = "abc" User-Password = "12345" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for abc radius_xlat: '(uid=abc)' radius_xlat: 'ou=users,ou=radius,dc=whitehouse,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to x.x.x.x:389, authentication 0 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as cn=Manager,dc=whitehouse,dc=edu/password to x.x.x.x:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=radius,dc=whitehouse,dc=edu, with filter (uid=abc) rlm_ldap: Added password 12345 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user abc authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "abc" with password "12345" rlm_ldap: user DN: uid=abc,ou=users,ou=radius,dc=whitehouse,dc=edu rlm_ldap: (re)connect to x.x.x.x:389, authentication 1 rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow rlm_ldap: bind as uid=abc,ou=users,ou=radius,dc=whitehouse,dc=edu/12345 to x.x.x.x:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: leaving group LDAP (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Can anyone help me??

2 1

NTLM in MSCHAP
by David Hláčik 25 Mar '08

25 Mar '08

Hi, I have working configuration of PPTPD (Windows VPN) trought Radius to LDAP stored users. The think is ,that it accepts only plain text stored passwords in ldap becouse of very well known NT-Password for MSCHAPv2 I figure out there is an option to make it work with ntlm_auth in mschap configuration in radius. But when I enable it : #with_ntdomain_hack = yes # The module can perform authentication itself, OR # use a Windows Domain Controller. This configuration # directive tells the module to call the ntlm_auth # program, which will do the authentication, and return # the NT-Key. Note that you MUST have "winbindd" and # "nmbd" running on the local machine for ntlm_auth # to work. See the ntlm_auth program documentation # for details. # # Be VERY careful when editing the following line! # ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-Use r-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT- Response:-00}" } I am getting following error : rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 1 rlm_mschap: Told to do MS-CHAPv2 for boss with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 6b radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=boss --challenge=09c34801a6bafab3 --nt-response=e9aa9365702850c20847566b84c4c729efbac9d014ff1301' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=boss --challenge=09c34801a6bafab3 --nt-response=e9aa9365702850c20847566b84c4c729efbac9d014ff1301 Exec-Program output: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) Exec-Program-Wait: plaintext: NT_STATUS_CANT_ACCESS_DOMAIN_INFO (0xc00000da) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 1 But I am not sending a domain trought VPN connection (I have it clear). I have also tried #with_ntdomain_hack = yes But without result. Please help me, David

3 4

Sorry Anthony Cope is out of the office until 31/03/2008
by Anthony Cope 25 Mar '08

25 Mar '08

I will be out of the office starting Tue 25/03/2008 and will not return until Mon 31/03/2008. I will respond to your message when I return.

1 0

new dictionary problem....
by Cristian Novac 25 Mar '08

25 Mar '08

Hi all, I know there already was this problem posted on the list, but I still have problems adding a new dictionary file to freeradius; Could anyone please state the steps I have to follow to manually attach a new dictionary to my installed freeradius. Thank you !

3 4

FreeRad 2.0.2, l2tp & CHAP problem
by srdjan mish 25 Mar '08

25 Mar '08

Hi, I have a problem while autorizing with chap password.... Problem is next: I have Allied Telesys NAS, it sends User-Name, CHAP Password and NAS IP, radius does everything ok, but when it comes to part where he compares password it says: "Wrong password"... I was debugging with -X -xx, and FR resolves password OK. It gets password from MySql database... Why am I asking for help is next: When I use radiusTest software from windows machine, send same data as NAS sends, authorisation goes OK... Please help, how can I set it up to work for me....

2 1

auth-type local trouble in 2.0.1
by Oleg Kozheltsev 25 Mar '08

25 Mar '08

Hello, After update from 1.1.7 to 2.0.1 on FreeBSD 6.3 (from ports), 'users' file seems not fully read... TEST User-Password == "TEST", Auth-Type := Local Exec-Program-Wait = "/home/corp/aaa/auth_test" 1.1.7 debug: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321' rlm_detail: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d expands to /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 modcall[authorize]: module "auth_log" returns ok for request 1 users: Matched entry TEST at line 218 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password 2.0.1 debug: +- entering group authorize ++[preprocess] returns ok expand: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d -> /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 rlm_detail: /var/corp/radacct/%{Client-IP-Address}/%Y/%m/auth-detail-%Y%m%d expands to /var/corp/radacct/1.1.1.1/2008/03/auth-detail-20080321 expand: %t -> Fri Mar 21 17:45:57 2008 ++[auth_log] returns ok WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry TEST at line 218 ++[files] returns ok rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [TEST/TEST] (from client c3640 port 0 cli 77777777) auth: Failed to validate the user. Login incorrect: [TEST/TEST] (from client c3640 port 0 cli 7777777) Sample config files readed, web and list archive searched - no one have same problem. In 2.x configs something must be added? No one use this? Can someone: "...You should first discuss it on the users list, to see if anyone can reproduce it..." please :) or this is bug, and he must be reported?... Thanks

4 7

Multiple switches access + ldap
by julio＠pop-pe.rnp.br 25 Mar '08

25 Mar '08

Hello all, I want to know if this kind of answer by RADIUS is possible: I need to authenticate some users for the switches in my network (all from 3com) and the users don't have the same access level in all switches, for example, the user1 has admin access level in SWITCH1 and don't have access for SWITCH2, but the user2 has admin access to both of them. I have a working configuration where a user have the same access level for all switches and in this way I have a LDAP base like this: uid = user1 userPassword = teste 3Com-User-Access-Level = 3Com-Administrator I was thinking about change the configuration of my LDAP database creating a child fo each switch that the user has access and in this subtree put the level of access, making the LDAP base 'appear' like this: uid = user1 userPassword = teste / \ cn = SWITCH1 cn = SWITCH2 ....... 3com-level = admin 3com-level = level ....... Is this a good way of doing this? There are another ways? Using this way how can I put the right answer in RADIUS reply? Thanks Julio Andrade

2 2