- Freeradius-Users - lists.freeradius.org

Re: Radius MAC filtering with EAP-PEAP
by Ivan Kalik 27 Feb '08

27 Feb '08

>Could you please suggest me how can I check MAC filter(via Radius) and after >that do EAP-PEAP authorization? > Read your NAS documentation. Ivan Kalik Kalik Informatika ISP

2 1

Radius MAC filtering with EAP-PEAP
by Alexey Eronko 27 Feb '08

27 Feb '08

I want to setup two WIFI networks: MAC Filter with EAP-PEAP. MAC Filter with WEP. How can I use Radius MAC filtering and EAP-PEAP simultaneously in one network. Could you please suggest me how can I check MAC filter(via Radius) and after that do EAP-PEAP authorization? Thank you Alexey

1 0

Expiration Value
by Tim White 26 Feb '08

26 Feb '08

I'm attempting to use Expiration to expire user accounts after a set time period. What format does the Date/Time (Value field) have to be? From what I can see it's in the format of "Monthname Day Year Hour:Min:Sec". So for example "March 24 2008 00:00:00". But it appears that in this format you can't use normal SQL datetime operators to see if it's expired (for example, to run a SQL query to remove all expired accounts). Can someone who has it working please let me know what format they use for Expiration value, and how they can use MySQL comparison operators with it? (Ether 2.0.2 or 1.1.7). Thanks Tim

5 10

Segmentation Fault on RH EL4 x86_64 with 2.0.2
by Reynolds, Walter 26 Feb '08

26 Feb '08

I am having a problem that I am not sure where to look for a solution. I install Freeradius via src with the straight 'configure', 'make' and 'make install'. No real problems show up during the install that are obvious so I configure and run the server with a local account. All good and fine still. Next I configure for Kerberos authentication which all works well....IF I am not in debug mode. If I enter debug mode however I always Segfault when the server enters the rlm_krb5 module. Thu Feb 21 11:33:34 2008 : Debug: +- entering group Kerberos Thu Feb 21 11:33:34 2008 : Debug: modsingle[authenticate]: calling krb5 (rlm_krb5) for request 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 182896438976 (LWP 21233)] 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 (gdb) Quit (gdb) info threads * 1 Thread 182896438976 (LWP 21233) 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 (gdb) thread apply all bt full Thread 1 (Thread 182896438976 (LWP 21233)): #0 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 No symbol table info available. #1 0x00000037e454364f in krb5_get_in_tkt_with_password () from /usr/lib64/libkrb5.so.3 No symbol table info available. #2 0x0000002a95bb0491 in krb5_auth (instance=0x6c5f90, request=Variable "request" is not available. ) at rlm_krb5.c:298 r = Variable "r" is not available. The hardware from gromit (where I get this) Linux gromit.umnet.umich.edu 2.6.9-67.0.1.ELsmp #1 SMP Fri Nov 30 11:57:43 EST 2007 x86_64 x86_64 x86_64 GNU/Linux Hardware on other box where it works: Linux engin-test1.ns.itd.umich.edu 2.6.9-1.667 #1 Tue Nov 2 14:41:25 EST 2004 i686 i686 i386 GNU/Linux Running freeradius 2.0.2. I have pointers that this could be anything from Krb libraries, the rlm_krb to autoconf files. I am not sure exactly what I am seeing here or why it is only when running in debug. I have tried using various installs from specifying library for rlm_krb5 to using broad library direction to local system tools. Always comes back with the Secmentation fault with kerberos like the trace listed above. Any help would be great. Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 1

Step 1: Configuring PAP fails with: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user
by Russell D. Mitchell 26 Feb '08

26 Feb '08

I've installed freeradius-server-2.0.2 onto a Fedora Core-5 machine, and tried to perform the first step as described in: http://deployingradius.com/documents/configuration/pap.html. Both radiusd and radtest were executed with root priviledges. The only change to config files was to add 'bob Cleartext-Password := "hello"' to /etc/raddb/users, to the top of the file. As you can see at the end of the radiusd output, the failure appears to be due to: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. But, I thought this was supposed to 'just work'. Here's the output from 'radtest bob hello localhost 0 testing123' Sending Access-Request of id 172 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=172, length=20 And here's the output from 'radisud -X': Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32775, id=172, length=55 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry bob at line 1 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 172 to 127.0.0.1:32775 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 172 with timestamp 47c459c7 Nothing to do. Sleeping until we see a request.

3 7

RE: PEAP LDAP password problem
by Alexey Eronko 26 Feb '08

26 Feb '08

I want to setup two WIFI networks: MAC Filter with EAP-PEAP. MAC Filter with WEP. Another very important question is : can I use MAC and EAP-PEAP simultaneously in one network. Alexey Eronko -----Original Message----- From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or g] On Behalf Of Alexey Eronko Sent: Tuesday, February 26, 2008 5:30 PM To: FreeRadius users mailing list Subject: RE: PEAP LDAP password problem Thank you for detailed explanation. I'll try to reenter all users password in NTpassword attribute. Could someone give me link to appoporate openldap guide. Where I can find howto do MAC filtering on Freeradius? Thank you -----Original Message----- From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or g] On Behalf Of Alan DeKok Sent: Tuesday, February 26, 2008 2:10 PM To: FreeRadius users mailing list Subject: Re: PEAP LDAP password problem Alexey Eronko wrote: > I have huge problem that I need to ask 200 users to reenter there passwords > in OpenLDAP. Then I guess you're not going to deploy PEAP. > Another problem is that I'm not sure that I can store two kind of password > simultaneously(nt and crypt). Yes, you can. They can go into two separate fields in LDAP. > Maybe someone know how to convert ldap passwords to nt hash? :) or I need to > reenter all passwords. You need to re-enter all of the passwords. OR convince the Windows users to install a supplicant such as SecureW2. > [AE:] The point is that my 200 users already have windows(active directory) > accounts and they know password. <sigh> If you had said this at the start, it would have simplified it a lot. Go read the Wiki for how to configure FreeRADIUS to authenticate PAP against AD. Or, see my web site. There are examples there, too. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: PEAP LDAP password problem
by Alan DeKok 26 Feb '08

26 Feb '08

Alexey Eronko wrote: > I have huge problem that I need to ask 200 users to reenter there passwords > in OpenLDAP. Then I guess you're not going to deploy PEAP. > Another problem is that I'm not sure that I can store two kind of password > simultaneously(nt and crypt). Yes, you can. They can go into two separate fields in LDAP. > Maybe someone know how to convert ldap passwords to nt hash? :) or I need to > reenter all passwords. You need to re-enter all of the passwords. OR convince the Windows users to install a supplicant such as SecureW2. > [AE:] The point is that my 200 users already have windows(active directory) > accounts and they know password. <sigh> If you had said this at the start, it would have simplified it a lot. Go read the Wiki for how to configure FreeRADIUS to authenticate PAP against AD. Or, see my web site. There are examples there, too. Alan DeKok.

2 1

Assignment for Attributes in external Scripts
by niall el-assaad 26 Feb '08

26 Feb '08

Hi, I am writing an external script to be run based upon an authentication. When the script returns output I am unsure as to what the assignment operators do, for example when should I use += vs := vs = If I look at the exec-program-wait sample script I see: echo "Reply-Message += \"Hello, %u\"," echo "Reply-Message += \"PATH=$PATH\"," echo Framed-IP-Address = 255.255.255.255 Is this documented anywhere? thanks, niall

4 5

Setting up a new database schema
by johnson elangbam 26 Feb '08

26 Feb '08

Hi, I am trying to make a new database schema in Ms Sql in order to read the user name and password only, how do I change the SQL queries in the coniguration files, i've change in the dialup.conf of mssql directory. Is there any configuration file to change so that it can be read only from my customize table.. Regards Elangbam Johnson

2 1

Re: PEAP LDAP password problem
by Alan DeKok 26 Feb '08

26 Feb '08

Alexey Eronko wrote: > Thanks for you replay. > > According with this link : > http://deployingradius.com/documents/protocols/compatibility.html. > > I need EAP-GTC. Huh? How did you conclude that? All you need to do is to put the NT hash into LDAP, as you said. You do NOT need to use EAP-GTC. > I'm not sure that my Proxim AP700 support this kind of EAP. Access points don't care about EAP methods. > Is this suitable method for WIFI network? > I still want to use user/password authentication for windows users thought > openLDAP(crypt) password. You don't. You put the NT hash into the OpenLDAP database. > How can I make sure that my Access Point can use EAP-GTC? Access points don't do EAP. Supplicants use EAP. > Or the only one way that I need is move to Windows Radius(IAS)? I have no idea why you think that will help. The web page I pointed you to says *nothing* about operating systems or RADIUS server implementations. If you have crypt'd passwords then you CANNOT do normal PEAP. Moving to Windows will make no difference. Alan DeKok.

2 1