- Freeradius-Users - lists.freeradius.org

Re: Help w/ pam radius
by Jeff Fishbaugh 19 Dec '07

19 Dec '07

Seems like I am getting closer possibly, but I see an error in radius.log -- could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow. Basically, I go to login to my pam_radius host, user exists in local password file with no pass, user/pass in RADIUS/LDAP, and when I login the SSH session immediately exits and I see the below in radius.log. If I use a login not in the local password file, but it is in RADIUS/LDAP then I get an access denied and no mention of the below error. I am not even starting TLS so why is it even complaining about it??? I am also curious what this means -- rlm_exec: Wait=yes but no output defined. Did you mean output=none? Appreciate any help. Thanks! Tue Dec 18 19:32:48 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Tue Dec 18 19:32:48 2007 : Info: Ready to process requests. Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:33:06 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:35:55 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow Tue Dec 18 19:36:03 2007 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to allow ----- Original Message ----- From: Jeff Fishbaugh To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, December 18, 2007 2:13 PM Subject: Help w/ pam radius Hello: I am having trouble getting pam_radius working and was wondering if someone might be of help since I followed the INSTALL instructions as well as a howto (as provided by the Wikid folks) and I am still coming up short getting it working. Here are some of my details - My PAM is such it is by service (Fedora 7 -- 0.99.7.1-5.1)....sshd being what I am most interested in, the default config for it looks like the below on a host I want talking to radius. What does this need to look like in terms of the pam_radius_auth.so related stanzas to get it working? Neither the INSTALL instructions or a howto I found would work. /etc/pam.d/sshd (default below) #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so - My Radius box runs freeradius (freeradius-1.1.7-3.1) with LDAP (fedora-ds) backending it with the user/pass info, got it working for Cisco's but have yet to get PAM working. I just get 'Access denied' -- tried the later with a user defined on the host with no password or with a password and won't work. Pretty simple, no huntgroups or anythig like that just plain and simple binding against LDAP. I think what I am looking for are... 1- Pam configuration on the host (ie- /etc/pam.d/sshd) 2- Pam configuration requirements as far as the radius server is concerned. Be helpful to see what all I might need that I am possibly missing in conf files. Thank you!

1 0

LDAP auth then file auth
by Ancalagon 18 Dec '07

18 Dec '07

Hi, I want to have the following authentication path. First I check in the ldap to see if a user is defined. If yes, I check his userPassword If the password is good, allow access (send access-accept packet) Else if the password is bad, reject access (send access-reject packet) If the user is not defined in the ldap, I check in the users file for an entry. During testing period, I add an DEFAULT section that allow access. At the end of the users file, I had another DEFAULT section for a reject. But, when I made a test with a valid user in the LDAP, even if the password is valid the users file is also checked. How could I avoid that? I try with Fall-Through yes or no but I was unable to get a valid status (if ldap is ok, then stop, if not, go to default users entry) Here my configuration and the logs: Thanks for any help users file : ------------ DEFAULT Auth-Type := CHAP Reply-Message := "Valid MAC-ADDRESS, access granted -> %{Calling-station-Id} [ %{NAS-IP-ADDRESS}::%{NAS-PORT} ]", Exec-Program = /etc/raddb/scripts/radius_access_request.sh, Fall-Through = yes DEFAULT Auth-Type := Accept Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 1, Reply-Message := "Access Granted (temporary) -> %{Calling-station-Id} [ %{NAS-IP-ADDRESS}::%{NAS-PORT} ]", Exec-Program = /etc/raddb/scripts/radius_access_request.sh, Fall-Through = no DEFAULT Auth-Type := Reject Reply-Message := "Access denied -> %{Calling-station-Id} [ %{NAS-IP-ADDRESS}::%{NAS-PORT} ]", Fall-Through = no radius.conf file : ------------------ ldap { server = "ip.address" identity = "valid cn that work" password = ***** basedn = "dc=comiteri,dc=be" basefilter = "(objectclass=radiusProfile)" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" #access_attr = "userPassword" password_attribute = userPassword dictionary_mapping = ${raddbdir}/ldap.attrmap compare_check_items = yes ldap_connections_number = 5 edir_account_policy_check=no start_tls = no timeout = 4 timelimit = 3 net_timeout = 1 } # ######### # # AUTHORIZE # # ######### # authorize { preprocess chap #mschap #suffix ldap eap #pap checkval-Calling-Station-Id checkval-Called-Station-Id checkval-NAS-Port checkval-NAS-IP-Address checkval-NAS-Identifier files } # ############ # # AUTHENTICATE # # ############ # authenticate { #Auth-Type PAP { # pap #} Auth-Type LDAP { ldap } Auth-Type CHAP { chap } #Auth-Type MS-CHAP { # mschap #} #unix eap } ldap.attr file : ---------------- checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem LM-Password lmPassword checkItem NT-Password ntPassword checkItem SMB-Account-CTRL-TEXT acctFlags checkItem Expiration radiusExpiration checkItem Calling-Station-Id radiusCallingStationId checkItem User-Password userPassword replyItem Reply-Message description replyItem User-Password userPassword LOG : (-X -A) --------------------- Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/clients.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/eap.conf Config: including file: /usr/local/freeradius-1.1.7/etc/raddb/sql.conf main: prefix = "/usr/local/freeradius-1.1.7" main: localstatedir = "/usr/local/freeradius-1.1.7/var" main: logdir = "/usr/local/freeradius-1.1.7/var/log/radius" main: libdir = "/usr/local/freeradius-1.1.7/lib" main: radacctdir = "/usr/local/freeradius-1.1.7/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/freeradius-1.1.7/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/usr/local/freeradius-1.1.7/var/run/radiusd/radiusd.pid" main: bind_address = ip.address IP address [ip.address] main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/freeradius-1.1.7/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius-1.1.7/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "ip.address" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=validcn,dc=be" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "+jvvS2psV9kYN5ylTneJhcZoI+Q+uxjfPtEKYKVv3PeGn6MvBwRvMQ==" ldap: basedn = "dc=comiteri,dc=be" ldap: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/freeradius-1.1.7/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = yes ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: edir_account_policy_check = no ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/freeradius-1.1.7/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP description mapped to RADIUS Reply-Message rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x5555557a49d0 Module: Instantiated ldap (ldap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "/usr/local/freeradius-1.1.7/etc/raddb/cacerts/" tls: pem_file_type = yes tls: private_key_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/BALIN.pem" tls: certificate_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/BALIN.pem" tls: CA_file = "(null)" tls: private_key_password = "ggA7cOHR0rdjfg==" tls: dh_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/dh" tls: random_file = "/usr/local/freeradius-1.1.7/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = yes tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/freeradius-1.1.7/etc/raddb/huntgroups" preprocess: hints = "/usr/local/freeradius-1.1.7/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded checkval checkval: item-name = "Calling-Station-Id" checkval: check-name = "Calling-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Calling-Station-Id for attribute 31 Module: Instantiated checkval (checkval-Calling-Station-Id) checkval: item-name = "Called-Station-Id" checkval: check-name = "Called-Station-Id" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name Called-Station-Id for attribute 30 Module: Instantiated checkval (checkval-Called-Station-Id) checkval: item-name = "NAS-Port" checkval: check-name = "NAS-Port" checkval: data-type = "integer" checkval: notfound-reject = no rlm_checkval: Registered name NAS-Port for attribute 5 Module: Instantiated checkval (checkval-NAS-Port) checkval: item-name = "NAS-IP-Address" checkval: check-name = "NAS-IP-Address" checkval: data-type = "ipAddr" checkval: notfound-reject = no rlm_checkval: Registered name NAS-IP-Address for attribute 4 Module: Instantiated checkval (checkval-NAS-IP-Address) checkval: item-name = "NAS-Identifier" checkval: check-name = "NAS-Identifier" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name NAS-Identifier for attribute 32 Module: Instantiated checkval (checkval-NAS-Identifier) Module: Loaded files files: usersfile = "/usr/local/freeradius-1.1.7/etc/raddb/users" files: acctusersfile = "/usr/local/freeradius-1.1.7/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/freeradius-1.1.7/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/freeradius-1.1.7/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/usr/local/freeradius-1.1.7/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication ip.address:1812 Listening on accounting ip.address:1813 Ready to process requests. rad_recv: Access-Request packet from host ip.address.NAS:1024, id=170, length=185 Framed-MTU = 9178 NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 15 NAS-Port-Type = Ethernet NAS-Port-Id = "15" Called-Station-Id = "Called-Station-Id-MAC" Calling-Station-Id = "Calling-Station-Id-MAC" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" CHAP-Password = 0x11f16451432a20e7684564ce9cba7a82b0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for mac-client-stripped radius_xlat: '(uid=mac-client-stripped)' radius_xlat: 'dc=comiteri,dc=be' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ip.address:389, authentication 0 rlm_ldap: bind as cn=validcn/***** to ip.address:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=comiteri,dc=be, with filter (uid=mac-client-stripped) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_checkval: Item Name: Calling-Station-Id, Value: Calling-Station-Id-MAC rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs modcall[authorize]: module "checkval-Calling-Station-Id" returns notfound for request 0 rlm_checkval: Item Name: Called-Station-Id, Value: Called-Station-Id-MAC rlm_checkval: Could not find attribute named Called-Station-Id in check pairs modcall[authorize]: module "checkval-Called-Station-Id" returns notfound for request 0 rlm_checkval: Item Name: NAS-Port, Value: rlm_checkval: Could not find attribute named NAS-Port in check pairs modcall[authorize]: module "checkval-NAS-Port" returns notfound for request 0 rlm_checkval: Item Name: NAS-IP-Address, Value: ip.address.NAS rlm_checkval: Could not find attribute named NAS-IP-Address in check pairs modcall[authorize]: module "checkval-NAS-IP-Address" returns notfound for request 0 rlm_checkval: Item Name: NAS-Identifier, Value: switch-8-00-1 rlm_checkval: Could not find attribute named NAS-Identifier in check pairs modcall[authorize]: module "checkval-NAS-Identifier" returns notfound for request 0 users: Matched entry DEFAULT at line 9 radius_xlat: 'Valid MAC-ADDRESS, access granted -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' users: Matched entry DEFAULT at line 14 radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' Login OK: [mac-client-stripped] (from client switch-8-00-1 port 15 cli Calling-Station-Id-MAC) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[post-auth]: module "detail" returns ok for request 0 modcall: leaving group post-auth (returns ok) for request 0 Sending Access-Accept of id 170 to ip.address.NAS port 1024 Reply-Message := "Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host ip.address.NAS:1025, id=171, length=118 Acct-Session-Id = "002100002E6F" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 15 Calling-Station-Id = "Calling-Station-Id-MAC" Service-Type = Framed-User NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 15,Client-IP-Address = ip.address.NAS,NAS-IP-Address = ip.address.NAS,Acct-Session-Id = "002100002E6F",User-Name = "mac-client-stripped"' rlm_acct_unique: Acct-Unique-Session-ID = "d89c04f3e92e2152". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "mac-client-stripped", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: leaving group preacct (returns ok) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radutmp' radius_xlat: 'mac-client-stripped' modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 171 to ip.address.NAS port 1025 Finished request 1 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 170 with timestamp 4767e9aa Cleaning up request 1 ID 171 with timestamp 4767e9aa Nothing to do. Sleeping until we see a request. rad_recv: Accounting-Request packet from host ip.address.NAS:1025, id=172, length=154 Acct-Session-Id = "002100002E6F" Acct-Status-Type = Stop Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 15 Calling-Station-Id = "Calling-Station-Id-MAC" Service-Type = Framed-User NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Acct-Terminate-Cause = 0 Acct-Session-Time = 25 Acct-Input-Octets = 1280 Acct-Output-Octets = 2907 Acct-Input-Packets = 20 Acct-Output-Packets = 25 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 15,Client-IP-Address = ip.address.NAS,NAS-IP-Address = ip.address.NAS,Acct-Session-Id = "002100002E6F",User-Name = "mac-client-stripped"' rlm_acct_unique: Acct-Unique-Session-ID = "d89c04f3e92e2152". modcall[preacct]: module "acct_unique" returns ok for request 2 rlm_realm: No '@' in User-Name = "mac-client-stripped", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 2 modcall[preacct]: module "files" returns noop for request 2 modcall: leaving group preacct (returns ok) for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[accounting]: module "detail" returns ok for request 2 modcall[accounting]: module "unix" returns ok for request 2 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radutmp' radius_xlat: 'mac-client-stripped' modcall[accounting]: module "radutmp" returns ok for request 2 modcall: leaving group accounting (returns ok) for request 2 Sending Accounting-Response of id 172 to ip.address.NAS port 1025 Finished request 2 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 2 ID 172 with timestamp 4767e9c4 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host ip.address.NAS:1024, id=173, length=185 Framed-MTU = 9178 NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Service-Type = Administrative-User Framed-Protocol = PPP NAS-Port = 15 NAS-Port-Type = Ethernet NAS-Port-Id = "15" Called-Station-Id = "Called-Station-Id-MAC" Calling-Station-Id = "Calling-Station-Id-MAC" Connect-Info = "CONNECT Ethernet 1000Mbps Full duplex" CHAP-Password = 0x12cbd98b2407d03051341a5bd92aaeaf4a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for mac-client-stripped radius_xlat: '(uid=mac-client-stripped)' radius_xlat: 'dc=comiteri,dc=be' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=comiteri,dc=be, with filter (uid=mac-client-stripped) rlm_ldap: Added password mac-client-stripped in check items rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "mac-client-stripped" rlm_ldap: Adding radiusCallingStationId as Calling-Station-Id == "Calling-Station-Id-MAC" rlm_ldap: extracted attribute Calling-Station-Id from generic item Calling-Station-Id == "Calling-Station-Id-MAC" rlm_ldap: extracted attribute Called-Station-Id from generic item Called-Station-Id == "Called-Station-Id-MAC" rlm_ldap: extracted attribute NAS-Port from generic item NAS-Port == "15" rlm_ldap: extracted attribute NAS-IP-Address from generic item NAS-IP-Address == "ip.address.NAS" rlm_ldap: extracted attribute NAS-Identifier from generic item NAS-Identifier == "switch-8-00-1" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding userPassword as User-Password = "mac-client-stripped" rlm_ldap: Adding description as Reply-Message = "Server" rlm_ldap: extracted attribute Tunnel-Type from generic item tunnel-type = "VLAN" rlm_ldap: extracted attribute Tunnel-Medium-Type from generic item tunnel-medium-type = "6" rlm_ldap: extracted attribute Tunnel-Private-Group-Id from generic item tunnel-private-group-ID = "4" rlm_ldap: user mac-client-stripped authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 3 rlm_checkval: Item Name: Calling-Station-Id, Value: Calling-Station-Id-MAC rlm_checkval: Value Name: Calling-Station-Id, Value: Calling-Station-Id-MAC modcall[authorize]: module "checkval-Calling-Station-Id" returns ok for request 3 rlm_checkval: Item Name: Called-Station-Id, Value: Called-Station-Id-MAC rlm_checkval: Value Name: Called-Station-Id, Value: Called-Station-Id-MAC modcall[authorize]: module "checkval-Called-Station-Id" returns ok for request 3 rlm_checkval: Item Name: NAS-Port, Value: rlm_checkval: Value Name: NAS-Port, Value: 15 modcall[authorize]: module "checkval-NAS-Port" returns ok for request 3 rlm_checkval: Item Name: NAS-IP-Address, Value: ip.address.NAS rlm_checkval: Value Name: NAS-IP-Address, Value: ip.address.NAS modcall[authorize]: module "checkval-NAS-IP-Address" returns ok for request 3 rlm_checkval: Item Name: NAS-Identifier, Value: switch-8-00-1 rlm_checkval: Value Name: NAS-Identifier, Value: switch-8-00-1 modcall[authorize]: module "checkval-NAS-Identifier" returns ok for request 3 users: Matched entry DEFAULT at line 9 radius_xlat: 'Valid MAC-ADDRESS, access granted -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' users: Matched entry DEFAULT at line 14 radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' modcall[authorize]: module "files" returns ok for request 3 modcall: leaving group authorize (returns ok) for request 3 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user radius_xlat: 'Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]' Login OK: [mac-client-stripped] (from client switch-8-00-1 port 15 cli Calling-Station-Id-MAC) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 3 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[post-auth]: module "detail" returns ok for request 3 modcall: leaving group post-auth (returns ok) for request 3 Sending Access-Accept of id 173 to ip.address.NAS port 1024 User-Password = "mac-client-stripped" Reply-Message := "Access Granted (temporary) -> Calling-Station-Id-MAC [ ip.address.NAS::15 ]" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4" Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host ip.address.NAS:1025, id=174, length=118 Acct-Session-Id = "002100002E70" Acct-Status-Type = Start Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-Port = 15 Calling-Station-Id = "Calling-Station-Id-MAC" Service-Type = Framed-User NAS-IP-Address = ip.address.NAS NAS-Identifier = "switch-8-00-1" User-Name = "mac-client-stripped" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 4 modcall[preacct]: module "preprocess" returns noop for request 4 rlm_acct_unique: Hashing 'NAS-Port = 15,Client-IP-Address = ip.address.NAS,NAS-IP-Address = ip.address.NAS,Acct-Session-Id = "002100002E70",User-Name = "mac-client-stripped"' rlm_acct_unique: Acct-Unique-Session-ID = "72d16234c91ae248". modcall[preacct]: module "acct_unique" returns ok for request 4 rlm_realm: No '@' in User-Name = "mac-client-stripped", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 4 modcall[preacct]: module "files" returns noop for request 4 modcall: leaving group preacct (returns ok) for request 4 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 4 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218' rlm_detail: /usr/local/freeradius-1.1.7/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius-1.1.7/var/log/radius/radacct/ip.address.NAS/detail-20071218 modcall[accounting]: module "detail" returns ok for request 4 modcall[accounting]: module "unix" returns ok for request 4 radius_xlat: '/usr/local/freeradius-1.1.7/var/log/radius/radutmp' radius_xlat: 'mac-client-stripped' modcall[accounting]: module "radutmp" returns ok for request 4 modcall: leaving group accounting (returns ok) for request 4 Sending Accounting-Response of id 174 to ip.address.NAS port 1025 Finished request 4 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 3 ID 173 with timestamp 4767e9ca Cleaning up request 4 ID 174 with timestamp 4767e9ca Nothing to do. Sleeping until we see a request. ---------------------------------------------------------------------- Free pop3 email with a spam filter. http://www.bluebottle.com/tag/5

2 1

DEFAULT entry in users file and LDAP, again
by Martin Pauly 18 Dec '07

18 Dec '07

Sorry to bother you guys again: a couple of weeks ago, I asked > > With a users file like > > DEFAULT > > User-Name = `%{User-Name}` > > > > the server complains loudly about the missing Auth-Type when asking with > > radtest > >So how do I direct the server to use LDAP without setting Auth-Type? > >Or is radtest somehow the wrong test tool in the new scenario?? Ivan advised me > Uncomment ldap in authorize and authenticate sections of radiusd.conf. and it worked. Now I'm going for a new production host and thought I'd simply copy the working radiusd.conf (with minor adjustments, of course). But again freeradius is unable to determine the proper auth-type. Static user entries and those with Auth-Type = System work fine. In radiusd.conf I have: modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } ldap ldap1 { server = "xxxxx.uni-marburg.de" identity = "uid=xxxxx,ou=xxxxx,o=Universitaet Marburg,c=DE" password = "xxxxx" basedn = "ou=people,ou=Staff,ou=Accounts,o=Universitaet Marburg,c=DE" filter = "(&(uid:caseExactMatch:=%{Stripped-User-Name:-%{User-Name}}) (!(UniMrDarfRadius=0)))" start_tls = yes tls_cacertdir = /etc/ssl/certs tls_require_cert = "demand" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 100 #timeout: # seconds to wait for LDAP query to finish default: 20 timeout = 60 #timelimit: # of seconds server has to process the query (server-side #time limit) default: 20 timelimit = 60 #net_timeout: # of seconds to wait for response of the server (network #failures) default: 10 net_timeout = 60 } [same for ldap2, ldap3] [...] } # end of modules [...] instantiate { ldap1 ldap2 ldap3 eap mschap } authorize { preprocess chap mschap suffix eap files redundant { ldap1 ldap2 ldap3 } pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix Auth-Type LDAP { redundant { ldap1 ldap2 ldap3 } } eap } #end of authenticate The debug output shows a successfull LDAP dialog about authorization, but then no Auth-Type is found: rad_recv: Access-Request packet from host 137.248.3.11:51358, id=100, length=57 User-Name = "pauly" User-Password = "xxxxxxx" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "pauly", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 64 radius_xlat: 'pauly' modcall[authorize]: module "files" returns ok for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for pauly radius_xlat: '(&(uid:caseExactMatch:=pauly) (!(UniMrDarfRadius=0)))' radius_xlat: 'ou=people,ou=Staff,ou=Accounts,o=Universitaet Marburg,c=DE' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to auth1.staff.uni-marburg.de:389, authentication 0 rlm_ldap: setting TLS CACert Directory to /etc/ssl/certs rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as uid=xxxxx,ou=xxxxx,o=Universitaet Marburg,c=DE/xxxxxx to auth1.staff.uni-marburg.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,ou=Staff,ou=Accounts,o=Universitaet Marburg,c=DE, with filter (&(uid:caseExactMatch:=pauly) (!(UniMrDarfRadius=0))) rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user pauly authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 100 to 137.248.xxx.xxx port 51358 Thanks for help, Martin -- Dr. Martin Pauly Fax: 49-6421-28-26994 HRZ Univ. Marburg Phone: 49-6421-28-23527 Hans-Meerwein-Str. E-Mail: pauly(a)HRZ.Uni-Marburg.DE D-35032 Marburg

3 7

Help w/ pam radius
by Jeff Fishbaugh 18 Dec '07

18 Dec '07

Hello: I am having trouble getting pam_radius working and was wondering if someone might be of help since I followed the INSTALL instructions as well as a howto (as provided by the Wikid folks) and I am still coming up short getting it working. Here are some of my details - My PAM is such it is by service (Fedora 7 -- 0.99.7.1-5.1)....sshd being what I am most interested in, the default config for it looks like the below on a host I want talking to radius. What does this need to look like in terms of the pam_radius_auth.so related stanzas to get it working? Neither the INSTALL instructions or a howto I found would work. /etc/pam.d/sshd (default below) #%PAM-1.0 auth include system-auth account required pam_nologin.so account include system-auth password include system-auth session optional pam_keyinit.so force revoke session include system-auth session required pam_loginuid.so - My Radius box runs freeradius (freeradius-1.1.7-3.1) with LDAP (fedora-ds) backending it with the user/pass info, got it working for Cisco's but have yet to get PAM working. I just get 'Access denied' -- tried the later with a user defined on the host with no password or with a password and won't work. Pretty simple, no huntgroups or anythig like that just plain and simple binding against LDAP. I think what I am looking for are... 1- Pam configuration on the host (ie- /etc/pam.d/sshd) 2- Pam configuration requirements as far as the radius server is concerned. Be helpful to see what all I might need that I am possibly missing in conf files. Thank you!

1 0

Expiration attribute limitation - max year?
by Marinko Tarlac 18 Dec '07

18 Dec '07

Hello I'm working on something and I can figure what is the max year for expiration attribute? Here is the problem rlm_sql: Failed to create the pair: failed to parse time string "December 31 2039 00:00:00" When I enter December 31 2035 00:00:00 as a year it works but 2039 doesn't. Is there any way to avoid this limit? I know that 2035th year is a far from now but.. :)

2 1

freeradius server and access point do not communicate each other
by Gianni Socionovo 18 Dec '07

18 Dec '07

Hello guys, i am a newby in installing and configuring an access point with a radius server. I set up a free radius server (IP 10.1.1.1) and i checked that is on. I set up a wireless access point (D-LINK DLW3200 AP, IP 10.1.1.2) with wpa2-enterprise authentication settings. In the screen of DWL authentication setting i set 10.1.1.1 as radius server and "radiussecret" as Radius Secret. In freeradius configuration file clients.conf i added the following: client 10.1.1.2 { secret = radiussecret shortname = dlink nastype = other } and i switched on sql authorizing because i use freeradius-mysql in radiusd.conf. I set up freeradius dialupadmin and it works right. I added a test user to table radcheck ('test', 'testpwd', 'radiussecret') I lauched the command: radtest test testpwd 10.1.1.2 0 radiussecret and i got the following message: radclient: no response from server for ID xx. if i ping the devices from one to another they respond each other. Is there anyone who can help me. I need to set the access point up asap for my company. thanks in advance for your help best regards soxio

2 2

no logging => reject?
by Norbert Wegener 18 Dec '07

18 Dec '07

I am using a recent pre-2, authentication via a mysql database. In post-auth I have a sql module, that reports accept/reject to a another mysql database. When this database is not available, the user is rejected, although I get Auth-Type = Accept before. Is this a desired behaviour, bug or feature? ... rad_check_password: Auth-Type = Accept, accepting the user Login OK: [000000007989] (from client 149.246.185.169 port 1812) +- entering group post-auth ++? if ("%{User-Name}" =~ /.net/i || "%{User-Name}" =~ /@/ ) expand: %{User-Name} -> 000000007989 ? Evaluating ("%{User-Name}" =~ /.net/i) -> FALSE expand: %{User-Name} -> 000000007989 Evaluating ("%{User-Name}" =~ /@/) -> FALSE ++? if ("%{User-Name}" =~ /.net/i || "%{User-Name}" =~ /@/ ) -> FALSE expand: //var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> //var/log/radius/radacct/149.246.185.169/reply-detail-20071218 rlm_detail: //var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to //var/log/radius/radacct/149.246.185.169/reply-detail-20071218 expand: %t -> Tue Dec 18 15:29:07 2007 ++[reply_log] returns ok rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> 000000007989 rlm_sql (sql): sql_set_user escaped user --> '000000007989' expand: INSERT into radpostauth (id, user, pass, reply, date,nasname) values ('', '%{User-Name}', '%{User-Password}', '%{reply:Packet-Type}', NOW(),'%{NAS-IP-Address}') -> INSERT into radpostauth (id, user, pass, reply, date,nasname) values ('', '000000007989', '000000007989', 'Access-Accept', NOW(),'139.25.153.222') rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date,nasname) values ('', '000000007989', '000000007989', 'Access-Accept', NOW(),'139.25.153.222') rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 ++[sql] returns fail Found Post-Auth-Type Reject +- entering group REJECT rlm_sql (sql): Processing sql_postauth expand: %{User-Name} -> 000000007989 rlm_sql (sql): sql_set_user escaped user --> '000000007989' expand: INSERT into radpostauth (id, user, pass, reply, date,nasname) values ('', '%{User-Name}', '%{User-Password}', '%{reply:Packet-Type}', NOW(),'%{NAS-IP-Address}') -> INSERT into radpostauth (id, user, pass, reply, date,nasname) values ('', '000000007989', '000000007989', 'Access-Reject', NOW(),'139.25.153.222') rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date,nasname) values ('', '000000007989', '000000007989', 'Access-Reject', NOW(),'139.25.153.222') rlm_sql (sql): Ignoring unconnected handle 4.. rlm_sql (sql): Ignoring unconnected handle 3.. rlm_sql (sql): Ignoring unconnected handle 2.. rlm_sql (sql): Ignoring unconnected handle 1.. rlm_sql (sql): Ignoring unconnected handle 0.. rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 ++[sql] returns fail Sending Access-Reject of id 51 to 149.246.185.169 port 32833 Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 4.0 seconds. Cleaning up request 0 ID 51 with timestamp +1 Ready to process requests. Norbert Wegener

4 4

NT Passwords
by Andreas Moroder 18 Dec '07

18 Dec '07

Hello, we would like to activate PEAP authentication with openLDAP. According to radiusd.conf #Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. The problem is that samba itself and othe management tools like webmin store the NT and the LM password as 32.digit hex string but without the 0x. I tried to add the 0x but the logon to main domain does not work with this added. Is there a good reason why freeradius needs a differen tformat then samba ? Thanks Andreas

2 2

EAP-SIM need help...
by Raghavendra. S 18 Dec '07

18 Dec '07

Hi, I added following lines in eap.conf inside eap block. sim { } I added following lines to users file. eapsim Auth-Type := EAP, EAP-Type := SIM EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234, EAP-Sim-SRES1 = 0x1234abcd, EAP-Sim-KC1 = 0x0011223344556677, EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a, EAP-Sim-SRES2 = 0x234abcd1, EAP-Sim-KC2 = 0x1021324354657687, EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab, EAP-Sim-SRES3 = 0x34abcd12, EAP-Sim-KC3 = 0x30415263748596a7 In src/tests/eapsim-03 there is one extra parameter, Autz-Type:=EAP, for which I am getting some error while enabling radiusd. So I removed Autz-Type:=EAP from first line. Is that OK? I want to know how I to get above Hex values? -- Regards & Thanks Raghavendra. S

2 1

Could'nt authenticate windows host account with freeradius + ldap backend + samba domain controller
by david.barbion＠adeoservices.com 18 Dec '07

18 Dec '07

Hello, We have a Samba domain controller (3.0.9) with freeradius on it and several windows XP SP2 workstations attached to it. Actually, this wired setup is working correctly. We are planning to use wifi on those workstations but we encounters many problems. Here our wifi setup: Our APs are cisco 12xx, WPA/PEAP/MSCHAPV2 + 802.1x to the Samba/freeradius servers. Samba is configured to use LDAP as a backend to store its accounts (computers/users/groups). On the XP workstations, we use its own supplicant. Freeradius version 1.1.7 is configured to authorize computers and users from ldap and the authentication is made in mschapv2 through eap. The user authentication is working but not the computer and we must have this to work so that if the computer is switched on and nobody logged in, it can even have access to the network (for applying nightly updates for examples). The problem is when a computer tries to authenticate, the User-Name sent is "host//computername/", but in ldap we have entrie like /computername/$. So we have some attr_rewrite that removes host/ and adds the dollar sign. rlm_ldap finds correctly the entry, but EAP complains about the user name change: "*rlm_eap: Identity does not match User-Name, setting from EAP Identity.** rlm_eap: Failed in handler" *Is there an existing solution to our problem ?* * Thanks in advance for any response. PS: a join the log where you can see what happends, the radiusd.conf and an example computer account (in ldif format) Ce message et toutes les pièces jointes sont établis à l'attention exclusive de leurs destinataires et sont confidentiels. Si vous recevez ce message par erreur, merci de le détruire et d'en avertir immédiatement l'expéditeur. L'internet ne permettant pas d'assurer l'intégrité de ce message, le contenu de ce message ne représente en aucun cas un engagement de la part de Adeo Services. prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 60 delete_blocked_requests = no cleanup_delay = 5 max_requests = 8192 bind_address = * port = 1812 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = yes log_auth_badpass = yes log_auth_goodpass = yes usercollide = no lower_user = before lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = ${raddbdir}/certs/ap.pem certificate_file = ${raddbdir}/certs/ap.pem CA_file = ${raddbdir}/certs/root.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 include_length = yes check_crl = no } peap { default_eap_type = mschapv2 } mschapv2 { } } mschap { } ldap { server = "localhost" identity = "cn=Manager,dc=mag125,dc=fr,dc=corp,dc=mycompany,dc=com" password = password basedn = "dc=mag125,dc=fr,dc=corp,dc=mycompany,dc=com" filter = "(uid=%{Stripped-User-Name})" start_tls = no dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 access_attr_used_for_allow = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } attr_rewrite copy.user-name { attribute = Stripped-User-Name new_attribute = yes searchfor = "" searchin = packet replacewith = "%{User-Name}" } attr_rewrite add-dollar-sign { attribute = Stripped-User-Name searchfor = "^host/(.*)" searchin = packet new_attribute = no replacewith = "%{1}$" } attr_rewrite strip-realm-name { attribute = Stripped-User-Name new_attribute = no searchin = packet searchfor = "^(.*[\\/]+)" replacewith = "" max_matches = 1 } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/%{Client-IP-Address}/reply-detail-%Y%m%d detailperm = 0600 } detail pre_proxy_log { detailfile = ${radacctdir}/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } exec echo { wait = yes program = "/bin/echo Username:%{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { expr } authorize { copy.user-name add-dollar-sign auth_log suffix ntdomain ldap eap } authenticate { copy.user-name add-dollar-sign Auth-Type LDAP { ldap } Auth-Type MS-CHAP { mschap } eap } preacct { preprocess acct_unique suffix ntdomain } accounting { detail radutmp } session { radutmp } post-auth { reply_log } pre-proxy { pre_proxy_log } post-proxy { eap }

2 4