- Freeradius-Users - lists.freeradius.org

HELP! testuser works, but local unix user dosn't! - WPA/WPA2 PEAP
by Kristian Junkov 09 Dec '07

09 Dec '07

Hi, I use freeradius 1.1.7, and my client pc runs windows Vista. I've set up a testuser with a clear-text password in the users file - which works:-). I can connect using the testuser with WPA/WPA2, PEAP, TTLS without problems. But when I try to connect using the local unix users it dosnt work:-((, what am I doing wrong? This is what i got when running in debug -X mode, and trying with root: ########## The user request ############# rad_recv: Access-Request packet from host 172.16.20.240:2056, id=0, length=121 User-Name = "root" NAS-IP-Address = 172.16.20.240 Called-Station-Id = "000001a728a8" Calling-Station-Id = "0013e8c11ed3" NAS-Identifier = "000001a728a8" NAS-Port = 12 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000901726f6f74 Message-Authenticator = 0x626a6cc69ca1f0b92f795e2542e86be3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "root", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 0 to 172.16.20.240 port 2056 EAP-Message = 0x01010016041054c071964fb44c8680fbb4110fcb766c Message-Authenticator = 0x00000000000000000000000000000000 State = 0x06737742f028b5011a4eecca9b8e7047 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 475b3805 Nothing to do. Sleeping until we see a request. This is my configuration from debug mode: loki:/etc/freeradius# freeradius -X -A -y Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 60 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/certs/wireless/server_key.pem" tls: certificate_file = "/etc/freeradius/certs/wireless/server_cert.pem" tls: CA_file = "/etc/freeradius/certs/wireless/CA/cacert.pem" tls: private_key_password = "xxxxxxxx" tls: dh_file = "/etc/freeradius/certs/wireless/dh" tls: random_file = "/etc/freeradius/certs/wireless/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ----------------------------------- Thanks, Kristian -- View this message in context: http://www.nabble.com/HELP%21-testuser-works%2C-but-local-unix-user-dosn%27… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Re: FW: MS-CHAP-v2 and CHAP with different passwords in LDAP
by Alan DeKok 08 Dec '07

08 Dec '07

Edvin Seferovic wrote: > before somebody yells "not again" - I just wish to ask if it is possible to > use MS-CHAP and CHAP authentication with a LDAP backend which contains > clear-text passwords as well as NT-Password ( used for MS-CHAP ) ??? Alan - > yes/no answer please :) Read the web page: http://deployingradius.com/documents/protocols/compatibility.html If you're doing "bind as user" in LDAP, read this: http://deployingradius.com/documents/protocols/oracles.html > If positive - can somebody give me an example of attribute mapping to ldap > for both ( MS-CHAP and CHAP ) to work ? You don't do attribute mappings. See the "ldap" section in radiusd.conf, and look for "password_attribute". > My setup with LDAP as backend is working with a mapping of NT-Password to > sambaNTPassword like this : > > checkItem NT-Password sambaNTPassword > > MS-CHAP works just fine ! > > For CHAP I added > > password_header = "{clear}" > password_attribute = "userPassword" > password_radius_attribute = "User-Password" Where did that last line come from? > to the LDAP module configuration. But unfortunately chap module doesn't like > my clear-text password ( stored in userPassword ) for authentication :( How > else can I say CHAP where to look for the clear-text password. See the FAQ for "it doesn't work". Alan DeKok.

2 1

1 byte leak ?
by blue_11j＠yahoo.co.jp 08 Dec '07

08 Dec '07

Hi, I'm *sorry* that I am not good at English because I'm Japanese. I found memory leak(?) of 1 byte when PEAP authentication, by valgrind. I tried fllowing patch for rlm_eap. it look like work well. is it corret way? -------------------------------- diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/eap.c ./src/modules/rlm_eap/eap.c --- ../freeradius-1.1.7/src/modules/rlm_eap/eap.c 2007-04-08 07:18:34.000000000 +0900 +++ ./src/modules/rlm_eap/eap.c 2007-10-10 02:44:20.000000000 +0900 @@ -421,6 +421,11 @@ */ if (reply->type.data && reply->type.length > 0) { memcpy(&hdr->data[1], reply->type.data, reply->type.length); + + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() in %s Freeing reply->type.data 0x%x", __func__, __FILE__, (unsigned int)reply->type.data); + reply->type.bNeedFreeData = 0; + free(reply->type.data); reply->type.data = reply->packet + EAP_HEADER_LEN + 1/*EAPtype*/; } diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_tls.c ./src/modules/rlm_eap/libeap/eap_tls.c --- ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_tls.c 2007-04-08 06:27:19.000000000 +0900 +++ ./src/modules/rlm_eap/libeap/eap_tls.c 2007-10-09 22:39:14.000000000 +0900 @@ -808,6 +808,10 @@ return 0; } + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() Malloc(%d) for eap_ds->request->type.data 0x%x", __func__, (reply->length - TLS_HEADER_LEN + 1), (unsigned int)eap_ds->request->type.data); + eap_ds->request->type.bNeedFreeData = 1; + /* EAPTLS Header length is excluded while computing EAP typelen */ eap_ds->request->type.length = reply->length - TLS_HEADER_LEN; diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_types.h ./src/modules/rlm_eap/libeap/eap_types.h --- ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eap_types.h 2006-05-19 23:19:15.000000000 +0900 +++ ./src/modules/rlm_eap/libeap/eap_types.h 2007-10-09 20:51:14.000000000 +0900 @@ -88,6 +88,9 @@ unsigned char type; unsigned int length; unsigned char *data; + + // 2007/10/09 workaround for memory leak. + unsigned int bNeedFreeData; } eaptype_t; /* diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eapcommon.c ./src/modules/rlm_eap/libeap/eapcommon.c --- ../freeradius-1.1.7/src/modules/rlm_eap/libeap/eapcommon.c 2007-03-05 23:34:55.000000000 +0900 +++ ./src/modules/rlm_eap/libeap/eapcommon.c 2007-10-10 02:43:30.000000000 +0900 @@ -216,6 +216,11 @@ */ if (reply->type.data && reply->type.length > 0) { memcpy(&hdr->data[1], reply->type.data, reply->type.length); + + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() in %s Freeing reply->type.data 0x%x", __func__, __FILE__, (unsigned int)reply->type.data); + reply->type.bNeedFreeData = 0; + free(reply->type.data); reply->type.data = reply->packet + EAP_HEADER_LEN + 1/*EAPtype*/; } @@ -386,6 +391,11 @@ ep.type.type = eap_type; ep.type.length = vp->length; ep.type.data = malloc(vp->length); + + // 2007/10/09 workaround for memory leak. + DEBUG2(" rlm_eap: in %s() Malloc(%d) for ep.type.data 0x%x", __func__, vp->length, (unsigned int)ep.type.data); + ep.type.bNeedFreeData = 1; + memcpy(ep.type.data,vp->strvalue, vp->length); eap_basic_compose(req, &ep); } diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/mem.c ./src/modules/rlm_eap/mem.c --- ../freeradius-1.1.7/src/modules/rlm_eap/mem.c 2007-02-10 00:42:03.000000000 +0900 +++ ./src/modules/rlm_eap/mem.c 2007-10-09 22:40:28.000000000 +0900 @@ -54,6 +54,14 @@ * so we do not free it but we NULL it free(eap_packet->type.data); */ + + // 2007/10/09 workaround for memory leak. + if(eap_packet->type.bNeedFreeData) { + DEBUG2(" rlm_eap: in %s() Freeing eap-packet->type.data 0x%x", __func__, (unsigned int)eap_packet->type.data); + eap_packet->type.bNeedFreeData = 0; + free(eap_packet->type.data); + } + eap_packet->type.data = NULL; } -------------------------------- -------------------------------------- New Design Yahoo! JAPAN 2008/01/01 http://pr.mail.yahoo.co.jp/newdesign/

2 1

FW: MS-CHAP-v2 and CHAP with different passwords in LDAP
by Edvin Seferovic 08 Dec '07

08 Dec '07

Hello list members, before somebody yells "not again" - I just wish to ask if it is possible to use MS-CHAP and CHAP authentication with a LDAP backend which contains clear-text passwords as well as NT-Password ( used for MS-CHAP ) ??? Alan - yes/no answer please :) If positive - can somebody give me an example of attribute mapping to ldap for both ( MS-CHAP and CHAP ) to work ? My setup with LDAP as backend is working with a mapping of NT-Password to sambaNTPassword like this : checkItem NT-Password sambaNTPassword MS-CHAP works just fine ! For CHAP I added password_header = "{clear}" password_attribute = "userPassword" password_radius_attribute = "User-Password" to the LDAP module configuration. But unfortunately chap module doesn't like my clear-text password ( stored in userPassword ) for authentication :( How else can I say CHAP where to look for the clear-text password. Any hints please ? TIA ! Regards, E:S

1 0

freeradius compile problem
by Dave Gibelli 08 Dec '07

08 Dec '07

Hi I am having problems compiling with eap module. Here is the section from config.log showing what I think is the problem. I have the latest OpenSSL and Freeradius 1.1.7 Any ideas? configure:20584: gcc -o conftest -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS conftest.c -lssl -L/usr/local/ssl/lib -lnsl -lresolv -lpthread >&5 /usr/local/ssl/lib/libssl.a(ssl_lib.o): In function `SSL_clear': ssl_lib.c:(.text+0x28): undefined reference to `ERR_put_error' ssl_lib.c:(.text+0x13a): undefined reference to `BUF_MEM_free' /usr/local/ssl/lib/libssl.a(ssl_lib.o): In function `SSL_new': ssl_lib.c:(.text+0x1ba): undefined reference to `CRYPTO_malloc'

4 4

need patch to inst->session_tail clear ?
by blue_11j＠yahoo.co.jp 08 Dec '07

08 Dec '07

Hi, I'm *sorry* that I am not good at English because I'm Japanese.... I think that it is need following patch for eaplist_find() in rlm_eap/mem.c, FreeRADIUS 1.1.7. if no patch, when session_head == NULL and session_tail != NULL, add handler to TAIL in next eaplist_add(). How do you think about it? ------------------------ diff -urN ../freeradius-1.1.7/src/modules/rlm_eap/mem.c ./src/modules/rlm_eap/mem.c --- ../freeradius-1.1.7/src/modules/rlm_eap/mem.c 2007-02-10 00:42:03.000000000 +0900 +++ ./src/modules/rlm_eap/mem.c 2007-12-07 12:32:23.000000000 +0900 @@ -301,6 +301,9 @@ rbtree_delete(inst->session_tree, node); inst->session_head = handler->next; + //--- 2007/12/07 added --------------- + if(!inst->session_head) inst->session_tail = NULL; + //------------------------------------ if (handler->next) handler->next->prev = NULL; eap_handler_free(handler); } ------------------------ -------------------------------------- New Design Yahoo! JAPAN 2008/01/01 http://pr.mail.yahoo.co.jp/newdesign/

2 1

Newbie question
by Monah Baki 07 Dec '07

07 Dec '07

Hi all, I am new to freeradius and I want to know if it's possible to perform the following. I provide for multiple people access to the internet via a proxy server with authentication (htpasswd), server is FreeBSD. I want to deny them access after 1 month. I was wandering if freeradius can work with the htpasswd password file, and then deny them access after 1 month. Thank you

2 1

rlm_sql_log. accounting and locking
by Phil Mayers 07 Dec '07

07 Dec '07

All, The rlm_sql_log module only logs a single query; unlike the main sql module which (for accounting) will do an update or insert if not found. How, if at all, are people merging the rows? Triggers? Post-processing? Also, I doubt it will be an issue, but just wanted to check; is the flock() of the file likely to cause any contention issues? Is there an easy way of hashing the NAS-IP-Address to writing to 26 files named "sql-log-[a-z]" and asking radsqlrelay to replay them all? Thoughts welcome. Regards, Phil

3 2

Fall-Through Syntax
by Reynolds, Walter 07 Dec '07

07 Dec '07

In looking at the list and several examples from various places I noticed that Fall-Through = xxx has been listed in different ways. I have seen "Yes" "yes" and "1" What are the options and where would I have been able to find the logic in the src so I could have looked myself? Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 1

attr_rewrite
by Дмитрий 07 Dec '07

07 Dec '07

Good afternoon! I have a problem. The user will be authorized with a login in the form of 123456@realm1, it is necessary, that freeradius transformed its login 123456@realm2... And so for all users. How to make? TRIED: radiusd.conf: attr_rewrite User-Name { attribute = User-Name searchin = packet searchfor = "realm1" replacewith = "realm2" ignore_case = yes new_attribute = yes max_matches = 1 append = yes } authorize { Autz-Type unknown { files } User-Name preprocess chap mschap suffix files sqlauth } in radiusd -X: User-Name = "123456@realm1" User-Password = "EBLAImXtaUidLnSa" NAS-IP-Address = 10.173.65.200 rad_lowerpair: User-Name now '123456@realm1' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: 'realm2' rlm_attr_rewrite: Added attribute User-Name with value 'realm2' modcall[authorize]: module "User-Name" returns ok for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "realm1" for User-Name = "123456@realm <mailto:123456@realm2> 1" rlm_realm: Found realm "realm1" rlm_realm: Proxying request from user 123456 to realm realm1 rlm_realm: Adding Realm = "123456" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 3 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '123456@realm1' rlm_sql (sqlauth): sql_set_user escaped user --> '123456@realm1' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '123456@realm1' ORDER BY id' Сысоев Дмитрий Александрович Сетевой администратор Отдел информационных технологий ЗАО ''Ульяновская Сотовая Связь'' Тел.: +7 (901) 947 17 31 Моб.: +7 (901) 947 02 71 Факс: +7 (8422) 43 51 99

2 2