- Freeradius-Users - lists.freeradius.org

Feature requests
by Fabio Pedretti 07 Dec '07

07 Dec '07

Hi, is there a plan on adding these features, already discussed some time ago on the lists? * SSL support on MySQL connections: http://lists.freeradius.org/mailman/htdig/freeradius-users/2005-March/04213… * OpenSSL exceptions or GNUTLS support, so SSL support can be legally distributed in distribution packages: http://lists.freeradius.org/pipermail/freeradius-devel/2006-July/010008.html Thanks

2 1

IP Pool
by Marcelus Trojahn 06 Dec '07

06 Dec '07

Hi folks, I have a PPPoE server which authenticates the user on freeradius... Right now, the PPPoE server is in charge of assigning the IPs to the users but I want to do that via radius because I'm adding another PPPoE server on the network and OSPF routing... Problem is, I had a look on radiusd.conf and what I could understand is that I can only have pools on a same network (like 192.168.0.0/23, for instance)... But I need 1 big pool with IPs in different networks because my users receive valid public IP addresses... So, I need all users on the same pool and the pool has to have a bunch of differente IP ranges, not in order, like 200.200.200.0/24, 201.10.20.0/24 and so on... Is that even possible? -- Marcelus Trojahn

2 2

Re: Using nas-ip address for user authorization
by Reynolds, Walter 06 Dec '07

06 Dec '07

You can also use the huntgroups file For example: LimitedAccess NAS-IP-Address == 191.168.1.53 User-Name == firstuser, User-Name == aaa, User-Name == bbb, User-Name == lastuser This will limit only those users listed from being able to log into the particular NAS. > Yes it is. Read instructions in users file and: > > http://wiki.freeradius.org/Operators > > Ivan Kalik > Kalik Informatika ISP > > > Dana 6/12/2007, "ajay raut" <rautajays(a)yahoo.com> pi?e: > > >Hi, > > > > I want to use nas-ip address of the radius-request to be checked in > users.conf file for the users authorization to access that NAS server. > > Is it possible in FreeRadius and i need to know the configuration to > do it.. > > > > > > Thanks, > > > > Ajay Raut > > > > > >--------------------------------- > >Be a better friend, newshound, and know-it-all with Yahoo! Mobile. > Try it now. > > > > > --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

1 0

Using nas-ip address for user authorization
by ajay raut 06 Dec '07

06 Dec '07

Hi, I want to use nas-ip address of the radius-request to be checked in users.conf file for the users authorization to access that NAS server. Is it possible in FreeRadius and i need to know the configuration to do it... Thanks, Ajay Raut --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

3 2

RE: free radius with radauth discarding packet?
by satyanarayanam 06 Dec '07

06 Dec '07

Hi ti all, Thanks you valuable sugestions, Now my setup is freeradius server<--->radauthfreeradius client client sending packet to server, server accepting only when USERNAME-root PASSWD-root123 othher than this server rejecting and sendinf access denied packet to client. i am trying to change clients.conf file in server as below client 10.50.41.43 { # secret and password are mapped through the "secrets" file. secret = testing123 shortname = liv1 # the following three fields are optional, but may be used by # checkrad.pl for simultaneous usage checks nastype = livingston login = root password = root123 } if i am changing this login and passwd then also it is not acepting.. anybody help to work this .. thnak you in advance -----Original Message----- From: Sridhar Bandi [mailto:sridhar.bandi@hp.com] Sent: Thursday, December 06, 2007 12:29 PM To: satyanarayanam(a)tataelxsi.co.in Subject: Re: free radius with radauth discarding packet? Hi Satyanarayana, The problem is with the radius client that is sending packets that are more than 4096 bytes. As per the standard (http://www.ietf.org/rfc/rfc2865.txt?number=2865) you cannot send packets more than 4096. In case, packets are more than 4096 the RADIUS servers will discarded those. We are not sure why you need to send packets which are more than 4096. What is the setup that you are working on? What is the platform that you are using? What is the customer base that you are looking at? If you provide the information on the configurations then the community will be able to help you out better. Best Regards, Bandi satyanarayanam wrote: > Hi, > > I am running sucessfully freeraduis with raduth-freeradius know it is > working fine but > only taking > USERNAME-root > PASSWD-root123 > > why not others i am changing this in clients.conf file also > > but working with only this ... > Please tell me what to do.. > > Thank you inadvance > > Thank you, > Satyanarayna reddy mendaddula, > Tata Elxsi Ltd,White field ,Hoody-1, > Emp no--6185, Mb no - 9341311577 > Email:- satyanarayanam(a)tataelxsi.co.in > > Help ever ,,,, Hurt never.... > > > > The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments contained in it. > > Contact your Administrator for further information. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments contained in it. Contact your Administrator for further information.

3 2

Login rejected. Error 691.
by pungki arianto 06 Dec '07

06 Dec '07

I installed FreeRadius 1.1.2 on FreeBSD 6.0. I followed the HOWTO from http://tldp.org/HOWTO/8021X-HOWTO/freeradius.html to configure the server. When I ran radtest, it show the message like this: Sending Access-Request of id 153 to 10.1.1.3 port 1645 User-Name = "user@sisni" User-Password = "sni" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Accept packet from host 10.1.1.3:1645, id=153, length=20 or Sending Access-Request of id 153 to 10.1.1.3 port 1645 User-Name = "user" User-Password = "sni" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Accept packet from host 10.1.1.3:1645, id=153, length=20 The user 'user' already registered inside /etc/password: user:*:1006:1006:user_radius_sisni:/home/user:/usr/sbin/nologin In radius.conf , proxy_request is set to No. And the $INCLUDE ${confdir}/proxy.conf is already commented. But I still got this message: rlm_realm: Proxy reply, or no User-Name. Ignoring. This is the content from huntgroup file: LNS-KPU-SM2 NAS-IP-Address == 10.1.1.0 This is the content from hints file DEFAULT Suffix == "@sisni", Strip-User-Name = Yes Hint = "sisni", If I tried to dial the Radius from Windows terminal, it always give me an error like this: *Error 691*: Access was denied because the user name and/or password was invalid on the domain Please help me to fix the error. Thank you. -Pungki Here is the last message in /var/log/radacct/10.1.1.0/detail-20071203 Acct-Status-Type = Accounting-On NAS-IP-Address = 10.1.1.0 NAS-Identifier = "LNS-KPU-SM2" Acct-Authentic = RADIUS Acct-Session-Id = "load:2147484043" Event-Timestamp = "Nov 22 2007 10:25:47 WIT" Acct-Delay-Time = 957324 Client-IP-Address = 10.1.1.0 Timestamp = 1196662186 Here is the message that show after radiusd -X command. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5 eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Accounting-Request packet from host 10.1.1.0:50016, id=223, length=80 Acct-Status-Type = Accounting-On NAS-IP-Address = 10.1.1.0 NAS-Identifier = "LNS-KPU-SM2" Acct-Authentic = RADIUS Acct-Session-Id = "load:2147484043" Event-Timestamp = "Nov 22 2007 10:25:47 WIT" Acct-Delay-Time = 952314 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 0 modcall: leaving group preacct (returns noop) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/var/log/radacct/10.1.1.0/detail-20071203' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.1.1.0/detail-20071203 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns noop for request 0 radius_xlat: '/var/log/radutmp' rlm_radutmp: NAS callback restarted (Accounting-On packet seen) modcall[accounting]: module "radutmp" returns ok for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 223 to 10.1.1.0 port 50016 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.1.1.0:50016, id=224, length=80 Acct-Status-Type = Accounting-On NAS-IP-Address = 10.1.1.0 NAS-Identifier = "LNS-KPU-SM2" Acct-Authentic = RADIUS Acct-Session-Id = "load:2147484043" Event-Timestamp = "Nov 22 2007 10:25:47 WIT" Acct-Delay-Time = 952317 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 1 modcall: leaving group preacct (returns noop) for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/var/log/radacct/10.1.1.0/detail-20071203' rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.1.1.0/detail-20071203 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns noop for request 1 radius_xlat: '/var/log/radutmp' rlm_radutmp: NAS callback restarted (Accounting-On packet seen) modcall[accounting]: module "radutmp" returns ok for request 1 modcall: leaving group accounting (returns ok) for request 1 Sending Accounting-Response of id 224 to 10.1.1.0 port 50016 Finished request 1 Going to the next request --- Walking the entire request list ---

5 12

freeradius-users@lists.freeradius.org
by radius 06 Dec '07

06 Dec '07

Hi listers [root@myhost ~]# uname -a OpenBSD myhost.mydomain.com 4.2 GENERIC#375 i386 [root@myhost ~]# [root@myhost ~]# pkg_info -A .... freeradius-1.1.6 RADIUS server implementation freeradius-ldap-1.1.6 freeradius ldap rlm addon .... [root@myhost ~]# [root@myhost ~]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "_freeradius" main: group = "_freeradius" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded LDAP ldap: server = "localhost" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=pam-ldap-checker,ou=pam-ldap,dc=mydomain,dc=com" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "vaxico" ldap: basedn = "ou=pam-ldap,dc=mydomain,dc=com" ldap: filter = "(&(objectclass=posixAccount)(uid=%{Stripped-User-Name:-%{User-Name}}))" ldap: base_filter = "(objectclass=posixAccount)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(&(memberUid=%{Stripped-User-Name:-%{User-Name}})(objectClass=posixGroup))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = yes ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes ldap: set_auth_type = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message conns: 0x7f11f800 Module: Instantiated ldap (ldap) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ----------------------------------- we use radius authentication on this openBSD server as workaround, because for openBSD no pam-(ldap) is available. here, all users, mail, ftp, yni are authenticated against openldap using various authentication methods (pam-ldap, pure ldap, courier-authlib with ldap, pure-ftpd with ldap, ...). the ldap-accounting-schemas we use are posixAccount and qmailControl/qmailUser. No radius schema so far. the radius authentication works fine, as far as password checking is concerned. The following radius-daemon output shows the login of a user cvs into the system. rad_recv: Access-Request packet from host 127.0.0.1:33886, id=44, length=39 User-Name = "cvs" User-Password = "xxxx" NAS-IP-Address = 200.200.200.200 NAS-Port = 3965 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for cvs radius_xlat: '(&(objectclass=posixAccount)(uid=cvs))' radius_xlat: 'ou=pam-ldap,dc=mydomain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as cn=pam-ldap-checker,ou=pam-ldap,dc=mydomain,dc=com/yyyy to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=pam-ldap,dc=mydomain,dc=com, with filter (&(objectclass=posixAccount)(uid=cvs)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user cvs authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: empty password supplied): [cvs] (from client localhost port 3965) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 127.0.0.1:33886, id=44, length=39 Sending Access-Reject of id 44 to 127.0.0.1 port 33886 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 44 with timestamp 4756743a Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:27572, id=154, length=55 User-Name = "cvs" User-Password = "xxxx" NAS-IP-Address = 200.200.200.200 NAS-Port = 3965 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for cvs radius_xlat: '(&(objectclass=posixAccount)(uid=cvs))' radius_xlat: 'ou=pam-ldap,dc=mydomain,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=pam-ldap,dc=mydomain,dc=com, with filter (&(objectclass=posixAccount)(uid=cvs)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user cvs authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type ldap auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_ldap: - authenticate rlm_ldap: login attempt by "cvs" with password "xxxx" rlm_ldap: user DN: uid=cvs,ou=People,ou=pam-ldap,dc=mydomain,dc=com rlm_ldap: (re)connect to localhost:389, authentication 1 rlm_ldap: bind as uid=cvs,ou=People,ou=pam-ldap,dc=mydomain,dc=com/xxxx to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: user cvs authenticated succesfully modcall[authenticate]: module "ldap" returns ok for request 1 modcall: leaving group authenticate (returns ok) for request 1 Login OK: [cvs] (from client localhost port 3965) Sending Access-Accept of id 154 to 127.0.0.1 port 27572 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 154 with timestamp 47567442 Nothing to do. Sleeping until we see a request. ---------------------- BUT when this user is logged in, it has the following parameters: cvs@myhost -> id uid=10001(cvs) gid=102(users) groups=102(users) cvs@myhost -> all these id-parameters are from the local /etc/master.passwd file and not from the ldap directory. instead of (when logging in to the user cvs on a different server) i get the following (correct) id-parameters cvs@yourhost ~> id uid=1067(cvs) gid=100(users) groups=100(users),503(release2) cvs@yourhost ~> when i check the ldap-host log, i see, that not even an attempt is made to request session parameters from the ldap server. what do i where need to change? thanks for any advice suomi

3 8

Using nas-ip addrees attribute
by ajay raut 06 Dec '07

06 Dec '07

Hi, i have one query, Can we use nas-ip address attribute in check items of radius request using the users.conf configuration file... Thanks, Ajay Raut --------------------------------- Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.

1 0

EAP-TTLS tunnel
by Sergio Belkin 06 Dec '07

06 Dec '07

When using EAP-TTLS the tunnel is between Access Point and client only? I mean: Is it protected data between AP and freeradius? Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 2

Oracle LDAP and password
by Fabio Pedretti 05 Dec '07

05 Dec '07

I am using FreeRADIUS 1.1.7 and I want to authenticate my users against an Oracle LDAP. TTLS-PAP works fine, but I also need PEAP-MSCHAPv2, so I have to be able to read NT-LM password. I noticed that the Oracle LDAP server stores password in this format: authpassword;orclcommonpwd: {X- ORCLLMV}708090a0b0c0d0e0f000102030405060 authpassword;orclcommonpwd: {X- ORCLNTV}000102030405060708090a0b0c0d0e0f I verified that the the LM and NT hashes match those needed by FreeRADIUS but hashes are after a special header ({X- ORCLLMV} or {X- ORCLNTV}) and all in the same attribute (authpassword;orclcommonpwd). Is it possible to configure FreeRADIUS to read the hashes in these format? Thanks, Fabio

2 1