- Freeradius-Users - lists.freeradius.org

freeradius 1.1.5/1.1.6 has a known bug on 64bit linux systems
by Dan Gahlinger 29 Nov '07

29 Nov '07

If you happen to be using 64bit linux and happen to have free radius 1.1.5 or 1.1.6 there is a known bug in the unix system authentication API. Basically, it doesn't work. But, relax, there is a fix. Please don't report this bug, it's known, and has a solution. the solution is to install version 1.1.7 which fixes this problem. the best way to get 1.1.7 is to use CVS the bug seems isolated to libradius-1.1.5.so library, but it is recommended to use the entire 1.1.7 not replace portions, because that can have unexpected results. Please do not report basic system authentication bugs with 1.1.5/1.1.6 this is known, and has a working solution instead, please install version 1.1.7 either by download or from CVS this was first reported and fixed on Suse Linux 10.3 64bit using kernel 2.6.22.12 _________________________________________________________________ Express yourself with free Messenger emoticons. Get them today! http://www.freemessengeremoticons.ca/?icid=EMENCA122

1 0

Re: rlm_passwd and EAP-MD5
by A.L.M.Buxey＠lboro.ac.uk 29 Nov '07

29 Nov '07

Hi, > Hm, does this mean that even now when I use rlm_passwd and tacacs passwd > file, I need to HUP radiusd whenever someone changes their password? dont HUP the server, restart the process. alan

1 0

Re: rlm_passwd and EAP-MD5
by Alan DeKok 29 Nov '07

29 Nov '07

Kolbjørn Barmen wrote: ... >>> since I want to change the password for each and every test, and do >>> not want to HUP radiusd all the time. >> I'm not sure that will work. > > Hm, isnt that the point of rlm_passwd? Reload without HUP? No. > 1.1.7 on NetBSD. Allthough NetBSD bring som patches, they seem to just be > for installation paths and pthread flags. So if it is supposed to work, > I'm curious as to why it doesnt for me. No idea. Try "branch_1_1" from CVS. That may be better. We'll likely release 1.1.8 soon. Alan DeKok.

1 0

Which RADIUS server can support RFC3576?
by Hangjun He 29 Nov '07

29 Nov '07

I know freeRADIUS can't suport RFC3576 (Dynamic Authorization Extensions to RADIUS). Do you know which one can support it? --------------------------------- 雅虎邮箱，终生伙伴！

2 1

vlan assignment
by inl2goal 28 Nov '07

28 Nov '07

I am having trouble configuring VLAN assignment for CISCO switches, this is the debug output from when the user authenticates, any ideas? thanks rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 13 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 13 modcall: leaving group authorize (returns updated) for request 13 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 13 modcall: leaving group authenticate (returns ok) for request 13 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 13 rlm_sql (sql): Processing sql_postauth radius_xlat: 'tortuga' rlm_sql (sql): sql_set_user escaped user --> 'tortuga' radius_xlat: 'INSERT into radpostauth (user, pass, reply, date) values ('tortuga', 'Chap-Password', 'Access-Accept', NOW())' radius_xlat: '/usr/local/var/log/radius/sqltrace.sql' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (user, pass, reply, date) values ('tortuga', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: INSERT into radpostauth (user, pass, reply, date) values ('tortuga', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Released sql socket id: 1 modcall[post-auth]: module "sql" returns ok for request 13 modcall: leaving group post-auth (returns ok) for request 13 Sending Access-Accept of id 17 to 10.19.100.196 port 1645 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Tunnel-Type:0 := VLAN Tunnel-Medium-Type:0 := IEEE-802 Tunnel-Private-Group-Id:0 := "120" EAP-Message = 0x03030004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "tortuga" Finished request 13 the user gets the attribute from a SQL table mysql> select * from radgroupreply; +----+-----------+-------------------------+----+---------------------+ | id | GroupName | Attribute | op | Value | +----+-----------+-------------------------+----+---------------------+ | 1 | admin | Framed-Protocol | := | PPP | | 2 | admin | Service-Type | := | Framed-User | | 3 | admin | Framed-Compression | := | Van-Jacobsen-TCP-IP | | 10 | admin | Tunnel-Type | := | VLAN | | 11 | admin | Tunnel-Medium-Type | := | IEEE-802 | | 13 | admin | Tunnel-Private-Group-ID | := | 120 | +----+-----------+-------------------------+----+---------------------+ -- View this message in context: http://www.nabble.com/vlan-assignment-tf4884769.html#a13980961 Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Execute A Script After User Authenticate
by fvt3 28 Nov '07

28 Nov '07

Hi, I have Freeradius setup to authenticate user off mysql database. I was able to set Freeradius to execute a script base on what group a user is in. ex. usergroup table: username groupname Jdoe testprogram radgroupreply table: Groupname atrribute op value testprogram Exec-Program-Wait == /usr/local/etc/raddb/test.pl When user Jdoe authenticates, the script ran no problem. My problem is how do you pass the user-name and client host information to this script. Note: I was able to pass the user-name to the script when the following is placed in the users file. However this does not behave the way I want. DEFAULT Auth-Type= local Exec-Program-Wait = '/usr/local/etc/raddb/test.pl %{User-Name}', Any help would be appreciated.. ____________________________________________________________________________________ Get easy, one-click access to your favorites. Make Yahoo! your homepage. http://www.yahoo.com/r/hs

2 1

Re: rlm_passwd and EAP-MD5
by Alan DeKok 28 Nov '07

28 Nov '07

Kolbjørn Barmen wrote: > Can rlm_passwd be used together with EAP-MD5? Yes. Only if the password is in clear-text. > If I in the users file set "Password == blabla" for a user test-user > and then connects using radeapclient as described in the manual with > "EAP-MD5-Password = blabla" it works fine. However, I want to use an > external clear-text password instead of having the password in users, > since I want to change the password for each and every test, and do > not want to HUP radiusd all the time. I'm not sure that will work. > On the same server I use rlm_passwd already for authenticate certain > clients against a TACACS passwd file, and for those clients I have in > users file entires like this: > > DEFAULT Auth-Type := PAP, Client-IP-Address == "w.x.y.z" > > which (if I have grasped things right) enforces those to use PAP, In 1.1.7, you don't need that Auth-Type. > With the above I get in the log: > > Info: rlm_eap_md5: User-Password is required for EAP-MD5 authentication Ugh. It works in 1.1.7. Which version are you running? > As for "Why EAP-MD5?", I just need some EAP-method for which > I can easily generate requests with radeapclient. See also wpa_supplicant and eapol_test. I use it to test all of the EAP types... Alan DeKok.

1 0

rlm_passwd and EAP-MD5
by Kolbjørn Barmen 28 Nov '07

28 Nov '07

Can rlm_passwd be used together with EAP-MD5? If I in the users file set "Password == blabla" for a user test-user and then connects using radeapclient as described in the manual with "EAP-MD5-Password = blabla" it works fine. However, I want to use an external clear-text password instead of having the password in users, since I want to change the password for each and every test, and do not want to HUP radiusd all the time. Is this at all possible? More details... On the same server I use rlm_passwd already for authenticate certain clients against a TACACS passwd file, and for those clients I have in users file entires like this: DEFAULT Auth-Type := PAP, Client-IP-Address == "w.x.y.z" which (if I have grasped things right) enforces those to use PAP, and this works excellent with module passwd tacacs { filename = /local/etc/tacpasswd format = "*User-Name:Crypt-Password:::::" delimiter = ":" hashsize = 100 ignorenislike = yes ignoreempty = yes allowmultiplekeys = no } Now, what I want is another passwd-module as above: passwd mypw { filename = ${confdir}/mypasswd format = "*User-Name:Cleartext-Password" delimiter = ":" hashsize = 100 ignorenislike = yes ignoreempty = yes allowmultiplekeys = no } and mypasswd being in the form "test-user:cleartextpassword" and in users instead of: test-user Password == "blabla", NAS-Identifier == "mytest-NAS" Reply-Message = "myradius.somewhere.no: OK" which works just fine, I have test-user NAS-Identifier == "mytest-NAS" Reply-Message = "myradius.somewhere.no: OK" and have EAP-MD5 work with this. My radeapclient sends: User-Name = test-user(a)test-realm.no NAS-Identifier = mytest-NAS EAP-MD5-Password = blabla EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = test-user(a)test-realm.no Message-Authenticator = 0x00 NAS-Port = 0 With the above I get in the log: Info: rlm_eap_md5: User-Password is required for EAP-MD5 authentication Auth: Login incorrect: [test-user] (from client blabla.somewhere.no port 0) And with debug (-X) I see this: modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry test-user at line 7 Yay! modcall[authorize]: module "files" returns ok for request 5 modcall[authorize]: module "tacacs" returns notfound for request 5 modcall[authorize]: module "mypw" returns notfound for request 5 Sob.. why? rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 5 modcall: leaving group authenticate (returns invalid) for request 5 auth: Failed to validate the user. Login incorrect: [test-user] (from client foo.somewhere.no port 0) Anyone got a tip on how I might do this? As for "Why EAP-MD5?", I just need some EAP-method for which I can easily generate requests with radeapclient. Thanks! :) -- Kolbjørn Barmen UNINETT Driftsenter

1 0

radtest seems to fail out of the box
by Dan Gahlinger 28 Nov '07

28 Nov '07

Ok, Al, can you explain or help with this. just to appease you, I unpacked free radius, out of the box, changed a single line in "server" as such: 127.0.0.1 testing123 3 ran radtest using a testuser local account: radtest testuser 1234 127.0.0.1 10 testing123 it failed, radtest shows: Sending Access-Request of id 90 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "1234" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=90, length=20 Radiusd -X shows: /usr/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32773, id=90, length=60 User-Name = "testuser" User-Password = "1234" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [testuser]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 90 to 127.0.0.1 port 32773 Waking up in 4 seconds... the password is valid, as a local SSH using the same information works. And one other oddity, when using users with "hardended" passwords like say "test@" radtest and radiusd -X will show the password as "test2", whether quotes are used or not. is this normal? and why does the radtest fail? no other configurations or files where changed. everything is default. _________________________________________________________________ Are you ready for Windows Live Messenger Beta 8.5 ? Get the latest for free today! http://entertainment.sympatico.msn.ca/WindowsLiveMessenger

2 3

Dynamic Realm
by Michael da Silva Pereira 28 Nov '07

28 Nov '07

I wonder if somebody else has managed to get this kind of thing right, I want to eliminate the need for usernames in my authentication process, I want to work with the callerid instead. Now thats not very hard, except now I want to be able to classify a user/callerid into a specific realm, a realm of which is declared in a SQL table. I've tried creating a Perl module with rlm_perl but it doesn't seem to classify the user into a realm. I don't really want to create a custom module for it, as I like to keep this kind of thing config based and not modular. Any Ideas? Thanks, Mike

4 5