- Freeradius-Users - lists.freeradius.org

Some users can't login after upgrade!
by Dean, Barry 13 Nov '07

13 Nov '07

The configuration I had was FreeRADIUS 1.1.4 running on NetBSD_3.0 (STABLE) authenticating to Novell eDirectory using LDAP. All was fine... I upgraded to FreeRADIUS 1.1.7 and all seemed OK, until two of my users found they can no longer login to the Cisco VPN3000 which uses this RADIUS. The log files simply show: Tue Nov 6 15:06:40 2007 : Auth: Login incorrect: [<user>] (from client vpn3000 port 13712 cli X.X.X.X) We also use RADIUS with EZProxy. I used a spare EZProxy test box and asked the user to login using that, failed with 1.1.7 RADIUS, changed it to use a spare 1.1.4 server and they could login! User names are alphabetic only and less than 8 characters, passwords are alpha-numeric only and 8 characters. I am reasonably new to RADIUS and cannot figure out why these two users are being singled out! I thought at first it might be because we have "edir_account_policy_check=yes" and that given the ChangeLog for 1.1.7 says "Added more eDirectory support.", and the two users possibly have extra attributes as they are sysadmins, that something was being checked that was not with 1.1.4 and that was preventing login. However later in radiusd.conf in the post-auth section the LDAP server entries are commented out. and it says: # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. So does this mean this feature is not in operation? Has anyone any ideas where I should start looking? Thanks. --------------- Barry Dean Networks Team University of Liverpool

2 5

FreeRadius returns the same attribute value twice
by VM 13 Nov '07

13 Nov '07

Hi, I have a problem with the Filter-ID attribute : When a switch (Enterasys) gets the filter-ID in an 'access-accept' reply, its value is written twice : ..... AVP: l=6 t=Service-Type(6): Framed-User(2) AVP: l=39 t=Filter-ID(11): Enterasys:version=1:policy=test-policy Filter-ID: Enterasys:version=1:policy=test-policy AVP: l=39 t=Filter-ID(11): Enterasys:version=1:policy=test-policy Filter-ID: Enterasys:version=1:policy=test-policy AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) AVP: l=58 t=Vendor-Specific(26) v=Microsoft(311) AVP: l=6 t=EAP-Message(79) Last Segment [1] ..... And this comportment confuses the switch (an old one). This happens only in an EAP negociation. Not in clear Radius. Do you know where this may come from ? Something to do with the fact that I set "use_tunnelled_reply=yes" in EAP.conf ? Thanks in advance, Vincent MAZARD

2 1

Re: Mikrotik ignores Framed-IP-Address
by Marinko Tarlac 13 Nov '07

13 Nov '07

Well I'm trying to use it. When I enter for example ID | UserName | Attribute | op 32 | user | Framed-IP-Address | 192.168.8.152 | := in radreply table, user should get static IP address (in this case 192.168.8.152) but this is ignored by Mikrotik because Framed-Pool is also available because user is inside specific group which has defined IP pool. When I delete IP pool from Mikrotik everything works fine... It seem that finally I will wrote specific perl or php script who will be dedicated to decide if framed-ip-address exist send it to MT else send IP-pool name Re: Mikrotik ignores Framed-IP-Address (tnt(a)kalik.co.yu) > > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 12 Nov 2007 12:55:14 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Mikrotik ignores Framed-IP-Address > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <fXF2NwKz.1194868514.1514360.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Use one way to assign IP addresses: DHCP or radius. If you want to give > static addresses to devices use dhcp pools (dynamic IP) and reservations > (static IP); if you want to give static IPs to users than use radius > ippool (dynamic IP) and (static) IP address assignment. > > Ivan Kalik > Kalik Informatika ISP > > Dana 12/11/2007, "Marinko Tarlac" <mangia81(a)gmail.com> pi?e: > > >> Hello >> >> I have freeradius and Mikrotik combination and here is the problem. >> Freeradius is configured to use mysql database. When I add >> Framed-IP-Address for certain user (in radreply table) For example >> >> 32 user Framed-IP-Address 10.51.8.152 := >> >> It works but only if I don't have IP pool created on Mikrotik. If I >> create IP pool than Framed-IP-Address is ignored. Framed-Pool is >> specified for every group and attributes for every group is added in >> radgroupreply table. >> >> Log without IP pool >> >> rad_recv: Access-Request packet from host 192.168.1.7:1026, id=229, length=149 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 870 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> CHAP-Challenge = 0x89a28dc77659b6311a88c16eb7500767 >> CHAP-Password = 0x01d385ce5c814c1d1db9cafadb4736c351 >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> rlm_chap: Setting 'Auth-Type := CHAP' >> rlm_sql (sql): Reserving sql socket id: 4 >> rlm_sql (sql): Released sql socket id: 4 >> rlm_chap: login attempt by "admin-test" with CHAP password >> rlm_chap: Using clear text password "perica" for user admin-test >> authentication. >> rlm_chap: chap user admin-test authenticated succesfully >> Sending Access-Accept of id 229 to 192.168.1.7 port 1026 >> Framed-IP-Address := 192.168.8.152 >> Framed-MTU = 576 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-Compression = Van-Jacobson-TCP-IP >> Ascend-Data-Rate := 0 >> Ascend-Xmit-Rate := 0 >> Framed-Pool := "radius" >> >> Log with created IP pool called "radius" >> >> rad_recv: Access-Request packet from host 192.168.1.7:1027, id=240, length=149 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 872 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> CHAP-Challenge = 0x5293ac8321ad51693a5e3109f8887511 >> CHAP-Password = 0x01b0a9f7bca1f632878bee51c13d667f5c >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> rlm_chap: Setting 'Auth-Type := CHAP' >> rlm_sql (sql): Reserving sql socket id: 4 >> rlm_sql (sql): Released sql socket id: 4 >> rlm_chap: login attempt by "admin-test" with CHAP password >> rlm_chap: Using clear text password "perica" for user admin-test >> authentication. >> rlm_chap: chap user admin-test authenticated succesfully >> Sending Access-Accept of id 240 to 192.168.1.7 port 1027 >> Framed-IP-Address := 192.168.8.152 >> Framed-MTU = 576 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> Framed-Compression = Van-Jacobson-TCP-IP >> Ascend-Data-Rate := 0 >> Ascend-Xmit-Rate := 0 >> Framed-Pool := "radius" >> rad_recv: Accounting-Request packet from host 192.168.1.7:1027, >> id=241, length=146 >> Service-Type = Framed-User >> Framed-Protocol = PPP >> NAS-Port = 872 >> NAS-Port-Type = Ethernet >> User-Name = "admin-test" >> Calling-Station-Id = "00:C0:CA:18:75:B3" >> Called-Station-Id = "radius" >> NAS-Port-Id = "ether1" >> Acct-Session-Id = "81d00316" >> Framed-IP-Address = 192.168.8.159 >> Acct-Authentic = RADIUS >> Acct-Status-Type = Start >> NAS-Identifier = "1.7 - h-0" >> NAS-IP-Address = 192.168.1.7 >> Acct-Delay-Time = 0 >> rlm_sql (sql): Reserving sql socket id: 3 >> rlm_sql (sql): Released sql socket id: 3 >> Sending Accounting-Response of id 241 to 192.168.1.7 port 1027 >> >> Any ideas? >> > >

2 1

Two more reasons to upgrade to 2.0
by Alan DeKok 12 Nov '07

12 Nov '07

Download CVS head, and: $ man radiusd ... In short: "-C" now works. Sort of. The server doesn't open any sockets. It doesn't check SQL, LDAP, etc. But modules which don't depend on anything (i.e. chap), and modules which only read flat-text files are checked for sanity when "-C" is used. The "man" page describes the limitations of "-C". $ kill -HUP `psgrep radiusd` This works. Sort of. For now, HUP *only* reloads the "files" module. it doesn't change ANYTHING else in the server. It doesn't reload, re-open, or examine ANY of the configuration files such as "radiusd.conf", "eap.conf", etc. With tiny amounts more work, a few other modules can be made to reload on HUP. i.e. preprocess, passwd, linelog, and a few others. Just as with "-C", SQL and LDAP won't be reloaded on HUP. Also, EAP won't be reloaded on HUP. If you *really* need that functionality, it's a large amount of work, and will need to be funded. Alan DeKok.

1 0

How to return Reply-Message when user submitted wrong password
by Lee Sing Chyun 12 Nov '07

12 Nov '07

Hi, Is there a way to reply with a intuitive Reply-Message (for e.g., 'Wrong Password') when the user tries to authenticate with a wrong password? My current configuration is using rlm_pap and rlm_sql for authorization and authentication. FreeRADIUS version is 1.1.7. Thanks in advance! -- Best Regards, SC

3 5

Mikrotik ignores Framed-IP-Address
by Marinko Tarlac 12 Nov '07

12 Nov '07

Hello I have freeradius and Mikrotik combination and here is the problem. Freeradius is configured to use mysql database. When I add Framed-IP-Address for certain user (in radreply table) For example 32 user Framed-IP-Address 10.51.8.152 := It works but only if I don't have IP pool created on Mikrotik. If I create IP pool than Framed-IP-Address is ignored. Framed-Pool is specified for every group and attributes for every group is added in radgroupreply table. Log without IP pool rad_recv: Access-Request packet from host 192.168.1.7:1026, id=229, length=149 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 870 NAS-Port-Type = Ethernet User-Name = "admin-test" Calling-Station-Id = "00:C0:CA:18:75:B3" Called-Station-Id = "radius" NAS-Port-Id = "ether1" CHAP-Challenge = 0x89a28dc77659b6311a88c16eb7500767 CHAP-Password = 0x01d385ce5c814c1d1db9cafadb4736c351 NAS-Identifier = "1.7 - h-0" NAS-IP-Address = 192.168.1.7 rlm_chap: Setting 'Auth-Type := CHAP' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "admin-test" with CHAP password rlm_chap: Using clear text password "perica" for user admin-test authentication. rlm_chap: chap user admin-test authenticated succesfully Sending Access-Accept of id 229 to 192.168.1.7 port 1026 Framed-IP-Address := 192.168.8.152 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Ascend-Data-Rate := 0 Ascend-Xmit-Rate := 0 Framed-Pool := "radius" Log with created IP pool called "radius" rad_recv: Access-Request packet from host 192.168.1.7:1027, id=240, length=149 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 872 NAS-Port-Type = Ethernet User-Name = "admin-test" Calling-Station-Id = "00:C0:CA:18:75:B3" Called-Station-Id = "radius" NAS-Port-Id = "ether1" CHAP-Challenge = 0x5293ac8321ad51693a5e3109f8887511 CHAP-Password = 0x01b0a9f7bca1f632878bee51c13d667f5c NAS-Identifier = "1.7 - h-0" NAS-IP-Address = 192.168.1.7 rlm_chap: Setting 'Auth-Type := CHAP' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "admin-test" with CHAP password rlm_chap: Using clear text password "perica" for user admin-test authentication. rlm_chap: chap user admin-test authenticated succesfully Sending Access-Accept of id 240 to 192.168.1.7 port 1027 Framed-IP-Address := 192.168.8.152 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Ascend-Data-Rate := 0 Ascend-Xmit-Rate := 0 Framed-Pool := "radius" rad_recv: Accounting-Request packet from host 192.168.1.7:1027, id=241, length=146 Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 872 NAS-Port-Type = Ethernet User-Name = "admin-test" Calling-Station-Id = "00:C0:CA:18:75:B3" Called-Station-Id = "radius" NAS-Port-Id = "ether1" Acct-Session-Id = "81d00316" Framed-IP-Address = 192.168.8.159 Acct-Authentic = RADIUS Acct-Status-Type = Start NAS-Identifier = "1.7 - h-0" NAS-IP-Address = 192.168.1.7 Acct-Delay-Time = 0 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 Sending Accounting-Response of id 241 to 192.168.1.7 port 1027 Any ideas?

2 1

radius server and MAC authentication for wireless
by Shawn Adams 11 Nov '07

11 Nov '07

I've noted that some wireless APs using MAC/MAC authentication send the MAC in the form: 11-22-33-44-55-66 or 11:22:33:44:55:66 or 112233445566 The last seems most prevelent. Is there a method to configure $RADIUS/user.conf or $RADIUS/radiusd.conf (or other file) to allow the radius to authenticate *both* with one user entry ? I guess I'm thinking about a user.conf entry which allows PC_X to attach to Access_point_A and authenticate when the userid/password is sent 112233445566 *and* allow the same PC, when roaming to Access_point_B to authenticate with 11-22-33-44-55-66 using only one users.conf entry. Any help appreciated. Thanks

4 13

Can FAQ 6.10 please be fixed?
by Jens Dreger 11 Nov '07

11 Nov '07

Hi! It took me a while to figure out that FAQ 6.10: http://wiki.freeradius.org/index.php/FAQ#How_do_I_check_the_configuration_b… is simply no longer true. Checked the source: that option is gone. I really really think that option should be there, though. I know there is a shell script that starts a second server on a different port and waits to see if it starts successfully. But that's also broken since the -p Option doesn't seem to work in all cases: ~> strace -e bind freeradius -X -p 32768 2>&1 | grep port main: port = 1812 listen: port = 0 bind(3, {sa_family=AF_INET, sin_port=htons(1812), <-------------------- sin_addr=inet_addr("130.133.100.66")}, 16) = -1 EADDRINUSE (Address already in use) /etc/freeradius/radiusd.conf[228]: Error binding to port for 130.133.100.66:1812 Also, that approach is somewhat ridiculous considered the importance of the radius server in our case. I tried to change the Wiki entry but apparently I don't have permission to do so. Can someone with write access to the Wiki please remove that entry (or better, add the -C option back to freeradius ;) Thanks, Jens. -- Jens Dreger Freie Universitaet Berlin dreger(a)physik.fu-berlin.de Fachbereich Physik - ZEDV Tel: +49 30 83854774 Arnimallee 14 Fax: +49 30 83855902 14195 Berlin

4 5

help with ldap/checkitem
by Joe Vieira 10 Nov '07

10 Nov '07

Hi, I am having some confusing trouble with an LDAP check item. applicable line from ldap attribute file --- checkItem VPNGroupName clarkuVlan ---- Users file. ############## VPN USER CONFIG ######################## DEFAULT NAS-Port-Type == Virtual, Framed-Protocol == PPP, Autz-Type := VPN Reply-Message = "Welcome %u, to Clark University's network #AUTHORIZED USE ONLY#", Fall-Through = Yes ############# VPN TEST USER CONFIG #################### DEFAULT VPNGroupName == testing CVPN3000-IPSec-Split-Tunneling-Policy = 1, Filter-Id="itsadmin-filter", CVPN3000-DHCP-Network-Scope = "140.232.2.1", CVPN3000-IPSec-Split-Tunnel-List ="itsadmin-routes" debug output ... rlm_ldap: checking if remote access for CLARKU\bjulin is allowed by clarkuVpnAccess rlm_ldap: looking for check items in directory... rlm_ldap: Adding clarkuVlan as VPNGroupName, value testing & op=21 ... Login OK: [CLARKU\\bjulin] (from client vpn port 176) Sending Access-Accept of id 8 to 10.13.13.1 port 1025 Reply-Message = "Welcome CLARKU\\\\bjulin, to Clark University's network #AUTHORIZED USE ONLY#" Framed-MTU = 576 MS-CHAP2-Success = 0xxxxxxxxxxxxxxxxxxxxxxxxx MS-MPPE-Recv-Key = 0xxxxxxxxxxxxxxxxxxxxxxxx MS-MPPE-Send-Key = 0xxxxxxxxxxxxxxxxxxxxxxxx MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 ... so i see it set the check item VPNGroupName to testing, but it never matches in the users file, can anyone point to what i am doing wrong? -- Joe Vieira UNIX Systems Administrator Clark University - ITS

4 6

Problem with MD5 Authentication and PAP
by Jonathan Wong 10 Nov '07

10 Nov '07

Hi, I am running Freeradius 1.1.4, MySQL, MD5, and PAP. For some reason, I cannot get authenticated using MD5 and PAP. The logins keep failing, and the logs says that I do not have a password set. When I use crypt and clear as the encryption schemes, I am able to get authenticated. The problem is that I am getting an md5 feed, so I have to use MD5. Can someone please help me figure out what I am doing wrong? Please let me know if other information is needed. Another weird thing is when I have PAP and MD5 set, and I do not have a radgroupcheck entry for my group, I can get authenticated by putting the MD5 Hash as my password. For example, if my MD5 hash was "abcd…", I would have to use "abcd…" as my password, and I would get an access-accept. #######Radiusd.conf######### modules{ pap { encryption_scheme = md5 } } authorize { preprocess auth_log sql } authenticate { Auth-Type PAP { pap } } ####### radcheck table entry ######### +----+----------+-----------+----+----------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+----------------------------------+ | 36 | stryker8 | Password | := | 5f4dcc3b5aa765d61d8327deb882cf99 | +----+----------+-----------+----+----------------------------------+ ####### radreply table entry ######### +----+----------+-----------+----+----------------+ | id | UserName | Attribute | op | Value | +----+----------+-----------+----+----------------+ | 36 | stryker8 | Class | = | OU=utnet-staff | +----+----------+-----------+----+----------------+ ####### radgroupcheck table entry ######### +----+-------------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-------------+-----------+----+-------+ | 8 | utnet-staff | Auth-Type | := | PAP | +----+-------------+-----------+----+-------+ ####### radiusd –X log ######### rad_recv: Access-Request packet from host 128.83.135.171:3335, id=5, length=48 User-Name = "stryker8" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/128.83.135.171/auth-detail-20071109' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/128.83.135.171/auth-detail-20071109 modcall[authorize]: module "auth_log" returns ok for request 1 radius_xlat: 'stryker8' rlm_sql (sql): sql_set_user escaped user --> 'stryker8' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'stryker8' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'stryker8' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'stryker8' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'stryker8' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'stryker8' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'stryker8' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'stryker8' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'stryker8' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_pap: login attempt with password password rlm_pap: No password configured for the user. Cannot do authentication modcall[authenticate]: module "pap" returns fail for request 1 modcall: group Auth-Type returns fail for request 1 auth: Failed to validate the user. Login incorrect: [stryker8] (from client JW-Client port 0) -------- Also, since I am running 1.1.4, I tried using the auto-header in PAP, instead of the encryption_scheme. I set auto_header = yes in the pap module in radiusd.conf I set my Attribute to "MD5-Password" in the radcheck table. I added "pap" to the end of the Authorize Module in radiusd.conf I get the following error: radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'stryker8' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'stryker8' ORDER BY id rlm_sql: Failed to create the pair: Unknown attribute "MD5-Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns fail for request 2 modcall: group authorize returns fail for request 2 There was no response configured: rejecting request 2 Server rejecting request 2. Thanks for your help in advance! Jonathan

3 3