- Freeradius-Users - lists.freeradius.org

pam_radius_auth updated spec file, please include in future releases
by Florin Andrei 05 Nov '07

05 Nov '07

I attached an updated spec file for pam_radius_auth. The original one fails when building as non-root. I fixed that and made a few other minor changes. It would be nice if the build system could generate this spec file from a template, automatically replace the version number inside the spec with the actual version of the pam_radius_auth tarball, and include the automatically generated spec in the tarball. That way, users could generate RPM packages out of the tarball by simply downloading the archive and running: rpmbuild -ta pam_radius...(version number here)...tar.gz Thanks, -- Florin Andrei http://florin.myip.org/

2 2

Maintaining a (very) dynamic user list with freeradius
by Jos Vos 05 Nov '07

05 Nov '07

Hi, What is the best way to maintain a very dynamic user list for freeradius (on a Linux platform)? I'm talking about a setup where every few minutes (sometimes every minute) a user has to be added and/or removed, with in total up to about 200 users in the user base at the same moment. Ideally, I'd like to just regenerate the users file with a script whenever a change is needed and let radiusd reload it, but I saw in the docs that reloading the config (and the users file) is "expensive", so this will probably not be very suitable for this situation. If anyhow possible I'd like to minimize any extra overhead, and avoid running PostgreSQL or MySQL servers, for example. Maybe use DBM? What is recommended for this purpose? Thanks for all suggestions. -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

5 10

FreeRADIUS with PostgreSQL fails to authenticate
by Jos Vos 04 Nov '07

04 Nov '07

Hello, After configuring FreeRADIUS to use PostgreSQL, and adding a user to the database, when doing a "radtest" for that user I see with "radiusd -X": modcall[authorize]: module "sql" returns ok for request 2 modcall: group authorize returns ok for request 2 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 modcall[authenticate]: module "unix" returns notfound for request 2 modcall: group authenticate returns notfound for request 2 auth: Failed to validate the user. It looks like the password is not checked against the radcheck table. There I added the user with attribute "User-Password", op ":=" and a password value. I also added another user to the users file and that user is accepted. This is with the old freeradius 1.0.1, but I hope the problem I have is just a simple user configuration error. Thanks for any suggestions, -- -- Jos Vos <jos(a)xos.nl> -- X/OS Experts in Open Systems BV | Phone: +31 20 6938364 -- Amsterdam, The Netherlands | Fax: +31 20 6948204

2 2

Problem: Proxy cleartext-password requests to remote IAS that only
by Erling Paulsen 03 Nov '07

03 Nov '07

Hi. I have the following scenario: [1]NAS <--> [2]FreeRADIUS <--> [3]IAS [1] A NAS that supports RADIUS. It sends request-packets with "User-Password" set in cleartext. [2] A FreeRADIUS server that proxies certain users (by realm) to another server (IAS). [3] An IAS (Windows RADIUS). The problem is that this server ONLY accepts ms-chap1 or ms-chap2 session. Is there a common way to bypass this problem, I cannot find any? I was thinking it would be nice to let FreeRADIUS act as an ms-chap session client on behalf of the NAS, and then in the end only send ACCEPT/DENY back to the NAS instead of proxying directly to the IAS (which denies cleartext logins). Is this possible in some way? -- Erling Paulsen

2 1

Users can't access the Web
by Rob Borland 03 Nov '07

03 Nov '07

I've installed FreeRadius-0.9.3 (the latest version my old RedHat Linux distribution will support). FreeRadius is working fine for logins but since installing it users can't access the Web. I'd appreciate any advice. Regards, Rob

1 1

Filtering out a attribute conditionally
by Mike O'Connor 03 Nov '07

03 Nov '07

Hi All I have a problem with my Cisco 7301's where I apply a address pool via a Cisco-AVPair (for each wholesale ISP customer) and the wholesale ISP supplies a Framed-IP-Address at the same time, the connection is kicked by the cisco. Is there any way of adding or removing the ip_pool bases on a rule ? Could Freeradius 2 do this ? Thanks Mike --- Current Attrs File xxxx.com Service-Type == Framed-User, Framed-IP-Address =* 255.255.255.254, Framed-IP-Netmask == 255.255.255.255, Framed-Route =* ANY, Cisco-AVPair := "ip:addr-pool=ip_pool_netyp", Framed-Compression =* Van-Jacobson-TCP-IP, Framed-Protocol == PPP, Framed-MTU =* 1492, Framed-Filter-ID =* ANY, Cisco-AVPair =* ANY, Reply-Message =* ANY, Proxy-State =* ANY, Idle-Timeout =* 600, Session-Timeout =* 28800, Port-Limit =* 1 --- Reply with out framed-ip-address Packet-Type = Access-Accept Wed Oct 31 19:55:36 2007 Cisco-AVPair := "ip:addr-pool=ip_pool_netyp" Service-Type = Framed-User Framed-Protocol = PPP Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Session-Timeout = 14400 Idle-Timeout = 900 Port-Limit = 1 --- Reply with framed-ip-address Packet-Type = Access-Accept Wed Oct 31 19:55:36 2007 Cisco-AVPair := "ip:addr-pool=ip_pool_netyp" Service-Type = Framed-User Framed-IP-Address = XXX.XXX.11.247 Framed-IP-Netmask = 255.255.255.255 Framed-Protocol = PPP Framed-MTU = 1500 Framed-Compression = Van-Jacobson-TCP-IP Session-Timeout = 14400 Idle-Timeout = 900 Port-Limit = 1

2 2

How to proxy password from TTLS
by Wolfgang Burger 02 Nov '07

02 Nov '07

Hi, I have a working configuration of FreeRADIUS configured for EAP-TLS. I´m trying to add support for EAP-TTLS and I want to proxy the username and password of the inner TTLS session to another Radius-Server. Client doing TTLS --> FreeRADIUS --> 3rd-Party Backend-Server with database of Users Forwarding of the packets is working. The Access-Request that FreeRADIUS sends to the backend-server uses the username entered at the client, but no password at all. If i add User-Password := "validpassword" to preproxy_users, where "validpassword" is the valid password for the given username on the Backend-Server, everything works. What do I have to change, to use the password transmitted in the TTLS-Tunnel? Or do I have fundamental errors in my idea of how to do this? Any help is very welcome. Greetings, Wolfgang Burger <burgerw(a)immunbio.mpg.de> Max-Planck-Institut fuer Immunbiologie Scientific Data Processing Unit (+00 49) 761 / 5108 461 Stuebeweg 51 D-79108 Freiburg Germany

3 7

problem with proxying
by hacklberry 02 Nov '07

02 Nov '07

I wrote a little module for freeradius that is forwarding the incoming authentication requests to another server (to do the authentication). However I have to support proxying (in case there is a 3rd party RADIUS server). I can not take advantage of realms, because the users are login without any realm suffixes, prefixes, etc. (User bob simply uses username 'bob'). The problems is that bob can be a valid user on our server as well on the 3rd party RADIUS server. I tried to experiment with the Proxy-To-Realm attribute in the users file, but haven't had any luck either. Here is what I m trying to do: use my module rlm_xxx to authenticate user bob - if success i don't need anything else - if failure i want to proxy the authentication request to a 3rd party RADIUS server - if the authentication on the 3rd party RADIUS server succeeds I registered a post-proxy function in my module, where I m decreasing failed authentication count on the first server All these steps are working (separatelly) , but I m not able to make them work together, i.e. my authentication works, but no proxying, or the proxying works (when i setup the 3rd party RADIUS in the NULL realm) - but then my authentication against the first server is not called at all (my modules authenticate function is not called), the request is proxied without attempting my authentication function, only the post-proxy function on my module is called. I wonder if you could suggest how to configure freeradius to achieve what I m trying to do (if it is possible at all of course), cheers, martin

2 1

PAM_RADIUS_AUTH
by Sobanbabu Bakthavathsalu 02 Nov '07

02 Nov '07

Hi I am trying install the PAM_RADIUS_AUTH on a Solaris 10 server to use RADIUS for user authentication. I have managed to successfully compile and install the pam plugin. When I tried to telnet to the machine from a different server I am getting the following error. Failed looking up IP address for RADIUS server radius1 (errcode=12) I have made a host entry for this server name in /etc/hosts file and able to ping the RADIUS server with name. But still its not working. Could you please help on resolving this. Regards Soban **************** CAUTION - Disclaimer ***************** This e-mail contains PRIVILEGED AND CONFIDENTIAL INFORMATION intended solely for the use of the addressee(s). If you are not the intended recipient, please notify the sender by e-mail and delete the original message. Further, you are not to copy, disclose, or distribute this e-mail or its contents to any other person and any such actions are unlawful. This e-mail may contain viruses. Infosys has taken every reasonable precaution to minimize this risk, but is not liable for any damage you may sustain as a result of any virus in this e-mail. You should carry out your own virus checks before opening the e-mail or attachment. Infosys reserves the right to monitor and review the content of all messages sent to or from this e-mail address. Messages sent to or from this e-mail address may be stored on the Infosys e-mail system. ***INFOSYS******** End of Disclaimer ********INFOSYS***

3 5

Basic usage: What do I do next to get this to work?
by Doc. Caliban 01 Nov '07

01 Nov '07

Hello, I hate to ask this, but I'm running out of time on this project and I'm completely new to RADIUS. I would be really happy if someone could just point me to a detailed HOW TO for what I need. I have freeRADIUS set up with an external MySQL user database and it's successfully authorizing requests from NTRadPing. Now I need to actually try it out "In the field". I need people running XP, Vista (ugh), and Apple laptops to be able to auth using the MySQL database that I have set up. So far I'm not having any luck, and I don't mind saying that I'm a little over my head at this point. Someone familiar with this will probably see glaring problems. I will provide all the details I can think of, but please let me know if you need more. Server: FreeRADIUS 1.1.7 with MySQL module. Database: Remote MySQL Access Point: D-Link DWL-7100AP (Ciscos coming in January) WPA-EAP TKIP Client Laptop: WPA Enterprise TKIP PEAP (Other options: EAP-SIM, TLS, TTLS, LEAP, EAP-FAST) MS-CHAP-V2 (Other options: GTC, TLS) I set up an AP to use RADIUS, and the requests get through to the RADIUS server, but they always fail. Posted below is the debug output from the failed attempt. > Ready to process requests. > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=0, > length=193 > Message-Authenticator = 0xf9c41895a382161a1d31b4a47bd830e0 > Service-Type = Framed-User > User-Name = "testuser" > Framed-MTU = 1488 > Called-Station-Id = "00-11-95-DA-16-A6:SUSOM" > Calling-Station-Id = "00-1B-77-28-B3-CF" > NAS-Identifier = "D-Link Access Point" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 54Mbps 802.11a" > EAP-Message = 0x0200000b01746261727468 > NAS-IP-Address = 192.168.0.1 > NAS-Port = 1 > NAS-Port-Id = "STA port # 1" > rad_lowerpair: User-Name now 'testuser' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 0 length 11 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > radius_xlat: 'testuser' > rlm_sql (sql): sql_set_user escaped user --> 'testuser' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'testuser' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 4 > radius_xlat: 'SELECT > radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op > FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'testuser' ORDER BY id' > radius_xlat: 'SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): Released sql socket id: 4 > modcall[authorize]: module "sql" returns ok for request 0 > rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 0 > modcall: leaving group authorize (returns updated) for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type md5 > rlm_eap_md5: Issuing Challenge > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: leaving group authenticate (returns handled) for request 0 > Sending Access-Challenge of id 0 to 192.168.0.1 port 1030 > Framed-Protocol := PPP > Service-Type := Framed-User > Framed-MTU := 1500 > Framed-Compression := Van-Jacobson-TCP-IP > EAP-Message = 0x0101001604104e273ea966f4fb77466b296f9c607385 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x149370a5228b3ae0acdd9dc3fb4a25a4 > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=1, > length=206 > Message-Authenticator = 0xc9926863cf3df06ac150bbb6f77208eb > Service-Type = Framed-User > User-Name = "testuser" > Framed-MTU = 1488 > State = 0x149370a5228b3ae0acdd9dc3fb4a25a4 > Called-Station-Id = "00-11-95-DA-16-A6:SUSOM" > Calling-Station-Id = "00-1B-77-28-B3-CF" > NAS-Identifier = "D-Link Access Point" > NAS-Port-Type = Wireless-802.11 > Connect-Info = "CONNECT 54Mbps 802.11a" > EAP-Message = 0x020100060319 > NAS-IP-Address = 192.168.0.1 > NAS-Port = 1 > NAS-Port-Id = "STA port # 1" > rad_lowerpair: User-Name now 'testuser' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: EAP packet type response id 1 length 6 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 1 > radius_xlat: 'testuser' > rlm_sql (sql): sql_set_user escaped user --> 'testuser' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radcheck WHERE Username = 'testuser' ORDER BY id' > rlm_sql (sql): Reserving sql socket id: 3 > radius_xlat: 'SELECT > radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op > FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' > radius_xlat: 'SELECT id, UserName, Attribute, Value, op > FROM radreply WHERE Username = 'testuser' ORDER BY id' > radius_xlat: 'SELECT > radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND > usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' > rlm_sql (sql): Released sql socket id: 3 > modcall[authorize]: module "sql" returns ok for request 1 > rlm_pap: Found existing Auth-Type, not changing it. > modcall[authorize]: module "pap" returns noop for request 1 > modcall: leaving group authorize (returns updated) for request 1 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 1 > rlm_eap: Request found, released from the list > rlm_eap: EAP NAK > rlm_eap: EAP-NAK asked for EAP-Type/peap > rlm_eap: No such EAP type peap > rlm_eap: Failed in EAP select > modcall[authenticate]: module "eap" returns invalid for request 1 > modcall: leaving group authenticate (returns invalid) for request 1 > auth: Failed to validate the user. > Delaying request 1 for 1 seconds > Finished request 1 > Going to the next request > Waking up in 6 seconds... > rad_recv: Access-Request packet from host 192.168.0.1:1030, id=1, > length=206 > Sending Access-Reject of id 1 to 192.168.0.1 port 1030 > EAP-Message = 0x04010004 > Message-Authenticator = 0x00000000000000000000000000000000

6 28