- Freeradius-Users - lists.freeradius.org

Freeradius Auth via LDAP against Active Directory Server 2003
by Jacob Jarick 09 Jul '07

09 Jul '07

I have been at this for awhile now, so I thought I would share a summary of what I have figured out so far for anyone else that decides to try this. 1 - Documentation for this particular configuration is either out of date / incomplete / both. There are no howtos that will get from start to end (if you do know of one or wrote one yourself please share - I will myself when I figure it all out). 2 - Most the trouble is due to the fact we are making a linux service talk to a windows service (AD LDAP). Freeradius talking to the linux passwd file is a breeze by comprassion. 3 - Windows 2003 LDAP implementation will not provide a password when a user/ service preforms a ldap search, the proper way If I understand correctly is to supply plain text username / password then freeradius preforms a bind with the provided credentials against your ADS server, success means the password was correct. 4 - Installing "Services For Unix" on 2003 will make AD LDAP provide a password hash attribute among other unix LDAP attributes. The user has have posix enabled. 5 - Anonymous searchs can be preformed on 2003 AD LDAP if you set dSHeuristics to 0000002 using adsiedit.msc. 6 - Microsofts LDAP is different to Novells (big surprise) and so unfortunately their documentation isnt to helpfull as a reference for people trying to use ADS in the same fashion.

6 17

Plug-in Question
by George Beitis 08 Jul '07

08 Jul '07

Hi Everyone i have a question regarding freeradius. I am trying to write a plugin and i was wondering what the postauth section is for. I want to be able to alter the authentication decision of freeradius, once it is made but before the ok response is sent. I will use a policy engine to do that and i want to overwrite the final decision if the user is not authorized based on my policy. Is postauth the right place to do this? regards George

8 29

Block wiki spammer.
by Arran Cudbard-Bell 08 Jul '07

08 Jul '07

Hi Peter, Can you block Ce3Wre <http://wiki.freeradius.org/index.php?title=User:Ce3Wre&action=edit> Spamming Run-time-Variables page. And could I have edit rights to the start page, pretty please :) Thanks, Arran

3 5

NAS Reboot
by gaopeng 08 Jul '07

08 Jul '07

Hi,I try to implement the EAP-TLS by Freeradius, but the authentication stoped. From the log, I guess the reason is "NAS Reboot". I wonder if you know why it happend. Thanks a lot in advance! Enclosed please find the part of the log. Paul... ...Finished request 23Going to the next requestWaking up in 6 seconds...rad_recv: Access-Request packet from host 192.168.1.120:32778, id=33, length=219 User-Name = "host/cn1njxac.cn001.siemens.net" NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" NAS-Port = 0 Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Calling-Station-Id = "00-16-6F-58-2D-4B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x022400061900 State = 0xc22b0aa9baefeb0a401d5bfb77355856 Message-Authenticator = 0xcbe38495618ee3a8a7d15dc8d088b68d Processing the authorize section of radiusd.confmodcall: entering group authorize for request 24 modcall[authorize]: module "preprocess" retu! rns ok for request 24 modcall[authorize]: module "chap" returns noop for request 24 modcall[authorize]: module "mschap" returns noop for request 24 rlm_realm: Checking for suffix after "@" rlm_realm: Looking up realm "cn1njxac.cn001.siemens.net" for User-Name = "host/cn1njxac.cn001.siemens.net"XXL:enter realm_find realm =cn1njxac.cn001.siemens.net,accounting =0 Start to compare realm 2:config ream is :LOCAL,sta ream is :cn1njxac.cn001.siemens.net rlm_realm: No such realm "cn1njxac.cn001.siemens.net" modcall[authorize]: module "suffix" returns noop for request 24 rlm_eap: EAP packet type response id 36 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 24 users: Matched entry host/cn1njxac.cn001.siemens.net at line 95 modcall[authorize]: module "files" returns ok for request 24XXL: enter pap_authorize,vp->attribute =1000XXL: vp->lvalue =6XXL: enter pap_authorize,vp->attribu! te =2XXL: enter PW_USER_PASSWORD,found_pw should be truerlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 24modcall: leaving group authorize (returns updated) for request 24 rad_check_password: Found Auth-Type EAPauth: type "EAP" Processing the authenticate section of radiusd.confmodcall: entering group authenticate for request 24 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLSrlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 24modcall: leaving group authenticate (returns handled) for request 24Sending Access-Challenge of id 33 to 192.168.1.120 port 32778 EAP-Message = 0x012500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8810d4afb824cb4c9026f9697c25f35cFinished r! equest 24Going to the next requestWaking up in 6 seconds...--- Walking the entire request list ---Cleaning up request 20 ID 29 with timestamp 468e087eCleaning up request 21 ID 30 with timestamp 468e087eCleaning up request 22 ID 31 with timestamp 468e087eCleaning up request 23 ID 32 with timestamp 468e087eCleaning up request 24 ID 33 with timestamp 468e087eNothing to do. Sleeping until we see a request.rad_recv: Accounting-Request packet from host 192.168.1.120:32779, id=34, length=101 Acct-Status-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.confmodcall: entering group preacct for request 25 modcall[preacct]: module "preprocess" returns noop for request 25rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: W! ARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 25 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 25 modcall[preacct]: module "files" returns noop for request 25modcall: leaving group preacct (returns ok) for request 25 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 25radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" retu! rns ok for request 25 modcall[accounting]: module "unix" returns noop for request 25radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 rebooted (Accounting-Off packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 25modcall: leaving group accounting (returns ok) for request 25Sending Accounting-Response of id 34 to 192.168.1.120 port 32779Finished request 25Going to the next request--- Walking the entire request list ---Cleaning up request 25 ID 34 with timestamp 468e08a3Nothing to do. Sleeping until we see a request.rad_recv: Accounting-Request packet from host 192.168.1.120:32781, id=0, length=101 Acct-Status-Type = Accounting-On Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Rebo! ot Processing the preacct section of radiusd.confmodcall: entering gr oup preacct for request 26 modcall[preacct]: module "preprocess" returns noop for request 26rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 26 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suffix" returns noop for request 26 modcall[preacct]: module "files" returns noop for request 26modcall: leaving group preacct (returns ok) for request 26 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 26radius_xlat: '/usr/local/fre! eradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" returns ok for request 26 modcall[accounting]: module "unix" returns noop for request 26radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 restarted (Accounting-On packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 26modcall: leaving group accounting (returns ok) for request 26Sending Accounting-Response of id 0 to 192.168.1.120 port 32781Finished request 26Going to the next request--- Walking the entire request list ---Cleaning up request 26 ID 0 with timestamp 468e08a7Nothing to do. Sleeping until we see a request.rad_recv: Accounting! -Request packet from host 192.168.1.120:32781, id=1, length=101 Acct-S tatus-Type = Accounting-Off Acct-Authentic = RADIUS NAS-IP-Address = 192.168.1.120 NAS-Identifier = "sourceserver.localdomain" Called-Station-Id = "00-19-E0-85-F2-45:madwifi_t41" Acct-Terminate-Cause = NAS-Reboot Processing the preacct section of radiusd.confmodcall: entering group preacct for request 27 modcall[preacct]: module "preprocess" returns noop for request 27rlm_acct_unique: WARNING: Attribute NAS-Port was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistentrlm_acct_unique: WARNING: Attribute User-Name was not found in request, unique ID MAY be inconsistentrlm_acct_unique: Hashing ',Client-IP-Address = 192.168.1.120,NAS-IP-Address = 192.168.1.120,,'rlm_acct_unique: Acct-Unique-Session-ID = "9ac3835c84179e1f". modcall[preacct]: module "acct_unique" returns ok for request 27 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[preacct]: module "suff! ix" returns noop for request 27 modcall[preacct]: module "files" returns noop for request 27modcall: leaving group preacct (returns ok) for request 27 Processing the accounting section of radiusd.confmodcall: entering group accounting for request 27radius_xlat: '/usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706'rlm_detail: /usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/freeradius/var/log/radius/radacct/192.168.1.120/detail-20070706 modcall[accounting]: module "detail" returns ok for request 27 modcall[accounting]: module "unix" returns noop for request 27radius_xlat: '/usr/local/freeradius/var/log/radius/radutmp'rlm_radutmp: NAS madwifi_t41 rebooted (Accounting-Off packet seen)rlm_radutmp: Error accessing file /usr/local/freeradius/var/log/radius/radutmp: No such file or directory modcall[accounting]: module "radutmp" returns ok for request 27modcall: leaving group accounting (returns ok)! for request 27Sending Accounting-Response of id 1 to 192.168.1.120 po rt 32781Finished request 27Going to the next request--- Walking the entire request list ---Cleaning up request 27 ID 1 with timestamp 468e0abeNothing to do. Sleeping until we see a request. _________________________________________________________________ 探索 Windows Vista 的世界 http://search.live.com/results.aspx?q=windows+vista&mkt=zh-cn&FORM=LIVSOP

2 1

User not found using LDAP
by Amr el-Saeed 08 Jul '07

08 Jul '07

Dear all, i'm using freeradius-1.1.0-1 i need to make a default action if a user is not found . i need to make this action ( allow) for a while, i mean if the radius searched the LDAP and didn't find the user reply to the router with OK. i didn't find anything in the docs. any ideas ?? Regards Amr Ali

3 7

sql auth problems with 2.0.0-pre
by Alexander Serkin 07 Jul '07

07 Jul '07

Gurus, may be i'm pulling some common mistake with my configuration being tested against cvs snapshot, but no idea which one. I've an sql profile telling: some.dotted.user Cleartext-Password = cisco NAS-IP-Address =~ "xxx.xxx.97.(85|86)" authentication request: User-Name = "some.dotted.user" User-Password = "cisco" Calling-Station-Id = "000000000000000" Framed-Protocol = PPP Service-Type = Framed-User NAS-IP-Address = xxx.xxx.97.85 gives the access-reject for unknown (for me) reason: rlm_sql (sqlauth): sql_set_user escaped user --> 'some.dotted.user' rlm_sql (sqlauth): Reserving sql socket id: 3 radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id' SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'some.dotted.user' ORDER BY id ... rlm_sql (sqlauth): Released sql socket id: 3 modcall[authorize]: module "sqlauth" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No password configured for the user Login incorrect (No password configured for the user): [some.dotted.user/cisco] (from client localhost port 0 cli 00000000000000) auth: Failed to validate the user. I've checked the authorization sql query shown in debug - it properly returns the profile configured -- Sincerely Yours, Alexander

5 21

Re: pool-key issue in rlm_sqlippool
by Hugh Messenger 07 Jul '07

07 Jul '07

[Changed the subject back again. I have a bad habit of forgetting to change it from the digest subject when I respond. Time to switch lists, I guess.] Peter Nixon <listuser(a)peternixon.net> said: > > if ("%{control:Pool-Name}") { > > if ("%{control:Huntgroup-Name" == "dialup") { > > sqlippool_dialup > > } > > elsif ("%{control:Huntgroup-Name" == "wireless") { > > sqlippool_wireless > > } > > } > > Nope. Accounting does not know which Pool-Name was used, or even IF a pool > was used or not.... Doh! And I'd just finished explaining how I set the Pool-Name up in the authorize section. Slaps forehead. Does the Huntgroup-Name get set during accounting? I may not know the pool name, but if I know the Huntgroup, I know which instance of sqlippool I'll need. > Just list them both. Yup. That's how I've been testing it so far. I was just trying to find a way that would avoid unnecessary db queries. > Even just fixing existing pages that you feel are unclear is helpfull as > you > are a new comer and have found by trial and error which bits are difficult > to understand. That was years ago for many of the wiki authors :-) Okie Dokie. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 1

using EAP instead of chilli
by Carl aniams 07 Jul '07

07 Jul '07

hi all i'm using freeradius with a mysql database to authenticate users through chillispot, and it's working fine. i would like to authenticate my user using EAP instead of using chilli that already grant them access through dhcp to the network i have a wrt54g linksys running dd-wrt can someone help or give a link on how to deploy using the same linksys box. thanks a lot -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

1 0

files module
by Diana Robert 07 Jul '07

07 Jul '07

hi, My server is using the files module to authenticate a client, but the module is present only in the authorize section and not in the authenticate section in radiusd.conf file, so can anyone comment on this. Wat is my doubt is , Is it enough to have the files [or anyother] module to be present only in authorize section. thank u. Send free SMS to your Friends on Mobile from your Yahoo! Messenger. Download Now! http://messenger.yahoo.com/download.php

2 1

Freeradius + LDAP + EAP-TTLS with PAP cannot login
by cktan＠ocesb.com.my 07 Jul '07

07 Jul '07

7 24