- Freeradius-Users - lists.freeradius.org

Question regarding external script authentication
by Patric 18 May '07

18 May '07

Hi all, I am currently using exec to authenticate users through an external script. When all criteria match I return the correct access-accept pairs and the users authenticate successfully. When the criteria are NOT met, I exit(1) my php script to hand control back to the freeradius server. This seems to be causing authentication requests to time out, as I guess I am not sending anything back... My question is this: Would it be correct to return Auth-Type="Reject" in the cases where I want the user to be rejected? TIA! Patrick ---------------------------------------------------------------------- Free pop3 email with a spam filter. http://www.bluebottle.com

6 21

RE: Pool-Name from Called-Station-Id
by Hugh Messenger 18 May '07

18 May '07

Alan DeKok <aland(a)deployingradius.com> said: > Try putting it in the "hints" section. I think the "users" file > doesn't do the proper translations, unfortunately. > > DEFAULT Calling-Station-Id =~ ... > Pool-Name = ... > > That might work. Unfortunately not. It does produce a slightly different failure mode though. Instead of issuing queries with a blank pool_name, sqlippool barfs about missing pool_name. It looks like the default in the hints is triggering, but the Pool-Name attribute isn't making it through to sqlippool. Here's my hints entry: DEFAULT Called-Station-Id =~ "^([A-z0-9]+_pppoe_[0-9]+)$" Pool-Name = `%{1}` ... and here's the relevant parts of a log, after running a test from NTRadPing: rad_recv: Access-Request packet from host x.x.x.x:1926, id=0, length=93 User-Name = "radiustest" User-Password = "xxxxxxxx" NAS-Port = 123456 NAS-IP-Address = x.x.x.x Calling-Station-Id = "00:60:B3:45:6A:98" Called-Station-Id = "wibbly_pppoe_666" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 hints: Matched DEFAULT at 36 radius_xlat: 'wibbly_pppoe_666' [... snip hack bobbit ...] pam_pass: using pamauth string <radiusd> for pam.conf lookup pam_pass: authentication succeeded for <radiustest> modcall[authenticate]: module "pam" returns ok for request 0 modcall: leaving group authenticate (returns ok) for request 0 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 0 rlm_sqlippool: missing pool_name modcall[post-auth]: module "sqlippool" returns noop for request 0 This isn't desperately urgent, as I've now entered our 50 or so pools into the users file as individual DEFAULT lines, but it sure would be nice to be able to replace them with a single entry, and not have to worry about maintaining the users file as we add and change wireless sectors. > Alan DeKok. -- hugh

1 0

RE: radius+ldap+peap
by Arjuna Scagnetto 18 May '07

18 May '07

> Arjuna Scagnetto wrote: > > can someone tell me a good tutorial about making work freeradius with > > ldap and peap on a 802.1x architecture ? Get LDAP working with PAP authentication, but NOT using "ldap bind". Get PEAP working with passwords in the "users" file. Try PEAP with a user whose password is in LDAP. > > For the moment my freeradius server dies with a Segmentation Fault, i > > think it's caused by a misunderstanding between peap and ldap but i'm > > not sure. Please say which version of the server you're using. PEAP with user whose password is in LDAP INfo related to my configuration and some debug. --------------------------------------------------------------- slapd.configuration include radius.schema account type: dn: uid=wclient, ou=dot1x,cn=example,cn=com objectclass:top objectclass:radiusprofile objectclass:inetOrgPerson userPAssword: {SSHA}tymetcetcetc if i autheticate the user against Mysql it works perfectly, same wpa_supplicant config file tryng to authenticate against ldap, radius server dies with a Segmentation FAULT. Radius bind ldap that extract the userPassword field from his DIT and than radius dies. ----------------------------------------------------------------- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

4 5

signed certificate
by Phil Brown 18 May '07

18 May '07

-----BEGIN PGP SIGNED MESSAGE----- Can any one recommend a signed certificate provider whose certificates work with the Microsoft 802.1x client. I currently have a system that works fine with a self signed certificate but fails to work with a Digicert signed certificate, so we are looking to purchase a certificate that will work. Phil Brown Lan support Room 2-04 Halpern House ISO department University of Portsmouth -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i OS/2 for non-commercial use Comment: PGP 5.0 for OS/2 Charset: cp850 wsBVAwUBRk1Lvh8HY4rdc96FAQE0Qwf+JL0Rs3oyciH7mHxrRB58l+vOIIDLihNC UmKqd7c1AsWonmwibcagSjX6cM971HF0Itc4Q0FiX/Fwwesb8xhB/RugTXAnqJ36 OPMrHXCJvMwxknUsyWRyaHpTXGJIpVf8XzZgmLK115s6M/TWbLtWv0eNGFqwL256 FfR1tbmijAsVrbAtU94u9cpsWnBtVmsRtx0wGzcn0rKtS1FXoa5sAqbflDN1B2IS vgd5Kb7sOX7A96QdYuCCP6hswBzslJIQvDYBUaGC6/fEYriHQ0YlEE19HgBVyjRM Tyil6OikurtC6Dvc213aipw91dBi3WESxbTC3ajIXCimWSHLNAyIYg== =px7Q -----END PGP SIGNATURE-----

3 3

RE: radius+ldap+peap
by Arjuna Scagnetto 18 May '07

18 May '07

> > > O/H Alan DeKok ??????: >> Arjuna Scagnetto wrote: >> ... >> >>> PEAP with user whose password is in LDAP >>> >> ... >> >>> userPAssword: {SSHA}tymetcetcetc >>> >> This WILL NOT WORK. See: >> >> http://deployingradius.com/documents/protocols/compatibility.html >> >> use clear-text passwords in LDAP. If you can't put clear-text >> passwords in LDAP, stop trying to use PEAP. >> >> Alan DeKok. >> yes i've seen the matrix, i'll try EAP-TTLS + PAP so i can authenticate against LDAP with any password hash. Thanks for helping as soon as the book is pubblished you'll become rich! :) bye arjuna -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

radrelay patch for 1.1.6
by Milan Holub 18 May '07

18 May '07

Hi Alan, when using -R switch with radrelay binary from latest 1.1.6 release: `radrelay -f -R5 -d /etc/freeradius -a /var/log/freeradius/radacct/radrelay -S /etc/freeradius/radrelay_secret -r <remote_host> detail` I was continuously flooded by similar messages: ... radrelay: Running and Processing Records. Seconds since startup: <continuously increasing> Records Read: <continuously increasing> Packets Sent: 0 Record Rate since startup: <some rate> Packet Rate since startup: 0.00 ... There was an empty detail file (without any writer) thus I did not expected any records to be read... Here is my tested patch: Index: src/main/radrelay.c =================================================================== RCS file: /source/radiusd/src/main/Attic/radrelay.c,v retrieving revision 1.22.2.3.2.4 diff -u -r1.22.2.3.2.4 radrelay.c --- src/main/radrelay.c 16 Mar 2007 13:22:03 -0000 1.22.2.3.2.4 +++ src/main/radrelay.c 17 May 2007 14:27:35 -0000 @@ -678,9 +678,11 @@ rad_unlockfd(fileno(fp), 0); fseek(fp, fpos, SEEK_SET); } while(0); - if (r_args->records_print && state == STATE_RUN){ + else { stats.records_read++; - if (stats.last_print_records - stats.records_read >= r_args->records_print){ + } + if (r_args->records_print && state == STATE_RUN){ + if (stats.records_read != stats.last_print_records && (stats.records_read - stats.last_print_records) % r_args->records_print == 0){ now = time(NULL); uptime = (stats.startup == now) ? 1 : now - stats.startup; fprintf(stderr, "%s: Running and Processing Records.\n",progname); I believe it should be fixed in 1.X... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 2

confusing about Simultaneous-Use (still)
by Trio Yulistianto 18 May '07

18 May '07

hi all im using Freeradius-1.1.6, with mysql database.i'm still confusing about simultaneous-use. i want to limiting the maximum number of simultaneous logons ( just 1 session can login for every 1 user in a same time) this is my radiusd.conf session { sql } and this is my database : mysql> select * from radcheck where username='dara@idola'; +----+-----------------+---------------------------+----+--------------+ | id | UserName | Attribute | op | Value | +----+-----------------+----------------------------+----+-------------+ | 55 | dara@idola | Password | == | denpasar | | 65 | dara@idola | Simultaneous-Use | := | 1 | +----+-----------------+---------------------------+----+--------------+ 2 rows in set (0.00 sec) mysql> select username,acctstoptime from radacct where username='dara@idola' and acctstoptime=0; +----------------+-------------------------------+ | username | acctstoptime | +----------------+--------------------------------+ | dara@idola | 0000-00-00 00:00:00 | +-----------------+-------------------------------+ 1 row in set (0.00 sec) with that config and data rows, user dara@idola can login for second session :( any help expected thanks trio

2 2

EAP-TTLS Accounting Bug
by Sam Schultz 18 May '07

18 May '07

I didn't see anything about it in the list of changes, but I was wondering if this issue has been fixed in any recent releases ( > 1.1.5) Quick summary of the problem is that the := operator wouldn't replace the current anonymous outer identity for the User-Name attribute, but rather would just add another User-Name attribute. All output then of course used the anonymous identity, which isn't helpful in the least for radius accounting, or user tracking. > -----Original Message----- > From: freeradius-users-bounces+jhubert=med- > web.com(a)lists.freeradius.org [mailto:freeradius-users- > bounces+jhubert=med-web.com(a)lists.freeradius.org] On Behalf Of > Sam Schultz > Sent: Wednesday, March 14, 2007 7:14 PM > To: freeradius-users(a)lists.freeradius.org > Subject: Re: RE : EAP-TTLS outer identity & accounting > > An entry like: > > DEFAULT Realm == "test", Autz-Type := sql-test > User-Name = "%{User-Name}" > > does add a new User-Name attribute with the proper value, but I need a > way to delete the anonymous@ entry still, because I Access- Accepts > like > this: > > Sending Access-Accept of id 134 to 192.168.0.5 port 5190 > User-Name := "anonymous@test" > User-Name := "test@test" > > Followed by Accounting-Requests that still contain the anonymous > entry, so it is still using the oldest (first?) User-Name attribute. > Is > there any way at all to REMOVE already set attributes so they aren't > re-sent to the NAS? > > For that matter, shouldn't the "use_tunneled_reply = yes" in the ttls > module configuration have kept me from having this problem? > > I also have copy_request_to_tunnel set to yes, but I doubt that should > be causing a problem like this. > > On Wed, 14 Mar 2007 13:03:21 -0500 Sam Schultz > <segfault90(a)hushmail.com> wrote: > >On Wed, 14 Mar 2007 11:25:20 -0500 Thibault Le Meur > ><Thibault.LeMeur(a)supelec.fr> wrote: > >>> -----Message d'origine----- > >>> De : > >>> freeradius-users- > bounces+thibault.lemeur=supelec.fr(a)lists.free > >>> radius.org > >>> [mailto:freeradius-users- > bounces+thibault.lemeur=supelec.fr@li > >>> sts.freeradius.org] De la part de Sam Schultz Envoyé : mercredi 14 > >>> mars 2007 17:13 À : freeradius-users(a)lists.freeradius.org > >>> Objet : Re: EAP-TTLS outer identity & accounting > >>> > >>> > >>> > >>> > >>> On Tue, 13 Mar 2007 13:15:52 -0500 Alan DeKok > >>> <aland(a)deployingradius.com> wrote: > >>> >Sam Schultz wrote: > >>> >> > >>> >> This should be solvable by adding something like 'User-Name = > >>> >> %{User-Name}' to the DEFAULT entries in > the > >>users > >>> >file, > >>> >> correct? > >>> > > >>> > Yes. > >>> > >>> One of my users file DEFAULT entries look like this: > >>> > >>> DEFAULT Realm == "test", Autz-Type := sql-test, > User- > >>Name = > >>> "%u" > >>> > >>> However, FreeRADIUS tells me this: > >>> > >>> Error: Invalid operator for item User-Name: reverting to > '==' > >>> > >>> I assume I'm not supposed to forcibly change User-Name, so > what > >>> attribute would I set to return the correct username to > the > >NAS? > >> > >>> I know there is a run-time variable %(reply:User-Name}, > would I > >>> need to somehow update it with the correct value for User- > Name > >>> instead? > >> > >>Yes, by simply adding the User-Name = XXX to the reply items > >(that > >>is to say > >>not on the first line). Try something like this: > > > >This didn't make much sense at first, but I think I > understand it > >now. > >What you're saying is that the first line is only for check > items, > >which is why I couldn't set User-Name there. The second line > and > >beyond > >then are for, what? Reply items ONLY, or check & reply items? > Is > >this > >documented anywhere? I just did a quick check through the freeradius > >doc directory, and only found a rlm_fastusers document which > didn't > >have anything to say about format restrictions. > > > >> > >>DEFAULT Realm == "test", Autz-Type := sql-test > >> User-Name=`%{User-Name}` > >> > >>HTH, > >>Thibault

1 0

SQL query in Pre-Proxy
by Ivan Kalik 18 May '07

18 May '07

>do you mean that i have to do the following: in the radcheck i have to put username calling-station-id=number and in the radreply, username proxy-to-realm:=domain No. Put them both in radcheck: INSERT INTO radcheck SET UserName='thatname', Attribute='Calling-Station-Id', op='==', Value='thatnumber' INSERT INTO radcheck SET UserName='thatname', Attribute='Proxy-To-Realm', op=':=', Value='thatdomain' Use correct operators. "=" is not the same as "==" and is not allowed as check operator. Ivan Kalik Kalik Informatika ISP

1 0

Integrate freeradius v1.1.6 and openLADP v2.3.32 for authorization and authentication
by robin gong 17 May '07

17 May '07

Thanks Pshem for your quick answer. I expect answer like folowing "rlm_ldap: user jjeep authorized succesfully modcall[authorize]: module "ldap" returns ok" But I got "rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0" Thanks Robin Pshem Kowalczyk wrote:Freeradius expects exactly one answer: rlm_ldap: object not found or got ambiguous search result kind regards Pshem On 22/05/07, xuebin gong <robin_gong(a)yahoo.com> wrote: > Hi, All, > > I am new user and want to integrate freeradius v1.1.6 and > openLADP v2.3.32 for authorization and > authentication. Our operating system is Fedora 5 > Linux. > > (1)Install freeRadius-1.1.6 > After following the instruction of installation in > http://wwww.freeradius.org, > install freeRadius-1.1.6 on Fedora Linux 5, run radius > server in debug mode > > radiusd -X > ...... > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > > FreeRadius was installed succeefully. > > (2)Configure freeRadius-1.1.6 > (2.1) Configure radiusd.conf > (2.1.1) LDAP module > ldap{ > server = "10.0.0.118" > identity = "cn=Manager,dc=mtcable,dc=net" > password = mtncnl1970 > basedn = "dc=mtcable,dc=net" > filter = > "uid=%{Stripped-User-Name:-%{User-Name}}" > start_tls = no > dictionary_mapping = > ${raddbdir}/ldap.attrmap > ldap_connections_number = 5 > edir_account_policy_check=no > timeout = 4 > timelimit = 3 > net_timeout = 1 > } > (2.1.2) authorize module > uncomment ldap line > > authorize{ > ...... > ldap > ...... > } > > (2.1.3) authenticate module > uncomment block ldap block: > > authenticate{ > ...... > Auth-Type LDAP { > ldap > } > ...... > } > > > (2.2) edit /usr/local/etc/raddb/users > Uncomment the following lines: > > DEFAULT Auth-Type = LDAP > Fall-Through = 1 > > (3)Install openLDAP > (4)Configure openLDAP > (5)Add one LDAP entry for testing > > dn: uid=jjeep, ou=radius, rccd=AAA3140018f, > dc=mtcable,dc=net > userPassword:: aabbccdd > cn: jeep > uid: jjeep > radiusAuthType: local > radiusSimultaneousUse: 1 > homeDirectory: // > objectClass: top > objectClass: posixAccount > objectClass: radiusprofile > uidNumber: 7012 > gidNumber: 100 > > After add this entry to LDAP, we reset the password to > "888888" > > (5)Test > After run test command line > > radtest jjeep "888888" localhost 1 testing123 > > The following is information from running Radiusd -X: > > ...... > rad_recv: Access-Request packet from host > 127.0.0.1:32771, > id=192, length=57 > User-Name = "jjeep" > User-Password = "888888" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 1 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok > for request 0 > modcall[authorize]: module "chap" returns noop for > request 0 > modcall[authorize]: module "mschap" returns noop for > request 0 > rlm_realm: No '@' in User-Name = "jjeep", looking up > realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for > request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for > request 0 > users: Matched entry DEFAULT at line 153 > modcall[authorize]: module "files" returns ok for > request 0 > rlm_ldap: - authorize > rlm_ldap: performing user authorization for jjeep > radius_xlat: 'uid=jjeep' > radius_xlat: 'dc=mtcable,dc=net' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to 10.0.0.118:389, > authentication 0 > rlm_ldap: bind as cn=Manager,dc=mtcable,dc=net/mtncnl1 > > 970 to 10.0.0.118:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in dc=mtcable,dc=net, with > > filter uid=jjeep > rlm_ldap: object not found or got ambiguous search > result > rlm_ldap: search failed > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authorize]: module "ldap" returns notfound > for req > uest 0 > rlm_pap: WARNING! No "known good" password found for > the use > r. Authentication may fail because of this. > modcall[authorize]: module "pap" returns noop for > request0 > modcall: leaving group authorize (returns ok) for > request 0 > rad_check_password: Found Auth-Type LDAP > auth: type "LDAP" > Processing the authenticate section of radiusd.conf > modcall: entering group LDAP for request 0 > rlm_ldap: - authenticate > rlm_ldap: login attempt by "jjeep" with password > "888888" > radius_xlat: 'uid=jjeep' > radius_xlat: 'dc=mtcable,dc=net' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in dc=mtcable,dc=net, with > > filter uid=jjeep > rlm_ldap: object not found or got ambiguous search > result > rlm_ldap: ldap_release_conn: Release Id: 0 > modcall[authenticate]: module "ldap" returns > notfound for > request 0 > modcall: leaving group LDAP (returns notfound) for > request 0 > auth: Failed to validate the user. > Login incorrect (rlm_ldap: User not found): [jjeep] > (from cl > ient localhost port 1) > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > > The following is logfile: > > ...... > May 17 12:09:13 dolphin slapd[2205]: conn=7 fd=17 > ACCEPT from IP=10.0.0.118:35564 (IP=0.0.0.0:389) > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND > dn="cn=Manager,dc=mtcable,dc=net" method=128 > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 BIND > dn="cn=Manager,dc=mtcable,dc=net" mech=SIMPLE ssf=0 > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=0 > RESULT tag=97 err=0 text= > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH > base="dc=mtcable,dc=net" scope=2 deref=0 > filter="(uid=jjeep)" > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 SRCH > attr=radiusNASIpAddress radiusExpiration acctFlags > ntPassword lmPassword radiusCallingStationId > radiusCalledStationId radiusSimultaneousUse > radiusAuthType radiusCheckItem radiusReplyMessage > radiusLoginLATPort radiusPortLimit > radiusFramedAppleTalkZone radiusFramedAppleTalkNetwork > radiusFramedAppleTalkLink radiusLoginLATGroup > radiusLoginLATNode radiusLoginLATService > radiusTerminationAction radiusIdleTimeout > radiusSessionTimeout radiusClass > radiusFramedIPXNetwork radiusCallbackId > radiusCallbackNumber radiusLoginTCPPort > radiusLoginService radiusLoginIPHost > radiusFramedCompression radiusFramedMTU radiusFilterId > radiusFramedRouting radiusFramedRoute > radiusFramedIPNetmask radiusFramedIPAddress > radiusFramedProtocol radiusServiceType radiusReplyItem > > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=1 > SEARCH RESULT tag=101 err=0 nentries=3 text= > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH > base="dc=mtcable,dc=net" scope=2 deref=0 > filter="(uid=jjeep)" > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 SRCH > attr=uid > May 17 12:09:13 dolphin slapd[2205]: conn=7 op=2 > SEARCH RESULT tag=101 err=0 nentries=3 text= > > It looks like LDAP search successfully and found 3 > entries, but redius server could not find any objects. > > What is wrong with my integration? > > Thanks In Advanced > > Robin -- View this message in context: http://www.nabble.com/Integrate-freeradius-v1.1.6-and-openLADP-v2.3.32-for-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0