- Freeradius-Users - lists.freeradius.org

Questions regarding authentication systems and protocols to password types compatibility
by Reimer Karlsen-Masur, DFN-CERT 20 Apr '07

20 Apr '07

Hi Alan, hi list, I appreciate the tables explaining the compatibility of authentication systems / protocols to password type compatibility from: [table 1] http://deployingradius.com/documents/protocols/compatibility.html and [table 2] http://deployingradius.com/documents/protocols/oracles.html But I am still confused about the relationship of these two tables to each other and how to use them. Is the following considered correct? 1. If I am using the back end DB (e.g. ldap or users file, etc.) as a simple *password store*, only [table 1] if of interest. And freeradius is able to connect to the back end (if there is a rlm_<back-end-db> module available), authenticate itself with a special radius server account/user credential and to retrieve the password plus optionally some other attribute values if the radius server *itself* authenticates successfully with the back end DB. The radius server itself is then performing the user name/password check to accept or reject the authentication request of the user trying to connect. 2. If I am using the back end DB (e.g. ldap etc.) as an *authentication oracle*, [table 2] tells me which authentication oracle system I can use (depending on the authentication protocol that the supplicant/client/user is using) and [table 1] tells me in which format the passwords need to be stored in the authentication oracle. And freeradius is able to connect to the back end (if there is a rlm_<back-end-db> module available), to authenticate *with the user provided* credentials (username/password) and to optionally retrieve some attribute values if the *user* authenticated successfully against the authN oracle. Confirmation or further clarification is welcome. Thanks Reimer ps: There is probably a small typo in the column heading of [table 1]: 'SSHA1 hash' should be 'SHA1 hash' and 'Salted SSHA1 hash' should be 'Salted SHA1 hash (SSHA1)' -- Kind Regards Reimer Karlsen-Masur DFN-PKI FAQ: https://www.pki.dfn.de/faqpki -- Dipl.-Inform. Reimer Karlsen-Masur (PKI Team), Phone +49 40 808077-615 DFN-CERT Services GmbH, https://www.dfn-cert.de, Phone +49 40 808077-555 Sitz / Register: Hamburg, AG Hamburg, HRB 88805, Ust-IdNr.: DE 232129737

2 3

re: configuration
by parfait kouassi nda 20 Apr '07

20 Apr '07

my last coonfiguration of these files is: radiusd.conf proxy_request = yes proxy.conf realm gie.local { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = araignee.gie.local:1812 accthost = araignee.gie.local:1813 secret = parfait nostrip } Clients.conf client 192.168.0.2 { secret = parfait shortname = araignee.gie.local } when i do configuration in all flies my freeradius reject my packets! this is the show of radiusd -X! Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "nobody" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 0 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.3.1:1812, id=19, length=130 NAS-IP-Address = 192.168.3.1 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "picasso(a)gie.local" Calling-Station-Id = "00-A0-C9-DE-7A-FE" Service-Type = Framed-User Framed-MTU = 1000 EAP-Message = 0x02020016017069636173736f406769652e6c6f63616c Message-Authenticator = 0x5aa9378c210f3cc9896ff7a4742bce77 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_realm: Looking up realm "gie.local" for User-Name = "picasso(a)gie.local" rlm_realm: Found realm "gie.local" rlm_realm: Proxying request from user picasso to realm gie.local rlm_realm: Adding Realm = "gie.local" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 19 to 192.168.3.1 port 1812 EAP-Message = 0x01030016041014292e9e4d0f780980b96f3ad2459504 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x020f058ccb95cbc717c1bb0f624b681b Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.3.1:1812, id=20, length=165 NAS-IP-Address = 192.168.3.1 NAS-Port = 50001 NAS-Port-Type = Ethernet User-Name = "picasso(a)gie.local" Calling-Station-Id = "00-A0-C9-DE-7A-FE" Service-Type = Framed-User Framed-MTU = 1000 State = 0x020f058ccb95cbc717c1bb0f624b681b EAP-Message = 0x020300270410e10ab8e5381c81c7806d8dbe102936fa7069636173736f406769652e6c6f63616c Message-Authenticator = 0xd4268d3dbb7397a0ff40d4c74b040f9d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_realm: Looking up realm "gie.local" for User-Name = "picasso(a)gie.local" rlm_realm: Found realm "gie.local" rlm_realm: Proxying request from user picasso to realm gie.local rlm_realm: Adding Realm = "gie.local" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 39 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: leaving group authenticate (returns invalid) for request 1 auth: Failed to validate the user. Login incorrect: [picasso(a)gie.local/<no User-Password attribute>] (from client Switch port 50001 cli 00-A0-C9-DE-7A-FE) Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.3.1:1812, id=20, length=165 Sending Access-Reject of id 20 to 192.168.3.1 port 1812 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 19 with timestamp 46288d79 Cleaning up request 1 ID 20 with timestamp 46288d79 Nothing to do. Sleeping until we see a request. _________________________________________________________________ MSN Hotmail : créez votre adresse e-mail gratuite & à vie ! http://www.msn.fr/newhotmail/Default.asp?Ath=f

3 2

server crashes with eap/tls after crl update
by Fiederling, Daniel 20 Apr '07

20 Apr '07

Hello, this week I updated to freeradius 1.1.6. We use eap/tls with a crl from a Microsoft CA, which is downloaded and converted by a shell script every hour or has to be updated manually. If it changes, I have to reload the server config, right? Since the update the server crashes with a seg fault about a minute after the config reload - but only if the crl changed. For now I changed the reload (SIGHUP) to a complete restart as a work around. Before we used freeradius 1.1.4. --- debug info --- # ./radiusd -X ... --- Walking the entire request list --- Nothing to do. Sleeping until we see a request. Reloading configuration files. reread_config: reading radiusd.conf Config: including file: /opt/freeradius/etc/raddb/proxy.conf Config: including file: /opt/freeradius/etc/raddb/clients.conf Config: including file: /opt/freeradius/etc/raddb/snmp.conf Config: including file: /opt/freeradius/etc/raddb/eap.conf Config: including file: /opt/freeradius/etc/raddb/sql.conf main: prefix = "/opt/freeradius" main: localstatedir = "/opt/freeradius/var" main: logdir = "/opt/freeradius/var/log/radius" main: libdir = "/opt/freeradius/lib" main: radacctdir = "/opt/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/opt/freeradius/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = no main: pidfile = "/opt/freeradius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/opt/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms Thu Apr 19 19:07:23 2007 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Apr 19 19:07:23 2007 : Error: radiusd.conf[1683] Auth-Type PAP already configured - skipping Thu Apr 19 19:07:23 2007 : Error: radiusd.conf[1692] Auth-Type CHAP already configured - skipping Thu Apr 19 19:07:23 2007 : Error: radiusd.conf[1698] Auth-Type MS-CHAP already configured - skipping Thu Apr 19 19:07:23 2007 : Info: radiusd.conf Auth-Type System already configured - skipping Thu Apr 19 19:07:23 2007 : Info: rlm_eap_tls: Loading the certificate file as a chain Thu Apr 19 19:07:24 2007 : Info: radiusd.conf Auth-Type eap already configured - skipping Thu Apr 19 19:07:24 2007 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Thu Apr 19 19:07:24 2007 : Info: rlm_sql (sql): Attempting to connect to XXXremovedXXX Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Thu Apr 19 19:07:24 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Thu Apr 19 19:07:24 2007 : Info: Ready to process requests. Segmentation fault --- debug info --- Does anyone have the same problem? Thanks! bye Daniel

3 3

SQL Accounting problem with 1.0.3 - The maximum number of threads (32) are active
by Rick Macdougall 20 Apr '07

20 Apr '07

Hi, We seem to be having the "The maximum number of threads (32) are active" with Freeradius 1.0.3. Version 1.0.1 works just fine. I tried to do a valgrind with -xxxx but when radiusd displays that message, you can no longer kill it. I have the debug output from the -xxxx and it shows the accounting processes running, adding info and completing but the thread doesn't seem to release. Example Tue Apr 17 09:49:57 2007 : Debug: rlm_sql (sql1): Reserving sql socket id: 6 Tue Apr 17 09:49:57 2007 : Debug: rlm_sql (sql1): Released sql socket id: 6 Tue Apr 17 09:49:57 2007 : Debug: modsingle[accounting]: returned from sql1 (rlm_sql) for request 48 Tue Apr 17 09:49:57 2007 : Debug: modcall[accounting]: module "sql1" returns ok for request 48 So it appears to be a problem with the mysql driver rather than a problem with a slow database query. Anything else I can provide ? Centos 4.3 Linux version 2.6.9-42.0.10.ELsmp 512 meg of ram Conntecting to a remote DB server over a dedicated gig network running MySQL 5.x Intel(R) Pentium(R) 4 CPU 3.20GHz with hyperthreading enabled. Regards, Rick

3 16

Radclient , -c flag = radclient.c:492: failed assertion `radclient->reply == NULL'
by Arran Cudbard-Bell 20 Apr '07

20 Apr '07

Hi, Radclient works fine with almost every except when you use the -c flag to specify that multiple copies of the same packet are sent. --- ./radclient -c 10 -x -f user radius1.susx.ac.uk auth xxxxxxx Sending Access-Request of id 205 to 139.184.14.180 port 1812 User-Name = "ac221" User-Password = "xxxx" rad_recv: Access-Accept packet from host 139.184.14.180 port 1812, id=205, length=20 radclient.c:492: failed assertion `radclient->reply == NULL' Was looking forward to doing some crude benchmarking :( Apart from that all seems well and good. Haven't noticed radiusd dieing at random intervals or any other weirdness. Back ticks work for sql xlat like you said, and there is indeed a reference in the attributes documentation. :) Just acquired a copy of THE C PROGRAMMING LANGUAGE Second edition, which I am assured is the best book for learning C. So you might actually see bug fixes some time soon instead of just bug reports ;) -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

Grouping after Kerberos 5 authentication accepted?
by Jason Chan 19 Apr '07

19 Apr '07

Hello, Is it possible for FreeRadius to perform grouping after Kerberos authentication accepted? My company has many switches and servers and we use kerberos 5 for RADIUS authentication. Once the user is authenticated, RADIUS will check and decide if this user can access the switches or particular servers (i.e. Allow telnet to the switch if the user belongs to the 'switch administrator' group). I've looked in the huntgroup file but it seems to require a lot of works for a very large company (5000+ users), and the problem is we can't touch the Kerberos server. Any help would be appreciated. Thank you Regards, Jason

3 4

Crypt passwords doesn't work
by Sebastian Firpo 19 Apr '07

19 Apr '07

Hi, I migrated a freeradius server from version 0.6 to 1.5. I'm using a users file for authorize. The server don't authorize and when a do a debug (radiusd -X) I saw the User-password in clear text. If I modify the User-password in the users file by the clear text one it works. Here are the debug and an entry of the users file: Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.12.4.2:1645, id=91, length=75 NAS-IP-Address = 10.12.4.2 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "sebas" Calling-Station-Id = "10.11.1.25" User-Password = "hello" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry sebas at line 50 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 0 for 1 seconds users file sebas Auth-Type := Local, Crypt-Password == "(!lGOOlHaBWoQ" Service-Type = Administrative-User, Cisco-AVPair = "shell:priv-lvl=15" Thanks very much!!

4 8

Motorola Authenitcation
by Matthew Neumark 19 Apr '07

19 Apr '07

FreeRADIUS Users/Developers, Does anyone use RADIUS to authenticate Motorola SM's? If so, I'm needing some information on how to accomplish this. Thank You In Advanced!, Matt Neumark

1 0

snmp accounting/statistic queries
by Milan Holub 19 Apr '07

19 Apr '07

Hi Alan, snmp querying works great now. Thanks for that! However I've tried also to query some MIBS from RADIUS-ACC-SERVER-MIB.txt or RADIUS-STAT-MIB.txt files and it looks like freeradius does not react on it at all(no DEBUG activity with -X). (cvs head) Working query (using MIBs from RADIUS-AUTH-SERVER-MIB.txt) example: `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-AUTH-SERVER-MIB.txt -c verysecret localhost radiusAuthServUpTime` Not working queries(examples) `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-ACC-SERVER-MIB.txt -c verysecret localhost radiusAccServUpTime` `snmpwalk -Cc -v 1 -m /devel/freeradius/cvs/work/mibs/RADIUS-STAT-MIB.txt -c verysecret localhost radiusStatUpTime` I remember all MIBs worked a week before or so... Milan Holub holub (at) thenet (dot) ch -------------------------------------- TheNet-Internet Services AG, im Bernertechnopark, Morgenstr. 129 CH-3018, Bern, Switzerland 031 998 4333, Fax 031 998 4330 http://www.thenet.ch http://wlan.thenet.ch --------------------------------------

2 3

how to configure
by parfait nda 19 Apr '07

19 Apr '07

i need to configure my freeradius server in proxy server to use it with windows IAS! i want the configuration of the files of freeradius which can permit me to do that! my last coonfiguration of these files is: radiusd.conf proxy_request = yes proxy.conf realm gie.local { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = araignee.gie.local:1812 accthost = araignee.gie.local:1813 secret = parfait nostrip } Clients.conf client 192.168.0.2 { secret = parfait shortname = araignee.gie.local } thanks for your help! _________________________________________________________________ Windows Live Spaces : créez votre blog à votre image ! http://www.windowslive.fr/spaces

3 3