- Freeradius-Users - lists.freeradius.org

IP Pool management and Re-authentication
by Thibault Le Meur 22 Mar '07

22 Mar '07

Hi, I'm using a system (openvpn) with 'radiusplugin' to let FR authenticate users and manage IP Pools. Openvpn sometimes needs to renegotiate the connections and thus sends authentication requests while the connection is still active (with an already assigned IP address): this causes FR to assign a new IP address from the pool (which seems normal since FR has no way to know this is a renegotiation). I'd like to patch the openvpn-radiusplugin so that an extra attribute is sent in the Access-Accept packets so that FR will be able to differentiate Initial and Renegociation Access-Accept requests and only assign new IP address from the pool on Initial Access-Accept requests. Do you know a standard Radius attribute that could be used for this ? As far as you know, are there other NASes using such a quirk ? Does this make sense ? Thanks in advance, Thibault

3 9

Incomplete accounting sessions and IP pool resets
by Ramm-Ericson, Johannes 22 Mar '07

22 Mar '07

Hello Freeradius users! I have a recurring problem that I'm wondering if any of you have run into. I am currently running freeradius 1.1.4 (haven't had time to upgrade yet) on Suse Linux SLES 10 together with a Myql DB engine. I am using IP pools to supply users coming from various NAS:es with IP adresses. These IP pools seem to run out of IP adresses which is surprising given that I have more IP adresses than users for each NAS. Basically, new access requests don't get anywhere because there aren't any free IPs left. Once I stop freeradius, delete the ip pools and start freeradius again everything is fine. It is annoying however.... I suspect the problem may be related to the fact that some sessions do not recieve accounting session stop packets. This happens alot so currently I'm working around the issue by way of a cron jobb that deletes the IP pools and restarts freeradius every night - but this is a workaround and I really would like a better solution. Particularly since the problem creeps up in daily operations aswell. Also; I have no control over the NAS:es but I can discuss the issue with the NAS admins if i know what to look for! Does anyone have any suggestions / ideas / experiences with this sort of problem? Thanks and Best Regards, Johannes R-E

3 2

New Server Build
by Scott Hughes 22 Mar '07

22 Mar '07

Hello All, I am attempting to build a new and different FR server than I currently use. The new one is running the latest FR release and MySql. I am also running the dialup admin software. Before I attach a bunch of logs and eat up bandwidth, I want to make sure that I am testing correctly. When I run the radtest utility that comes with FR, I get an access-reject, even though the user is in the radius database. Running FR with the -X parameter, it does appear to be check the database. Am I testing correctly for this type of FR & MySQL setup? Thanks in advance, Scott

2 1

Res: EAP-TTLS + Post-auth clear password
by Erico Augusto 22 Mar '07

22 Mar '07

thanks joe, my pap's modules section is already as follows: pap { encryption_scheme = clear } I'm trying to forward username and password to my own app, using post-auth section, to perform user authentication, as described below ... is that possible? Erico. ----- Mensagem original ---- De: joe vieira <jvieira(a)clarku.edu> Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Quarta-feira, 21 de Março de 2007 17:17:18 Assunto: Re: EAP-TTLS + Post-auth clear password Erico Augusto wrote: > Hi, > > I would like to send clear-text password at post-auth using eap-ttls. > is there a way? > I'm avoiding to write a lot of details about the question. Just using > post-auth I got to send User-password attribute, but it's cyphered at > destination(Yes, there is all the TLS tunneling stuff, but I'm trying > to see the problem at a simpler-unknown perspective). > I'm using SecureW2 as supplicant(PAP), freeradius-1.1.2+jradius patch. i think by default pap is an md5 hash, you should be able to change that tho in the radiusd.conf (altho i could be totally insane.) in 1.1.4+ this looks to have changed to be auto negotiated. other people will know better than me but, i think this is accurate. Joe - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

2 1

freeradius radwho output >999
by satish patel 22 Mar '07

22 Mar '07

Dear 's I have useing freeradius-1.1.0 with mssql when i run radwho i have seen this optout #radwho mlpm482 mlpm482 PPP >999 Thu 10:11 192.168.1 10.100.13.205 mlpm636 mlpm636 PPP >999 Thu 11:31 192.168.1 10.100.14.178 so what is >999 this is error or somting else can anybody explain me what is this ?? $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

A request for your input.
by lmth＠deakin.edu.au 22 Mar '07

22 Mar '07

Hello My name is Lara Thynne and I am a PhD candidate at Deakin University Australia. I am currently researching the boundary between work and leisure activities directly related to the open source community and open source program development. As part of this I am running a survey at the following address. https://dcarf.deakin.edu.au/surveys/oss/ The survey is completely confidential and looks at your views and motivations to use Open Source software and to participate in the community. It will only take a five to ten minutes to complete and your contact details will not be recorded. You can withdraw your participation at any stage. I sincerely apologize for the spammish nature of this e-mail - I don't mean to abuse this list. I am trying to collect responses from as many open source developers and users as possible and a mailing list like can be the only way to reach many developers. Thanks again Lara P.S The program that I am using is open source, of course (www.phpsurveyor.org)

1 0

Re: Is anyone using dialup_admin with a PHP version newer than, 4.2.0?
by Arran Cudbard-Bell 21 Mar '07

21 Mar '07

> > Message: 4 > Date: Wed, 21 Mar 2007 15:33:11 -0400 > From: "Ethan Dicks" <ethan.dicks(a)gmail.com> > Subject: Is anyone using dialup_admin with a PHP version newer than > 4.2.0? > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <f4eb766f0703211233x1ece77b5if936c0dd76e2f38d(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hi, all, > > This is a refinement of my earlier request for information, honed > after half a week of trying to untangle things. > > I've been grubbing through all the code for dialup_admin 1.80 (from > the 20070320 CVS snapshot) and am entirely unconvinced that it works > with version of PHP newer than 4.2.0. I'm using PHP 4.3.0, since > that's what comes with RedHat Enterprise Linux 4. I've turned on > register_globals, but I can't get the dialup_admin code to stop > throwing warnings about variable names, etc. > > Let's take $login as an example. In config.php3, there's code to > scrub "bad" characters out of it, and to strip the realm if requested. > Unfortunately, in my environment, just going to the entry point of > the dialup_admin application results in... > > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 92, referer: > http://localhost/dialup/ > [client 127.0.0.1] PHP Notice: Undefined variable: login in > /usr/local/dialup_admin/conf/config.php3 on line 95, referer: > http://localhost/dialup/ > > (ignore the exact line numbers - they won't match the code in CVS > because I have some debugging stuff further up right now). > > I realize that this is a "notice" level message and that messages can > be turned off by twiddling error_reporting, but that's not the point - > the point is not simply that there are hundreds of these 'notices' > getting logged when I bounce around dialup_admin. The point is that > these notices are caused by PHP trying to "do the right thing" and > getting it wrong because the dialup_admin code is chock-a-block with > $login rather than the now-accepted practice of $_GET['login], and in > any case, because of how the URLs and PHP code interrelate, modules > like config.php3 aren't always called from other modules that were > invoked with a GET method with those exact elements, thus variables > like $login and $find_user and any other variables which appear to be > implicly created under older versions of PHP might or might not be > defined, but the code is written as if they are always defined, albeit > occasionally empty. > > I'm entirely willing to accept that I've missed a step in the > installation, but I did try to follow the steps in the TODO file and > don't believe I missed any. Do people just use the freeRADIUS server > and manipulate the user database manually? Are there any dialup_admin > users running on operating systems less than a year old? All I'm > really after is a user management GUI - I don't really care if it's > dialup_admin or not. If there's something that other people prefer, > I'd love to hear about it. > > In terms of getting this all going, I'm about to start forcing > variables to be something useful, as in... > > $login = ""; > $max_results = ""; > > if (!empty($_GET)) { > $login = $_GET['login']; > $max_results = $_GET['max_results']; > } > > ... just to quiet down the logged errors in the code so I can drill > down to why I can't click on "new user" and get a page that lets me > enter a new user. I'm also open to other suggestions to clean up the > dialup_admin code and get it up to snuff w.r.t. presently-shipping > versions of PHP. This will be an essential step to getting this code > running under php5, as all of these globalisms have been deprecated > because they lead to massive vulnerabilities. > > Thanks, > > -ethan > > You could try phpRadmin http://freshmeat.net/projects/phpradmin/ Still in alpha last time I checked but very pretty and featurefull gui :)

2 1

EAP-TTLS + Post-auth clear password
by Erico Augusto 21 Mar '07

21 Mar '07

Hi, I would like to send clear-text password at post-auth using eap-ttls. is there a way? I'm avoiding to write a lot of details about the question. Just using post-auth I got to send User-password attribute, but it's cyphered at destination(Yes, there is all the TLS tunneling stuff, but I'm trying to see the problem at a simpler-unknown perspective). I'm using SecureW2 as supplicant(PAP), freeradius-1.1.2+jradius patch. Thanks a lot. Erico. ----- Mensagem original ---- De: Nick Owen <nowen(a)wikidsystems.com> Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Enviadas: Quarta-feira, 21 de Março de 2007 16:45:43 Assunto: Re: Apache2 - PAM - freeRADIUS - users On 3/21/07, Helmut Tröbs <Helmut.Troebs(a)lrz-muenchen.de> wrote: > Hello Michael, > > >> > >> freeRADIUS works quite good and it's possible to authenticate via PAM, > >> for example local logins, ssh-logins, su, chsh, gdm, ... are working > >> quite fine. > >> > >> The only thing is the htaccess from apache2 which will not work. The > >> Radius gets the request and permits the user: > > > > I would suggest finding out why Apache is requiring more from PAM than > > everyone else does. It's not really a pam_radius problem, because it > > works with everything else. > > > > > we had similar problems with radius and Apache2 (it is not a RADIUS/PAM > problem!) PAM didn't work for us neither, so a colleague found another > radius module for Apache 2: > > http://www.outoforder.cc/projects/apache/mod_auth_xradius/ > > But it only works with Apache 2.0.x. With Apache 2.2.x we didn't manage > to get any radius authentication working. I got apache <-> radius working with mod_auth_xradius with apache-2.2.2 on FC6. a very basic how-to is here: http://www.howtoforge.com/apache_radius_two_factor_authentication hth. nick -- Nick Owen WiKID Systems, Inc. 404.962.8983 (desk) 404.542.9453 (cell) http://www.wikidsystems.com At last, two-factor authentication, without the hassle factor Now open source: http://sourceforge.net/projects/wikid-twofactor/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Fale com seus amigos de graça com o novo Yahoo! Messenger http://br.messenger.yahoo.com/

2 1

Problems with PAP, upgrading from 1.1.3
by Josh Endries 21 Mar '07

21 Mar '07

Hi everyone, I'm having a hell of a time upgrading from 1.1.3 to 1.1.4 due to PAP. First of all, leaving my settings as they are doesn't work at all. I'm beginning to wonder if my 1.1.3 configuration shouldn't work at all yet somehow magically does what I want it to. I currently (1.1.3) don't have a *-Password attribute. The table has a "password" field in it that I use in a crazy SQL query. It fakes a row with the "User-Password" attribute. The passwords are all SHA1 hashed. This is what happens when using the 1.1.3 config ("encryption_scheme = sha1"): rad_recv: Access-Request packet from host 192.168.0.10:54288, id=46, length=56 User-Name = "test" User-Password = "qwertyuiop1" NAS-IP-Address = 255.255.255.255 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' ... modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 1 rlm_pap: login attempt with password qwertyuiop1 rlm_pap: No password configured for the user. Cannot do authentication modcall[authenticate]: module "pap" returns fail for request 1 modcall: leaving group PAP (returns fail) for request 1 auth: Failed to validate the user. Login incorrect: [test] (from client localhost port 1) This is where I get lost, radiusd.conf: modules { pap { encryption_scheme = sha1 } ... } ... authorize { sql } authenticate { Auth-Type PAP { pap } } I know the rlm_pap man page talks about putting "pap" into authorize{}, so maybe that is what is preventing it from working, though it does seem to get to into rlm_pap above. Adding the header onto the password in the DB doesn't help (though I didn't expect it to). So at this point I tried making things the way they should be: modules { pap { # encryption_scheme = sha1 auto_header = yes } ... } Didn't work with non-prefixed password (duh). This is what I get after prepending "{sha1}" to the password: Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password qwertyuiop1 rlm_pap: Using clear text password. rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: leaving group PAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [test] (from client localhost port 1) Okay, so it didn't pick up the header, so I put pap into authorize{} after "sql" as the man page says and now I get: Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' ... modcall[authorize]: module "sql" returns ok for request 0 rlm_pap: Found unknown header {{sha1}}: Not doing anything rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt with password qwertyuiop1 rlm_pap: Using clear text password. rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: leaving group PAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [test] (from client localhost port 1) Now it says unknown header {{sha1}}. I dunno what this means, maybe it wasn't compiled correctly, or I'm specifying the header wrong? I have "{sha1}ar3h8ir4r4a3r..." in the field. I tried skipping this (according to my understanding of the man page) by changing User-Password to SHA1-Password, but that breaks my SQL driver: rlm_sql: Failed to create the pair: Unknown attribute "SHA1-Password" rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user I'm kinda lost now. I'm guessing that if the header was known, things would work, but for some reason it doesn't understand the "{sha1}" prefix... Thanks, Josh

1 1

Apache2 - PAM - freeRADIUS - users
by Michael Messner 21 Mar '07

21 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hey, freeRADIUS works quite good and it's possible to authenticate via PAM, for example local logins, ssh-logins, su, chsh, gdm, ... are working quite fine. The only thing is the htaccess from apache2 which will not work. The Radius gets the request and permits the user: rad_recv: Access-Request packet from host 127.0.0.1:11970, id=92, length=94 User-Name = "micmes" User-Password = "**********" NAS-IP-Address = 192.168.2.12 NAS-Identifier = "apache2" NAS-Port = 10945 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.2.103" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 68 modcall[authorize]: module "preprocess" returns ok for request 68 radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/auth-detail-20070321' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detai l-20070321 modcall[authorize]: module "auth_log" returns ok for request 68 modcall[authorize]: module "chap" returns noop for request 68 modcall[authorize]: module "mschap" returns noop for request 68 rlm_realm: No '@' in User-Name = "micmes", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 68 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 68 users: Matched entry micmes at line 250 modcall[authorize]: module "files" returns ok for request 68 modcall: leaving group authorize (returns ok) for request 68 auth: type Local auth: user supplied User-Password matches local User-Password radius_xlat: 'Hello, micmes' Login OK: [micmes/**********] (from client localhost port 10945 cli 192.168.2.103) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 68 radius_xlat: '/var/log/freeradius/radacct/127.0.0.1/reply-detail-20070321' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/reply-det ail-20070321 modcall[post-auth]: module "reply_log" returns ok for request 68 modcall: leaving group post-auth (returns ok) for request 68 Sending Access-Accept of id 92 to 127.0.0.1 port 11970 Filter-Id == "Enterasys:version=1:mgmt=su:policy=Admin-Policy" Reply-Message = "Hello, micmes" Finished request 68 Going to the next request - --- Walking the entire request list --- also pam gives me the message that the user is authenticated: Mar 21 00:07:07 debianmike apache2: pam_radius_auth: Got user name micmes Mar 21 00:07:07 debianmike apache2: pam_radius_auth: Sending RADIUS request code 1 Mar 21 00:07:07 debianmike apache2: pam_radius_auth: Got RADIUS response code 2 Mar 21 00:07:07 debianmike apache2: pam_radius_auth: authentication succeeded and the apache log gives me this last information: [Wed Mar 21 00:07:07 2007] [error] [client 192.168.2.103] PAM: user 'micmes' - invalid account: Authentication service cannot retrieve authentication info. my browser displays: Authorization Required This server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required. the .htaccess: cat /var/www/apache2-default/.htaccess AuthType "basic" AuthName "Radius Authentication" AuthPAM_Enabled on Require valid-user some information: freeradius -v freeradius: FreeRADIUS Version 1.1.4, for host i386-pc-linux-gnu, built on Feb 16 2007 at 21:35:11Copyright (C) 2000-2006 The FreeRADIUS server project.There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR APARTICULAR PURPOSE.You may redistribute copies of FreeRADIUS under the terms of theGNU General Public License.For more information about these matters, see the file named COPYRIGHT. apache2 -v Server version: Apache/2.0.54Server built: Jul 28 2006 09:04:55 libpam-radius-auth 1.3.16-3 on a debian stable with all patches any ideas whats going wrong? thanks for any help ca mIke -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (Darwin) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFGAGslyUY4xkIcFVQRAgA5AKDg64L+9T9zX/C2h9gB29xT6KV77gCgyYUo X4pCc64EWq4nO+QrOZwl8Ok= =0gqo -----END PGP SIGNATURE-----

4 3