- Freeradius-Users - lists.freeradius.org

Authentication Process/Flowchart
by Walt Reynolds 06 Mar '07

06 Mar '07

I have searched, but did not find what I was looking for, so trying to do my own flowchart of the process. Below is a written up flow that I want to try and convert to a graphical one. Can I please get some feedback on if this is not only the way it really works, but also if it is accurate. If someone has something like this I would be very grateful if you would pass it along to me. Just remember plagiarisms is the greatest form of flattery (I would give you credit either way if you wanted) Thanks. ======================================== 1. Request comes in (example) User-Name = "Guest2(a)location.com" User-Password = "Password" NAS-IP-Address = 192.168.224.36 Service-Type = Login-User Framed-IP-Address = 198.168.225.72 Called-Station-Id = "00:07:E9:D1:8F:C2" Calling-Station-Id = "00:40:96:a7:00:14" NAS-Identifier = "box.lab" Acct-Session-Id = "00:07:E9:D1:8F:C2:117165661771" NAS-Port-Type = Wireless-802.11 2. Looks in the authorize section of radius.conf ## authorize actually means is this request authorized to authenticate ##(does it match rules) preprocess ##This looks a the following files to add/coorelate ##the request to rules defined in later modules. huntgroups ##Matches based on NAS hints ##Matches on user auth_log ##This defines where the log will be suffix ##Defined as deliminater for proxying realms ## Finds realm (if listed, if so will be used ##starting in preproxy_users eap ##Set to define and perform EAP authentication (if in ##request) files ## Looks at the following files: users ##Used to decide how to AuthZ and AuthN ##users. Check items, if matched will ##add reply info to NAS ##if no specific match, will match ##DEFAULT ##User could move to acct_users ##Same as users file but for accounting. !!!***!!!If there is no realm defined at this part, it will preproxy_users ##Matches like users, but reply items ##added to proxied request to new NAS pre_proxy_log ##Allows you to log the pre-proxied ##request 3. Sent proxy request to radius server listed in proxy.conf if it did find a realm match (based on suffix/px.... 4. Receives reply a. Looks at post_proxy post_proxy_log ##Logs post proxy info if enabled attr_filter ##Allows you to filter what the proxied ##server sends back to NAS 5. Sends Accept/Deny to NAS (with all attributes added or filtered) 6. Accounting ---- -- Walt Reynolds Principle Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 2

Re: Freeradius-Users Digest, Vol 23, Issue 13
by Arran Cudbard-Bell 06 Mar '07

06 Mar '07

> Dana 5/3/2007, "Tim Tyler" <tyler(a)beloit.edu> pi?e: > >> Freeradius experts, >> I am trying to configure freeradius to use openldap as a backend >> for authentication, but I can't seem to get the passwords to >> authenticate. It seems to have no problem binding and finding the >> username (uid). I am using crypt passwords in the ldap userPassword field: >> userPassword:: e1NTSEF9aXBWQklEYnZYSU9RdWl2V0ZtdGR5MWxIWFFsZWVCMjQ= >> >> I am not using any radius attributes. I simply want to allow any >> uid to authenticate. I get these results: >> >> rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 >> User-Name = "tylertj" >> User-Password = "xxxxxx" >> NAS-IP-Address = 255.255.255.255 >> NAS-Port = 1812 >> rlm_ldap: - authorize >> rlm_ldap: performing user authorization for tylertj >> rlm_ldap: ldap_get_conn: Checking Id: 0 >> rlm_ldap: ldap_get_conn: Got Id: 0 >> rlm_ldap: (re)connect to ldap.beloit.edu:389, authentication 0 >> rlm_ldap: setting TLS CACert File to /etc/openldap/cacerts/cacert.cer >> rlm_ldap: starting TLS >> rlm_ldap: bind as / to ldap.beloit.edu:389 >> rlm_ldap: waiting for bind result ... >> rlm_ldap: Bind was successful >> rlm_ldap: looking for check items in directory... >> rlm_ldap: looking for reply items in directory... >> rlm_ldap: user tylertj authorized to use remote access >> rlm_ldap: ldap_release_conn: Release Id: 0 >> rad_recv: Access-Request packet from host 144.89.40.8:59881, id=60, length=59 >> Sending Access-Reject of id 60 to 144.89.40.8:59881 >> >> >> What might I be doing wrong? I presume that the ldap server >> doesn't have to store the passwords in plain text, correct? I can >> store them in md5 or SHA1 hash if I want, correct? I did uncomment: >> >> authenticate { >> Auth-Type LDAP { >> ldap >> } >> >> Am I wrong to think this is now a password issue? >> Tim >> >> >> >> >> >> Tim Tyler >> Network Engineer - Beloit College >> tyler(a)beloit.edu >> You need to prefix your crypt password with {crypt}, else LDAP won't know which hashing scheme your using, and when you attempt a v3 bind it'll treat your crypted password as plaintext. Also, in order to use crypted password you'll need a authentication mechanism that supports reversible encryption, like PAP or GTC. -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Unversity of Sussex | Infrastructure Services ++441273873900/ext:3900

1 0

Some problem
by zhangxianshi 06 Mar '07

06 Mar '07

Dear All, I use a Linux system called Ubuntu. Yesterday I tried to complier the freeradius 1.1.4. When I begun to make, there is something wrong. This is the error log: Making all in rlm_passwd... make[6]: Entering directory `/home/stone/freeradius-1.1.4/src/modules/rlm_passwd' make[6]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules/rlm_passwd' Making all in rlm_perl... make[6]: Entering directory `/home/stone/freeradius-1.1.4/src/modules/rlm_perl' /home/stone/freeradius-1.1.4/libtool --mode=link gcc -release 1.1.4 \ -module -export-dynamic -o rlm_perl.la \ -rpath /usr/local/lib rlm_perl.lo rlm_perl.c /home/stone/freeradius-1.1.4/src/lib/libradius.la \ `perl -MExtUtils::Embed -e ldopts` -lnsl -lresolv -lpthread *** Warning: Linking the shared library rlm_perl.la against the *** static library /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a is not portable! gcc -shared .libs/rlm_perl.o -Wl,--rpath -Wl,/home/stone/freeradius-1.1.4/src/lib/.libs -Wl,--rpath -Wl,/usr/local/lib /home/stone/freeradius-1.1.4/src/lib/.libs/libradius.so -L/usr/local/lib /usr/lib/perl/5.8/auto/DynaLoader/DynaLoader.a -L/usr/lib/perl/5.8/CORE -lperl -ldl -lm -lc -lcrypt -lnsl -lresolv -lpthread -Wl,-E -Wl,-soname -Wl,rlm_perl-1.1.4.so -o .libs/rlm_perl-1.1.4.so /usr/bin/ld: cannot find -lperl collect2: ld returned 1 exit status make[6]: *** [rlm_perl.la] Error 1 make[6]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules/rlm_perl' make[5]: *** [common] Error 2 make[5]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules' make[4]: *** [all] Error 2 make[4]: Leaving directory `/home/stone/freeradius-1.1.4/src/modules' make[3]: *** [common] Error 2 make[3]: Leaving directory `/home/stone/freeradius-1.1.4/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/home/stone/freeradius-1.1.4/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/home/stone/freeradius-1.1.4' make: *** [all] Error 2 How can I slove it? Regards Zhang

4 4

freeradius + mssql error
by satish patel 06 Mar '07

06 Mar '07

Dear I have useing freeradius with mssql and it was working fine but last day when i restrat radius server i got error like this '22018 [unixODBC][FreeTDS][SQL Server]Syntax error converting the datetime value '1900-01-01' to a column of data type int.' what is this ?? Satish Patel $ cat ~/satish/url.txt System administrator ( Data Center ) please visit this site http://linux.tulipit.com --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Upgrading 1.0.5 to 1.1.4
by Linda Pagillo 06 Mar '07

06 Mar '07

Hi everyone. I'm currently running FreeRadius verison 1.0.5 on a Linux Redhat 9 server. I need to upgrade my FreeRadius to the latest, greatest version 1.1.4. Awhile back i upgraded from 0.9.3 to 1.0.5, but for the life of me i can't remember how to do the upgrade without completely messing up my current configuration. Can anyone provide exact instructions on how to go from 1.0.5 to 1.1.4 without changing the config files? Thanks.

3 3

how to install n configure freeradius on suse 10.1
by Pojan Junior 06 Mar '07

06 Mar '07

hi, my name pojan. i have a problem about "how to install n configure freeradius on suse 10.1" and i want test the server freeradius with the Pc (Personal Comp) (LAN, Cross Cable). please help me!! thanx, Pojan --------------------------------- Any questions? Get answers on any topic at Yahoo! Answers. Try it now.

1 0

Re: one passwd to many users
by Sam Schultz 05 Mar '07

05 Mar '07

You could add an entry like "User-Password == <your_password_here>" to a default entry in freeradius' users file (/etc/raddb/users, usually), or do something similar using a group if you have some user accounts that will need to have different passwords. In that case, you'd need to use "Group == <your_group_name>" for each user entry that would use the shared password, and the group entry itself would contain the "User-Password == <your_password_here>" line. On Mon, 05 Mar 2007 12:38:53 -0500 Eddy Marcos Rebolledo Velez <emarcos(a)inutil.com.mx> wrote: >Hi > >I need to configure one password for many users, how can i do it? >because I want to change the passsword for example every week, but >not one by one > > >I have my freeradius with mysql > >regards > >Cordialmente > >Eddy Marcos Rebolledo >IT Support >Tel. Oficina (52) 1164 1178 >Tel. Home (52) 5380 9378 >Tel Movil 04455 5506 7823 >http://www.hoteldemexico.com -- Click to publish your book fast with high quality presses http://tagline.hushmail.com/fc/CAaCXv1IpqiCMyykA8Do4m7huQZvigqZ/

1 0

Login-Time
by Joseba Beltrán 05 Mar '07

05 Mar '07

Hi all, Im testing a new conf. using Login-Time. It works fine until I try to define 2 timespans for a day. For example if I define a new user, called "test" with this radcheck data: mysql> select * from radcheck where UserName='test'\G *************************** 1. row *************************** id: 320 UserName: test Attribute: Login-Time op: := Value: Mo0001-0940,Mo0952-2359 1 row in set (0.00 sec) I can login ok between the first timespan (00:01 to 09:40), but it's impossible during the second one (09:52 to 23:59). Maybe there is someting incorrect in the time string. Any help? All the best! Joseba

2 3

one passwd to many users
by Eddy Marcos Rebolledo Velez 05 Mar '07

05 Mar '07

Hi I need to configure one password for many users, how can i do it? because I want to change the passsword for example every week, but not one by one I have my freeradius with mysql regards Cordialmente Eddy Marcos Rebolledo IT Support Tel. Oficina (52) 1164 1178 Tel. Home (52) 5380 9378 Tel Movil 04455 5506 7823 http://www.hoteldemexico.com

1 0

guest acces?
by Matt Ashfield 05 Mar '07

05 Mar '07

Hi, I'm using EAP-TTLS-PAP aginst LDAP, however I want to provide guest access to users without adding these users to the LDAP directory. I know I could add them as local users to the /etc/raddb/users file, but that would involve a SIGHUP, and I'd prefer to avoid that if I could. Instead, what I'd like to do is create a user account on the radius server itself (with nologin, and an expiry, no rights, etc..). This could be done "on-the-fly" and therefore require no such SIGHUP. Now I know Alan does not recommend DEFAULT Auth-Type, but for here, I think it might be necessary. So in my users file, I added the following: DEFAULT Auth-Type := System Fall-Through = Yes Thinking that would allow my users who have accounts on the server to login. However, that is not working because in the logs in debug mode I see: Debug: modcall: group authorize returns ok for request 0 Debug: rad_check_password: Found Auth-Type System Debug: auth: type "System" Debug: ERROR: Unknown value specified for Auth-Type. Cannot perform requested action. Debug: auth: Failed to validate the user. I'm sure it's something small I'm missing, but can't find it. That or this is not possible and I'm missing the reason why for that too! Any advice is appreciated. Thanks Matt mda(a)unb.ca

2 4