- Freeradius-Users - lists.freeradius.org

New to FreeRadius, having a small issue
by Marc Hultquist 20 Feb '07

20 Feb '07

Hey Everyone, I am new to freeradius, and when receiving a auth request to the server, in the /var/log/radius/radiusd.log file, I get the following line whenever the auth request comes though. ---- Mon Feb 19 12:29:46 2007 : Error: Invalid operator for item User-Password: reverting to '==' ---- If anyone could point me in the direction of a document or manual on how i could fix this, would be appretiated, i checked the man pages but dont see anything specific there towards my problem, and well to be honest I just dont seem to be able to find a relevant document for FreeRadius on this error. Any help would be appretiated. Kind Regards - Marc

2 3

FreeRADIUS + LVS problem
by Sam Schultz 20 Feb '07

20 Feb '07

According to my research, FreeRADIUS supposedly does work from behind an LVS load balancer. My current configuration works perfectly outside of the LVS, but once it is put behind the LVS it ceases to work. Connections seem to succeed even behind the LVS, until they get to an access challenge, where I get: rad_recv: Access-Challenge packet from host 192.168.240.111:5058, id=42, length=64 Authentication reply packet code 11 sent to a non- proxy reply port from client WPA_Test:5058 - ID 42 : IGNORED >From what little information I could find on this, it looks like the freeradius thinks these are proxied requests due to ip mangling done by the LVS load balancer (Basically, it's a 1:1 NAT). Has anyone come across anything like this? Any pointers for work- arounds would definitely be appreciated. P.S. Alan, I would definitely think this (LVS + FreeRADIUS) would be a good topic for your book -- Click for free info on adult education and start making $150k/ year http://tagline.hushmail.com/fc/CAaCXv1S62Uaoe8eWguezq8EENBamjiB/

4 12

Accounting with pam_radius_auth
by Christophe Boyanique 20 Feb '07

20 Feb '07

Hello, I found in the archive that pam_radius questions can be asked here so here is mine: I am using pam_radius_auth to authenticate and do some accounting against a freeradius+ldaps server (which works perfectly). Everything (authorization, authentication and accounting) work perfectly except accounting in some cases. Configuration uses pam_radius_auth 1.3.16. Here is an example pam configfile (/etc/pam.d/su): -- cut -- auth sufficient /lib/security/$ISA/pam_rootok.so auth required /lib/security/$ISA/pam_env.so auth sufficient /lib/security/$ISA/pam_unix.so likeauth nullok auth sufficient /lib/security/pam_radius_auth.so try_first_pass debug auth required /lib/security/$ISA/pam_deny.so account sufficient /lib/security/pam_radius_auth.so debug account sufficient /lib/security/$ISA/pam_unix.so account sufficient /lib/security/$ISA/pam_succeed_if.so uid<100 quiet account required /lib/security/$ISA/pam_permit.so password requisite /lib/security/$ISA/pam_cracklib.so retry=3 password sufficient /lib/security/$ISA/pam_unix.so nullok use_authok md5 shadow password required /lib/security/$ISA/pam_deny.so #session required /lib/security/$ISA/pam_selinux.so close #session required /lib/security/$ISA/pam_limits.so session sufficient /lib/security/pam_radius_auth.so debug session sufficient /lib/security/$ISA/pam_unix.so #session sufficient /lib/security/$ISA/pam_selinux.so open multiple #session optional /lib/security/$ISA/pam_xauth.so -- cut -- In fact the main problem is if I su to an unprivileged user, no accounting packet is sent and output displays: su: pam_radius_auth: Could not open configuration file /etc/raddb/server: Permission denid If I su to root user, then accounting packet is correctly sent. I suppose that session part of pam runs as unprivilegied user and it can't open the /etc/raddb/server which is protected as advised in the documentation. I tried with and without commented lines in the session parts without success. Is this a common problem (I found nothing in the archive) or do I have a mistake in the pam configuration ? Regards, Christophe.

2 2

Number of requests from given client
by Pshem Kowalczyk 20 Feb '07

20 Feb '07

Hi, We run a farm of radius proxies for many different customers (wholesale of services), our devices send requests to the proxies, which in turn send them to the proper backend systems. Number of requests doesn't usually exceed 40-60 a sec, however if one of the client devices gets restarted (or simply crashes) the limit of requests (8192) gets depleted very quickly and proxies start dropping requests from all of the clients, sometimes the backend system of given customer gets overwhelmed which causes additional problems. Is there a way of setting the number of requests on per-client basis, so a single device can't use up whole pool? Of course I can increase the total number of request even further but that only postpones the problem. kind regards pshem

2 3

Fw: Attribute Max-Daily-Session + Session-Timeout
by Abel Monzón 20 Feb '07

20 Feb '07

No body know what is the solution? I send this e-mail, and nothing of answer. Good Day From: Abel Monzón To: mailist Sent: Monday, February 19, 2007 2:04 AM Subject: Attribute Max-Daily-Session + Session-Timeout Hello List. I have a problem. I had limited the Max-Daily-Session = 120, and the Session-Timeout = 60. The Session-Timeout work, but the Max-Daily-Session don't. because the Session-Timeout log out the user, but de Max-Daily-Session don't and let log in again. I have this in my radiusd.conf: sqlcounter contdiario { counter-name = Daily-Session-Time check-name = Max-Daily-Session sqlmod-inst = sql key = User-Name reset = daily count-attribute = Max-Daily-Session query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } authorize { .... contdiario ..... } Any help? Thanks

2 3

EAP-MD5 test
by Amin BEN ABDALLAH 20 Feb '07

20 Feb '07

I am a new user of Radius Server and I want to know how to test the authentification of an EAP-MD5 user using radtest, radclient or radeapclient. users file : ___________________________________________________________________ ali Auth-Type := EAP, User-Password == "ali" Reply-Message = "success" ___________________________________________________________________ The test : ___________________________________________________________________ echo "User-Name = ali, EAP-MD5-Password = ali" | radeapclient 127.0.0.1 auth testing123 ___________________________________________________________________ the result of the test is Access-Reject ___________________________________________________________________ Sending Access-Reject of id 133 to 127.0.0.1 port 32905 Reply-Message = "success" ___________________________________________________________________ Thanks in advance Amin BEN ABDALLAH

3 2

1.1.4 - TTLS - missing attributes
by Bjarni Hardarson 20 Feb '07

20 Feb '07

Hi list! Recently upgraded from 1.1.3 to 1.1.4 to support EAP-PEAP for Windows Vista clients. That works fine but now I got problems with missing reply attributes for Mac OSX clients using EAP-TTLS. FreeRADIUS sends an Access-Challenge with the correct attributes but they are missing from the final Access-Accept. If I use eapol_test client it works fine. I used the freeradius.spec file for Suse to build the server. The file is for 1.1.3. I simply changed the version number to 1.1.4. Here is the debug output from OSX. -------------- modcall: leaving group post-auth (returns ok) for request 5 TTLS: Got tunneled reply RADIUS code 2 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "315" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-CHAP2-Success = 0xe9533d34313632353645463239384442354536433344363845364130414132374337423333373433324531 MS-MPPE-Recv-Key = 0x2f1c2a0924281f7543ac01a62e5d4959 MS-MPPE-Send-Key = 0x54b7f78adaa581dcbe24933210de2944 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 TTLS: Got tunneled Access-Accept TTLS: Got MS-CHAP2-Success, tunneling it to the client in a challenge. modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 57 to 172.20.16.14 port 1645 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "315" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-MPPE-Recv-Key = 0x2f1c2a0924281f7543ac01a62e5d4959 MS-MPPE-Send-Key = 0x54b7f78adaa581dcbe24933210de2944 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 EAP-Message = 0x0140005f15800000005517030100501cc3ec5991b8db1c9fa0b2a8738e13a3adafa3d12aad4719582298263fd36dd9e40a95a7b92783655681e701373871336737a7ea70a9a07ea8a015dc51b734e3700b71dc22b33bc6686f23efc7bfeba8 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd1d25d75fcc645729434631403c3dd5a Finished request 5 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.20.16.14:1645, id=58, length=142 NAS-IP-Address = 172.20.16.14 NAS-Port = 50632 NAS-Port-Type = Ethernet User-Name = "XXXXXXX" Called-Station-Id = "00-03-6B-BE-25-8F" Calling-Station-Id = "00-14-51-2E-6C-50" Service-Type = Framed-User Framed-MTU = 1500 State = 0xd1d25d75fcc645729434631403c3dd5a EAP-Message = 0x024000061500 Message-Authenticator = 0x2d5e6aadce0ad3a0eb864bc26e9271f9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 rlm_realm: No '@' in User-Name = "XXXXXXX", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 64 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 modcall[authorize]: module "mschap" returns noop for request 6 modcall[authorize]: module "files" returns notfound for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 6 modcall: leaving group authenticate (returns ok) for request 6 Login OK: [XXXXXXX/<no User-Password attribute>] (from client SITEALAN port 50632 cli 00-14-51-2E-6C-50) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 6 modcall[post-auth]: module "LDAP1LAN" returns noop for request 6 modcall[post-auth]: module "LDAP2LAN" returns noop for request 6 modcall[post-auth]: module "LDAP1AIR" returns noop for request 6 modcall[post-auth]: module "LDAP2AIR" returns noop for request 6 modcall[post-auth]: module "LDAP1VPN" returns noop for request 6 modcall[post-auth]: module "LDAP2VPN" returns noop for request 6 modcall: leaving group post-auth (returns noop) for request 6 Sending Access-Accept of id 58 to 172.20.16.14 port 1645 MS-MPPE-Recv-Key = 0x3e5ac1123d8312388fd89060503bbc0111586573e9b05e0166f4b738ef11db5a MS-MPPE-Send-Key = 0x68dce1376add4161d31704257ac1d5d9e891b1905e62064647c2216b53454986 EAP-Message = 0x03400004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "XXXXXXX" Finished request 6 ----------------------- Here is the debug output from eapol_test. -------------- modcall: leaving group post-auth (returns ok) for request 5 TTLS: Got tunneled reply RADIUS code 2 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "328" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-CHAP-MPPE-Keys = 0x79b109dec67d52c6b969bc2f0b8a40a4f2df16f387f6ee980000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 5 modcall: leaving group authenticate (returns ok) for request 5 Login OK: [anon/<no User-Password attribute>] (from client localhost port 0 cli 00-00-00-00-00-02) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 5 modcall[post-auth]: module "LDAP1LAN" returns noop for request 5 modcall[post-auth]: module "LDAP2LAN" returns noop for request 5 modcall[post-auth]: module "LDAP1AIR" returns noop for request 5 modcall[post-auth]: module "LDAP2AIR" returns noop for request 5 modcall[post-auth]: module "LDAP1VPN" returns noop for request 5 modcall[post-auth]: module "LDAP2VPN" returns noop for request 5 modcall: leaving group post-auth (returns noop) for request 5 Sending Access-Accept of id 5 to 127.0.0.1 port 32777 User-Name = "XXXXXXX" Tunnel-Private-Group-Id:0 = "328" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-CHAP-MPPE-Keys = 0x79b109dec67d52c6b969bc2f0b8a40a4f2df16f387f6ee980000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Recv-Key = 0xa74558be21dd80fe6f406921c6e2aa367e840ac12405c4ab86adf7fa48c4effa MS-MPPE-Send-Key = 0x9901fdcc0f86e0091f1a16795ff2a480b99d28b46094b557cae32f81bb4b16e2 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5 ------------------- /etc/raddb/eap.conf -------------- eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = *************** private_key_file = ${raddbdir}/certs/server_key.pem certificate_file = ${raddbdir}/certs/server_cert.pem CA_file = ${raddbdir}/certs/rootcert.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random } ttls { default_eap_type = mschapv2 use_tunneled_reply = yes copy_request_to_tunnel = yes } mschapv2 { } peap { default_eap_type = mschapv2 use_tunneled_reply = yes copy_request_to_tunnel = yes } mschapv2 { } } -------------- /etc/raddb/users -------------- DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = "%{User-Name}", Fall-Through = Yes DEFAULT Huntgroup-name == "LAN", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := LAN DEFAULT Huntgroup-name == "AIR", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := AIR DEFAULT Huntgroup-Name == "VPN", Autz-Type := VPN, Auth-Type := Local -------------- regards/mvh Bjarni Hardarson

6 14

Re: The EAP Saga begins.
by Evan Vittitow 20 Feb '07

20 Feb '07

[CONFIG] Socket 4 (frame handler) had an event! Network ID from EAP hint : Pukey If this is a wired network, the above ID can be used in the configuration file to identify this network. [CONFIG] Working from config file /etc/xsupplicant.conf. Network ID from EAP hint : Pukey If this is a wired network, the above ID can be used in the configuration file to identify this network. [CONFIG] Working from config file /etc/xsupplicant.conf. [CONFIG] Identity : User [CONFIG] Socket 4 (frame handler) had an event! [CONFIG] Trying to load root certificate /etc/raddb/certs/cert-clt.pem or certificate directory (null) [CONFIG] Loaded root certificate /etc/raddb/certs/cert-clt.pem and directory (null) [CONFIG] Socket 4 (frame handler) had an event! OpenSSL Error -- error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed This is xsupplicant's output. ukey { type = wireless allow_types = eap_peap identity = User eap-peap { random_file = /dev/urandom root_cert = /etc/raddb/certs/cert-clt.pem chunk_size = 1398 allow_types = eap_mschapv2 eap-mschapv2 { username = User password = password } } } I changed the Username and password.

4 20

freeradius 1.1.4 + LDAP + PEAP/mschapv2
by Baptiste Delporte 19 Feb '07

19 Feb '07

Hi all ! After installing Freeradius 1.1.4, I am trying to set it up to authenticate users with a LDAP database using PEAP + eap/mschapv2. Freeradius seems to work fine for most users, but for a few people I get this error in my log file : /Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Length Included Mon Feb 19 09:30:07 2007 : Error: TLS_accept:error in SSLv3 read client certificate A Mon Feb 19 09:30:07 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Length Included Mon Feb 19 09:30:07 2007 : Info: (other): SSL negotiation finished successfully Mon Feb 19 09:30:07 2007 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Mon Feb 19 09:30:07 2007 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon Feb 19 09:30:07 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Mon Feb 19 09:30:08 2007 : Error: rlm_mschap: Invalid LM-Password Mon Feb 19 09:30:08 2007 : Error: rlm_mschap: Invalid NT-Password Mon Feb 19 09:30:08 2007 : Auth: Login incorrect: [********] /Authentication works perfectly with the same config files (eap.conf, radiusd.conf,users...) with an older version (1.0.1 and even 1.1.3) of freeradius on the same server. I've made tests with EAP-TTLS, and in that case authentication also works fine for everyone. In both cases, I get this line when I run freeradius in debug mode : /rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. /And I can't find if there's a link between that warning and the authentication failure for some of my users. Thanks for your help. -- Ce message a été vérifié par MailScanner pour des virus ou des polluriels et rien de suspect n'a été trouvé. MailScanner remercie transtec pour son soutien.

2 1

FreeRadius + MySQL - Crypt-Passwrd in radcheck table
by Nataniel Klug 19 Feb '07

19 Feb '07

Hello people, I am using freeradius-1.0.1-3.RHEL4.3 and freeradius-mysql-1.0.1-3.RHEL4.3 on a CentOS 4.4 server but I am sutcked into a problem. I have made my FreeRadius works great using MySQL but I could not make it uses Crypt-Password. Into radcheck table I have: mysql> SELECT * FROM radcheck; +----+----------+----------------+----+----------------------------------+ | id | UserName | Attribute | op | Value | +----+----------+----------------+----+----------------------------------+ | 1 | teste | Crypt-Password | == | 42cbf4730aeac1d645324d4818104826 | +----+----------+----------------+----+----------------------------------+ 1 row in set (0.00 sec) The password was encrypted using PHP MD5 command and should be 8872. But when I use a radtest command the respose of my Radius is: Sun Feb 18 17:23:56 2007 : Auth: Login incorrect: [teste/8872] (from client localhost port 1812) I made the same in debug mode and radius just not get the password. I think it is not testing the 8872 password to see if it matches de MD5 crypt. I tryed with "42cbf4730aeac1d645324d4818104826" as a password and it returned OK for the request. How can I do this work? I need that into MySQL table I have a crypted password (for security reasons) and I need that my clients can put a simple text password. Can someone give me a hit? -- Att, NATANIEL KLUG nata(a)cnett.com.br Cyber Nett - Internet Banda Larga www.cnett.com.br (42) 3635-2957 Rua Diogo Pinto, 1046, Centro Laranjeiras do Sul - PR Brasil - 85301-290

2 3