- Freeradius-Users - lists.freeradius.org

VPN authentication from Windows Vista
by Lai Fu Keung 09 Feb '07

09 Feb '07

Hi, My users said the VPN login failed with their Windows Vista. I enabled freeradius debug. I came across an authentication method, md5chap in debug output that my freeradius is currently not configured to support. If the user unselects "Require Data Encryption" in VPN. It then works fine. Can anyone confirm the following questions for me? 1. Is it that Vista uses md5chap for VPN authentication with "Data Encryption"? 2. Can freeradius be configured to support md5chap? I don't get a lot of information about md5chap in google. I appreciate any pointers on this subject and how freeradius can be made to support it, as radiusd.conf seems no mentioning on this subject. Thanks. Lai

4 3

Setting up a VPN server with pptp and RADIUS for all sorts of clients
by robert 09 Feb '07

09 Feb '07

Hello, This is my First post on this mailing list, so sorry if I am in the wrong place!! I am having problems getting the Radius Serv to validate my VPN clients. Reading through the mail archives, I have found similar subjects, but the main difference I have is the fact that I don't have authority on the Radius Server. The main problem comes from my windows clients, I am trying to stick to the default Microsoft auth method (using ms-chap v2) to keep the client side as simple as possible. So I have set-up my pptp daemon, installed radiusclient, and have used the dictionary.microsoft from the sources of radiusclient. I must point out that authentication works using "User-Password" field (say if I am wrong, but this is a clear text password?) on 802.1X clients, and all Users in the LDAP base have a valid User-Password (but no NT/LM Passwords) The solutions I have come across until now tell me to use NT or LM password field and the problem is solved, but I can't change the layout, It has been set by "eduroam", who guides the project. So I must get my radius client to work with User-password, but I don't know where to start... A log sent from the Radius Admin shows that the mschap module fails to find User-Password (this is how I have understood it!) and refuses to validate the user. here is the part I am talking about: FROM Radius log: auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for dupontd with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. But I am sure that the field User password contains the valid password I am trying to use. Just in case, I shall post the dictionary.microsoft I am using: # # Microsoft's VSA's, from RFC 2548 # # $Id: dictionary.microsoft,v 1.1 2004/11/14 07:26:26 paulus Exp $ # VENDOR Microsoft 311 Microsoft ATTRIBUTE MS-CHAP-Response 1 string Microsoft ATTRIBUTE MS-CHAP-Error 2 string Microsoft ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft # This is referred to as both singular and plural in the RFC. # Plural seems to make more sense. ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft ATTRIBUTE MS-CHAP-Domain 10 string Microsoft ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft ATTRIBUTE MS-BAP-Usage 13 integer Microsoft ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft ATTRIBUTE MS-RAS-Version 18 string Microsoft ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft ATTRIBUTE MS-Filter 22 string Microsoft ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft ATTRIBUTE MS-CHAP2-Response 25 string Microsoft ATTRIBUTE MS-CHAP2-Success 26 string Microsoft ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft #ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft # # Integer Translations # # MS-BAP-Usage Values VALUE MS-BAP-Usage Not-Allowed 0 VALUE MS-BAP-Usage Allowed 1 VALUE MS-BAP-Usage Required 2 # MS-ARAP-Password-Change-Reason Values VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1 VALUE MS-ARAP-PW-Change-Reason Expired-Password 2 VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3 VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4 # MS-Acct-Auth-Type Values VALUE MS-Acct-Auth-Type PAP 1 VALUE MS-Acct-Auth-Type CHAP 2 VALUE MS-Acct-Auth-Type MS-CHAP-1 3 VALUE MS-Acct-Auth-Type MS-CHAP-2 4 VALUE MS-Acct-Auth-Type EAP 5 # MS-Acct-EAP-Type Values VALUE MS-Acct-EAP-Type MD5 4 VALUE MS-Acct-EAP-Type OTP 5 VALUE MS-Acct-EAP-Type Generic-Token-Card 6 VALUE MS-Acct-EAP-Type TLS 13 I have tried to expose my problem the best I can, but If you find that something is missing, don't hesitate! Thanks, Robert PS: using other protocols (PAP for exemple) works fine, but we need mschap support!

4 6

rlm_perl problem (Detaching!!)
by Rohaizam Abu Bakar 09 Feb '07

09 Feb '07

Hi.. FR: 1.1.2 FBSD: 6.0 My rlm_perl keep logging error as example below. Everytime this happen radiusd will hang and DO NOT respond to any request. But this NEVER happen while running in debug mode and working fine. rlm_perl is used to load timeout based on certain rules.. u can see below my perl script (newtimeou5.pl) and also config files setting. Please help TQ. Error /var/log/radius.log ################################################################################## Thu Feb 8 12:30:09 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout4.pl , func = authorize exit status= Undefined subroutine &main:: called. Thu Feb 8 12:32:00 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 12:39:46 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout4.pl , func = authorize exit status= panic: leave_scope inconsistency at /usr/local/etc/raddb/newtimeout4.pl line 184. Thu Feb 8 12:39:47 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:08:52 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:22:40 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:57:25 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Fri Feb 9 09:53:52 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = authorize exit status= Usage: Encode::is_utf8(sv, check = 0) at /usr/local/lib/perl5/site_perl/5.8.7/Convert/ASN1.pm line 422, <DATA> line 424. Fri Feb 9 10:21:59 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = authorize exit status= Undefined subroutine &Convert::ASN1::authorize called at /usr/local/lib/perl5/site_perl/5.8.7/Net/LDAP.pm line 759 Fri Feb 9 10:57:59 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = preacct exit status= Undefined subroutine &Convert::ASN1::preacct called at /usr/local/lib/perl5/site_perl/5.8.7/Net/LDAP.pm line 759 #################################################### ######################users############################ DEFAULT NAS-Identifier == "Wireless-802.11", Autz-Type := Y5, Auth-Type :Y5 ######################################################## #################radiusd.conf################################# authorize { Autz-Type Y5 { redundant { ldapy51 ldapy52 } y5perl } } modules { perl y5perl { module = /usr/local/etc/raddb/newtimeout5.pl } } authenticate { Auth-Type Y5 { redundant { ldapy51 ldapy52 } } } ########################################################## #######################newtimeout5.pl######################## sub authorize { ##main my $return_value = 0; $return_value = &timeout; print "VALUE return: $return_value\n"; if ($return_value eq '-1'){ return RLM_MODULE_REJECT; }else{ return RLM_MODULE_OK; } } sub timeout { my $query; my $query2; my $uid=$RAD_REQUEST{'User-Name'}; my $userfrom; my $userconnect=$RAD_REQUEST{'NAS-Identifier'}; my $timeout; ################################ if ($userconnect =~ /Wireless-802.11|WiFi/) { $query="Service"; $query2 = "TimeoutWIFI"; } if ($query){ $userfrom = ldapquery($uid,$query); if ($userfrom =~ /Y5PLAT|Y5GOLD/){ $userfrom = "WiFi-BTP"; }elsif ($userfrom =~ /^Y5$/){ $userfrom = "Wireless-802.11"; } if ($userconnect eq $userfrom){ print "rlm_perl: Local user.. No timeout.. Unlimited!!!\n"; return (1); }elsif ($userconnect ne $userfrom){ print "rlm_perl: Roaming user.. Timeout will be loaded !!\n"; $timeout = ldapquery($uid,$query2); print "rlm_perl: $query2:$timeout\n"; if (!$timeout){ return (-1); }else{ $RAD_REPLY{'Session-Timeout'} = $timeout; print "rlm_perl: NOT YET....\n"; return (1); } } }else{ print "rlm_perl: Not a wifi connection !!!\n"; return (1); } } sub ldapquery { my ( $uid, $query ) = @_; my $host = "xxxxxxxxxx"; my $value; my $baseDN = "ou=Y5,ou=AAA, ou=xxxxx, dc=xxxxx, dc=xxxx"; my $ldap = Net::LDAP->new( $host ) or die "$@"; my $mesg = $ldap->bind ; # an anonymous bind $mesg = $ldap->search( # perform a search base => $baseDN, filter => "(&(uid=$uid))" ); my $count = $mesg->count; if ($mesg->code) { return ("NULL"); } if ($count < 0 ){ return ("NULL"); }elsif ($count > 0){ for ( my $i = 0 ; $i < $count ; $i++ ) { my $entry = $mesg->entry ( $i ); my $data = $entry->dn; $value = $entry->get_value($query); } } $mesg = $ldap->unbind; return ($value); }

1 0

freeradius on eth1
by Cihan DEMİR 09 Feb '07

09 Feb '07

Hi, I am using the latest FreeRadius version on Redhat. I want to run FreeRadius on eth1 because it's gateway is different and it is directly connected to GSM operator. How can i configure it? Thanks in advance, Cihan. -------------------------------------------------------------------------------- Omsan'in sundugu hizmetleri nasil degerlendiriyorsunuz? Görüsleriniz bizim için degerli. Aldiginiz hizmetin beklentilerinizi ve ihtiyaçlarinizi ne ölçüde karsiladigi konusunda benimle irtibata geçebilir veya pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr veya innovate(a)omsan.com.tr adreslerine e-mail gönderebilirsiniz. How do you evaluate the services of Omsan? Your opinions are valuable for us. You can contact me or send an e-mail to , pazarlama(a)omsan.com.tr, musteridestek(a)omsan.com.tr or innovate(a)omsan.com.tr to inform us about the extent to which the services provided fulfill your expectations and needs. -------------------------------------------------------------------------------- Bu e-posta mesaji kisiye özel olup, gizli bilgiler içeriyor olabilir. Eger bu e-posta mesaji size yanlislikla ulasmissa, içerigini hiç bir sekilde kullanmayiniz ve ekli dosyalari açmayiniz. Bu durumda lütfen e-posta mesajini kullaniciya hemen geri gönderiniz ve tüm kopyalarini mesaj kutunuzdan siliniz. Bu e-posta mesaji, hiç bir sekilde, herhangi bir amaç için çogaltilamaz, yayinlanamaz ve para karsiligi satilamaz. Bu e-posta mesaji virüslere karsi anti-virüs sistemleri tarafindan taranmistir. Ancak yollayici, bu e-posta mesajinin - virüs koruma sistemleri ile kontrol ediliyor olsa bile - virüs içermedigini garanti etmez ve meydana gelebilecek zararlardan dogacak hiçbir sorumlulugu kabul etmez. This message is intended solely for the use of the individual or entity to whom it is addressed, and may contain confidential information. If you are not the intended recipient of this message or you receive this mail in error, you should refrain from making any use of the contents and from opening any attachment. In that case, please notify the sender immediately and return the message to the sender, then, delete and destroy all copies. This e-mail message, can not be copied, published or sold for any reason. This e-mail message has been swept by anti-virus systems for the presence of computer viruses. In doing so, however, sender cannot warrant that virus or other forms of data corruption may not be present and do not take any responsibility in any occurrence.

3 2

latest cvs - gdbm fatal: lseek error
by tzieleniewski 09 Feb '07

09 Feb '07

Hi!! I compiled the latest cvs version of freeradius and installed it as always. When I tried to run it by radiusd -X to check if everything was ok I got the following error which probably considered counter module (is it error or I missed something?): Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded counter counter: filename = "/home/radius/freeradius/raddb/db.daily" counter: key = "User-Name" counter: reset = "daily" counter: count-attribute = "Acct-Session-Time" counter: counter-name = "Daily-Session-Time" counter: check-name = "Max-Daily-Session" counter: reply-name = "Session-Timeout" counter: allowed-servicetype = "Framed-User" counter: cache-size = 5000 rlm_counter: Counter attribute Daily-Session-Time is number 1830 rlm_counter: Current Time: 1170980756 [2007-02-09 01:25:56], Next reset 1171062000 [2007-02-10 00:00:00] gdbm fatal: lseek error My radiusd.conf: instantiate { exec expr daily expiration logintime } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout allowed-servicetype = Framed-User cache-size = 5000 } bests -tomasz

1 0

SQL help from someone who groks c, please?
by Dan Mahoney, System Admin 08 Feb '07

08 Feb '07

Hey all... Disclaimer: If I should ask this on the devel list, let me know and I will. As I'm not qualified in the languages to be a developer, this seemed the more logical place. I'm decent with Radius but have just come to freeradius over Cistron...I'm still in the process of assimilating the "op" syntax, but that's not the problem, I think. That said, I figured out two possible ways to handle my previous question regarding advanced SQL auth (including multiple occurances of the same username with different check-items). What I need to know is which way it was "intended" to work (either one of my two thoughts here, or something entirely -- or even "what I want to do isn't possible".) Here's the thought (apologies if the tabs get messed up). a) The rows returned are parsed in order, just as if they were a users file, and something (perhaps a password entry or an op of ==) triggers the system that it's on the "next record". of b) The "id" field (which some of the docs say are unused) is used to "bind" multiple items having the same ID. i.e (citing my earlier example)... Jeremy nas-ip-address="the vpn server" password="x" Service-Type = "Framed-User" # Our switches, which we trust jeremy not to mess up Jeremy password = "y" Service-Type = "Admin-User" Jeremy nas-ip-address="a big powerful router" Service-Type = Reject If it's (a): Based on the standard values in the database, would this work: id username attribute value op 1 jeremy password X == 2 jeremy nas-ip-address "vpnsvr" := 3 jeremy password y == 4 jeremy password "z" == 5 jeremy nas-ip-address "router" := The problem I see with this one is that a) there's no easy way to keep your (presumably auto-increment) id field entries properly ordered. Also, line 4 above doesn't make sense -- there really ARE no check items that would work here. If line 4 above were deleted, it would instead match password=y, nas-ip-address=router (again, I may be missing something critical about operators and their signaling here). Also, based on this, you would have to then find which attributes in the reply table to ask, which could *possibly* be based on the id of the "password" attribute, but that's hardly normalized. If it's (b): id username attribute value op 1 jeremy password X == 1 jeremy nas-ip-address "vpnsvr" := 2 jeremy password y == 3 jeremy password "z" == 3 jeremy nas-ip-address "router" := This one implies you either have a keyless table (bad), or that there's another key value here, which isn't in the included schemas. It also implies that the server acutally LOOK AT the "id" value to know when to stop parsing. In this case your reply items would be pulling based on that "id" field, not the username at all (since in this case the username is not unique). /endif The assumption I worked with is: My knowledge of SQL is far better than my knowledge of the inner workings of freeradius-SQL. What I've done is I've had to hard code the NAS-IP address into my queries, coupled with some special tables to return the right values expected by certain network devices (for example), if it's a PDU, return the admin (or userlevel) service-type for those devices, if it's a switch, return the appropriate there -- even allowing our customers access to those PDU ports that they control, but this still isn't as flexible as an old-fashioned users file. In reality, I should be able to return ALL records related, and radius should pick up the differences in the check-items, instead of the query only returning a select few. This will make more sense if we decide we need to start checking more values than just the one. I've also had to UNION my queries together because employees and clients are in different tables (and I am only checking on employee access on some devices -- but this is also done through the SQL). I noticed, interestingly enough, that UNION works, but the semicolon does not (perhaps this is to prevent SQL injection?). As I am unable to grok the c, I can't be sure. I.e. at the moment there's about forty users, some of which have differing access than others, and there's no real radius "groups", since each person's needs are slightly different and vary based on what each person has been certified and tested on. Apologies for seeming long. If anyone has any ideas, let me know, please. I may be able to compensate someone for an hour or two of consultation time, if it gets the questions answered (please contact me off-list regarding this). -Dan -- --------Dan Mahoney-------- Techie, Sysadmin, WebGeek Gushi on efnet/undernet IRC ICQ: 13735144 AIM: LarpGM Site: http://www.gushi.org ---------------------------

4 9

Problem with the attribute "Message-Authenticator"
by yao guoxian 08 Feb '07

08 Feb '07

I write a program to send Access-request packet to the Radius server. The packet format is as follow: __________________________________________________________ | code = 1 | ID = 1 | Length = 73 ( 0x 00 49 ) | __________________________________________________________ | 16 bytes authenticator | __________________________________________________________ | user_name = "test" | __________________________________________________________ | chap_password | __________________________________________________________ | eap_message = "pdsicygx" | __________________________________________________________ | Message_authenticator | __________________________________________________________ The Message_authenticator is calculated as follow: Message_authenticator = HMAC-MD5 (code ,ID, Length,16 bytes Authenticator, user_name,chap_password,eap_message) , using the shared secret between NAS and radius server , in this case ,"testing123". While sending "chap" packets without the "eap_message" and "Message_authenticator" gets "Access request" , sending packets like above gets response from radius server as follow: rad_recv: Access-Request packet from host 202.117.7.223:1408, id=1, length=73 Received packet from 202.117.7.223 with invalid Message-Authenticator! (Shared secret is incorrect.) Server rejecting request 1. Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 1 to 202.117.7.223:1408 Segmentations of the "Radiusd -X " are as follow: ... Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap ... Can the "eap_message" attribute be set randomly, in my packets, "pdsicygx"? Is it right to calculate "Message_authenticator" as I did? Regards Guoxian

3 3

Radius brokes down during "Accounting Request"
by tzieleniewski 08 Feb '07

08 Feb '07

Hi! I am trying to use radius as the accounting server for Sip proxy. After i send the Accounting request to radius the radius server brokes down and informs about memory segmentation fault. Please point me what could be the reason for this. Here is the radius debug output: rad_recv: Accounting-Request packet from host 127.0.0.1 port 32825, id=88, length=463 SER-Attr = "" Acct-Session-Id = "69E969D9-A757-D5D1-477F-77FEF8DAA44D(a)192.168.1.2" Sip-To-Tag = "795669631" SER-From = "tomix <sip:tomix@tezet.no-ip.org:7060>;tag=795669631" SER-Flags = 12 SER-Original-Request-ID = "sip:tomix@tezet.no-ip.org" Sip-Method = "INVITE" Sip-Cseq = 51319 Sip-Translated-Request-ID = "sip:tomix@192.168.1.2:7060" Sip-Source-IP-Address = 192.168.1.2 Sip-From-Tag = "795669631" SER-To = "<sip:tomix@tezet.no-ip.org>;tag=795669631" SER-Digest-Username = "tomix" SER-Request-Timestamp = 1170882487 Calling-Station-Id = "sip:tomix@tezet.no-ip.org:7060" Sip-Source-Port = 7060 SER-Digest-Realm = "tezet.no-ip.org" Sip-Response-Code = 486 Called-Station-Id = "sip:tomix@tezet.no-ip.org" SER-Response-Timestamp = 1170882487 Acct-Status-Type = Failed Service-Type = IAPP-Register NAS-Port = 5060 Acct-Delay-Time = 0 NAS-IP-Address = 127.0.0.1 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 Naruszenie ochrony pamięci (translation -> memory segmentation fault) (when I commented out the preprocess module form the preacct it didn't broke down but still nothig was logged in the database) My radiusd.conf file look like this: preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } preacct { preprocess acct_unique suffix files } accounting { acc_req_log radutmp sql attr_filter.accounting_response }

3 7

Usage of Cleartext-Password
by Federico Giannici 08 Feb '07

08 Feb '07

I have just upgraded from 1.1.2. to 1.1.4. Now I tried to convert my custom authorization module to use the "Cleartext-Password" attribute instead of "User-Password" (my passwords are in clear-text). I simply replaced the following command at the end of the authorization routine of my module: pairadd( &request->config_items, pairmake("User-Password", password, T_OP_CMP_EQ) ); with: pairadd( &request->config_items, pairmake("Cleartext-Password", password, T_OP_CMP_EQ) ); But the daemon started to give "Login incorrect" errors (with no other error description), so I had to revert the change. What am I missing? Thanks. -- ___________________________________________________ __ |- giannici(a)neomedia.it |ederico Giannici http://www.neomedia.it ___________________________________________________

3 5

Nortel telnet authentication using FreeRadius
by Paul Conn 08 Feb '07

08 Feb '07

Anyone have experience configuring Nortel devices (450/60/70) for radius, telnet/ssh authentication? I keep getting "Sending Access-Accept of id 2 to x.x.x.x port 1024. Thanks. Paul Conn

4 4