- Freeradius-Users - lists.freeradius.org

Starting radius issue - configuration files globaly readable.
by tzieleniewski 10 Feb '07

10 Feb '07

Hi! I have just compiled the latest CVS and whenever I try to start radius I get the following info: Configuration file /home/radius/freeradius/raddb/radiusd.conf is globally readable. This is because I use the symbolic links to files. Can this restriction be somehow removed?? Bests -tomasz

4 6

Mysql - radcheck, radreply, radgroupcheck and radgroupreply
by "Fabrício F. Kammer" 09 Feb '07

09 Feb '07

Hi, I'm using Freeradius + Mysql to do the MAC Address authentication of the clients that connection on my APs (Mikrotik machines). In the mysql I've the follow: Table usergroup: UserName = MAC address GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Table radgroupcheck: GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Then I've four lines for each GroupName with the follow: Attribute: "Auth-Type" // op: ":=" // Value: "Local" Attribute: "NAS-IP-Address" // op: "==" // Value: "IP of the AP" Attribute: "NAS-Port-Identify" // op: "==" // Value: "Name of the AP - Ex: MyAP1" On the table radcheck I don't have anything. This table is empty. In the table radreply I've one record: UserName: "MAC Address of the client" Attribute: "Mikrotik-Rate-Limite" op: "=" Value: "64000/128000" The problem is: If the Freeradius don't find the UserName on the table radcheck it doesn't return the attributes that are on the table radreply, just the records of the table radgroupreply are returned. I need to return the reply different for each client because this parameter is the speed of upload and download and this values are different for each client. My questio is: Is it possible that the Freeradius return the values of the table radreply if I don't have any value on the radcheck? (The authentication was made in the radgroupcheck table) Thanks in advanced, Fabrício F.: Kammer

1 0

Re: VPN authentication from Windows Vista
by david＠mitton.com 09 Feb '07

09 Feb '07

MS-Chap is in RFC 2433 (Oct 1998) MS-Chap V2 is in RFC 2759 (Jan 2000) see also Microsoft Specific RADIUS attributes - RFC 2548 (Mar 1999) Dave. ----Original Message---- From: p.mayers(a)imperial.ac.uk Date: Feb 9, 2007 6:01 To: "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius. org> Subj: Re: VPN authentication from Windows Vista Lai Fu Keung wrote: > Hi, > > My users said the VPN login failed with their Windows Vista. > > I enabled freeradius debug. I came across an authentication method, > md5chap in debug output that my freeradius is currently not configured Do you mean "mschap"? > to support. If the user unselects "Require Data Encryption" in VPN. It > then works fine. It uses PAP and sends the password in plaintext (bad idea). Windows has always done that, back to win95. > > Can anyone confirm the following questions for me? > > 1. Is it that Vista uses md5chap for VPN authentication with "Data > Encryption"? Windows has always done that. > 2. Can freeradius be configured to support md5chap? Yes > > I don't get a lot of information about md5chap in google. I appreciate That's because there's no such thing - as I said, I think you mean "mschap" (or "MSCHAP" or "MS-CHAP" whichever they've called it). I don't have a vista box handy, I'll fire up a VM and take a look in a bit. > any pointers on this subject and how freeradius can be made to support > it, as radiusd.conf seems no mentioning on this subject. > > Thanks. > > Lai > > - > List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html

1 0

LDAP server contacted twice?
by Fabio Spelta 09 Feb '07

09 Feb '07

Hello everybody. We got a setup which does work in authenticating 812.1x users over a wired network by using EAP-MD5, checking authorization and authentication of the supplicant over a LDAP directory. What we do find strange (and pretty annoying, indeed) is that the we feel that the LDAP server does get contacted more than necessary, read: twice. Being more specific, when the freeradius server gets an ACCESS-REQUEST from the NAS, then radiusd does contact the LDAP server three times. The first time it does check for the existance of the user authenticating. The second, it checks if the users belong to a certain group specified with the Ldap-Group option. The third time it does grab the password from the user entry in the LDAP field and add it to the check item list.. So long, so well. What happens next? Next step is about the ACCESS-CHALLENGE. When radiusd is about to send it, it first checks the LDAP again. The same three times. Check for the users in the whole directory, check the belonging to the group, check the password again to calculate the hash. That results in six LDAP queries, we suspect that those can be reduced down to half but we can't find the point out. Thank you very much in advance. Here's the radiusd debug log (radiusd -X): rad_recv: Access-Request packet from host ********:37540, id=1, length=161 Message-Authenticator = 0x******** User-Name = "********" NAS-IP-Address = ******** Called-Station-Id = "********" NAS-Port = 21001 NAS-Port-Id = "fe.2.1" NAS-Port-Type = Ethernet Service-Type = Framed-User Calling-Station-Id = "********" EAP-Message = 0x******** Framed-MTU = 1300 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/********/auth-detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/********/auth-detail-20070209 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 24 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched DEFAULT at 8 users: Matched DEFAULT at 103 users: Matched DEFAULT at 105 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=********,dc=********' radius_xlat: '(uid=********)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ********:389, authentication 0 rlm_ldap: bind as cn=********,ou=********,dc=********,dc=********/******** to ********:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (&(cn= 802.1xwired)(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))) rlm_ldap::ldap_groupcmp: User found in group 802.1xwired rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 121 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ******** radius_xlat: '(uid=********)' radius_xlat: 'dc=********,dc=********' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ******** authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group Autz-Type returns ok for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 1 to ********:37540 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Filter-Id = "Enterasys:version=1:mgmt=su:policy=admin" EAP-Message = 0x******** Message-Authenticator = 0x00000000000000000000000000000000 State = 0x******** Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host ********:37540, id=2, length=196 Message-Authenticator = 0x91c3c6cfd386855dc73803c5a3670318 User-Name = "********" State = 0xb9e826259b6a63f5c103fd209ffde50b NAS-IP-Address = ******** Called-Station-Id = "********" NAS-Port = 21001 NAS-Port-Id = "fe.2.1" NAS-Port-Type = Ethernet Framed-MTU = 1300 Service-Type = Framed-User Calling-Station-Id = "********" EAP-Message = 0x******** Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/********/auth-detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/********/auth-detail-20070209 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 41 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched DEFAULT at 8 users: Matched DEFAULT at 103 users: Matched DEFAULT at 105 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=********,dc=********' radius_xlat: '(uid=********)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (&(cn= 802.1xwired)(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))) rlm_ldap::ldap_groupcmp: User found in group 802.1xwired rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 121 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for ******** radius_xlat: '(uid=********)' radius_xlat: 'dc=********,dc=********' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ******** authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group Autz-Type returns ok for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 1 modcall: group authenticate returns ok for request 1 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 radius_xlat: '/var/log/radius/radacct/********/reply-detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/********/reply-detail-20070209 modcall[post-auth]: module "reply_log" returns ok for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: '********' rlm_sql (sql): sql_set_user escaped user --> '********' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', '********', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', '********', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 modcall[post-auth]: module "sql" returns ok for request 1 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 2 to ********:37540 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Filter-Id = "Enterasys:version=1:mgmt=su:policy=admin" EAP-Message = 0x******** Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "********" Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 1 with timestamp 45cc6700 Waking up in 6 seconds... rad_recv: Accounting-Request packet from host ********:37541, id=1, length=100 Acct-Status-Type = Start User-Name = "********" Calling-Station-Id = "********" NAS-IP-Address = ******** NAS-Port = 21001 Acct-Delay-Time = 0 Acct-Session-Id = "1000004F" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 21001,Client-IP-Address = ********,NAS-IP-Address = ********,Acct-Session-Id = "1000004F",User-Name = "********"' rlm_acct_unique: Acct-Unique-Session-ID = "3974eb0b2b9f763c". modcall[preacct]: module "acct_unique" returns ok for request 2 rlm_realm: Looking up realm "********" for User-Name = "********" rlm_realm: No such realm "********" modcall[preacct]: module "suffix" returns noop for request 2 acct_users: Matched DEFAULT at 7 modcall[preacct]: module "files" returns ok for request 2 modcall: group preacct returns ok for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 modcall[accounting]: module "acct_unique" returns noop for request 2 radius_xlat: '/var/log/radius/radacct/********/detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/********/detail-20070209 modcall[accounting]: module "detail" returns ok for request 2 modcall[accounting]: module "unix" returns ok for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: ********' modcall[accounting]: module "radutmp" returns ok for request 2 radius_xlat: '********' rlm_sql (sql): sql_set_user escaped user --> '********' radius_xlat: 'INSERT into radacct ***************** rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 modcall[accounting]: module "sql" returns ok for request 2 modcall: group accounting returns ok for request 2 Sending Accounting-Response of id 1 to ********:37541 Finished request 2 -- Fabio

2 1

FreeRadius + OpenLDAP (SMD5) + Windows XP
by Mercier Romain 09 Feb '07

09 Feb '07

Hi, I got a simple question but I don?t find anything to answer it. Situation: I got a database OpenLDAP which contains users info, mainly ?uid? and ?userPassword? crypt with SMD5 and I can?t modify this encryption type. I want Wireless users to have to authenticate to access the WLAN without installing anything on users' PC (mainly Windows XP PCs). Question: Does anybody know if there is a way to authenticate users using this password ? I tried using a clear-text password and that works but I cannot and don't want to change userPassword encryption. Thanks a lot for any idea/help, Romain Mercier

3 5

AW: ntlm_auth authentication against multiple ADS domains
by Habegger Lukas, ERZ-AZD-AIL 09 Feb '07

09 Feb '07

Hi I don't know exactly what you have to do. I have implemented something like this. ------- ------- | RAD |---------| AD1 | ------- ------- | ------- ------------| AD2 | ------- It's done with a perl module over rlm_perl. The perl module looks for witch domain the request is and starts the right winbind-daemon. It's not really nice. The problem is that a samba server only could be member of one domain. The samba team said that samba4 would support more then one domain or you could change the samba3-code to support multiple sockets on winbind (i think it was discussed on the samba-mailinglist). If you can build trusts between the domains it's much more easier. This way you can auth on a single point. It should look like this ------- ------- | RAD |---------| AD1 | ------- ------- | ------- | AD2 | ------- A other way is to proxy the requests to a radius on the samba server. It looks like this ------- ------------- | RAD |---------| RAD - AD1 | ------- ------------- | ------------- ------------| RAD - AD2 | ------------- If you need more infos about my implementation write again. Lukas

1 0

ntlm_auth authentication against multiple ADS domains
by Dow, Corey 09 Feb '07

09 Feb '07

Hi All, This is more of an ntlm_auth how to than a FreeRADIUS question, but I thought I would post here since others may have run across this. We're trying to use ntlm_auth and FreeRADIUS to authenticate users against an ADS back-end. I've found several excellent articles on how to set this up, and I have it working with a single ADS domain. The problem I've encountered is performing authentication against multiple ADS domains using ntlm_auth. ADS Parent domain netidm.net ADS Child domain xyz.abc.com If I join to abc.com using net ads join, I can use ntlm_auth with no problems, but how do I perform authentications against xyz.abc.com ? I've tried: Ntlm_auth --request-nt-key --DOMAIN=XYZ --username=jdoe But I get an NT_STATUS_IO_TIMEOUT. I'm assuming this is because I'm joined to the Parent domain and not the child domain, but can't this work by only joining the one domain? # Samba Config workgroup = ABC server string = Samba Server security = ads load printers = yes log file = /usr/local/samba/var/log.%m max log size = 50 realm = ABC.COM wins server = 180.44.200.53 dns proxy = no comment = Home Directories browseable = no writable = yes comment = All Printers path = /usr/spool/samba browseable = no guest ok = no writable = no printable = yes #Kerberos Config default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log default_realm = ABC.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes ABC.COM = { kdc = 180.44.200.53:88 kdc = 180.44.200.54:88 } XYZ.ABC.COM = { kdc = 180.44.200.69:88 } .abc.com = ABC.COM abc.com = ABC.COM .xyz.abc.com = XYZ.ABC.COM xyz.abc.com = XYZ.ABC.COM profile = /var/kerberos/krb5kdc/kdc.conf pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } Any help greatly appreciated. Corey Corey Dow Network Solution's Test Center ProCurve Networking by HP

3 2

VPN authentication from Windows Vista
by Lai Fu Keung 09 Feb '07

09 Feb '07

Hi, My users said the VPN login failed with their Windows Vista. I enabled freeradius debug. I came across an authentication method, md5chap in debug output that my freeradius is currently not configured to support. If the user unselects "Require Data Encryption" in VPN. It then works fine. Can anyone confirm the following questions for me? 1. Is it that Vista uses md5chap for VPN authentication with "Data Encryption"? 2. Can freeradius be configured to support md5chap? I don't get a lot of information about md5chap in google. I appreciate any pointers on this subject and how freeradius can be made to support it, as radiusd.conf seems no mentioning on this subject. Thanks. Lai

4 3

Setting up a VPN server with pptp and RADIUS for all sorts of clients
by robert 09 Feb '07

09 Feb '07

Hello, This is my First post on this mailing list, so sorry if I am in the wrong place!! I am having problems getting the Radius Serv to validate my VPN clients. Reading through the mail archives, I have found similar subjects, but the main difference I have is the fact that I don't have authority on the Radius Server. The main problem comes from my windows clients, I am trying to stick to the default Microsoft auth method (using ms-chap v2) to keep the client side as simple as possible. So I have set-up my pptp daemon, installed radiusclient, and have used the dictionary.microsoft from the sources of radiusclient. I must point out that authentication works using "User-Password" field (say if I am wrong, but this is a clear text password?) on 802.1X clients, and all Users in the LDAP base have a valid User-Password (but no NT/LM Passwords) The solutions I have come across until now tell me to use NT or LM password field and the problem is solved, but I can't change the layout, It has been set by "eduroam", who guides the project. So I must get my radius client to work with User-password, but I don't know where to start... A log sent from the Radius Admin shows that the mschap module fails to find User-Password (this is how I have understood it!) and refuses to validate the user. here is the part I am talking about: FROM Radius log: auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for dupontd with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. But I am sure that the field User password contains the valid password I am trying to use. Just in case, I shall post the dictionary.microsoft I am using: # # Microsoft's VSA's, from RFC 2548 # # $Id: dictionary.microsoft,v 1.1 2004/11/14 07:26:26 paulus Exp $ # VENDOR Microsoft 311 Microsoft ATTRIBUTE MS-CHAP-Response 1 string Microsoft ATTRIBUTE MS-CHAP-Error 2 string Microsoft ATTRIBUTE MS-CHAP-CPW-1 3 string Microsoft ATTRIBUTE MS-CHAP-CPW-2 4 string Microsoft ATTRIBUTE MS-CHAP-LM-Enc-PW 5 string Microsoft ATTRIBUTE MS-CHAP-NT-Enc-PW 6 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Policy 7 string Microsoft # This is referred to as both singular and plural in the RFC. # Plural seems to make more sense. ATTRIBUTE MS-MPPE-Encryption-Type 8 string Microsoft ATTRIBUTE MS-MPPE-Encryption-Types 8 string Microsoft ATTRIBUTE MS-RAS-Vendor 9 integer Microsoft ATTRIBUTE MS-CHAP-Domain 10 string Microsoft ATTRIBUTE MS-CHAP-Challenge 11 string Microsoft ATTRIBUTE MS-CHAP-MPPE-Keys 12 string Microsoft ATTRIBUTE MS-BAP-Usage 13 integer Microsoft ATTRIBUTE MS-Link-Utilization-Threshold 14 integer Microsoft ATTRIBUTE MS-Link-Drop-Time-Limit 15 integer Microsoft ATTRIBUTE MS-MPPE-Send-Key 16 string Microsoft ATTRIBUTE MS-MPPE-Recv-Key 17 string Microsoft ATTRIBUTE MS-RAS-Version 18 string Microsoft ATTRIBUTE MS-Old-ARAP-Password 19 string Microsoft ATTRIBUTE MS-New-ARAP-Password 20 string Microsoft ATTRIBUTE MS-ARAP-PW-Change-Reason 21 integer Microsoft ATTRIBUTE MS-Filter 22 string Microsoft ATTRIBUTE MS-Acct-Auth-Type 23 integer Microsoft ATTRIBUTE MS-Acct-EAP-Type 24 integer Microsoft ATTRIBUTE MS-CHAP2-Response 25 string Microsoft ATTRIBUTE MS-CHAP2-Success 26 string Microsoft ATTRIBUTE MS-CHAP2-CPW 27 string Microsoft ATTRIBUTE MS-Primary-DNS-Server 28 ipaddr Microsoft ATTRIBUTE MS-Secondary-DNS-Server 29 ipaddr Microsoft ATTRIBUTE MS-Primary-NBNS-Server 30 ipaddr Microsoft ATTRIBUTE MS-Secondary-NBNS-Server 31 ipaddr Microsoft #ATTRIBUTE MS-ARAP-Challenge 33 string Microsoft # # Integer Translations # # MS-BAP-Usage Values VALUE MS-BAP-Usage Not-Allowed 0 VALUE MS-BAP-Usage Allowed 1 VALUE MS-BAP-Usage Required 2 # MS-ARAP-Password-Change-Reason Values VALUE MS-ARAP-PW-Change-Reason Just-Change-Password 1 VALUE MS-ARAP-PW-Change-Reason Expired-Password 2 VALUE MS-ARAP-PW-Change-Reason Admin-Requires-Password-Change 3 VALUE MS-ARAP-PW-Change-Reason Password-Too-Short 4 # MS-Acct-Auth-Type Values VALUE MS-Acct-Auth-Type PAP 1 VALUE MS-Acct-Auth-Type CHAP 2 VALUE MS-Acct-Auth-Type MS-CHAP-1 3 VALUE MS-Acct-Auth-Type MS-CHAP-2 4 VALUE MS-Acct-Auth-Type EAP 5 # MS-Acct-EAP-Type Values VALUE MS-Acct-EAP-Type MD5 4 VALUE MS-Acct-EAP-Type OTP 5 VALUE MS-Acct-EAP-Type Generic-Token-Card 6 VALUE MS-Acct-EAP-Type TLS 13 I have tried to expose my problem the best I can, but If you find that something is missing, don't hesitate! Thanks, Robert PS: using other protocols (PAP for exemple) works fine, but we need mschap support!

4 6

rlm_perl problem (Detaching!!)
by Rohaizam Abu Bakar 09 Feb '07

09 Feb '07

Hi.. FR: 1.1.2 FBSD: 6.0 My rlm_perl keep logging error as example below. Everytime this happen radiusd will hang and DO NOT respond to any request. But this NEVER happen while running in debug mode and working fine. rlm_perl is used to load timeout based on certain rules.. u can see below my perl script (newtimeou5.pl) and also config files setting. Please help TQ. Error /var/log/radius.log ################################################################################## Thu Feb 8 12:30:09 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout4.pl , func = authorize exit status= Undefined subroutine &main:: called. Thu Feb 8 12:32:00 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 12:39:46 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout4.pl , func = authorize exit status= panic: leave_scope inconsistency at /usr/local/etc/raddb/newtimeout4.pl line 184. Thu Feb 8 12:39:47 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:08:52 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:22:40 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Thu Feb 8 14:57:25 2007 : rlm_perl: rlm_perl::Detaching. Reloading. Done. Fri Feb 9 09:53:52 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = authorize exit status= Usage: Encode::is_utf8(sv, check = 0) at /usr/local/lib/perl5/site_perl/5.8.7/Convert/ASN1.pm line 422, <DATA> line 424. Fri Feb 9 10:21:59 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = authorize exit status= Undefined subroutine &Convert::ASN1::authorize called at /usr/local/lib/perl5/site_perl/5.8.7/Net/LDAP.pm line 759 Fri Feb 9 10:57:59 2007 : Error: rlm_perl: perl_embed:: module = /usr/local/etc/raddb/newtimeout5.pl , func = preacct exit status= Undefined subroutine &Convert::ASN1::preacct called at /usr/local/lib/perl5/site_perl/5.8.7/Net/LDAP.pm line 759 #################################################### ######################users############################ DEFAULT NAS-Identifier == "Wireless-802.11", Autz-Type := Y5, Auth-Type :Y5 ######################################################## #################radiusd.conf################################# authorize { Autz-Type Y5 { redundant { ldapy51 ldapy52 } y5perl } } modules { perl y5perl { module = /usr/local/etc/raddb/newtimeout5.pl } } authenticate { Auth-Type Y5 { redundant { ldapy51 ldapy52 } } } ########################################################## #######################newtimeout5.pl######################## sub authorize { ##main my $return_value = 0; $return_value = &timeout; print "VALUE return: $return_value\n"; if ($return_value eq '-1'){ return RLM_MODULE_REJECT; }else{ return RLM_MODULE_OK; } } sub timeout { my $query; my $query2; my $uid=$RAD_REQUEST{'User-Name'}; my $userfrom; my $userconnect=$RAD_REQUEST{'NAS-Identifier'}; my $timeout; ################################ if ($userconnect =~ /Wireless-802.11|WiFi/) { $query="Service"; $query2 = "TimeoutWIFI"; } if ($query){ $userfrom = ldapquery($uid,$query); if ($userfrom =~ /Y5PLAT|Y5GOLD/){ $userfrom = "WiFi-BTP"; }elsif ($userfrom =~ /^Y5$/){ $userfrom = "Wireless-802.11"; } if ($userconnect eq $userfrom){ print "rlm_perl: Local user.. No timeout.. Unlimited!!!\n"; return (1); }elsif ($userconnect ne $userfrom){ print "rlm_perl: Roaming user.. Timeout will be loaded !!\n"; $timeout = ldapquery($uid,$query2); print "rlm_perl: $query2:$timeout\n"; if (!$timeout){ return (-1); }else{ $RAD_REPLY{'Session-Timeout'} = $timeout; print "rlm_perl: NOT YET....\n"; return (1); } } }else{ print "rlm_perl: Not a wifi connection !!!\n"; return (1); } } sub ldapquery { my ( $uid, $query ) = @_; my $host = "xxxxxxxxxx"; my $value; my $baseDN = "ou=Y5,ou=AAA, ou=xxxxx, dc=xxxxx, dc=xxxx"; my $ldap = Net::LDAP->new( $host ) or die "$@"; my $mesg = $ldap->bind ; # an anonymous bind $mesg = $ldap->search( # perform a search base => $baseDN, filter => "(&(uid=$uid))" ); my $count = $mesg->count; if ($mesg->code) { return ("NULL"); } if ($count < 0 ){ return ("NULL"); }elsif ($count > 0){ for ( my $i = 0 ; $i < $count ; $i++ ) { my $entry = $mesg->entry ( $i ); my $data = $entry->dn; $value = $entry->get_value($query); } } $mesg = $ldap->unbind; return ($value); }

1 0