- Freeradius-Users - lists.freeradius.org

FreeRadius with mysql and shadow encryption
by carlos Alberto RR 25 Jan '07

25 Jan '07

Hello, I have installed a freeradius with mysql and dialupadmin , but I need to migrate theusers of system and the passwords that are in /etc/shadow are encrypted with DES and crypt of dialupadmin use MD5, How Do I can do to migrate this users? any idea? or How do I make for that crypt of dialupadmin work with DES? Thanks

1 0

Re: Splitting the password field in freeRADIUS
by Drumm, Daniel 25 Jan '07

25 Jan '07

Dan Geist explained what it was I am trying to do. His suggestion is the way I will look, to use a perl module to split the authentication. Time for some ASCII Art (bad) NAS ---> FR (this field passes the password via RADIUS/PAP, and is the securID tokencode + kerberos pwd.) ( ex: user:jdoe pwd:549872MyPassword ) FR then splits the first 6 characters, and sends the authentication to the RADIUS listener that RSA bundles with Auth Mgr 6.1. FR ----> RSA-AuthMgr-RADIUS-listener | |-------> Campus Kerberos RADIUS server It then sends the campus Kerberos password (i.e. MyPassword) to the campus RADIUS server that front ends the Kerberos system. Since RADIUS is an async network protocol, Freeradius will have to set timers and wait for each to be successful before returning an accept to the NAS for the RADIUS request which it proxied. As Dan explained, this will probably be independent PAM calls to the two methods. Could be tricky. Dan @ UM. ---- Message: 2 Date: Tue, 23 Jan 2007 14:05:32 -0800 (PST) From: Agent Smith <news8080(a)yahoo.com> Subject: Re: Splitting the password field in freeRADIUS To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <529131.95171.qm(a)web50915.mail.yahoo.com> Content-Type: text/plain; charset=iso-8859-1 I frontend our secureID server with FR. but that is only doing PAP. The way I do this is radius proxy whre the FR is running on the same box different port. I don't understand what you are trying to do here. If a user tried to authenticate you want the PIN to authenticate on radius? and the rest somewhere else?

1 0

?? - No "known good" password found for the user
by tzieleniewski 25 Jan '07

25 Jan '07

Hi! I am trying to use freeradius as an authentication server for sip express router. I am o newbee with free radius so a kindly ask for your help. I configured ser so it sends the requests messages to radius but I encountered a strange error: Both are running on the same machine so it is enough to use the 127.0.0.1 client configuration from client.conf. I defined realm that would service the request comming with the "voip.touk.pl" domain part in the proxy.conf: realm voip.touk.pl { type = radius authhost = LOCAL accthost = LOCAL nostrip } I also included the digest modules in the authentication and authorization sections in the radiusd.conf. At the end I added the user data in the users file: hellboy Auth-Type := Digest, User-Password := "hellboy", Huntgroup-Name == "voip.touk.pl" Fall-Through = No, User-Name = `%{User-Name}`, Reply-Message = "Accepted: %{User-Name}" And know when SER sends the authentication request radius rejects it and there is this "strange" info" rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. another thing wich is strange is: rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. when my suffix is defined in the radiusd.conf as: realm suffix { format = suffix delimiter = "@" } here is the whole free radius degub outout: rad_recv: Access-Request packet from host 127.0.0.1 port 32794, id=225, length=299 User-Name = "hellboy(a)voip.touk.pl" Digest-Attributes = 0x0a0968656c6c626f79 Digest-Attributes = 0x010e766f69702e746f756b2e706c Digest-Attributes = 0x022a34356238633234313732386462316132343230333639303633313264366333626338363135306563 Digest-Attributes = 0x04177369703a7465737440766f69702e746f756b2e706c Digest-Attributes = 0x0308494e56495445 Digest-Attributes = 0x050661757468 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x08223133304432333745384238443837353945304441383438444443323133353542 Digest-Response = "bd2e0fd81858b8114d326394b7b92001" Service-Type = 0x0000000f00000000 SER-Service-Type = 0x0000000300000000 SER-Uri-User = "hellboy" NAS-Port = 0x000013c400000000 NAS-IP-Address = 0x7f00000100000000 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 0 rlm_realm: Looking up realm "voip.touk.pl" for User-Name = "hellboy(a)voip.touk.pl" rlm_realm: Found realm "voip.touk.pl" rlm_realm: Proxying request from user hellboy to realm voip.touk.pl rlm_realm: Adding Realm = "voip.touk.pl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 modcall[authorize]: module "files" returns noop for request 0 modcall[authorize]: module "expiration" returns noop for request 0 modcall[authorize]: module "logintime" returns noop for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_digest: Cleartext-Password or Digest-HA1 is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Login incorrect: [hellboy(a)voip.touk.pl/<via Auth-Type = DIGEST>] (from client ip4.localhost port 0) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 0 radius_xlat: 'hellboy(a)voip.touk.pl' attr_filter: Matched entry DEFAULT at line 11 modcall[post-auth]: module "attr_filter.access_reject" returns updated for request 0 modcall: group REJECT returns updated for request 0 best Tomasz

2 1

Re: Problem with freeradius 1.1.3 and MySQL reserving sql socket
by Raúl Rodríguez 25 Jan '07

25 Jan '07

Sorry, I'm stupid... i have commented sql query about authentication

1 0

Re: The EAP Saga begins.
by Evan Vittitow 25 Jan '07

25 Jan '07

rad_recv: Access-Request packet from host 192.168.0.250:1175, id=66, length=149 User-Name = "kurama" Cisco-AVPair = "ssid=Pukey" NAS-IP-Address = 192.168.0.250 Called-Station-Id = "004096285ceb" Calling-Station-Id = "00095b679ccf" NAS-Identifier = "AP340-285ceb" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Login-User EAP-Message = 0x024e000b016b7572616d61 Message-Authenticator = 0xa9ef47a3079c2a10a405828572e5931a Processing the authorize section of radiusd.conf modcall: entering group authorize for request 28 modcall[authorize]: module "preprocess" returns ok for request 28 rlm_ldap: - authorize rlm_ldap: performing user authorization for kurama radius_xlat: '(uid=kurama)' radius_xlat: 'dc=pukey' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=pukey, with filter (uid=kurama) rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value supersecret & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusFilterId as Filter-Id, value Enterasys:version=1:policy=Enterprise User & op=11 rlm_ldap: user kurama authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 28 modcall[authorize]: module "chap" returns noop for request 28 modcall[authorize]: module "mschap" returns noop for request 28 rlm_realm: No '@' in User-Name = "kurama", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "kurama" rlm_realm: Proxying request from user kurama to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 28 rlm_eap: EAP packet type response id 78 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 28 modcall[authorize]: module "files" returns notfound for request 28 modcall: leaving group authorize (returns updated) for request 28 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 28 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 28 modcall: leaving group authenticate (returns handled) for request 28 Sending Access-Challenge of id 66 to 192.168.0.250 port 1175 Filter-Id = "Enterasys:version=1:policy=Enterprise User" EAP-Message = 0x014f00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6da2542209613e6e277dfd56deb50f0c Finished request 28 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 28 ID 66 with timestamp 45b79890 Nothing to do. Sleeping until we see a request. This uid does exist and has the NT and LM password attributes.

2 1

Problem with freeradius 1.1.3 and MySQL reserving sql socket
by Raúl Rodríguez 25 Jan '07

25 Jan '07

Hi all! I'm trying to set-up a freeradius 1.1.3 using MySQL 5.0.22 as Database Backend... although i have a very annoying problem that i don't know how to solve. When i launch the service with -X option to see debug, it seems that everything goes well, although when i try to submit some request to the server (Auth, access...) it fails with an sql query error without doing any query (i can confirm this beacuse i was sniffing mysql traffic in the server). The problem seems to come when the server try to reserve one sql socket... but there is no error, inmediately it response with an sql query error... here is the log: rlm_sql (sql): starting 22 rlm_sql (sql): Attempting to connect rlm_sql_mysql #22 rlm_sql_mysql: Starting connect to MySQL server for #22 rlm_sql (sql): Connected new DB handle, #22 rlm_sql (sql): starting 23 rlm_sql (sql): Attempting to connect rlm_sql_mysql #23 rlm_sql_mysql: Starting connect to MySQL server for #23 rlm_sql (sql): Connected new DB handle, #23 rlm_sql (sql): starting 24 rlm_sql (sql): Attempting to connect rlm_sql_mysql #24 rlm_sql_mysql: Starting connect to MySQL server for #24 rlm_sql (sql): Connected new DB handle, #24 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.100:9695, id=38, length=43 User-Name = "101" User-Password = "1234" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "digest" returns noop for request 0 rlm_realm: No '@' in User-Name = "101", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: '' -------------- ERROR ------------------------------------- rlm_sql (sql): Reserving sql socket id: 24 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 24 ---------------------------------------------------------- modcall[authorize]: module "sql" returns fail for request 0 modcall: leaving group authorize (returns fail) for request 0 Finished request 0 ... Thank you in advance. Raúl.

3 2

Proxying based on SSID
by Lai Fu Keung 25 Jan '07

25 Jan '07

Hi, Sorry if the questions have been asked. I have done a lot of searches, but could not find the answer. Normally, I proxy a PEAP request whenever the realm is unknown to us (i.e. using the DEFAULT realm without stripping user name). However, for some SSIDs, I want requests to be handled locally with ldap, independent of what the realm is (and with the user name stripped). What I did is to find those SSIDs in "Called-Station-ID" and set proxy-to-realm to a local realm. But the problem (I guess) is that when freeradius processes the realm file, the user name is not stripped. When later on processed by the local realm, the request fails because the user name still contains the domain. Any suggestions to solve it is appreciated. Thanks in advance. Best Regards, Lai Users ===== DEFAULT NAS-Port-Type == "Wireless-802.11", Called-Station-Id =~ "MY-SSID$", St rip-User-Name := Yes, Autz-Type := usePlainTextPwd, Proxy-to-realm := "hku.hk" DEFAULT NAS-Port-Type == "Wireless-802.11", Autz-Type := usePlainTextPwd Radiusd -X ========= rad_recv: Access-Request packet from host 17.18.28.26:20002, id=136, length=152 NAS-Port-Id = "2098/1" Calling-Station-Id = "00-18-DE-83-3E-1B" Called-Station-Id = "00-16-E0-FD-47-40:VIP-peap" Service-Type = Framed-User EAP-Message = 0x02010012017063637732406173642e636f6d User-Name = "pcw2(a)asd.com" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = 17.18.28.26 Message-Authenticator = 0x46e6da4a3ad7d253157a9f21a110807b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "asd.com" for User-Name = "pcw2(a)asd.com" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user pcw2 to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 244 modcall[authorize]: module "files" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall: leaving group authorize (returns updated) for request 0 Found Autz-Type usePlainTextPwd Processing the authorize section of radiusd.conf modcall: entering group usePlainTextPwd for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for pcw2(a)asd.com radius_xlat: '(&(uid=pcw2(a)asd.com)))' radius_xlat: 'ou=ldap,o=hku,c=hk' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.hku.hk:389, authentication 0 rlm_ldap: starting TLS rlm_ldap: bind as cn=net,o=hku,c=hk/M134aNaa to ldap1.hku.hk:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=ldap,o=hku,c=hk, with filter (&(uid=pcw2(a)asd.com)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "withNTPwd" returns notfound for request 0 modcall: leaving group redundant (returns notfound) for request 0 modcall: leaving group usePlainTextPwd (returns notfound) for request 0 WARNING: You set Proxy-To-Realm = hku.hk, but it is a LOCAL realm! Cancelling invalid proxy request. rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 WARNING: Cancelling proxy to Realm hku.hk, as the realm is local. Sending Access-Challenge of id 136 to 17.18.28.26 port 20002 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd7f032f1c3ed7e8e39bf1872727e771 Finished request 0 Going to the next request

3 6

RE: help
by John Wan 25 Jan '07

25 Jan '07

Hi Alan, Thanks for your help again. Does the NAS documentation mean the documentation of my wireless access point? Thanks Regards John -----Original Message----- From: freeradius-users-bounces+j.wan=mbs.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+j.wan=mbs.edu@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, 22 January 2007 5:57 PM To: FreeRadius users mailing list Subject: Re: help John Wan wrote: > > I have followed all the instructions from http://deployingradius.com. > I do not know why I have had the CHAP authentication. See the NAS documentation. > I would like to use MS-CHAP authentication instead of CHAP, and do you > have any tipps for me for this kind of setup (MS-CHAP)? See the NAS documentation. The choice of CHAP or MS-CHAP is not under control of the RADIUS server. Alan DeKok. -- http://deployingradius.com - The web site of the book http://deployingradius.com/blog/ - The blog - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- _______________________________________________________________________________ Notice from Melbourne Business School Ltd The information contained in this e-mail is confidential, and is intended for the named person's use only. It may contain proprietary or legally privileged information. If you have received this email in error, please notify the sender and delete it immediately. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient Internet communications are not secure. You should scan this message and any attachments for viruses. Melbourne Business School does not accept any liability for loss or damage which may result from receipt of this message or any attachments. ______________________________________________________________________________

2 1

Accounting in MySQL
by DESEtech - German P. Santillan 25 Jan '07

25 Jan '07

I actually have my Users DB in MySQL Server and my FreeRADIUS use the "radcheck" and "radreply" tables to read (SELECT) records, in my radiusd.conf I have... authorize { sql } accounting { sql } But I don´t hace records in radacct Table. What is the problem? Thanks in advance and sorry for my English Germán P. Santillán Administrador de Redes Jefe del Dpto. Técnico DESETech Argentina S.A. San Martín 133 - CP: B8000FIC Bahía Blanca - Argentina Tel/Fax: +54 (291) 456-5642 gsantillan(a)desetech.com.ar http://www.desetech.com.ar

3 5

Setting a realm in the User-Name based on Client-IP-Address
by Jason E. Murray 24 Jan '07

24 Jan '07

I have quite a few people on campus who authenticate to various systems without using a realm in their username. With our current radius server there is a option in the clients file where you specify a Default-Realm per client. When an authentication request comes in from this client the @realm is automatically tacked onto the User-Name attribute then proxying is done based username@realm combination. I need to replicate this behavior in FreeRadius. In the users file I have: DEFAULT Client-IP-Address == 127.0.0.1, User-Name !~ ".*@.*", Proxy-To-Realm := "rts" Fall-Through = Yes In the preproxy_users file I have: DEFAULT Client-IP-Address == 127.0.0.1, User-Name !~ ".*@.*" User-Name := "%{User-Name}@rts" Both of these lines check to see if the @realm is missing and the Client-IP-Address is 127.0.0.1 the proxy and rewrite accordingly. My question is there a better way to do this, this seems a bit kludgy. Using FreeRadius 1.1.4 Thanks in advance, -- Jason E. Murray - jemurray(a)zweck.net

2 1