- Freeradius-Users - lists.freeradius.org

Proxy Realm Error or Realm dead ??
by Rio Yang 31 Oct '06

31 Oct '06

Hi all, Found a problem on freeradius when I review the log file (detail-YYYYMMDD). The following is my proxy settings. default (proxy to 1.1.1.1) abc.com (proxy to 2.2.2.2) But I found some error entries in detail log. The username is test(a)abc.com and it's realm must be "abc.com" But in detail log, it belongs "default". Is there anybody have the same problem ?? Or abc.com deaded and the freeradius assign test(a)abc.com to new realm (default) ??? Rio

3 5

'{%SQL-User-Name}' does not work for SQLIPPOOL
by Guilherme Franco 31 Oct '06

31 Oct '06

Hello, '{%SQL-User-Name}' does not work for SQLIPPOOL, it always appears blank. What should I use in order to get the username? Thank you.

1 0

CVS problem
by Guilherme Franco 31 Oct '06

31 Oct '06

Hello, I'm trying to do a cvs checkout but it won't let me: cvs -d :pserver:anoncvs@cvs.freeradius.org:/source login Logging in to :pserver:anoncvs@cvs.freeradius.org:2401/source CVS password: anoncvs cvs -d :pserver:anoncvs@cvs.freeradius.org:/source checkout radiusd It just hangs in the checkout part... Any problems with the server? Thanks.

4 4

FreeRadius installation problem.
by Chad Best 31 Oct '06

31 Oct '06

When I run ./confiugre, make and make install, "radiusd" does not install. I have checked the /usr/local/bin and /usr/local/sbin and it is not there. Yes, I did make sure that I was showing hidden files when I search for it. I also did a search for radiusd and it does not show up anywhere. Therefore, when I try to run radiusd by typing "radiusd -X", it says command not found. I am running Ubuntu Linux and trying to install Freeradius-1.0.0(behind the times, I know). I am a total newbie to Freeradius altogether, so please be patient! I have already tried to reinstall, but that didn't work. Any help would greatly be appreciated.

3 3

authorize_check_query and authorize_reply_query
by Guido 31 Oct '06

31 Oct '06

Hello list, I'm using freeradius and have some doubts abot these steps. authorize_check_query = "store_check_query '%{Stripped-User-Name:-%{User-Name}},'''' authorize_reply_query = "store_check_query '%{Stripped-User-Name:-%{User-Name}},'''' At this moment I'm using both authorize (check and reply), executong in both steps an store procedure. The question is if is madatory use both auth or is possible use only one of them. i.e. only authorize_reply_query Thanks in advanced Guido

1 0

FreeRadius not stable on my server
by Nataniel Klug 31 Oct '06

31 Oct '06

Hello all, I am using FreeRadius to authenticate my PPPoE clients. This is the version I am using: [root@ns2 radius]# radiusd -v radiusd: FreeRADIUS Version 1.1.0, for host , built on Feb 20 2006 at 08:14:50 Copyright (C) 2000-2003 The FreeRADIUS server project. My system uses the /etc/passwd and /etc/shadow to look for a login and them let that client connect to the PPPoE concentrator. I have 4 PPPoE concetrators and I am having a problem: sometimes my freeradius get a little crazy and close some connections and other times it just says that the client is still connected and block the client to use (becouse of max login set to 1) like in this two situatios: === NO LOGIN RECORD === Fri Oct 27 08:45:37 2006 : Auth: Login OK: [pauloperez] (from client ns3 port 2846 cli 00:4F:62:02:96:00) Fri Oct 27 08:47:09 2006 : Error: rlm_radutmp: Logout for NAS ns3 port 2827, but no Login record Fri Oct 27 08:47:23 2006 : Auth: Login OK: [maquiagro] (from client ns3 port 2847 cli 00:4F:62:09:E8:BB) Fri Oct 27 08:52:13 2006 : Auth: Login OK: [joilce] (from client ema port 14413 cli 00:4F:62:04:D9:5D) Fri Oct 27 08:52:15 2006 : Error: rlm_radutmp: Logout for NAS ns3 port 2698, but no Login record Fri Oct 27 08:52:29 2006 : Auth: Login OK: [paulogava] (from client ns3 port 2860 cli 00:4F:62:09:E7:8F) === MAX LOGIN=== Fri Oct 27 08:09:00 2006 : Auth: Multiple logins (max 1) : [carine] (from client ns3 port 2769 cli 00:06:F4:0A:D6:76) Fri Oct 27 08:09:06 2006 : Auth: rlm_unix: [carine]: invalid password Fri Oct 27 08:09:06 2006 : Auth: Login incorrect: [carine/] (from client ns3 port 2770 cli 00:06:F4:0A:D6:76) Fri Oct 27 08:09:19 2006 : Auth: rlm_unix: [carine]: invalid password What can I do to make my radius system more stable? Migrate it to a MySQL solution? I have about 200 login records in most usage time and a average of 80 all day. Att, Nataniel Klug .'.

2 3

Survey Results are in.
by Alan DeKok 31 Oct '06

31 Oct '06

It's been a few weeks since the survey was started. Thanks to everyone who entered their data. The results are still coming in at about 25 per day, so I expect that these numbers will change over time. So far, we have a bit over 500 responses, which makes the data very useful. I won't get into a detailed explanation of the results, but I will hilight the numbers. I'll see if I can put some graphs on freeradius.org in a few days, too. We have the most interesting result first: ==> Total number of users who are authenticated via FreeRADIUS: 100,000,000 That's impressive. The top 30 sites alone have over 75 million users who are using RADIUS for authentication. With those numbers, it looks like 10% or more of people on the net are authenticated via FreeRADIUS. If we assume that a number of large sites haven't entered their data on the survey, then the percentage is probably much higher, like 25%. FreeRADIUS looks like it's the server of choice for the Internet. Maybe we'll make that the new slogan... ==> Total number of RADIUS servers Many sites (70%) only have 1-2, with 95% of sites having 10 or fewer servers. About 1% has 50-100 servers, though, which is impressive. ==> Databases MySQL is the clear winner at 30%. Next comes the "users" file at 10%, OpenLDAP at 17%, and Active Directory at 14%. ==> Password hashes 40% of passwords are stored as cleartext, 25% as Crypt, 20% as MD5, and 13% as NT hash. ==> Authentication Protocols PAP and CHAP are paired at about 20%. But PEAP, EAP-TLS, and TTLS are each about 10%, too. ==> Configuration updates 75% of sites change their configuration monthly to never. That statistic goes a long way to explaining why so few people need official support. :) ==> Other RADIUS servers ACS and IAS are tied at about 25% each. Cistron and OpenRADIUS are at about 10%, and Funk & Radiator are just under 10%. It looks like FreeRADIUS isn't in the top 5 of RADIUS servers, it's in the top 3, and maybe is even number one! And a large number of people have *never* used a server other than FreeRADIUS. I'm glad to see it's well received. ==> Why FreeRADIUS? Open source, cost, and feature set all came in at about 20% each. ==> What do you need most from FreeRADIUS? Something called "documentation" beat out the next nearest response by nearly 2:1. We'll see if we can work on that. Anyways, thanks for all of the response. We'll use the information to target development for future releases. Alan DeKok.

2 2

Re: RADIUS AUTHENTICATOR---need HELP using MSCHAP and NTPASSWORD
by ego seek 31 Oct '06

31 Oct '06

Message: 6 Date: Mon, 30 Oct 2006 08:25:43 -0500 From: Michael Lecuyer <mjl(a)theorem.com> Subject: Re: RADIUS AUTHENTICATOR---need HELP using MSCHAP and NTPASSWORD To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4545FD57.1030202(a)theorem.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed This pretty much sums up the problem: > rlm_mschap: No MS-CHAP-Challenge in the request This is not a valid MS-CHAP request. You might want to look at the actual attributes passed to see if this is really an MS-CHAP request. It will contain Microsoft VSAs containing a MS-CHAP-Challenge and a MS-CHAP-Response. How I can do it? ego seek wrote: > I use Squid and RADIUS. > > Squid use Squid_radius_authenticator to authenticate a client and write > a log in which there is the username and the http request. > > THE PROBLEM IS: > In the radcheck table i put a value: "AUTH-TYPE" and set "MS-CHAP" for > the user. his password is stored in NT-HASH format. > when the authenticator try to authenticate the user, this is the output > > > "....... > rad_check_password: Found Auth-Type MS-CHAP > auth: type "MS-CHAP" > Processing the authenticate section of radiusd.conf > modcall: entering group MS-CHAP for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: Found NT-Password > rlm_mschap: No MS-CHAP-Challenge in the request > modcall[authenticate]: module "mschap" returns reject for request 6 > modcall: leaving group MS-CHAP (returns reject) for request 6 > auth: Failed to validate the user. > Login incorrect:[username/password]" > > > can anybody help me? > please. > > > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Machine Accounts against AD
by King, Michael 31 Oct '06

31 Oct '06

I had this working before, and I can't figure out what I'm missing to get it working on this server. Samba Version 3.0.23b FreeRADIUS version 1.0.4 Users successfully authenticate with the domain, Machine accounts do not however. My ntlm_auth line is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" I have: with_ntdomain_hack = yes in the mschap section. The debug is below The only thing that looks different than last time is it looks like the host/ isn't getting stripped off. Should it? rad_recv: Access-Request packet from host 10.0.1.22:32769, id=171, length=324 User-Name = "host/boytel2883.campus.bridgew.edu" Calling-Station-Id = "00-90-96-F4-2A-BB" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.22 NAS-Identifier = "BUWISM2-2" Vendor-14179-Attr-1 = 0x00000007 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0207007419001703010069fad4edfbbed6d8fb51dcf6cb01ead274ca25439081be3955 bfd614a066335309bfcc72d0f20a0891d43fd085e948c3a635622fcd52658bdc817970b8 7e859a66ec970d7433349e6cbd2d19184182eb762ea246e13202349e8c32c8acd5e5c322 df88f7fd45aa24e13f State = 0xdfdc87766140b541e2ac318d7ce82e0f Message-Authenticator = 0x42318a374d505be3af9ffa7af0c39484 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 19 modcall[authorize]: module "preprocess" returns ok for request 19 modcall[authorize]: module "chap" returns noop for request 19 modcall[authorize]: module "mschap" returns noop for request 19 rlm_realm: No '@' in User-Name = "host/boytel2883.campus.bridgew.edu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 19 rlm_eap: EAP packet type response id 7 length 116 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 19 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 19 modcall: group authorize returns updated for request 19 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 19 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to host/boytel2883.campus.bridgew.edu PEAP: Adding old state with f4 4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 19 modcall[authorize]: module "preprocess" returns ok for request 19 modcall[authorize]: module "chap" returns noop for request 19 modcall[authorize]: module "mschap" returns noop for request 19 rlm_realm: No '@' in User-Name = "host/boytel2883.campus.bridgew.edu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 19 rlm_eap: EAP packet type response id 7 length 93 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 19 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 19 modcall: group authorize returns updated for request 19 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 19 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 19 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/boytel2883.campus.bridgew.edu with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: c4 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=host/boytel2883.campus.bridgew.edu --challenge=896edabb073ecbba --nt-response=ed45bb2d412865db09406089a5c4145c142b682a469717cb' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=host/boytel2883.campus.bridgew.edu --challenge=896edabb073ecbba --nt-response=ed45bb2d412865db09406089a5c4145c142b682a469717cb Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 19 modcall: group Auth-Type returns reject for request 19 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 19 modcall: group authenticate returns reject for request 19 auth: Failed to validate the user. Login incorrect: [host/boytel2883.campus.bridgew.edu] (from client localhost port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 19 modcall: group authenticate returns handled for request 19 Sending Access-Challenge of id 171 to 10.0.1.22:32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010800261900170301001b117712344a946d2ec4a5810ca84e7e8d679cd4db81a9d3ba 62f02c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xda9104a0e99cbf878c499197750025dd Finished request 19 Going to the next request Waking up in 3 seconds... rad_recv: Access-Request packet from host 10.0.1.22:32769, id=172, length=246 User-Name = "host/boytel2883.campus.bridgew.edu" Calling-Station-Id = "00-90-96-F4-2A-BB" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.22 NAS-Identifier = "BUWISM2-2" Vendor-14179-Attr-1 = 0x00000007 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020800261900170301001b8391b7780fd0e65e7da0ff923b9c0239457f612ac17c7904 4626be State = 0xda9104a0e99cbf878c499197750025dd Message-Authenticator = 0x58d7a64496d15d4c60e90495b86ab1db Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 modcall[authorize]: module "preprocess" returns ok for request 20 modcall[authorize]: module "chap" returns noop for request 20 modcall[authorize]: module "mschap" returns noop for request 20 rlm_realm: No '@' in User-Name = "host/boytel2883.campus.bridgew.edu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 20 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 20 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 20 modcall: group authorize returns updated for request 20 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 20 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 20 modcall: group authenticate returns invalid for request 20 auth: Failed to validate the user. Login incorrect: [host/boytel2883.campus.bridgew.edu] (from client BUWiSM-2-2 port 29 cli 00-90-96-F4-2A-BB) Delaying request 20 for 1 seconds Finished request 20

2 2

PROBLEM - Proxy + SQLIPPOOL + Framed-IP-Address
by Guilherme Franco 31 Oct '06

31 Oct '06

Hi, Doing proxy, freeradius always ignore the static Framed-IP-Address set in radreply table and sets the random SQLIPPOOL instead. Without proxy, SQLIPPOOL won't assign an IP from the pool and grabs the Framed-IP-Address correctly. I guess it's because the Framed-IP-Address = 255.255.255.254 contained in the Access-Accept packet from the proxy home server. Played with attrs but no luck. Please help! Thanks!

1 0