- Freeradius-Users - lists.freeradius.org

3com wx - peap-mschapv2 - freeradius - mysql
by news.gmane.org 30 Oct '06

30 Oct '06

Hello, I have a wireless network based on wx switch 3com (centrally managed access-point) and I'm trying to activate WPA protection on one ssid "wpa-experimental". I hope to have configured all the component correctly. When I attempt to connect, on radius log (started by radiusd -X) I see: rad_recv: Access-Request packet from host 149.139.32.61:20001, id=118, length=148 NAS-Port-Id = "2/1" Calling-Station-Id = "00-08-E3-B0-73-46" Called-Station-Id = "00-12-A9-17-08-40:wpa-experimental" Service-Type = Framed-User EAP-Message = 0x0201000d0161676f7374696e69 User-Name = "agostini" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "3Com" NAS-IP-Address = xxx.xxx.xxx.xxx Message-Authenticator = 0x3c8c9588223b33c4a8dafd70db73e334 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 203 modcall[authorize]: module "preprocess" returns ok for request 203 modcall[authorize]: module "chap" returns noop for request 203 modcall[authorize]: module "mschap" returns noop for request 203 rlm_realm: No '@' in User-Name = "agostini", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 203 rlm_eap: EAP packet type response id 1 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 203 radius_xlat: 'agostini' rlm_sql (sql): sql_set_user escaped user --> 'agostini' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'agostini' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id' rlm_sql_mysql: query: SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'agostini' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'agostini' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 203 users: Matched DEFAULT at 155 modcall[authorize]: module "files" returns ok for request 203 modcall: group authorize returns updated for request 203 rad_check_password: Found Auth-Type EAP rad_check_password: Found Auth-Type Local Warning: Found 2 auth-types on request for user 'agostini' auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [agostini/<no User-Password attribute>] (from client Wx1200-B1D port 0 cli 00-08-E3-B0-73-46) Delaying request 203 for 1 seconds Finished request 203 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 118 to 149.139.32.61:20001 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 203 ID 118 with timestamp 44896cc8 Nothing to do. Sleeping until we see a request. Have you any idea what is wrong? Thank you in advance A Agostini

6 11

RADIUS AUTHENTICATOR---need HELP using MSCHAP and NTPASSWORD
by ego seek 30 Oct '06

30 Oct '06

I use Squid and RADIUS. Squid use Squid_radius_authenticator to authenticate a client and write a log in which there is the username and the http request. THE PROBLEM IS: In the radcheck table i put a value: "AUTH-TYPE" and set "MS-CHAP" for the user. his password is stored in NT-HASH format. when the authenticator try to authenticate the user, this is the output "....... rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 auth: Failed to validate the user. Login incorrect:[username/password]" can anybody help me? please.

2 1

How does freeradius calculate the number of required threads?
by Pshem Kowalczyk 30 Oct '06

30 Oct '06

Hi group, I'm trying to figure out optimal configuration for our radius-proxy farm. atm the farm is handling about 10-15 req/sec per device with the following config (two servers, load-balanced using an slb) thread pool { start_servers = 20 max_servers = 120 min_spare_servers = 20 max_spare_servers = 70 max_requests_per_server = 300 } perl { {...} max_clones = 100 start_clones = 20 min_spare_clones = 20 max_spare_clones = 50 cleanup_delay = 5 max_request_per_clone = 100 } With this configuration both servers run between 25 and 35 threads. Everything is fine (except for huge memory consumption), but when i try to point another device to the load balanced ip (device creates about 15-20req/sec (auth+acct)) freeradius starts spawning threads untill it hits the limit (both freeradius and rlm_perl) and then it locks. I suppose the problems are caused by the fact that the number of requests increases so suddenly, but I have no other way of switching the device over. Is there any way I can influence that behaviour? I suspect that about 50-60 threads would do the job, but if i drop the limit to 60 it just locks quicker. Any ideas how to fix that? regards pshemko

2 5

FreeRadius User config file
by Uma Palvannan 30 Oct '06

30 Oct '06

Hi All, I am currently configuring power distribution units(PDU) in our organisation, authentication from freeradius-1.0.1-3.RHEL4.3 1. I have configured the dictionary file accordingly. client 131.xxx.xx.xxx { secret =abcdeffghijk shortname =PDU1 } client 131.xxx.xx.xxx { secret =lmnoopqrstuve shortname =PDU2 } 2. I have also defined the ATTRIBUTE and VALUE the dictionary file as per APC vendor's instructions VENDOR APC 318 BEGIN-VENDOR APC ATTRIBUTE APC-Service-Type 1 integer APC VALUE APC-Service-Type Admin 1 VALUE APC-Service-Type Device 2 VALUE APC-Service-Type ReadOnly 3 3. I have modified the users file , created groups and outlet access for each group. In the below example,I have given group3 access to outlet3. DEFAULT Group == "group3", Auth-Type = System APC-Service-Type = Outlet, APC-Outlets = "3", Fall-Through = No 4. Now, I have 20 PDUs setup (in pair) and I also would like to restrict the subnets that it can authenticate from. I would like to set up a rule in user file as following: If pdu1 or pdu2 {if group1 and authenticated from the approved subnets Then APC-Service-Type = Outlet, APC-Outlets = "1", } ....And so on for the rest of PDU pairs. Has anyone done a similar setup before? If so, could you please shed light? Thanks in advance Uma u.palvannan(a)qut.edu.au

1 0

RE: Static IP Address allocation database - Active Directory?
by Jonathan De Graeve 30 Oct '06

30 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > Has anyone experimented with using Active Directory as a database for > Static IP Addressing? Yes, just assign a static ip in the AD dial-in properties for that user and adapt the ldap.attrmap accordingly, this works perfectly. There is no need to make a user member of a 'radius_staticip' Group. J. - -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98 -----BEGIN PGP SIGNATURE----- Version: 9.5.0 (Build 1202) wsBVAwUBRUG6jdjY2X/BrZGJAQgslggAmOMNyQR2lingFOOZas2+tRm2DM7+LgrG A8PNHcGxeMIWhtksMm++/nWwwZgK0PrBXECeX13fJf+mmgt3U1V1oXsD58HUAFJj VW+PW9O8o8ef5Br+03pzrIV0enZ6N4AmUOz42JudO4qPrUdrE7SyKDkz41vu8gSz dhW7SO9nTR7h9r688XqJnQU+w6ZQi2AUTumQ+9rvNn6UMS7AhzoNm0naH5tTp0Ql LUPEMByf4O6e4Ucuqd1SJk+gyeKD+ZsZ93YzmFP8btevLAnIw3VK2lnT0gwcejlD FIlkGc7Rt+DJ9Dznn3BXk19hZxNqnsPBDs1rZOX8nGdo7uLdjHctSQ== =tLiY -----END PGP SIGNATURE-----

2 4

Question about rlm modules
by Ali Majdzadeh 29 Oct '06

29 Oct '06

Hi all Is it possible to send Vendor Specific Attributes through an rlm module? I use the following method to send standard attributes through an rlm module: (As suggested by the template itself) * *reply = pairmake ("User-Name", "root", T_OP_EQ); pairadd (&request->reply->vps, reply); request->reply->code = PW_USER_NAME; DEBUG ("rlm_cmod: Sending User-Name"); What specific code should I use when for example I want to send h323-credit-amount attribute to a NAS? Best Regards Ali

2 1

RE: Peap mschapv2 proxy early termination of EAP
by Yogesh Nagarkar 28 Oct '06

28 Oct '06

EAP-PEAP-MSCHAPv2 hack for FreeRADIUS 1.1.3 If anyone has been following the threads http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg30477.… http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg22903.… The solution was: Edit : freeradius-1.1.3/src/main/request_list.c Comment out line 321: ----------------------------------------- proxy_ipaddr = listener->ipaddr; change to /*proxy_ipaddr = listener->ipaddr;*/ ----------------------------------------- Comment out line 797: request->proxy->src_ipaddr = proxy_ipaddr; Change to /*request->proxy->src_ipaddr = proxy_ipaddr;*/ ---------------------------------------- Compile request_list.c make && make install and we have FreeRADIUS 1.1.3 successfully authenticating: Microsoft Windows Supplicant -------> Request--------> Proxy Server -------- MSCHAPv2------> Home Server (WPA1/TKIP/PEAP) (PEAP tunnel ends) (Access Accept) Microsoft Windows Supplicant <------- Response------ Proxy Server <--------- MSCHAPv2------ Home Server (success) (Copy to PEAP tunnel) -------------------------------------------------- /etc/raddb/users file (proxy server) DEFAULT User-Name =~ "@somerealm.net", FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := inner-somerealm /etc/raddb/proxy.conf file (proxy server) realm somerealm.net { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm inner- somerealm{ type = radius authhost = xxxxxxxxx:1645 accthost = xxxxxxxxx:1646 secret = xxxxxxxx ldflag = round_robin nostrip } ------------------------------------------------- /etc/raddb/users file (home server) kirkhammet(a)somerealm.net User-Password == xxxxxxxxxx Reply-Message = "Enter Sandman!" ------------------------------------------------- Good luck :) Yogesh Nagarkar ------------------- Related thread ---------------------------------- I have tried the examples in those postings as well as suggestions from other postings without any success. I have started with the default config and turned on the debug option. However, looking at the debug output yet I couldn't quite figure out what went wrong. What I got so far is as follow: 1) Send a PEAP/MSCHAPv2 request using Linux's Xsupplicant or Mac client to the proxy radius 2) Proxy radius terminated EAP locally and proxied request (MSCHAPv2 minus EAP) to home radius 3) Home radius responded with an access-accept packet to proxy radius 4) Proxy Radius sent access-reject to client. See error output below. Tue Oct 3 20:10:37 2006 : Debug: rlm_eap: Request not found in the list Tue Oct 3 20:10:37 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Tue Oct 3 20:10:37 2006 : Debug: rlm_eap: Failed in handler I am running Freeradius 1.1.3 and have attached below my configuration files and an excerpt of the debug output hoping that the mistake would look obvious to some of you and that you could provide some helpful pointers or links. Thanks a lot for your help. -David In case, anyone is following this thread, the problem was solved by downgrading from Freeradius 1.1.2 and above running on Solaris 9 down to Freeradius 1.0.5 running on the same OS. Still tracing this issue through the debugger and will post to this thread if more information is available. Best, David ----------------------------------------------------------------------

1 0

Why is radiusd command not found?
by Chad Best 28 Oct '06

28 Oct '06

This is a total newbie question, but I can figure out the answer to it so I decided to post here. I have installed Freeradius-1.0.0(little behind the times, I know). After I finished configuring the radiusd.conf, eap.conf, and users files, I tried to start FreeRadius in debug mode. However, when I type "radiusd -X", I get command not found. What did I do wrong? When I installed the program, I just ran ./configure, make, make install so it should have installed properly. Any help would be greatly appreciated.

3 2

SQLIPPOOL problem
by Guilherme Franco 28 Oct '06

28 Oct '06

Hi, This is very important, please. In ippool module I can use two or more pools just by setting ippool POOL1{...} ippool POOL2{...} In SQLIPPOOL, I know that I can create as many pools as I wan't but I need to treat that pools differently, say, POOL1 assigns static IPs and POOL2 dynamic ones, or POOL1 is in databaseX and POOL2 in databaseY. So I did this sqlippool.conf: sqlippool POOL1{...} sqlippool POOL2{...} And then in radiusd.conf post-auth{ POOL1 POOL2 } But the user that have Pool-Name := POOL2 in radcheck receives the IP (because POOL2 exists in the database), but it's not treated by the POOL2 instance created in sqlippool.conf (radiusd -X shows that both module POOL1 and POOL2 are instantiated), it's being treated by the POOL1 instance. So, how can I tell that for users that belong to POOL2 use the POOL2 module, instead of POOL1 and vice-versa? Thank you.

2 2

RE: FR with AD authentication not working
by Karthik R 28 Oct '06

28 Oct '06

> -----Original Message----- > But while using radtest tool with the same logon credentials > as above it rejects the user and here is the log message. Please paste the entire debug log. It looks like you missed a few bits in the cut and paste. Mike, Here is the entire debug log. In the users file, auth-type =system has been commented out. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Respo nse:-00}" Module: Instantiated mschap (mschap) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32772, id=101, length=61 User-Name = "<removed>" User-Password = "<removed>" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "<removed>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 101 to 127.0.0.1 port 32772 Waking up in 4 seconds... Kartthik

2 1