- Freeradius-Users - lists.freeradius.org

experienced FreeRadius users in Switzerland?
by Sean.Boran＠swisscom.com 27 Oct '06

27 Oct '06

Hi, I was wondering if there any Swiss based sysadmins or developers listening; I be interested in a physical meeting (BE,ZH,LS or GE) to exchange 802.1x experience and ideas. [I speak DE/FR too if that helps] Thanks in advance, Sean Boran [s e a n AT b o r a n. c o m]

1 0

RE: exec external script on successful proxy authentication
by Garber, Neal 27 Oct '06

27 Oct '06

> you are saying that it is possible to put the "exec" module into this > stage? Well, under the heading "I'd rather teach you to fish than give you a fish", you can determine this by looking at the source. If you look at the bottom of src/modules/rlm_exec.c, you'll find: module_t rlm_exec = { "exec", /* Name */ RLM_TYPE_THREAD_SAFE, /* type */ NULL, /* initialization */ exec_instantiate, /* instantiation */ { exec_dispatch, /* authentication */ exec_dispatch, /* authorization */ exec_dispatch, /* pre-accounting */ exec_dispatch, /* accounting */ NULL, /* check simul */ exec_dispatch, /* pre-proxy */ exec_dispatch, /* post-proxy */ exec_dispatch /* post-auth */ }, exec_detach, /* detach */ NULL, /* destroy */ }; This indicates that post-proxy and post-auth are valid for rlm_exec. If you do the same for rlm_files.c, you'll see NULL for post-proxy and post-auth. So, files does nothing in these stages. > If this is so, what is the syntax? In the other places exec > module was used from the users file with something like Read radiusd.conf. You would define the module and then use it in the post-proxy or post-auth section of that file.

1 0

RE: exec external script on successful proxy authentication
by Garber, Neal 27 Oct '06

27 Oct '06

> Is there a way to execute a script with the original request > attributes at the time of successul receipt of authentication reply > from a home server when FreeRADIUS is used as a proxy? We require to > execute an auxilary action on successful authentication, but currently > have only found ways to do this at the time of request. Have you looked at the post-proxy and/or post-auth stages in radiusd.conf? You could call a perl script during those stages. The request and reply attributes are available in hashes within the perl script.

2 1

Accountig-Response
by Vasea Marii 27 Oct '06

27 Oct '06

I need to configure freeradius to send specific attributes in accounting-response packet! I use a MySQL database that's why it would be nice to configure freeradius to send these attributes(in VSA ) from the database! In sql.conf there are auth_reply configuration queries but i couldn't find a way to make it for account-response! My NAS is absolutelly configurable so there is no problem with NAS understanding these new Attributes! Thanks! --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

2 6

exec external script on successful proxy authentication
by Mike 27 Oct '06

27 Oct '06

Dear list, Is there a way to execute a script with the original request attributes at the time of successul receipt of authentication reply from a home server when FreeRADIUS is used as a proxy? We require to execute an auxilary action on successful authentication, but currently have only found ways to do this at the time of request. Also, is it possible to add arbitrary attributes to the proxied response? Something just like preproxy_users, but rather post_proxyusers?

1 0

Re: FR with AD authentication not working
by Karthik R 27 Oct '06

27 Oct '06

Message: 2 Date: Fri, 27 Oct 2006 09:22:39 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: FR with AD authentication not working To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20061027082239.GB29794(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii hi, remove the System authentication line from your users file. alan Alan, I tried commenting that line, but no luck, Kartthik

1 0

How to configure/store NAS clients in LDAP instead of clients.conf
by Lenir Santiago 27 Oct '06

27 Oct '06

Hi guys, I've been looking for the past two days all over the web regarding this subject. Sorry if this question has been posted before. With rlm_sql im able to store NAS clients on a SQL table. I want to do the same but with ldap. is there a way that rlm_ldap can lookup NAS clients from my ldap server? Thanks in advance. Lenir

2 1

RE: Open access (Jonathan De Graeve)
by Sean 27 Oct '06

27 Oct '06

Hi Jonatahan, Thanks for the quick response. It worked first time. Regards, Sean http://swarmhotspots.com

1 0

freeradius and ntlm_auth howto
by Stieven.Struyf＠komatsu.eu 27 Oct '06

27 Oct '06

All, I am trying to authenticate my wifi users via our AD. I'm finding bits and pieces on the internet to configure things, but no completely usable howto. Can someone of the users look at the ouput below and point me to the correct solution/howto? I setup smb.conf,krb5.conf and freeradius. I joined the server to the domain and tested the connection with ntlm_auth: [root@belx11ke ~]# /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --domain=KMT-EU.KMTG.NET password: NT_STATUS_OK: Success (0x0) [root@belx11ke ~]# rights of the winbind pipe: ls -l /var/cache/samba/winbindd_privileged total 0 srwxrwxrwx 1 root root 0 Oct 25 14:46 pipe below is the debug output of freeradius Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d45552e4b4d54472e4e45545c73737472757966 PEAP: Setting User-Name to KMT-EU.KMTG.NET\sstruyf PEAP: Adding old state with a4 c3 PEAP: Sending tunneled request EAP-Message = 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d45552e4b4d54472e4e45545c73737472757966 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "KMT-EU.KMTG.NET\\sstruyf" State = 0xa4c337a92357e8d90a5f8c64b37d2df1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "KMT-EU.KMTG.NET\sstruyf", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "kmt-eu.kmtg.net" returns noop for request 7 rlm_realm: Looking up realm "KMT-EU.KMTG.NET" for User-Name = "KMT-EU.KMTG.NET\sstruyf" rlm_realm: Found realm "KMT-EU.KMTG.NET" rlm_realm: Adding Stripped-User-Name = "sstruyf" rlm_realm: Proxying request from user sstruyf to realm KMT-EU.KMTG.NET rlm_realm: Adding Realm = "KMT-EU.KMTG.NET" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "ntdomain" returns noop for request 7 rlm_eap: EAP packet type response id 9 length 82 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched sstruyf at 98 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns updated for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? rlm_mschap: Told to do MS-CHAPv2 for KMT-EU.KMTG.NET\sstruyf with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 95 rlm_mschap: NT Domain delimeter found, should we have enabled with_ntdomain_hack? radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challeng e=7b634e5c9dd73ddc --nt-response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=7b634e5c9dd73ddc --nt-response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972 Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 7 modcall: group Auth-Type returns reject for request 7 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 7 modcall: group authenticate returns reject for request 7 auth: Failed to validate the user. Login incorrect: [KMT-EU.KMTG.NET\\sstruyf/<no User-Password attribute>] (from client localhost port 0) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 7 Stieven Struyf M.I.S. Division - System Operations Komatsu Europe International NV Mechelsesteenweg 586 B-1800 Vilvoorde Stieven.Struyf(a)komatsu.eu Tel. +32 (0)2 2552551

5 10

HP-UX and AIX pam_radius problem
by Arthur Caetano 27 Oct '06

27 Oct '06

hi everybody, i have a problem with radius module for PAM. When i compile the source of pam_radius-1.3.16.tar, i got a lot of erros. I applied patch's available in the list, but the problems persists. In the HP-UX enviroments the messages are: begin -------------------- [root] patch_pam_radius> make gcc -z -fPIC -c pam_radius_auth.c -o pam_radius_auth.o pam_radius_auth.c: In function 'talk_radius': pam_radius_auth.c:885: warning: passing argument 6 of 'recvfrom' from incompatible pointer type pam_radius_auth.c: In function 'rad_converse': pam_radius_auth.c:1021: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1024: warning: passing argument 2 of 'conv->conv' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_authenticate': pam_radius_auth.c:1076: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1104: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1118: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1151: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_setcred': pam_radius_auth.c:1247: warning: passing argument 3 of 'pam_get_data' from incompatible pointer type pam_radius_auth.c: In function 'pam_private_session': pam_radius_auth.c:1272: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1293: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c: In function 'pam_sm_chauthtok': pam_radius_auth.c:1379: warning: passing argument 2 of 'pam_get_user' from incompatible pointer type pam_radius_auth.c:1400: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type pam_radius_auth.c:1414: warning: passing argument 3 of 'pam_get_item' from incompatible pointer type gcc -z -fPIC -c md5.c ld -b pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so patch_pam_radius> end ------------------------ Apparently it compels but the pam_radius_auth.so not work, it causes a problem in sshd, follow the error: sshd[20783]: reverse mapping checking getaddrinfo for xxxxx.xxxxx.xxx - POSSIBLE BREAKIN ATTEMPT! I Apply this patch for HP-UX: ======================================================================= Begin output listing from diff -u ======================================================================= diff -u clean/pam_radius-1.3.16/Makefile pam_radius-1.3.16/Makefile --- clean/pam_radius-1.3.16/Makefile 2003-09-19 10:41: 45.000000000 -0400 +++ pam_radius-1.3.16/Makefile 2003-12-23 11:21:26.000000000 -0500 @@ -15,7 +15,10 @@ # # If you're not using GCC, then you'll have to change the CFLAGS. # -CFLAGS = -Wall -fPIC +#CFLAGS = -Wall -fPIC +# Added by jl 12/09/2003 for HP-UX +CFLAGS = +DAportable +DSPA7100 +z +# End Add jl # # On Irix, use this with MIPSPRo C Compiler, and don't forget to export CC=cc # gcc on Irix does not work yet for pam_radius @@ -55,7 +58,10 @@ # gcc -shared pam_radius_auth.o md5.o -lpam -lc -o pam_radius_auth.so # pam_radius_auth.so: pam_radius_auth.o md5.o - ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so +# ld -Bshareable pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so +# Added by jl 12/09/2003 for HP-UX + ld -b pam_radius_auth.o md5.o -lpam -o pam_radius_auth.so +# End add jl ###################################################################### # diff -u clean/pam_radius-1.3.16/md5.c pam_radius-1.3.16/md5.c --- clean/pam_radius-1.3.16/md5.c 2002-06-28 02:29:21.000000000 -0400 +++ pam_radius-1.3.16/md5.c 2004-01-12 11:58:22.000000000 -0500 @@ -43,6 +43,12 @@ #define HIGHFIRST #endif +/* 01/12/2004 jl - Added for HPUX compiles */ +#ifdef _INCLUDE_HPUX_SOURCE +#define HIGHFIRST +#endif +/* END jl */ + #ifndef HIGHFIRST #define byteReverse(buf, len) /* Nothing */ #else diff -u clean/pam_radius-1.3.16/md5.h pam_radius-1.3.16/md5.h --- clean/pam_radius-1.3.16/md5.h 2003-04-29 16:19:16.000000000 -0400 +++ pam_radius-1.3.16 /md5.h 2003-12-16 11:33:55.000000000 -0500 @@ -15,7 +15,10 @@ #define MD5Transform pra_MD5Transform #include <sys/types.h> -#define uint32 u_int32_t +/* Added by jl */ +/* #define u_int32_t unsigned int */ +/* #define uint32 u_int32_t */ +#define uint32 uint32_t struct MD5Context { uint32 buf[4]; Only in pam_radius-1.3.16: md5.o diff -u clean/pam_radius-1.3.16/pam_radius_auth.c pam_radius-1.3.16 /pam_radius_auth.c --- clean/pam_radius-1.3.16/pam_radius_auth.c 2003-02-27 13:01:07.000000000 -0500 +++ pam_radius-1.3.16/pam_radius_auth.c 2004-01-12 12:00:52.000000000 -0500 @@ -58,6 +58,11 @@ #ifdef sun #include <security/pam_appl.h> #endif +/* Added by jl 12/09/2003 */ +#ifdef _INCLUDE_HPUX_SOURCE +#include <security/pam_appl.h> +#endif +/* End add jl */ #include <security/pam_modules.h> #include "pam_radius_auth.h" diff -u clean/pam_radius-1.3.16/pam_radius_auth.h pam_radius-1.3.16/pam_radius_auth.h --- clean/pam_radius-1.3.16/pam_radius_auth.h 2003-09-19 10:41:32.000000000 -0400 +++ pam_radius-1.3.16/pam_radius_auth.h 2003-12-09 10:20:29.000000000 -0500 @@ -66,6 +66,11 @@ */ #define CONST const #else +/* Added by jl 12/09/2003 */ +#ifdef _INCLUDE_HPUX_SOURCE +#define PAM_EXTERN extern +#endif +/* End add jl */ #define CONST const #endif ======================================================================= End output listing from diff -u ======================================================================= In AIX i applied this modifications in md5.h, md5.c and pam_radius_auth.h - change to the md5.h file. Change line 18 from: #define uint32 u_int32_t to #define uint32 uint32_t - in md5.c, insert to line 38 (before any #include lines) #define __sparc - in pam_radius_auth.h, line 60, insert after the comment section but before "#ifdef sun": #define sun the output for the command cc -z -fPIC -c md5.c -o md5.o it's ok. No errors. the output for the command cc -z -fPIC -c pam_radius_auth.c -o pam_radius_auth.o. the following ones: pam_radius_auth.c: In function `talk_radius': pam_radius_auth.c:880: warning: passing arg 6 of `nrecvfrom' from incompatible pointer type pam_radius_auth.c: In function `rad_converse': pam_radius_auth.c:1016: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1019: warning: passing arg 2 of pointer to function from incompatible pointer type pam_radius_auth.c: In function `pam_sm_authenticate': pam_radius_auth.c:1071: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1099: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1113: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1146: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_setcred': pam_radius_auth.c:1242: warning: passing arg 3 of `pam_get_data' from incompatible pointer type pam_radius_auth.c: In function `pam_private_session': pam_radius_auth.c:1267: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1288: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c: In function `pam_sm_chauthtok': pam_radius_auth.c:1374: warning: passing arg 2 of `pam_get_user' from incompatible pointer type pam_radius_auth.c:1395: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1404: warning: passing arg 3 of `pam_get_item' from incompatible pointer type pam_radius_auth.c:1409: warning: passing arg 3 of `pam_get_item' from incompatible pointer type When i try the ld: ld -G md5.o pam_radius_auth.o -o pam_radius_auth.so the following ones occurs: ld: 0711-327 WARNING: Entry point not found: __start ld: 0711-244 ERROR: No csects or exported symbols have been saved. I'm really need of this solution. Somebody can help me, with this problems??? -- Arthur

1 0