- Freeradius-Users - lists.freeradius.org

RE: freeradius and ntlm_auth howto
by Garber, Neal 27 Oct '06

27 Oct '06

Did you notice the response from ntlm_auth: Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf --challenge=decc4450c3b83d2c --nt-response=1af36673f68f926b4cc76bf8cd9f440d0c36396981ad345 Exec-Program output: Logon failure (0xc000006d) This indicates an invalid username or password. Try running "/usr/bin/ntlm_auth --username=sstruyf" and entering the same password you used in your previous test when prompted. Is the username correct? Is samba going to the correct domain by default? Did you enter the correct password? If you can't authenticate from the command line, you won't be able to do so from freeradius either.

2 1

Re: openldap+freeradius+Cisco
by jerrrry＠voila.fr 27 Oct '06

27 Oct '06

OK it works fine now with this in the users file: Robert Auth-Type = LDAP service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=1" but it is said in radius.conf not to use Auth-Type = LDAP. so is there an other solution to add this attributes in reply. Thomas > Message du 27/10/06 à 10h27 > De : "jerrrry(a)voila.fr" > A : freeradius-users(a)lists.freeradius.org > Copie à : > Objet : openldap+freeradius+Cisco > > Hi, I'm trying to authenticate and authorize Cisco routers administrators But not the autorization (privilege level). so not when i add "aaa authorization exec default group radiusvrf if-authenticated" to the cisco router to be able to manage privileges with radius. to make it work, i think i need to configure Service-Type and cisco-avpair attributes for each user to get the autorization from the cisco router. I want to configure this attributs in freeradius, not in openldap. So, is it possible to add this attributes to a specific user in the raddb/users file after he has been authenticated by ldap ? or i must do it differently ? in raddb/radiusd.conf: > authorize { > preprocess > files > ldap > } > > authenticate { > Auth-Type PAP { > pap > } > Auth-Type LDAP { > ldap > } > } I tried with a user and a DEFAULT user: raddb/users: > Robert Service-Type = NAS-Prompt-User > cisco-avpair = "shell:priv-lvl=1" > > DEFAULT Service-Type = NAS-Prompt-User > cisco-avpair = "shell:priv-lvl=1" > but this attributs seem not to be send to the routeur. when ldap is authorize in radiusd.conf, the users file is not check anymore ? Thanks for your help Thomas > > [ (pas de nom de fichier) (0.1 Ko) ]

1 0

radius + mysql problem
by balijepalli srikrishnamohan 27 Oct '06

27 Oct '06

Hello all, I am trying to configure freeradius with mysql. I did the relevent changes in radiusd.conf and when i start the server in debug mode, it is giving an error: "rlm_sql (sql): Could not link driver rlm_sql_mysq: file not found rlm_sql (sql): Make sure it (all its dependent libraries) are in the search path of your system's ld. radiusd.conf[14]: sql: Module instantiation failed." Here are the changes i made in radiusd.conf file: sqltrace=yes uncommented the line sql in Authorize section. commented the line sql in preacct section. uncommented the line sql in accounting section. Created the radius database using the schema in the file db_mysql.sql. Wht can be problem with configuration.Pls clarify any other config changes required. Thanks in advance. Regards, Sri

2 1

RE: Open access
by Jonathan De Graeve 27 Oct '06

27 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Sean > Verzonden: vrijdag 27 oktober 2006 14:20 > Aan: freeradius-users(a)lists.freeradius.org > Onderwerp: Open access > > Hi, > > I want to grant access to any user or password on my backup server. I > found DEFAULT Auth-Type := Accept in the FAQ, however it gives no hint > as to where to put the code. I've been trying various parts of > raddb.conf with no success. > Place it in users - -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98 -----BEGIN PGP SIGNATURE----- Version: 9.5.0 (Build 1202) wsBVAwUBRUIAydjY2X/BrZGJAQixcgf/Vs9sAwHNdeWNqZBlogAZCw2qXBDDg5s6 gcI8WqcqeALhdESu3oSr3AePbmrcDjZjTIqgGlNFY+Ps44xr15aRLk/kY4lPdI9N cN/Ljw1LxqrmvyI2AVHr+ELrakTWj9BYnhaRr4a/brJWgLKapz+7H7lRjPrhoimh eGgH2JgC7x4lkyWB28O/19qUR9qi/M43uSd07YxwegC8VYdtz47x5aA+uQtRt4wS lf3ZV0QHW3THMzhR1YifmDUDSWJW12fMh2D2m14mjI3+dpF005F5lzi9mpLRZ4fx Nse6gFOoEO3S6tWtn8awb0vaQMT9B5qTZl6G0v0ovymBTJP8llbtrA== =vRRD -----END PGP SIGNATURE-----

1 0

Open access
by Sean 27 Oct '06

27 Oct '06

Hi, I want to grant access to any user or password on my backup server. I found DEFAULT Auth-Type := Accept in the FAQ, however it gives no hint as to where to put the code. I've been trying various parts of raddb.conf with no success. Any help appreciated as usual. Sean Bracken

1 0

FW: SIGSEGV SEGV_MAPERR
by Barry A Byrne 27 Oct '06

27 Oct '06

[Apologies, I may have sent this before from the wrong mail-box] Hello I am running the Blastwave packaging of Freeradius 1.0.1 on Solaris 8, sparc. This interfaces with MySQL version 4.0.18-log, built from source. The RADIUS server inexplicably terminates with no core dump or logged messages The tail of a truss log shows bash-2.05# grep SEGV_MAPERR truss.log | wc -l 1766 bash-2.05# tail -20 truss.log 10471/6: 978.8120 Incurred fault #6, FLTBOUNDS %pc = 0xFED714F4 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8121 Received signal #11, SIGSEGV [caught] 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8123 sigprocmask(SIG_SETMASK, 0xFF17CFB8, 0x00000000) = 0 10471/6: 978.8124 sigprocmask(SIG_SETMASK, 0xFF188CE0, 0x00000000) = 0 10471/6: 978.8125 setcontext(0xFE702CD0) 10471/6: 978.8127 Incurred fault #6, FLTBOUNDS %pc = 0xFED714F4 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8128 Received signal #11, SIGSEGV [caught] 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8130 sigprocmask(SIG_SETMASK, 0xFF17CFB8, 0x00000000) = 0 10471/6: 978.8131 sigprocmask(SIG_SETMASK, 0xFF188CE0, 0x00000000) = 0 10471/6: 978.8132 setcontext(0xFE702CD0) 10471/6: 978.8134 Incurred fault #6, FLTBOUNDS %pc = 0xFED714F4 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8135 Received signal #11, SIGSEGV [caught] 10471/6: siginfo: SIGSEGV SEGV_MAPERR addr=0x00000003 10471/6: 978.8137 sigprocmask(SIG_SETMASK, 0xFF17CFB8, 0x00000000) = 0 10471/1: 978.8140 _exit(1) It got into a SEGV_MAPERR 1766 times while I had it under truss... This error is superficially similar to the one reported by Terry J Fike Jr in July 2004, but here the server exits voluntarily. Has this problem been encountered before? What further investigation should I do? Thank you, Barry Barry A Byrne Network Applications and Public Services Cable & Wireless

1 0

FR with AD authentication not working
by Karthik R 27 Oct '06

27 Oct '06

Using freeradius v1.1.1 on a RHEL 4 box trying to authenticate users against Windows 2003 Active directory. I was able to bind linux box to Windows domain successfully and able to read the active directory users and groups using wbinfo - u R1\Administrator R1\Guest and wbinfo -g. Using ntlm_auth tool am able to successfully authenticate the users too. -bash-3.00# ntlm_auth --request-nt-key --username=kartthikr password: NT_STATUS_OK: Success (0x0) But while using radtest tool with the same logon credentials as above it rejects the user and here is the log message. But I didnt find logon success failure in AD when i checked event viewer. rad_recv: Access-Request packet from host 127.0.0.1:32927, id=243, length=61 User-Name = "<removed>" User-Password = "<removed>" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "<removed>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 243 to 127.0.0.1 port 32927 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 243 with timestamp 45413139 Nothing to do. Sleeping until we see a request. Here is nss config file: passwd: files winbind shadow: files winbind group: files winbind hosts: files winbind nis dns protocols: files winbind # nis services: files winbind # nis netgroup: files winbind # nis automount: files winbind nis Here is radiusd.conf file: modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } So aint sure what am i missed here, any help will be appreciated.

2 1

openldap+freeradius+Cisco
by jerrrry＠voila.fr 27 Oct '06

27 Oct '06

Hi, I'm trying to authenticate and authorize Cisco routers administrators But not the autorization (privilege level). so not when i add "aaa authorization exec default group radiusvrf if-authenticated" to the cisco router to be able to manage privileges with radius. to make it work, i think i need to configure Service-Type and cisco-avpair attributes for each user to get the autorization from the cisco router. I want to configure this attributs in freeradius, not in openldap. So, is it possible to add this attributes to a specific user in the raddb/users file after he has been authenticated by ldap ? or i must do it differently ? in raddb/radiusd.conf: authorize { preprocess files ldap } authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } } I tried with a user and a DEFAULT user: raddb/users: Robert Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=1" DEFAULT Service-Type = NAS-Prompt-User cisco-avpair = "shell:priv-lvl=1" but this attributs seem not to be send to the routeur. when ldap is authorize in radiusd.conf, the users file is not check anymore ? Thanks for your help Thomas

1 0

Bug on Accouting-Requests proxying
by Geoffroy Arnoud 27 Oct '06

27 Oct '06

FreeRADIUS 1.1.3 bug - Accounting requests reemission by FreeRADIUS In file "main\request_list.c", function "refresh_request". In the case of an accounting request (request->proxy->code == PW_ACCOUNTING_REQUEST), FreeRADIUS adds to the proxied packet the attribute "Acct-Delay-Time" (or updates it, if it was present in previous emission) with value set to the time difference between current time and time of initial proxied request. According to RFC 2866, chapter 4.1 : "The Identifier field MUST be changed whenever the content of the Attributes field changes, and whenever a valid reply has been received for a previous request. For retransmissions where the contents are identical, the Identifier MUST remain unchanged. Note that if Acct-Delay-Time is included in the attributes of an Accounting-Request then the Acct-Delay-Time value will be updated when the packet is retransmitted, changing the content of the Attributes field and requiring a new Identifier and Request Authenticator." FreeRADIUS updates the content of the packet when reemitting the accounting request, but does not change the Identifier. Thus, those packets sent after the first one are *not* true reemissions. This is a problem to us. For instance, we have the following setup : A client (A) sending an accounting request to FreeRADIUS (B), which retransmits the request to a proxy FreeRADIUS server (C). FreeRADIUS C is slow to respond, so FreeRADIUS B reemits the request, with different packet attributes (Acct-Delay-Time added), but keeps the same identifier. FreeRADIUS C receives the second request, but discards it since it has the same identifier as the request currently being processed. FreeRADIUS C then decides to finally respond (to the first request). FreeRADIUS B receives this response, and verifies if the request (the reemission) and response match. They do not, thus FreeRADIUS B drops the response and logs an error. FreeRADIUS should either : - NOT add Acct-Delay-Time attribute in accounting reemissions, thus preserving the content of the attributes in the packet. - or, add an Acct-Delay-Time, but change the identifier and handle the proxied packet as a new request. The second solution seems overly complicated, because FreeRADIUS would have to handle the second proxied request as a completely new request, but would also have keep the first one, as the proxy server can respond to any of the reemissions. The first solution is very simple to correct: it simply involves removing the block "if (request->proxy->code == PW_ACCOUNTING_REQUEST) {" in function "refresh_request" of file "main\request_list.c". I don't know if Acct-Delay-Time attribute is really useful to someone, I've never seen it used in any implementation of a RADIUS server. Anyhow, it seems way too much hassle to correctly handle this attribute in accounting reemissions. If tehre is any any objection, we will develop a patch to remove Acct-Delay-Time and provide it soon. Best regards, Geoff. ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

Static IP Address allocation database - Active Directory?
by duckeo 27 Oct '06

27 Oct '06

Has anyone experimented with using Active Directory as a database for Static IP Addressing? I have two Radius groups in AD, Radius and Radius_StaticIP. If you are a member of the radius group, you are given a address by the NAS (I return 255.255.255.254 to the NAS). If you are a member of the Radius_StaticIP group I want to allocate an address out from my end, I am looking at perl at the moment but has anyone tried using a custom attribute in ActiveDirectory or similar to manage the addressing? Each account could have it's address defined in it's AD entry, but can FreeRadius look up these attributes and use them as replies? Has anyone gotten static ips to work from the client end? I'm not sure what I need to return to allow the client in a PPP dial-in session to set their own IP address in TCP/IP properties. Any help appreciated.

1 0