- Freeradius-Users - lists.freeradius.org

FreeRadius + NIS
by Dagoberto Carvalio Junior 26 Oct '06

26 Oct '06

Expensive friends, I am with authentication problem, being that I opted to using the FreeRadius. I ask for the gentility you to answer if the FreeRadius has support to catch the base of users of a server NIS. It forgives for my English, therefore I am Brazilian. Until more, and thanks. Dagoberto Carvalio Junior Analyst Systems - Universidade de São Paulo. -- ######################################################## Dagoberto Carvalio Junior - CCNA/CCAI/FCPF/FCPM/SCS Analista de Sistemas Instituto de Ciencias Matematicas e de Computacao UNIVERSIDADE DE SAO PAULO USER LINUX #417157 EMail : dago(a)icmc.usp.br Tel : 55 16 3373-9652 ########################################################

1 0

Q:ABOUTE:GET AN ATTRIBUET FROM NAS TO CHANGE QUERY IN RADIUS
by Alejandro Sanchez 26 Oct '06

26 Oct '06

Hi evreybody. I need to get the attribute Caller-Station-ID and then include in the "where" section of the query that access the table radreply. This is because i have only 1 user to access the IP net from PSTN but i need send back different values to the device dependeing what station is calling. How can i get this behavor? Thank's in Advanced ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Double-free in src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c causes crash on HUP
by Phil Mayers 26 Oct '06

26 Oct '06

At least on RHEL4 with glibc 2.3.4-2.13, a double-free in the above file causes a crash on HUP in some circumstances. I've confirmed that removing this fixes the issue. 459 460 free(conf->check_cert_cn); 461 free(conf->check_cert_cn); 462 free(conf->cipher_list);

2 2

RE: freeradius and ntlm_auth howto
by Jonathan De Graeve 26 Oct '06

26 Oct '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 The debugging output is exactly saying whats wrong Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) This dir should be readable by freeradius AND winbind. I thought 750 would work J. - -- Jonathan De Graeve IMELDA vzw Informatica Dienst Network System Engineer jonathan.de.graeve(a)imelda.be +32(0)15/50.52.98 > -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens > Stieven.Struyf(a)komatsu.eu > Verzonden: donderdag 26 oktober 2006 16:24 > Aan: freeradius-users(a)lists.freeradius.org > Onderwerp: freeradius and ntlm_auth howto > > > All, > I am trying to authenticate my wifi users via our AD. I'm finding bits and > pieces on the internet to configure things, but no completely usable > howto. > Can someone of the users look at the ouput below and point me to the > correct solution/howto? > > I setup smb.conf,krb5.conf and freeradius. I joined the server to the > domain and tested the connection with ntlm_auth: > [root@belx11ke ~]# /usr/bin/ntlm_auth --request-nt-key --username=sstruyf > --domain=KMT-EU.KMTG.NET > password: > NT_STATUS_OK: Success (0x0) > [root@belx11ke ~]# > > rights of the winbind pipe: > ls -l /var/cache/samba/winbindd_privileged > total 0 > srwxrwxrwx 1 root root 0 Oct 25 14:46 pipe > > below is the debug output of freeradius > > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 7 > rlm_eap: Request found, released from the list > rlm_eap: EAP/peap > rlm_eap: processing type peap > rlm_eap_peap: Authenticate > rlm_eap_tls: processing TLS > eaptls_verify returned 7 > rlm_eap_tls: Done initial handshake > eaptls_process returned 7 > rlm_eap_peap: EAPTLS_OK > rlm_eap_peap: Session established. Decoding tunneled attributes. > rlm_eap_peap: EAP type mschapv2 > rlm_eap_peap: Tunneled data is valid. > PEAP: Got tunneled EAP-Message > EAP-Message = > 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 > 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d4555 > 2e4b4d54472e4e45545c73737472757966 > PEAP: Setting User-Name to KMT-EU.KMTG.NET\sstruyf > PEAP: Adding old state with a4 c3 > PEAP: Sending tunneled request > EAP-Message = > 0x020900521a0209004d3137d2b9533b5dbce9ca720a00d56208c30000 > 0000000000008a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972004b4d542d4555 > 2e4b4d54472e4e45545c73737472757966 > FreeRADIUS-Proxied-To = 127.0.0.1 > User-Name = "KMT-EU.KMTG.NET\\sstruyf" > State = 0xa4c337a92357e8d90a5f8c64b37d2df1 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 7 > modcall[authorize]: module "preprocess" returns ok for request 7 > modcall[authorize]: module "mschap" returns noop for request 7 > rlm_realm: No '@' in User-Name = "KMT-EU.KMTG.NET\sstruyf", looking up > realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "kmt-eu.kmtg.net" returns noop for request 7 > rlm_realm: Looking up realm "KMT-EU.KMTG.NET" for User-Name = "KMT- > EU.KMTG.NET\sstruyf" > rlm_realm: Found realm "KMT-EU.KMTG.NET" > rlm_realm: Adding Stripped-User-Name = "sstruyf" > rlm_realm: Proxying request from user sstruyf to realm KMT-EU.KMTG.NET > rlm_realm: Adding Realm = "KMT-EU.KMTG.NET" > rlm_realm: Authentication realm is LOCAL. > modcall[authorize]: module "ntdomain" returns noop for request 7 > rlm_eap: EAP packet type response id 9 length 82 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 7 > users: Matched sstruyf at 98 > modcall[authorize]: module "files" returns ok for request 7 > modcall: group authorize returns updated for request 7 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 7 > rlm_eap: Request found, released from the list > rlm_eap: EAP/mschapv2 > rlm_eap: processing type mschapv2 > Processing the authenticate section of radiusd.conf > modcall: entering group Auth-Type for request 7 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > rlm_mschap: Told to do MS-CHAPv2 for KMT-EU.KMTG.NET\sstruyf with NT- > Password > radius_xlat: Running registered xlat function of module mschap for string > 'Challenge' > mschap2: 95 > rlm_mschap: NT Domain delimeter found, should we have enabled > with_ntdomain_hack? > radius_xlat: Running registered xlat function of module mschap for string > 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=sstruyf -- > challeng e=7b634e5c9dd73ddc --nt- > response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972' > Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=sstruyf -- > challenge=7b634e5c9dd73ddc --nt- > response=8a0b7468748de41ff9fc510e9cc7afb6e1f9faaf0d9a9972 > Exec-Program output: winbind client not authorized to use > winbindd_pam_auth_crap. Ensure permissions on > /var/cache/samba/winbindd_privileged are set correctly. > (0xc0000022) > Exec-Program-Wait: plaintext: winbind client not authorized to use > winbindd_pam_auth_crap. Ensure permissions on > /var/cache/samba/winbindd_privileged are set correctly. (0xc0000022) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > modcall[authenticate]: module "mschap" returns reject for request 7 > modcall: group Auth-Type returns reject for request 7 > rlm_eap: Freeing handler > modcall[authenticate]: module "eap" returns reject for request 7 > modcall: group authenticate returns reject for request 7 > auth: Failed to validate the user. > Login incorrect: [KMT-EU.KMTG.NET\\sstruyf/<no User-Password attribute>] > (from client localhost port 0) > Processing the post-auth section of radiusd.conf > modcall: entering group Post-Auth-Type for request 7 > > Stieven Struyf > M.I.S. Division - System Operations > Komatsu Europe International NV > Mechelsesteenweg 586 > B-1800 Vilvoorde > Stieven.Struyf(a)komatsu.eu > Tel. +32 (0)2 2552551 -----BEGIN PGP SIGNATURE----- Version: 9.5.0 (Build 1202) wsBVAwUBRUDJDNjY2X/BrZGJAQjchQf/QUKfxpmDYdPgui8BqBOLGnp9SeO/v97+ QJZa0iCfSPX7Sr2GoXq+lK4s5a+vFnyqTm2s1kHwCcZif4PaUAjmXf0kjsPiV4X9 IIeImenaGNnS8iEFmIWEaP7WnzrB8/rPAeA1xnSyML06g7ejyMK23b50NwcWUyrf lnPPrGxLLOu1FUg94NI28iVtwLs9eqoHKyAKddaw42m9IXomuc7rZDBYBRO6bNvv /3E9TZMLszpe2oy6SEIItNyx9qjZTZtP2K1KSBS1ING9rI6EIYL505aQ9OPYzj9t HsP0HnpdvZJL8D0EtcSxzzoQLuC5wPzBjlWmGUGtsDY/8Wil9fx07A== =wrIA -----END PGP SIGNATURE-----

1 0

Freeradius server can not see any request from clients.
by richard Bai 26 Oct '06

26 Oct '06

Hi, everyone, I face a very strange problem right now when I configure a freeradius server with PEAP + LDAP. I can start the radius in debug mode properly. I get following lines: Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Then I did test by using " *radtest username password localhost 0 sharedsecret*" And the radius server replied with Access-Accept message. So, I think the serve works just fine. But when I tested by using "*radtest username password IP of server 0 sharedsecret*" from a client conneted to the server through a hub, I can not get anything back. I even did not see any Access-Request information in debug mode on the radius server. It looks like the radius doesn't receive anything. However, I sniffered the interface via Ethereal and used " tcpdump -v port 1812 " in the server, I do see the Access-Request packet received by the interface on the server, I confirmed that the 1812 port is open. Please give me some idea. Any advices or solution is welcome. Thank you very much! Best Regards Richard

4 5

Radius Attributes
by Manuel Sánchez Cuenca 26 Oct '06

26 Oct '06

Hello all, How must I configure my freeradius server to include in the Access-Accept response to the AP several radius attributes such as Session-Timeout or Framed-IP-Address? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

1 0

rlm_krb5
by Stieven.Struyf＠komatsu.eu 26 Oct '06

26 Oct '06

3 5

Important question about module instantiation
by Guilherme Franco 25 Oct '06

25 Oct '06

Hello, In sqlippool.conf I've instantiated: sqlippool DYNAMIC{ ... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{check:Pool-Name}' AND expiry_time < 'now'::timestamp(0) \ ORDER BY RANDOM() \ LIMIT 1 \ FOR UPDATE" ... } sqlippool STATIC{ ... allocate-find = "SELECT framedipaddress FROM ${ippool_table} \ WHERE pool_name = '%{check:Pool-Name}' AND expiry_time < 'now'::timestamp(0) \ ORDER BY (username <> '%{SQL-User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time \ LIMIT 1 \ FOR UPDATE" ... } So, the first one allocates dynamic IP addresses to the user and the second assigns static ones. Then in radiusd.conf: post-auth { DYNAMIC STATIC ... } The problem is: when someone who have Pool-Name := STATIC in radcheck logs in, the sqlippool module used for assigning IP to that user is DYNAMIC because it was called first than STATIC in radiusd.conf. As a result the user get a dynamic IP. That's a problem. What can I do to solve this, please? Thank you.

1 0

Error: Assertion failed in listen.c, line 620
by Guilherme Franco 25 Oct '06

25 Oct '06

Hello, Whenever I run "radiusd" alone, without the "-X" this error occurs in the first authentication request: Error: Assertion failed in listen.c, line 620 This line indicate the proxy part. Running CVS "radiusd -X" generates no error at all. Any clues? Thanks.

2 4

Freeradius and FreeBSD 4.1.1
by Paul Lambert 25 Oct '06

25 Oct '06

Hi, I have just installed Freeradius onto a dedicated hosted server I have recently started to use. The hosting company have FreeBSD 4.1.1 installed and as such, things are a little tricky to get running out of the box! I have had to add an include to sys/types.h into src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c, and also choose to build it without thread support.... ./configure --with-threads=no All seems to have gone in OK, and its happily communicating with my SQL database, and my NAS's.... Now, my question is in regard to what impact my "tweaks" will have.... Should I expect a dramatic performance loss due to the exclusion of threading??? Also, have I missed anything that might come back and bite me in the proverbial??? Many thanks in advance, Paul.

1 0