- Freeradius-Users - lists.freeradius.org

setting freeradius + ldap + linux
by R_2_S_1_T_0 21 Sep '06

21 Sep '06

I have install freeradius and linux , but not yet also succeed. user of in windows 2000 ( LDAP ) as which/such ? helping my sending mail is settinganya? thanks

1 0

working rlm_perl example ?
by Michael Gale 20 Sep '06

20 Sep '06

Hello, Does anyone have a working rlm_perl module I can test with ? I have just started out and at this point can not determine if it is my perl module that is having a problem or my radius configuration. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 1

rlm_perl with WinXP MS-CHAP clients ?
by Michael Gale 20 Sep '06

20 Sep '06

Hello, I have a freeradius 1.0.X server setup with ppp and pptp using a mysql DB for user authentication. Here I assign static IP's and users to groups. We wish to use rlm_perl instead of the sql module so we can authenticate the users against a in house application. I have build freeradius 1.1.3 from source and it seems to work however since the client is WinXP and the auth type is MS-CHAP it seems to be calling the mschap section under authentication and then exiting. Here is my debug output: rad_recv: Access-Request packet from host 127.0.0.1:32768, id=51, length=141 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "baduser" MS-CHAP-Challenge = 0x0c09ad640ce7275613b8a0dd51d2f4c6 MS-CHAP2-Response = 0x630065cbdfea16f542fbda8cdc65d7fd30930000000000000000ca32eebf6779cfb34001c39530a93ea7f5aebd54eea79f2b Calling-Station-Id = ".271" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 0 rlm_realm: No '@' in User-Name = "baduser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 perl_pool: item 0x9d5ad20 asigned new request. Handled so far: 1 found interpetator at address 0x9d5ad20 rlm_perl: MG RAD_REQUEST: Service-Type = Framed-User rlm_perl: MG RAD_REQUEST: Calling-Station-Id = .271 rlm_perl: MG RAD_REQUEST: MS-CHAP-Challenge = 0x0c09ad640ce7275613b8a0dd51d2f4c6 rlm_perl: MG RAD_REQUEST: Client-IP-Address = 127.0.0.1 rlm_perl: MG RAD_REQUEST: Framed-Protocol = PPP rlm_perl: MG RAD_REQUEST: User-Name = baduser rlm_perl: MG RAD_REQUEST: MS-CHAP2-Response = 0x630065cbdfea16f542fbda8cdc65d7fd30930000000000000000ca32eebf6779cfb34001c39530a93ea7f5aebd54eea79f2b rlm_perl: MG RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: MG RAD_REQUEST: NAS-Port = 0 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Framed-IP-Address = 255.255.255.254 rlm_perl: Added pair Framed-Compression = Van-Jacobson-TCP-IP rlm_perl: Added pair Framed-MTU = 576 rlm_perl: Added pair Framed-Protocol = PPP rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Auth-Type = MS-CHAP perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x9d5ad20 modcall[authorize]: module "perl" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for baduser with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Login incorrect: [baduser/<no User-Password attribute>] (from client localhost port 0 cli .271) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 51 to 127.0.0.1 port 32768 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 51 with timestamp 451194b6 Nothing to do. Sleeping until we see a request. -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 6

Re: sqlippool not working
by Guilherme Franco 20 Sep '06

20 Sep '06

I need to thank you again and congratulate you guys for such a great support. Question: Even with freeradius-snapshot-20060920.tar.gz I will need to use ./configure --with-modules="rlm_sqlippool"? If all works well, I assume that in radcheck table, the users need to have "Pool-Name := test_pool" right? Thanks a lot. On 9/19/06, Peter Nixon <listuser(a)peternixon.net> wrote: > On Wed 20 Sep 2006 01:51, Tuyan Ozipek wrote: > > Hi everybody, > > Sorry for not being able to cc to radius-users list. > > I will be on the list as soon as possible. > > > > > Gentlemen, > > > > > > Thank you very much for lending me your time. > > > > That's ok. Thank you for testing the software... > > > > > I'm downloading freeradius-snapshot-20060919.tar.gz right now. > > > > > > Yes, my allocate-clear is configured exactly as Tuyan's and that's why > > > I stated before that "regardless of my configuration in sqlippool.conf > > > and radiusd.conf" the trace is always empty. > > > > > > For example, if in sqlippool.conf I set sql-instance-name = "foobar", > > > the output of radiusd -X is always: > > > > > > Module: Loaded SQL IP Pool > > > sqlippool: sql-instance-name = "sql" > > > > There should be something wrong with your sqlippool.conf file, are you > > sure you are including the right one from the main radius configuration > > file? All the variables that we see in your trace, are the default > > ones.Basically we are putting them in case there is no value set for > > that variable.. > > For example : If there is no sql-instance-name set in your > > sqlippool.conf file, we set it as "sql" internally. > > > > Please double check your include paths for the sqlippool.conf file. > > Is there any sqlippool { } directives hanging around in your > > radiusd.conf? Maybe a clean install with ./configure --prefix=/xxx/xxx > > can help you to find the config problem as well.. > > My guess is that his problem is caused by the way he built sqlippool: > > > Well, I've tried to install todays freeradius CVS, and it installed > > without the sqlippool module, don't know why. > > So, I've compiled it manually from > > freeradius-snapshot-20060918/src/modules/rlm_sqlippool/ > > If he does a clean install from tonight's cvs I think everything will work as > expected. > > -- > > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc > > >

2 2

Re: IAS and Freeradius
by Artur Hayne 20 Sep '06

20 Sep '06

HI, The freeradius is comunicate with the IAS through a proxy, but dont authenticate. The windows show me this error: "Event type: Error Source: IAS A malformed request was received from client XXXX. The data is the packet." The freeradius debug: modcall[authorize]: module "auth_log" returns ok for request 3 modcall[authorize]: module "chap" returns noop for request 3 rlm_realm: Looking up realm "voip.domain.br" for User-Name = "teste(a)voip.domain.br" rlm_realm: Found realm "DEFAULT" rlm_realm: Proxying request from user teste to realm DEFAULT rlm_realm: Adding Realm = "DEFAULT" rlm_realm: Preparing to proxy authentication request to realm "DEFAULT" modcall[authorize]: module "suffix" returns updated for request 3 rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for teste(a)voip.domain.br radius_xlat: '(uid=teste(a)voip.domain.br)' radius_xlat: 'ou=users,dc=voip,dc=domain,dc=br' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,dc=voip,dc=domain,dc=br, with filter (uid=teste(a)voip.domain.br) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 3 modcall: leaving group authorize (returns notfound) for request 3 Sending Access-Request of id 3 to 10.2.1.XY port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Proxy-State = 0x323038 Re-sending Access-Request of id 0 to 10.2.1.XX port 1600 User-Name = "teste(a)voip.domain.br" Digest-Attributes = 0x0a077465737465 Digest-Attributes = 0x010e766f69702e756662612e6272 Digest-Attributes = 0x022a34353039343233343264313165616336306262366262633263373539643630666362383939656131 Digest-Attributes = 0x04127369703a766f69702e756662612e6272 Digest-Attributes = 0x030a5245474953544552 Digest-Response = "4283445dcb36643dab5f437e10f692bf" Service-Type = IAPP-Register X-Ascend-PW-Lifetime = 0x7465737465 NAS-IP-Address = 10.2.1.XX NAS-Port = 5060 Client-IP-Address = 10.2.1.XX Realm = "DEFAULT" Module-Failure-Message = "rlm_ldap: User not found" Realm = "DEFAULT" Proxy-State = 0x323035 Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.2.1.XX:33634, id=206, length=200 Ignoring duplicate packet from client OpenSER:33634 - ID: 206, due to outstanding proxied request 1. What is worng? I dont undestand: freeradius and IAS use the same protocol... It is attribute question? Cryptografy? Please any Idea... a tip anybody already had some similar experience? I tried in some ways: |Openser| -> |Freeradius| -> |AD| |Openser| -> |Radiusclient| -> |IAS| -> |AD| |Openser| -> |Freeradius| -> |IAS| -> |AD| help! thanks... --------------------------------- O Yahoo! está de cara nova. Venha conferir!

2 1

RE: realtime for freeradius
by Tariq Rashid 20 Sep '06

20 Sep '06

yes - realtime scheduling won't be of too much help for throughput-bound services buy may improve the performance characteristics of latency-bound services, especially in small size transaction services. consider clusters of proxying freeradius - no database backend - these servers merely proxy radius requests onto other servers (possibly other organisations)... would real-time scheduling improve the "jitter" at this layer which sees large numbers of small sized transactions? t -----Original Message----- From: freeradius-users-bounces+tariq.rashid=uk.easynet.net(a)lists.freeradius.or g [mailto:freeradius-users-bounces+tariq.rashid=uk.easynet.net@lists.freer adius.org]On Behalf Of Peter Nixon Sent: 20 September 2006 12:22 To: FreeRadius users mailing list Subject: Re: realtime for freeradius On Wed 20 Sep 2006 14:09, Tariq Rashid wrote: > With modern operating systems we have various server task scheduling > options available to use. > > We can either use OSes modified to provide soft real-time such as versions > of Linux. We can also ask the task schedulers to give certain processes > either higher priority or to give them real-time alike scheduling, as is > possible in Solaris and maybe Linux. > > I wonder of anyone has experimented with observing FreeRadius performance > under load conditions with these options? We shouldn't expect faster > performance, but we may achieve more consistent behaviour - for example a > smaller variance in response times. > > Thoughts and suggestions welcome. Realtime typically is used for Telecom and Telemetry applications. I can't think of any reason why you would need a radius server to run as realtime however... Generally you are in any case waiting on a backend LDAP or SQL database in any case.. Cheers -- Peter Nixon http://www.peternixon.net/ PGP Key: http://www.peternixon.net/public.asc

2 1

RE: Conditionally adding reply pair
by Garber, Neal 20 Sep '06

20 Sep '06

> You should be able to do this through the users file: >... > Just change the check and reply items where necessary. > If you don't expect to use the NetSensory huntgroup after > these lines, you may want to add the following after all > users file entries related to the NetSensory huntrgroup. I didn't think of that because LDAP-Group isn't set when files executes. But, I can move files after the ldap module in my authorize section. Then, the LDAP-Group attribute would exist in the check list. Given there will be one LDAP-Group attribute for each group in which the user is a member, will files check all of them and stop when it finds a match? If so, then I can use the users file. Thanks Kevin.

1 0

realtime for freeradius
by Tariq Rashid 20 Sep '06

20 Sep '06

With modern operating systems we have various server task scheduling options available to use. We can either use OSes modified to provide soft real-time such as versions of Linux. We can also ask the task schedulers to give certain processes either higher priority or to give them real-time alike scheduling, as is possible in Solaris and maybe Linux. I wonder of anyone has experimented with observing FreeRadius performance under load conditions with these options? We shouldn't expect faster performance, but we may achieve more consistent behaviour - for example a smaller variance in response times. Thoughts and suggestions welcome. tariq (this applies not just to freeradius but other server tasks too)

2 1

Users file and rlm_sql
by Benoît Bianchi 20 Sep '06

20 Sep '06

Hi, We are currently using freeradius with users file configuration for our Wireless system, authenticating through ldap and rlm_eap which is working fine, but wed like to use a sql database to store login/password for guest accounts. This seems to us the easiest way to manage this because well have to create and delete theses accounts from a web interface. Can we do this with rlm_sql? After lookink at the documentation and googled about this, my feeling is that using rlm_sql will prevent the server to parse the users file, but Id like the users to be parsed first and then if there is no match, the sql database to be queried. Is this possible? Do we have to create all radius tables in the sql server even if we use only the radcheck one? Here is our actual users file which I dont see how to configure with rlm_mysql: DEFAULT hint == "WPA" , FreeRADIUS-Proxied-To == 127.0.0.1, Ldap-Group != "WPA_Allowed", Auth-Type := Reject DEFAULT User-Name := "%{User-Name}" Will putting sql in the authorise section of radius.conf just after file do the trick? Thanks for your help. Benoît.

2 1

radcheck vs radreply
by Graham Beneke 20 Sep '06

20 Sep '06

I seem to have a conceptual misunderstanding of the radcheck and radreply tables - and all my googling has given me nothing solid to correct myself on. Can someone explain the difference of the 2 and what their purpose in the system is. My understanding it the radcheck is used to decide whether a user should have access to the NAS and values are then sent back from the results of these checks... The radreply is then simply a list of properties/configuration attributes that are returned to the NAS is that specific user is authorised. My confusion comes - though - due to the fact that when running a radtest on my server none of the radcheck attributes are being returned and the users are being allowed to do more than they should be as a result.

1 0