- Freeradius-Users - lists.freeradius.org

Maximum timed out Session
by Elie Hani 14 Sep '06

14 Sep '06

Hi; Is there a way to disconnect a user after a certain time automatically using freeradius? I've tried the entry:"Max-All-Session" in the database, but it didn't work. Thanks Elie Hani

3 2

RADIUS proxy-----trace user site surfed------
by ego seek 14 Sep '06

14 Sep '06

Does anybody know how can I setup RADIUS and a proxy server to generate a log for the users? I need to trace where in the Internet the user went. Do yoy have any other suggestion for this pourpose? thank you. Best regards egoseek

3 2

Re: IAS and Openser
by Artur Hayne 14 Sep '06

14 Sep '06

Hello, How can I transform freeradius server in a proxy? I configured the proxy.conf, but seems dont work proxy.conf: proxy server { synchronous = no retry_delay = 5 retry_count = 3 dead_time = 120 default_fallback = yes post_proxy_authorize = no } realm DEFAULT { type = radius authhost = mydomain.br accthost = mydomain.br secret = mysecret nostrip } And I uncommnet the line in radiusd.conf: proxy_requests = yes $INCLUDE ${confdir}/proxy.conf I wanna do this: |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| Its work? And in IAS should I configured anything? Sorry for the portuguese e-mail. freeradius-users-request(a)lists.freeradius.org escreveu: Hello! This list is in English. > Como faço para transformar o Freeradius num cliente do IAS? Existe algum > tutorial, ou artigo? Se for sem passar pelo servidor freeradius eu já > configurei o radiusclient para ir direto ao IAS, mas não deu certo, nada > acontece, e o pior de tudo que não tenho nem como debugar o problema e o > arquivo de log do IAS é muito fraco. > > |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| > > Da pra fazer isso? Como faço isso? > > Alguma idéia? If I got you right, all you want to do is use FreeRADIUS as a proxy to communicate to an IAS which does the authentication. This is easy, all you need to do is proxy all incoming requests to the IAS. See proxy.conf, read it, try it, and if doesn't work for you ask here again. But in English please, it's been quite a time since I had Spanish in school. Greetings, Stefan Winter -- Stefan WINTER RESTENA Foundation - Réseau Téléinformatique de l'Education Nationale et de la Recherche R&D Engineer 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg email: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Re: PAP questions.
by Keith Woodworth 14 Sep '06

14 Sep '06

On Tue, 22 Aug 2006, Alan DeKok wrote: |->Keith Woodworth <kwoody(a)citytel.net> wrote: |->> One of the things I did try was add PAP to the authorize section, but |->> radius failed to start when I did that. |-> |-> And the error message was...? Had to put this project a side for the last 2 weeks...Hate when I have to do that. Also this post has lots of debug output. Anyway here is the error: radiusd.conf: "PAP" modules aren't allowed in 'authorize' sections -- they have no such method. radiusd.conf[1569] Failed to parse authorize section. Here is where I put pap, with all the comments stripped: authorize { preprocess # auth_log # attr_filter ### KEITH pap chap mschap # digest # IPASS # ntdomain #eap files sql # etc_smbpasswd # ldap # daily # checkval } |->> Deployingradius.com did say there were very few circumstances to set |->> Auth-Type, but not which ones. Guess I found one? |-> |-> Possibly. Much of this is fixed in CVS head, which is currently |->planned to be 2.0 before Christmas. The PAP module does more there, |->and there are MANY fewer cases where you have to set Auth-Type. At the rate I'm going, it will be Christmas before I'm ready to go. |->> How stable is the current server version? Anyone using it in production? |-> |-> Yes. A number of people. There are 3 issues that need addressing |->before it's ready for an official 2.0, however. Would it be advisable to upgrade at this point or wait till its official? |->> Sounds like I might have to be using the CVS version to do what I want |->> properly of only having the user in one table and do PAP authentication |->> with the crypt password stored in sql. |-> |-> 1.1.2 can do it, it just takes a little more configuration. |->Basically, for every user who has a Crypt-Password attribute, you have |->to set "Auth-Type = Local". Not ":=", but "=". After having to put this aside for a few weeks I have finally done some testing. One. If the user has a crypt password in radcheck: 4 | tester | Crypt-Password | := | f3RCpSYQzT292 is listed in Usergroup: 14 | tester | default And default is in radgroupcheck: +----+-----------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-------+ | 1 | default | Auth-Type | = | Local | This is the debug output: rad_recv: Access-Request packet from host 204.244.99.67:1645, id=92, length=76 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Ok, so next change radgroupcheck so Auth-Type is PAP: +----+-----------+-----------+----+-------+ | id | GroupName | Attribute | op | Value | +----+-----------+-----------+----+-------+ | 1 | default | Auth-Type | := | PAP | and do another dialup try: rad_recv: Access-Request packet from host 204.244.99.67:1645, id=93, length=76 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group PAP for request 0 rlm_pap: login attempt by "tester" with password test rlm_pap: Using password "f3RCpSYQzT292" for user tester authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: leaving group PAP (returns ok) for request 0 Sending Access-Accept of id 93 to 204.244.99.67 port 1645 Service-Type := Framed-User Framed-Protocol := PPP Framed-Compression := Van-Jacobson-TCP-IP Framed-MTU := 1500 Framed-Routing := None Framed-IP-Netmask := 255.255.255.255 Finished request 0 I get authenticated, I get an IP and away I go. Now here is the main issue: I remove the user tester from the UserGroup table but leave Auth-Type := PAP rad_recv: Access-Request packet from host 204.244.99.67:1645, id=97, length=76 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: type Crypt Sending Access-Accept of id 97 to 204.244.99.67 port 1645 Finished request 0 And while Radius seems to send an Access-Accept, the dialup user gets an error 691 password invalid. So last change set Auth-Type = Local in radgroupcheck as per the suggestion above: 1 | default | Auth-Type | = | Local Debug output: rad_recv: Access-Request packet from host 204.244.99.67:1645, id=100, length=76 NAS-IP-Address = 204.244.98.67 NAS-Port = 23 NAS-Port-Type = Async User-Name = "tester" User-Password = "test" Service-Type = Framed-User Framed-Protocol = PPP Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 radius_xlat: 'tester' rlm_sql (sql): sql_set_user escaped user --> 'tester' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'tester' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'tester' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'tester' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: type Crypt Sending Access-Accept of id 100 to 204.244.99.67 port 1645 Finished request 1 Going to the next request Again I get Access-Accept, but a 691 password error on the client side. So as I see it with this: I have to have the user listed in UserGroup AND RadCheck with a Crypt-Password attribute and RadGroupCheck with Auth-Type := PAP for the user to authenticate and be able to get online. If the username is in UserGroup AND RadCheck with the Auth-Type = Local I see this: modcall[authorize]: module "sql" returns ok for request 5 modcall: leaving group authorize (returns ok) for request 5 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. So I guess I missed something completely or its not possible to have a username ONLY listed in Radcheck with Crypt-Password and authenticate that user? Does the username really need to be be in both the UserGroup table and Radcheck table for a crypt-password method to work? Sorry for the long post. Thanks, Keith

4 7

EAP-MSChapv2 authentication
by Christopher, Paul 13 Sep '06

13 Sep '06

I have a device that uses EAP-MSCHAPv2 (without PEAP) for authentication. I am running freeRadius on Redhat. The device is plugged into a switch which sends the EAP request to the server. I am unable to get the device authenticated with the Radius server. In the users file should the Auth-type be local or MS-Chap? Should I be sending the authentication request to an NT domain or will the username and password in the user file be sufficient? Any documentation or insight would be very helpful and greatly appreciated! Below is the radius debug output. Thanks, Paul. rad_recv: Access-Request packet from host 13.138.136.68:1645, id=226, length=127 NAS-IP-Address = 13.138.136.68 NAS-Port = 50003 NAS-Port-Type = Ethernet User-Name = "tester" Called-Station-Id = "00-0A-B8-39-79-85" Calling-Station-Id = "00-00-AA-6E-78-F6" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0201000b01746573746572 Message-Authenticator = 0x7836b28d762411aa9dcd27ff0d70d047 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry tester at line 82 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient(s) please contact the sender by reply e-mail and destroy all copies of the original message. Thank you

4 8

FreeRadius Dialupadmin page not loading
by Nico Gazzano 13 Sep '06

13 Sep '06

I've got php4 installed and for some reason when I try to load the admin page it asks if I want to open or save the buttons.html.php3 file, I wasn't thinking and clicked save and now it saves the file instead of opening the admin page. Can someone help? I'm doing this locally on the server. Nico Gazzano Network & Systems Admin MIS Choice Inc. 1699 Wall ST Suite 602 Mount Prospect, IL 60056 Phone 847-690-1900 ext206 Fax 847-690-1350 nicog(a)mischoice.com

3 5

Mac authenication
by Ali Jawad 13 Sep '06

13 Sep '06

Hi Guys Ive got my pppoe server up and running and the authenication process is just fine. What I want to do now is to bind the username and password combination to a mac..so that that the mentioned user/password combination can only be used on a per pc "i.e. per mac" basis. Can anyone help me on how to do this, please. -- With Regards Ali Jawad

1 0

Question about rlm modules
by Ali Majdzadeh 13 Sep '06

13 Sep '06

Hi all What is(are) the coresponding function pointer(s) for start and stop packets in an rlm module? (Something like xxx_authenticate) Should I define my own custome funtion pointers? Then, How can I test them? Best Regards Ali

5 9

NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47
by ego seek 13 Sep '06

13 Sep '06

I'm working with mschapv2, I use a PHP web site to register a user, can i insert into the db a NT-hased password? Have I to configure the radius to accept che NT-PASSWORD value or it does by itself? thank you so much. you're so helpful. egoseek Message: 1 Date: Wed, 13 Sep 2006 10:26:52 +0100 From: Rob Shepherd <rob(a)techniumcast.com> Subject: Re: Freeradius-Users Digest, Vol 17, Issue 47 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4507CEDC.9060006(a)techniumcast.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed ego seek wrote: > thank you for yor reply. Which one? Don't top-post above an entire digest message!! > > do you know if i can use NT-PASSWORD using windowsXP client? > The windowsXP client, if configured appropriately, will use mschapv2 inside PEAP. It will be supplying an NT password hash as part of this. > do I have only modify the table insert "NT-PASSWORD" instead "PASSWORD"? Yes. However `Password` is usually a check item, for comparing clear text passwords. The `NT-Password` needs to be a config item. radiusd will figure out what to do with it. Rob

2 1

radippool table for Oracle
by Guilherme Franco 13 Sep '06

13 Sep '06

Hello, Is there anyone that managed to create a working "radippool" table for Oracle? I'm using the last CVS version of freeradius and there's a schema_sqlippool_pgsql.sql but it's only for PostGreSQL: CREATE TABLE radippool ( id serial NOT NULL, pool_name text NOT NULL, ip_address inet, nas_ip_address text NOT NULL, nas_port integer NOT NULL, calling_station_id text DEFAULT ''::text NOT NULL, expiry_time timestamp(0) without time zone NOT NULL, username text DEFAULT ''::text ); CREATE INDEX radippool_poolname_ipaadr ON radippool USING btree (pool_name, ip_address); CREATE INDEX radippool_poolname_expire ON radippool USING btree (pool_name, expiry_time); CREATE INDEX radippool_nasipaddr_port ON radippool USING btree (nas_ip_address, nas_port); CREATE INDEX radippool_nasipaddr_calling ON radippool USING btree (nas_ip_address, calling_station_id); -- NOTE: don't forget to vaccum a DB regulary -------------------------------------------------------------------------------- What can I change to make it Oracle compatible? Please, anybody can help me? Thanks very much!

2 7