- Freeradius-Users - lists.freeradius.org

EAP-MSChapv2 authentication
by Christopher, Paul 13 Sep '06

13 Sep '06

I have a device that uses EAP-MSCHAPv2 (without PEAP) for authentication. I am running freeRadius on Redhat. The device is plugged into a switch which sends the EAP request to the server. I am unable to get the device authenticated with the Radius server. In the users file should the Auth-type be local or MS-Chap? Should I be sending the authentication request to an NT domain or will the username and password in the user file be sufficient? Any documentation or insight would be very helpful and greatly appreciated! Below is the radius debug output. Thanks, Paul. rad_recv: Access-Request packet from host 13.138.136.68:1645, id=226, length=127 NAS-IP-Address = 13.138.136.68 NAS-Port = 50003 NAS-Port-Type = Ethernet User-Name = "tester" Called-Station-Id = "00-0A-B8-39-79-85" Calling-Station-Id = "00-00-AA-6E-78-F6" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x0201000b01746573746572 Message-Authenticator = 0x7836b28d762411aa9dcd27ff0d70d047 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "tester", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 1 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry tester at line 82 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 8 for 1 seconds Finished request 8 This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient(s) please contact the sender by reply e-mail and destroy all copies of the original message. Thank you

4 8

FreeRadius Dialupadmin page not loading
by Nico Gazzano 13 Sep '06

13 Sep '06

I've got php4 installed and for some reason when I try to load the admin page it asks if I want to open or save the buttons.html.php3 file, I wasn't thinking and clicked save and now it saves the file instead of opening the admin page. Can someone help? I'm doing this locally on the server. Nico Gazzano Network & Systems Admin MIS Choice Inc. 1699 Wall ST Suite 602 Mount Prospect, IL 60056 Phone 847-690-1900 ext206 Fax 847-690-1350 nicog(a)mischoice.com

3 5

Mac authenication
by Ali Jawad 13 Sep '06

13 Sep '06

Hi Guys Ive got my pppoe server up and running and the authenication process is just fine. What I want to do now is to bind the username and password combination to a mac..so that that the mentioned user/password combination can only be used on a per pc "i.e. per mac" basis. Can anyone help me on how to do this, please. -- With Regards Ali Jawad

1 0

Question about rlm modules
by Ali Majdzadeh 13 Sep '06

13 Sep '06

Hi all What is(are) the coresponding function pointer(s) for start and stop packets in an rlm module? (Something like xxx_authenticate) Should I define my own custome funtion pointers? Then, How can I test them? Best Regards Ali

5 9

NT-PASSWORD--Re: Freeradius-Users Digest, Vol 17, Issue 47
by ego seek 13 Sep '06

13 Sep '06

I'm working with mschapv2, I use a PHP web site to register a user, can i insert into the db a NT-hased password? Have I to configure the radius to accept che NT-PASSWORD value or it does by itself? thank you so much. you're so helpful. egoseek Message: 1 Date: Wed, 13 Sep 2006 10:26:52 +0100 From: Rob Shepherd <rob(a)techniumcast.com> Subject: Re: Freeradius-Users Digest, Vol 17, Issue 47 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4507CEDC.9060006(a)techniumcast.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed ego seek wrote: > thank you for yor reply. Which one? Don't top-post above an entire digest message!! > > do you know if i can use NT-PASSWORD using windowsXP client? > The windowsXP client, if configured appropriately, will use mschapv2 inside PEAP. It will be supplying an NT password hash as part of this. > do I have only modify the table insert "NT-PASSWORD" instead "PASSWORD"? Yes. However `Password` is usually a check item, for comparing clear text passwords. The `NT-Password` needs to be a config item. radiusd will figure out what to do with it. Rob

2 1

radippool table for Oracle
by Guilherme Franco 13 Sep '06

13 Sep '06

Hello, Is there anyone that managed to create a working "radippool" table for Oracle? I'm using the last CVS version of freeradius and there's a schema_sqlippool_pgsql.sql but it's only for PostGreSQL: CREATE TABLE radippool ( id serial NOT NULL, pool_name text NOT NULL, ip_address inet, nas_ip_address text NOT NULL, nas_port integer NOT NULL, calling_station_id text DEFAULT ''::text NOT NULL, expiry_time timestamp(0) without time zone NOT NULL, username text DEFAULT ''::text ); CREATE INDEX radippool_poolname_ipaadr ON radippool USING btree (pool_name, ip_address); CREATE INDEX radippool_poolname_expire ON radippool USING btree (pool_name, expiry_time); CREATE INDEX radippool_nasipaddr_port ON radippool USING btree (nas_ip_address, nas_port); CREATE INDEX radippool_nasipaddr_calling ON radippool USING btree (nas_ip_address, calling_station_id); -- NOTE: don't forget to vaccum a DB regulary -------------------------------------------------------------------------------- What can I change to make it Oracle compatible? Please, anybody can help me? Thanks very much!

2 7

mysql failover issue
by andy 13 Sep '06

13 Sep '06

Hi, I have seen these errors when primary radius server goes offline and the secondary takes over: All requests are coming via Redback SE400: Wed Sep 13 07:51:34 2006 : Error: Dropping conflicting packet from client redback:1812 - ID: 1 due to unfinished request 1051 285 Wed Sep 13 07:51:35 2006 : Error: Dropping conflicting packet from client redback:1812 - ID: 2 due to unfinished request 1051 286 This happens on both servers and after an hour it seemed to sort itself out. Setup is as follows: 2xfreeradius server 2xmysql cluster API nodes each FR server is pointed to a different node, so when we take one node offline, the secondary defined freeradius server should kick in and talk to its API. When the primary radius server came back after its mysql API was brought back after a planned outage, the primary and secondary radius servers got confused. They both started to drop connections with the above errors and no users could authenticate. Is this issue a known issue, is there a fix, has anyone got any further info on when this would happen. Restarting the primary radius server fixed the issue however this solution is meant to be a resiliant and redundant solution capable of working through either radius or mysql node failures. any info or assistance would be helpful for my RFO here. cheers -- andy andy(a)shady.org ----------------------------------------------- Never argue with an idiot. They drag you down to their level, then beat you with experience. -----------------------------------------------

1 0

Re: Freeradius-Users Digest, Vol 17, Issue 47
by ego seek 13 Sep '06

13 Sep '06

thank you for yor reply. do you know if i can use NT-PASSWORD using windowsXP client? do I have only modify the table insert "NT-PASSWORD" instead "PASSWORD"? how then I can make the sistem work? what I have to put in the radiusd.conf? thank you. Best regards 2006/9/12, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org>: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- (Rob Shepherd) > 2. Re: FreeRadius suport IPv6 ??????????????/ (Alan DeKok) > 3. Re: Probs with pppoe-server + radius (Alan DeKok) > 4. Re: rautmp not working.. (Alan DeKok) > 5. Re: Question about rlm modules (Alan DeKok) > 6. Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- (Alan DeKok) > 7. Re: Question about rlm modules (Alan DeKok) > 8. Re: Re: Re: IAS e Openser (Artur Hayne) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 12 Sep 2006 15:09:46 +0100 > From: Rob Shepherd <rob(a)techniumcast.com> > Subject: Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4506BFAA.5060803(a)techniumcast.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > ego seek wrote: > > > > > > Does Anybody know HOW I can make radius WORK with md5-stored password in > > the db? > > > > I use EAP-PEAP-MSCHAPv2, and if the system works great if the pwds are > > in clear in the mysqlDB > > > > > You can't. See > http://deployingradius.com/documents/protocols/compatibility.html > > Store an 'NT-Password' value as a config ':=' attribute in the radcheck > table. > > NT password hashes can be generated in most programming languages. > > Rob > > -- > Rob Shepherd | Computer and Network Engineer | Technium CAST | LL57 4HJ > rob(a)techniumcast.com | 01248 675024 | 077988 72480 > > > ------------------------------ > > Message: 2 > Date: Tue, 12 Sep 2006 10:21:38 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: FreeRadius suport IPv6 ??????????????/ > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142138.F266216E1C(a)mail.nitros9.org> > > Christian Hahn <hahn(a)berkom.de> wrote: > > Do you mean IPv6 transport or support for IPv6 attributes (RFC3162)? > > RFC3162 is supported by freeradius 2.0.0-pre0 (CVS), IPv6 transport as > > far as I know is not supported. > > The CVS version also supports IPv6 transport. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 3 > Date: Tue, 12 Sep 2006 10:23:15 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: Probs with pppoe-server + radius > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142315.586D516E31(a)mail.nitros9.org> > > Ali Jawad <alijawad1(a)gmail.com> wrote: > > The info above is to help you guys in helping me pinpoint my prolem, my > > real problem is that I can dial into my server using pppoe and simple > > chap and/or pap authenication. However once I use radius to authenicate > > the pppoe-dialup requests into the server. I get the following output in > > pppd.log > > And in all of this you are carefully avoiding the one tool that > will help you solve the problem: running the server in debugging mode. > > See the README, FAQ, INSTALL. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 4 > Date: Tue, 12 Sep 2006 10:25:37 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: rautmp not working.. > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142537.9FD8616E1C(a)mail.nitros9.org> > > Collen Blijenberg <collen(a)mail.hermanjordan.nl> wrote: > > but no radutmp file is created, and if created by hand it stay's 0 > bytes... > > > > dunno my guesses tells me i forgot something... ??? > > Send the server accounting packets. radutmp is created when the NAS > agrees that the user has logged in, not when the server tells the NAS > to let the user in. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 5 > Date: Tue, 12 Sep 2006 10:26:24 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: Question about rlm modules > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142624.1F05B16E1C(a)mail.nitros9.org> > > Shankar Ganesh C <shankarganesh(a)tataelxsi.co.in> wrote: > > Could you let me know how did u capture the vendor specfic attributes in > the > > rlm_module ? > > Read the source code to rlm_files. VSA's are just normal > attributes. You can refer to them by name. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 6 > Date: Tue, 12 Sep 2006 10:27:33 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: STORE PWD using MD5 and EAP-PEAP-MSCHAPv2 for the > comunication----------------------------------- > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142733.AC4BF16E1C(a)mail.nitros9.org> > > "ego seek" <egoseek(a)gmail.com> wrote: > > Does Anybody know HOW I can make radius WORK with md5-stored password in > the > > db? > > > > I use EAP-PEAP-MSCHAPv2, and if the system works great if the pwds are > in > > clear in the mysqlDB > > http://deployingradius.com/documents/protocols/compatibility.html > > What you want to do is impossible. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 7 > Date: Tue, 12 Sep 2006 10:28:08 -0400 > From: "Alan DeKok" <aland(a)deployingradius.com> > Subject: Re: Question about rlm modules > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20060912142808.646DA16E1C(a)mail.nitros9.org> > > "Ali Majdzadeh" <ali.majdzadeh(a)gmail.com> wrote: > > What is(are) the coresponding function pointer(s) for start and stop > packets > > in an rlm module? (Something like xxx_authenticate) > > The "accounting" sections handle accounting packets. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > > > ------------------------------ > > Message: 8 > Date: Tue, 12 Sep 2006 11:41:22 -0300 (ART) > From: Artur Hayne <arturhayne(a)yahoo.com.br> > Subject: Re: Re: Re: IAS e Openser > To: freeradius-users(a)lists.freeradius.org > Message-ID: <20060912144122.13065.qmail(a)web61213.mail.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > Olá a todos, > > Como faço para transformar o Freeradius num cliente do IAS? Existe algum > tutorial, ou artigo? > Se for sem passar pelo servidor freeradius eu já configurei o radiusclient > para ir direto ao IAS, mas não deu certo, nada acontece, e o pior de tudo > que não tenho nem como debugar o problema e o arquivo de log do IAS é muito > fraco. > > |Openser| -> |Radiusclient| -> |Freeradius| -> |IAS| -> |AD| > Da pra fazer isso? Como faço isso? > > Alguma idéia? > > Obrigado. > ----------------------------- > > Marcos escreveu: > > > > > > > > > > > > > > > > > > > > > > > > > Pessoal, facam o seguinte: > > - instale o IAS no windows - esse software atua como > um radius server > - configure o freeradius para atuar como um radius > client, usando o IAS como radius server. > > pronto, assim fica mais facil. > infelizmente o windows nao eh 100% LDAP. > o AD do windows 2003 eh mais LDAP que o AD do windows > 2000, mas mesmo assim nao sao 100% compativeis com o > padrao LDAP. > > []s > > Marcos > > --- Marcelo Costa escreveu: > > > Arthur, > > > > qual ? a pesquisa que o freeradius est? fazendo no > > ldap? > > o que tem no users.conf? > > > > eu f? utilizei freeradius+ldap sem problemas. > > > > []s > > Marcelo Costa > > > > Em 20/8/2006, "Artur Hayne" > > escreveu: > > > > >Ol? a todos, > > > > > > Eu tenho um problema que parece n?o haver > > solu??o. Tenho um servidor openser que deve > > autenticar os usu?rios no servidor ldap Active > > Directory atrav?s do FreeRadius. Consigo estabelecer > > uma se??o do Freeradius com o AD, porem quando o > > usu?rio tenta se autenticar atraves de um > > softphone, passando pelo FreeRadius, aparece um > > erro. > > > > > > Vejam aqui o debug do Radius: > > > > > > radius_xlat: 'ou=bli,dc=blo,dc=blu,dc=br' > > > rlm_ldap: ldap_get_conn: Checking Id: 0 > > > rlm_ldap: ldap_get_conn: Got Id: 0 > > > rlm_ldap: performing search in > > ou=bli,dc=blo,dc=blu,dc=br, with filter (uid=jab) > > > rlm_ldap: object not found or got ambiguous > > search result <---------- essa linha!!! > > > rlm_ldap: search failed <---------- essa linha!!! > > > rlm_ldap: ldap_release_conn: Release Id: 0 > > > modcall[authorize]: module "ldap" returns > > notfound for request 47 <---------- essa linha!!! > > > modcall: leaving group authorize (returns ok) for > > request 47 > > > rad_check_password: Found Auth-Type DIGEST > > > auth: type "digest" > > > Processing the authenticate section of > > radiusd.conf > > > modcall: entering group authenticate for request > > 47 > > > rlm_digest: Configuration item "User-Password" or > > MD5-Password is required for authentication. > > <---------- essa linha!!! > > > modcall[authenticate]: module "digest" returns > > invalid for request 47 <---------- essa linha!!! > > > modcall: leaving group authenticate (returns > > invalid) for request 47 > > > auth: Failed to validate the user. <---------- > > essa linha!!! > > > > > > Eu vi alguns tutoriais mostrando como autenticar > > no dominio utilizando a ferramneta ntlm_auth, mas > > ela parece que so funciona com o protocolo mschap, > > sendo que o Openser utiliza o digest para > > autenticar. > > > No radiusd.conf o digest e o ldap est?o > > descomentados tanto para autentica??o como para > > autoriza??o. > > > ? necess?rio fazer alguma configura??o nos > > aquivos users ou em outro? > > > Eu ainda estou tentando entender um pouco mais do > > Freeradius. > > > > > > Obrigado. > > > > > > > > > > > >--------------------------------- > > > O Yahoo! est? de cara nova. Venha conferir! > > >__ > > >masoch-l list > > >https://eng.registro.br/mailman/listinfo/masoch-l > > __ > > masoch-l list > > https://eng.registro.br/mailman/listinfo/masoch-l > > > > > > > > > > > > > > --------------------------------- > Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu > celular. Registre seu aparelho agora! > > > --------------------------------- > Novidade no Yahoo! Mail: receba alertas de novas mensagens no seu celular. > Registre seu aparelho agora! >

2 1

(no subject)
by Kshitij Korde 13 Sep '06

13 Sep '06

Hi I want to manage freeradius server remotely . How do I do that on Solaris 8 box. I have SNMP package "ucd-snmp-4.1.2". I configured it. But when I try to run the snmp deamon it gives me error init_kmem: kvm_open failed: Permission denied. Thanks Kshitij ============================================================================================================================ Tech Mahindra, formerly Mahindra-British Telecom. Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/Disclaimer.html">http://tim.techmahindra.com/Disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

1 0

Using CVS, Unknown host cvs.freeradius.org. why happen error?
by 나종현 13 Sep '06

13 Sep '06

2 1