- Freeradius-Users - lists.freeradius.org

users file for NULL realm, LDAP for another
by John Keimel 21 Jul '06

21 Jul '06

I have two Freeradius servers, one of which authenticates MAC addresses for wireless, the other usernames(a)myrealm.com for some other network access. I'd like to combine the two of them into one server. If the username comes through without a realm (a MAC address) I'd like it to check the users file. If it comes through with a realm, just check LDAP. If the MAC address fails, it should never ever check LDAP. That just beats up the LDAP server and the LDAP admin yells (with good reason!). Should I be looking to do this just in the radiusd.conf? Or should I be attempting to mangle some kind of proxy arrangement? Would anyone care to share any sample configs for such a thing? It looks to me like there may be several ways to do this and I'd like to spend the time building up the best method. Proxy? Autz-type? I am running Freeradius 1.0.2 from Debian Sarge. I did some mailing list archive searching but I just might be checking the wrong search terms, as I'm not finding a good result. Thanks for any suggestions. j

2 1

[Fwd: IP Pool management]
by darshak＠elitecore.com 21 Jul '06

21 Jul '06

---------------------------- Original Message ---------------------------- Subject: IP Pool management From: darshak(a)elitecore.com Date: Fri, July 21, 2006 10:16 am To: freeradius-users(a)lists.freeradius.org -------------------------------------------------------------------------- Hi, I am new to radius. I want to understand functionality of IP Pool management and 802.1x,means EAP,EAP-MD5,LEAP . How can I customize the same using free radius ? Thanxs to all Darshak

1 0

Need help setting up PEAP authentication
by Reynald Borer 21 Jul '06

21 Jul '06

Hi, I'm trying to setup freeradius to authenticate users of my wireless networks and I'm facing some problems. I've tried to follow the guide located at http://www.tldp.org/HOWTO/8021X-HOWTO/ , which explains exactly the setup I would like (that is, authentication with username / password credentials). So I've setup freeradius like explained (I've already have everything needed for ssl, CA root certificate and server certificate), and I've configured my access point to use my radius server. So when I try to login, for example with wpa_supplicant, it tolds me that authentication with MSCHAPv2 went ok, and then 30 seconds later it says "Authentication timed out", and it tries to re authenticate. So I'm able to use my wireless network 30 seconds only (for example if I start up a dhcp client then I get an IP) before I'm re authenticated. I've also tried with a Windows XP client, and it continues asking me my credentials. Here is what is displayed in the logs (without verbose mode): Error: TLS_accept:error in SSLv3 read client certificate A Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) Info: rlm_eap_mschapv2: Issuing Challenge So does someone have a working freeradius configuration to share with me ? Or some tips to get it working ? Thanks in advance, Reynald Borer P.S: I'm using debian so I've recompiled freeradius to link against libssl P.S2: I've attached my freeradius config files (modified parts only). Complete files are available at http://www.borer.name/files/index.php?dir=radius/ eap { default_eap_type = peap ## default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no tls { #private_key_password = whatever private_key_file = ${raddbdir}/certs/bob.keyunsecure.pem certificate_file = ${raddbdir}/certs/newcert.pem CA_file = ${raddbdir}/certs/cacert.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes } ttls { default_eap_type = md5 use_tunneled_reply = no } peap { default_eap_type = mschapv2 } mschapv2 { } } mschap { use_mppe = yes require_encryption = yes require_strong = yes #with_ntdomain_hack = no #ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" authtype = MS-CHAP } authorize { preprocess mschap suffix # ntdomain eap files } authenticate { Auth-Type MS-CHAP { mschap } eap }

6 8

Pasword check failed [sic]
by Paul Long 21 Jul '06

21 Jul '06

Anybody know what could be wrong? This is the relevant entry in my users file: plong Auth-Type = Local, User-Password := "123" and this is a snippet of the debug output: rlm_chap: login attempt by "plong" with CHAP password rlm_chap: Using clear text password 123 for user plong authentication. rlm_chap: Pasword check failed Why might the CHAP password check fail? Paul

2 3

Problem about execute external program
by Kun Niu 21 Jul '06

21 Jul '06

Dear all, I'm trying to use an external script written by myself. And I insert the following line into my mysql database. INSERT INTO radreply( UserName,Attribute, Value ) VALUES( "123", "Session-Timeout", "%{exec:/path/to/myprogram}" ); And I insert exec into instanciate and authorize section. But the server failed to send the session-timeout to my client. the following is "myprogram" #!/usr/bin/perl -w print "Session-Timeout==1800"; And my exec section is like this: exec { wait = yes inputpairs=request outputpairs=response program="/path/to/myprogram" packet_type=Access-Accept } Have I missed anything? Any help would be appreciated and thanks in advance. Sincerely, Kun

1 0

what is .../log/radius/radacct/NULL
by Rich 21 Jul '06

21 Jul '06

I have a file named NULL in /usr/local/var/log/radius/radacct on one of my FreeRadius servers... that keeps growing and growing... it seems to be a binary equivalent of the csv files I am collecting. Application is VOIP CDR collection. It is an older version of freeradius running in a SCREEN session with 'radiusd -sfx' Problem is I think the NULL file grows until it is too big then the radiusd task crashes. This has happened once just recently. I cannot find anything about it nor how to not use it. I have 2 other FreeRadius servers running, looks like they are configured the same , they are running the same way... but do not have this file showing up... I do not see it mentioned anywhere in docs or config files. I am currently building up an FC5 server with newest rev of freeradius, but am having difficulty porting the sql.conf file. Any clues would help and be appreciated. Thanks, Rich

2 1

Proxy WinXP Computer Account
by Flyswatter 20 Jul '06

20 Jul '06

Hello All, I am having issues proxying requests to IAS when the username is in the format host/MACHINE.domain.com where domain.com is our AD name. WinXP likes to put it in that format when it logs in with the computer account. It will also be proxying for 2 other domains without any trust between them. I have it working with DOMAIN\User, but these machine accounts are baffling me. Does anyone have some pointers? It would be really appreciated! Thanks! -- View this message in context: http://www.nabble.com/Proxy-WinXP-Computer-Account-tf1977488.html#a5425247 Sent from the FreeRadius - User forum at Nabble.com.

1 0

Howto rlm_sqlippool ?
by Michael Kopp 20 Jul '06

20 Jul '06

Hi together, I configured freeradius 1.1.2 with ip-pools. Everything works fine so far. But now I want to use rlm_sqlippool module to change from flat files to mysql database for my ip pools (to achive greater performance, hopefully) So far I have compiled the rlm_sqlippool and the module library files are created and successfully installed (i verfied that the .o and .la files are in the correct folder) in radiusd.conf I uncommented the "include sqlippool.conf" and looked also at this file. But from what I can see it is only I series of SQL statements howto update and grap IP from SQL database. I am missing some description howto setup the database part, how should the database be named, and how should the needed tables look like ? Is there some howto , which explains me what steps I have to take to the rlm_sqlippools up and running ? A howto would be great, or at least some hints how the database and the tables should look like ? Is there a script for initialization ? Do I have to change anything in some other files ? sql.conf ? Regards Michael -- Echte DSL-Flatrate dauerhaft für 0,- Euro*! "Feel free" mit GMX DSL! http://www.gmx.net/de/go/dsl

1 1

mschap machine authentication
by Guillermo Vargas-DellaCasa 20 Jul '06

20 Jul '06

I'm using Free Radius 1.1.2. I wanted to share what I did to get Windows machine authentication (via ntlm_auth) to work properly in my network. After configuring FreeRadius for ntlm_auth against my windows network, I found that not all machines got authenticated. Machines with names longer than 15 characters did not get authenticated. I found out that this is because Windows supplicant send the machine name as "host/quitelongmachinename.company.domain", and the mschap module of FreeRadius strip "quitelongmachinename" and use that when running ntlm_auth (it actually uses "quitelongmachinename$". But, ntlm_auth needs "quitelongmachin$" to work (i.e. only the first 15 chars). So, I went to "src/modules/rlm_mschap/rlm_mschap.c" and changed this line: snprintf(out, outlen, "%s$", user_name->strvalue + 5); with these lines: char largo[20]=""; snprintf(largo, 16, "%s", user_name->strvalue + 5); strcat(largo, "$"); strNcpy(out,largo,17); And recompiled. That got FreeRadius to send to ntlm_auth only the first 15 chars of the machinename when doing machine authentication. I'm not a programmer so probably what's above is not the nicer way to get the idea done, but hey, it worked pretty well. Now machine authentication works no matter how long the machine name is. Thought I would share it... FreeRadius version: 1.1.2 Authentication method: PEAP-MSCHAP Client: Windows XP supplicant Authenticating against: A windows AD domain via ntlm_auth Samba version: 3.0.22 G.

2 1

I'm writing a RADIUS book... who's interested?
by Alan DeKok 20 Jul '06

20 Jul '06

I'm in the process of writing a RADIUS book, with everything I've learned over the last 10 years working with RADIUS. I'm wondering who's interested. :) The goal is to have 200-300 pages of densely packed information. The working title is "Deploying RADIUS: Practices and Principles". My main difficult is that I'm finding it hard to bootstap the book. i.e. time/money. I'm wondering who's interested in buying the book (i.e. is there a market for it). Having a known market means it's much easier for me to find the time to finish it I'm also wondering how many people are interested in buying pre-prints, with additional rights not available to the average buyer. (i.e. internal duplication, etc). This *is* a call for funding. I've been putting a lot of work into the server for many years now, and it just keeps getting bigger and better. With additional funding, I should be able to devote significantly more time to developing those features and documentation that everyone is interested in. Please respond privately with interest, if any. Alan DeKok.

2 2