- Freeradius-Users - lists.freeradius.org

ntlm_auth - rlm_mschap: No User-Password configured. Cannot create NT-Password.
by Peter de Groot 17 Jul '06

17 Jul '06

> eter de Groot <peter.de.groot(a)det.wa.edu.au> wrote: >> > I am trying to autheticate against a different domain that than the >> > samba server is joined to.. should be ok ?? > > Probably not. > >> > [root@curric4182-05 raddb]# ntlm_auth --request-nt-key >> > --domain=admin4182 --username=e2052982 >> > password: >> > NT_STATUS_OK: Success (0x0) > > That's nice, but it's not what the server is doing: > >> > radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=e2052982 >> > --domain=ADMIN4182 --challenge=7801a84637ef5c68 >> > --nt-response=4f77faa8137d60ae186c5f910fea83f936dbd827ac54f757' > > What happens when you run the above command from the command line? > > Alan DeKok. > Thanks for the reply .... I re-ran the connect and then copy and pasted onto the command line from the (radiusd -X ) log.. [root@curric4182-05 raddb]# [root@curric4182-05 raddb]# [root@curric4182-05 raddb]# /usr/bin/ntlm_auth --request-nt-key --username=e2052982 --domain=ADMIN4182 --challenge=6151ad29f27eff47 --nt-response=01e42eabc464bf9915883d804457069d4702d95534ce4d53 Logon failure (0xc000006d) [root@curric4182-05 raddb]# [root@curric4182-05 raddb]# Not good. :-( .. but they do give me the domain option .. so it "should" be ok. ? . . . Sorry ... couple more idiot (newbie) questions .... I am using PEAP with MSCHAPv2 .. and (I think) according to the how-tos .. I do NOT need ANY certificate(s) on the client PC... Is this correct ??.... or, if not .. which certificate(s) are REQUIRED on the PC... ?? I am using tinyCA with the OID extra bits for the XP extensions. Is this an error in the following certficate stuff ?? . . . rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0927], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED . . . . IS the following significant ... ?? It seems to say it cannot create the password ?? modcall: entering group MS-CHAP for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for e2052982 with NT-Password Thanks Peter de Groot Windows Re-Installation Engineer Eastern Goldfields College Ph 08) 90801800 Fax 08) 90801866 Mob 0418915312 http://egshs.wa.edu.au

3 7

Re: mysql default install schema (Matt Manjos)
by Kun Niu 17 Jul '06

17 Jul '06

Hi Matt, Here is the db_mysql.gz I copied from /usr/share/doc/freeradius/examples You can make some minor changes if you get warning when installing. Hope you good luck.:) ########################################################################### # db_mysql.sql rlm_sql - FreeRADIUS SQL Module # # # # Database schema for MySQL rlm_sql module # # # # To load: # # mysql -uroot -prootpass radius < db_mysql.sql # # # # Mike Machado <mike(a)innercite.com> # ########################################################################### # # Table structure for table 'radacct' # CREATE TABLE radacct ( RadAcctId bigint(21) NOT NULL auto_increment, AcctSessionId varchar(32) NOT NULL default '', AcctUniqueId varchar(32) NOT NULL default '', UserName varchar(64) NOT NULL default '', Realm varchar(64) default '', NASIPAddress varchar(15) NOT NULL default '', NASPortId int(12) default NULL, NASPortType varchar(32) default NULL, AcctStartTime datetime NOT NULL default '0000-00-00 00:00:00', AcctStopTime datetime NOT NULL default '0000-00-00 00:00:00', AcctSessionTime int(12) default NULL, AcctAuthentic varchar(32) default NULL, ConnectInfo_start varchar(32) default NULL, ConnectInfo_stop varchar(32) default NULL, AcctInputOctets bigint(12) default NULL, AcctOutputOctets bigint(12) default NULL, CalledStationId varchar(50) NOT NULL default '', CallingStationId varchar(50) NOT NULL default '', AcctTerminateCause varchar(32) NOT NULL default '', ServiceType varchar(32) default NULL, FramedProtocol varchar(32) default NULL, FramedIPAddress varchar(15) NOT NULL default '', AcctStartDelay int(12) default NULL, AcctStopDelay int(12) default NULL, PRIMARY KEY (RadAcctId), KEY UserName (UserName), KEY FramedIPAddress (FramedIPAddress), KEY AcctSessionId (AcctSessionId), KEY AcctUniqueId (AcctUniqueId), KEY AcctStartTime (AcctStartTime), KEY AcctStopTime (AcctStopTime), KEY NASIPAddress (NASIPAddress) ) ; # # Table structure for table 'radcheck' # CREATE TABLE radcheck ( id int(11) unsigned NOT NULL auto_increment, UserName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '==', Value varchar(253) NOT NULL default '', PRIMARY KEY (id), KEY UserName (UserName(32)) ) ; # # Table structure for table 'radgroupcheck' # CREATE TABLE radgroupcheck ( id int(11) unsigned NOT NULL auto_increment, GroupName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '==', Value varchar(253) NOT NULL default '', PRIMARY KEY (id), KEY GroupName (GroupName(32)) ) ; # # Table structure for table 'radgroupreply' # CREATE TABLE radgroupreply ( id int(11) unsigned NOT NULL auto_increment, GroupName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '=', Value varchar(253) NOT NULL default '', prio int unsigned NOT NULL default '0', PRIMARY KEY (id), KEY GroupName (GroupName(32)) ) ; # # Table structure for table 'radreply' # CREATE TABLE radreply ( id int(11) unsigned NOT NULL auto_increment, UserName varchar(64) NOT NULL default '', Attribute varchar(32) NOT NULL default '', op char(2) NOT NULL DEFAULT '=', Value varchar(253) NOT NULL default '', PRIMARY KEY (id), KEY UserName (UserName(32)) ) ; # # Table structure for table 'usergroup' # CREATE TABLE usergroup ( id int(11) unsigned NOT NULL auto_increment, UserName varchar(64) NOT NULL default '', GroupName varchar(64) NOT NULL default '', PRIMARY KEY (id), KEY UserName (UserName(32)) ) ; # # Table structure for table 'radpostauth' # CREATE TABLE radpostauth ( id int(11) NOT NULL auto_increment, user varchar(64) NOT NULL default '', pass varchar(64) NOT NULL default '', reply varchar(32) NOT NULL default '', date timestamp(14) NOT NULL, PRIMARY KEY (id) ) ; ###################################################################### # # The next two tables are commented out because they are not # currently used in the server. # # # Table structure for table 'dictionary' # #CREATE TABLE dictionary ( # id int(10) DEFAULT '0' NOT NULL auto_increment, # Type varchar(30), # Attribute varchar(64), # Value varchar(64), # Format varchar(20), # Vendor varchar(32), # PRIMARY KEY (id) #); # # Table structure for table 'nas' # CREATE TABLE nas ( id int(10) NOT NULL auto_increment, nasname varchar(128) NOT NULL, shortname varchar(32), type varchar(30) DEFAULT 'other', ports int(5), secret varchar(60) DEFAULT 'secret' NOT NULL, community varchar(50), description varchar(200) DEFAULT 'RADIUS Client', PRIMARY KEY (id), KEY nasname (nasname) ); > Date: Sun, 16 Jul 2006 18:50:03 -0400 > From: "Matt Manjos" <mattdev121(a)gmail.com> > Subject: mysql default install schema > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <3a1455400607161550q12f1809ex1e5058ee4192433a(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Hello, it's my first install of freeradius using mysql for auth and I > must be going mental because I can't seem to find the default schema > to import into sql. > > I'm using freeradius-1.1.1 on gentoo, and i've looked in > /usr/share/doc/freeradius-1.1.1/sql.schemas and all of the source code > (/src/modules/rlm_sql/drivers/rlm_sql_mysql) and I still can't seem to > find it anywhere. > > Where do I get the default schema from? > > Many Thanks, > Matt > >

2 1

mysql default install schema
by Matt Manjos 17 Jul '06

17 Jul '06

Hello, it's my first install of freeradius using mysql for auth and I must be going mental because I can't seem to find the default schema to import into sql. I'm using freeradius-1.1.1 on gentoo, and i've looked in /usr/share/doc/freeradius-1.1.1/sql.schemas and all of the source code (/src/modules/rlm_sql/drivers/rlm_sql_mysql) and I still can't seem to find it anywhere. Where do I get the default schema from? Many Thanks, Matt

2 3

Digest auth with LDAP
by Matt 17 Jul '06

17 Jul '06

Hello, I have a problem with the users file. Indeed, if I write in this file : DEFAULT Auth-Type := digest I got this error "rlm_digest: Configuration item "User-Password" or Digest-HA1 is required for authentication." So I decided to put a Digest-HA1 attribute in the users file and the auth works : DEFAULT Auth-Type := digest, Digest-HA1 := "409e2df0ac3a755199a8a91817bb87b8" But it's works of course only for my login. How to do this for different login? Thank you for your help and sorry for my English! Sincerely, Matt -- View this message in context: http://www.nabble.com/Digest-auth-with-LDAP-tf1953428.html#a5357147 Sent from the FreeRadius - User forum at Nabble.com.

2 1

certificate requirements for EAP-PEAP using Radius-to-LDAP
by Matt Ashfield 15 Jul '06

15 Jul '06

Hi All I'm trying to do EAP-PEAP (with MSCHAPv2) radius authentication against an LDAP database with my passwords stored in clear text on the directory. I'm thinking my issues right now are with certificates. Can someone give me a quick explanation of what certificate requirements I need to have on my radius server for doing the NAS-radius conversation as well as the ldap authorization. Also, what certificates do I need for/from the LDAP server? Thanks Matt mda(a)unb.ca

2 1

RE: Confused about 'hints' file
by Brenckle, Nicholas 15 Jul '06

15 Jul '06

I had incorrectly thought that the "Hint ==" portion of the entry in the hints file tied to the users file entry with the same "Hint ==" part. Sort of a "tie these two things together because they have the same name" or something. The issue is that I do not see the extra attributes passed from the entry in the users file. Service-Type = Framed-User, Framed-Protocol = PPP, X-Ascend-Data-Filter = "IP IN FORWARD TCP EST", X-Ascend-Data-Filter += "IP IN FORWARD 0 DSTIP 192.168.100.100/32", X-Ascend-Data-Filter += "IP IN DROP TCP DSTPORT = 25", X-Ascend-Data-Filter += "IP IN FORWARD 0", X-Ascend-Assign-IP-Pool = 0 So if the hints file is not needed to make sure these attributes are passed to the authenticating user, what does? The user does pass authentication correctly. Thank you, Nicholas Brenckle -----Original Message----- The question was not about "huntgroups", but "hints". hints is used during preprocess and is a packet mangler: it's the only place where you can modify and add all the request items at will. It's mostly often just used to add request items based on the prefix or suffix of the User-Name attribute for historic reasons, but it's much more powerful than just that. The only packets ignored by hints are those without a User-Name attribute (Acct-Start and -Stop mostly), this limitation is for historic reasons. If it works if you don't touch the file, and it doesn't when you do, the solution is simple: don't touch it. Greetings, Stefan Winter -- Stefan WINTER

2 1

Crypt-Password Problem
by Gary.Blydenburgh＠interactivedata.com 14 Jul '06

14 Jul '06

Excuse me if this has been asked before but I am having a hard time finding it in the archives. I have a script that builds a radius users file out of a htpasswd file, the password entries are encrypted. This worked great on a Redhat Enterprise AS 3 server running freeradius-0.9.3. I have since had to upgrade my linux box (to RHEL 4) and used the version that came with it, freeradius-1.0.1. Now users can not authenticate. Here is an entry for the user in the USERS file: juser Auth-Type := Local, Crypt-Password == "H25nfgL4rCxBY" Service-Type = Framed-User, Framed-Protocol = PPP, THIS IS THE DEBUG OUTPUT FROM THE SERVER Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. Ready to process requests. rad_recv: Access-Request packet from host 172.24.0.14:36180, id=72, length=46 User-Name = "user" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "d4lane", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched d4lane at 7993 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... CONFIG FILE: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap }

3 4

(no subject)
by Robert Dukes 14 Jul '06

14 Jul '06

Hello, Has anyone used Freeradius with Alvarion Breezeaccess to do accounting ? I am having a big issue get the the radius to understand the rodios Attribs. Or there other ways to track user traffic. We are in Russia doing a chartity project for Russian Orpahs, So any help to resolve this issues would be a big help. -- Robert Dukes

3 8

Confused about 'hints' file
by Brenckle, Nicholas 14 Jul '06

14 Jul '06

I have an entry in the hints file, that when I uncomment, the authentication fails. And I can't figure out why. When/where during the process does the hints file come into play? Im watching everything under debug mode, and I can't figure it out.... Thank you!

3 2

RADIUS , LDAP Authentication Problem
by Thato Molise 14 Jul '06

14 Jul '06

Glacier Hi all, I'm currently running redhat linux 3 ES with kernel-2.4.21-27.EL openldap-2.0.27-17, and freeradius-1.0.1-1.RHEL3. I dont have a problem authenticating RADIUS against LDAP but the major problem is RADIUS is ignoring LDAP Expiration date for unix Accounts; what causes this?

3 5