- Freeradius-Users - lists.freeradius.org

RE: peap with mysql
by Chris Liles 19 May '06

19 May '06

Please forgive my ignorance, but can you be a little bit more specific. I tried putting the following in the database: mysql> select * from radcheck; +----+----------+------------------------+----+--------+ | id | UserName | Attribute | op | Value | +----+----------+------------------------+----+--------+ | 1 | temptest | Password | := | authme | | 2 | temptest | MS-CHAP-User-NTLM-Auth | == | No | +----+----------+------------------------+----+--------+ I added the following to dictionary: ATTRIBUTE MS-CHAP-User-NTLM-Auth 3003 string But I am still seeing the call made for ntlm authing: radius_xlat: 'temptest' rlm_sql (sql): sql_set_user escaped user --> 'temptest' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'temptest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'temptest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'temptest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'temptest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [temptest] modcall[authorize]: module "sql" returns notfound for request 16 modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 16 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for temptest with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d2 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=temptest --challenge=f323f6e00a6e7eef --nt-response=adbc3550e29c702918ea4c1a3f6a5811d1b58dbfcf3a21d2 --require-membership-of=DOMAIN+wifi-secure' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=temptest --challenge=f323f6e00a6e7eef --nt-response=adbc3550e29c702918ea4c1a3f6a5811d1b58dbfcf3a21d2 --require-membership-of=DOMAIN+wifi-secure Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 16 modcall: leaving group MS-CHAP (returns reject) for request 16 I'm guessing that I need to put the MS-CHAP-User-NTLM-Auth somewhere else?? -- Chris Liles -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Thursday, May 18, 2006 8:31 PM To: FreeRadius users mailing list Subject: Re: peap with mysql "Chris Liles" <Chris.Liles(a)air2web.com> wrote: > How can I make the mschap module use both ntlm and mysql? If it gets a clear-text password, it should probably default to using that. For now, you can set the check item MS-CHAP-User-NTLM-Auth = No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

acct_users & scripts working.
by MINODIER David RD-RESA-LAN 19 May '06

19 May '06

Hi all, I went through some problems for triggering the execution of some scripts upon the reception of accounting messages. Clearly, my acct_users file was as below: DEFAULT Acct-Status-Type == Start Exec-Program = "/usr/local/bin/do_start.sh" DEFAULT Acct-Status-Type == Stop Exec-Program = "/usr/local/bin/do_stop.sh" and the scripts were never executed although I had this line in the debug when receiving a Acct-Start or Acct-Stop message: <SNIP> Acct_users: Matched entry DEFAULT at line 1 (or 4 if Acct-STOP) </SNIP> And then.... Nothing ! I remembered that the version of Freeradius I was using was a (beta) CVS version: host4:~# radiusd -v radiusd: FreeRADIUS Version 1.1.0-pre0, for host i686-pc-linux-gnu, built on Dec 1 2005 at 16:32:48 Copyright (C) 2000-2003 The FreeRADIUS server project. I installed the latest version of Freeradius: host4:/home/minodida/freeradius-1.1.1# ./src/main/radiusd -v lt-radiusd: FreeRADIUS Version 1.1.1, for host , built on May 18 2006 at 16:12:22 Copyright (C) 2000-2006 The FreeRADIUS server project. And it works: I now have in the debug the following two lines that I did not have before: Acct_users: Matched entry DEFAULT at line 1 <SNIP> radius_xlat: '/usr/local/bin/do_start.sh' Exec-Program: /usr/local/bin/do_start.sh </SNIP> I hope this may help some of you... Yours, David. David Minodier FTR&D - Lannion 02 96 05 05 19

2 1

RE: LDAP and realms
by Mitchell, Michael J 19 May '06

19 May '06

Hi Corey, You don't have debug output for the "username without realm", but I suspect what is happening is the Sripped-User-Name attribute is not being added, because the username doesn't need to be stripped! You can try: filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" Which will use Stripped-User-Name if it is present, otherwise User-Name. cheers, Mike ________________________________ From: freeradius-users-bounces+michael.mitchell=team.telstra.com(a)lists.freerad ius.org [mailto:freeradius-users-bounces+michael.mitchell=team.telstra.com@lists .freeradius.org] On Behalf Of Corey Burks Sent: Friday, 19 May 2006 4:02 PM To: freeradius-users(a)lists.freeradius.org Subject: LDAP and realms We have 2 clients authenticating user one passes simply the uid (cburks) and users authenticate properly. The other client is passing username and realm (cburks(a)zhone.com) which fails. I have configured zhone.com realm in the proxy.conf file like this: realm zhone.com { type = radius authhost = LOCAL accthost = LOCAL } Radiusd.conf file has the following in the ldap section. filter = "(uid=%u)" Which works for username only and username + realm does not work if I switch to: filter = "(uid=%{Stripped-User-Name})" username + realm works and username alone fails. Is there a way different way to strip off the realm, so I can have both ways working? Thanks Corey When I run radiusd in debug I see that the realm is getting stripped but the username and relam are still being passed to LDAP. Debug output: rad_recv: Access-Request packet from host 172.16.15.251:2502, id=20, length=80 User-Name = "cburks(a)zhone.com" User-Password = "password" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 172.16.15.251 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "zhone.com" for User-Name = "cburks(a)zhone.com" rlm_realm: Found realm "zhone.com" rlm_realm: Adding Stripped-User-Name = "cburks" rlm_realm: Proxying request from user cburks to realm zhone.com rlm_realm: Adding Realm = "zhone.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 270 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for cburks radius_xlat: '(uid=cburks(a)zhone.com)' radius_xlat: 'ou=people,o=oak.zhone.com,o=zhone.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to newldap.oak.zhone.com:389, authentication 0 rlm_ldap: bind as uid=radius,o=oak.zhone.com,o=zhone.com/password to newlda p.oak.zhone.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=oak.zhone.com,o=zhone.com, with filte r (uid=cburks(a)zhone.com) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "cburks" with password "password" radius_xlat: '(uid=cburks(a)zhone.com)' radius_xlat: 'ou=people,o=oak.zhone.com,o=zhone.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,o=oak.zhone.com,o=zhone.com, with filte r (uid=cburks(a)zhone.com) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [cburks(a)zhone.com/password] (from cl ient zw2-vpn1 port 0) Delaying request 0 for 1 seconds Finished request 0

2 1

Re: freeradius upgrade
by Giuseppe Parlato 19 May '06

19 May '06

ok for going back to the previous versiona but when I try to uninstall, make uninstall, I get "No rule to make target". I hope I do not have to uninstall freeradius anyway! thank you Giuseppe ----- Original Message ----- From: "Guy Davies" <aguydavies(a)gmail.com> To: "Giuseppe Parlato" <gparlato(a)tnet.it> Sent: Friday, May 19, 2006 1:11 PM Subject: Re: freeradius upgrade Well, if you've still got the source from the previous build, you should probably be able to do a make install from the root directory of that build. Rgds, Guy On 19/05/06, Giuseppe Parlato <gparlato(a)tnet.it> wrote: > THANK YOU! really! the last question is.. if something goes wrong can I go > back to the previous version in some way? and if I have to remove and > install Freeradius from the beginning how can I eventually remove it? > > Giuseppe > > ----- Original Message ----- > From: Giuseppe Parlato > To: FreeRadius users mailing list > Sent: Thursday, May 18, 2006 2:54 PM > Subject: Re: freeradius upgrade > > > ..and if I tell you I also have unixodbc and freetds installed? > > Giuseppe > > ----- Original Message ----- > From: Giuseppe Parlato > To: FreeRadius users mailing list > Sent: Wednesday, May 17, 2006 3:05 PM > Subject: Re: freeradius upgrade > > > thanks, > I'll backup dictionaries for sure and then I'll try to upgrade.. > > Giuseppe > > ----- Original Message ----- > From: "Guy Davies" <aguydavies(a)gmail.com> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Wednesday, May 17, 2006 2:51 PM > Subject: Re: freeradius upgrade > > > > Hi Giuseppe, > > > > In general, you can upgrade straight from one version to the next by > > doing a configure; make; make install if you used that method to > > install in the first place (rather than an RPM or other package > > manager). > > > > If you have any custom dictionaries, be sure to backup > > /usr/local/share/freeradius before doing the make install and then > > merge your custom entries back into the new dictionaries that will be > > installed there. > > > > Other than that, it should go pretty well. I had no specific issues I > > can remember going from 1.0.x to 1.1.0. I have had issues compiling > > 1.1.1 but that should be fixed apparently in 1.1.2. > > > > Rgds, > > > > Guy > > > > On 17/05/06, Giuseppe Parlato <gparlato(a)tnet.it> wrote: > >> no one can help me ? > >> > >> Giuseppe > >> > >> ----- Original Message ----- > >> From: "Giuseppe" <gparlato(a)tnet.it> > >> To: <freeradius-users(a)lists.freeradius.org> > >> Sent: Wednesday, May 17, 2006 11:08 AM > >> Subject: freeradius upgrade > >> > >> > >> > Hello all, I'm new here and freeradius newbye. > >> > I have to upgrade from freeradius 1.0.1 to 1.1.1 on red hat linux. > >> > Do you have any advice or help ? > >> > The default 1.0.1 installation is the same as the new one 1.1.1? I > >> > mean > >> > does it install file in /usr/local/etc for configuration file, > >> > /usr/local/var/log for log files and /usr/local/lib for libraries ? > >> > .. then configuration file I suppose won't be changed, right? > >> > .. then the procedure is the same as intsllation procedure? > >> > > >> > thanks > >> > Giuseppe > >> > >> > >> - > >> List info/subscribe/unsubscribe? See > >> http://www.freeradius.org/list/users.html > >> > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > -- > > No virus found in this incoming message. > > Checked by AVG Free Edition. > > Version: 7.1.392 / Virus Database: 268.6.0/341 - Release Date: > > 16/05/2006 > > > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > No virus found in this incoming message. > Checked by AVG Free Edition. > Version: 7.1.392 / Virus Database: 268.6.0/341 - Release Date: 16/05/2006 > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > No virus found in this incoming message. > Checked by AVG Free Edition. > Version: 7.1.392 / Virus Database: 268.6.0/342 - Release Date: 17/05/2006 > > -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.392 / Virus Database: 268.6.1/343 - Release Date: 18/05/2006

1 0

(no subject)
by Alhagie Puye 19 May '06

19 May '06

unsubscribe This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

freeradius upgrade
by Giuseppe Parlato 19 May '06

19 May '06

Hello all, I'm new here and freeradius newbye. I have to upgrade from freeradius 1.0.1 to 1.1.1 on red hat linux. Do you have any advice or help ? The default 1.0.1 installation is the same as the new one 1.1.1? I mean does it install file in /usr/local/etc for configuration file, /usr/local/var/log for log files and /usr/local/lib for libraries ? .. then configuration file I suppose won't be changed, right? .. then the procedure is the same as intsllation procedure? thanks Giuseppe

2 5

Re: max_requests
by Giuseppe Parlato 19 May '06

19 May '06

I guess I just have to change value and restart the service ----- Original Message ----- From: "Giuseppe Parlato" <gparlato(a)tnet.it> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Thursday, May 18, 2006 7:59 PM Subject: Re: max_requests > I'll wait :^)) > > Giuseppe > > ----- Original Message ----- > From: "Alan DeKok" <aland(a)nitros9.org> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Thursday, May 18, 2006 6:34 PM > Subject: Re: max_requests > > >> "Giuseppe Parlato" <gparlato(a)tnet.it> wrote: >>> None can help me? >> >> Are you expecting immediate answers to your questions? >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> -- >> No virus found in this incoming message. >> Checked by AVG Free Edition. >> Version: 7.1.392 / Virus Database: 268.6.0/342 - Release Date: 17/05/2006 >> >> >

1 0

Re: limit upload and download speed for each user
by Terry J Fike Jr 19 May '06

19 May '06

> does anyone knows how to limit upload/download speed for each user in > "user" file ? Rate_Limit_Rate = 137, Rate_Limit_Burst = 15000, Police_Rate = 137, Police_Burst = 15000, Rate_Limit aprox= download Police_Rate aprox= upload -- Terry J Fike Jr System Administrator MTA Solutions 907-793-4100 tfike(a)mtasolutions.com

2 1

How can I account with Freeradius using mysql DB?
by fangh 19 May '06

19 May '06

freeradius-users，您好！ I did things like that above,but after I recompile Asterisk and restart Asterisk Server,when I made a call,the radius server couldn't receive request messages. I also can not find dictionary.asterisk file after I recompile asterisk,why? And how can I get the dictionary.asterisk,what should I do? I'd configure the radius configurations,the files radiusd.conf,clients.conf,sql.conf in raddb directory at Freeradius server side,the files servers,radiusclient.conf at the radiusclient side. the detail configurations just like in <Call Detail Recording to RADIUS Server> doc said. How can I get the asterisk call detail records in mysql on radius server? 　　　　　　　　Thanks more for your help!~~ 　　　　　　　　fangh 　　　　　　　　fghai(a)126.com 　　　　　　　　　　2006-05-19

1 0

LDAP and realms
by cburks＠zhone.com 19 May '06

19 May '06

We have 2 clients authenticating user one passes simply the uid (cburks) and users authenticate properly. The other client is passing username and realm (cburks(a)zhone.com) which fails. I have configured zhone.com realm in the proxy.conf file like this: realm zhone.com { type = radius authhost = LOCAL accthost = LOCAL } Radiusd.conf file has the following in the ldap section. filter = "(uid=%u)" Which works for username only and username + realm does not work if I switch to: filter = "(uid=%{Stripped-User-Name})" username + realm works and username alone fails. Is there a way different way to strip off the realm, so I can have both ways working? Thanks Corey When I run radiusd in debug I see that the realm is getting stripped but the username and relam are still being passed to LDAP. Debug output: rad_recv: Access-Request packet from host 172.16.15.251:2502, id=20, length=80 User-Name = "cburks(a)zhone.com" User-Password = "password" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 172.16.15.251 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "zhone.com" for User-Name = "cburks(a)zhone.com" rlm_realm: Found realm "zhone.com" rlm_realm: Adding Stripped-User-Name = "cburks" rlm_realm: Proxying request from user cburks to realm zhone.com rlm_realm: Adding Realm = "zhone.com" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 270 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for cburks radius_xlat: '(uid=cburks(a)zhone.com)' radius_xlat: 'ou=people,o=oak.zhone.com,o=zhone.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to newldap.oak.zhone.com:389, authentication 0 rlm_ldap: bind as uid=radius,o=oak.zhone.com,o=zhone.com/password to newlda p.oak.zhone.com:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=oak.zhone.com,o=zhone.com, with filte r (uid=cburks(a)zhone.com) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group LDAP for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "cburks" with password "password" radius_xlat: '(uid=cburks(a)zhone.com)' radius_xlat: 'ou=people,o=oak.zhone.com,o=zhone.com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,o=oak.zhone.com,o=zhone.com, with filte r (uid=cburks(a)zhone.com) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: leaving group LDAP (returns notfound) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: User not found): [cburks(a)zhone.com/password] (from cl ient zw2-vpn1 port 0) Delaying request 0 for 1 seconds Finished request 0

1 0