- Freeradius-Users - lists.freeradius.org

Radius unstable
by Bill Schoolfield 08 May '06

08 May '06

I have posted two requests to this list concerning MySQL issues and FreeRadius. To date I haven't gotten a single response. As I can also use /etc/password and /etc/shadow, I've decided for now to drop using MySQL (e.g. use Auth-Type := System). So hopefully my new problem is now more common. I've tried making updates to the users file for this but I'm still getting "no authenticate method (Auth-Type) configuration found". What am I getting wrong here? In the users file I have: DEFAULT Auth-Type := System, Simultaneous-Use == 1 Fall-Through = Yes Here's the log piece: Acct-Session-Id = "6000006B" User-Name = "bill" User-Password = "bill" NAS-IP-Address = 127.0.0.1 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP Mon May 8 23:50:01 2006 : Debug: Processing the authorize section of radiusd.conf Mon May 8 23:50:01 2006 : Debug: modcall: entering group authorize for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 1 Mon May 8 23:50:01 2006 : Debug: modcall[authorize]: module "preprocess" returns ok for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 1 Mon May 8 23:50:01 2006 : Debug: modcall[authorize]: module "chap" returns noop for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 1 Mon May 8 23:50:01 2006 : Debug: modcall[authorize]: module "mschap" returns noop for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: calling suffix (rlm_realm) for request 1 Mon May 8 23:50:01 2006 : Debug: rlm_realm: No '@' in User-Name = "bill", looking up realm NULL Mon May 8 23:50:01 2006 : Debug: rlm_realm: No such realm "NULL" Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 1 Mon May 8 23:50:01 2006 : Debug: modcall[authorize]: module "suffix" returns noop for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 1 Mon May 8 23:50:01 2006 : Debug: rlm_eap: No EAP-Message, not doing EAP Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 1 Mon May 8 23:50:01 2006 : Debug: modcall[authorize]: module "eap" returns noop for request 1 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: calling files (rlm_files) for request 1 Mon May 8 23:50:01 2006 : Debug: users: Matched entry DEFAULT at line 79 Mon May 8 23:50:01 2006 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 1 Mon May 8 23:50:01 2006 : Debug: modcall[authorize]: module "files" returns ok for request 1 Mon May 8 23:50:01 2006 : Debug: modcall: group authorize returns ok for request 1 Mon May 8 23:50:01 2006 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Mon May 8 23:50:01 2006 : Debug: auth: Failed to validate the user.

4 3

LDAP and Freeradius
by cburks＠zhone.com 08 May '06

08 May '06

All, Is it possible to have freeradius bind to ldap using the username and password provided in the access-request? For example in the ldap module have some sort of variable in the Identity= field. Thank you Corey

2 1

Restrict Access with Max Data Allowed.
by Sarkis Gabriel 08 May '06

08 May '06

Hello All Just a quick question, i am running Freeradius with Time and Seconds restriction at the moment but i want to add another product on my line. The product is Per Megabyte account, i.e restrict a user to a Max amount of DATA i.e 1000Megabytes, can someone show me or tell me the key word to search for. Thanks Sarky

1 0

A bit lost.
by Eric Hilden 08 May '06

08 May '06

Well I think I got everything installed correctly from PHP4, MySQL, Apache2, Freeraidus and Dialupadmin but I am still a bit confused on all the setting up. BTW: I did get the mysql examples all loaded into the radius database so everything is working great for that I think. I also configured radiusd.conf for all the mysql settings. I am following this guide currently http://www.frontios.com/freeradius.html and http://www.onlamp.com/pub/a/onlamp/excerpt/radius_5/index1.html If I go to my info.php page I created I get all the test results back running apache2 on php4.4.0 so I am assuming this is working correctly. I also don't know if I have everything setup correctly with passwords and access. I tried reading many how-tos' but with so many different versions it makes it very difficult. Next if I got to my dialupadmin/htdocs directory and access the webpage everything comes up fine, but the following errors I am still receiving. Find Users *seems to do nothing at all after I have created users through the DialupAdmin interface.* Edit Users after entering in a name I have created comes back with the following: *Warning: main(password.php3)[function.main]: failed to open stream: no such file or directory in /srv/www/dialup_admin/lib/sql/password_check.php3 on line 2.* and it goes on over failed operation on opening this file. In the many guides I have read, I found something that I need to edit my httpd.conf to add modules for php and create a password file for dialupAdmin. Is this necessary for this to work? Could this be the error I'm getting for my Edit.Users. When I got my dialupadmin check server page I get the following reply: *Radius Server Test Page Friday 5 may 2006, 12:21:06 cdt server: locahost: 1812 (test user test) *After a few hundred guides and bookmarks I have been through I found a screen shot (can't find it now) of different login information for the (test user test) and something with authentication. ---------------------------------------------------------------------------------------------------------------- My second problem is getting the FreeRadius configuration working correctly. I'm about to bust my head open because I don't get what I'm missing. I have edited the users.conf and uncommented the example of steve with modifying the password...Now when trying to do a test I get the standard access request info and then I get rejected with *Invalid Signature (err=2)! (Shared secret is incorrect(. ) *I have checked my clients.conf file and as it sets the secret = "trustno1". I am also unshure of the NAS types and what exactly each type does but localhost = portslave. radtest steve test localhost 1812 trustno1 This is command I am typing in. Following syntax of cmd: usr pw host port secrect The only thing I can think of is that maybe sense I have moved everything to dialupAdmin and MySQL that it is no longer reading the text files but the sql ones. Anyways I appreciate any help, direction, or what I need to read. Going to order the O Reilly's Radius book as the Chapter 3 section which is posted seem to have good info. Please save myself from taking a sledgehamemr to my head.

2 2

win2003 Active Directory authentication
by Frank Smith 08 May '06

08 May '06

I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain. I can authenticate using ldap, no? Also, is this insecure due to clear text? Any other ideas for what I want here? Thanks!

5 6

Regarding on Freeradius in openser.
by raviprakash sunkara 08 May '06

08 May '06

Hello Everybody, I'm new to openser and also to freeradius. 1)how to insert the users in freeradius server 2) When I test with radiusd - X its show somes errors . The errors are mention below /usr/local/etc/raddb/users[64]: Unexpected trailing comma in check item list for entry test Errors reading /usr/local/etc/raddb/users radiusd.conf[1047]: files: Module instantiation failed. radiusd.conf[1791] Unknown module "files". radiusd.conf[1727] Failed to parse authorize section. 3) And also when tested the clients , by using "radclient -f digest localhost auth <shared_secret>" . It shows the following error radclient : no respones from server ID 134 4) And also when I tried with " radtest test test 192.168.2.55 5060 hyperion" its shows me below one Sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" Re-sending Access-Request of id 233 to 192.168.2.55 port 1812 User-Name = "test" radclient: no response from server for ID 233 5) when i also tried with "ps -aux | grep radiusd " it show a warning and errors Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.3 /FAQ root 13093 0.0 0.1 4276 696 pts/4 S+ 16:41 0:00 grep radiusd Please help me in 5 issues which are mention above. -- Thanks and Regards with cheers Sunkara Ravi Prakash (Voip Developer) Hyperion Technology www.hyperion-tech.com

2 1

RE: win2003 Active Directory authentication
by Chris Liles 08 May '06

08 May '06

Yes you can do use the ldap module of freeradius to hit your AD, I am doing this now. Yes you can do ssl/tls for encryption between the radius server and AD. Windows server 2000 does not support tls, only ssl. It is similar to setting up mm_mod_auth_ldap for apache. You will need an ldap browser to browse your domain to find out the correct search filters for everything. The only thing I can't figure out is how to check for group membership. I posted to the mailing list, but no one has responded yet :-( There is good documentation on the wiki. Look for my previous post about not getting groups working to see my config files. -- Chris Liles System Analyst Air2Web, Inc. 1230 Peachtree St. N.E. 12th Floor Atlanta, GA 30309 Tel: (404) 942-5334 Fax: (404) 815-7708 -----Original Message----- From: freeradius-users-bounces+chris.liles=air2web.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+chris.liles=air2web.com@lists.freeradius.org] On Behalf Of Frank Smith Sent: Monday, May 08, 2006 11:55 AM To: freeradius-users(a)lists.freeradius.org Subject: win2003 Active Directory authentication I am running AD in native mode. By my ancient understanding of samba, I cannot join this domain. I can authenticate using ldap, no? Also, is this insecure due to clear text? Any other ideas for what I want here? Thanks!

1 0

cisco ap350(WLAN) vs freeradius with PEAP
by Gabor Szelei 08 May '06

08 May '06

Hi, Ive been trying to get $subject working. My last state is the client has been authenticated, but no traffinc is going through. Does anyone have a working config for Cisco350 with PEAP? What kindof reply is CISCO expecting from radius? br, Gabor Szelei

2 1

Re: PLS Help I get no response for 2 monthe (missing
by Assa Tal 08 May '06

08 May '06

Hi Stepan 10x for your prompt respond I Used radrelay and it works fine the point is that I would like to do it without additional proccess Like u said with the hint file where can I get this patch for the hint file ? And how do I tell him not to look for User-Name 10x in adv Tal assa To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. PLS Help I get no response for 2 monthe (missing User-name attribute) (Assa Tal) 2. Re: PLS Help I get no response for 2 monthe (missing User-nameattribute) (Stefan Winter) 3. cisco ap350(WLAN) vs freeradius with PEAP (Gabor Szelei) 4. Re: Special characters in users file (sumi thra) 5. Re: FreeRadius + MySQL & Encrypted passwords (Miguel Angel Quiles) ---------------------------------------------------------------------- Message: 1 Date: Mon, 8 May 2006 09:50:45 +0300 From: "Assa Tal" <Tal.Assa(a)comverse.com> Subject: PLS Help I get no response for 2 monthe (missing User-name attribute) To: <freeradius-users(a)lists.freeradius.org> Message-ID: <FE225DCF1021F34FB2269676A45BB8814434AF(a)il-tlv-mail01.comverse.com> Content-Type: text/plain; charset="us-ascii" Hello All freeradius mailinglist I would appriciate you help Description a telephony service provider is sending Radius req to my RADIUS server who proxy them to a backend server I have configured a free radius server Version 1.1.0 to act as a proxy server to proxy the request to a backend server These are the configuration file clients.conf and the proxy.conf Client.conf client 172.28.185.31/32 { secret=secretgprs1 shortname=RADIUS_GGSN Proxy.conf realm NULL { type = radius authhost=LOCAL accthost=172.31.201.98:1813 (backend server) secret=secretgprs1 } # # This realm is for ALL OTHER requests. # realm DEFAULT { type = radius authhost=LOCAL accthost=172.31.201.98:1813 secret=secretgprs The problem I have noticed that radius request are not proxied at all So I started to dig in and found that freeradius will not proxy accounting If the attribute User -Name is missing As you can see I made some logs and u can see very vividly the problem. I made my own test to emulate the problem with a radius client and as u can see it was proxies The big Q is how to I force the freeradius to pass the request and not to check these header or maybe to use some sort of INJECTION To the header . I Tia Tal assa

2 1

problems with hints file
by wekz 08 May '06

08 May '06

Hi all, I use freeradius1.1.1 + ldap. And peap or eap-tls for authorization. I've been trying to use hints.file for changing the User-Name. When a laptop user which is in a domain tries to do a peap authentication, windows sends a User-Name that follows this pattern (at least the ones I've seen): DOMAIN\5c\5cLOGIN I'm trying to catch up the LOGIN name so the radius can perform a search in ldap. I've modify hints.file including this line: DEFAULT User-Name =~ "^([^\\]+)\\5c\\5c([^\\]+)" User-Name := "%{2}" The problem is that this rule matches but it changes the User-Name for an empty string. If I put a string instead of %{2} it does change it right. DEFAULT User-Name =~ "^([^\\]+)\\5c\\5c([^\\]+)" User-Name := "JOHNDOE" I don't know if that is a bug or if there's something I'm doing wrong and didn't realize. ¿? Thanks.

2 2