- Freeradius-Users - lists.freeradius.org

Password in auth-detail file
by Axel Seguin 04 May '06

04 May '06

Hi everyone, I am using Freeradius with LDAP. I use EAP-TTLS for authentication with PAP (the passwords in LDAP being crypted). In the ldap.conf file I have : log_auth_badpass = no log_auth_goopass = no But I still see the user password in clear text in the auth-detail file. I am sorry if this is a silly question but I have been trying to find a solution for quite a while now and still haven't found anything. Is it possible to make sure the passwords are not stored in the auth- detail files? Or does it have to be like this? Thank you all in advance.

3 2

dialup_admin blank pages
by rabbtux rabbtux 04 May '06

04 May '06

All, Not to sound like a nubie, but I spent the day researching & working on this issue. My dialup_admin package has the standard "blank pages", and does not report errors. I've checked apache,mysql, and freeradius log files. I configured dialup_admin to use mysql database and all. First I did a debian install of freeradius and freeradius-dialupadmin packages. All the apache and php dependencies were met, as I installed & used phpmyadmin. Later I wiped out the binaries and did a fresh source build and install. I have the mysql -> freeradius working, as I can manually put user/password in the proper mysql table, and then use radtest to successfully test the entry. Help! I have the basic functionality of mysql->freeradius, just not the GUI for others to use :-( Thanks in advance - marshall

2 2

Re: ntlm_auth is not used by mschap
by robiwan＠arcor.de 04 May '06

04 May '06

----- Original Nachricht ---- Von: Stefan Winter <stefan.winter(a)restena.lu> An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Datum: 04.05.2006 13:20 Betreff: Re: ntlm_auth is not used by mschap > Hi, > > you didn't state what problem you have right now. The logs send an Accept at > > the end, so everything looks very fine. > Was your mail just to let the world know that things work now, or do you > have > a question? > Hi, Oh sorry, my Question is, that the Authenticator, a Cisco Catalyst 3750, do not map my XP-Client into the VLAN 40 as i defined it in the users file: roka Auth-Type := MS-CHAP Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 When the XP-Client will be authenticated via MS-CHAP, the Cisco Catalyst map my Client in VLAN 1, the default-VLAN, and NOT in VLAN 40. When i authenticate with Auth-Type := Local roka Auth-Type := Local, User-Password = "Gerti1000" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 it works, as you can see the output from radtest: Debian:~# radtest roka Gerti1000 localhost 1645 testing123 Sending Access-Request of id 0 to 127.0.0.1 port 1812 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=0, length=36 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "40" Here is the output from the radiusd: rad_recv: Access-Request packet from host 127.0.0.1:1024, id=72, length=56 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 modcall[authorize]: module "chap" returns noop for request 13 modcall[authorize]: module "mschap" returns noop for request 13 rlm_realm: No '@' in User-Name = "roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 13 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 13 users: Matched entry roka at line 82 modcall[authorize]: module "files" returns ok for request 13 modcall: leaving group authorize (returns ok) for request 13 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [roka/Gerti1000] (from client localhost port 1645) Sending Access-Accept of id 72 to 127.0.0.1 port 1024 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "40" Finished request 13 Going to the next request Thanks in advance... Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

Proxy Radius and accthost
by Tony Spencer 04 May '06

04 May '06

We have a customer who we terminate connections for and pass on the authentication and accounting to via proxy.conf. However we want to be able to see the accounting also. Is it possible to add another “accthost” to the entry in proxy.conf for this customer so we receive the radius accounting packets also? If not is there another way to be able to have the accounting packets logged in 2 different places? Thanks Tony -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.385 / Virus Database: 268.5.2/329 - Release Date: 02/05/2006 -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

1 0

c module
by Kamanashis Roy 04 May '06

04 May '06

Thanks yao guoxian,Mike Mitchell, But it looks to fork(using exec section of radiusd.conf) new processes each time. Using rlm_example($FREERADIUSHOME/src/modules/rlm_example) works fine. I have just replaced the 'example' to 'sync' (the name i chose for my module) in the directory name and all the files inside,-Entered into the directory. I have done some DEBUG("Start Authentication "); So that I understand what it actually does. The compile time configuration is done by, shell &lt ./configure command. Then I done, shell &lt make shell &lt make install I have also made some change in modules section modules{ .... sync { } .... .... } Is it good? I donot know.Some other changes have also be made. authorize{ .... sync .... } authencate{ .... sync .... } accounting{ .... sync .... } At last it works fine. Just donot authenticate the NAS. I think i should work with the attributes (for specific NAS) for replying. Do not know details about authType. Is it make any problem for me? I think i can use mysql-client library to connect local mysql server in it. I have not yet tryed it. I think it needs mysql_client lib to be linked or I include the source. I have done it in a standalone server. But the question is, if freeradius is using threads. And if so what should be done to take care of that. Good Luck -- Kamanashis Roy -- Using Opera's revolutionary e-mail client: http://www.opera.com/mail/

1 0

ntlm_auth is not used by mschap
by robiwan＠arcor.de 04 May '06

04 May '06

Dear All, Now i am a step further on, my radiusd uses the ntlm_auth module AND authenticate the user correctly !!!. My Username = roka, Password = Gerti1000, Domain = WINLAB Now i use the selfcompiled freeradius 1.1.1 and NOT the Debian freeradius. The Debian freeradius is unable to load EAP-Type/peap. I activated in the file eap.cfg the peap-section: -------------------------------snip--------------------------- peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } ---------------------------snap---------------------------- Here again the mschap-section in the radiusd.conf -------------------------------snip--------------------------- mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --domain=winlab --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } ---------------------------snap---------------------------- And the file users: -------------------------------snip--------------------------- DEFAULT Auth-Type = MS-Chap Fall-Through = 1 roka Auth-Type := MS-CHAP Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 ---------------------------snap---------------------------- In my Windows XP-Box i use as 802.1X authentfication the EAP(PEAP) and as authentification-method EAP-MASCHAP v2. Here is the radiusd output: rad_recv: Access-Request packet from host 10.187.0.15:1645, id=132, length=137 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x020000100157494e4c41425c726f6b61 Message-Authenticator = 0xbd4afc42085fcbbf08d044ae750c53fd Sending Access-Challenge of id 132 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xeef3170dad81ebd1111e10041bb347cd rad_recv: Access-Request packet from host 10.187.0.15:1645, id=133, length=145 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xeef3170dad81ebd1111e10041bb347cd EAP-Message = 0x020100060319 Message-Authenticator = 0xbc407e57ea0373c4d3c64172b16383e3 Sending Access-Challenge of id 133 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe31f70214e83e2de5cc7759b43818b12 rad_recv: Access-Request packet from host 10.187.0.15:1645, id=134, length=251 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xe31f70214e83e2de5cc7759b43818b12 EAP-Message = 0x0202007019800000006616030100610100005d03014459dd090912178089f8e3c69693534605b03bf50368573ab4d2e6b2236469142079a45d849f7096a2b2bbc38c20a1ed71682d0fd9e6debf2bc4412059da76b1df001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x5916349f8c6defda32f07b85cec1f492 TLS_accept:error in SSLv3 read client certificate A Sending Access-Challenge of id 134 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0103040a19c0000006f1160301004a0200004603014459dda2b79409fcb6d4d89fac9548c3823e922e24a065fe40651a32332886db20eac3c696ce916da32ce4d48b6b696d0895a73a5c1ea3587a904d849d32fde49e00040016030106940b00069000068d0002cd308202c930820232a003020102020102300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e74206365 EAP-Message = 0x7274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d301e170d3034303132353133323631305a170d3035303132343133323631305a30819b310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f73743119301706035504031310526f6f74206365727469666963617465311f301d06092a864886f70d0109011610726f6f74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003 EAP-Message = 0x818d0030818902818100dac525422bfedb082629a2cba44b3449c90d0ab462fb72c8434a782098863d7eb7d7e70028c2b7ad555a51cc756cf4fa1d7091615ab450d5289553ae6616aff014a55085d6b8fb4aee98638e426175cdd36c665c63cda177d34920eb30585edc8773999c2980f81ad4638bbbea1c82d054023db7ef24a3ec1c3f6241a903d7f30203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038181007a2d921b1cf13bf2982a9178ec9ede6d88edc178a2e8bd40a0a06fb6f0769957884cd7084537083496fd184165293f583c8e8240eb68e042c94b15752e4c07e80d09 EAP-Message = 0x779afa3dd55c24fa54ac292d77205d1c2477ed30d59f57caf9bd21ff2a8d16cc0911c50e4f295763fcb60efa3c3d2d0e43850f6e6fbe284902f6e83503650003ba308203b63082031fa003020102020100300d06092a864886f70d010104050030819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c EAP-Message = 0x652e636f6d301e170d3034303132353133323630375a Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc7cf07a88e421df6a3b7286fe43369d6 rad_recv: Access-Request packet from host 10.187.0.15:1645, id=135, length=145 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xc7cf07a88e421df6a3b7286fe43369d6 EAP-Message = 0x020300061900 Message-Authenticator = 0x3d277dba131d4505b6845d6cfd6ed376 Sending Access-Challenge of id 135 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010402f71900170d3036303132343133323630375a30819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d4c5b19724f164acf1ffb189db1c8fbff4f14396ea7cb1e90f78d69451725377895dfe52ccb99b41e8 EAP-Message = 0x0ddeb58b127a943f4f58cbc562878192fbdc6fece9f871e7c130d35cf5188817e9b133249edd2a1c75d31043ae87553cec7a77ef26aa7d74281db9b77e17c6446c5dd9b188b43250ca0229963722a123a726b00b4027fd0203010001a381ff3081fc301d0603551d0e0416041468d36d3e1ee7bc9d5a057021c363da1365d1ade33081cc0603551d230481c43081c1801468d36d3e1ee7bc9d5a057021c363da1365d1ade3a181a5a481a230819f310b30090603550406130243413111300f0603550408130850726f76696e63653112301006035504071309536f6d65204369747931153013060355040a130c4f7267616e697a6174696f6e31123010 EAP-Message = 0x060355040b13096c6f63616c686f7374311b301906035504031312436c69656e742063657274696669636174653121301f06092a864886f70d0109011612636c69656e74406578616d706c652e636f6d820100300c0603551d13040530030101ff300d06092a864886f70d01010405000381810033c00b66b1e579ef73a06798252dab8d5e5511fc00fd276d80d12f834777c6743fdc2743fca1507704e4bc0979e4f60ac3ad9ee83e6f347369229d1f77229ba2e982359da563024a00163dba6d6c986c0bad28af85132ff8f0d76501bf1b7c2dff658ce1e62c01997b6e64e3e8d4373354ce9912847651539063b85bbc5485c516030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xec08c9ae544f092c6a427e7a70dbbe23 rad_recv: Access-Request packet from host 10.187.0.15:1645, id=136, length=331 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xec08c9ae544f092c6a427e7a70dbbe23 EAP-Message = 0x020400c01980000000b61603010086100000820080771469fb40621c4f3c2fc1f6ec25d522e4c5d3875d9b1b2117f2d79b2bb48911db4efd1d2f5556c182f423f61a5431e811bd7269987d215bbe2a119e59c92d42743d1a1535bbf2967b575924234913beb3cdabb36c8af0f5fd8b0dc78265f24d00419c2edcb066a475f01be123c112f055ceeb8d27ef3d0769dd049e44cbcf9314030100010116030100207e447742f402496865b7ff6579e5bcfbbf3c983ee258e6792b6ae75085f6ab5f Message-Authenticator = 0x62b1bf32b3b16b6857c2d630fcf960e0 Sending Access-Challenge of id 136 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01050031190014030100010116030100201efddd23acbd285af12a1314e91ffad945f58a08566adc8582c7e547d7213269 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2cb96659eeaf144836c35733c6a0a808 rad_recv: Access-Request packet from host 10.187.0.15:1645, id=137, length=145 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x2cb96659eeaf144836c35733c6a0a808 EAP-Message = 0x020500061900 Message-Authenticator = 0xbda925ee01abf70665fd68a59d82bdf3 Sending Access-Challenge of id 137 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x01060020190017030100155351c3c41dd669c9851f2fc575f8195a3b48fa2e90 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xbe17fb42c27358c6e33f9980e0597b4c rad_recv: Access-Request packet from host 10.187.0.15:1645, id=138, length=178 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0xbe17fb42c27358c6e33f9980e0597b4c EAP-Message = 0x020600271900170301001c23049e0e9cfc346962dda69f3bce6e63b95f3c05f8dcef9c0a8bdd29 Message-Authenticator = 0xc46f001225f57a9f57a085d4d2217c93 rlm_eap_mschapv2: Issuing Challenge Sending Access-Challenge of id 138 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0107003c19001703010031ddc5a0e836791a192d89b4038de58bb2b678a07041a0ef90a1623e213941ef52bb8e006d7a35737884b3eb1455a4e7e754 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x043b2578a061745314b8ad9d341c0cef rad_recv: Access-Request packet from host 10.187.0.15:1645, id=139, length=232 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x043b2578a061745314b8ad9d341c0cef EAP-Message = 0x0207005d190017030100524a31d80a4489031df02823a24f82d5829d0c4ed1bdbd1ad6474e7628b62e0e67d3fa7f307b9936c07e7a937df8f9eb75d1c35dee5c91ae462abdb628ba395fbc5f20a42f24f3b4354e407435f659be333046 Message-Authenticator = 0x26edddab5cbe293c97ca484f91bb9a49 radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' Exec-Program: /usr/bin/ntlm_auth --domain=winlab --request-nt-key --username=roka --challenge=d3ebe3c71d26efdb --nt-response=e0f465788d19ac1febee280128abf37d5ce5d430c7516212 Exec-Program-Wait: plaintext: NT_KEY: 2F6C7B1EA51DEE8E0E47A627D4E5DEA5 Exec-Program: returned: 0 Sending Access-Challenge of id 139 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x0108004a1900170301003fe95b4d356a5729b7513424e95b3815d5f664558f10fe45ce635500380a4d78ec71b59f36a16d8c3a196bbcca6155322203c5c2a82c4f224b8238e6f2b16606 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5141f9f539e80bf903ba740d943e82a9 rad_recv: Access-Request packet from host 10.187.0.15:1645, id=140, length=168 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x5141f9f539e80bf903ba740d943e82a9 EAP-Message = 0x0208001d19001703010012463c06b6275da4d04f23c9eb7e2e23aea2ee Message-Authenticator = 0xe00580e029f8e3c388b82938c5ffb176 Login OK: [WINLAB\\roka/<no User-Password attribute>] (from client localhost port 0) Sending Access-Challenge of id 140 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010900261900170301001b5ca7996a37fe349ccac8e6953704bcf369ba2e3141f25b22003352 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x69d1f13c657d02f68ffb205c41c26c9c rad_recv: Access-Request packet from host 10.187.0.15:1645, id=141, length=177 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 State = 0x69d1f13c657d02f68ffb205c41c26c9c EAP-Message = 0x020900261900170301001b2d01514390d15c42a319617b87af8233f59c6f67444bdaf5989a5a Message-Authenticator = 0x87e08fe2becd0de8192365a40e2c8b65 Login OK: [WINLAB\\roka/<no User-Password attribute>] (from client M4DEMRCO0000015 port 50103 cli 00-0B-5D-84-AE-CA) Sending Access-Accept of id 141 to 10.187.0.15 port 1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User MS-MPPE-Recv-Key = 0xbbfe5508b45b961e066f53e6dc8ee0ddd3d7d5893608c12de1787bd0599471fc MS-MPPE-Send-Key = 0x218c81973cefe42ebaa2aff5ab5ab5d315bb3a434730821ed6437f08e3d23cab EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "WINLAB\\roka" Many thanks to all Robert ----- Original Nachricht ---- Von: robiwan(a)arcor.de An: freeradius-users(a)lists.freeradius.org Datum: 04.05.2006 07:46 Betreff: ntlm_auth is not used by mschap > You send a packet that does not contain any MS-CHAP attributes. Because of > that, the server is not doing MS-CHAP: > > > modcall[authorize]: module "mschap" returns noop for request 0 > > As this line tells you. > > Send a MS-CHAP request, and look what happens then. > > Stefan > > Hi , > > Now i send a mschap request (EAP/PEAP with WindowsXP) and that is the output > of my radiusd: > > rad_recv: Access-Request packet from host 10.187.0.15:1645, id=229, > length=137 > NAS-IP-Address = 10.187.0.15 > NAS-Port = 50103 > NAS-Port-Type = Ethernet > User-Name = "WINLAB\\roka" > Called-Station-Id = "00-14-69-5B-8B-03" > Calling-Station-Id = "00-0B-5D-84-AE-CA" > Service-Type = Framed-User > Framed-MTU = 1500 > EAP-Message = 0x020000100157494e4c41425c726f6b61 > Message-Authenticator = 0x90f61cee340a78e94ee24fe3c625baa0 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: EAP packet type response id 0 length 16 > rlm_eap: No EAP Start, assuming it's an on-going EAP conversation > modcall[authorize]: module "eap" returns updated for request 0 > users: Matched entry DEFAULT at line 174 > users: Matched entry DEFAULT at line 198 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns updated for request 0 > rad_check_password: Found Auth-Type EAP > auth: type "EAP" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_eap: EAP Identity > rlm_eap: processing type md5 > rlm_eap_md5: Issuing Challenge > modcall[authenticate]: module "eap" returns handled for request 0 > modcall: group authenticate returns handled for request 0 > Sending Access-Challenge of id 229 to 10.187.0.15:1645 > Framed-IP-Address = 255.255.255.254 > Framed-MTU = 576 > Service-Type = Framed-User > EAP-Message = 0x010100160410be8025aedc237e79bb769d7448c5e684 > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x01aa44a4c384c8d0b88b27a8f803a381 > Finished request 0 > Going to the next request > > > Again the > modcall[authorize]: module "mschap" returns noop for request 0 > You said, this mean i do not send a mschap request. > > What else can i do ? > > Many thanks in Advance > Robert > > > Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren > ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig > und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, > nur 44,85 inkl. DSL- und ISDN-Grundgebühr! > http://www.arcor.de/rd/emf-dsl-2 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

ntlm_auth is not used by mschap
by robiwan＠arcor.de 04 May '06

04 May '06

You send a packet that does not contain any MS-CHAP attributes. Because of that, the server is not doing MS-CHAP: > modcall[authorize]: module "mschap" returns noop for request 0 As this line tells you. Send a MS-CHAP request, and look what happens then. Stefan Hi , Now i send a mschap request (EAP/PEAP with WindowsXP) and that is the output of my radiusd: rad_recv: Access-Request packet from host 10.187.0.15:1645, id=229, length=137 NAS-IP-Address = 10.187.0.15 NAS-Port = 50103 NAS-Port-Type = Ethernet User-Name = "WINLAB\\roka" Called-Station-Id = "00-14-69-5B-8B-03" Calling-Station-Id = "00-0B-5D-84-AE-CA" Service-Type = Framed-User Framed-MTU = 1500 EAP-Message = 0x020000100157494e4c41425c726f6b61 Message-Authenticator = 0x90f61cee340a78e94ee24fe3c625baa0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "WINLAB\roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 16 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 198 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 229 to 10.187.0.15:1645 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010100160410be8025aedc237e79bb769d7448c5e684 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x01aa44a4c384c8d0b88b27a8f803a381 Finished request 0 Going to the next request Again the modcall[authorize]: module "mschap" returns noop for request 0 You said, this mean i do not send a mschap request. What else can i do ? Many thanks in Advance Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

1 0

PPPoE Unique Login without using FreeRadius at all solved. traffic shaping Up+download included.
by Rani Ahmed 04 May '06

04 May '06

Hi all.. what follows is a very very cheap solution to disallow 2 different computers to login to rp-pppoe server using the same username. This means the same username should have one and only one login session in the whole network. This /DOES/ not use FreeRadius at all. It uses only /etc/ppp/ip-up.d and /etc/ppp/ip-down.d shell scripts. This also contains NO-borrowing / NO-shared-bandwidth traffic shaping using HTB. This is Tested and it works AND IS FINAL. Works for People who has scheduled electrical powerdowns within parts of the same country like it's the case in Lebanon in the Middle East. Can be used any where, currently used in a Wireless LAN. Remember this uses /etc/ppp/chap-secrets for login. It uses the same setup described in: http://wrath.geoweb.ge/pppoe-server.html How it can be cheap? because i did not use a NAS. since from my research online, i have to buy a wireless NAS e.g Cisco (1000$ worth). #######################put in /etc/ppp/ip-up.d/pppoeup script. make it executeble############## #!/bin/bash #Customer $IP IP=$5 #Customer pppN device dev=$1 #making sure of the existance of the file /root/shaping/check this is used as a check-in. if [ ![-f /root/shaping/check] ] then mkdir /root/shaping/ > /dev/null 2>&1 touch /root/shaping/check fi #checking if the file contains a previously added $IP ie an already logged in Customer. prev_dev=$(grep -e $IP /root/shaping/check| cut -f2) #if the Customer $IP is in the file /root/shaping/check then shutdown the current log in ##FIXME##kill the session smoothly, no signal means simply normal close### #Shutdown the $dev and then .. ##FIXME##Kill the session in SURE KILL NO MERCY KILL (signal number -9 ) This wont let pppoedown work/run. #any device will be flushed automatically after the timeout period finishes #and will run ip-down.d/pppoedown electricity shutdown #therefore there is no worry on the /root/shaping/check if [ "$prev_dev" != "" ] then #ifconfig $dev down #kill -9 $(cat /var/run/${dev}.pid ) #sed -e '/'$IP'\t'$prev_dev'/d' -i /root/shaping/check if [ -f /var/run/${prev_dev}.pid ] then kill $(cat /var/run/${prev_dev}.pid ) fi fi # if Customer $IP not in the file /root/shaping/check append the $IP to the file and continue normally. echo $IP$'\t'$dev >> /root/shaping/check /sbin/tc qdisc del $dev root 2> /dev/null > dev/null /sbin/tc qdisc del ${dev} ingress 2> /dev/null > dev/null # /root/shaping/speeds is a tabulated file of dedicated speeds. written as follows: # IP UPload_speed (kBytes/sec) UPload_burst (kBytes) DOWNload_speed (kBytes/sec) DOWNload_burst (kBytes) uprate=$(brief_config /root/shaping/speeds | grep -e $IP | cut -f 2 ) upburst=$(brief_config /root/shaping/speeds | grep -e $IP | cut -f 3 ) downrate=$( brief_config /root/shaping/speeds | grep -e $IP | cut -f 4) downburst=$( brief_config /root/shaping/speeds | grep -e $IP | cut -f 5) loginname=$(grep -e $IP /etc/ppp/chap-secrets | cut -f 1) date=`date` /sbin/tc qdisc add dev $dev root handle 1: htb default 1 /sbin/tc class add dev $dev parent 1:1 classid 1:1 htb rate ${downrate}kbps ceil ${downrate}kbps burst ${downburst}kB #U32="/sbin/tc filter add dev ${dev} protocol ip parent 1:0 prio 1 u32" #${U32} match ip src ${IP} flowid 1:1 /sbin/tc qdisc add dev $dev handle ffff: ingress /sbin/tc filter add dev $dev protocol ip parent ffff: prio 50 u32 match ip src 0.0.0.0/0 police rate ${uprate}kbps burst ${upburst}kB drop flowid :1 echo "${loginname} loggin at ${date} downrate ${downrate} uprate ${uprate} " >> /root/shaping/pppoe.log ################## end of file /etc/ppp/ip-up.d/pppoeup ############################### #############put in /etc/ppp/ip-down.d/pppoedown script. make it executeble############## #!/bin/bash #Customer's pppN device/interface and his IP dev=$1 IP=$5 #remove his traffic shaping issues /sbin/tc qdisc del dev $dev root /sbin/tc qdisc del dev $dev ingress #get his username and to echo his logout time later. loginname=$(grep -e $5 /etc/ppp/chap-secrets | cut -f 1) date=`date` #delete him from the check list #sed -e '/'$dev'/d' -i /root/shaping/check sed -e '/'$IP'\t'$dev'/d' -i /root/shaping/check #write his log out date. echo "${loginname} logout at ${date}" >> /root/shaping/pppoe.log #############end of /etc/ppp/ip-down.d/pppoedown script ############## Wish ye all good luck. SuperLinux : To Linux infinity and beyond!

1 0

freeradius.de hacked ;)
by patrick 04 May '06

04 May '06

http://www.freeradius.de/forum/ hacked ;)

3 3

radtest ?
by Michael Gale 04 May '06

04 May '06

Hello, What type of Auth-Type does radtest provide ?? I have a pptp / ppp + freeradius + mysql setup working, I am able to connect with a XP laptop using PPTP with out any problems. Now when I try and test a user using radtest I noticed the following: - The Auth-Type is allows System ? - If the user is in the DB I receive: rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=39, length=20 - If the user is a local user I receive: rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=46, length=20 So if the default Auth-Type set to System ... causing username and passwords to be checked against local system account ? Thanks -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

2 1