- Freeradius-Users - lists.freeradius.org

Yet another Simultaneous-Use issue
by Eduardo Bejar 03 May '06

03 May '06

Hi, It seems that I´m missing something regarding the Simultaneous-Use option as I can´t make it work yet. I´ve found that this has been asked many times before, but I´ve tried all suggested methods with no luck. Here's my config: - Fedora Core 4 fresh install, Freeradius 1.1.0 with MySQL. And I´ve done the following: - Tested with uncommented simul_count_query at sql.conf. - Tested inserting GroupName="dialup", Attribute="Simultaneous-Use", op=":=", Value=1. - Tested inserting UserName="the_one_Im_testing", Attribute="Simultaneous-Use", op=":=", Value=1. - Tested at users file: DEFAULT Auth-Type = sql Fall-Through = 1 DEFAULT Simultaneous-Use := 1 Fall-Through = 1 - Tested the same, but with DEFAULT Simultaneous-Use == 1. - Tested radiusd -sx and no Simultaneous-Use shows up when login. - Tested with checkrad script from Cistron Radius and got snmpget timeout. Checkrad from freeradius does not shows timeout. Currently I can login twice with the same user, but the user only shows up 1 time when doing radwho. Please tell me what else should I do or test to make it work. Thank you and regards, Eduardo

2 1

Semantics of radiusd.conf ?
by Gabriel L. Somlo 03 May '06

03 May '06

Hi, I'm trying to understand the semantics of the radiusd.conf file. Specifically, when does a module (not) need to be mentioned in the authorize and authenticate sections of the config file ? For instance, I want mysql-based authorization, and eap-based authentication. For this, I have to do something like this: authorize { ... eap sql } authenticate { eap } Removing the eap from 'authorize' prevents the server from working correctly (works fine if you leave it in there). Why does eap have to be mentioned in 'authorize', if I only need it for authentication ? Thanks, Gabriel

2 1

Newbie question
by Wayne Hill 03 May '06

03 May '06

Hey guys/gals, I'm a newbite with freeradius and have come upon an interesting issue. Here at my job we've been using Radiator-ODBC for quite some time and are hoping to phase this out and begin using freeradius, along with some more modern hardware, instead. Here's the issue I'm coming across. The file we were using for authentication is a binary file, and inaccessible to me for use in the new implementation so i've been building my own. The information I can access doesn't have groups available to me, however, they are retrievable. What I've been trying to do is use the file generated from our nis servers for the actual authentication, but a different file, containing only username:group pairs. Right now, I have it set up with an entry for rad_group with the following: passwd rad_group{ filename = /usr/local/etc/raddb/group format="*User-Name:~Group" authtype=System } Then placed rad_group in the authorize section. I get the following output in a debug after doing this: Wed May 3 11:52:21 2006 : Debug: rlm_passwd: Added Group: 'filtered' to request_items But Group = "foo" is completely disregarded and radius simply skips to the last, least restrictive entry in the file. What am I missing? Thanks, Wayne

2 3

dropped mysql connections
by Bill Schoolfield 03 May '06

03 May '06

Hello All, We've implemented a billing solution for a client and as part of that effort we are using FreeRadius 1.05 and MySQL 4.0.x on Redhat ES 3.0. It is very standard setup; nothing fancy. Today they experienced a radius failure (8 hours from a radius restart) where FreeRadius could not access the MySQL database. Here's what the logfile says: Wed May 3 17:50:05 2006 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Wed May 3 17:50:05 2006 : Error: rlm_radutmp: Logout entry for NAS ERX port 102 has wrong ID Wed May 3 17:50:05 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed May 3 17:50:05 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Wed May 3 17:50:05 2006 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@localhost:radius Wed May 3 17:50:05 2006 : Error: rlm_sql_mysql: Mysql error '' Wed May 3 17:50:05 2006 : Error: rlm_sql (sql): Failed to connect DB handle #4 Wed May 3 17:50:05 2006 : Error: rlm_sql (sql): reconnect failed, database down? Wed May 3 17:50:05 2006 : Error: rlm_sql (sql): Couldn't insert SQL accounting STOP record - rlm_sql_mysql: no connection to db Wed May 3 17:50:05 2006 : Error: rlm_sql: Stop packet with zero session length. (user 'f81616', nas '194.54.200.1') Note that the MySQL logs show that the server was up the entire time without any reported problems. The effect of this seems to be that FreeRadius stopped responding to requests. Is this normal behavior when this happens? I assume so. Secondly is there anything we can do to prevent or mitigate this problem? Would increasing the number of connections help? Are there known problems in this area? Thanks in advance for your response. Bill

1 0

preventing several login in with same username at the same time?
by Frank Bonnet 03 May '06

03 May '06

Hello I use Chillispot with Freeradius and ldap everything works well :-) But I would like to prevent users to log in with the same username at the same time ( *some* students give their passwords to anyone ) Thanks a lot -- Frank Bonnet

1 0

ntlm_auth is not used by mschap
by robiwan＠arcor.de 03 May '06

03 May '06

Dear all, I try to authenticate Radius-users against my Microsoft-2003-Server Active-Directory using the mschap-Module with ntlm_auth. My Windows-Domain is "winlab" my username is "roka" and the Password is "Gerti1000". The winbindd and therefore the ntlm_auth works properly as you can see: Debian:~# /usr/bin/ntlm_auth --username=roka --password=Gerti1000 --domain=winlab NT_STATUS_OK: Success (0x0) Here is the mschap section of my /etc/freeradius/radiusd.conf: ----------snip radiusd.conf---------------------------- mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap ----------snap radiusd.conf---------------------------- Here is my /etc/freeradius/users: ----------------snip users------------------------------------- hugo Auth-Type = Local, User-Password == "hugo01" Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 roka Auth-Type := MS-CHAP Tunnel-Type = VLAN, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 40 DEFAULT Auth-Type := MS-CHAP DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP ----------------snap users................. Here is the output when i start freeradius, the ntlm_auth in the mschap-section is seen Debian:/etc/freeradius# freeradius -sfxxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Now i try to authenticate the user roka: --------------------------------------------------- Debian:/tmp# radtest roka Gerti1000 localhost 1645 testing123 Sending Access-Request of id 116 to 127.0.0.1:1812 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = Debian NAS-Port = 1645 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=116, length=20 And that is the output of my radiusd: ------------------------------------------------ rad_recv: Access-Request packet from host 127.0.0.1:33565, id=141, length=56 User-Name = "roka" User-Password = "Gerti1000" NAS-IP-Address = 255.255.255.255 NAS-Port = 1645 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "roka", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry roka at line 144 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [roka/Gerti1000] (from client localhost port 1645) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 141 to 127.0.0.1:33565 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 141 with timestamp 44586c93 Nothing to do. Sleeping until we see a request. I can not see that the ntlm_auth is used anywhere. I expect, that module mschap is calling the ntlm_auth, but it don't works I tried in the /etc/freeradius/users the following lines: roka Auth-Type := MSCHAP, MS-CHAP-USE-NTLM-Auth = 1 roka Auth-Type := MS-CHAP, MS-CHAP-USE-NTLM-Auth = yes but nothing works. Many thanks in advance for any suggestion Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

3 2

Aw: Re: ntlm_auth is not used by mschap
by robiwan＠arcor.de 03 May '06

03 May '06

----- Original Nachricht ---- Von: Stefan Winter <stefan.winter(a)restena.lu> An: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Datum: 03.05.2006 11:59 Betreff: Re: ntlm_auth is not used by mschap > > Now i try to authenticate the user roka: > > --------------------------------------------------- > > > > Debian:/tmp# radtest roka Gerti1000 localhost 1645 testing123 > > Sending Access-Request of id 116 to 127.0.0.1:1812 > > User-Name = "roka" > > User-Password = "Gerti1000" > > NAS-IP-Address = Debian > > NAS-Port = 1645 > > rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=116, > length=20 > > You send a packet that does not contain any MS-CHAP attributes. Because of > that, the server is not doing MS-CHAP: > > > modcall[authorize]: module "mschap" returns noop for request 0 > > As this line tells you. > > Send a MS-CHAP request, and look what happens then. > > Stefan > > -- > Stefan WINTER > > Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de > la Recherche > Ingenieur Forschung & Entwicklung > > 6, rue Richard Coudenhove-Kalergi > L-1359 Luxembourg > E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 > http://www.restena.lu Fax: +352 422473 > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > Hi Stefan, You say i do not send a MS-CHAP Request. Hmm ... Finally it should work with Windows-XP Supplicant: In my WindowsXP 802.1X Network-Configuration I can choose between "MD5Challenge" , or "secure EAP(PEAP)" or "Smartcart or other Certificate" What ist the right one? Or is mschap basically the wrong authentication method for my equipment? Robert Viel oder wenig? Schnell oder langsam? Unbegrenzt surfen + telefonieren ohne Zeit- und Volumenbegrenzung? DAS TOP ANGEBOT JETZT bei Arcor: günstig und schnell mit DSL - das All-Inclusive-Paket für clevere Doppel-Sparer, nur 44,85 inkl. DSL- und ISDN-Grundgebühr! http://www.arcor.de/rd/emf-dsl-2

2 1

freeradius + pptp + mysql
by Michael Gale 03 May '06

03 May '06

Hello, I am trying to get freeradius to work with my pptp / ppp server. I have followed the documents from the following locations: http://poptop.sourceforge.net/dox/radius_mysql.html http://www.frontios.com/freeradius.html However I am unable to get it to work when using freeradius. pptpd-1.3.0-0 ppp-2.4.3-5.rhel4 freeradius-1.0.1-3.RHEL4.3 My client is a XP Pro laptop using MS-CHAP v2 I believe, with just pptp / ppp and using a chap-secrect file it work great. However once I introduce freerdius and mysql I am unable to authentication. The following works fine on my test server: radtest testuser testpass localhost 1812 testing123 When trying from the XP Pro client it fails with: rlm_mschap: No MS-CHAP-Challenge in the request I have added the logs below, any feedback would be appreciated. Here are the logs: rad_recv: Access-Request packet from host 127.0.0.1:32804, id=83, length=65 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser" Calling-Station-Id = "10.10.0.3" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 radius_xlat: 'testuser' rlm_sql (sql): sql_set_user escaped user --> 'testuser' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'testuser' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'testuser' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'testuser' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... -- Michael Gale Red Hat Certified Engineer Network Administrator Pason Systems Corp.

5 7

default vlan for ldap users
by Nuno Reis 03 May '06

03 May '06

Hi, Is there any way to make freeradius assign a vlan to any user that was authenticated using active directory database? Something like, freeradius asks active directory for user authenticity, and if accepted, freeradius forwards always the same tunnel-pvt-group-id to NAS. Thanks, Nuno Reis -- No trees were killed in the sending of this message. However, a large number of electrons have been terribly inconvenienced

2 1

Re: Running prepaid apps on freeradius
by Sean 03 May '06

03 May '06

On Wed, 2006-05-03 at 12:13 +0200, freeradius-users-request(a)lists.freeradius.org wrote: > Running prepaid apps on freeradius Hi Checkout phpMyPreaid on sourceforge and http://swarmhotspots/faq for a tutorial. Sean

1 0