- Freeradius-Users - lists.freeradius.org

Want to use 2 different authentication-methods
by Hans-Peter Fuchs 22 Mar '06

22 Mar '06

I use freeradius 1.0.5 for a special NAS I want to use 2 user databases. requests from nas-special should first verified per sql If and only if sql does not verify the user try pam. In users I have: ##### new DEFAULT NAS-IP-Address == special, Autz-Type := SQL Idle-Timeout = 3600, Session-Timeout= 7200, Fall-Through = yes #### end new #### begin old config: works DEFAULT Auth-Type = Pam Service-Type = Framed-User, Nomadix-Bw-Up = 128, Fall-Through = yes ### end old config ### begin new config # pam-authentified users from ssg get Ainternet-attribute DEFAULT NAS-IP-Address == special Service-Type = Framed-User, Idle-Timeout = 3600, Session-Timeout= 7200, Cisco-Account-Info += "KW0", Fall-Through = yes ### end new config But with this users who are verified by sql are also checked against pam. Do you have some tips? Output from radiusd -X: rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 0 modcall: group Autz-Type returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radius> for pam.conf lookup pam_pass: function pam_authenticate FAILED for <test>. Reason: Permission denied modcall[authenticate]: module "pam" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Grüße Hans-Peter Fuchs Hans-Peter Fuchs - RZKR, Zimmer 20 Zentrum fuer angewandte Informatik - Universitaetsweiter Service RRZK Universität zu Köln - Tel: 0221-470-6972

2 1

Version 1.1.1 has been released
by Alan DeKok 22 Mar '06

22 Mar '06

Version 1.1.1 has just been released. http://www.freeradius.org/security.html Upgrade now, or disable EAP-MSCHAPv2. That's a bad bug. ChangeLog: Security fixes * Additional state checking in the EAP-MSCHAPv2 module. Bug found by Steffen Schuster. Feature improvements * More dictionary updates * Additional tests and fixes for Digest module from Phillipe Sultan. * Add new "phone" response mode to rlm_otp/cryptocard. * Put the eap sessions into a tree, so that looking them up is very fast, and no longer O(n) in the number of sessions. * Install the schema examples for a set of backends with the rest of the documentation. * Add support for xlat expansion of attributes from LDAP. Bug fixes * Fix rlm_perl crash. (closes: #348) * Fix handling of CoA-Request packets (close #344). Also correct name of CoA packets. * Fix an error on x86_64 machines when reading dictionaries. (closes: #312) * Fix compilation errors on FreeBSD and NetBSD because of rlm_otp module. (closes: #314 #328) * Workaround Cisco bug in State attribute handling in rlm_otp. * Support LP64 for async mode in rlm_otp. * Fix libtool problems on Debian with rlm_eap_peap and rlm_eap_ttls modules. (closes: #75) * Make "use_tunneled_reply" work properly for PEAP. * Copy the whole string when getting a one-to-one-mapped attribute from LDAP (closes: #261) * Fix net-snmp's ucd-snmp compatibility mode.

5 6

request object pointer offset
by jasonatx0001 22 Mar '06

22 Mar '06

I am having some difficulty accessing the data in the request object inside my module. It seems the pointers are offset ... inside the authenticate method of my module ... DEBUG ("MYMODULE: request->config_items->name = %s", request->config_items->name); DEBUG ("MYMODULE: request->config_items->strvalue = %s", request->config_items->strvalue); if (!request->username) { DEBUG ("MYMODULE: no username found\n"); } else { DEBUG ("MYMODULE: request->username->strvalue = %s\n", request->username->strvalue); } if (!request->password) { DEBUG ("MYMODULE: no password found\n"); } else { DEBUG ("MYMODULE: request->password->strvalue = %s\n", request->password->strvalue); } DEBUG ("MYMODULE: request->number = %d\n", request->number); return RLM_MODULE_REJECT; ... and this is the output i get from radiusd -X ... auth: type "mymodule" Processing the authenticate section of radiusd.conf modcall: entering group mymodule for request 0 MYMODULE: request->config_items->name = User-Name MYMODULE: request->config_items->strvalue = testuser MYMODULE: request->username->strvalue = test MYMODULE: no password found MYMODULE: request->number = 0 modcall[authenticate]: module "mymodule" returns reject for request 0 modcall: leaving group mymodule (returns reject) for request 0 auth: Failed to validate the user. ... As you can see, the config_items VP* points to the User-name VP and the username VP* points to the password and the password VB* is NULL. Any ideas ? -- View this message in context: http://www.nabble.com/request-object-pointer-offset-t1325410.html#a3537076 Sent from the FreeRadius - User forum at Nabble.com.

2 2

Questions about FreeRadius proxy
by Dovelet 22 Mar '06

22 Mar '06

Hi all, I am new in FreeRadius and I hope someone can kindly help me. I have several questions: Q1) I just setup a FreeRadius server and I want to set it as a Radius Proxy server. I know Realm can do it but I found that to use Realm, the user needs to append the domain @xxx.com (i.e. user01(a)xxx.com) at the end. Is it true? Can I skip the domain @xxx.com? (i.e. user just type the username [user01] and the FreeRadius can proxy to another RADIUS server). Q2) Can I setup a table in the FreeRadius server with username only so that when the Application server request for authentication, the FreeRadius will proxy to another RADIUS server only if the username is listed in the table? Q3) If Q2 is feasible, can I have several Application Servers and I limit the users from the Application servers? i.e. If user01 login Appliation server1, Application Server1 request the FreeRadius server. The FreeRaidus server check the user01 is belongs to Application Server1 group and it proxy the request to another RADIUS server. Application Server1 - user01 - user02 Application Server2 - user03 - user04 Any suggestions are welcome. Sorry for so many questions. Regards, Dovelet -- View this message in context: http://www.nabble.com/Questions-about-FreeRadius-proxy-t1297096.html#a34536… Sent from the FreeRadius - User forum at Nabble.com.

3 4

Load-balance and Auth-Type
by Evil I_Am 22 Mar '06

22 Mar '06

Hi all I have this scenario: 2 radius servers must point to 2 ldap servers with a load-balancing and fault-tolerant configuration. I tried to implement this on one of the radius servers this way: modules { ldap ldap1 { ........... authtype = ldap #added later but seems not to work } ldap ldap2 { ........... authtype = ldap #added later but seems not to work } } authorize { preprocess load-balance { # between two redundant sections below redundant { ldap1 ldap2 } redundant { ldap2 ldap1 } } } authenticate { Auth-Type LDAP { load-balance { # between two redundant sections below redundant { ldap1 ldap2 } redundant { ldap2 ldap1 } } } but if i try to authenticate a user i see this in debug: rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:25702, id=169, length=77 User-Name = "XXXXXX" User-Password = "XXXXXX" NAS-IP-Address = XXX.XXX.XXX.XXX NAS-Identifier = "login" NAS-Port = 24677 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall: entering load-balance group for request 0 modcall: entering group redundant for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for XXX radius_xlat: '(uid=XXX)' radius_xlat: 'dc=XXXXXXX,dc=XX' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to XXX.XXX.XXX.XXX:389, authentication 0 rlm_ldap: bind as / to XXX.XXX.XXX.XXX:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=XXXXXXX,dc=XX, with filter (uid=XXX) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusServiceType as Service-Type, value Shell-User & op=11 rlm_ldap: extracted attribute Cisco-AVPair from generic item cisco-avpair="shell:priv-lvl=15" rlm_ldap: user futhwo authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 modcall: leaving group redundant (returns ok) for request 0 modcall: load-balance group returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 169 to XXX.XXX.XXX.XXX port 25702 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 169 with timestamp 44212404 Nothing to do. Sleeping until we see a request. If i keep only 1 module,call it simply ldap and give up on load balancing everything works ok. How can i resolv this issue?

2 1

Failed Compilation of Freeradius with Mysql since 1.1.0 (Works on 1.0.5)
by Philippe JOYEZ 22 Mar '06

22 Mar '06

Hello All, I've seen many topics about that problem but no one of them has solved my problem. I'm trying to upgrade my 1.0.5 Freeradius server to 1.1.1 on my Solaris 8 system but it fails to find mysql libs. On the same server, I use the same configure scripts options: ./configure --localstatedir=/var --with-logdir=/var/log/radius/log --with-radacctdir=/var/log/radius/radacct --with-mysql-lib-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc/l- ib --with-mysql-include-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-spa- rc/include --with-mysql-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc It works for 1.0.5 but not for 1.1.1 (and also KO for 1.1.0): configuring in ./drivers/rlm_sql_mysql running /bin/sh ./configure --localstatedir=/var --with-logdir=/var/log/radius/log --with-radacctdir=/var/log/radius/radacct --with-mysql-lib-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc/l- ib --with-mysql-include-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-spa- rc/include --with-mysql-dir=/usr/local/mysql-standard-4.1.7-sun-solaris2.8-sparc --enable-ltdl-install --cache-file=../../../../.././config.cache --srcdir=. loading cache ../../../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking for mysql_config... (cached) no checking for pthread_create in -lpthread... (cached) yes checking for mysql_init in -lmysqlclient_r... no configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. checking for mysql/mysql.h... yes configure: warning: sql submodule 'mysql' disabled creating ./config.status creating Makefile creating config.h config.h is unchanged Best regards -- Disclaimer ------------------------------------ Ce message ainsi que les eventuelles pieces jointes constituent une correspondance privee et confidentielle a l'attention exclusive du destinataire designe ci-dessus. Si vous n'etes pas le destinataire du present message ou une personne susceptible de pouvoir le lui delivrer, il vous est signifie que toute divulgation, distribution ou copie de cette transmission est strictement interdite. Si vous avez recu ce message par erreur, nous vous remercions d'en informer l'expediteur par telephone ou de lui retourner le present message, puis d'effacer immediatement ce message de votre systeme. *** This e-mail and any attachments is a confidential correspondence intended only for use of the individual or entity named above. If you are not the intended recipient or the agent responsible for delivering the message to the intended recipient, you are hereby notified that any disclosure, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify the sender by phone or by replying this message, and then delete this message from your system.

4 3

(no subject)
by vignesh 22 Mar '06

22 Mar '06

Hello guys This is Vignesh here. I have just started with RADIUS. We are planning to build a VoIP billing system using Free RADIUS and Oracle as the backend and using CISCO IPIP gateway . We were planning to implement both postpaid and prepaid scenario. I believe most of you must be doing the same thing. So far we were working on PostPaid Solution. There some problems that we are facing 1. we are using triggers to do the accounting of the call. i.e. calculating the rates etc for that particular call. There many users who can call from either using gateway or using soft phones, hard phones etc. the problem is that while accounting using the trigger, there is no single column from where we can identify the user. The user can be accounted based on his ani or his remote gateway. Also we want multi leg accounting. 2. also we would like to know how we can build a prepaid solution. What are the changes that needs to be done for doing the same. Vignesh vignesh(a)novanet.net

1 0

Doubt regarding sql.conf
by vignesh 22 Mar '06

22 Mar '06

Hello guys I am trying to modify the query for authorization in sql.conf file. I will let you know what I exactly want I want to authenticate users based on the CLID and the remote ip address. The problem is that the remote address has to be searched from a set of ips. I will give you a example Suppose that we have a user 9204 and the call for this particular user has to come from a set of ips like 222.223.33.24 or 33.44.334.44 and many more. the user will be authenticated only when the ani is 9204 and the ip is either of these only. But I am not sure how to modify the query or is there something else That I need to do.. Vignesh vignesh(a)novanet.net

1 0

Table radacct is empty
by Vincent MARGUERIE 22 Mar '06

22 Mar '06

Hi, I've installed freeradius 1.1.1 on a Debian Sarge distribution, and the connection works fine with my wireless windows XP client but I have a problem to get information into radacct table in my mysql database. Does anyone get solution for this ? Rq : I use a Dlink-DWL-2000AP+ as Acces Point Regards, Vincent

2 1

Avoiding ldapsearch on LDAP authentication
by MAEDA 22 Mar '06

22 Mar '06

Hello, I'm running Freeradius 1.0.4 with OpenLDAP 2.2.29 on my Fedora Core 4 box and try to configure radiusd so that ldap_search is not performed on authentication (i.e. just use ldap_bind for authentication). But so far, I've got no success. Radiusd seems to perform search anyway. I've read the document doc/rlm_ldap and followed the instruction, but I couldn't get it working (I must be missing something). I configured radiusd as follows: In users: DEFAULT Ldap-UserDn := `uid=%{User-Name},ou=people,dc=atusi,dc=org`, Auth-Type = LDAP In radiusd.conf: modules { ldap { server = "localhost" ldap_debug = 0xFFFF # identity = "cn=admin,o=My Org,c=UA" # password = mypass basedn = "ou=people,dc=atusi,dc=org" # filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" start_tls = no access_attr = "dialupAccess" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } ... } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } # All other parts are left as default. When I test my setup with: (echo 'User-Name=mytestuser'; echo 'User-Password = mypassword') | radclient -c 1 127.0.0.1 auth testing123 radiusd (run with -X option) says: rad_recv: Access-Request packet from host 127.0.0.1:32791, id=183, length=43 User-Name = "mytestuser" User-Password = "mypassword" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "mytestuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 214 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "mytestuser" with password "mypassword" radius_xlat: '(uid=mytestuser)' radius_xlat: 'ou=people,dc=atusi,dc=org' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 ldap_bind ldap_simple_bind ldap_sasl_bind ldap_send_initial_request ldap_new_connection ldap_int_open_connection ldap_connect_to_host: TCP localhost:389 ldap_new_socket: 6 ldap_prepare_socket: 6 ldap_connect_to_host: Trying 127.0.0.1:389 ldap_connect_timeout: fd: 6 tm: 1 async: 0 ldap_ndelay_on: 6 ldap_is_sock_ready: 6 ldap_ndelay_off: 6 ldap_open_defconn: successful ldap_send_server_request rlm_ldap: waiting for bind result ... ldap_result msgid 1 ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 4 sec, 0 usec), msgid 1 wait4msg continue, msgid 1, all 1 ** Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue Mar 21 13:31:12 2006 ** Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=1, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 1, all 1 ldap_read: message type bind msgid 1, original id 1 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 1 request 1 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result ldap_msgfree rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,dc=atusi,dc=org, with filter (uid=mytestuser) ldap_search put_filter: "(uid=mytestuser)" put_filter: simple put_simple_filter: "uid=mytestuser" ldap_send_initial_request ldap_send_server_request ldap_result msgid 2 ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL wait4msg (timeout 4 sec, 0 usec), msgid 2 wait4msg continue, msgid 2, all 1 ** Connections: * host: localhost port: 389 (default) refcnt: 2 status: Connected last used: Tue Mar 21 13:31:12 2006 ** Outstanding Requests: * msgid 2, origid 2, status InProgress outstanding referrals 0, parent count 0 ** Response Queue: Empty ldap_chkResponseList for msgid=2, all=1 ldap_chkResponseList returns NULL ldap_int_select read1msg: msgid 2, all 1 ldap_read: message type search-result msgid 2, original id 2 new result: res_errno: 0, res_error: <>, res_matched: <> read1msg: 0 new referrals read1msg: mark request completed, id = 2 request 2 done res_errno: 0, res_error: <>, res_matched: <> ldap_free_request (origid 2, msgid 2) ldap_free_connection ldap_free_connection: refcnt 1 ldap_parse_result rlm_ldap: object not found or got ambiguous search result ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authenticate]: module "ldap" returns notfound for request 0 modcall: group Auth-Type returns notfound for request 0 auth: Failed to validate the user. According to the log lines: rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 I guessed (by reading rlm_ldap.c) Ldap-UserDn valuepair is not passed to ldap_authenticate() for some reason. I tried to write `Ldap-UserDn := ...' as reply item of the DEFAULT entry in users file but in that case radiusd says: WARNING! Check item "Ldap-UserDn" ?found in reply item list for user "DEFAULT". ?This attribute MUST go on the first line with the other check items and still got the same result. I also tried in radiusd.conf: modules { ldap { identity = "%{Ldap-UserDN}" password = `%{User-Password}` ... } } but these attributes are not xlated and passed to LDAP as they are. Any clues would be greately appreciated.

3 3