- Freeradius-Users - lists.freeradius.org

Authentication problem if CHAP is not used
by Alex M 20 Mar '06

20 Mar '06

Hi, I have a problem; I always get Access Reject saying that password is invalid. But when I'm using NTRadPing Test Utility, the same username and password works fine if I check to use CHAP, but when the CHAP check box is not selected then I'm getting the same problem as I have with my NAS. So can some one tell me how to make FreeRadius work so that if I'm using NTRadPing without CHAP it would still work! Thanks!!!

2 7

pppoe+mysql+Framed-IP-Address
by Norbert Grochal 20 Mar '06

20 Mar '06

I have just run pppoe server with freeradius pppeo user radius.so and radattr.so modules It works ok, but clients gets 'random' IP addreses... I need static IP (like that in /etc/ppp/chap-secrets last column). I try to add 1 record to my mysql, so I have: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'norbert' ORDER BY id -> ; +-----+----------+-------------------+---------------+----+ | id | UserName | Attribute | Value | op | +-----+----------+-------------------+---------------+----+ | 77 | norbert | User-Password | xxxxxxxx | == | | 258 | norbert | Framed-IP-Address | 82.177.xx.yy | := | +-----+----------+-------------------+---------------+----+ but I still gets IP addresses like 10.67.15.1 ..., not 82.177.xx.yy my example access-request contains Framed-Protocol = PPP: Packet-Type = Access-Request Fri Mar 17 15:25:22 2006 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "norbert" CHAP-Challenge = 0x4aaccdf7f520730e84f58bc4018c04217b97 CHAP-Password = 0xb6fe48120b0aed82ffdb4d782f3b51cd6a NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Client-IP-Address = 10.10.10.248 What I should do? norbert

4 8

Proxy Question (default_fallback)
by christian meutes 20 Mar '06

20 Mar '06

Hello list, i got a proxy configuration in which all auth requests for a specific realm is proxied to another radius server. The problem is that if this radius server isnt reachable the server is marked as dead and every further auth request is sucessfully authenticated locally in cause of a user default accept configuration. In proxy.conf i have set for the proxy realm a default_fallback=no, but this doesnt help. Anybody with an idea why this is happening? I dont want that the auth requests are tried locally if the real radius server isnt answering. best regards, Christian Meutes systems engineer -- claranet gmbh internet service provider tel +49 (0) 69 - 40 80 18 - 300 email: christian.meutes(a)de.clara.net http://www.claranet.de/

2 1

Backend Retry option
by Craig T. Hancock 20 Mar '06

20 Mar '06

When configuring your backend authentication and authorization system how does the retry option work. What I want to know is when connecting to the backend server and if it fails to connect given a specified time does freeradius cache the IP address after the first DNS lookup of the. server DNS name specified in the radiusd.conf file. Or does it attempt to do a DNS lookup on the server IP address on each retry. I am trying to investigate the possibility of load balancing my authentication backend through Round Robin DNS. -- ****************************************************** Craig T. Hancock Systems Engineer, Infrastructure Services Office of Information Technology University of Notre Dame ******************************************************

3 4

Exec program debugging.
by Eliot, Wireless and Server Administrator, Great Lakes Internet 20 Mar '06

20 Mar '06

I am trying to execute a program in the post-proxy section on Access-Accept packets to bring up bandwidth management for a user when they log in: (radiusd.conf) exec bwup { wait = no; program = "/etc/raddb/bwlimit start %{User-Name} %{Calling-Station-Id} %{Tunnel-Private-Group-Id:0} %{NAS-Port} %{GLI-Rx-Data-Rate} %{GLI-Tx-Data-Rate}" input_pairs = reply packet_type = Access-Accept output = none } post-proxy { # post_proxy_log # attr_rewrite # attr_filter exec eap } However, the exec call keeps failing when called from inside radiusd -X: Ready to process requests. rad_recv: Access-Request packet from host xxx.xxx.6.99:1645, id=3, length=128 User-Name = "" Framed-MTU = 1400 Called-Station-Id = "00-13-19-36-C4-52" Calling-Station-Id = "00-13-D3-67-D7-05" Service-Type = Login-User Message-Authenticator = 0x43483d78f3b3f25bcb7657f1522050ef EAP-Message = 0x0202000501 NAS-Port-Type = Wireless-802.11 NAS-Port = 262 NAS-IP-Address = xxx.xxx.6.99 NAS-Identifier = "xxxx-Ch11" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "" rlm_realm: Proxying request from user to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 0 modcall: group authorize returns updated for request 0 Sending Access-Request of id 0 to xxx.xxx.178.13:1645 User-Name = "" Framed-MTU = 1400 Called-Station-Id = "00-13-19-36-C4-52" Calling-Station-Id = "00-13-D3-67-D7-05" Service-Type = Login-User Message-Authenticator = 0x00000000000000000000000000000000 EAP-Message = 0x0202000501 NAS-Port-Type = Wireless-802.11 NAS-Port = 262 NAS-IP-Address = xxx.xxx.6.99 NAS-Identifier = "xxxx-Ch11" Proxy-State = 0x33 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Challenge packet from host xxx.xxx.178.13:1645, id=0, length=80 Proxy-State = 0x33 Session-Timeout = 30 EAP-Message = 0x010300061920 State = 0x1cc30355000001370001d819b406000000034b872b6f01 Message-Authenticator = 0x2153f90d4c19a27ae054f7f297611c86 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 0 rlm_exec (exec): We require a program to execute modcall[post-proxy]: module "exec" returns fail for request 0 modcall: group post-proxy returns fail for request 0 Going to the next request --- Walking the entire request list --- Waking up in 31 seconds... But, if I take the values from a valid Access-Accept packet for the attributes listed above, the file executes correctly with no errors: wireless-r1 raddb # su - radiusd radiusd@wireless-r1 ~ $ /etc/raddb/bwlimit start egable 00:a0:12:34:56:78 3 7 1024 512 radiusd@wireless-r1 ~ $ /etc/raddb/bwlimit stop egable radiusd@wireless-r1 ~ $ exit logout wireless-r1 raddb # All of my rules get added correctly when issuing a start command and they get removed correctly when issuing the stop command, but only if I issue the commands from the command line. If I add more Xs to the -X, it still doesn't tell me why it is failing (what the specific error message is): Mon Mar 20 13:32:45 2006 : Debug: Processing the post-proxy section of radiusd.conf Mon Mar 20 13:32:45 2006 : Debug: modcall: entering group post-proxy for request 0 Mon Mar 20 13:32:45 2006 : Debug: modsingle[post-proxy]: calling exec (rlm_exec) for request 0 Mon Mar 20 13:32:45 2006 : Error: rlm_exec (exec): We require a program to execute Mon Mar 20 13:32:45 2006 : Debug: modsingle[post-proxy]: returned from exec (rlm_exec) for request 0 Mon Mar 20 13:32:45 2006 : Debug: modcall[post-proxy]: module "exec" returns fail for request 0 Mon Mar 20 13:32:45 2006 : Debug: modcall: group post-proxy returns fail for request 0 Mon Mar 20 13:32:45 2006 : Debug: Going to the next request Mon Mar 20 13:32:45 2006 : Debug: rl_next: returning NULL Mon Mar 20 13:32:45 2006 : Debug: Waking up in 6 seconds... I am assuming I just have the configuration for this set up wrong or something. Obviously, the Access-Accept packet is not yet coming back because the first Access-Challenge hasn't even been passed on to the AP yet. So, I'm not sure why the post-proxy section even wants to fire the program at this point in the authentication process. Does anyone know what I did wrong? Thanks. Eliot Gable Certified Wireless Network Administrator (CWNA) Certified Wireless Security Professional (CWSP) Cisco Certified Network Associate (CCNA) CompTIA Security+ Certified CompTIA Network+ Certified Network and Systems Administrator Great Lakes Internet, Inc. 112 North Howard Croswell, MI 48422 (810) 679-3395 (877) 558-8324 Now offering Broadband Wireless Internet access in Croswell, Lexington, Brown City, Yale, and Sandusky. Call for details.

2 1

Backup/Primary Radius Config
by Maqbool Hashim 20 Mar '06

20 Mar '06

Hi, I have two radius servers one primary and one backup one, on different ip addresses. They both have a mysql backend which runs on the same physical machine. I need the sql database and radius configuration files to be synchronised periodically (probably every 24hours). I guess this is a common setup, so I'd appreciate some ideas as to the best way to achieve this? Thanks -- ------------------------------------------------------- Sohonet ltd http://www.sohonet.co.uk Taking digital sound and vision to the world since 1995 Tel:+44(0)20 7292 6900 Fax:+44(0)20 7292 6901 Sup:+44(0)20 7292 6909 Email:support@sohonet.co.uk -------------------------------------------------------

3 2

Multiple NAS-Identifier
by DESETech - German P. Santillan 20 Mar '06

20 Mar '06

How I can configure multiples "NAS-Identifier" attributes in my "users" file? Thanks in advance Germán P. Santillán Administrador de Redes Responsable Dpto. Técnico DESETech Argentina S.A. San Martín 133 - CP: B8000FIC Bahía Blanca - Argentina Tel/Fax: +54 (291) 456-5642 gsantillan(a)desetech.com.ar http://www.desetech.com.ar

2 1

General question about authentication/authorization
by Florian Prester 20 Mar '06

20 Mar '06

Hi, 1.) in the users-file, I can only check for attributes provided by the request - correct? 2.) in the users-file, if an entry matches all check-attributes, I can specify an Auth/Autz-Type - correct? 3.) in the users-file, if I do not specify the Auth/Autz-Type the radius is taken the requested Type automatically - correct? 4.) Authentication is comparing a password - correct? 5.) Authorization is even if a password is correct, the user may not use/do something - correct? 6.) Authorization is done by providing appropriate reply-attributes - correct? Now the big question: If I have an user who is authenticate, meaning correct username + password whereas the password is stored in LDAP. I want to replay attributes according th some other information stored in LDAP - how can I do such a thing, like: IF ldap-attribute::xy == valid_1 THEN RETURN ldap-attribute::IP-good, ELSIF dap-attribute::xy == valid_2 THEN RETURN ldap-attribute::IP-better, ELSE RETURN ldap-attribute::IP-bad Thanks Florian -- Dipl. Inf. Florian Prester Network Administration Regionales RechenZentrum Erlangen Universitaet Erlangen-Nuernberg Martensstr. 1 91052 Erlangen Germany Tel.: +499131 8527813

5 18

Authentication Question
by fvt3 20 Mar '06

20 Mar '06

Hi, I'm pretty new to freeradius and need some help. In Freeradius, when a request is made can you used the supplied userid and password to authenticate off from LDAP and if the user does not exist in LDAP can force it to authenticate off from the local database? If this is possible, can you direct me to some links that can further assist me. Thanks in advance ... __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

rlm_eap: identity does not match User-Name, setting from EAP identity
by Agent Smith 20 Mar '06

20 Mar '06

Hello group, I have FR configured for EAP/TLS for wireless but I ran into an interesting problem. When a user connectes, they are presented with a login box (username, password and domain name) if they put a domain name in the domain field, radius can't authenticate them and gives that error message. when the domain field is left empty, it works fine. I read some posting that talked about how you have to turn off ntdomain_hack off and I tried that, it didn't gave me that error but then the ntlm_auth failed saying 'NO SUCH USER' so my guess is that the user-name has to be exactly same as what gets sent into EAP message. has anyone else ran into this? any ideas on how to fix it? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

5 11