- Freeradius-Users - lists.freeradius.org

Encrypted passwords
by Vishwanath Srikant Pattanshetti 10 Mar '06

10 Mar '06

Hello All I am using Freeradius1.1.0 with Oracle 10 in my project for user authentication. I need to store encrypted passwords in the database - I would be using Java code to access the database for this purpose. However, I will be sending the password in clear text, to the jradius api to form the access request. This may sound strange, but its true. Is there any way, I can support, such a scenario? - ie. Can I instruct FreeRadius to execute some code(java preferably) before comparing the passwords?? Can some one please point me to some documentation? Or advise me, so that I can go ahead in this regard. Thanks in advance. -Vishwa.

2 1

RE: Freeradius-Users Digest, Vol 11, Issue 39
by Atkins, Dwane P 10 Mar '06

10 Mar '06

Thanks for all the input. I have one more question. Is there a way that I can input the start and stop time for user as far as in like an expiration date? Let say you are a contractor and need access for the 5 duty days you are in town. Can I put a config in that says, start on the 1st, end on the 5th? Thanks for all you inputs. Truly helpful. Dwane -----Original Message----- From: freeradius-users-bounces+atkinsd=uthscsa.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+atkinsd=uthscsa.edu@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Friday, March 10, 2006 5:36 AM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 11, Issue 39 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: freeradius newbie (mnisay) 2. RE: perl scripts (mnisay) 3. Re: Reload on freeradius 1.1.0 (Andr? Lemos) 4. Re: Reload on freeradius 1.1.0 (Andr? Lemos) 5. Re: Reload on freeradius 1.1.0 (Andr? Lemos) 6. Re: Reload on freeradius 1.1.0 (Andr? Lemos) ---------------------------------------------------------------------- Message: 1 Date: Fri, 10 Mar 2006 11:25:30 +0100 From: "mnisay" <mnisay(a)aim-consultants.com> Subject: RE: freeradius newbie To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <01c101c6442c$f5b90130$14c9ffd5@billgates> Content-Type: text/plain; charset="windows-1250" how about 1. Is there a good document that I can follow that will give me step-by-step instructions to install freeradius on Fedora 4? I would even do FreeBSD if need be but I am more familiar with the FC 4 processes. yum install freeradius 2. Is there a GUI front-end that will allow us to https into the FreeRadius Server and make changes to the mysql database? google for phpmyadmin and dialupadmin 3. Where would I find the debug documents that I read about when I execute the radtest executable? man radrest -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.375 / Virus Database: 268.2.1/278 - Release Date: 3/9/2006

1 0

need info regarding Reply-Message
by Vishwanath Srikant Pattanshetti 10 Mar '06

10 Mar '06

Hello All I am using Freeradius 1.1.0 with Oracle. I want to return a reply-message for all failed authentications. How should I configure this? Do I need to handle it through the query - select the reply-message if password does not match? Any information, or pointer to the same would be of great help. Thanks in advance -Vishwa.

1 0

Reload on freeradius 1.1.0
by André Lemos 10 Mar '06

10 Mar '06

freeradius 1.1.0 doesn't seem to cope with reloads as well as it did with freeradius 1.0.5. On the version 1.1.0 after about 2/3 reloads, I get the following on the logs: Tue Feb 25 16:23:22 2003 : Info: rlm_eap_tls: Loading the certificate file as a chain Tue Feb 25 16:23:22 2003 : Error: rlm_eap_tls: Error reading certificate file Tue Feb 25 16:23:22 2003 : Error: rlm_eap: Failed to initialize type tls Tue Feb 25 16:23:22 2003 : Error: radiusd.conf[9]: eap: Module instantiation failed. Tue Feb 25 16:23:22 2003 : Error: radiusd.conf[1668] Unknown module "eap". Tue Feb 25 16:23:22 2003 : Error: radiusd.conf[1616] Failed to parse authenticate section. this seems a bug related to how the version 1.1.0 copes with kill signals (I can't reproduce the problem with the version 1.0.5) Thanks Ps.: the command used was: kill -1 `cat /var/run/radiusd/radiusd.pid` -- **_____________________** * *André Ventura Lemos** **Software Engineer** **Critical Software, SA** **Webpage:** **www.andrelemos.com** **MSN:** **tux(a)tuxslare.org** **GSM:** **+351916401042** **TLF:** **+351239989100** DISCLAIMER: This message may contain confidential information or privileged material and is intended only for the individual(s) named. If you are not a named addressee and mistakenly received this message you should not copy or otherwise disseminate it: please delete this e-mail from your system and notify the sender immediately. E-mail transmissions are not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete or contain viruses. Therefore, the sender does not accept liability for any errors or omissions in the contents of this message that arise as a result of e-mail transmissions. Please request a hard copy version if verification is required. Critical Software.

2 7

freeradius newbie
by Atkins, Dwane P 10 Mar '06

10 Mar '06

Thank you for this mailing list. I am trying to install Freeradius on a FC4 device. I am also trying to use the MySql database function. I am having problems getting a good install. So, as usual, I have a few questions for you all. 1. Is there a good document that I can follow that will give me step-by-step instructions to install freeradius on Fedora 4? I would even do FreeBSD if need be but I am more familiar with the FC 4 processes. 2. Is there a GUI front-end that will allow us to https into the FreeRadius Server and make changes to the mysql database? 3. Where would I find the debug documents that I read about when I execute the radtest executable? Thanks for the help. Dwane <mailto:atkinsd@uthscsa.edu>

3 3

[freeradius-users]dialup_admin can't connect to the Sql server!!
by 刘杰 10 Mar '06

10 Mar '06

Hi, there. I'm configuring the dialup_admin but it always tell can't connect to the sql. Anything wrong with? I've configured the admin.conf as follows: " sql_debug: true sql_type: mysql sql_server: 2*.4*.2*.5* sql_port: 3306 sql_username: root sql_password: ****** sql_database: radius sql_accounting_table: radacct sql_badusers_table: badusers sql_check_table: radcheck sql_reply_table: radreply sql_user_info_table: userinfo sql_groupcheck_table: radgroupcheck sql_groupreply_table: radgroupreply sql_usergroup_table: usergroup sql_total_accounting_table: totacct sql_nas_table: nas sql_command: /usr/bin/mysql " and i've been running mysql server properly so is there anything more not properly made? Thx in advance. By the way, what does "use 'clear cache' page if you use sessions and do any changes in any of the configuration files" does it mean clear cache when using the browser? Regards. Jedliu 2006-03-10

1 0

freeradius auth logging (rlm_detail)
by ???????, ?? ???????? 10 Mar '06

10 Mar '06

Hi! Is it possible to log more detailed information about radius response packet for authorization? At the moment it looks like: Packet-Type = Access-Accept Wed Mar 8 10:25:57 2006 Auth-Type = Accept But how can I know, for which request it has responsed? Can I log the "Authenticator"? (Both, in the request and in the response?) ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

1 0

RE: Machine Authecitation with PEAP
by King, Michael 10 Mar '06

10 Mar '06

> -----Original Message----- > If it helps, this the ntlm command (which i think you have correct): > /usr/bin/ntlm_auth --request-nt-key --username=cse-mpr$ > --challenge=4de0a9c09623ab12 > --nt-response=d4b9516b28ba1760f8d31f8ac2b257d74a2439b9e104a102 > > - are you passing the domain correctly? (i dont specify the domain on > the ntlm_auth command line, whereas you have) i have the following in > samba.conf > I didn't have the ntlm_auth line correct. I did have the domain correct. I had this in the radius.conf file ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{msc hap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} BUT, in my notes, and on my working server, I had this: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response= %{mschap:NT-Response}" I removed the :-00 from the NT-Response and the Challenge options, and I also removed the --domain, since I had no idea why it was in there either. I think I only replaced bits and pieces of the default line in the example config, instead of deleting the whole line and pasting in my notes. Thanks, it works great now!

1 0

Re: Machine Authecitation with PEAP
by James J J Hooper 09 Mar '06

09 Mar '06

>>> ------------------------------ >>> >>> Message: 6 >>> Date: Thu, 9 Mar 2006 13:17:48 -0500 >>> From: "King, Michael" <MKing(a)bridgew.edu> >>> Subject: Machine Authecitation with PEAP >>> >>> Has anyone gotten Machine Authentication with PEAP working? >> Yes >>> >>> radius_xlat: '/usr/bin/ntlm_auth --request-nt-key >>> --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 >>> --nt-response=c92c >>> 121419368a6b599e159c9ef21bbc4d98138946d6df29 ' >>> >>> Exec-Program: /usr/bin/ntlm_auth --request-nt-key >>> --username=boy-it-tel-2528$ --domain=campus --challenge=8498683817c21d86 >>> --nt-response=c92c1 >>> 21419368a6b599e159c9ef21bbc4d98138946d6df29 >>> >>> Exec-Program output: Logon failure (0xc000006d) >>> >>> Exec-Program-Wait: plaintext: Logon failure (0xc000006d) >> >> From my experience this means the credentials the machine is sending are >> wrong or your version of samba is too old - get 3.0.21c (or at least >> 3.0.21a) >I wish it was that easy. I'm using Debian Package of the Testing >release. It's currently at 3.0.21b > >Does it have to anything to do with the host/ getting stripped off? Nope ... --username=boy-it-tel-2528$ is in the correct format If it helps, this the ntlm command (which i think you have correct): /usr/bin/ntlm_auth --request-nt-key --username=cse-mpr$ --challenge=4de0a9c09623ab12 --nt-response=d4b9516b28ba1760f8d31f8ac2b257d74a2439b9e104a102 for the radius packet: NAS-IP-Address = 172.17.51.78 NAS-Port = 50018 Cisco-NAS-Port = "GigabitEthernet0/18" NAS-Port-Type = Ethernet User-Name = "host/cse-mpr.cse.bris.ac.uk" Called-Station-Id = "00-16-C8-7C-A9-12" Calling-Station-Id = "00-07-E9-E7-41-50" Service-Type = Framed-User Framed-MTU = 1500 State = 0x2155356ae073362e26296c9869da2893 EAP-Message = 0x0207006d190017030100629bfa223d9efed1787d6bdeee43082a4a43adaf1792f0bd93acc6fbe8e4b7ee82d8d88380e459496d97435e7225e057fac5dd15e2525bd4ff36ae085cc54c677cc3e3a96d1f7a023f6b49 As far as i can tell the problem is with the windows / samba side of things: - might be a stupid question, but is the computer account properly registered in the domain? - is the account locked ?? - does it work if you try to auth as a user? - if you updated samba recently - have you restarted winbindd? - are you passing the domain correctly? (i dont specify the domain on the ntlm_auth command line, whereas you have) i have the following in samba.conf (the domain is UOB): [global] workgroup = UOB netbios name = IS-RHUBARB security = domain password server = ads.bris.ac.uk realm = ads.bris.ac.uk winbind use default domain = no winbind nested groups = Yes winbind enum users = No winbind enum groups = No remote browse sync = ads.bris.ac.uk where ads.bris.ac.uk is a round robin resolving to the IPs of 11 domain controllers. Regards, James -- James J J Hooper, Information Services University of Bristol --

1 1

Problem compiling Freeradius + MySQL on Solaris 9
by Alan 09 Mar '06

09 Mar '06

I've made symlinks like recommended in the mailing lists. I have also specified the lib, include and base MySQL directory when running the configure script. After running configure I always get the same output. Please help. -- configure: warning: mysql libraries not found. Use --with-mysql-lib-dir=<path>. configure: warning: sql submodule 'mysql' disabled -- OS: Solaris 9 (SPARC) MySQL Package: Sunfreeware (mysql-4.0.21-sol9-sparc-local.gz) -- ln -s /usr/local/mysql/lib /usr/lib/mysql ln -s /usr/local/mysql/include/mysql /usr/include/mysql -- ./configure \ --with-mysql-dir-dir=/usr/local/mysql/ \ --with-mysql-include-dir=/usr/local/mysql/include/mysql/ \ --with-mysql-lib-dir=/usr/local/mysql/lib/ -- "/usr/lib/mysql" libdbug.a libheap.a libmerge.a libmyisam.a libmyisammrg.a libmysqlclient.a libmysqlclient.la libmysqlclient.so -> libmysqlclient.so.12.0.0 libmysqlclient.so.10 -> libmysqlclient.so.10.0.0 libmysqlclient.so.10.0.0 libmysqlclient.so.12 -> libmysqlclient.so.12.0.0 libmysqlclient.so.12.0.0 libmysqlclient_r.a libmysqlclient_r.la libmystrings.a libmysys.a libnisam.a libvio.a

2 3