- Freeradius-Users - lists.freeradius.org

Linksys and Dlink access Point does not authenticate to FreeRadius 1.1.0 server
by Michael Calizo 28 Feb '06

28 Feb '06

Hi, I have a Dlink DI-824VUP+ wireless VPN router, Freeradius 1.1.0 server. My free radius is working, I can authenticate using radtest on both localhost and remote host. But when i try to use my Dlink access point to authenticate on freeradius nothing happened. My Dlink config looks like this: Network ID: myWIFI Chanel: 6 Security: WAP *802.1X Settings * Radius Server: 192.168.1.12 Radius Port: 1812 Shared Key: test123 When I issue radiusd -x nothing is happening using Dlink. But when I use radtest it authenticates. Thnx alot.. -- Mike Calizo Registered Linux User # 365113 _________________________________________________ Even the longest journey has to start with a small first-step

1 0

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 27 Feb '06

27 Feb '06

Having pap pap{ encryption_scheme = crypt } pap papplain{ encryption_scheme = clear } .... Auth-Type PAP { pap } Auth-Type PAPPLAIN { papplain } in radiusd.conf having user1 Crypt-Password := blablaencrypted user2 User-Password := blablacleartext in radcheck table. having pptp Auth-Type := PAPPLAIN dialup Auth-Type := pap in radgroupcheck having user1 ppttp user2 dialup in user groups... In fact I have added extra logic to the custom dialup-admin clone I am running to make it select the right attribute and ecnryption scheme or none for user depending on his/her membership in a certain group. Regards Alex.

2 1

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 27 Feb '06

27 Feb '06

Alan, I've solved my problems already... I've even finished the custom modification to dialup-admin which takes care of changing the Crypt-Passwords to User-Passwords for users accessing the new services. Thanks for clearing things up... >> btest | NT-Password | == | NT-hashbla-bla-bla^&&@0-3443 >> btest | Crypt-Password | == | $$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 > Which is exactly what I keep saying is not needed, and is causing > problems for you. OK, I understood your point, but would you be so kind to explain WHY do you think it is such a bad idea (besides the fact that it doesn't work with the current version of rlm_sql)... The solution seems to be perfectly logical: - none of the network technitians on-site can abuse user's passwords since they are encrypted and supposedly beyound their cracking abilities, and both PAP and MS-CHAP should work... OK, again, it doesn't work NOW, but why shouldn't it? What's so evil about this configuration? Btw, in freeradius FAQ you, guys, claim, that PAP is better than CHAP because it allows storing passwords in encrypted form. I kinda agree with that... Why do you now claim that storing in clear text is better? Ok, it is less headache for me, but what about privacy rights of my users? Thanks Alex

3 2

RE: type of lvalue in VALUE_PAIR
by Jonathan De Graeve 27 Feb '06

27 Feb '06

> -----Oorspronkelijk bericht----- > Van: freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org > [mailto:freeradius-users- > bounces+jonathan.de.graeve=imelda.be(a)lists.freeradius.org] Namens Alan > DeKok > Verzonden: maandag 27 februari 2006 23:17 > Aan: edvin.seferovic(a)kolp.at; FreeRadius users mailing list > Onderwerp: Re: type of lvalue in VALUE_PAIR > > "Seferovic Edvin" <edvin.seferovic(a)kolp.at> wrote: > > Okay - but I suppose I will have to patch my NAS ( Poptop server ) to > use > > Acct-Input-GigaWords and Output- instead of Octets. Still if I patch my > NAS > > to send GigaWords.. when I use sqlcounter to count the MBs I will still > not > > be able to compare the check-name which is written into uint32 variable. > > Shouldn't this be patched too ( I am not a professional programmer - so > > excuse my "silly" question ). > > Yes, but that doesn't have much to do with RADIUS attributes. > > If your NAS doesn't send the Gigawords attributes, then why are you > worried about people using more than 4G of traffic? Your NAS will > never tell the server that the user had more than 4G of traffic. > The nice thingy about this is that most nasses just wrap around 2GB (2^31, signed int instead of 2^32,unsigned int) > > Poptop server accepts Session-Octets-Limit for the traffic limit ( > actually > > it is ppp that is doing the limiting ). So Ive added this attribute to > my > > dictionary. PPP also needs Octets-Direction so it can know which traffic > > flow to count. Ive added both attributes and it is working ( for 2^32 ). > > Ah, Ok. > > > Can you give me some directives how to implement this. Maybe to extend > the > > config of sqlcounter and value_pair struct? > > I don't see how that will help if your NAS doesn't send the Gigaword > attributes. > > If it does send them, then yes, you'll have to update the sqlcounter > module to handle 64-bit numbers. But you don't need to update any of > the valuepair structures. You could do it by using a multiplicator, say using kbytes/mbytes instead of bits/bytes. That will save you the 64-bit numbering within sqlcounter. SQL can handle this with the builtin calculation functions J.

1 0

LDAP auth and different use of access_attr
by John Keimel 27 Feb '06

27 Feb '06

I've a FreeRADIUS server (1.0.2, from debian stable) that is set up to authenticate users of a VPN into the network. I've presently got the firewall talking to FreeRADIUS which then talks to LDAP and check the existence access_attr: vpntype If the users profile has the attribute of vpntype in it, they're let in. What we'd rather do is allow access based on the value of access_attr . So rather than just allowing if it exists, we might later pass on some extra rights to people in different groups. vpntype: foo or vpntype: bar vpntype: baz - whatever those values might be. Am I looking in the wrong spot for this ? Is access_attr: the right place to put such a setting? Or is there someplace else. I've done some basic searches of the mail archive, but I think my barking up the wrong tree may be causing my searches to be too broad. Pointers towards fine tuning my search or possibly some threads on this, would be welcome. Thanks j

2 1

logging Access-Reject messages
by Geoff Silver 27 Feb '06

27 Feb '06

Hi everyone, I have no trouble logging Access-Request and Access-Accept messages, but neither rlm_detail nor "log_auth = yes" seems to log Access-Reject messages. I feel quite silly asking this, but is there something special I need to do to get these logged? My radiusd.conf file looks like: authorize { preprocess detail auth_log attr_filter files } authenticate { Auth-Type System { unix } } preacct { preprocess acct_unique files } accounting { detail } session { } post-auth { reply_log } I'm happy to send any extra config you'd like - just let me know. Alternately, I'm happy to patch the code to allow this if someone knows the right place to do it. Thanks for any ideas!

2 2

Disconnect the user if reach the limit
by Yudi Wijaya 27 Feb '06

27 Feb '06

Hello , I create HotSpot system with MikroTik, FreeRADIUS + MySQL But i have problem : How to disconnect user when reach the usage limit (ex: 50 hours, 50 MBytes)? depends on they prepaid registration, so it will stored at RADIUS (MySQL Database). Everyone can register via web based hmmm.. if it possible, how to give user information when they reach the limit like "Time's Up", etc. Does it using RadKill ? but, actually i don't know how to use it. thanks before.. -- Best regards, Yudi Wijaya

2 3

freeradius authorization without "username"
by ???????, ?? ???????? 27 Feb '06

27 Feb '06

I have a freeradius, and I need "Calling-Station-Id" for authorization. This is the one attribute, which I select in the radiusd.conf checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } (But in fact, I do not use this) Why, when freeradius rescieve the access-request packet, and "username" field is empty, then we got access-denied? I use SQL authorization module. In the database (I use it as a blacklist, id Calling-Station-Id exist in the list, then access denied.): +----+------------+-----------+----+--------+ | id | UserName | Attribute | op | Value | +----+------------+-----------+----+--------+ | 2 | 3339222222 | Auth-Type | == | Reject | | 1 | all_users_not_in_black_list | Auth-Type | == | Accept | +----+------------+-----------+----+--------+ >From sql.conf: authorize_check_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authcheck_table} \ WHERE Username = IF(Username='%{SQL-User-Name}','%{SQL-User-Name}','all_users_not_in_black_list') \ LIMIT 1" authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = 'all_users_not_in_black_list' \ ORDER BY id" So, info from radiusd in debug mode: rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:1812, id=182, length=113 NAS-Identifier = "ggsn2" User-Name = "" User-Password = "" NAS-IP-Address = XXX.XXX.XXX.XXX NAS-Port-Type = Virtual Called-Station-Id = "1000" Calling-Station-Id = "3339222225" Acct-Session-Id = "d45d6126057478b1" Acct-Multi-Session-Id = "d45d61260000b77a" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail.log' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail.log expands to /usr/local/var/log/radius/radacct/auth-detail.log modcall[authorize]: module "auth_log" returns ok for request 0 rlm_sql (sql): zero length username not permitted modcall[authorize]: module "sql" returns invalid for request 0 modcall: leaving group authorize (returns invalid) for request 0 Invalid user: [/] (from client ggsn2 port 0 cli 3719248521) Sending Access-Reject of id 182 to XXX.XXX.XXX.XXX port 1812 I don't care, what kind of username do we have! How I can avoid this problem? :-( Can someone help me with this quesion? Here is the part of my radiusd.conf file: <...skipped...> modules { checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } # Livingston-style 'users' file # files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/acct-detail.log detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/auth-detail.log detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/reply-detail.log detailperm = 0600 } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{Calling-Station-Id} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } } instantiate { } authorize { auth_log # See "Authorization Queries" in sql.conf sql } authenticate { } accounting { detail radutmp } session { radutmp } # Post-Authentication post-auth { reply_log } ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

2 1

re: Client certs with MSCHAPV2 in PEAP
by Norbert Wegener 27 Feb '06

27 Feb '06

>"Dave Huff" <dbhuff at yahoo.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >>/ > For EAP-TLS to work, the client certs have to be />>/ > signed by the server cert. />>/ Signed by the server cert or by the CA cert? I have a CA that signed the />/> server and client certs, and the eap.conf file knows where server and CA />/> certs are. / > If you're using 1.0.x, that won't work. It doesn't do certificate >chains. The client cert MUST be signed by the server cert. Using a >CA to sign them, both won't work. > > I'm not even sure it will work in 1.1.0, to be honest. > > Alan DeKok In 1.1.0 I have chained client certificates and for me EAP-TLS works, if the client does not require the server to authenticate itself. The client cert is not signed by the server cert. It seems to be neccessary,that if you have a root ca and an issuing ca, the CA_file must contain the certificates of both of them. If the client requires the server to authenticate itself, the whole process fails. Norbert Wegener

1 0

how to confirm locally??
by pelusa vali 27 Feb '06

27 Feb '06

hi everybody, i'm using debian sarge kernel 2.6.13, openssl 0.9.8a, hostapd 0.5.1, freeradius 1.0.5, madwifi-ng-r1406, i want to use eap-tls in my wlan and over my own ap over linux. so i can install and configure all programs (except hostapd, so instead compile myself i installed it from .deb format), now i have my certificates and programs running but when try to connect a windows client i get this error: "Received packet from (my freeradius server ip direction) with invalid Message Authenticator (invalid signature) (shared secret is incorrect)". i generate certifictes using winxp extensions. so my question is: is there any way i can test my certificates from freeradius?? any command? or may be install wpa-supplicant over my debian and test from there (authenticator and supplicant in same machine??). If clients try to connect without freeradius and hostapd running it's possible, but with these two programs clients lost immediately ip direction and show a message of "Error authenticating". could any body try to help? thanks in advance for your help and time. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

1 0