- Freeradius-Users - lists.freeradius.org

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 26 Feb '06

26 Feb '06

Exactly as I suggested in original post...

1 0

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 26 Feb '06

26 Feb '06

Please ignore... Found the answer already...

2 1

rtl8186 + radius
by Norbert Grochal 26 Feb '06

26 Feb '06

Hi, I try to secure wireless network with freeradius (on linux PC). Access Points on rtl8186, WPA2(mixed), clients cards edimax on ralink rt2500 and ralink rt2400, PEAP. Firmware on AP: (newest versions) Planet 4035, Planet wrt414, Edimax ew-7206, Edimax ew-7209, OvisLink Airlive... Problems (all need reset AP, after reboot all is work ok 1-4 hours...): 1. wds disconnects every 3-4 hours. 2. If count of peoples > 4 then after 1-4 hours AP stops talk with freeradius 3. and sometimes freezes and peoples can't connect at all I have connect the AP to COM on my PC and see, that there are no error messages in builtin linux, there is anough memory and ramdisc space. I think this may be problem with driver for radio (RF, RTL8180/RTL8185). Anyone succesfully 'run' freeradius with PEAP + AP on rtl8186 with WPA2(mixed) + about 10-15 users?? Norbert

2 1

freeradius 1.1.0 and mysql5
by Seferovic Edvin 26 Feb '06

26 Feb '06

Hello, are there any known issues when installing freeradius with mysql support? I have Suse 9.1 with mysql5 ( from RPMs ) and after compiling freeradius - rlm_sql module is not able to link rlm_sql_myql because I do NOT have libmysqlclient.so.12 !! Sun Feb 26 17:36:24 2006 : Error: rlm_sql (sql): Could not link driver rlm_sql_mysql: libmysqlclient.so.12: cannot open shared objey Sun Feb 26 17:36:24 2006 : Error: rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your sys. Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[14]: sql: Module instantiation failed. Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[1257] Unknown module "sql". Sun Feb 26 17:36:24 2006 : Error: radiusd.conf[1243] Failed to parse accounting section. YES - I have tried to compile with -disable-shared, but then I get a lot of other error messages about DynaLoader and rlm_smb??? extracting global C symbols from `../modules/rlm_sql/drivers/rlm_sql_mysql/.libs/rlm_sql_mysql.a' (cd .libs && gcc -c -fno-builtin -fno-rtti -fno-exceptions "radiusdS.c") cc1: warning: "-fno-rtti" is valid for C++ but not for C/ObjC rm -f .libs/radiusdS.c .libs/radiusd.nm .libs/radiusd.nmS .libs/radiusd.nmT gcc .libs/radiusdS.o -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../include -DHt ../modules/rlm_perl/.libs/rlm_perl.a(rlm_perl.o)(.text+0x26fb): In function `xs_init': /root/software/freeradius-1.1.0/src/modules/rlm_perl/rlm_perl.c:613: undefined reference to `boot_DynaLoader' ../modules/rlm_smb/.libs/rlm_smb.a(smbencrypt.o)(.text+0x172): In function `E_md4hash': /root/software/freeradius-1.1.0/src/modules/rlm_smb/smbencrypt.c:107: undefined reference to `mdfour' collect2: ld returned 1 exit status rm -f .libs/radiusdS.o gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/root/software/freeradius-1.1.0/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/software/freeradius-1.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/software/freeradius-1.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/software/freeradius-1.1.0' make: *** [all] Error 2 Is there any way I can disable those modules I do not need ( or plan to use )? Any ideas how I can solve those problems? Thank you in advance. Regards, Edvin Seferovic

2 1

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 26 Feb '06

26 Feb '06

Hi, Alan! Thanks for answering... First of all I never intended to use CRYPT passwords for MS-CHAPv2. C'mon, I know that much about MS-CHAP. ;-) Not all my users need access to new services, as I wrote, I was planning to expose the cleartext password for those who need (perhaps NT-Password in the future) and to continue using CRYPT for those who do not need the new services. If you say SQL doesn't like having two passwords in radcheck and only grabs the first one - let it be... What I wrote about hacking the code was about trying to fix this perhaps, shouldn't SQL take all check records found?... Actually I've found my around the problem... I've made a second instance of pap using clear text passwords in radiusd and I'll only change password attributes to clear text in radcheck to those who use MS-CHAP as well (placing them into group which does Auth-Type := papplain). This however leaves me without NT-Password (which is NT-Hash). An ideal situation for me would be something like this in radcheck: username | att | op | val --------------+-------------------------+----+----------- btest | NT-Password | == | NT-hashbla-bla-bla^&&@0-3443 btest | Crypt-Password | == | $1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 This however will not work because PAP burps on Crypt-Password this way. Here is the dump of having both, it was stupid of me not to include one, I admit: btest User-Password == Master1 btest Crypt-Password == "$1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1" Authentication PAP Ready to process requests. rad_recv: Access-Request packet from host 192.168.0.8:1248, id=5, length=45 User-Name = "btest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry btest at line 69 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User btest not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User btest not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied User-Password matches local User-Password Login OK: [btest] (from client rasdata port 0) Sending Access-Accept of id 5 to 192.168.0.8:1248 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --------------------------------------------------------------------------------------------------------- Authentication CHAP rad_recv: Access-Request packet from host 192.168.0.8:1271, id=11, length=46 User-Name = "btest" CHAP-Password = 0xd2bf262017f2f6812bc00cbd077aed9b55 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry btest at line 69 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User btest not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User btest not found in radgroupcheck rlm_sql (sql): User not found rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 auth: type Local auth: user supplied CHAP-Password matches local User-Password Login OK: [btest] (from client rasdata port 0) Sending Access-Accept of id 11 to 192.168.0.8:1271 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds...

2 1

RE: FreeBSD 6.0 and mysql
by Rob Parker 26 Feb '06

26 Feb '06

Not sure if this is any use, but the last time I saw an error like that was with a box which had conflicting threading libraries on it... in the end I just pulled the box down and reinstalled freebsd (box was not in production, thankfully!), but this might be useful to you (it's from a KDE mailing list, but the problem/solution should be the same): http://freebsd.kde.org/pipermail/kde-freebsd/2004-August/008692.html Maybe FreeRADIUS is linked against one library and MySQL is linked to another. Cheers, Rob. -----Original Message----- From: Alan Craig [mailto:alan@mexcom.co.za] Sent: 24 February 2006 10:03 To: freeradius-users(a)lists.freeradius.org Subject: RE: FreeBSD 6.0 and mysql Nope this doesn't help. I have a suspicion it is a threading problem, but I haven't a clue on where to look to sort that out. -- View this message in context: http://www.nabble.com/FreeBSD-6.0-and-mysql-t1168311.html#a3105556 Sent from the FreeRadius - User forum at Nabble.com. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Freeradius + Microsoft Active Directory
by Natalia Escalera 25 Feb '06

25 Feb '06

Hello, I am setting up freeradius with Microsoft Active Directory. So far, I am able to connect to the server but not to authenticate a user. Can you please give me a hint of how the configuration files need to be set in order to authenticate the user. Also, what is "3D" used for? (Example: server =3D your.ad.server.org ...) Thank you in advance, Nataly

2 7

Adding A
by squirrel＠isot.com 25 Feb '06

25 Feb '06

I'm trying to add "Ascend-Data-Filter" to mysql using either phpmyadmin or dialup administrator, but it doesn't seem to work. It works fine in users text file as in: username Auth-Type := Local, User-Password == "xxx", Simultaneous-Use := 2 Service-Type = Framed-User, Framed-Protocol = MP, Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip a.b.c.0/20", Ascend-Data-Filter += "ip in forward tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Framed-Compression = Van-Jacobsen-TCP-IP But the dialup administrator allow me to add only one Ascend-Data-Filter item. If I try to add using myphpadmin ************************************** Computer problems? ................... ..............http://www.multibyte.net

2 5

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Dear Alan! > See the FAQ about pointless statements like "it doesn't work". Alan, please, you asked me to try := instead of == . I did and it does not work. Somehow I needed to inform you it did not. > Maybe you could try reading the debug output. Or failing that, >posting it here. I did in my first post. Would you please explain me, why freeradius only process one record, when it does process both while using users file? Is it possible perhaps to make the PAP module understand both CRYPT and plaintext passwords (perhaps by defining two instances of module)? I can in this case keep one record per user, and it will be cleartext for PAP and MS-CHAPv2 when the user is granted services requiring MS-CHAPv2 and CRYPT for all existing users otherwise. >Then those users can't do MS-CHAP. C'mon. This is not an answer... I can't just ignore all of my existing users and I can't make all of them to change their passwords and, as far as I know, I can't extract their passwords from the crypt hash. I really do not want to start hacking freeradius code, but on the other side I really do need to make the new services available to these users. >Stop trying to get both clear & crypted passwords to work for the >same user. Why does it work perfectly as expected when I am doing it in users file? Should not the SQL module perform the same? I am reposting the debug output here, just in case.... rad_recv: Access-Request packet from host 192.168.0.8:1061, id=7, length=45 User-Name = "atest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "atest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 173 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'atest' rlm_sql (sql): sql_set_user escaped user --> 'atest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'atest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'atest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'atest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'atest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "atest" with password Master1 rlm_pap: Using password "Master1" for user atest authentication. rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [atest/Master1] (from client rasdata port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 7 to 192.168.0.8:1061 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 7 with timestamp 4400b816 Nothing to do. Sleeping until we see a request.

2 1

CentOS
by Italo Morellato 25 Feb '06

25 Feb '06

Freeradius 1.1.0 RPM for CentOS 4.2 (smeserver) is possible? Thanks in advance. Italo Morellato

3 2