- Freeradius-Users - lists.freeradius.org

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 25 Feb '06

25 Feb '06

Dear All! I wonder is somebody has tried to make PAP understand both plaintext and crypted passwords via multiple instances for example? Would this make sense: pap { encryption_scheme = clear } pap papcrypt { encryption_scheme = crypt } in modules configuration and then Auth-Type PAP { pap papcrypt } in authenticate section? Regards Alex.

1 0

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Dear Alan! >You want to use ":=", not "==", both here and in SQL. That will >make it work. > > Alan DeKok. I've tried that already. Same result... DOES NOT work... (AND it works with both == and := when I use users file instead)... With SQL it produces the very same debugging output with both == and := A bug perhaps? Shouldn't users file and radchek table perform the very same way? As for your offer for storing the clear-text for PAP it is not an option for me, since I already have 450 users stored in CRYPT form (for a simple reason of preventing the administration power abuse as much as possible - yes that is, I do not want admin to know and use user passwords). I hate using the clear text passwords for MS-CHAPv2 as well, but I haven't yet figured out how to generete NT-hash for storing the NT-Password instead. Changing passwords for 450 users is a pain, which I want to avoid... By the way, how does one generate this hash? I am running heavily modified by me version of dialup-admin, and I haven't yet implemented the CRYPT function for NT-Hash.

2 1

Re: Freeradius + Microsoft Active Directory
by Kai Geek 25 Feb '06

25 Feb '06

Hello, your password crypt key is used. not become in this ethereal can't recognize. > Auth-Type CHAP { > chap > } > > > Auth-Type MS-CHAP { > mschap > } you must show the full and state this in the file #ls /etc/raddact #vi radius.conf #vi clients.conf best regards, -- Ozgur Karatas CCNA & Network Engineer Linux System Administrator ozgur (at) ozgurkaratas dot com > ----- Original Message ----- > From: "Natalia Escalera" <nescalera(a)gmail.com> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius + Microsoft Active Directory > Date: Sat, 25 Feb 2006 11:53:20 -0600 > > > Hello Mr. DeKok > > Thank you for the fast response. The password is clear-text. We are > using ethereal to debug why we are getting "Operations Error" on the > Search Result. The Operation Errors comment is the following: > "In order to perform this operation a successful bind must be completed." > > The search request on ethereal from Freeradius to the active directory > gives the following: > Message Type: Search Request > Message Length: 96 > Response In: 469 > Base DN: dc=test, dc=prt > Scope: subtree (0x02) > Derefence: Never (0x00) > Size Limit: 0 > Time Limit: 4 > Attributes only: False > Filter: (&(objectclass=person)(sAMAccountName=%u)) > Attribute: uid ????we are not sending this attribute and we do not > know where it is specified on Freeradius > > Here are the settings given for LDAP module on radius.conf and user file: > > #radius.conf > ldap { > server="xxx.xx.xxx.xxx" > > identity ="" # If this is suppose to be the bind dn??? > > password = "mypassword" > basedn ="dc=test,dc=prt" > > #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" > filter ="(&(objectclass=person) (sAMAccountName=%u))" > > # set this to 'yes' to use TLS encrypted connections > # to the LDAP database by using the StartTLS extended > # operation. > # The StartTLS operation is supposed to be used with normal > # ldap connections instead of using ldaps (port 689) connections > start_tls = no > > # tls_cacertfile = /path/to/cacert.pem > # tls_cacertdir = /path/to/ca/dir/ > # tls_certfile = /path/to/radius.crt > # tls_keyfile = /path/to/radius.key > # tls_randfile = /path/to/rnd > # tls_require_cert = "demand" > > # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" > # profile_attribute = "radiusProfileDn" > access_attr = "dialupAccess" > > # Mapping of RADIUS dictionary attributes to LDAP > # directory attributes. > dictionary_mapping = ${raddbdir}/ldap.attrmap > > ldap_connections_number = 5 > > > timeout =5 > timelimit =4 > net_timeout =2 > compare_check_items = yes > > } > > authenticate { > > Auth-Type PAP { > pap > } > > > Auth-Type CHAP { > chap > } > > > Auth-Type MS-CHAP { > mschap > } > > > unix > > > > Auth-Type LDAP { > ldap > } > > > eap > } > > #users file > DEFAULT Auth-Type := LDAP > Fall-Through = 1 > > Can you please tell us if there is something wrong or if we are > missing something on the configuration files? > > Thanks in advance, > Nataly > > On 2/25/06, Alan DeKok <aland(a)ox.org> wrote: > > "Natalia Escalera" <nescalera(a)gmail.com> wrote: > > > I am setting up freeradius with Microsoft Active Directory. So far, I > > > am able to connect to the server but not to authenticate a user. Can > > > you please give me a hint of how the configuration files need to be > > > set in order to authenticate the user. > > > > If the RADIUS packets have clear-text passwords, then the normal > > LDAP module should work. If you're using PEAP or MS-CHAP, read > > "radiusd.conf",m and use "ntlm_auth". > > > > > Also, what is "3D" used for? (Example: server =3D your.ad.server.org ...) > > > > Nothing. It's an artifact of stupid mailers. 3D is ASCII for '='. > > > > Alan DeKok. > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Hi, Gerry. Thanks for an answer... >I'll bet if you only have a single encrypted entry that will work. > >This is just a guess on my part but give it a shot. > >Gerry Of course it works if I only have a single encrypted problem. This is exactly where my problem is. I do run a bunch of services onsite, some using the PAP passwords (CRYPT form) and some using the MS-CHAPv2 (partly internal and partly accessing the ADS via NTLM). I want the single logon for all services. If say PPPoe is PAP and IPSEC is MS-CHAPv2 I need two entries one with the CRYP-ted password for PAP and one plain or NT-hash for MS-CHAPv2. Everything works when using "users" file. PAP doesn't work when using the mysql backend and there is plain-text record in a database as well. It looks like freeradius does indeed only process first record (by the way I've tried playing with the SQL query for authentication in pursuit of making it to return the crypted password first, but alas it doesn't help). Do you by any chance know WHY it only processes one record and how to make it process two instead? Thanks Alex.

2 1

Stale sessions problem
by Georgi Alexandrov 25 Feb '06

25 Feb '06

Hello, I'm running freeradius 1.1.0 + mysql + dialupadmin on a linux 2.6 box with a pppoe-server runing on the same machine as nas. It works great ;-) But i have a problem with stalled sessions. I have set simultaneous use :=1. I have set "sql" in the session section in radiusd.conf. If a user that somehow failed network connectivity and failed to tell the server "account stop" tries to reconnect back it won't let him because his previous session is stalled. I need a mechanism that will do a check upon connection if the session is stalled, delete it and let the user in or if there is already a real user logged in deny the connecting one. I read from the mailing lists that radzap should do the job but i can't seem to figure out how to integrate it in that setup (the man page explains only the syntax). I also use the ippool module to give (and it should return back too) ip addresses from a given pool range. I need to be sure that it will return an ip to the pool if there's a stalled session detected by the needed mechanism. At the moment radwho and rlm_ippool_tool show about twice or more entries than the number actually used. Please advice ;-) -- regards, Georgi Alexandrov Key Server = http://pgp.mit.edu/ :: KeyID = 37B4B3EE Key Fingerprint = E429 BF93 FA67 44E9 B7D4 F89E F990 01C1 37B4 B3EE

3 8

Assigning ip address through 802.1x
by Manuj 25 Feb '06

25 Feb '06

Hello everybody, Please tell me, do we have any attribute in Free RADIUS to send the ip address to the 802.1x client after the successfull authentication. I know we can do it with the dhcp server but I want to know the attribute in RADIUS server(if any). Thanks for your help. Regards Manuj

2 1

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

Please anybody help me... I am reposting this message, since I am hitting the dead end with this issue.... Thanks in advance... Hi to all... Does anyone have any idea why placing the following two lines into users file works perfectly with both PAP and CHAP users btest User-Password == Master1 btest Crypt-Password == "$1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1" whereas placing the same two records into radcheck table doesn't work for PAP it does however work for CHAP? username | att | op | val --------------+-------------------------+----+----------- btest | User-Password | == | Master1 btest | Crypt-Password | == | $1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 It seems that rlm_sql is hitting the unencrypted password only, whereas encryption-scheme in radiusd.conf is defined crypt... Am I missing something? Any help will be appreciated Alex Savguira radius -X (version 1.0.4 ) says rad_recv: Access-Request packet from host 192.168.0.8:4544, id=47, length=45 User-Name = "btest" User-Password = "Master1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "btest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 173 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'btest' rlm_sql (sql): sql_set_user escaped user --> 'btest' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'btest' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'btest' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall[authorize]: module "domainmschap" returns noop for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "btest" with password Master1 rlm_pap: Using password "Master1" for user btest authentication. rlm_pap: Using CRYPT encryption. rlm_pap: Passwords don't match modcall[authenticate]: module "pap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_pap: CRYPT password check failed): [btest/Master1] (from client rasdata port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 47 to 192.168.0.8:4544 Waking up in 4 seconds...

2 1

Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Alex Savguira 25 Feb '06

25 Feb '06

>Of course it works if I only have a single encrypted problem Drat! I mean only a single encrypted password record in a database of course....

1 0

Re: Please HELP!!! Any ideas??? MySQL and users file... Difference???
by Gerry Dalton 25 Feb '06

25 Feb '06

This is just a quess...... Since you are doing a sql look-up, I will bet it does the select * from xxx where username like btest. It returns both records, but only processes the first record, the passwords don't match and fails. I'll bet if you only have a single encrypted entry that will work. This is just a guess on my part but give it a shot. Gerry At 12:25 AM 2/25/2006, you wrote: >Please anybody help me... I am reposting this message, since I am >hitting the dead end with this issue.... > >Thanks in advance... > > >Hi to all... >Does anyone have any idea why placing the following two lines into >users file works perfectly with both PAP and CHAP >users >btest User-Password == Master1 >btest Crypt-Password == "$1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1" > >whereas placing the same two records into radcheck table doesn't work >for PAP it does however work for CHAP? >username | att | op | val >--------------+-------------------------+----+----------- >btest | User-Password | == | Master1 >btest | Crypt-Password | == | $1$KyUhHIHD$R7mAm4rPX1q4WTEJY5rKQ1 > >It seems that rlm_sql is hitting the unencrypted password only, >whereas encryption-scheme in radiusd.conf is defined crypt... >Am I missing something? > >Any help will be appreciated >Alex Savguira > >radius -X (version 1.0.4 ) says > >rad_recv: Access-Request packet from host 192.168.0.8:4544, id=47, length=45 > User-Name = "btest" > User-Password = "Master1" > Processing the authorize section of radiusd.conf >modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > rlm_realm: No '@' in User-Name = "btest", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > users: Matched entry DEFAULT at line 171 > users: Matched entry DEFAULT at line 173 > modcall[authorize]: module "files" returns ok for request 0 >radius_xlat: 'btest' >rlm_sql (sql): sql_set_user escaped user --> 'btest' >radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck >WHERE Username = 'btest' ORDER BY id' >rlm_sql (sql): Reserving sql socket id: 4 >radius_xlat: 'SELECT >radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op > FROM radgroupcheck,usergroup WHERE usergroup.Username = 'btest' AND >usergroup.GroupName = radgroupcheck.GroupName ORDER BY >radgroupcheck.id' >radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply >WHERE Username = 'btest' ORDER BY id' >radius_xlat: 'SELECT >radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op > FROM radgroupreply,usergroup WHERE usergroup.Username = 'btest' AND >usergroup.GroupName = radgroupreply.GroupName ORDER BY >radgroupreply.id' >rlm_sql (sql): Released sql socket id: 4 > modcall[authorize]: module "sql" returns ok for request 0 > modcall[authorize]: module "domainmschap" returns noop for request 0 >modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type PAP >auth: type "PAP" > Processing the authenticate section of radiusd.conf >modcall: entering group Auth-Type for request 0 >rlm_pap: login attempt by "btest" with password Master1 >rlm_pap: Using password "Master1" for user btest authentication. >rlm_pap: Using CRYPT encryption. >rlm_pap: Passwords don't match > modcall[authenticate]: module "pap" returns reject for request 0 >modcall: group Auth-Type returns reject for request 0 >auth: Failed to validate the user. >Login incorrect (rlm_pap: CRYPT password check failed): >[btest/Master1] (from client rasdata port 0) >Delaying request 0 for 1 seconds >Finished request 0 >Going to the next request >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Waking up in 1 seconds... >--- Walking the entire request list --- >Sending Access-Reject of id 47 to 192.168.0.8:4544 >Waking up in 4 seconds... > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Newbie question re. dictionary files.
by Bohannan, Chad W 25 Feb '06

25 Feb '06

Try changing NS-Admin-Privilege = "Read-Only-Admin" To NS-Admin-Privilege = "1" Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Mark Tunnell Sent: Friday, November 04, 2005 1:23 PM To: freeradius-users(a)lists.freeradius.org Subject: Newbie question re. dictionary files. I'm using FreeRADIUS 1.0.5. to authenticate admin logins to a NetScreen5. I'm able to authenticate accounts just fine. Now I'd like to begin pulling administrative privileges from the Radius server, but I haven't figured out how to do that. I've referenced the dictionary.netscreen file in my clients.conf file, nastype = netscreen, but I'm embarrassed to say I can't figure out the format for including the dictionary attributes for a user in my users file. I've tried various permutations like: markt Auth-Type := Local, User=Password == "testing" NS-Admin-Privilege = "Read-Only-Admin" and: markt Auth-Type := Local, User=Password == "testing" Netscreen-NS-Admin-Privilege = "Read-Only-Admin" Nothing's working. Can some one show me the correct syntax? Thank you, Mark - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1