- Freeradius-Users - lists.freeradius.org

deny access to ms-chap
by André Lemos 26 Jan '06

26 Jan '06

1 1

SV: How to log users in radutmp
by Torkel Mathisen 26 Jan '06

26 Jan '06

Hi Thanks. I was looking on the freeradius server, but ofcourse the problem was on the AP. :) Regards, Torkel -----Opprinnelig melding----- Fra: freeradius-users-bounces+torkel.mathisen=bbs.no(a)lists.freeradius.org [mailto:freeradius-users-bounces+torkel.mathisen=bbs.no@lists.freeradius.org] På vegne av Alan DeKok Sendt: 24. januar 2006 18:29 Til: FreeRadius users mailing list Emne: Re: How to log users in radutmp "Torkel Mathisen" <torkel.mathisen(a)bbs.no> wrote: > I don't have that radutmp file. > > How do I get freeradius to log users in that file? Make the NAS send data that FreeRADIUS can log. See the FAQ. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Yet another PEAP/LDAP Question
by Jon P. Giza 25 Jan '06

25 Jan '06

Hello all: I am trying to setup a 802.1x WiFi authentication system using freeradius. My setup is as follows: Windows XP SP2 as the supplicant using PEAP/MSCHAPv2 Cisco Aironet 1231 Freeradius 1.1.0 IBM Lotus Domino LDAP The process is mostly working - Freeradius binds to LDAP properly, the User gets authorized, Freeradius pulls the correct password hash from the Domino LDAP server.. But, then the MSCHAP portion fails. Portion of the log is shown below which I believe shows the problem. I am thinking that the problem is that I am not telling Freeradius how to hash the supplied password correctly to match the Domino password. The aggravating part is that we are using the exact same Domino LDAP server to authenticate our VPN users. Full (sanatized) copy of the debug output is here: http://www.xbytenetworks.com/debug-log.txt Copy of Radiusd.conf is here: http://www.xbytenetworks.com/radiusd.conf Thanks in advance for any help you can offer. Jon rlm_ldap: - authorize rlm_ldap: performing user authorization for jon.giza radius_xlat: '(uid=jon.giza)' radius_xlat: 'OU=Waukesha,OU=NA,O=MyCo' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Waukesha,OU=NA,O=MyCo, with filter (uid=jon.giza) rlm_ldap: Added password (6BDC5527858B28XXXXXXXXXEFAF2323F) in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user jon.giza authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 5 rlm_mschap: Told to do MS-CHAPv2 for jon.giza with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 5 modcall: leaving group MS-CHAP (returns reject) for request 5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 5 modcall: leaving group authenticate (returns reject) for request 5 auth: Failed to validate the user. Login incorrect: [jon.giza/<no User-Password attribute>] (from client wifi.myco.com port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 152 to 10.100.224.235 port 1645 EAP-Message = 0x010800261900170301001b1bb3ec40925325e30990ce3b14a78af7abc1f7222d06716740d2 ff Message-Authenticator = 0x00000000000000000000000000000000 State = 0x132496908cd3121e6967d7ddafcdd795 Finished request 5

3 6

Dictionary files for HP Procurve switch?
by Mark Tunnell 25 Jan '06

25 Jan '06

Can anyone point me to dictionary file for an HP ProCurve 2650 switch? I've got basic authentication functioning but I don't have the information I need to get the privilege level working. Thanks, Mark

6 9

IC radius question
by Jake Messinger 25 Jan '06

25 Jan '06

I know this is the freeradius forum but I thought Id ask here. I have a customer using icradius and they say that they cant easily switch to freeradius because of several python scripts written to work with icradius. So, there problem. They are seeing THIS error in their radius logs: Check list does not match request list [USER] (from nas access-2#2/S99 cli 5094441590) It only happens with S99 and only with this 2nd Lucent Portmaster 4 they recently installed. The first pm4 and 2 other pm3's never get this error. They ARE using the NAS-PORT-TYPE attribute if that has possibly anything to do with it. Im wondering why, its coming from S99? There is no port s99 on a Portmaster 4. ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~ Jake Messinger, VP. ph:713-772-6690 Visit: portmasters.com AMS, Inc. fx:713-774-3498 advmed.com 8300 Bissonnet #400 jake(a)jakes.org profjake.com Houston, Texas 77074 http://jakes.org homestarrunner.com ICQ# 4403734 YAHOO: prof_jake AIM: profjake MSN: jake(a)jakes.org Adjunct Professor University of Houston, CBA jake(a)uh.edu ~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~'`^`'~*-,._.,-*~

5 6

error compiling freeradius-1.1.0 on fedora core three
by Tony Alexander 25 Jan '06

25 Jan '06

hello all, first time posting tothe list. i'm trying to compile freeradius-1.1.0 from source on a proliant ml350 with dual pentium III's. the box is running fedora core 3, kernel 2.6.12-1.1381_FC3smp, gcc 3.4.4 although configure goes off without a hitch the compile bombs out after three minutes with the following error: gmake[7]: Entering directory `/root/freeradius-1.1.0/src/modules/ rlm_otp/cardops' gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DOPENSSL_NO_KRB5 -I/usr -Wall -D_GNU_SOURCE -g -Wshadow -Wpointer-arith -Wcast-qual - Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes - Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef - I../../../include -I/usr -DOTP_MODULE_NAME="rlm_otp" -DFREERADIUS / usr -c cryptocard.c -o cryptocard.o gcc: /usr: linker input file unused because linking not done cc1: /usr: No such file or directory gmake[7]: *** [cryptocard.o] Error 1 gmake[7]: Leaving directory `/root/freeradius-1.1.0/src/modules/ rlm_otp/cardops' gmake[6]: *** [cardops/cryptocard.lo] Error 2 gmake[6]: Leaving directory `/root/freeradius-1.1.0/src/modules/rlm_otp' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/root/freeradius-1.1.0/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/root/freeradius-1.1.0/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/root/freeradius-1.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/root/freeradius-1.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/root/freeradius-1.1.0' make: *** [all] Error 2 a google search revealed that an 'if defined' statement in this doc 'src/modules/rlm_otp/otp_state.c' of the source package was incorrect: #if defined(__linux__) || defined(__APPLE__) #include <sys/un.h> #endif and should be changed to: #ifdef HAVE_SYS_UN_H #include <sys/un.h> #endif to fix the compile problem. i've made the correction but i still get the same compile error. my 'c' programming is a little rusty. is there anyone who can suggest what further steps i should take to try and debug this? thanx in advance. any help will be greatly appreciated. ax :-) Tony Alexander System Administrator Center for Biodiversity and Conservation American Museum of Natural History Central Park West at 79th Street New York, NY 10024 Phone: 212 496 3474 Fax: 212 769 5292 Mobile: 917 548 0560 http://cbc.amnh.org

2 2

redundant-load-balance question
by Dusty Doris 25 Jan '06

25 Jan '06

Is there any way to use a redundant-load-balance w/in the users file, for something such as ldap-group? For example: Autz-Type GROUP1 { redundant-load-balance { ldap1 ldap2 ldap3 } } Then in users file DEFAULT SomeAttr == "something", GROUP1-Ldap-Group == "group", Autz-Type := GROUP1 I've tried that and it doesn't like it. Seems I have to do something like below, which gives me failover, but not load-balance. DEFAULT SomeAttr == "something", ldap1-Ldap-Group == "group"... DEFAULT SomeAttr == "something", ldap2-Ldap-Group == "group"... DEFAULT SomeAttr == "something", ldap3-Ldap-Group == "group"... OR, just setup one ldap instance that points to all the servers, such as ldap ldap1 { server = "ldap1 ldap2 ldap3" } w/ DEFAULT SomeAttr == "something", ldap1-Ldap-Group == "group" But, I'd really like to get that ldap-group setup to use the same redundant-load-balance configuration? Any ideas? Thanks Dusty Doris

2 1

ippool behavior
by Peter Manckok 25 Jan '06

25 Jan '06

Hy all :-) I am introducing in the RADIUS (and FreeRadius) world since two months ago. And now I am doing tests trying to understand all the possibilities offered by FreeRadius (congratulations to all the community, I am really impressed). Now, I am testing the rlm_ippool module. I have been looking for documentation about this module, but I have only found information in the radiusd.conf file and in some posts in the forum so excuse me if my nexts questions are stupid or yet answered. ------------ Well, my configuration is: * In radiusd.conf I have: .... modules { ... ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } ... } ... accounting { detail unix radutmp main_pool } ... post-auth { main_pool ... } * In users file I have: DEFAULT Auth-Type := Accept, Pool-Name := "main_pool" Service-Type = Framed-User, Framed-Protocol = PPP * I use the radclient utility to test the mod $ radclient -f Attributes localhost auth testing Received response ID 42, code 2, length = 44 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.3.181 Framed-IP-Netmask = 255.255.255.0 And in the Attributes file I have: User-Name = "telemati" User-Password = "telemati" NAS-IP-Address = aa.bb.cc.dd NAS-Port = 55 My debugs are: modcall: entering group post-auth for request 0 rlm_ippool: Searching for an entry for nas/port: aa.bb.cc.dd/55 rlm_ippool: Allocating ip to nas/port: aa.bb.cc.dd/55 rlm_ippool: num: 1 rlm_ippool: Allocated ip 192.168.3.181 to client on nas aa.bb.cc.dd,port 55 modcall[post-auth]: module "main_pool" returns ok for request 0 modcall: group post-auth returns ok for request 0 Sending Access-Accept of id 42 to 127.0.0.1:35183 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = 192.168.3.181 Framed-IP-Netmask = 255.255.255.0 -------------- Well, my questions are: 1) Is this a correct behavior? 2) The FreeRadius assigns the IP 192.168.3.181. Why does not it start assigning the IP 192.168.1.1? 3) If I send another Access-Request packet with a different NAS-Port attribute, I observe that FreeRadius assigns an IP that is not consecutive with regard to the previous IP. Is this a correct behavior or am I doing something wrong? 4) Which is the consequence of deleting the db.ippool and db.ipindex files? 5) How does the rlm_ippool module free the IP address assigned? Sorry about the large of the mail (and my poor english) Regards, Peter ______________________________________________ LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

2 1

documentation on rlm_sql_log
by Seferovic Edvin 25 Jan '06

25 Jan '06

Hi there, I haven't been able to find any documentation on rlm_sql_log module ( doc directory, freeradius-wiki :-( ). Can somebody give me a hint where to look for it? I know it is a new module, but is there any documentation somewhere out there? Regards, Edvin Seferovic

4 3

problem starting radiusd with perl module
by maury 25 Jan '06

25 Jan '06

Hi I have problem to start radiusd with perl module authentication support. ..... Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded perl perl: module = "/etc/raddb/example.pl" perl: func_authorize = "authorize" perl: func_authenticate = "authenticate" perl: func_accounting = "accounting" perl: func_preacct = "preacct" perl: func_checksimul = "checksimul" perl: func_detach = "detach" perl: func_xlat = "xlat" perl: func_pre_proxy = "pre_proxy" perl: func_post_proxy = "post_proxy" perl: func_post_auth = "post_auth" perl: perl_flags = "(null)" perl: func_start_accounting = "(null)" perl: func_stop_accounting = "(null)" Segmentation fault I have installed freeradius 1.1.0 stable on redhat es 3 and I have compiled with this options: ./configure \ --with-logdir=/var/log/radius \ --with-raddbdir=/etc/raddb \ --disable-static \ --enable-shared \ --enable-ucd-snmp-compatibility \ --with-gnu-ld \ --with-threads \ --with-thread-pool \ --disable-ltdl-install \ --with-rlm-sql_mysql-include-dir=/usr/include/mysql \ --with-rlm-krb5-include-dir=/usr/kerberos/include I have configurate radiusd.conf modules { ..... .... .... $INCLUDE ${confdir}/experimental.conf } authenticate { .... .... ... perl ....... } Any idea o suggest? Thank you maury

1 1