- Freeradius-Users - lists.freeradius.org

mschap and users file
by André Lemos 19 Jan '06

19 Jan '06

Right now I'm only using mschap and the users file to authenticate a user, but I'm getting: modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for wifi with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect although on my users file I have: "wifi" Crypt-Password == "BcFvDSx8ydTSk" "wifi" lmPassword == "02D093CE93078E8FAAD3B435B51404EE" "wifi" ntPassword == "CAF13C4F321B608B27FD75D2549BA53C" can't I have my users file only with encrypted passwords? thanks -- **_____________________** * *André Ventura Lemos** **Software Engineer** **Critical Software, SA** **MSN:** **tux(a)tuxslare.org** **GSM:** **+351916401042** **TLF:** **+351239989100** DISCLAIMER: This message may contain confidential information or privileged material and is intended only for the individual(s) named. If you are not a named addressee and mistakenly received this message you should not copy or otherwise disseminate it: please delete this e-mail from your system and notify the sender immediately. E-mail transmissions are not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete or contain viruses. Therefore, the sender does not accept liability for any errors or omissions in the contents of this message that arise as a result of e-mail transmissions. Please request a hard copy version if verification is required. Critical Software.

3 2

Windows PPTP and Cisco VPN Concentrator
by ALMEIDA Antonio Jose 19 Jan '06

19 Jan '06

Hello, I'm trying to implement one pptp vpn between one windows xp and one vpn concentrator. I've no problems with the Cisco vpn client but I get this error when I try the windows software: In the software: The PPP link control protocol was terminated. In the vpn concentrator: User [xxxx] disconnected. Cannot resolve an IP address for remote peer. In debug mode, freeradius gives this output:; auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: Told to do MS-CHAPv2 for toze3 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 38 to AA.BB.CC.DD:1033 MS-CHAP2-Success = 0x02533d3346343545313438444234344339303636463630454141394444413134444436 4630463137343639 MS-MPPE-Recv-Key = 0x7bece896d285fa327b97e150aa13cc9d MS-MPPE-Send-Key = 0x91606621ce8a086e8a961d21bf250787 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 0 Can someone help me with this? I've search google for some time now and I still can't solve this. Regards, Antonio

1 0

Question about dialup-admin
by Miguel Angel Quiles 19 Jan '06

19 Jan '06

I've downloaded dialup-admin. I've changed few values from the admin.conf file, such as mysql username and password, and path to the different directories. I also created the "badusers" table in the "radius" in the mysql. I opened a web browser and I can see the accounting is working ok, but I can´t see any bad users. I've already enabled the log auth in the radiusd.conf (log_auth = yes), so now I´ve got some entries in the /var/log/radius/radius.log. I've been reading the README file, and it says that the bin/log_badlogins it will constantly check the radiusd.log file. But it seems that this doesn't happen. I hope someone knows how I can resolve this problem, or another solution so I can get the badusers. Thanks.

1 0

Re: Authorization
by Stefan Adams 19 Jan '06

19 Jan '06

Dusty, Thanks for your fine input and the reminder on the index (I completely forgot about that). I'll give the ldap module filter a go with the attr_rewrite. I like keeping attributes with the user object, rather than spreading usernames around to various other objects. With this implementation, to me, the extra benefit is that I can just add a radiusGroupName attribute = X to each user object. BTW, on the attr_rewrite, can I use more advanced regex than just ................: ? It works and always will work, but it would be more clear in the config file if I could say "([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2}):" or something to that effect... I couldn't get ANY regex to work except the . Does that seem right? Stefan > Message: 4 > Date: Mon, 19 Dec 2005 14:52:10 -0500 (EST) > From: Dusty Doris <freeradius(a)mail.doris.cc> > Subject: Re: Freeradius-Users Digest, Vol 8, Issue 82 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20051219143705.I21565(a)mail.doris.name> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Mon, 19 Dec 2005, Stefan Adams wrote: > > > Hey, guys! Thanks for the great replies!! I like what you suggested > > better than what I've come up with in the mean time. I think what I > > came up with will work, it just seems messy/wrong/inefficient. What > > do you think? > > > > modules { > > ldap { > > : > > filter = > > > >"(&(uid=%{Stripped-User-Name:-%{User-Name}}) > >(radiusGroupName=%{Called-Station-ID}))" > > : > > } > > attr_rewrite getssid { > > attribute = Called-Station-Id > > searchin = packet > > searchfor = ".................:" > > replacewith = "" > > ignore_case = yes > > new_attribute = no > > } > > } > > > > authorize { > > # for WinXP, 802.1x, EAP-PEAP, MS-CHAPv2 > > preprocess > > eap > > getssid > > ldap > > } > > > > This cuts off the first 17 bytes and then a colon of the > > Called-Station-ID (My AP transmits a dash separated MAC followed by a > > colon and then the SSID). Then it uses this rewritten > > Called-Station-ID and uses that as a filter in the LDAP search. > > Therefore, if the SSID a user tries to connect to is not listed as an > > attribute of the user's LDAP object, the user is denied. > > > > Does that make sense? > > That's a pretty neat idea. The benefit of that is if you had multiple > ldap instances and wanted to implement fail-over within freeradius. To do > it the traditional way, you would need this for fail-over with ldap-group > checks if say you had two ldap instances. > > DEFAULT Called-Station-Id =~ /studentregex/, ldap1-Ldap-Group == > "students" > > DEFAULT Called-Station-Id =~ /studentregex/, ldap2-Ldap-Group == > "students" > > That is so it will check with ldap1 instance first. If that fails, then > check ldap2. > > By doing it your way, you won't need to do that anymore. Instead a > redundant block in authorize would get you what you need already since the > radiusGroupname inside your search filter takes care of the Ldap-Group > check. > > I wonder if you could use regex matches of Called-Station-ID in the > huntgroups file. You'll have to test this out, I doubt it would work, but > its another interesting idea. I don't know if huntgroups excepts regex > and if it can use things like Called-Station-Id > > in huntgroups > > students Called-Station-Id =~ /studentregex/ > faculty Called-Station-Id =~ /facultyregex/ > > Then in users file. > > DEFAULT Ldap-Group == %{Huntgroup-Name} > > Or you're way. > > (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=%{Huntgroup-Name}))" > > See doc/configurable_failover and doc/rlm_ldap to see what I'm talking > about with the failover. If you have a load balancer in front of that > ldap server, you won't need to worry about it. But if you don't and you > want to add redundancy, then its something you'll need to think about some > day. Freeradius can do the redundancy for you w/out a load balancer or > shared IP using configurable failover. Actually in the upcoming 1.1 > release it will also do load balancing for you in addition to failover > inside your ldap blocks. > > Hope I'm not too confusing. My point is I like your idea and if its > working for you, it doesn't sound like a bad one to me. You might want to > try hitting it hard to see if the rewrite slows anything down, but I would > bet it doesn't. > > I'd also make sure to add an eq index to radiusgroupname, since you'll be > using that as part of your search filter.

8 8

Re: Ippool and NAS
by Kai Geek 19 Jan '06

19 Jan '06

Hello, where you radius server and users config file ? > ----- Original Message ----- > From: "Johansson, Daniel" <Daniel.Johansson2(a)sonyericsson.com> > To: freeradius-users(a)lists.freeradius.org > Subject: Ippool and NAS > Date: Thu, 19 Jan 2006 15:18:59 +0100 > > > Hi Freeradius users. > > I have compiled and installed the 1.1.0 version of Freeradius and made > the basic configurations and everything works fine. > > Now I have 5 NAS boxes that is accessing the radius server the problem > is that I want each NAS to use a set if ipadresses. > > So for NAS(1) the radius should return ippool(1) and so on. > > I have looked at the FAQ and have been searching in the mail archive for > several hours and have only seen people asking about allocating > ipadresses for specific user(s) or group(s) but not for a NAS. > > > Could anyone please help me to get me started on this. > > Best Regards > /Daniel Johansson > > > Below is my NAS boxes in clients.conf > > # Client for RTP-RFTN, GGSN 1 > > client 192.168.9.1 { > secret = xxx > shortname = RTP-RFTN > > } > > # Client for S99, GGSN 249 > > client 192.168.15.249 { > secret = xxx > shortname = S99 GGSN 249 > } > > # Client for S98, GGSN 254 > > client 192.168.13.254 { > secret = xxx > shortname = S98 GGSN 254 > } > > # Client for GLANA, GGSN 250 > > client 192.168.11.250 { > secret = xxx > shortname = GLANA GGSN 250 > } > > # Client for Telia GLANA, GGSN 249 > > client 192.168.11.249 { > secret = xxx > shortname = GLANA GGSN 249 > } > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

How to compile freeradius with sqlcounter module on debian/ubuntu
by Gabriele Vidali 19 Jan '06

19 Jan '06

hi, I'm trying to compile freeradius with sqlcounter module on my ubuntu dapper with no success. Actually I can compile it but at the end I have no rlm_sqlcounter-x.x.so in my /usr/lib/freeradius directory. This is how I proceeded: * apt-get source freeradius * apt-get build-dep freeradius * I added --with-experimental-modules in debian/rules file * dpkg-buildpackage -rfakeroot -uc -us Is this way correct? freeradius version in dapper is 1.0.5-2 many thanks Gabriele

3 2

Blank Username in radacct
by Maykel Moya 18 Jan '06

18 Jan '06

Accidentally, I found today tons of tuples in raddact with blank Username. Is that normal? Regards, maykel

2 1

PEAP error
by debik 18 Jan '06

18 Jan '06

A have an error when XP is authenticating: rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select Does anybody knows what it menas ???

2 1

rlm_eap: Identity does not match User-Name, setting from EAP Identity.
by gerardma＠planet.nl 18 Jan '06

18 Jan '06

Hi All, I have solved the certificate problem. The sites below have been very helpfull. http://www.linuxjournal.com/node/8095/print http://www.linuxjournal.com/node/8151/print But right now I have an other problem. I am using FreeRadius with LDAP. My LDAP source is novell Edirectory. The primary login of the windows client is a Microsoft 2003 domain. When I select "Automatically use my Windows Logon name and password (and domain if any)" within in the network properties, Windows tries to login at freeradius with user@domain. I have configured FreeRadius to strip the domain name away, what is working as well. But on the end I receive this error: rlm_eap: Identity does not match User-Name, setting from EAP Identity. When I deselect: "Automatically use my Windows Logon name and password (and domain if any)" and login manual it is working fine! Anyone? Thanks guys,

1 0

FreeRadius server questions ...
by Le Gal Philippe 18 Jan '06

18 Jan '06

Hi I have setup a server to authenticate users against the FreeRadius server when they connect with ssh My remote server (where I want users to be authenticated with Radius ) is running : - openssh-4.2p1 - pam /etc/pam.d/ssh #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth #password sufficient /lib/security/pam_radius_auth.so password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so my /etc/raddb/server file is as follow : 192.168.0.72 secret 1 On the other side , my radius server is running as follow : clients.conf client 172.16.51.67 { secret = secret shortname = us067 } Both secret are identical.... ! I have created a user account on the radius server as follow : my user file contains : test Auth-Type := System, User-Password == "test" Reply-Message = "Hi !." PLease find below the debug output from the radius server My questions : 1) why User-Password = "\010\n\INCORRECT" shows : "\010\n\INCORRECT" ? I'm sure to have typed in user:test passwd:test 2) Why NAS-IP-Address = 127.0.0.1 ? It should be the address of my remote server where i try to authenticate ? 3) NAS-Identifier = "sshd", not sure about tha neither... 4) auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! As I said before, the secret are perfectly identical. Therefore the problem comes from somewhere else... That's as far as I went... Than you for your precious help ! Philippe [root@us072 raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.16.51.67:3739, id=105, length=89 User-Name = "test" User-Password = "\010\n\INCORRECT" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2714 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.60.76" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [test]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 105 to 172.16.51.67:3739 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 105 with timestamp 43ce6fc9 Nothing to do. Sleeping until we see a request. Philippe LE GAL Email: Philippe.LeGal(a)emea.eu.int ________________________________________________________________________ This e-mail has been scanned for all known viruses by EMEA. ________________________________________________________________________

1 0