- Freeradius-Users - lists.freeradius.org

Re: FreeRadius in a production environment
by Sean 20 Jan '06

20 Jan '06

> Hy :-) > I am interested to know about success stories of people using >FreeRadius in a production environment. > I have read http://www.freeradius.org/testimonials.html but I would >like to obtain a few more experiences. > Best regards, Susana Hi Susana, I've been using release 1.03 of FreeRadius to manage WiFi hotspots scattered all over the World for the last year I've had no downtime and the flexibility and power in the way that you can tailor the program to meet your requirements is unsurpassed. I very much doubt if you could find a commercial solution costing thousands of Euro that would be as reliable and powerful as FreeRadius. In addition the support from this mailing list and various forums such as dd-wrt.org and chillispot.org means that you are only a click away from solving any problems that you encounter. Regards, Sean Bracken http://swarmhotspots.com

1 0

how to allow only one authentication ?
by Riccardo.Veraldi 20 Jan '06

20 Jan '06

Hello, I could succesfully use EAP-TTLS with kerberos authentication. my problem now is that in this way also users who have a certificate can authenticate. I would like only users with kerberos credentials to being able to authenticate in my users file I have DEFAULT Auth-Type = Kerberos in this way any EAP-TLS with a valid certificate can authenticate while I do not want people to use the certificate, because the only method I wish to allow is login/password on kerberos server. There is a way to do it ? To allow ONLY kerberos via EAP-TTLS ? I Tryed with a Auth-Type := Reject but with no luck.. So what I did is this. I wrote this users file: "user1" Auth-Type = Kerberos DEFAULT Auth-Type := Reject in this case the user called user1 can authenticate with Kerberos credential and he cannot authenticate if it has a certificate, this as I Wantet but THIS WORKS only for user1 I want to do it for all users in the Kerberos database, and I do not like to write all the usernames in the users file. If I use DEFAULT instead of "user1" in the line above it does not work ... Please maybe there is a hint which could help me ? thanks Rick

2 3

file detail
by Alvaro Quiñones 20 Jan '06

20 Jan '06

Hi I run radiusd and the service up without errors, however i try to see file detail and it not appear. /usr/local/var/log/radius/radacct/ users are authenticating, but file detail is not create.Why ?? where is the problem? Thanks Alvaro

3 3

Freeradius authentication question
by Le Gal Philippe 20 Jan '06

20 Jan '06

Hi everybody, I'm trying to authenticate users login in a machine using ssh. I have configured ssh & PAM on that server to autenticate against the radius server (Redhat Application Server 2.1). Please find below the debug of the radius server as well as my conf files. The Free radius server says : Login incorrect: [test/\010\n\INCORRECT] (from client us067.eudra.org port 1500 cli 192.168.xx.xx) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! So did I . I checked the secrets on the server and they are *IDENTICAL*... I used the NTRadPing utility with exactly the same parameters and it works absolutely fine ! Thank you for your help ! my /etc/raddb/server file : (on the client machine) : [root@us067 root]# vi /etc/raddb/server # pam_radius_auth configuration file. Copy to: /etc/raddb/server # # For proper security, this file SHOULD have permissions 0600, # that is readable by root, and NO ONE else. If anyone other than # root can read this file, then they can spoof responses from the server! # # There are 3 fields per line in this file. There may be multiple # lines. Blank lines or lines beginning with '#' are treated as # comments, and are ignored. The fields are: # # server[:port] secret [timeout] # # the port name or number is optional. The default port name is # "radius", and is looked up from /etc/services The timeout field is # optional. The default timeout is 3 seconds. # # If multiple RADIUS server lines exist, they are tried in order. The # first server to return success or failure causes the module to return # success or failure. Only if a server fails to response is it skipped, # and the next server in turn is used. # # The timeout field controls how many seconds the module waits before # deciding that the server has failed to respond. # # server[:port] shared_secret timeout (s) loginhost.eudra.org philippe123456 1 # # having localhost in your radius configuration is a Good Thing. # # See the INSTALL file for pam.conf hints. clients.conf : client us067.eudra.org { secret = philippe123456 shortname = us067.eudra.org } [root@us072 raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.16.51.67:2531, id=82, length=89 User-Name = "test" User-Password = "\010\n\INCORRECT" NAS-IP-Address = 172.16.51.67 NAS-Identifier = "sshd" NAS-Port = 1506 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.60.76" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_unix: [test]: invalid password modcall[authenticate]: module "unix" returns reject for request 0 modcall: group authenticate returns reject for request 0 auth: Failed to validate the user. Login incorrect: [test/\010\n\INCORRECT] (from client us067.eudra.org port 1506 cli 192.168.60.76) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 82 to 172.16.51.67:2531 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 82 with timestamp 43d0c994 Nothing to do. Sleeping until we see a request. ________________________________________________________________________ This e-mail has been scanned for all known viruses by EMEA. ________________________________________________________________________

2 1

Performance features of FreeRadius
by Marta Lajas 20 Jan '06

20 Jan '06

Hy all, I would like to know where I can find information about the performance features of the FreeRadius product. I would like to propose my boss tu use this product because I have been testing it with differents configurations and it is a very good product (congratulations!). But I need that information first. Thank you very much in advance, Marta Lajas --------------------------------- LLama Gratis a cualquier PC del Mundo. Llamadas a fijos y móviles desde 1 céntimo por minuto. http://es.voice.yahoo.com

3 2

Query string
by Dickson, John 20 Jan '06

20 Jan '06

In passing an LDAP search to MS-LDAP I would like FreeRADIUS to pass a query rather than search through the basedn structure. Is this sound? John

1 0

RE: Freeradius authentication question
by Kai Geek 20 Jan '06

20 Jan '06

hmm ok a lot thank you.. regards :) > ----- Original Message ----- > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: RE: Freeradius authentication question > Date: Fri, 20 Jan 2006 12:08:59 -0000 > > > > The Pam radius configuration file on the client machine should be > located here: /etc/raddb/server (cf pam radius INSTALL) > > I can't see why the radius server can not decrypt the password when > I know my shared secret is absolutely identical on the client and > on the radius server. > > Anyone ? > > Philippe > > -----Original Message----- > From: > freeradius-users-bounces+philippe.legal=emea.eu.int(a)lists.freeradius.org > [mailto:freeradius-users-bounces+philippe.legal=emea.eu.int@lists.freera > dius.org]On Behalf Of Kai Geek > Sent: 20 January 2006 12:00 > To: FreeRadius users mailing list > Subject: Re: Freeradius authentication question > > > Hello, > [root@us067 root]# vi /etc/raddb/server ?? > > the config file will this be ? > correct directory; > > #vi /etc/raddb/clients.conf > > oke. > > > ----- Original Message ----- > > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > > Subject: Freeradius authentication question Date: Fri, 20 Jan > > 2006 11:34:51 -0000 > > > > > > > > Hi everybody, > > > > I'm trying to authenticate users login in a machine using ssh. I > > have configured ssh & PAM on that server to autenticate against > > the radius server (Redhat Application Server 2.1). > > > > Please find below the debug of the radius server as well as my conf files. > > > > The Free radius server says : > > > > Login incorrect: [test/\010\n\INCORRECT] (from client > > us067.eudra.org port 1500 cli 192.168.xx.xx) > > WARNING: Unprintable characters in the password. ? > > Double-check the shared secret on the server and the NAS! > > > > So did I . I checked the secrets on the server and they are *IDENTICAL*... > > > > I used the NTRadPing utility with exactly the same parameters and > > it works absolutely fine ! > > > > Thank you for your help ! > > > > my /etc/raddb/server file : (on the client machine) : > > > > [root@us067 root]# vi /etc/raddb/server > > # pam_radius_auth configuration file. Copy to: /etc/raddb/server > > # > > # For proper security, this file SHOULD have permissions 0600, > > # that is readable by root, and NO ONE else. If anyone other than > > # root can read this file, then they can spoof responses from the server! > > # > > # There are 3 fields per line in this file. There may be multiple > > # lines. Blank lines or lines beginning with '#' are treated as > > # comments, and are ignored. The fields are: > > # > > # server[:port] secret [timeout] > > # > > # the port name or number is optional. The default port name is > > # "radius", and is looked up from /etc/services The timeout field is > > # optional. The default timeout is 3 seconds. > > # > > # If multiple RADIUS server lines exist, they are tried in order. The > > # first server to return success or failure causes the module to return > > # success or failure. Only if a server fails to response is it skipped, > > # and the next server in turn is used. > > # > > # The timeout field controls how many seconds the module waits before > > # deciding that the server has failed to respond. > > # > > # server[:port] shared_secret timeout (s) > > loginhost.eudra.org philippe123456 1 > > # > > # having localhost in your radius configuration is a Good Thing. > > # > > # See the INSTALL file for pam.conf hints. > > > > > > clients.conf : > > > > client us067.eudra.org { > > secret = philippe123456 > > shortname = us067.eudra.org > > } > > > > > > [root@us072 raddb]# radiusd -X > > Starting - reading configuration files ... > > reread_config: reading radiusd.conf > > Config: including file: /usr/local/etc/raddb/proxy.conf > > Config: including file: /usr/local/etc/raddb/clients.conf > > Config: including file: /usr/local/etc/raddb/snmp.conf > > Config: including file: /usr/local/etc/raddb/eap.conf > > Config: including file: /usr/local/etc/raddb/sql.conf > > main: prefix = "/usr/local" > > main: localstatedir = "/usr/local/var" > > main: logdir = "/usr/local/var/log/radius" > > main: libdir = "/usr/local/lib" > > main: radacctdir = "/usr/local/var/log/radius/radacct" > > main: hostname_lookups = no > > main: max_request_time = 30 > > main: cleanup_delay = 5 > > main: max_requests = 1024 > > main: delete_blocked_requests = 0 > > main: port = 0 > > main: allow_core_dumps = no > > main: log_stripped_names = no > > main: log_file = "/usr/local/var/log/radius/radius.log" > > main: log_auth = yes > > main: log_auth_badpass = yes > > main: log_auth_goodpass = yes > > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > > main: user = "(null)" > > main: group = "(null)" > > main: usercollide = no > > main: lower_user = "no" > > main: lower_pass = "no" > > main: nospace_user = "no" > > main: nospace_pass = "no" > > main: checkrad = "/usr/local/sbin/checkrad" > > main: proxy_requests = yes > > proxy: retry_delay = 5 > > proxy: retry_count = 3 > > proxy: synchronous = no > > proxy: default_fallback = yes > > proxy: dead_time = 120 > > proxy: post_proxy_authorize = yes > > proxy: wake_all_if_all_dead = no > > security: max_attributes = 200 > > security: reject_delay = 1 > > security: status_server = no > > main: debug_level = 0 > > read_config_files: reading dictionary > > read_config_files: reading naslist > > Using deprecated naslist file. Support for this will go away soon. > > read_config_files: reading clients > > read_config_files: reading realms > > radiusd: entering modules setup > > Module: Library search path is /usr/local/lib > > Module: Loaded exec > > exec: wait = yes > > exec: program = "(null)" > > exec: input_pairs = "request" > > exec: output_pairs = "(null)" > > exec: packet_type = "(null)" > > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > > Module: Instantiated exec (exec) > > Module: Loaded expr > > Module: Instantiated expr (expr) > > Module: Loaded PAP > > pap: encryption_scheme = "crypt" > > Module: Instantiated pap (pap) > > Module: Loaded CHAP > > Module: Instantiated chap (chap) > > Module: Loaded MS-CHAP > > mschap: use_mppe = yes > > mschap: require_encryption = no > > mschap: require_strong = no > > mschap: with_ntdomain_hack = no > > mschap: passwd = "(null)" > > mschap: authtype = "MS-CHAP" > > mschap: ntlm_auth = "(null)" > > Module: Instantiated mschap (mschap) > > Module: Loaded System > > unix: cache = no > > unix: passwd = "(null)" > > unix: shadow = "(null)" > > unix: group = "(null)" > > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > > unix: usegroup = no > > unix: cache_reload = 600 > > Module: Instantiated unix (unix) > > Module: Loaded eap > > eap: default_eap_type = "md5" > > eap: timer_expire = 60 > > eap: ignore_unknown_eap_types = no > > eap: cisco_accounting_username_bug = no > > rlm_eap: Loaded and initialized type md5 > > rlm_eap: Loaded and initialized type leap > > gtc: challenge = "Password: " > > gtc: auth_type = "PAP" > > rlm_eap: Loaded and initialized type gtc > > mschapv2: with_ntdomain_hack = no > > rlm_eap: Loaded and initialized type mschapv2 > > Module: Instantiated eap (eap) > > Module: Loaded preprocess > > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > > preprocess: hints = "/usr/local/etc/raddb/hints" > > preprocess: with_ascend_hack = no > > preprocess: ascend_channels_per_line = 23 > > preprocess: with_ntdomain_hack = no > > preprocess: with_specialix_jetstream_hack = no > > preprocess: with_cisco_vsa_hack = no > > Module: Instantiated preprocess (preprocess) > > Module: Loaded realm > > realm: format = "suffix" > > realm: delimiter = "@" > > realm: ignore_default = no > > realm: ignore_null = no > > Module: Instantiated realm (suffix) > > Module: Loaded files > > files: usersfile = "/usr/local/etc/raddb/users" > > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > > files: compat = "no" > > Module: Instantiated files (files) > > Module: Loaded Acct-Unique-Session-Id > > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > > Client-IP-Address, NAS-Port" > > Module: Instantiated acct_unique (acct_unique) > > Module: Loaded detail > > detail: detailfile = > > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > > detail: detailperm = 384 > > detail: dirperm = 493 > > detail: locking = no > > Module: Instantiated detail (detail) > > Module: Loaded radutmp > > radutmp: filename = "/usr/local/var/log/radius/radutmp" > > radutmp: username = "%{User-Name}" > > radutmp: case_sensitive = yes > > radutmp: check_with_nas = yes > > radutmp: perm = 384 > > radutmp: callerid = yes > > Module: Instantiated radutmp (radutmp) > > Listening on authentication *:1812 > > Listening on accounting *:1813 > > Ready to process requests. > > rad_recv: Access-Request packet from host 172.16.51.67:2531, id=82, length=89 > > User-Name = "test" > > User-Password = "\010\n\INCORRECT" > > NAS-IP-Address = 172.16.51.67 > > NAS-Identifier = "sshd" > > NAS-Port = 1506 > > NAS-Port-Type = Virtual > > Service-Type = Authenticate-Only > > Calling-Station-Id = "192.168.60.76" > > Processing the authorize section of radiusd.conf > > modcall: entering group authorize for request 0 > > modcall[authorize]: module "preprocess" returns ok for request 0 > > modcall[authorize]: module "chap" returns noop for request 0 > > modcall[authorize]: module "mschap" returns noop for request 0 > > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > > rlm_realm: No such realm "NULL" > > modcall[authorize]: module "suffix" returns noop for request 0 > > rlm_eap: No EAP-Message, not doing EAP > > modcall[authorize]: module "eap" returns noop for request 0 > > users: Matched entry DEFAULT at line 156 > > modcall[authorize]: module "files" returns ok for request 0 > > modcall: group authorize returns ok for request 0 > > rad_check_password: Found Auth-Type System > > auth: type "System" > > Processing the authenticate section of radiusd.conf > > modcall: entering group authenticate for request 0 > > rlm_unix: [test]: invalid password > > modcall[authenticate]: module "unix" returns reject for request 0 > > modcall: group authenticate returns reject for request 0 > > auth: Failed to validate the user. > > Login incorrect: [test/\010\n\INCORRECT] (from client > > us067.eudra.org port 1506 cli 192.168.60.76) > > WARNING: Unprintable characters in the password. ? > > Double-check the shared secret on the server and the NAS! > > Delaying request 0 for 1 seconds > > Finished request 0 > > Going to the next request > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Waking up in 1 seconds... > > --- Walking the entire request list --- > > Sending Access-Reject of id 82 to 172.16.51.67:2531 > > Waking up in 4 seconds... > > --- Walking the entire request list --- > > Cleaning up request 0 ID 82 with timestamp 43d0c994 > > Nothing to do. Sleeping until we see a request. > > > > ________________________________________________________________________ > > This e-mail has been scanned for all known viruses by EMEA. > > ________________________________________________________________________ > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ > Version: GnuPG v1.4.2 (GNU/Linux) > .-. .-. _ > : : : : :_; > .-' : .--. : `-. .-. .--. ,-.,-. > ' .; :' '_.'' .; :: :' .; ; : ,. : > `.__.'`.__.'`.__.':_;`.__,_;:_;:_; > > Kai "Ozgur" Geek > Network Engineer > PGP ID: B1B63B6E > +-+-+-+ END PGP SIGNATURE +-+-+-+ > > > -- > _______________________________________________ > Check out the latest SMS services @ http://www.linuxmail.org > This allows you to send and receive SMS through your mailbox. > > Powered by Outblaze > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ________________________________________________________________________ > This e-mail has been scanned for all known viruses by EMEA. > ________________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

RE: Freeradius authentication question
by Le Gal Philippe 20 Jan '06

20 Jan '06

The Pam radius configuration file on the client machine should be located here: /etc/raddb/server (cf pam radius INSTALL) I can't see why the radius server can not decrypt the password when I know my shared secret is absolutely identical on the client and on the radius server. Anyone ? Philippe -----Original Message----- From: freeradius-users-bounces+philippe.legal=emea.eu.int(a)lists.freeradius.org [mailto:freeradius-users-bounces+philippe.legal=emea.eu.int@lists.freera dius.org]On Behalf Of Kai Geek Sent: 20 January 2006 12:00 To: FreeRadius users mailing list Subject: Re: Freeradius authentication question Hello, [root@us067 root]# vi /etc/raddb/server ?? the config file will this be ? correct directory; #vi /etc/raddb/clients.conf oke. > ----- Original Message ----- > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Freeradius authentication question > Date: Fri, 20 Jan 2006 11:34:51 -0000 > > > > Hi everybody, > > I'm trying to authenticate users login in a machine using ssh. I > have configured ssh & PAM on that server to autenticate against the > radius server (Redhat Application Server 2.1). > > Please find below the debug of the radius server as well as my conf files. > > The Free radius server says : > > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1500 cli 192.168.xx.xx) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > > So did I . I checked the secrets on the server and they are *IDENTICAL*... > > I used the NTRadPing utility with exactly the same parameters and > it works absolutely fine ! > > Thank you for your help ! > > my /etc/raddb/server file : (on the client machine) : > > [root@us067 root]# vi /etc/raddb/server > # pam_radius_auth configuration file. Copy to: /etc/raddb/server > # > # For proper security, this file SHOULD have permissions 0600, > # that is readable by root, and NO ONE else. If anyone other than > # root can read this file, then they can spoof responses from the server! > # > # There are 3 fields per line in this file. There may be multiple > # lines. Blank lines or lines beginning with '#' are treated as > # comments, and are ignored. The fields are: > # > # server[:port] secret [timeout] > # > # the port name or number is optional. The default port name is > # "radius", and is looked up from /etc/services The timeout field is > # optional. The default timeout is 3 seconds. > # > # If multiple RADIUS server lines exist, they are tried in order. The > # first server to return success or failure causes the module to return > # success or failure. Only if a server fails to response is it skipped, > # and the next server in turn is used. > # > # The timeout field controls how many seconds the module waits before > # deciding that the server has failed to respond. > # > # server[:port] shared_secret timeout (s) > loginhost.eudra.org philippe123456 1 > # > # having localhost in your radius configuration is a Good Thing. > # > # See the INSTALL file for pam.conf hints. > > > clients.conf : > > client us067.eudra.org { > secret = philippe123456 > shortname = us067.eudra.org > } > > > [root@us072 raddb]# radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = yes > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/usr/local/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 172.16.51.67:2531, id=82, length=89 > User-Name = "test" > User-Password = "\010\n\INCORRECT" > NAS-IP-Address = 172.16.51.67 > NAS-Identifier = "sshd" > NAS-Port = 1506 > NAS-Port-Type = Virtual > Service-Type = Authenticate-Only > Calling-Station-Id = "192.168.60.76" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 156 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_unix: [test]: invalid password > modcall[authenticate]: module "unix" returns reject for request 0 > modcall: group authenticate returns reject for request 0 > auth: Failed to validate the user. > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1506 cli 192.168.60.76) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 82 to 172.16.51.67:2531 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 82 with timestamp 43d0c994 > Nothing to do. Sleeping until we see a request. > > ________________________________________________________________________ > This e-mail has been scanned for all known viruses by EMEA. > ________________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ________________________________________________________________________ This e-mail has been scanned for all known viruses by EMEA. ________________________________________________________________________

1 0

Re: Freeradius authentication question
by Kai Geek 20 Jan '06

20 Jan '06

Hello, [root@us067 root]# vi /etc/raddb/server ?? the config file will this be ? correct directory; #vi /etc/raddb/clients.conf oke. > ----- Original Message ----- > From: "Le Gal Philippe" <Philippe.LeGal(a)emea.eu.int> > To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> > Subject: Freeradius authentication question > Date: Fri, 20 Jan 2006 11:34:51 -0000 > > > > Hi everybody, > > I'm trying to authenticate users login in a machine using ssh. I > have configured ssh & PAM on that server to autenticate against the > radius server (Redhat Application Server 2.1). > > Please find below the debug of the radius server as well as my conf files. > > The Free radius server says : > > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1500 cli 192.168.xx.xx) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > > So did I . I checked the secrets on the server and they are *IDENTICAL*... > > I used the NTRadPing utility with exactly the same parameters and > it works absolutely fine ! > > Thank you for your help ! > > my /etc/raddb/server file : (on the client machine) : > > [root@us067 root]# vi /etc/raddb/server > # pam_radius_auth configuration file. Copy to: /etc/raddb/server > # > # For proper security, this file SHOULD have permissions 0600, > # that is readable by root, and NO ONE else. If anyone other than > # root can read this file, then they can spoof responses from the server! > # > # There are 3 fields per line in this file. There may be multiple > # lines. Blank lines or lines beginning with '#' are treated as > # comments, and are ignored. The fields are: > # > # server[:port] secret [timeout] > # > # the port name or number is optional. The default port name is > # "radius", and is looked up from /etc/services The timeout field is > # optional. The default timeout is 3 seconds. > # > # If multiple RADIUS server lines exist, they are tried in order. The > # first server to return success or failure causes the module to return > # success or failure. Only if a server fails to response is it skipped, > # and the next server in turn is used. > # > # The timeout field controls how many seconds the module waits before > # deciding that the server has failed to respond. > # > # server[:port] shared_secret timeout (s) > loginhost.eudra.org philippe123456 1 > # > # having localhost in your radius configuration is a Good Thing. > # > # See the INSTALL file for pam.conf hints. > > > clients.conf : > > client us067.eudra.org { > secret = philippe123456 > shortname = us067.eudra.org > } > > > [root@us072 raddb]# radiusd -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /usr/local/etc/raddb/proxy.conf > Config: including file: /usr/local/etc/raddb/clients.conf > Config: including file: /usr/local/etc/raddb/snmp.conf > Config: including file: /usr/local/etc/raddb/eap.conf > Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = yes > main: log_auth_badpass = yes > main: log_auth_goodpass = yes > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = yes > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: authtype = "MS-CHAP" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" > preprocess: hints = "/usr/local/etc/raddb/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address, NAS-Port" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/usr/local/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 172.16.51.67:2531, id=82, length=89 > User-Name = "test" > User-Password = "\010\n\INCORRECT" > NAS-IP-Address = 172.16.51.67 > NAS-Identifier = "sshd" > NAS-Port = 1506 > NAS-Port-Type = Virtual > Service-Type = Authenticate-Only > Calling-Station-Id = "192.168.60.76" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > users: Matched entry DEFAULT at line 156 > modcall[authorize]: module "files" returns ok for request 0 > modcall: group authorize returns ok for request 0 > rad_check_password: Found Auth-Type System > auth: type "System" > Processing the authenticate section of radiusd.conf > modcall: entering group authenticate for request 0 > rlm_unix: [test]: invalid password > modcall[authenticate]: module "unix" returns reject for request 0 > modcall: group authenticate returns reject for request 0 > auth: Failed to validate the user. > Login incorrect: [test/\010\n\INCORRECT] (from client > us067.eudra.org port 1506 cli 192.168.60.76) > WARNING: Unprintable characters in the password. ? Double-check > the shared secret on the server and the NAS! > Delaying request 0 for 1 seconds > Finished request 0 > Going to the next request > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Waking up in 1 seconds... > --- Walking the entire request list --- > Sending Access-Reject of id 82 to 172.16.51.67:2531 > Waking up in 4 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 82 with timestamp 43d0c994 > Nothing to do. Sleeping until we see a request. > > ________________________________________________________________________ > This e-mail has been scanned for all known viruses by EMEA. > ________________________________________________________________________ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

1 0

Error with dialup admin
by bishal＠baayu.com.np 20 Jan '06

20 Jan '06

Hello all I have installed freeradius 1.1.0 in freebsd 6.0. While clicking on statistic menu of dialup page I got this error. Warning: mktime() expects parameter 1 to be long, string given in /usr/home/httpd/baayu.com.np/baayucom/dialbaayu/lib/functions.php3 on line 83 Warning: mktime() expects parameter 1 to be long, string given in /usr/home/httpd/baayu.com.np/baayucom/dialbaayu/lib/functions.php3 on line 83

1 0