- Freeradius-Users - lists.freeradius.org

CIsco Pix and FreeRadius....
by Sills, Tripp 17 Jan '06

17 Jan '06

Good Morning All, I am having an issue with No Auth-Type when trying to connect to the radius server from the Pix. I can authenticate to the radius server by using "test aaa-server authentication" command. It says Auth-Type found Local but when I run with the VPN client it says unknown auth type. Please any help would be great! Tripp

2 1

FreeRadius, Pam authentication issue ...
by Le Gal Philippe 16 Jan '06

16 Jan '06

Hi ! I was asked to create a network based authentication system for the linux servers of my company. i have chosen radius and the FreeRadius server to authenticate Admins/ DBAs/Developers on the servers. I'm using FreeRadius server and pam_radius authentication on the servers I want to autheticate the users on. I have created a default account : login : test paswd : test on the radius server As advised I ran the FreeRasius server in the debug mode. The following shows the last lines once I have started the server : Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. I have configured my PAM module sshd in /etc/pam.d/ssh to be (on the machines I want to be authenticate): #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so I try so ssh to the box I want to be authenticated on : ssh test@machine_of_the_test The login name I used is : test passwd : test But when I see the incoming request, I can't see that the login name is "test" but is : User-Name = "NOUSER" What's wrong ? Thank you for your help Phil rad_recv: Access-Request packet from host 172.16.51.67:18299, id=22, length=91 User-Name = "NOUSER" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "sshd" NAS-Port = 17274 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.60.76" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "NOUSER", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 22 to 172.16.51.67:18299 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 22 with timestamp 43cbe46d Nothing to do. Sleeping until we see a request. Philippe LE GAL Email: <mailto:Philippe.LeGal@emea.eu.int> Philippe.LeGal(a)emea.eu.int ________________________________________________________________________ This e-mail has been scanned for all known viruses by EMEA. ________________________________________________________________________

1 0

FreeRADIUS 1.0.5 rlm_ldap crashing
by Paul Khavkine 16 Jan '06

16 Jan '06

Hi Guys. I'm doing a stress test on 1.0.5 running on FreeBSD 5.4-RELEASE and when start_tls is enabled radiusd crashed somwhere in the rlm_ldap module. I can't seem to make it produce a core file to properly inspect it. The server is running as root and core dumps are enabled in the config file. When i disable start_tls it does not crash. It always crased with signal 6 at random periods. Here's an error: rlm_ldap: attempting LDAP reconnection rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: (re)connect to ldap01.totftds.int.distributel.net:389, authentication 0 rlm_ldap: ldap_get_conn: Checking Id: 1 rlm_ldap: ldap_get_conn: Got Id: 1 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap01.totftds.int.distributel.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radiusd/current/etc/raddb/certs/cacert.pem rlm_ldap: setting TLS CACert File to /usr/local/radiusd/current/etc/raddb/certs/cacert.pem radiusd in free(): error: chunk is already free rlm_ldap: starting TLS Abort Any pointers on how to debug this problem ? Thanx Paul

4 15

Re: How do you setup MD5 using Freeradius and MySQL?
by Frank Reiss 16 Jan '06

16 Jan '06

Hi, Well I did not get the zip file but did find the solution. What I did not know was to add the information into the database. Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> select * from radcheck; +----+------------+----------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+------------+----------------+----+------------------------------------+ | 1 | fred | User-Password | == | wilma | | 2 | barney | User-Password | == | betty | | 3 | dialrouter | User-Password | == | dialup | | 4 | frankr | User-Password | == | missy | | 6 | flr | Crypt-Password | == | $1$M/Dyy6Ix$wEc4DMMhp4MK222lTn1X/0 | | 7 | flr3 | Crypt-Password | == | $1$NxQPW2DB$glf2EPj/iPS3H8SwId6mA. | | 5 | flr1 | Crypt-Password | == | $1$HoIOzDKM$.TZWU5kiU9.sjHGrbSkc.1 | | 8 | flr1 | Auth-Type | == | Crypt-Local | | 9 | flr | Auth-Type | == | Crypt-Local | | 10 | flr3 | Auth-Type | == | Crypt-Local | | 11 | flr2 | Crypt-Password | == | $1$bZTA.bno$RgogLTF9j9/H7jTsnAsLQ. | | 12 | flr2 | Auth-Type | == | Crypt-Local | | 13 | flr4 | Crypt-Password | == | $1$Q42F5AEu$Oq7g9z2s38PsQ4Qzjv14Z0 | | 14 | flr4 | Auth-Type | == | Crypt-Local | +----+------------+----------------+----+------------------------------------+ 14 rows in set (0.01 sec) Below is a test bash shell that works #!/bin/bash set -v IDV=$(mysql radius -e "select max(id)+1 from radcheck;" | grep -v max) USV=$(mysql radius -e "select UserName from usergroup where UserName = '$1';" | grep -c $1) HTS=$(grep master-host /etc/my.cnf | awk -F= '{ print $2 }') HPW=$(grep master-password /etc/my.cnf | awk -F= '{ print $2 }') HUS=$(grep master-user /etc/my.cnf | awk -F= '{ print $2 }') HCP=$(openssl passwd -1 $2) echo "$2 $HCP" if [ $USV -eq 0 ] then RSV=$(mysql radius -e "select UserName from radcheck where UserName = '$1';" | grep -c "$1") if [ $RSV -eq 0 ] then echo "Adding user $1 $2" echo "insert into usergroup (UserName, GroupName) values('$1', 'dynamic');" > /tmp/maddusr.tmp echo "insert into radcheck ( UserName, Attribute, op, Value) values('$1', 'Crypt-Password', '==', '$HCP');" >> /tmp/maddusr.tmp echo "insert into radcheck ( UserName, Attribute, op, Value) values('$1', 'Auth-Type', '==', 'Crypt-Local');" >> /tmp/maddusr.tmp echo "select * from usergroup;" >> /tmp/maddusr.tmp echo "select * from radcheck;" >> /tmp/maddusr.tmp cat /tmp/maddusr.tmp mysql radius < /tmp/maddusr.tmp > /tmp/maddusr.log radtest $1 $2 localhost 1 p1zzap1e | tee -a /tmp/maddusr.log # rm -f /tmp/maddusr.tmp fi fi [root@localhost ~]# Frank Reiss Impeva Labs, Inc. Phone: 1-850-872-7099 COMPANY CONFIDENTIAL NOTICE This electronic mail transmission and any accompanying documents contain information belonging to the sender which may be company confidential and legally privileged. If you are not the intended recipient, any disclosure, copying, distribution or action taken in reliance on the message is strictly prohibited. If you have received this message in error, please delete it. Thank You ----- Original Message ----- From: "Marco Spiga" <ctxspi(a)gmail.com> To: "Frank Reiss" <f.reiss(a)impeva.com> Cc: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Saturday, January 14, 2006 6:55 AM Subject: Re: How do you setup MD5 using Freeradius and MySQL? > On Fri, Jan 13, 2006 at 06:18:41PM -0600, Frank Reiss wrote: >> From: "Frank Reiss" <f.reiss(a)impeva.com> >> To: <freeradius-users(a)lists.freeradius.org> >> Date: Fri, 13 Jan 2006 18:18:41 -0600 >> X-Mailer: Microsoft Outlook Express 6.00.2900.2180 >> Subject: How do you setup MD5 using Freeradius and MySQL? >> >> HI, >> >> Well I tested the MD5 authentication using the user file and that worked >> but I still can not figure out how to do it against the mysql database. >> Is there anyone out there that knows hot to set this up I would >> appreciate some HELP!! >> >> Frank Reiss >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > ---fine del testo--- > > If you want I send you a file tar.gz that work fine with Postgresql and > eap-md5!!! > I think there are few differences!!! > Sorry for my bad english!!! > -- > !!!!! Messaggio da Marco !!!!! > >

1 0

D-Link Airplus Supplicant MSCHAP2 error
by Ben Thompson 16 Jan '06

16 Jan '06

Hi We run a WPA/TKIP/PEAP wireless network with FreeRADIUS 1.0.1 on Redhat. Most client machines tend to be Windows XP and we they are usually set up to use the Microsoft built in supplicant. Occasionally someone comes along with a Windows 2000 box and we have to set them up using whatever software came with the network card as there is no wireless configuration tool included in the OS. Usernames are specified using the format username@realm and we normally reject anything without a realm using the following entry in the users file :- DEFAULT Realm == "NULL", Auth-Type := Reject we also have :- DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = "%{User-Name}", Fall-Through = Yes and in eap.conf :- peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes } The other day someone came along with a Win2K box with D-Link wireless card and we attempted to set it up to access the network. We could not get it to work and noticed the following output from FreeRADIUS :- modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: Found NT-Password rlm_mschap: Told to do MS-CHAPv2 for emm502(a)york.ac.uk with NT-Password rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: group Auth-Type returns reject for request 6 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 6 modcall: group authenticate returns reject for request 6 auth: Failed to validate the user. PEAP: Got tunneled reply RADIUS code 3 Tunnel-Type:1 := VLAN Tunnel-Medium-Type:1 := IEEE-802 Tunnel-Private-Group-Id:1 := "4025" User-Name = "emm502(a)york.ac.uk" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0xc15ca10 3 Tunnel-Type:1 := VLAN Tunnel-Medium-Type:1 := IEEE-802 Tunnel-Private-Group-Id:1 := "4025" User-Name = "emm502(a)york.ac.uk" MS-CHAP-Error = "\007E=691 R=1" EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 6 modcall: group authenticate returns handled for request 6 Sending Access-Challenge of id 168 to 144.32.226.208:1645 Tunnel-Type:1 := VLAN Tunnel-Medium-Type:1 := IEEE-802 Tunnel-Private-Group-Id:1 := "3970" EAP-Message = 0x0108004819001703010018e031d8fca1c0cbfedb0cfcdce46b9a4c46758441f22e0ba417030100203027372cc858586642a97e40254bb292c08bd9e461560f21dd2c8e77b66450ee Message-Authenticator = 0x00000000000000000000000000000000 State = 0x73386b81b01f285fe325fdeb408f2f43 Finished request 6 Just for testing we removed the NULL realm reject from the users file and tested the client with username entered on its own and found that this worked OK. Does this point to a problem with the D-link supppicant or could it be a problem with our setup? The MSCHAP2 response is incorrect when I specify the realm. Does this mean the supplicant is incorrectly handling the username and stripped username? Thanks Ben Thompson University of York

1 0

EAP-TLS and MySQL
by Frank Buttner 15 Jan '06

15 Jan '06

Hello, is it possible to store the certs in an MySQL DB and not in files? Thanks Frank

2 1

bandwidth restrction with radius and PPTP
by Markus Wiedner 15 Jan '06

15 Jan '06

Dear all, I have sorted out to configure freeradius/mysql on poptop server. Now i want to restrict bandwidth per user. What procedure should I follow. I know how to restrict bandwidth with tc iproute2 package. But don't know how to integrate tc with freeradius/mysql on poptop server. has any one over here did these things? any ideas/clues/rough manual... I have found an older Link about tat in the List, because the Link is dead, please could someone help my? Best regards and sorry for my English

2 1

"rlm_eap_tls" not found
by Mathieu Clément 15 Jan '06

15 Jan '06

Hello, Debian Sarge, Apache 1.3.33, (+ssl), libapache-mod-ssl installed, Freeradius, EAP-TLS, PEAP ................................................................................... # freeradius -x Starting - reading configuration files ... Using deprecated naslist file. Support for this will go away soon. Module: Loaded exec rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[9]: eap: Module instantiation failed. ...................................................................................................................... ==> Attached: /etc/freeradius/eap.conf, modified file, the "secrets" are simple because I prefer do a test before having the functionnal and definitive configuration. And just another question: what is the maxlenght of the secret ? Thank you in advance if you can solve my problem! Have fun with Freeradius ! Mathieu Clément

3 3

EAP-TLS proxy??
by Danai Chudthong 15 Jan '06

15 Jan '06

Hi all, I'm working in a university in Thailand. We use Freeradius for our wireless network. Currently, Each university have it own Freeradius and the authentication method is EAP-TLS. Is it possible to configure radius to proxy certificate so our student will be able to roam from their university to anothers by using certificate issued from their university? I tried to do it by myself but it's not working. Thank you very much Danai __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

How do you setup MD5 using Freeradius and MySQL?
by Frank Reiss 15 Jan '06

15 Jan '06

HI, Well I tested the MD5 authentication using the user file and that worked but I still can not figure out how to do it against the mysql database. Is there anyone out there that knows hot to set this up I would appreciate some HELP!! Frank Reiss

2 1