- Freeradius-Users - lists.freeradius.org

FreeRADIUS and OpenLDAP
by Michael Schwartzkopff 17 Jan '06

17 Jan '06

Hi, If I use OpenLDAP to authorize / authenticate my users, what kinds of passwords can I store in LDAP? clear, crypt, SSHA, SMD5, MD5, SHA, NTHASH, LMHASH? Is this controlled by the password_header configuation or does this only strip the header of the password? Is there any difference if use the EAP module? Thanks. -- Dr. Michael Schwartzkopff MultiNET Services GmbH Bretonischer Ring 7 85630 Grasbrunn Tel: (+49 89) 456 911 - 0 Fax: (+49 89) 456 911 - 21 mob: (+49 174) 343 28 75 PGP Fingerprint: F919 3919 FF12 ED5A 2801 DEA6 AA77 57A4 EDD8 979B Skype: misch42

3 2

Problem in sending PAP Authentication with radclient
by Hamzeh Motahari 17 Jan '06

17 Jan '06

Hello We have set PAP scheme to MD5 in "radius.conf". Now we can't authenticate users using "radclient". When configuration changes from 'MD5' to 'Clear text', every thing is good. What should we do if we want send password using MD5 method? If "radclient" doesn't support this, can you suggest an open source radius client which can do this? Thanks. --------------------------------- Yahoo! Photos Got holiday prints? See all the ways to get quality prints in your hands ASAP.

2 1

Re: Debian + Exec-Program = Zombie process
by Rashad Rustamoff 17 Jan '06

17 Jan '06

> as soon as I send accounting stop packet to radius, test.pl executes and > becomes a zombie. (I tried bash script, c program with the same result.) > > 3890 ? Ss 0:00 /usr/local/freeradius/sbin/radiusd > 3893 ? Z 0:00 \_ [test.pl] <defunct> > > As far as I know, this should have been fixed in 1.0.3 and I doubt it's > debian specific, as I know 0.93 works on another RH 7.3 without a > problem (In fact zombie is listed there as well but disappears after > several seconds). > > Any ideas/suggestions? Did you try version 1.0.1 indeed? I had this problem several monthes ago with versions 1.0.4 and 1.0.5, but in case of 1.0.1 it works. As I know version 1.0.1 hasn't this problem. My server configuration is similar with yours: Debian 3.1 (Sarge) -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.371 / Virus Database: 267.14.18/230 - Release Date: 2006-01-14

2 1

rlm_eap.so
by Anton Gorlov 17 Jan '06

17 Jan '06

I'v compiled fresh verison FreeRADIUS (Version 1.1.0) from http://www.freeradius.org/ but i'v got error on program startup: Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no radiusd: symbol lookup error: /usr/lib/freeradius/rlm_eap.so: undefined symbol: eaptype_name2type [root@ring freeradius-1.1.0]# ldd /usr/lib/freeradius/rlm_eap.so libssl.so.4 => /lib/libssl.so.4 (0x00128000) libcrypto.so.4 => /lib/libcrypto.so.4 (0x00158000) libnsl.so.1 => /lib/libnsl.so.1 (0x00253000) libresolv.so.2 => /lib/libresolv.so.2 (0x00268000) libpthread.so.0 => /lib/libpthread.so.0 (0x0027b000) libc.so.6 => /lib/libc.so.6 (0x002ce000) libdl.so.2 => /lib/libdl.so.2 (0x003db000) /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x80000000) [root@ring rlm_eap]# uname -a Linux ring.local 2.4.26-std-up-alt13 #1 Mon Nov 14 00:25:14 MSK 2005 i686 unknown unknown GNU/Linux

2 4

libeap.so
by Anton Gorlov 17 Jan '06

17 Jan '06

Hm... **** Warning: Linking the executable radeapclient against the loadable module **** libeap.so is not portable! [root@ring root]# ls /usr/lib/freeradius/libeap.so /usr/lib/freeradius/libeap.so

1 0

Does freeradius as a proxy pass along everything?
by Gerdisch, Mitchell R (Mitchell) 17 Jan '06

17 Jan '06

Dumb question that I'm hoping is easy to answer. If I configure freeradius to proxy all requests, and the client (and ultimate RADIUS server) uses some vendor specific attributes, will freeradius as a proxy forward the requests and responses without dropping any of the VSAs? In other words, when freeradius is acting as a proxy, does it basically ignore the contents of the request and response? Or, does it need to be able to speak the vendor-specific language, so to speak, to be able to proxy the request/response? Thanks, Mitch Gerdisch

2 1

CIsco Pix and FreeRadius....
by Sills, Tripp 17 Jan '06

17 Jan '06

Good Morning All, I am having an issue with No Auth-Type when trying to connect to the radius server from the Pix. I can authenticate to the radius server by using "test aaa-server authentication" command. It says Auth-Type found Local but when I run with the VPN client it says unknown auth type. Please any help would be great! Tripp

2 1

FreeRadius, Pam authentication issue ...
by Le Gal Philippe 16 Jan '06

16 Jan '06

Hi ! I was asked to create a network based authentication system for the linux servers of my company. i have chosen radius and the FreeRadius server to authenticate Admins/ DBAs/Developers on the servers. I'm using FreeRadius server and pam_radius authentication on the servers I want to autheticate the users on. I have created a default account : login : test paswd : test on the radius server As advised I ran the FreeRasius server in the debug mode. The following shows the last lines once I have started the server : Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. I have configured my PAM module sshd in /etc/pam.d/ssh to be (on the machines I want to be authenticate): #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so I try so ssh to the box I want to be authenticated on : ssh test@machine_of_the_test The login name I used is : test passwd : test But when I see the incoming request, I can't see that the login name is "test" but is : User-Name = "NOUSER" What's wrong ? Thank you for your help Phil rad_recv: Access-Request packet from host 172.16.51.67:18299, id=22, length=91 User-Name = "NOUSER" User-Password = "test" NAS-IP-Address = 127.0.0.1 NAS-Identifier = "sshd" NAS-Port = 17274 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "192.168.60.76" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "NOUSER", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 22 to 172.16.51.67:18299 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 22 with timestamp 43cbe46d Nothing to do. Sleeping until we see a request. Philippe LE GAL Email: <mailto:Philippe.LeGal@emea.eu.int> Philippe.LeGal(a)emea.eu.int ________________________________________________________________________ This e-mail has been scanned for all known viruses by EMEA. ________________________________________________________________________

1 0

FreeRADIUS 1.0.5 rlm_ldap crashing
by Paul Khavkine 16 Jan '06

16 Jan '06

Hi Guys. I'm doing a stress test on 1.0.5 running on FreeBSD 5.4-RELEASE and when start_tls is enabled radiusd crashed somwhere in the rlm_ldap module. I can't seem to make it produce a core file to properly inspect it. The server is running as root and core dumps are enabled in the config file. When i disable start_tls it does not crash. It always crased with signal 6 at random periods. Here's an error: rlm_ldap: attempting LDAP reconnection rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: (re)connect to ldap01.totftds.int.distributel.net:389, authentication 0 rlm_ldap: ldap_get_conn: Checking Id: 1 rlm_ldap: ldap_get_conn: Got Id: 1 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap01.totftds.int.distributel.net:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radiusd/current/etc/raddb/certs/cacert.pem rlm_ldap: setting TLS CACert File to /usr/local/radiusd/current/etc/raddb/certs/cacert.pem radiusd in free(): error: chunk is already free rlm_ldap: starting TLS Abort Any pointers on how to debug this problem ? Thanx Paul

4 15

Re: How do you setup MD5 using Freeradius and MySQL?
by Frank Reiss 16 Jan '06

16 Jan '06

Hi, Well I did not get the zip file but did find the solution. What I did not know was to add the information into the database. Type 'help;' or '\h' for help. Type '\c' to clear the buffer. mysql> select * from radcheck; +----+------------+----------------+----+------------------------------------+ | id | UserName | Attribute | op | Value | +----+------------+----------------+----+------------------------------------+ | 1 | fred | User-Password | == | wilma | | 2 | barney | User-Password | == | betty | | 3 | dialrouter | User-Password | == | dialup | | 4 | frankr | User-Password | == | missy | | 6 | flr | Crypt-Password | == | $1$M/Dyy6Ix$wEc4DMMhp4MK222lTn1X/0 | | 7 | flr3 | Crypt-Password | == | $1$NxQPW2DB$glf2EPj/iPS3H8SwId6mA. | | 5 | flr1 | Crypt-Password | == | $1$HoIOzDKM$.TZWU5kiU9.sjHGrbSkc.1 | | 8 | flr1 | Auth-Type | == | Crypt-Local | | 9 | flr | Auth-Type | == | Crypt-Local | | 10 | flr3 | Auth-Type | == | Crypt-Local | | 11 | flr2 | Crypt-Password | == | $1$bZTA.bno$RgogLTF9j9/H7jTsnAsLQ. | | 12 | flr2 | Auth-Type | == | Crypt-Local | | 13 | flr4 | Crypt-Password | == | $1$Q42F5AEu$Oq7g9z2s38PsQ4Qzjv14Z0 | | 14 | flr4 | Auth-Type | == | Crypt-Local | +----+------------+----------------+----+------------------------------------+ 14 rows in set (0.01 sec) Below is a test bash shell that works #!/bin/bash set -v IDV=$(mysql radius -e "select max(id)+1 from radcheck;" | grep -v max) USV=$(mysql radius -e "select UserName from usergroup where UserName = '$1';" | grep -c $1) HTS=$(grep master-host /etc/my.cnf | awk -F= '{ print $2 }') HPW=$(grep master-password /etc/my.cnf | awk -F= '{ print $2 }') HUS=$(grep master-user /etc/my.cnf | awk -F= '{ print $2 }') HCP=$(openssl passwd -1 $2) echo "$2 $HCP" if [ $USV -eq 0 ] then RSV=$(mysql radius -e "select UserName from radcheck where UserName = '$1';" | grep -c "$1") if [ $RSV -eq 0 ] then echo "Adding user $1 $2" echo "insert into usergroup (UserName, GroupName) values('$1', 'dynamic');" > /tmp/maddusr.tmp echo "insert into radcheck ( UserName, Attribute, op, Value) values('$1', 'Crypt-Password', '==', '$HCP');" >> /tmp/maddusr.tmp echo "insert into radcheck ( UserName, Attribute, op, Value) values('$1', 'Auth-Type', '==', 'Crypt-Local');" >> /tmp/maddusr.tmp echo "select * from usergroup;" >> /tmp/maddusr.tmp echo "select * from radcheck;" >> /tmp/maddusr.tmp cat /tmp/maddusr.tmp mysql radius < /tmp/maddusr.tmp > /tmp/maddusr.log radtest $1 $2 localhost 1 p1zzap1e | tee -a /tmp/maddusr.log # rm -f /tmp/maddusr.tmp fi fi [root@localhost ~]# Frank Reiss Impeva Labs, Inc. Phone: 1-850-872-7099 COMPANY CONFIDENTIAL NOTICE This electronic mail transmission and any accompanying documents contain information belonging to the sender which may be company confidential and legally privileged. If you are not the intended recipient, any disclosure, copying, distribution or action taken in reliance on the message is strictly prohibited. If you have received this message in error, please delete it. Thank You ----- Original Message ----- From: "Marco Spiga" <ctxspi(a)gmail.com> To: "Frank Reiss" <f.reiss(a)impeva.com> Cc: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Saturday, January 14, 2006 6:55 AM Subject: Re: How do you setup MD5 using Freeradius and MySQL? > On Fri, Jan 13, 2006 at 06:18:41PM -0600, Frank Reiss wrote: >> From: "Frank Reiss" <f.reiss(a)impeva.com> >> To: <freeradius-users(a)lists.freeradius.org> >> Date: Fri, 13 Jan 2006 18:18:41 -0600 >> X-Mailer: Microsoft Outlook Express 6.00.2900.2180 >> Subject: How do you setup MD5 using Freeradius and MySQL? >> >> HI, >> >> Well I tested the MD5 authentication using the user file and that worked >> but I still can not figure out how to do it against the mysql database. >> Is there anyone out there that knows hot to set this up I would >> appreciate some HELP!! >> >> Frank Reiss >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html > ---fine del testo--- > > If you want I send you a file tar.gz that work fine with Postgresql and > eap-md5!!! > I think there are few differences!!! > Sorry for my bad english!!! > -- > !!!!! Messaggio da Marco !!!!! > >

1 0