- Freeradius-Users - lists.freeradius.org

GPRS
by alfonso 09 Jan '06

09 Jan '06

Hello to all. This is a theorically question Im working to validate GPRS users with freeradius( WIFI users goes ok). I want to know the state of this machines, when they are logged. For that Im using nagios, to check the state. I must join both solutions. The AAA solution and the check Solution. I should write a custom script for the authorization section, retrieve the parameters of the Access-Request. User-Name, ip is passed as an arguments, or passed as additional arguments or another posibilitie is to make a sql query to insert all the values needed to a nagios database, so nagios can check it periodically I haven't clear wich is the way. Another question is how can I run scripts after the user is validated Thank you for your opinion Alfonso Guerendiain oliver

2 1

SQL Authentication (mainly @Alan!)
by florian broder 09 Jan '06

09 Jan '06

Hi. Some weeks ago I was asking for this, but didn't receive an answer. Subject is MySQL Authentication based on a Calling-Station-ID. The problem is, that the cisco Switch doesn't send a user-name&user-password in his access-request, and mysql doesn't like! --> *Error: rlm_sql *>* (sql): zero length username not permitted" I tried to comment out this part in the sql-module source-code, and recompile freeradius. To my surprise, this actually DOES work. --> rad_recv: Access-Request packet from host 127.0.0.1:1046, id=134, length=52 User-Name = "" User-Password = "michael" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'michael' rlm_sql (sql): sql_set_user escaped user --> 'michael' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck ? WHERE Username = 'michael' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'michael' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 134 to 127.0.0.1:1046 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 134 with timestamp 43bc1274 Nothing to do. Sleeping until we see a request. Sql.conf was told, to check for the password, not username. It works! So, my question is, like in the subject, mainly directed to alan, or some other developper of the sql-module. WHY was it done like that, i.e. that you HAVE to use a username in sql? Thanks for your help, I really appreciate it! Bye. *

2 4

radiusd.c (Is it a bug??)
by Leo Lai 09 Jan '06

09 Jan '06

when reloading config file, there's a section of code that is supposed to wait for all threads to stop, however the condition is like this: if (!spawn_flag) for(;;) { // wait for thread here... } when I check where spawn_flag is set, I found that it's TRUE when multithread is supported, and FALSE when there is no thread. In this case, shouldn't here be "if (spawn_flag)" instead?? if (need_reload) { #ifdef HAVE_PTHREAD_H /* * Threads: wait for all threads to stop * processing before re-loading the * config, so we don't pull the rug out * from under them. */ int max_wait = 0; if (!spawn_flag) for(;;) { /* * Block until there are '0' threads * with a REQUEST handle. */ sig_hup_block = TRUE; if( (total_active_threads() == 0) || (max_wait >= 5) ) { sig_hup_block = FALSE; break; } sleep(1); max_wait++; } #endif Thanks, leo

2 1

thread pool information
by DilipSimha.N.M 09 Jan '06

09 Jan '06

hi, can anyone please tell me abt the thread pool configurations? start_servers = 5 ... but 5 RADIUS servers aren't started initially. then what is this attribute for?? --DilipSimha

3 2

Connection TimeOut!!!
by Kirti S. Bajwa 08 Jan '06

08 Jan '06

Hello: RH 9.0, freeRADIUS 1.4 I have been using freeRADIUS for the last 10 Months. Works great. I like to setup a maximum connection time of 120 minutes for each user. I am a complete newbie. Can somebody direct me to the file I need to set the timeout time? I also need to know the exact command, if possible. Thanks in Advance. Kirt

2 4

(err=2)! (Shared secret is incorrect.)
by Jonathan Carpenter 07 Jan '06

07 Jan '06

I have setup freeradius to authincate against my postgresql database. But I am getting odd errors about my secrets. They are the same every where. Can someone help me out with this? Here is the output from my login attempt: rad_recv: Access-Reject packet from host 127.0.0.1:1645, id=184, length=20 rad_decode: Received Access-Reject packet from 127.0.0.1:1645 with invalid signature (err=2)! (Shared secret is incorrect.) Sending Access-Request of id 185 to 127.0.0.1:1645 User-Name = "chrisr" User-Password = "test1" NAS-IP-Address = scooby Here is the logs from my radius.log file: Fri Jan 6 09:11:42 2006 : Auth: Login incorrect: [chrisr/\362\354A2\317\227\374\237\273J<\300-#\373\217] (from client localhost port 0) Fri Jan 6 09:11:45 2006 : Auth: Login incorrect: [chrisr/\357U*\345\330sG\353\3417-F&\226\005\327] (from client localhost port 0) Fri Jan 6 09:11:48 2006 : Auth: Login incorrect: [chrisr/5\315\237\373\3417r\344\300J\255\363] (from client localhost port 0) Thanks, -- Jonathan Carpenter Linux System Administrator Windows System Administrator <The Unix Geek>

4 6

Re: LDAP scope
by Stefan Adams 07 Jan '06

07 Jan '06

> Date: Thu, 05 Jan 2006 17:07:30 -0500 > From: Gary Algier <gaa(a)ulticom.com> > Subject: Re: LDAP scope > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <43BD98A2.7000401(a)ulticom.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Stefan Adams wrote: > > Hi! > > > > Is it possible to specify a basedn of "dc=example,dc=com" with a scope > > of "sub" so that my search filters can apply to both "ou=People" and > > "ou=Computers" for example? It seems from my testing that the scope > > is "one" by default. > From my experience it is a scope of "sub" by default. My people are Yup... It worked as sub for me! Was I dreaming or stupid, I dunno. But I'm glad you told me sub should work cuz then I tried it again. > in the data store like: > dn: uid=gaa,ou=people,dc=ulticom,dc=com > and my ldap section of radius.conf is: > ldap { > server = "ldap.ulticom.com" > basedn = "dc=ulticom,dc=com" > filter = "(&(objectclass=person)(uid=%{Stripped-User-Name:-%{User-Name}}))" > do_xlat = yes > base_filter = "(objectclass=*)" > start_tls = no > access_attr = "uid" > dictionary_mapping = ${raddbdir}/ldap.attrmap > ldap_connections_number = 5 > timeout = 4 > timelimit = 3 > net_timeout = 1 > } > > > > > > The reason I would like to do this is to have the check box in Windows > > XP that says "Authenticate as computer..." checked. Doing this, > > FreeRADIUS is first presented with the credentials of the computer > > (host/name). Since I already have a computer account in ou=Computers, > > I figure I'd just add a cn=host/name attribute and modify the filter > > to be (|(uid=%{User-Name})(cn=%{User-Name})). But this can only work > > with a basedn of "dc=example,dc=com" and a scope of sub. > The thing to watch out for is the actual LDAP lookup may not be > what you think. Without special regex matches or other tricks it > will only lookup your hostname. For instance with a user of "gaa" > on host "malachite", the supplied user value is "MALACHITE\GAA". > This then results in an LDAP lookup of (from radiusd -X): > ----------------------------------------------------------------------------- > rlm_ldap: performing user authorization for MALACHITE\gaa > radius_xlat: '(&(objectclass=person)(uid=MALACHITE))' > radius_xlat: 'dc=ulticom,dc=com' > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: performing search in dc=ulticom,dc=com, with filter (&(objectclass=person)(uid=MALACHITE)) > rlm_ldap: object not found or got ambiguous search result > rlm_ldap: search failed > rlm_ldap: ldap_release_conn: Release Id: 0 > ----------------------------------------------------------------------------- > > I tried to handle it with this: > > hints file: > ... > DEFAULT NAS-IP-Address == 172.25.16.9, User-Name =~ "^(.*)\\\\(.*)" > Hint = "8021XUSER", > Stripped-User-Name = `${2}` > ... > users file: > ... > DEFAULT Hint == "8021XUSER" > Fall-Through = 1 > ... > > This strips the hostname off, mostly. I see it do several "uid=gaa" > lookups, then one "uid=MALACHITE" and then it fails. If you get it > to work, let me know. All I want to do is lookup the user. I haven't tried the hints or users file method, but here's how I do it and so far everything is working perfectly: FreeRADIUS 1.1.0-pre0 (snapshot-20051220) Windows XP SP2, 802.1x, EAP-PEAP, MS-CHAPv2 radiusd.conf: proxy_requests = no $INCLUDE ${confdir}/proxy.conf modules { unix { radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "ldap.borgia.com" identity = "cn=Manager,dc=borgia,dc=com" password = Manager's password basedn = "dc=borgia,dc=com" filter = "(|(uid=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-User-Name:-%{User-Name}}))" base_filter = "(objectclass=radiusprofile)" tls { ... } access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 auto_header = no access_attr_used_for_allow = yes } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = whatever private_key_file = /etc/1x/server.pem certificate_file = /etc/1x/server.pem CA_file = /etc/1x/root.pem dh_file = /etc/1x/DH random_file = /etc/1x/random include_length = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes } mschapv2 { } } realm ntdomain { format = prefix delimiter = "\\" } preprocess { : with_ntdomain_hack = no : } } authorize { preprocess ntdomain eap ldap } authenticate { Auth-Type MS-CHAP { mschap } eap } clients.conf: client 172.16.16.0/24 { secret = whatever shortname = ap } client 172.16.254.0/24 { secret = whatever shortname = server } proxy.conf: realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } [ SSID Authorization (If I want to autz a user via 802.1x to an existing LDAP based on which connecting-to SSID): modules { ldap { filter = "(&(|(uid=%{Stripped-User-Name:-%{User-Name}})(cn=%{Stripped-User-Name:-%{User-Name}}))(radiusCalledStationId=%{Called-Station-ID}))" } attr_rewrite getssid { attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet # Strip the MAC Address out of the Called-Station-ID # Resulting in just the SSID # My AP sends the:mac:add:ress:and:the:SSID # All I want is the SSID searchfor = ".................:" replacewith = "" ignore_case = yes new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended to th # append = no } } authorize { : eap getssid ldap : } Windows XP: Apply this Pre-SP3 Hotfix: http://support.microsoft.com/?kbid=885453 Windows Network Connection Properties: Preferred networks, [SSID] Properties: Association: Network Auth: WPA Data Enc: AES Authentication: EAP Type: PEAP [X] Authenticate as computer when computer information is available (IF PC IS JOINED TO DOMAIN) [ ] Authenticate as computer when computer information is available (IF NOT JOINED) Properties: EAP-MS-CHAP v2 Configure: [X] Automatically use my Windows logon name and Password (IF PC IS JOINED TO DOMAIN) [ ] Automatically use my Windows logon name and Password (IF NOT JOINED) [X] Enable Fast Reconnect > If you want to use the hostname, how will you match the password? What > credentials are you expecting it to pass? I was under the assumption > that when you select "Authenticate as computer..." it expects to > use certificates (I may be wrong here). When the PC is joined to a Samba domain, a computer account is created with uid=hostname$ and sambaNTPassword=xxxxxxxxx When you authenticate as computer, windows sends host/hostname as the User-Name and the the password that, when encrypted, matches the sambaNTPassword. This has successfully connected me to 802.1x (Wired and WPA wireless) as computer when joined to the domain. This allows me to login to the domain using a domain account never before used on that computer so that it is not cached. I'm sure the significance of this can be realized. > The format of the password when using the Windows domain style login > is the Windows "encrypted" format (actually a hash, not encrypted, > but you still can't recreate the clear text password). The the default > configuration, this value is matched against the LDAP attribute > "sambaNTPassword". This assumes that you are already using > Samba for SMB/CIFS access. (I am). |---> Of course!!! :) > > > > Thanks! > > Stefan > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > -- > Gary Algier, WB2FWZ gaa at ulticom.com +1 856 787 2758 > Ulticom Inc., 1020 Briggs Rd, Mt. Laurel, NJ 08054 Fax:+1 856 866 2033 > > Nielsen's First Law of Computer Manuals: > People don't read documentation voluntarily. > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 9, Issue 23 > *********************************************** >

1 0

no (Auth-Type) ?
by Jonathan Carpenter 06 Jan '06

06 Jan '06

I have setup freeradius to use postgresql but when I try to run a test using: radtest test test localhost:1645 10 secret localhost while having freeradius running in debug mode I get this in my debug log. [root@scooby raddb]# /usr/sbin/radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/postgresql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1645 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "yes" main: lower_pass = "no" main: nospace_user = "yes" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Listening on authentication *:1645 Listening on accounting *:1646 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32770, id=34, length=66 User-Name = "test" User-Password = "test" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Framed-Protocol = PPP auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test/test] (from client localhost port 10) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 34 to 127.0.0.1:32770 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 34 with timestamp 43bea8b5 Nothing to do. Sleeping until we see a request. Do I need to specify an Auth-Type in my postgresql database and if so where? Thanks -- Jonathan Carpenter

1 0

RE: MS LDAP connect OK users not found
by Dickson, John 06 Jan '06

06 Jan '06

You probably want to read the proxy.conf file and add your realm if you haven't already. Actually, you should read and understand what *all* of the files in the raddb dir are for. We use mysql, not ldap, but I'm guessing the uid in ldap is listed as "radtest", not "radtest(a)xxx1.xxx2.edu". So the ldap lookup is failing. In my sql.conf there is an option to use stripped UserName attributes. See if you have something like that in your ldap.conf file in raddb. You may need to adjust it. Alternately, make all your uids in ldap user@domain instead of just user. It seems that the only hurdle is to pass authentication from the freeradius to the windowz ldap server....I just can't get it done. Here is the output from the requesting terminal on the radius server: Sending Access-Request of id 153 to 10.1.1.27:1812 User-Name = "testing" User-Password = "Passw0rd" NAS-IP-Address = magellan.xxxx1.xxxx2.edu NAS-Port = 0 ...and on the radius terminal debug output....: Thread 1 handling request 0, (1 handled so far) User-Name = "testing" User-Password = "Passw0rd" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "testing", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for testing radius_xlat: '(uid=testing)' radius_xlat: 'ou=Users,dc=xxxx1,dc=xxxx2,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to XXXX1.XXXX2.EDU:389, authentication 0 rlm_ldap: bind as sususu@XXXX1.XXXX2.EDU/rDkf@mh to XXXX1.XXXX2.EDU:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=Users,dc=XXXX1,dc=XXXX2,dc=edu, with filter (uid=testing) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 10.1.1.27:32816, id=153, length=59 Sending Access-Reject of id 153 to 10.1.1.27:32816 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 153 with timestamp 43bed7b1 Nothing to do. Sleeping until we see a request -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

AW: Noone anny idea fot --> TLS Athentifikation before Domain, Logon XP?
by Armin Krämer 06 Jan '06

06 Jan '06

Okay, i tested on and found an difference. I attach 2 Files. One is the output with an normal Client-Certificate the other with an Certifikate with the OID 1.3.6.1.4.1.311.17.2. In both cases the Certifikate is rejected with Error in Certifikate A. The Client Certifikate ist tested as Client-Certifikate and works when installed as an normal Account Certifikate. Sems like the mistake is at the Certifikate itself??? When i generated the Special Machine Certifikate i changed out the normal OID against the other one described above. Or may i have to add OID as a second OID to the certifikate? Thanks for helping. :-) -----Ursprüngliche Nachricht----- Von: j.cluzel(a)online.fr [mailto:j.cluzel@online.fr] Gesendet: Freitag, 6. Januar 2006 21:11 An: Kraemer.Armin(a)web.de Betreff: Re: Noone anny idea fot --> TLS Athentifikation before Domain, Logon XP? Hello, - login as local administrateur - start mmc.exe - add certificate / computer account / local computer (note sure for names, my XP is french, so I translate) - Then, in the tree, select root certification autority/Certificates - Right click, All tasks/Import - select your "root.der" - Then, in the tree, select Personnal/Certificates - Right click, All tasks/Import - select your "machine.p12" - enter your "private key" - close mmc - set AuthMode to "2" in registry - in computer panel/Network connection/wireless connection - tab "Association" WPA & TKIP - tab "Auth" check "Authenticate as computer..." - tab "Auth"/Properties check "Validate serveur certificate" and select your certificate in the list, !!! Be aware, in "property", you add to check "Connexion to these servers", but let it uncheck for testing - Pray... ;-) Hope it helps. FYI, it works for me. Regards, Jeremy

1 0