- Freeradius-Users - lists.freeradius.org

TLS Athentifikation before Domain Logon XP
by Armin Krämer 06 Jan '06

06 Jan '06

Hi, i searched the whole archive about this Problems but can not find an real answert to my Problem. I want Windows XP to authenticate to Freeradius when before the user Logs on the domain otherwise he would have no network connection to reach the PDC and the logon fails. It should be possible wit the XP Client and no other additional software. I tried out the registry patch AuthMode with a value of 2 whch causes windows to authenticate with the machine certificate only. Then I generated a client certificate with openssl with the special OID 1.3.6.1.4.1.311.17.2 which was posted in the mailing list some time ago. But with this certificate authentification fails. Is there anybody who successfully managed that problem and can describe me how he solved this problem step by step. I think the problem is the machine certificate. Greetings Armin

3 4

MS LDAP connect OK users not found
by Dickson, John 06 Jan '06

06 Jan '06

I have made great progress but still need assistance with the individual authentication being passed to the MS ldap. Using ldapsearch I have access to all the records. Using "ntlm_auth --request-nt-key --domain=xxxx1 --username=radtest" works as well. What I see is that "rlm_realm" finds no realm and is not able to pass authentication. Why is the "NAS-IP-Address = 255.255.255.255"? Is it that my request from the localhost " radtest radtest userpass xxxx1.xxxx2.edu 0 testing123" has syntax errors? rad_recv: Access-Request packet from host 10.1.1.27:32800, id=87, length=77 --- Walking the entire request list --- Waking up in 31 seconds... Thread 3 got semaphore Thread 3 handling request 7, (2 handled so far) User-Name = "radtest(a)xxxx1.xxxx2.edu" User-Password = "userpass" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: Looking up realm "xxxx1.xxxx2.edu" for User-Name = "radtest(a)xxxx1.xxxx2.edu" rlm_realm: No such realm "xxxx1.xxxx2.edu" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 7 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for radtest(a)xxxx1.xxxx2.edu radius_xlat: '(uid=radtest(a)xxxx1.xxxx2.edu)' radius_xlat: 'ou=Users,dc=xxxx1,dc=xxxx2,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Metro Users,dc=xxxx1,dc=xxxx2,dc=edu, with filter (uid=radtest(a)xxxx1.xxxx2.edu) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 7 modcall: group authorize returns ok for request 7 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 modcall[authenticate]: module "unix" returns notfound for request 7 modcall: group authenticate returns notfound for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Thread 3 waiting to be assigned a request rad_recv: Access-Request packet from host 10.1.1.27:32800, id=87, length=77 Sending Access-Reject of id 87 to 10.1.1.27:32800 --- Walking the entire request list ---

2 1

SQL Authentication (mainly @Alan!)
by florian broder 06 Jan '06

06 Jan '06

Hi. Some weeks ago I was asking for this, but didn't receive an answer. Subject is MySQL Authentication based on a Calling-Station-ID. The problem is, that the cisco Switch doesn't send a user-name&user-password in his access-request, and mysql doesn't like! --> *Error: rlm_sql *>* (sql): zero length username not permitted" I tried to comment out this part in the sql-module source-code, and recompile freeradius. To my surprise, this actually DOES work. --> rad_recv: Access-Request packet from host 127.0.0.1:1046, id=134, length=52 User-Name = "" User-Password = "michael" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'michael' rlm_sql (sql): sql_set_user escaped user --> 'michael' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck ? WHERE Username = 'michael' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'michael' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'michael' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 134 to 127.0.0.1:1046 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 134 with timestamp 43bc1274 Nothing to do. Sleeping until we see a request. Sql.conf was told, to check for the password, not username. It works! So, my question is, like in the subject, mainly directed to alan, or some other developper of the sql-module. WHY was it done like that, i.e. that you HAVE to use a username in sql? Thanks for your help, I really appreciate it! Bye.*

1 0

Re: acct_unique
by Velikanov 06 Jan '06

06 Jan '06

I now about Auth-Type, Autz-Type, Acct-Type, Session-Type and the sections where to use them. What "ZZZZ-Type" must i use in "preacct" section ? THANKS > "Velikanov" <alex(a)asu.farlep.net> wrote: > > preacct { > > preprocess > > Acct-Type PIX{ > > acct_PIX > > } > > You put an "Acct-Type" in a "preacct" section. That won't work. > Acct-Types have to go into "accounting" sections. > > > radiusd.conf[1683] Unknown module rcode 'acct_PIX'. > > It's treating "Acct-Type" as a module name, because Acct-Types don't > belong in "preacct" sections. > > Alan DeKok.

2 1

Test
by Mathieu Clément 05 Jan '06

05 Jan '06

Please answer if it works!!!!

2 1

before freeradius, openssl don't work
by pelusa vali 05 Jan '06

05 Jan '06

hi everybody, well still trying to use freeradius for a wlan. i use debian sarge kernel 2.6.13, openssl 0.9.8.a to generate certificates and last freeradius version. well i followed many tutorials about securing wlans with freeradius and all of them have this step: openssl rsa <newreq.pem > servidor-key.pem but when i type this my system returns: unable to load Private Key 5237:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: ANY PRIVATE KEY so i think it's a problem with rsa generation and tried to generate rsa key but always get same error. i know it's not a list of openssl but i posted this question in openssl list and nobody ask; searched in internet and nothing; so, any body could help?? what is happening and how could i solve this?? excuse if this so trivial but i'm new with both, openssl and freeradius and don't understand what is happening and why. thanks in advance for your time and help. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

1 0

RE: Fw: authorize and authenticate methods ina custom module
by Susana Macias 05 Jan '06

05 Jan '06

Thanks a lot Alan, I would like to explain what I am trying to develop. If someone has any advise, please tell me. This is my scenario: Until now, we have a RADIUS server (RADIUS PSI) which only receives Access-Request packets. Also we have a CGI application located in the URL http://X.Y.Z.W:8080/nucleo This application receives a set of parameters as an URL encoded string (all characters that are not a-z, A-Z or 0-9 are converted to their "URL escaped" version) with this form: Attribute1=Value1&Attribute2=Value2... (where Attribute1, Attribute2... and Value1,Value2... are the differents Attribute/Value pairs obtained from the Access-Request packet) The CGI application consults a remote database (and normally authenticate the user using the telephone number; although there are other variants). According to the response obtained from the remote resource, the RADIUS server adds differents Attribute/Value pairs to the reply list, and always reply with an Access-Accept packet (whether or not the CGI application authenticate the user successfully) Now, we want to change to a FreeRadius server. I only want to call the remote resource (using the libcurl library) passing it the appropiates parameters and collect the information returned by it in order to create the reply list. As the CGI application performs the authorize and authenticate activities I am a little embarrassed to say that I am not sure which function should I implement (authorize or authenticate). Thank you very much in advance Best wishes, Susana ----- Original Message ----- From: "Alan DeKok" To: "FreeRadius users mailing list" Sent: Tuesday, January 03, 2006 4:31 PM Subject: Re: authorize and authenticate methods ina custom module > Susana Macias wrote: > > I have started working with the RADIUS protocol (and with FreeRadius > > in particular) three weeks ago. Congratulations for the product, it is > > really powerful! > > Thanks. > > > But, when are the authorize() and authenticate() methods called? > > When a packet comes in. See doc/aaa.txt > > > Is it necessary to include in the radiusd.conf the name of the > > instance (of the new module created) in the authorize section in order > > to call its authorize() method? > > Yes. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > --------------------------------- Correo Yahoo! Comprueba qué es nuevo, aquí http://correo.yahoo.es

2 1

LDAP scope
by Stefan Adams 05 Jan '06

05 Jan '06

Hi! Is it possible to specify a basedn of "dc=example,dc=com" with a scope of "sub" so that my search filters can apply to both "ou=People" and "ou=Computers" for example? It seems from my testing that the scope is "one" by default. The reason I would like to do this is to have the check box in Windows XP that says "Authenticate as computer..." checked. Doing this, FreeRADIUS is first presented with the credentials of the computer (host/name). Since I already have a computer account in ou=Computers, I figure I'd just add a cn=host/name attribute and modify the filter to be (|(uid=%{User-Name})(cn=%{User-Name})). But this can only work with a basedn of "dc=example,dc=com" and a scope of sub. Thanks! Stefan

2 1

Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header
by Mathieu Clément 05 Jan '06

05 Jan '06

Good morning, Look at this: --------------------------------------------------------------- # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib radiusd.conf[1383] Failed to link to module 'rlm_exec': /usr/local/lib/rlm_exec.a: invalid ELF header -------------------------------------------- Running mandrake with mysql. Second question: How to add users in the mysql table ? I see "UserName, value, etc." but where to put the password, and which format (md5 ? sha1 ? cleared-text ?) Thank you in advance, Have a good day. Mathieu --- avast! Antivirus: message Sortant propre. Base de donnÚes des virus (VPS): 0601-1, 03/01/2006 Test du: 05/01/2006 02:47:50 avast! - copyright (c) 1988-2004 ALWIL Software. http://www.avast.com

1 1

acct_unique
by Velikanov 05 Jan '06

05 Jan '06

Good day. I need to use such a construction in radiusd.conf acct_unique acct_std{ key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } acct_unique acct_PIX{ key = "Acct-Session-Id, NAS-IP-Address, Login-IP-Host, Login-TCP-Port" } preacct { preprocess Acct-Type PIX{ acct_PIX } acct_std } BUT got an error when i do "radiusd -X": .......... .......... Module: Instantiated sql (sql) radiusd.conf[1683] Unknown module rcode 'acct_PIX'. In radiusd.conf there are the strings: string 1682: Acct-Type PIX{ string 1683: acct_PIX string 1684: } WHERE IS MY MISTAKE ? And a questions - Why we need to use attribute "Acct-Unique-Session-Id" ? I use sql database for accounting, there we have unique index "radacctid" and i need to understand the purpose and advantages of using the attribute "Acct-Unique-Session-Id" THANKS

2 1