- Freeradius-Users - lists.freeradius.org

The entries should be ordered
by M T 30 Dec '05

30 Dec '05

In man 5 users, HINTS, from: http://www.freeradius.org/doc/users.5.html#index Does "the entries should be ordered" mean in alphabetical order? (username first) TIA

2 2

A small question...
by Samuel Degrande 29 Dec '05

29 Dec '05

Hello everybody, I wish you a merry christmas. I have one small question, something I don't understand, and I didn't found any explication nowhere : I have something like this : --- radiusd.conf authorization { ... etc_smbpasswd files ... } --- users DEFAULT Auth-Type != MS-CHAP ..... DEFAULT Auth=Type == MS-CHAP ..... In the debug output of radiusd, I see something like : rlm_passwd: Added LM-Password: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' to config_items rlm_passwd: Added NT-Password: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[UX ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" That's done before the mod_call to 'files'. However, there's no matched entry in 'users'. What does it mean ? Why is not Auth-Type set to MS-CHAP before to look at 'users' ? Is there a doc somewhere that precisely describes how the server chains things ? But perhaps it's a big secret, a kind of graal that only radius core developpers can touch ? :-) However, a public version could be really helpfull... -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]

3 3

huntgroups file, aclip
by Adam KOSA 29 Dec '05

29 Dec '05

Hi all, google and the wiki search option did not answer my question, it may be too dumb to ask. i have the following huntgroup contents: aclip Calling-Station-Id == 127.0.0.1 aclip Calling-Station-Id == 127.0.0.11 aclip Calling-Station-Id == 10.61.11.17 aclip Calling-Station-Id == 10.61.13.41 ... aclip Calling-Station-Id == 10.61.14.10 aclip NAS-Port-Type == Async for restricting the logins to our cisco devices. what i'm looking for is the ability to use 127.0.0.0/24 or 127.0.0.1-255 instead of the first two lines. the above / and - syntax did not work. is this possible? what doc am i missing? btw: i need the first two lines because of cisco modules, that are using AAA, and can log into them via console, in which case the connection appears to be coming from 127.0.0.0/24. thanks in advance Adam

2 1

postgres + freeradius trouble
by André Lemos 29 Dec '05

29 Dec '05

1 0

radiusd core dumps on authentication (solaris 9)
by Johan Ramm-Ericson 29 Dec '05

29 Dec '05

Hello freeradius-users! I am currently experiencing an authentication problem and am wondering if anyone has run into something similar (or has an answer as to what I'm doing wrong I am running freeradius 1.0.5 on a Solaris 9 box. I have my users accounts currently stored in a NIS/YP database hosted by a Linux (Suse SLES9) server. My users - configuration file - currently looks like this: DEFAULT Auth-Type = Pam Fall-Through = No I have tried using Auth-Type = {System | Pam | unix}. No matter which I try radiusd core dumps as soon as it comes to the Authenticate module (see debug log below). This does not happen if I set Auth-Type = Local, then everything works as expected. _But_ that would give me two username / password databases to maintain - which is not something I look forward to.... Anyone have any ideas as to what's going on? TIA, Johan PS. No idea if this helps but I have an old freeraidius 1.0.2 lying around. The results (using the same config files) are the same. debug log --------------- /etc/init/freeradiusd start .... Module: Instantiated realm (MIP02) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (NULL) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/opt/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/detail-combined" detail: detailperm = 384 detail: dirperm = 493 detail: locking = yes Module: Instantiated detail (accounting_replication_log) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (post_proxy_log) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.11.249:3644, id=171, length=121 NAS-IP-Address = 192.168.11.249 NAS-Identifier = "vrr_ggsn_2" Called-Station-Id = "xxxx.xxx.xx" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Virtual User-Name = "daniel" User-Password = "secret" Calling-Station-Id = "00001111" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/opt/freeradius/var/log/radius/radacct/192.168.11.249/auth-detail-20051229' rlm_detail: /opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/freeradius/var/log/radius/radacct/192.168.11.249/auth-detail-20051229 modcall[authorize]: module "auth_log" returns ok for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radiusd> for pam.conf lookup Segmentation Fault - core dumped radiusd

2 1

Freeradius vs NT Domain Authentication
by Richard Bortolucci 29 Dec '05

29 Dec '05

Hi, I know that's possible to configure Freeradius to authenticate Windows NT Domain users, but I just can't find a good/complete documentation about it... Is it possible for anyone on this forum to provide such documentation (files/links/instructions) to me? Thanks, -- Richard Bortolucci

2 3

Client authenticated but no internet connection
by mfred 29 Dec '05

29 Dec '05

Hi, The clients can login (through chillispot login page) and authenticate via the radius server and mysqldb. So they have an IP like 192.168.182.5. But even if they get authenticated they still cannot connect to the internet. And I have no idea why. Any hints ? TIA mfred

5 4

RE: FreeRadius and Dlink Switch Authentication Problem
by Kai Geek 29 Dec '05

29 Dec '05

Merhabalar Inci hanim, oncelikle yardimlariniz icin cok tesekkur ederim. Ancak tacacs kullanamiyoruz cunku switchlerin cogu Dlink ve 3226 modeli yani tacacs yok. radius server destekliyorlar. bu nedenle radius kullanmam gerek. #radiusd -X diyerek debug moda aliyorum ve benim ip adresim 10.0.0.185 radius server ise 10.0.0.6'da calisiyor. switch ise (dlink marka) 10.0.0.250 ip adresine sahip. ben #telnet 10.0.0.250 komutunu verdigim zaman switchin kendi icindeki kullanici ile (admin) girebiliyorum. ama hicbir log dusmuyor. ne onerirsiniz? ----- Original Message ----- From: "Inci Gedik " <igedik(a)ford.com.tr> To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Subject: RE: FreeRadius and Dlink Switch Authentication Problem Date: Thu, 29 Dec 2005 15:20:43 +0200 > > Selam, > > Radius un debug ettin mi ? Sen switch e baglanmaya calisirken ekrana neler > geliyor bir bakar misin ? Birde calisan bir sistemden ornek veriim : > > client.conf dosyani asagidaki gibi editler misin ? > > client 10.0.0.250 { > secret = 250 > shortname = switch > nastype = cisco > } > > Users dosyasindaki kulanici tanimlamasini asagidaki gibi yapip, linux > sisteminde steve diye bir kullanici acip bir de sifre verirsen baglantiyi > saglayabilirsin. > > steve Auth-Type := System > Service-Type = Shell-User, > Login-Service = Telnet, > Login-IP-Host = 0.0.0.0, > Login-TCP-Port = Telnet > > Linux altinda port numaralarinda acik degil mi ? Bu sekilde bir kontrol > edersen bir de conf dosyani inceleyebiliriz. O zaman conf dosyanda bir hata > var demektir. > > Bi de israrla tacacs+ diyorum : ) > > > > Kolay gelsin , > > Inci Gedik > > -----Original Message----- > From: freeradius-users-bounces+igedik=ford.com.tr(a)lists.freeradius.org > [mailto:freeradius-users-bounces+igedik=ford.com.tr@lists.freeradius.org] On > Behalf Of Kai Geek > Sent: 29 Aralık 2005 Perşembe 14:24 > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius and Dlink Switch Authentication Problem > > Hello, > i am using freeradius in my computer with the ip 10.0.0.6 > i have a dlink 3226s model switch in my network and its ip is 10.0.0.250 > > i want this switch to verify username and password from radius server > (10.0.0.6) > > i have added 10.0.0.250 as a client to the radius servers clients.conf and > users files and i introduced a user. but still it doesnt connect. where may > be the error? > when i test locally, it seems as working but teh switch doesnt connect to > radius? > thank you, > > using command radius server (10.0.0.6) > > kernel@debian#pico clients.conf > > client 10.0.0.250 { > secret = 250 > shortname = 1 > } > > kernel@debian#pico users > > steve Auth-Type := Local, User-Password == "testing" > Service-Type = Framed-User, > Framed-Protocol = PPP, > Framed-IP-Address = 127.0.0.1, > Framed-IP-Netmask = 255.255.255.0, > Framed-Routing = Broadcast-Listen, > Framed-Filter-Id = "std.ppp", > Framed-MTU = 1500, > Framed-Compression = Van-Jacobsen-TCP-IP > > #radtest steve testing 10.0.0.6 1812 testing > okay > what problem ? > when i test locally, it seems as working but teh switch doesnt connect to > radius? > > +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ > Version: GnuPG v1.4.2 (GNU/Linux) > .-. .-. _ > : : : : :_; > .-' : .--. : `-. .-. .--. ,-.,-. > ' .; :' '_.'' .; :: :' .; ; : ,. : > `.__.'`.__.'`.__.':_;`.__,_;:_;:_; > > Kai "Ozgur" Geek > Network Engineer > PGP ID: B1B63B6E > +-+-+-+ END PGP SIGNATURE +-+-+-+ > > > -- > _______________________________________________ > Check out the latest SMS services @ http://www.linuxmail.org > This allows you to send and receive SMS through your mailbox. > > Powered by Outblaze > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

2 1

FreeRadius and Dlink Switch Authentication Problem
by Kai Geek 29 Dec '05

29 Dec '05

Hello, i am using freeradius in my computer with the ip 10.0.0.6 i have a dlink 3226s model switch in my network and its ip is 10.0.0.250 i want this switch to verify username and password from radius server (10.0.0.6) i have added 10.0.0.250 as a client to the radius servers clients.conf and users files and i introduced a user. but still it doesnt connect. where may be the error? when i test locally, it seems as working but teh switch doesnt connect to radius? thank you, using command radius server (10.0.0.6) kernel@debian#pico clients.conf client 10.0.0.250 { secret = 250 shortname = 1 } kernel@debian#pico users steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 127.0.0.1, Framed-IP-Netmask = 255.255.255.0, Framed-Routing = Broadcast-Listen, Framed-Filter-Id = "std.ppp", Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP #radtest steve testing 10.0.0.6 1812 testing okay what problem ? when i test locally, it seems as working but teh switch doesnt connect to radius? +-+-+-+ BEGIN PGP SIGNATURE +-+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) .-. .-. _ : : : : :_; .-' : .--. : `-. .-. .--. ,-.,-. ' .; :' '_.'' .; :: :' .; ; : ,. : `.__.'`.__.'`.__.':_;`.__,_;:_;:_; Kai "Ozgur" Geek Network Engineer PGP ID: B1B63B6E +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

3 2

openssl fails
by pelusa vali 29 Dec '05

29 Dec '05

hi everybody, well finally get install openssl v0.9.8a, now when i try to generate certificates to be used with freeradius (eap-tls or eap-peap) i use these command to CERTIFICATE AUTHORITY GENERATION: #openssl req -new -x509 -keyout newreq.pem -out newreq.pem -passin pass:clue1 -passout pass:clue1 #openssl pkcs12 -export -in demoCA/cacert.pem -inkey newreq.pem -out root.p12 -cacerts -passin pass:clue1 -passout pass:clue1 #openssl pkcs12 -in root.p12 -out root.pem -passin pass:clue1 -passout pass:clue1 (i copied root.p12 from freeradius files) #openssl x509 -inform PEM -outform DER -in root.pem -out root.der #rm -rf newreq.pem and these to SERVER CERTIFICATE GENERATION: #openssl req -new -keyout newreq.pem -out newreq.pem -passin pass:whatever -passout pass:clue1 #openssl ca -policy policy_anything -out newcert.pem -passin pass:whatever -key whatever -extensions xpserver_ext -extfile xpextensions -infiles newreq.pem right here, when using this command i get this error: Error opening CA private key ./demoCA/private/cakey.pem 4161:error:02001002:system library:fopen:No such file or directory:bss_file.c:349:fopen ('./demoCA/private/cakey.pem' ,'r') 4161:error:20074002:BIO routines:FILE_CTRL:system lib:bss_file.c:351: unable to load CA private key well i really don't understand what this mean but reviewed ./demoCA/private/cakey.pem and effectively it's there, so why openssl cann't locate it?? why unable to load CA private key?? so, i tried this: #openssl x509 -inform PEM -outform DER -in demoCA/cacert.pem -out demoCA/cacert.der but now get this: 4201:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:644:Expecting: TRUSTED CERTIFICATE excuse if this question is so trivial but i really don't understand it. could any body help and tell me what is happening?? thanks for your patience and help. _________________________________________________________________ Las mejores tiendas, los precios mas bajos, entregas en todo el mundo, YupiMSN Compras: http://latam.msn.com/compras/

2 1