- Freeradius-Users - lists.freeradius.org

EAP-PEAP (mschapv2) & ssid restriction
by Sergey Velikanov 21 Dec '05

21 Dec '05

Hi I've implemented wi-fi access (EAP-PEAP with ms-chap v2), it works fine, now I want that users from one ssid could not connect to another ssid, my AP can include this infrmation in Access-Request packet rad_recv: Access-Request packet from host 192.168.232.3:1645, id=215, length=274 User-Name = "user1" Framed-MTU = 1400 Called-Station-Id = "0013.1a4b.ae50" Calling-Station-Id = "0002.2d37.249f" Cisco-AVPair = "ssid=is_client" in my raddb/users I've changed user1 User-Password == "123456" to user1 Cisco-AVPair =~ "ssid=is_client", User-Password == "123456" it works fine with EAP-TLS, but it fails with EAP-PEAP (it uses mschap), rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 18 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 18 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for user1 with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect It seems that rlm_mschap do not include Cisco-AVPair = "ssid=is_client" in its auth request How can I solve this situation?

2 2

"make install" error with FreeRadius 1.0.5 on RH8.0
by Vineet Verma 21 Dec '05

21 Dec '05

I completed the configure and make successfully but "make install" gives me the following error: Making install in rlm_eap_gtc... gmake[11]: Entering directory `/data/software/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_gtc' if [ "xrlm_eap_gtc" != "x" ]; then \ /data/software/freeradius-1.0.5/libtool --mode=install /data/software/freeradius-1.0.5/install-sh -c -c \ rlm_eap_gtc.la /usr/local/lib/rlm_eap_gtc.la; \ rm -f /usr/local/lib/rlm_eap_gtc-1.0.5.la; \ ln -s rlm_eap_gtc.la /usr/local/lib/rlm_eap_gtc-1.0.5.la || exit ; \ fi gmake[11]: execvp: /bin/sh: Argument list too long gmake[11]: *** [install] Error 127 gmake[11]: Leaving directory `/data/software/freeradius-1.0.5/src/modules/rlm_eap/types/rlm_eap_gtc' gmake[10]: *** [common] Error 2 I understand that the "Argument list too long" error is from the OS because the argv list is probably exceeding the 128K buffer. Usually the workaround is to rewrite the offending commands so that the argument lists are shorter. Has anyone run into this problem before and do you have any tips on how I can workaround this?

2 2

Re: rlm_sqlcounter and something else than Session-Timeout
by Alan DeKok 21 Dec '05

21 Dec '05

"Seferovic Edvin" <edvin.seferovic(a)kolp.at> wrote: > I do NOT want to limit or change the limit during a session. I just want to > limit it for a session As I was trying to say that in general, you CANNOT do this. You can check if they're over the limit at the START of a session. The NAS will *not* check the limit during a session, and the server can't check the limit during a session. So if they're under the limit at the start of the session, they can go over during the session, and no one will notice. This has NOTHING to do with changing the limits during a session. > 3. freeradius returns Session-Octets-Limit with the value from sqlcounter > which is the actual limitation. If the NAS supports this, it may work. But 99.9999% of the NASes do NOT support this. It's not a standard, and it's not a common vendor extension to RADIUS. > Alan, I think you are far more better programmer then I am. It shouldn't be > a big trouble to allow another config parameter for sqlcounter. This one > could be named "Reply-Attribute" and people could use to enter > "Session-Timeout" or "Session-Octets-Limit" depending on their need and > usage of freeradius. I can't test that, sorry. I'd rather see a patch that works. Alan DeKok.

2 2

Client-IP-Address in detail files
by freeradius＠list.coretech.ro 20 Dec '05

20 Dec '05

hello, I have recently upgraded from CVS version as of 2005-02-19 with the one from 2005-12-17 and I no longer get the "Client-IP-Address" attribute in the files produced by the detail module. on the other hand the "Client-IP-Address" attribute is expanded correctly in sql querys. is there something different ? how can I add "Client-IP-Address" attribute back to the detail files ? and something else. where can I find the syntax of the "listen" directive ? (to remove bind_address and port directives) thanks, Razvan Radu

3 4

Problem with CHAP, users file and radclient
by Andreas Engler 20 Dec '05

20 Dec '05

Hello, i try to test a new freeradius (1.0.5) installation with radclient (Version 1.72.2.1)and an existing auth-log detailfile. The authentication failed in rlm_check_password. Please take a look at the radius.log sequence at bottom. In the auth-log file are accepted requests of a different server, wich gets the user-password via mysql. In the auth-log file are Chap-Password and Chap-Challenge attributes. The new installation should use the users file for storing the password. So i exctracted the data from mysql-db and created the users file. The passwords are stored cleartext. Did i somthing missing in the configuration (see log)? Couldn't i use radclient this way to test real packets? Did you need mor information? Thank you for help Andreas Engler the users file entry: hubba User-Password == "bubba", NAS-Port-Id == 1/0/0/8.32 the radius.log sequence: Thread 1 handling request 0, (1 handled so far) Framed-Protocol = PPP User-Name = "hubba" CHAP-Password = 0x2c98390c540135e0bbf1024d3dff4a71ef NAS-Port-Type = Virtual NAS-Port = 268959776 NAS-Port-Id = "1/0/0/8.32" Connect-Info = "pppoe4atm" Service-Type = Framed-User NAS-IP-Address = xxx.xxx.xxx.xxx CHAP-Challenge = 0x3fc1d8dc7b393459a292d664a9054a92 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_passwd: Added Grp-Name: 'test##all##' to request_items modcall[authorize]: module "etc_group" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/127.0.0.1/auth-detail-20051220' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20051220 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 users: Matched entry DEFAULT at line 11 users: Matched entry hubba at line 31 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "hubba" with CHAP password rlm_chap: Using clear text password bubba for user hubba authentication. rlm_chap: Pasword check failed modcall[authenticate]: module "chap" returns reject for request 0 modcall: group Auth-Type returns reject for request 0 auth: Failed to validate the user. Login incorrect (rlm_chap: Wrong user password): [hubba/<CHAP-Password>] (from client localhost port 268959776)

2 1

Changing default reply from server when denied using Login-Time
by Drew S. Dupont 20 Dec '05

20 Dec '05

How can you change the default reply message sent back from the server when a user tries to login outside the allowed time? I am specifically asking about the message: Reply-Message = "You are calling outside your allowed timespan\r\n" that is returned when trying to login when using the Login-Time parameter for a user. I understand there is a "Reply-Message" field one can use in the user record. However, in our system it is only used when they are deactivated by the admin/manager and should not be populated otherwise. Is the only solution to recompile the freeradius server with that message changed? Or am I missing some param. or file where it could be changed? Thank you, Drew Dupont -- ------------------------------------------------------------------------------------------------------ Drew S. Dupont dsdupont(a)alumni.indiana.edu AIM: NetWhizOne FWD #: 271144 YIM: dsdupont ------------------------------------------------------------------------------------------------------

1 0

failed eap-type/tls???
by pelusa vali 20 Dec '05

20 Dec '05

hi everybody, well i'm trying to implement an ap over linux, i use madwifi-ng, debian sarge kernel 2.6.13 and freeradius supplied with debian installation cd's; i'd like to add more security so i decided to use hostapd and freeradius, first i generate my own certificates using openssl, and my hostapd configuration refer to freeradius files and directories; here is my radiusd.conf file: prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /var/log/freeradius raddbdir = /etc/freeradius radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/freeradius log_file = ${logdir}/radius.log libdir = /usr/lib/freeradius pidfile = ${run_dir}/freeradius.pid user = root group = root max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = 192.168.50.1 port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = before lower_pass = before nospace_user = before nospace_pass = before security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 shadow = /etc/shadow radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } detail { detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = no check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } and here eap.conf file: eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_password = wlanserver private_key_file = /etc/freeradius/certs/miscerts/private/cakey.pem certificate_file = /etc/freeradius/certs/miscerts/cacert.crt CA_file = /etc/freeradius/certs/miscerts/cacert.pem dh_file = /etc/freeradius/certs/dh random_file = /etc/freeradius/certs/random fragment_size = 1024 } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } } well the problem is: when i run freeradius -X i get this error: rlm_eap:Failed to link EAP-Type/tls: rlm_eap_tls.so:cannot open shared object:no such file or directory radiusd.conf[9]:eap:instantation failed so could any body help me?? why occurs this error and how could i solve it?? thanks for your help. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

2 1

Authorize a group by multivalued "Service-Type" (in MySql)
by Hamzeh Motahari 20 Dec '05

20 Dec '05

2 1

Plain text password file
by Alexander Lund 20 Dec '05

20 Dec '05

Can somebody explain howto use rlm_passwd and a textfile with this setup: name:password:group and so on the order can be any way around, spaces can also be present. Any pointers will be gladly excepted. A sweet tutorial will result in a free night out in Borås, Sweden /Alex -- When there is no solution, there is no problem.

2 3

Freeradius RPM for SUSE 10.0 or 9.3
by LeRoy DeVries 19 Dec '05

19 Dec '05

Does anyone here on the list have the RPM for freeradius /w experimental modeles to share with me. I would be very greatfull. I would compile it however, SUSE won't let me compile the program because of interdependancy errors and it's like chasing my tail so I gave up. ---- LeRoy

8 23