- Freeradius-Users - lists.freeradius.org

After the manual's config, chap wont work with LDAP
by Matt Juszczak 16 Dec '05

16 Dec '05

Hi all, We've got our freeradius servers working with LDAP fine, except for CHAP. Originally, the logs were saying "Invalid user \\user", but we fixed that by enabling an option in radiusd.conf. Now, when we dial up without encrypted password enabled, the connection comes through successfully. However, when we enable the encrypted password option and try again, we get: Thu Dec 15 18:12:52 2005 : Auth: Login incorrect (rlm_ldap: empty password supplied): [username/] (from client 123.123.123.123 port 3088 cli 2125550404) Its saying the password is empty, but we are indeed using a password. Does anyone have any ideas? We've followed the instructions in the FAQ (CHAP above LDAP in the authorize section, no := Auth-Type, etc.)..... it just doesn't seem to want to recognize that a password is being entered. For the record, no query hits the LDAP server during a CHAP authentication...... so its obviously something with the config of freeradius. Thanks for any help! -Matt

2 3

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Ok, I will try the CVS version. Thanks for helping me. Best regards, Paulo Ferreira > > In a previous email, I asked you if Freeradius supports IPv6 > > authentications and you response to me that CVS version does. > > Yes... so? > > > > You use the IPv6 attributes from the dictionary, just like you use > > > IPv4 attributes from the dictionary. > > > > Where I can get some documentation about this configuration? > > Read your NAS documentation on what IPv6 attributes it takes. > > > > Version 1.0.5 does not listen on IPv6 addresses, so you can't use > > > IPv6 clients, either. > > > > If I can't use IPv6 clients, how I can execute an IPv6 authentication? > > Is it really that hard to figure out? > > > Did CVS version listening IPv6 addresses? > > Uh... why are you asking this again? Do you think the answer has > changed? > > Alan DeKok.

1 0

radacct mysql query for badguy
by Andys Pool Shop 16 Dec '05

16 Dec '05

Greetings everyone, I have a bad guy that keeps sending harassment emails from a well-known web-mail acct. I know he has httpd an email on 2005-12-15 08:57:32 I have tried to query mySQL radacct but, I left my level of expertise. Please don't be brutal, I know..Go to the the mySQL list. But since radius logs are for security too, I thought this list would help me. Can someone tell me the best SELECT statements to use, so I can narrow my search? My problems come when I try to SELECT UserName FROM radacct WHERE AcctStartTime with the date/time format syntax We are a very small and only have 46 dial-up ports so any returned results would be most satisfying.

1 0

No matching entry in the database for request from user
by Bill Schoolfield 16 Dec '05

16 Dec '05

Hello, I'm getting "No matching entry in the database for request from user" returned from the sql lookup. Below I have the radclient and server diagnostics interlaced. All look correct and the querries are good (see below for them). What is wrong? Bill /usr/local/bin/radclient -x -f radclient.dat2 "194.54.234.234:1814" auth example Sending Access-Request of id 33 to 194.54.234.234:1814 Acct-Session-Id = "6000006B" User-Name = "GLF0000002(a)billmax.com" User-Password = "example" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP rad_recv: Access-Request packet from host 194.54.234.234:1814, id=29, length=94 Acct-Session-Id = "6000006B" User-Name = "GLF0000002" User-Password = "example" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP Proxy-State = 0x30303164 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'GLF0000002' ORDER BY id rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'GLF0000002' ORDER BY id rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): No matching entry in the database for request from user [GLF0000002] rlm_sql (sql): Released sql socket id: 4 Re-sending Access-Request of id 33 to 194.54.234.234:1814 Acct-Session-Id = "6000006B" User-Name = "GLF0000002(a)billmax.com" User-Password = "\291\246\352\320\006\303p\316\230\n%\353\255\202J\341" Group = "default" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP rad_recv: Access-Request packet from host 194.54.234.234:1814, id=29, length=94 Sending Access-Reject of id 29 to 194.54.234.234:1814 Proxy-State = 0x30303164 rad_recv: Access-Reject packet from host 194.54.234.234:1814, id=33, length=54 Reply-Message = "Proxied request" Reply-Message = "Proxied request" Here are the querries from above. They all work: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'GLF0000002' ORDER BY id; +-------+------------+-----------------+---------------+----+ | id | UserName | Attribute | Value | op | +-------+------------+-----------------+---------------+----+ | 60647 | GLF0000002 | Crypt-Password | SMVdbmrqLzh2A | == | | 60648 | GLF0000002 | Session-Timeout | 7200 | == | +-------+------------+-----------------+---------------+----+ 2 rows in set (0.00 sec) mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+------------------+-------------+----+ | 1 | default | Auth-Type | Pap | := | | 2 | default | Service-Type | Framed-User | := | | 3 | default | Framed-Protocol | PPP | := | | 4 | default | Simultaneous-Use | 1 | := | +----+-----------+------------------+-------------+----+ 4 rows in set (0.00 sec) mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'GLF0000002' ORDER BY id; +----+------------+------------------+-------+----+ | id | UserName | Attribute | Value | op | +----+------------+------------------+-------+----+ | 11 | GLF0000002 | Simultaneous-Use | 1 | := | +----+------------+------------------+-------+----+ 1 row in set (0.00 sec) mysql> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; +----+-----------+-------------------+-----------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+-----------------+----+ | 2 | default | Framed-Protocol | PPP | := | | 3 | default | Service-Type | Framed-User | := | | 4 | default | Framed-MTU | 1500 | := | | 5 | default | Simultaneous-Use | 1 | := | | 6 | default | Framed-IP-Netmask | 255.255.255.255 | := | | 7 | default | Idle-Timeout | 900 | := | +----+-----------+-------------------+-----------------+----+ 6 rows in set (0.01 sec)

2 3

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Hi, it's me again. Now I'm trying to implement the IPv6 Freeradius, but I'm having some doubts. When I'm configuring Freeradius, is the same configuration that is used in IPv4, except in the clients file, where I must use IPv6 addresses. My doubt is: How and where did I configure the IPv6 attributes referred in RFC 3162 to RADIUS distribute them to Authenticated users? Please if is possible send to me a configuration example. Regards, Paulo Ferreira > > > > > > I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 > > > Freeradius functioning. > > > > Why? > > Because I didn't arrange a machine for test it yet :) > > > > > > Did the communications between NAS and Freeradius, in IPv6 only > > networks, > > > are made only with IPv6 packets (Access request packets, etc.)? > > > > Uh... you're asking if non-IPv6 packets are sent in an IPv6-only > > network. > > > > That makes *no* sense. > > No, I wanted an IPv6 only, but I wasn't sure if Freeradius was > communicating with NAS in IPv6 only packets, or if it was encapsulating > IPv6 attributes (RFC 3162) over IPv4 packets. > > > > > > Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated > in > > > IPv4 packets? > > > > Read the RFC's. The data in a RADIUS packet is completely > > independent of the IPv4 or IPv6 transport. > > I already red the RFC 3162, and I think that was the idea, but I asked to > the list this questions to had sure. > > Good, that means that it works with packets in both network protocols, > depending of NAS support. > > > > > Alan DeKok. > > > > Thanks for the help, and I will try that when I will have opportunity. > > Regards, > Paulo Ferreira >

2 1

no inet from clients & mysql tables topics
by mfred 16 Dec '05

16 Dec '05

Hi again, thx 2 all who helped me until now with my freeradius project. I made many advancings but have 2 issues which I cant figure out. 1) My client gets authenticated if I use the users file (testentry from howto of Christoph Gravier) Sending Accounting-Response of id 2 to 192.168.0.8:32780 but it dont get authenticated if I use sql entries radius output: rad_recv: Access-Request packet from host 192.168.0.8:32782, id=0, length=199 User-Name = "sqltest2" User-Password = "sqltest2" NAS-IP-Address = 192.168.0.8 Service-Type = Login-User Framed-IP-Address = 192.168.182.3 Calling-Station-Id = "00-E0-98-35-00-28" Called-Station-Id = "00-02-B3-4C-95-89" NAS-Identifier = "nas01" Acct-Session-Id = "43a2af6200000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x79af42dc40dbe6235bcf8585938c6a02 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 13 modcall[authorize]: module "preprocess" returns ok for request 13 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 13 radius_xlat: 'sqltest2' rlm_sql (sql): sql_set_user escaped user --> 'sqltest2' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'sqltest2' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'sqltest2' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'sqltest2' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'sqltest2' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 13 modcall: group authorize returns ok for request 13 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 13 modcall[authenticate]: module "unix" returns notfound for request 13 modcall: group authenticate returns notfound for request 13 auth: Failed to validate the user. Login incorrect: [sqltest2/sqltest2] (from client 192er-testnetz port 0 cli 00-E0-98-35-00-28) my sql table (only radcheck entries, all others are empty): mysql> select * from radcheck; +----+----------+---------------+----+----------+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+----------+ | 1 | mfred | User-Password | := | test | | 7 | sqltest | Password | := | sqltest | | 8 | sqltest2 | User-Password | := | sqltest2 | | 9 | sqltest3 | User-Password | == | sqltest3 | | 10 | argl | User-Password | == | argl | +----+----------+---------------+----+----------+ I tried different Attribute/op entries as I dont know exactly which are good. The different howto's out there are not clear about this. Maybe its version dependent? --------------------------------------- 2) My next problem is that even if I get conneted with my local user I dont have Internet access from the clients. I only can ping 192.168.182.1 but nothing more. >From the Server If you woulbe be so kind again and help me in these topics I would be very happy and my weekend is maybe saved this time :) br, mfred

1 1

rlm_sqlcounter causing a segmentation fault
by Serge Lhermitte 16 Dec '05

16 Dec '05

Hi, I am not too sure about how this should be handled, but hopefully someone can give me a hint As soon as I try to use the rlm_sqlcounter module and start the radiusd, it gives me a segmentation fault message. The last line before it crashes, radiusd -xx is giving me is the following Sqlcounter: safe-characters = "@abc..... /" I am using a recent CVS. Cheers. S.

2 1

bug in rlm_ldap?
by Norbert Wegener 16 Dec '05

16 Dec '05

I want to add a checkitem from an ldap request and use it, when later the users file is processed. Therefore I added checkItem User-Category primaryGroupID to ldap.attrmap The users file contains nothing but: ###################################### HOST/lnxad.tde002.sitest.net User-Category != 515 Fall-Through = No, HOST/lnxad.tde002.sitest.net User-Category == 515 Fall-Through = No, HOST/lnxad.tde002.sitest.net Auth-Type := Reject ###################################### radiusd -AX : .... rlm_ldap: looking for check items in directory... ldap_get_values ldap_get_values ..... ldap_get_values rlm_ldap: Adding LDAP attribute primaryGroupID as RADIUS attribute User-Category == 515 ldap_get_values rlm_ldap: looking for reply items in directory... ldap_get_values ... ldap_get_values ldap_get_values rlm_ldap: Adding LDAP attribute primaryGroupID as RADIUS attribute User-Category = 515 ldap_get_values rlm_ldap: user HOST/lnxad.tde002.sitest.net authorized to use remote access ldap_msgfree rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 users: Matched entry HOST/lnxad.tde002.sitest.net at line 12 This is the last entry of the users file with Auth-Type := Reject Neither of the entries containing the checkitem User-Category matches. Am I doing something wrong? Norbert Wegener

2 5

allowed characters in User-Password?
by Nils-Henner Krueger 16 Dec '05

16 Dec '05

I tried to replace a very old Livingston RADIUS installation by FreeRadius 1.0.1 (using the Solaris pkg from Blastwave). I used the "compat = cistron" directive to simply continue with the existing users file for a first test. At first sight everything worked fine but after following the log for a while it turns out that (too) many users were rejected. All the rejected accounts have a "%" sign in the User-Password. Are there any restrictions on the character set used for the User-Password attribute? Which special chars are forbidden? Where can I find information on that subject? How can I get around this problem? There are a few thousand dialin accounts, out of them about 300 have a "%" in the password so I can't simply call them and solve that directly, not speaking about other chars that might make trouble, too. Thanks for help! nhk

2 5

Freeradius and LDAP : to be continued
by Christophe Gravier 16 Dec '05

16 Dec '05

Hello, From the last things settled today about ldap support for freeradius on the list, I succeeded in configuring the ldap backend for freeradius. At least, radtest provides me an Accept response ! Nevertheless, with the front chillispot, I can't login, freeradius tells: rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ist-guizay.univ-st-etienne.fr:389, authentication 0 rlm_ldap: bind as / to ist-guizay.univ-st-etienne.fr:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=person,o=istase,c=fr, with filter (uid=gravier.christophe) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user gravier.christophe authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. That's pretty strange since it does work with radtest (But I see a plain text password being sent to openldap :s). Anyway, the problem comes from : rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". But I DO have told: password_attribute = "userPassword" for my ldap server in /etc/freeradius/radiusd.conf I mean, there's no configuration in chillispot expect the radius server IP to match users against. What's the difference between a radtest and a authentification via chillispot ? Apart from this chilli-freeradius problem (towards radtest), how can I make freeradius sent a hash as password ? (my userPassword is hash using SHA). There is a porposal here : http://lists.cistron.nl/pipermail/freeradius-users/2002-October/012169.html, but I don't want to use CHAP since my userPassword in SHA encrypted. I tried to comment in authorize section the chap and mschap part (I'll never use it). (same error). (I must say I followed http://www.linuxhomenetworking.com/linux-adv/ldap.htm#_Toc92561284 howto for configuring ldap for freeradius). Please, feel free to point me some directions to search. Best regards, Christophe.

7 21