- Freeradius-Users - lists.freeradius.org

No Reply Proxy for Accounting Requests
by David Bickle 17 Dec '05

17 Dec '05

Does anyone know how to configure a proxy for the forwarding of no reply accounting requests? In particular I am interested in accounting start/stop packets. Thanks,

3 3

RADIUS packet did not have correct Message-Authenticator
by Norbert Wegener 17 Dec '05

17 Dec '05

I do an eap/tls authentication and after that an ad search. This works so far. But when setting the groupmembership in the ldap1 section, there are problems. I do not see the usual eap messages flying around, but nevertheless radius sends an Access-Accept: rlm_ldap::ldap_groupcmp: User found in group 515^M rlm_ldap: ldap_release_conn: Release Id: 0^M users: Matched entry DEFAULT at line 25^M modcall[authorize]: module "files" returns ok for request 0^M modcall: leaving group authorize (returns updated) for request 0^M rad_check_password: Found Auth-Type Accept^M rad_check_password: Auth-Type = Accept, accepting the user^M Sending Access-Accept of id 0 to 149.246.133.44 port 32770^M Tunnel-Type:0 = VLAN^M Tunnel-Medium-Type:0 = 802^M Tunnel-Private-Group-Id:0 = "Core1"^M Finished request 0^M On the client side, where I have eapol_test, I get an error: STA 00:00:00:00:00:02: Received RADIUS packet matched with a pending request, round trip time 0.24 sec No Message-Authenticator attribute found Incoming RADIUS packet did not have correct Message-Authenticator - dropped STA 00:00:00:00:00:02: No RADIUS RX handler found (type=0 code=2 id=0) - dropping packet This is from my radiusd.conf: When it is there, radius sends an Access-Accept. ldap ldap1 { server = "globalcatalogue" port = 3268 #global catalogue server identity = "testrad(a)TDE002.MYDOM.NET" password = "mypass" basedn = "dc=MYDOM,dc=NET" filter = "(&(servicePrincipalName=%{Stripped-User-Name:-%{User-Name}})(objectClass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" ldap_debug= 0xFFFF timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap groupmembership_attribute = "primaryGroupID" } authorize { preprocess eap ldap1 { notfound = reject } files } The complete output of radius -AX is lengthy and therefore nor included. It can be found at: http://www.wegener-net.de/fr/bad-group , where the error occurs, http://www.wegener-net.de/fr/ok-nogroup , where the authentication works as expected. As mentioned above, the only difference in the configuration is the use of groupmembership. Any hints are really appreciated. Thanks Norbert Wegener

3 5

PAM client password change
by John Kelly 17 Dec '05

17 Dec '05

I see that >http://www.freeradius.org/pam_radius_auth/README says > This is the PAM to RADIUS authentication module. It allows any >Linux or Solaris machine to become a RADIUS client for authentication >and password change requests. ^^^^^^^^^^^^^^^^^^^^^ OK! But then http://www.freeradius.org/pam_radius_auth/USAGE says > The module takes a number of configuration options. > Password changing is not implemented, as the RADIUS protocol does not ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ So README says yes, and USAGE says no. I want take all my users out of /etc/passwd and put them in a RADIUS server (running on the same host). And it would be nice if they could change their own passwords. But after reading the documents above, I don't know what to believe. Is this possible with pam_radius?

1 0

EAP-PEAP and windows supplicant behaviour
by Riccardo Veraldi 17 Dec '05

17 Dec '05

Hello, I Tried EAP-PEAP with success, and it works great with freeradius. My question (perhaps off topic) is how to change the default behaviour of the XP PEAP supplicant ? If you insert login/password it remembers those setting and it will not prompt you for them anymore... how to solve this problem ? is there a registry key to modify ? anyone has a hint about this ? thanks Rick

2 1

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Hi, Alan In a previous email, I asked you if Freeradius supports IPv6 authentications and you response to me that CVS version does. > > > How and where did I configure the IPv6 attributes referred in RFC 3162 to > > RADIUS distribute them to Authenticated users? > > You use the IPv6 attributes from the dictionary, just like you use > IPv4 attributes from the dictionary. Where I can get some documentation about this configuration? > Version 1.0.5 does not listen on IPv6 addresses, so you can't use > IPv6 clients, either. If I can't use IPv6 clients, how I can execute an IPv6 authentication? Did CVS version listening IPv6 addresses? > > Alan DeKok. Thanks in advance, Paulo Ferreira

2 1

After the manual's config, chap wont work with LDAP
by Matt Juszczak 16 Dec '05

16 Dec '05

Hi all, We've got our freeradius servers working with LDAP fine, except for CHAP. Originally, the logs were saying "Invalid user \\user", but we fixed that by enabling an option in radiusd.conf. Now, when we dial up without encrypted password enabled, the connection comes through successfully. However, when we enable the encrypted password option and try again, we get: Thu Dec 15 18:12:52 2005 : Auth: Login incorrect (rlm_ldap: empty password supplied): [username/] (from client 123.123.123.123 port 3088 cli 2125550404) Its saying the password is empty, but we are indeed using a password. Does anyone have any ideas? We've followed the instructions in the FAQ (CHAP above LDAP in the authorize section, no := Auth-Type, etc.)..... it just doesn't seem to want to recognize that a password is being entered. For the record, no query hits the LDAP server during a CHAP authentication...... so its obviously something with the config of freeradius. Thanks for any help! -Matt

2 3

RE: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Ok, I will try the CVS version. Thanks for helping me. Best regards, Paulo Ferreira > > In a previous email, I asked you if Freeradius supports IPv6 > > authentications and you response to me that CVS version does. > > Yes... so? > > > > You use the IPv6 attributes from the dictionary, just like you use > > > IPv4 attributes from the dictionary. > > > > Where I can get some documentation about this configuration? > > Read your NAS documentation on what IPv6 attributes it takes. > > > > Version 1.0.5 does not listen on IPv6 addresses, so you can't use > > > IPv6 clients, either. > > > > If I can't use IPv6 clients, how I can execute an IPv6 authentication? > > Is it really that hard to figure out? > > > Did CVS version listening IPv6 addresses? > > Uh... why are you asking this again? Do you think the answer has > changed? > > Alan DeKok.

1 0

radacct mysql query for badguy
by Andys Pool Shop 16 Dec '05

16 Dec '05

Greetings everyone, I have a bad guy that keeps sending harassment emails from a well-known web-mail acct. I know he has httpd an email on 2005-12-15 08:57:32 I have tried to query mySQL radacct but, I left my level of expertise. Please don't be brutal, I know..Go to the the mySQL list. But since radius logs are for security too, I thought this list would help me. Can someone tell me the best SELECT statements to use, so I can narrow my search? My problems come when I try to SELECT UserName FROM radacct WHERE AcctStartTime with the date/time format syntax We are a very small and only have 46 dial-up ports so any returned results would be most satisfying.

1 0

No matching entry in the database for request from user
by Bill Schoolfield 16 Dec '05

16 Dec '05

Hello, I'm getting "No matching entry in the database for request from user" returned from the sql lookup. Below I have the radclient and server diagnostics interlaced. All look correct and the querries are good (see below for them). What is wrong? Bill /usr/local/bin/radclient -x -f radclient.dat2 "194.54.234.234:1814" auth example Sending Access-Request of id 33 to 194.54.234.234:1814 Acct-Session-Id = "6000006B" User-Name = "GLF0000002(a)billmax.com" User-Password = "example" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP rad_recv: Access-Request packet from host 194.54.234.234:1814, id=29, length=94 Acct-Session-Id = "6000006B" User-Name = "GLF0000002" User-Password = "example" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP Proxy-State = 0x30303164 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'GLF0000002' ORDER BY id rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'GLF0000002' ORDER BY id rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): No matching entry in the database for request from user [GLF0000002] rlm_sql (sql): Released sql socket id: 4 Re-sending Access-Request of id 33 to 194.54.234.234:1814 Acct-Session-Id = "6000006B" User-Name = "GLF0000002(a)billmax.com" User-Password = "\291\246\352\320\006\303p\316\230\n%\353\255\202J\341" Group = "default" NAS-IP-Address = 194.126.63.86 NAS-Port-Id = "32" NAS-Port-Type = Async Service-Type = Framed-User Framed-Protocol = PPP rad_recv: Access-Request packet from host 194.54.234.234:1814, id=29, length=94 Sending Access-Reject of id 29 to 194.54.234.234:1814 Proxy-State = 0x30303164 rad_recv: Access-Reject packet from host 194.54.234.234:1814, id=33, length=54 Reply-Message = "Proxied request" Reply-Message = "Proxied request" Here are the querries from above. They all work: mysql> SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'GLF0000002' ORDER BY id; +-------+------------+-----------------+---------------+----+ | id | UserName | Attribute | Value | op | +-------+------------+-----------------+---------------+----+ | 60647 | GLF0000002 | Crypt-Password | SMVdbmrqLzh2A | == | | 60648 | GLF0000002 | Session-Timeout | 7200 | == | +-------+------------+-----------------+---------------+----+ 2 rows in set (0.00 sec) mysql> SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; +----+-----------+------------------+-------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+------------------+-------------+----+ | 1 | default | Auth-Type | Pap | := | | 2 | default | Service-Type | Framed-User | := | | 3 | default | Framed-Protocol | PPP | := | | 4 | default | Simultaneous-Use | 1 | := | +----+-----------+------------------+-------------+----+ 4 rows in set (0.00 sec) mysql> SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'GLF0000002' ORDER BY id; +----+------------+------------------+-------+----+ | id | UserName | Attribute | Value | op | +----+------------+------------------+-------+----+ | 11 | GLF0000002 | Simultaneous-Use | 1 | := | +----+------------+------------------+-------+----+ 1 row in set (0.00 sec) mysql> SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'GLF0000002' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; +----+-----------+-------------------+-----------------+----+ | id | GroupName | Attribute | Value | op | +----+-----------+-------------------+-----------------+----+ | 2 | default | Framed-Protocol | PPP | := | | 3 | default | Service-Type | Framed-User | := | | 4 | default | Framed-MTU | 1500 | := | | 5 | default | Simultaneous-Use | 1 | := | | 6 | default | Framed-IP-Netmask | 255.255.255.255 | := | | 7 | default | Idle-Timeout | 900 | := | +----+-----------+-------------------+-----------------+----+ 6 rows in set (0.01 sec)

2 3

Re: IPv6 Support
by Paulo Alexandre Caceres Ferreira 16 Dec '05

16 Dec '05

Hi, it's me again. Now I'm trying to implement the IPv6 Freeradius, but I'm having some doubts. When I'm configuring Freeradius, is the same configuration that is used in IPv4, except in the clients file, where I must use IPv6 addresses. My doubt is: How and where did I configure the IPv6 attributes referred in RFC 3162 to RADIUS distribute them to Authenticated users? Please if is possible send to me a configuration example. Regards, Paulo Ferreira > > > > > > I don.t try Freeradius with IPv6 yet, but I have doubts with IPv6 > > > Freeradius functioning. > > > > Why? > > Because I didn't arrange a machine for test it yet :) > > > > > > Did the communications between NAS and Freeradius, in IPv6 only > > networks, > > > are made only with IPv6 packets (Access request packets, etc.)? > > > > Uh... you're asking if non-IPv6 packets are sent in an IPv6-only > > network. > > > > That makes *no* sense. > > No, I wanted an IPv6 only, but I wasn't sure if Freeradius was > communicating with NAS in IPv6 only packets, or if it was encapsulating > IPv6 attributes (RFC 3162) over IPv4 packets. > > > > > > Or did the IPv6 attributes (NAS-IPv6-Address, etc.) are encapsulated > in > > > IPv4 packets? > > > > Read the RFC's. The data in a RADIUS packet is completely > > independent of the IPv4 or IPv6 transport. > > I already red the RFC 3162, and I think that was the idea, but I asked to > the list this questions to had sure. > > Good, that means that it works with packets in both network protocols, > depending of NAS support. > > > > > Alan DeKok. > > > > Thanks for the help, and I will try that when I will have opportunity. > > Regards, > Paulo Ferreira >

2 1