- Freeradius-Users - lists.freeradius.org

rlm_digest: cannot do "auth-int" digest authentication to work
by Bruno Negrao 12 Dec '05

12 Dec '05

Hi all, I'm testing the rlm_digest module in freeradius 1.0.5 to make a digest authentication. To test, I'm using radclient and I'm passing to it the Digest attributes in order to authenticate on the localhost. I'm using the command bellow to authenticate the user "bob" password "zanzibar" in my radius server but it's not working. echo ' User-name = "bob", Digest-Response = "bdbeebb2da6adb6bca02599c2239e192", Digest-Realm = "biloxi.com", Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093", Digest-Method = "INVITE", Digest-URI = "sip:bob@biloxi.com", Digest-Algorithm = "MD5", Digest-User-Name = "bob", Digest-QOP = "auth-int", Digest-Nonce-Count = "00000001", Digest-CNonce = "0a4f113b", Digest-Body-Digest = "c1ed018b8ec4a3b170c0921f5b564e48"' | /usr/bin/radclient localhost auth testing123 2>&1 The values in I'm passing in the attributes are supposed to be correct. I extracted them from the draft http://ftp6.us.freebsd.org/pub/rfc/internet-drafts/draft-smith-sipping-auth… What is going wrong is the calculation of H(A2). See the output of "radiusd -X" in response to that command above: Cleaning up request 0 ID 111 with timestamp 439dbec1 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 127.0.0.1:32937, id=117, length=229 User-Name = "bob" Digest-Response = "bdbeebb2da6adb6bca02599c2239e192" Digest-Attributes = 0x010c62696c6f78692e636f6d Digest-Attributes = 0x022464636439386237313032646432663065386231316430663630306266623063303933 Digest-Attributes = 0x0308494e56495445 Digest-Attributes = 0x04147369703a626f624062696c6f78692e636f6d Digest-Attributes = 0x06054d4435 Digest-Attributes = 0x0a05626f62 Digest-Attributes = 0x050a617574682d696e74 Digest-Attributes = 0x090a3030303030303031 Digest-Attributes = 0x080a3061346631313362 Digest-Attributes = 0x07226331656430313862386563346133623137306330393231663562353634653438 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "biloxi.com" Digest-Nonce = "dcd98b7102dd2f0e8b11d0f600bfb0c093" Digest-Method = "INVITE" Digest-URI = "sip:bob@biloxi.com" Digest-Algorithm = "MD5" Digest-User-Name = "bob" Digest-QOP = "auth-int" Digest-Nonce-Count = "00000001" Digest-CNonce = "0a4f113b" Digest-Body-Digest = "c1ed018b8ec4a3b170c0921f5b564e48" rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 1 rlm_realm: No '@' in User-Name = "bob", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry bob at line 5 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type Digest auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 A1 = bob:biloxi.com:zanzibar A2 = INVITE:sip:bob@biloxi.com:Áí???Ä£±pÀ??[VNH H(A1) = 12af60467a33e8518da5c68bbff12b11 H(A2) = 7a3ae801f64033d060b8209ec071569c KD = 12af60467a33e8518da5c68bbff12b11:dcd98b7102dd2f0e8b11d0f600bfb0c093:00000001:0a4f113b:auth-int:7a3ae801f64033d060b8209ec071569c EXPECTED 6b2a26c4371e4bbac1d5e71763443f5f RECEIVED bdbeebb2da6adb6bca02599c2239e192 rlm_digest: FAILED authentication modcall[authenticate]: module "digest" returns reject for request 1 modcall: group authenticate returns reject for request 1 auth: Failed to validate the user. PS: The value of H(A2) should be 3e8ec46a56447dbb073e1171b1be0683. You verify it by running te command: echo -n "INVITE:sip:bob@biloxi.com:c1ed018b8ec4a3b170c0921f5b564e48" | md5sum That draft also confirms that H(A2) should be " 3e8ec46a56447dbb073e1171b1be0683". So, why is rlm_digest calculating it as "7a3ae801f64033d060b8209ec071569c"? Is it really a bug or am I making a some silly mistake? Any help will be greatly appreciated. bnegrao

2 3

How many Request handle by Free Radius at same time form same client.
by Manojkumar Patel 12 Dec '05

12 Dec '05

Hi All I have one question? How many Request handle by Free Radius at same time form same client. I have one Free Radius Server, One client and one other server.Client send request to radius server and then radius server will send it to other server and wait for replay for that request. After getting reply form other server radius will do some process and send replay to client. I want to implement a Radius system such as my radius server will be able to handle 5000 request form client as same time. Mean radius is able to listen 5000 request form client and then send all request to other server and wait. After Getting replay from other server , radius will send replay to client. How can I implement such requirements . Thanks & Regard Manoj Patel Mobile: +91-9881403519 ********************************************************* Disclaimer: The contents of this E-mail (including the contents of the enclosure(s) or attachment(s) if any) are privileged and confidential material of MBT and should not be disclosed to, used by or copied in any manner by anyone other than the intended addressee(s). In case you are not the desired addressee, you should delete this message and/or re-direct it to the sender. The views expressed in this E-mail message (including the enclosure(s) or attachment(s) if any) are those of the individual sender, except where the sender expressly, and with authority, states them to be the views of MBT. This e-mail message including attachment/(s), if any, is believed to be free of any virus. However, it is the responsibility of the recipient to ensure that it is virus free and MBT is not responsible for any loss or damage arising in any way from its use *********************************************************

3 2

Wiki is now live
by Alan DeKok 12 Dec '05

12 Dec '05

http://wiki.freeradius.org/ Please feel free to add documentation, configuration examples, etc. Right now it's pretty minimal and free-form. Thanks to Peter Nixon for setting it up and hosting it. Alan DeKok.

5 5

RedHat - Fedora - mod_auth_radius and Apache
by Frank Reiss 12 Dec '05

12 Dec '05

Hi, I need some help I am trying to setup FreeRadius on a Red Hate Fedora 4 system running Apache 2.0.54. I can not build the module for the source I have found at FreeRadius for Apache 2. Does any one have some tips no building the module mod_auth_radius.so for red hat systems? Frank Reiss Impeva Labs, Inc. Phone: 1-850-872-7099 COMPANY CONFIDENTIAL NOTICE This electronic mail transmission and any accompanying documents contain information belonging to the sender which may be company confidential and legally privileged. If you are not the intended recipient, any disclosure, copying, distribution or action taken in reliance on the message is strictly prohibited. If you have received this message in error, please delete it. Thank You

2 1

RE: Wiki is now live
by Alhagie Puye 12 Dec '05

12 Dec '05

Awesome!!! Thanks guys. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Alan DeKok > >Sent: December 12, 2005 9:55 AM > >To: freeradius-users(a)lists.freeradius.org > >Subject: Wiki is now live > > > > http://wiki.freeradius.org/ > > > > Please feel free to add documentation, configuration examples, etc. > >Right now it's pretty minimal and free-form. > > > > Thanks to Peter Nixon for setting it up and hosting it. > > > > Alan DeKok. > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Postgres
by leunam atebro 12 Dec '05

12 Dec '05

I am new to this freeradius server, can you give me some idea on how to authenticate freeradius in a postgres database? Also, I need sample configuration to test the server. My NAS client is CISCO(2500) with 11.3 IOS. Help is highly appreciated...... Thank you... Nuel __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

3 2

Installation FreeRadius in Solaris 8
by Rafael Roldán 12 Dec '05

12 Dec '05

Hy all, I have just joined the list. It is my first job and I am new using a UNIX System (in my case Solaris 8) so pardon my stupid questions. I am going to try to install FreeRadius: * Which version of FreeRadius do you recommend me to install? * I don´t know which software is required for the installation besides gcc compiler (SMCgcc). Any idea? Thank you very much for your help, Rafa

1 0

RE: Documentation on Group Locking using FreeRADIUS/AD/Cisco VPNConcentrator
by Alhagie Puye 12 Dec '05

12 Dec '05

No suggestions on this? This is an awesome product. No doubt!!! However I think we will benefit more with better documentation. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Alhagie Puye > >Sent: December 9, 2005 3:05 PM > >To: FreeRadius users mailing list > >Subject: Documentation on Group Locking using > >FreeRADIUS/AD/Cisco VPNConcentrator > > > >Hello all, > > > >I have spent a few bit of time trying to get > >FreeRADIUS/Active Directory/Cisco VPN Concentrator 3005 to > >lock users into group using the class attribute. Dusty Doris > >gave me a hand too. It has been tested and it works as expected. > > > >http://www.cisco.com/warp/public/471/altigagroup.html > > > >This feature is very, very neat and flexible. > > > > > >I would now like to write up a step-by-step document on how > >to make these work together. I don't have a public web site > >to host this page. > >I'm looking for suggestions on how to make it readily > >available to other users since the VPN Concentrator is > >gaining popularity. > > > > > >Is the wiki page mentioned here a while back going to > >materialize? Or should I write up a text document so that it > >could be added to doc/ directory in the source code? > > > >I would hate for someone to have to reinvent the wheel on this issue. > > > > > >Alhagie Puye - Network Engineer > >Datawave Group of Companies > >(604)295-1817 > > > > > >This message (including any attachments) is confidential, > >may be privileged and is only intended for the person to > >whom it is addressed. If you have received it by mistake > >please notify the sender by return e-mail and delete this > >message from your system. Any unauthorized use or > >dissemination of this message in whole or in part is > >strictly prohibited. E-mail communications are inherently > >vulnerable to interception by unauthorized parties and are > >susceptible to change. We will use alternate communication > >means upon request. > > > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Memory big problem
by Dimple 12 Dec '05

12 Dec '05

Hi everyone, I installed latest freeradius cvs-snapshot freeradius-snapshot-20051130 on Debian Linux 10 vs Oracle db 10 and Oracle Internet Directory (LDAP) 10. I have about 30 clients in clients.conf and about 30 connections in a second, including accounting requests. I have 8G RAM on server and freeradius daemon takes away all free memory within two day! "max_requests_per_server = 300" option did not help. I use following modules in my radiusd.conf: acct_unique, attr_rewrite, chap, checkval, detail, dictionary, expiration, files, ldap, logintime, mschap, pap, preprocess, sql, sql_oracle, sqlcounter. I understand, what the information has not enough, but somebody can will prompt, what module most likely uses for itself all memory? Excuse for my English.

3 2

skip authentication
by thgjerde 12 Dec '05

12 Dec '05

Is it possible to authorize users without authenticating them first?

2 1