- Freeradius-Users - lists.freeradius.org

Cache with proxy
by Romain GAILLEGUE 23 Nov '05

23 Nov '05

Hi, I have recently installed two freeradius servers one in server mode with MySQL authentication and an other in proxy mod. But sometime the connexion between the two servers is broken. I would like to know if it's possible to have a cache on the proxy ? Thanks Romain

2 2

problem to authenticate via peap/mschapv2
by Konne 23 Nov '05

23 Nov '05

hi i like to authenticate with my AD over peap/mschapv2... but i become following error... my clients are windowsXP SP2 with SecureW2... my test accesspoint d-link dwl900+ and freeradius 1.0.5 i dont know why they dont send the User-Password... rad_recv: Access-Request packet from host 192.168.13.10:1226, id=16, length=127 User-Name = "wuser" NAS-IP-Address = 192.168.13.10 NAS-Port = 0 Called-Station-Id = "00-80-C8-15-26-66" Calling-Station-Id = "00-0F-B5-E1-90-E6" NAS-Identifier = "numanu" Framed-MTU = 1380 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000a017775736572 Message-Authenticator = 0xf332a25b2eaf0c9e25c989631c721dc5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 3 modcall[authorize]: module "preprocess" returns ok for request 3 modcall[authorize]: module "mschap" returns noop for request 3 rlm_realm: No '@' in User-Name = "wuser", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 3 rlm_eap: EAP packet type response id 1 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 3 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'ou=wireless,dc=my,dc=dom' radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=wireless,dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(|(&(objectClass=GroupOfNames)(member=CN=wuser,OU=wireless,DC=my,DC=dom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=wuser,OU=wireless,DC=my,DC=dom)))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=wireless,dc=my,dc=dom, with filter (&(cn=wireless)(|(&(objectClass=GroupOfNames)(member=CN=wuser,OU=wireless,DC=my,DC=dom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN=wuser,OU=wirel ss,DC=my,DC=dom)))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=wuser,OU=wireless,DC=my,DC=dom, with filter (objectclass=*) rlm_ldap: performing search in CN=wireless,OU=Groups,DC=my,DC=dom, with filter (cn=wireless) rlm_ldap::ldap_groupcmp: User found in group wireless rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 218 modcall[authorize]: module "files" returns ok for request 3 rlm_ldap: - authorize rlm_ldap: performing user authorization for wuser radius_xlat: '(&(sAMAccountname=wuser)(objectClass=person))' radius_xlat: 'ou=wireless,dc=my,dc=dom' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=wireless,dc=my,dc=dom, with filter (&(sAMAccountname=wuser)(objectClass=person)) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user wuser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 3 modcall: group authorize returns updated for request 3 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 3 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 3 modcall: group Auth-Type returns invalid for request 3 auth: Failed to validate the user. Login incorrect: [wuser] (from client ap port 0 cli 00-0F-B5-E1-90-E6) Delaying request 3 for 1 seconds Finished request 3 Going to the next request --- Walking the entire request list --- Waking up in 1 sec

1 0

Attributes in access-challenge
by MINODIER David RD-RESA-LAN 23 Nov '05

23 Nov '05

Hi all, Is it "normal" that the attributes contained in the access-accept packet are also contained in the Access-Challenge packets sent by Freeradius ? Is there a way to force Freeradius to return the attributes associated to the user in the access-accept packet only ? Many thanks. David

1 0

Re: tool for testing machine authentication
by Johan Ramm-Ericson 23 Nov '05

23 Nov '05

>Date: Tue, 22 Nov 2005 14:20:29 -0500 >From: "Alan DeKok" <aland(a)ox.org> >Subject: Re: tool for testing machine authentication >To: FreeRadius users mailing list ><freeradius-users(a)lists.freeradius.org> >Message-ID: <20051122192029.228B417127(a)mail.nitros9.org> > >"Brian A. Seklecki" <lavalamp(a)spiritual-machines.org> wrote: >>It is time for someone to step up and start writing some serious >>documentation. > ><sigh> Once again, the generic "someone", meaning "not me". > >Alan DEKok. Hi, having just recently succesfully setup freeradius and being somewhat frustrated with the documentation, I felt there may be someway I could contribute to improve it. A while back there was a thread on the mailinglist to the effect of setting up a Wiki. Has this seen any progression? If not, I'll be glad to put in some effort to get this done. Also, I'm willing to pitch in on writing the documentation, however my freeradius experience is so recent that I'd probably only be able to do any good with well-defined tasks... /johan r-e

2 1

Adding a realm to username with pam_radius_auth
by Walter Goulet 23 Nov '05

23 Nov '05

Hi, Quick question regarding pam_radius_auth. Since you have to have a local account on the client machine using pam_radius_auth to authenticate ssh sessions, how would you go about adding a realm to the username portion of the authentication request? Reason I'm asking is because I'd like to use pam_radius_auth on a client machine that talks to a AAA proxy server. The proxy server needs to use the realm name to figure out which AAA server to route the request to. Can I specify this with the client-id option in the pam_radius_auth configuration file? Thanks, Walter

2 2

parsing detail files myself
by Ming-Ching Tiew 23 Nov '05

23 Nov '05

As a follow on the my requirement of reading the detail file and updating them into MSSQL database, I have written a program to parse the content of the file, which is produced by ***ONE*** single Cisco box sending data to free radius 1.04, and this is what I noticed, I need someone to tell me if this is an expected behaviour or somewhere there is something wrong :- My observations :- 1. The number attributes in a records ( ie the number of lines in a "record" ) is not consistent. I have skipped those Cisco-AVPair in the files, and this is the stats :- acount=25, value=0 acount=26, value=0 acount=27, value=0 acount=28, value=0 acount=29, value=14 acount=30, value=16 acount=31, value=7290 acount=32, value=6724 acount=33, value=0 acount=34, value=0 acount=35, value=0 In other words, in my detail file, there are 14 records which have 29 attributes, 16 records with 30 attributes, 7290 records which have 31 attributes and 6724 records with 32 attributes. Question is why don't they have the same number of attributes ? 2. Not only that, the occurances of the attributes are not consistent either :- attrib=Acct-Authentic, occurance=14043 attrib=Acct-Delay-Time, occurance=14043 attrib=Acct-Input-Octets, occurance=14043 attrib=Acct-Input-Packets, occurance=14043 attrib=Acct-Output-Octets, occurance=14043 attrib=Acct-Output-Packets, occurance=14043 attrib=Acct-Session-Time, occurance=14043 attrib=Acct-Status-Type, occurance=14043 attrib=Acct-Unique-Session-Id, occurance=14055 attrib=Called-Station-Id, occurance=14043 attrib=Calling-Station-Id, occurance=14013 attrib=Cisco-NAS-Port, occurance=6194 attrib=Client-IP-Address, occurance=14045 attrib=NAS-IP-Address, occurance=14043 attrib=NAS-Port, occurance=6194 attrib=NAS-Port-Type, occurance=6194 attrib=Service-Type, occurance=14043 attrib=Timestamp, occurance=21349 attrib=User-Name, occurance=14013 attrib=gw-final-xlated-cdn, occurance=545 attrib=gw-rxd-cdn, occurance=14043 attrib=h323-call-origin, occurance=14043 attrib=h323-call-type, occurance=14043 attrib=h323-conf-id, occurance=14043 attrib=h323-connect-time, occurance=14043 attrib=h323-disconnect-cause, occurance=14043 attrib=h323-disconnect-time, occurance=14043 attrib=h323-gw-id, occurance=14043 attrib=h323-incoming-conf-id, occurance=14043 attrib=h323-remote-address, occurance=7849 attrib=h323-setup-time, occurance=14043 attrib=h323-voice-quality, occurance=14043 attrib=session-protocol, occurance=7849 attrib=subscriber, occurance=14043 Take for example, why Cisco NAS port has such low occurances in the detail file ? Similarly why h323-remote-address has such a low occurances ? Is it a Cisco thingy or free radius did not parse what Cisco sent correctly ? Appreciate any help or comments.

2 1

Freeradius How to integrate Active Directory [AD Integration WindowsXP NTLM Tutorial]
by charles schwartz 23 Nov '05

23 Nov '05

Hi list, A lot of people on this list would like to integrate Active Directory with FreeRADIUS in order to provide a transparent user authentication login process. There are at least 2 ways to integrate AD: LDAP and NTLM. I've written a tutorial about how to do this with NTLM (winbind, ntlm_auth). The Windows supplicants are configured to work with PEAP and MSCHAPv2. You can download it from here: http://homepages.lu/charlesschwartz/radius/freeRadius_AD_tutorial.pdf Good luck! Regards, Charles Schwartz

6 8

ntlm_auth problem
by Andrew Dixon 22 Nov '05

22 Nov '05

Hi All. I have setup up a VPN server using FC4 and Poptop using freeradius for authication via a Windows DC. As far as I can see everything is setup correctly, however it fails to authicate any users when a login attempt is made. It is logging the following error message in the radius.log file: Tue Nov 22 22:01:47 2005 : Error: Exec-Program: FAILED to execute /usr/bin/ntlm_auth: Permission denied I have checked the permissions on this file and everyone has permission to execute it and if I execute it manually from the command prompt I can authicate users without issue. Anyone have any ideas what the problem could be. Thanks in advanced. Andrew.

1 1

Password Expiry policy
by Alhagie Puye 22 Nov '05

22 Nov '05

Hello all, I was wondering if anyone has implemented the feature of password expiry with Freeradius used for authenticating Cisco VPN clients. I have a Cisco PIX firewall using Freeradius as a backend (/etc/passwd). Anyway help would be greatly appreciated. Thanks in advance, Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

1 0

Freeradius + Mysql + Dialup Admin
by Mohammad K. Flaifel 22 Nov '05

22 Nov '05

Hi all, I have configured freeradius over RedHat AS4, mysql and dialup admin. I'm still now in testing phase. When testing an account with ntradping utility I get the following log on radius.log: Tue Nov 22 18:02:26 2005 : Error: rlm_sql: Failed to create the pair: Unknown value Local for attribute Auth-Type Tue Nov 22 18:02:26 2005 : Error: rlm_sql (sql): Error getting data from database Tue Nov 22 18:02:26 2005 : Auth: Login OK: [test/123] (from client flaifel port 0) On ntradping I get access accept and I can see the attributes, but is there any error in the log ?? or its normal ? Regards, Flaifel

3 2