- Freeradius-Users - lists.freeradius.org

multiple timespan entries ( Login-Time )
by Seferovic Edvin 22 Nov '05

22 Nov '05

Hi, I would like to allow my users to access the internet only between 0700 and 1430 and between 1530 and 2200 hours. So my Login-Time attribute looks like Wk0700-1430, Wk1530-2200. It is also stored in my LDAP directory... so.. my user wants to connect at 1600 and I get message "Auth: Outside allowed timespan (time allowed Wk0700-1430): username ..." why is freeradius ignoring the second entry? Or should multiple entries look else then that? Regards, Edvin Seferovic

1 0

[Fwd: Re: help needed for debugging segfault]
by Norbert Wegener 22 Nov '05

22 Nov '05

Hello Michael, as you have found the solution of how to make machine authentication work against AD using freeradius and samba: As long as there seems to be a problem with the actual cvs version of freeradius in that area, would it be possible for you, to supply a diff against 1.0.5, so that machine authentication will work? Thanks Norbert Wegener

1 0

authentication by ip address
by Mathias Dörr 22 Nov '05

22 Nov '05

Hello, I have version 1.0.4 installed and trying know to make authorization/ authentication by the remote ip address, instead of username and password. In the main distribution authorization/ authentication is based on username /password. Where is the starting point to get this implemented ? Many thanks Mathias

2 1

RE: wireless+freeradius+AD
by David Antognini 22 Nov '05

22 Nov '05

Yes I too would like some help with this. This what I am trying to do: 1. authenticate via chap (from chillispot) to freeradius, using unix shadow passwords or pam.. I followed the pam directions and it works fine for pap, but not chap.. 2. also, would like to get it to work via AD (kerberos etc.) A doc on this would be very helpful... Dave > On Mon, 21 Nov 2005, King, Michael wrote: > > > > Oh, excellent. I just joined this list hoping to query the > > > members on finding more information on doing > > > wireless+activedirectory+freeradius, > > > unfortunately I could not find any good postings, or web > > > toots/examples. > > > > Hi Robin, Welcome to the club. > > > > > > > I would need to use Microsoft IAS. Is this false ? > > Yes, That particular example used Microsoft IAS, but it is not > > required. > > > > > > > Are people > > > using Active Directory successfully ? > > Yes. Besides myself, there are many people on this list that are. > > > > > I have a linux box that > > > is currently acting as a tacacs server while authenticating > > > using winbind etc, and was hoping to make it a radius server as well. > > > > You are already 3/4 of the way there, since the trickest part of my > > freeradius setup was getting winbind to talk to activedirectory > > > > Depending on your Linux distribution, you will just have to install > > freeradius. (Some distributions like Debian require a -disable-shared) > > > > Go thru the radiusd.conf and the eap.conf files, it's clearly commented > > on what you need to configure. > > > > You'll see a section marked: > > ntlm_auth = "/path/to/ntlm_auth ........(Trimmed) > > > > You might need to modify this to: > > ntlm_auth = "/path/to/ntlm_auth --request-nt-key > > --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} > > --challenge=%{mschap:Challenge:-00} > > --nt-response=%{mschap:NT-Response:-00}" > > > > Don't hesitate to ask questions. There is a good Howto (unfortuantly, I > > don't have my bookmarks with me) but some others on the list hopefully > > will post it. > > > > Yes winbind kerberos stuff works well, and I got it previously working to > enable TAC_PLUS to do active directory authentication. > > If anyone knows the site with a good howto I would greatly apprecieate it. > > Otherwise I am chugging along. > > I have gotten the windows program NTRadPing to authenticate non CHAP with > a local UNIX account. I am not sure what fields I must enter to get > MS-CHAP to test, or if there is even a difference between CHAP and > MS-CHAP? > > Anyways I fuddled around with a bunch of different combinations and always > get this in the logfile > > Auth: Login incorrect (rlm_chap: Clear text password not available): > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FreeRadius + Windows AD Authentication
by Varun Marwah 22 Nov '05

22 Nov '05

Hi, I still can face a problem of LDAP users with Dialup access not able to authenticate through Radius Server. Attached it the Radiusd.conf file and The Logs. ldap { server = "10.91.0.33" identity = "cn=radiususer,ou=Users,ou=QMHI,dc=india,dc=quark,dc=com" password = Quark_123 basedn = "dc=india,dc=quark,dc=com" filter = "(&(samaccountname=%{user-name}))" #filter = "(SamAccountName=%u)" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # password_header = "{clear}" # # Set: dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # #password_header = "{clear}" # # Set: # password_attribute = nspmPassword # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # # edir_account_policy_check=no # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 40 timelimit = 30 net_timeout = 10 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } Logs rad_recv: Access-Request packet from host 10.91.192.115:3072, id=0, length=139 User-Name = "INDIA\\vmarwah" NAS-IP-Address = 10.91.192.115 Called-Station-Id = "0012178026ed" Calling-Station-Id = "0012f0b442e3" NAS-Identifier = "0012178026ed" NAS-Port = 21 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001201494e4449415c766d6172776168 Message-Authenticator = 0x663d5b4e1e084bb62c6db0268f187847 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "INDIA\vmarwah", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for INDIA\vmarwah radius_xlat: '(&(samaccountname=INDIA))' radius_xlat: 'dc=india,dc=quark,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.91.0.33:389, authentication 0 rlm_ldap: bind as cn=radiususer,ou=Users,ou=QMHI,dc=india,dc=quark,dc=com/Quark_123 to 10.91.0.33:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=india,dc=quark,dc=com, with filter (&(samaccountname=INDIA)) rlm_ldap: ldap_search() failed: Operations error rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request Please help me out to resolve this............. Thanks & Regards Varun Marwah CONFIDENTIALITY NOTICE This e-mail transmission and any documents, files, or previous e-mail messages appended or attached to it, may contain information that is confidential or legally privileged. If you are not the intended recipient, or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, printing, distribution, or use of the information contained or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please immediately notify the sender by telephone (+91-172-2299137) or return e-mail message (vmarwah(a)quark.com) and delete the original transmission, its attachments, and any copies without reading or saving in any manner. Thank you. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: Monday, November 21, 2005 11:45 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 7, Issue 79 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Freeradius - LDAP - Active Directory (Konne) 2. RE: wireless+freeradius+AD (King, Michael) 3. Re: 802.1x machine authentication patch help (Jamie Crawford) 4. tool for testing machine authentication (Norbert Wegener) 5. Re: tool for testing machine authentication (Konne) 6. RE: tool for testing machine authentication (Cris Boisvert) 7. Re: tool for testing machine authentication (Robin Mordasiewicz) 8. Re: tool for testing machine authentication (Konne) 9. Cache with proxy (Romain GAILLEGUE) 10. RE: tool for testing machine authentication (Robin Mordasiewicz) ---------------------------------------------------------------------- Message: 1 Date: Mon, 21 Nov 2005 13:03:52 +0100 From: Konne <bridge_stone(a)gmx.net> Subject: Re: Freeradius - LDAP - Active Directory To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4381B7A8.7020303(a)gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed hi i found the problem... *before* basedn = "dc=my,dc=dom" # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 *after, now it goes* basedn = "ou=wireless,dc=my,dc=dom" groupname_attribute = cn groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=Gr oupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = memberOf timeout = 40 timelimit = 30 net_timeout = 10 thx ------------------------------ Message: 2 Date: Mon, 21 Nov 2005 09:50:15 -0500 From: "King, Michael" <MKing(a)bridgew.edu> Subject: RE: wireless+freeradius+AD To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <EFB7B6506E9AB147BCC8EF9417E22091046723D4(a)EXCH2.campus.bridgew.edu> Content-Type: text/plain; charset="US-ASCII" > Oh, excellent. I just joined this list hoping to query the > members on finding more information on doing > wireless+activedirectory+freeradius, > unfortunately I could not find any good postings, or web > toots/examples. Hi Robin, Welcome to the club. > I would need to use Microsoft IAS. Is this false ? Yes, That particular example used Microsoft IAS, but it is not required. > Are people > using Active Directory successfully ? Yes. Besides myself, there are many people on this list that are. > I have a linux box that > is currently acting as a tacacs server while authenticating > using winbind etc, and was hoping to make it a radius server as well. You are already 3/4 of the way there, since the trickest part of my freeradius setup was getting winbind to talk to activedirectory Depending on your Linux distribution, you will just have to install freeradius. (Some distributions like Debian require a -disable-shared) Go thru the radiusd.conf and the eap.conf files, it's clearly commented on what you need to configure. You'll see a section marked: ntlm_auth = "/path/to/ntlm_auth ........(Trimmed) You might need to modify this to: ntlm_auth = "/path/to/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Don't hesitate to ask questions. There is a good Howto (unfortuantly, I don't have my bookmarks with me) but some others on the list hopefully will post it. ------------------------------ Message: 3 Date: Mon, 21 Nov 2005 08:54:11 -0600 From: "Jamie Crawford" <crawford(a)cmsu1.cmsu.edu> Subject: Re: 802.1x machine authentication patch help To: <freeradius-users(a)lists.freeradius.org>, <samba(a)lists.samba.org>, <mgriego(a)utdallas.edu> Message-ID: <s3818b53.061(a)NETMAIL.CMSU.EDU> Content-Type: text/plain; charset=US-ASCII I found my problem. From Andrew Bartlett himself "This is not supported against NT4. Only Samba 3.0.21rc1 and AD support this extra flag." To do machine authentication with freeradius, your workstation (supplicant) and samba server must be a member of a 2000/2003 domain. I had the supplicant and samba server still a member of the nt4 domain. Once I changed this, it worked great. Were still in the middle of a migration from nt4 to 2003 and all accounts still authenticate fine. Thanks for everyones help!!!!!! jamie >>> mgriego(a)utdallas.edu 11/18/2005 12:16:43 PM >>> Make sure you used the rlm_MSchap module from the snapshot, not the rlm_chap module. They're different. --Mike Jamie Crawford wrote: > Hi, > I am trying to get machine authentication working with freeradius. I > have patched the samba code and freeradius code. But am getting this > error when the machine tries to authenticate. I patched the rlm_chap > module by taking last nights cvs snapshot and copying over the rlm_chap > folder overwriting the contents of the same folder in the > freeradius-1.0.5 release and recompiling. I see that it is trying to > pass the username as "host/IS--000031176". I thought the updated > rlm_mschap was suppposed to strip the "host/" part of the username. Do > I need to create a realm to strip the "host/"? > Any help would be appreciated!!! > Thanks, > jamie > > > make clean > > ./configure --configure --with-raddbdir=/etc/radius > --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql > --without-rlm_ldap --without-rlm_krb5 > > make > > make install > > modcall: entering group Auth-Type for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with > NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'User-Name' > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: d3 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=12345ce0768615e > --nt-response=123456f1011a2f799b5d62e04ba > d8bb39719fa48c3d11299e' > Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=123453ce0768615e > --nt-response=12345f1011a2f799b5d62e04bad8bb39719fa48c3d11299e > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ------------------------------ Message: 4 Date: Mon, 21 Nov 2005 17:59:14 +0100 From: Norbert Wegener <nw(a)sbs.de> Subject: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4381FCE2.4070209(a)sbs.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Does a tool exist, that lets me test machine account authentication against an AD? Something like an equivalent to radtest? Thanks Norbert Wegener ------------------------------ Message: 5 Date: Mon, 21 Nov 2005 18:11:31 +0100 From: Konne <bridge_stone(a)gmx.net> Subject: Re: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <4381FFC3.3010701(a)gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi Norbert, i use the programm NTRadTest... on Windows machine and start freeradius with "freeradius -X", for debug bye Norbert Wegener schrieb: > Does a tool exist, that lets me test machine account authentication > against an AD? > Something like an equivalent to radtest? > Thanks > Norbert Wegener > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > ------------------------------ Message: 6 Date: Mon, 21 Nov 2005 12:15:10 -0500 From: "Cris Boisvert" <cris(a)usai.net> Subject: RE: tool for testing machine authentication To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <000901c5eebf$22103960$064da8c0@systemadmin> Content-Type: text/plain; charset="us-ascii" NTRADPING It's a windows tool that does exactly what your looking for. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Norbert Wegener Sent: Monday, November 21, 2005 11:59 AM To: FreeRadius users mailing list Subject: tool for testing machine authentication Does a tool exist, that lets me test machine account authentication against an AD? Something like an equivalent to radtest? Thanks Norbert Wegener - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.13.4/176 - Release Date: 11/20/2005 ------------------------------ Message: 7 Date: Mon, 21 Nov 2005 12:13:30 -0500 (EST) From: Robin Mordasiewicz <rmordasiewicz(a)samuelmanutech.com> Subject: Re: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <Pine.LNX.4.58.0511211212510.20094(a)smtcorms02.samuelmanutech.com> Content-Type: TEXT/PLAIN; charset=US-ASCII On Mon, 21 Nov 2005, Konne wrote: > Hi Norbert, > > i use the programm NTRadTest... on Windows machine > and start freeradius with "freeradius -X", for debug > i just did a google on NTRadTest, but found nothing. Where can I download NTRadTest ------------------------------ Message: 8 Date: Mon, 21 Nov 2005 18:23:14 +0100 From: Konne <bridge_stone(a)gmx.net> Subject: Re: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <43820282.8080104(a)gmx.net> Content-Type: text/plain; charset=ISO-8859-1; format=flowed hi sorry it was my bug it must be NTRADPING sorry Robin Mordasiewicz schrieb: >On Mon, 21 Nov 2005, Konne wrote: > > > >>Hi Norbert, >> >>i use the programm NTRadTest... on Windows machine >>and start freeradius with "freeradius -X", for debug >> >> >> >i just did a google on NTRadTest, but found nothing. Where can I download >NTRadTest >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > ------------------------------ Message: 9 Date: Mon, 21 Nov 2005 18:55:13 +0100 From: Romain GAILLEGUE <rgaillegue(a)wallix.com> Subject: Cache with proxy To: freeradius-users(a)lists.freeradius.org Message-ID: <1132595713.20382.7.camel@winxp> Content-Type: text/plain Hi, I have recently installed two freeradius servers one in server mode with MySQL authentication and an other in proxy mod. But sometime the connexion between the two servers is broken. I would like to know if it's possible to have a cache on the proxy ? Thanks Romain ------------------------------ Message: 10 Date: Mon, 21 Nov 2005 12:57:53 -0500 (EST) From: Robin Mordasiewicz <rmordasiewicz(a)samuelmanutech.com> Subject: RE: tool for testing machine authentication To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <Pine.LNX.4.58.0511211256420.20094(a)smtcorms02.samuelmanutech.com> Content-Type: TEXT/PLAIN; charset=US-ASCII On Mon, 21 Nov 2005, Cris Boisvert wrote: > NTRADPING > > It's a windows tool that does exactly what your looking for. > ok that seems to work. I can authenticate using a local unix account. Now I need to find documentation on how to connect my freeradius to AD ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 7, Issue 79 ***********************************************

1 0

help with EAP MD5 wired authentication
by Anup Parkhi 22 Nov '05

22 Nov '05

Hi, I am struggling with EAP-MD5 wired authentication for last couple of days. I checked the web and archives but to no avail. I am using XP supplicant. Tried with Funk's supplicant also but same result. Any help will be highly appreciated. Thanks Anup My users file has following towards the end # On no match, the user is denied access. a User-Password == "a" "test" User-Password == "test" "Administrator" User-Password == "pnbidm123!" aparkhi Auth-Type := System, User-Password == "aparkhi" DEFAULT Auth-Type := Accept Reply-Message = "All users are allowed, Welcome %u." Radiusd.conf has 1. modules section ... pap { encryption_scheme = crypt } # CHAP module # # To authenticate requests containing a CHAP-Password attribute. # chap { authtype = CHAP } ... $INCLUDE ${confdir}/eap.conf mschap { ... } files { ... } ... The console output of radiusd -X -s is Ready to process requests. rad_recv: Access-Request packet from host 10.11.12.107:1024, id=76, length=214 Framed-MTU = 1480 NAS-IP-Address = 10.11.12.107 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "test" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 24 NAS-Port-Type = Ethernet NAS-Port-Id = "24" Called-Station-Id = "00-0f-20-8d-04-c8" Calling-Station-Id = "00-c0-9f-0d-4a-1f" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1010" EAP-Message = 0x020200090174657374 Message-Authenticator = 0xb12214c2d6fb14f33c7cc758ccfb54b7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 76 to 10.11.12.107:1024 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x0103001604100118f4899111b27fc08900284095e5e2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x33fe6026586af730cd367983bb9ea8b6 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, length=249 Framed-MTU = 1480 NAS-IP-Address = 10.11.12.107 NAS-Identifier = "HP ProCurve Switch 2824" User-Name = "test" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 24 NAS-Port-Type = Ethernet NAS-Port-Id = "24" Called-Station-Id = "00-0f-20-8d-04-c8" Calling-Station-Id = "00-c0-9f-0d-4a-1f" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1010" State = 0x33fe6026586af730cd367983bb9ea8b6 EAP-Message = 0x0203001a04101c913399463bebf9f6dc2d0af18f0c7974657374 Message-Authenticator = 0x2592cd875d1068f5b16fe7999f451769 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 3 length 26 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 users: Matched entry DEFAULT at line 183 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap_md5: User-Password is required for EAP-MD5 authentication rlm_eap: Handler failed in EAP/md5 rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 1 modcall: group authenticate returns invalid for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 10.11.12.107:1024, id=77, length=249 Sending Access-Reject of id 77 to 10.11.12.107:1024 EAP-Message = 0x04030004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 76 with timestamp 43826690 Cleaning up request 1 ID 77 with timestamp 43826690 Nothing to do. Sleeping until we see a request.

1 0

RE: CHAP Problems
by Mitchell, Michael J 22 Nov '05

22 Nov '05

There used to be a DEFAULT stanza in the "users" configuration file that set Auth-Type := System which tells the RADIUS server to use /etc/passwd for authentication. This has caused a few issues like this in the past, though I thought it had been resolved for 1.0.5. If is still exists you may have more success if you comment that out. Hope that helps, Mike -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] Sent: Tuesday, 22 November 2005 9:13 AM To: freeradius-users(a)lists.freeradius.org Subject: CHAP Problems rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 14 modcall: group authenticate returns invalid for request 14 auth: Failed to validate the user.

2 3

CHAP Problems
by Radius 21 Nov '05

21 Nov '05

I have tried to hire someone to help with my Radius over the last 6 month's but have not been able to get it working correctly. I seem to be getting answers from my MySql database but when a CHAP request comes in, it will not authorize and ells us Auth-Type already set. The database seems to be answering fine from local dialup, but when one comes in from over our Level3 network it errors out and won't allow them to connect. I can provide a major city access number if that will help anyone for testing also. I'm also getting the run time error that it's using my realms file, but there is nothing in that file as instructed. I went to 1.0.5 and things improved a little that we started seeing the response from the MySql database but still nothing in CHAP. I'm sure I'm missing a setting somewhere because of the Auth-Type warning. If someone can actually help get this running that is well versed with FreeRadius please give me a cost or if I need to send the config files I can also do that. Here is my debug print out. Thanks Waking up in 1 seconds... rad_recv: Access-Request packet from host 216.127.146.29:61336, id=16, length=231 User-Name = "awarren(a)surftheusa.com" CHAP-Password = 0x01d84611071bc09d90932c0cb55f287648 NAS-IP-Address = 63.215.26.177 NAS-Port = 404 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 31200 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 49333 Called-Station-Id = "9283774011" Calling-Station-Id = "928-Deleted" NAS-Identifier = "nas3.2az1.Level3.net" Acct-Session-Id = "404029672" NAS-Port-Type = Async Ascend-NAS-Port-Format = 2_4_5_5 Vendor-7005-Attr-12 = 0x4469616c7570555341 Attr-102 = 0x6c33 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 14 hints: Matched other at 63 modcall[authorize]: module "preprocess" returns ok for request 14 radius_xlat: 'awarren' rlm_sql (sql): sql_set_user escaped user --> 'awarren' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 2 modcall[authorize]: module "sql" returns ok for request 14 rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP modcall[authorize]: module "chap" returns noop for request 14 rlm_realm: No '@' in User-Name = "awarren", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 14 users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 205 modcall[authorize]: module "files" returns ok for request 14 modcall: group authorize returns ok for request 14 rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 14 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 14 modcall: group authenticate returns invalid for request 14 auth: Failed to validate the user. Login incorrect: [awarren/<CHAP-Password>] (from client usa1 port 404 cli 9287572602) Delaying request 14 for 1 seconds Finished request 14 Going to the next request Sending Access-Reject of id 14 to 216.127.146.30:56516 Waking up in 2 seconds... rad_recv: Access-Request packet from host 216.127.146.30:56516, id=15, length=231 User-Name = "awarren(a)surftheusa.com" CHAP-Password = 0x0103a463bb5007b7eb6f49b6d4176c5386 NAS-IP-Address = 63.215.26.177 NAS-Port = 402 Service-Type = Framed-User Framed-Protocol = PPP Ascend-Data-Rate = 31200 Ascend-Calling-Id-Type-Of-Num = Unknown Ascend-Calling-Id-Number-Plan = Unknown Ascend-Xmit-Rate = 49333 Called-Station-Id = "9283774011" Calling-Station-Id = "928-deleted" NAS-Identifier = "nas3.2az1.Level3.net" Acct-Session-Id = "404029734" NAS-Port-Type = Async Ascend-NAS-Port-Format = 2_4_5_5 Vendor-7005-Attr-12 = 0x4469616c7570555341 Attr-102 = 0x6c33 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 hints: Matched other at 63 modcall[authorize]: module "preprocess" returns ok for request 7 radius_xlat: 'awarren' rlm_sql (sql): sql_set_user escaped user --> 'awarren' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' rlm_sql_mysql: query: SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id' rlm_sql_mysql: query: SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'awarren' ORDER BY id radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql_mysql: query: SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'awarren' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 7 rlm_chap: WARNING: Auth-Type already set. Not setting to CHAP modcall[authorize]: module "chap" returns noop for request 7 rlm_realm: No '@' in User-Name = "awarren", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 users: Matched entry DEFAULT at line 174 users: Matched entry DEFAULT at line 205 modcall[authorize]: module "files" returns ok for request 7 modcall: group authorize returns ok for request 7 rad_check_password: Found Auth-Type Local rad_check_password: Found Auth-Type System Warning: Found 2 auth-types on request for user 'awarren' auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_unix: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "unix" returns invalid for request 7 modcall: group authenticate returns invalid for request 7 auth: Failed to validate the user. Login incorrect: [awarren/<CHAP-Password>] (from client usa1 port 402 cli 9287572602) Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 2 seconds...

1 0

Problem with false errors logging in
by MHumphries＠delcomp.net 21 Nov '05

21 Nov '05

i am having problems with false errors when trying to login. for example when i try to login some clients are getting MPP Attempts and others are getting multiple login errors. however other customers are not getting these errors when connecting thourhg the same NAS box. i have tryed clearing the MYSQL Db radacct table. and that has not done it. frankle i am not an expert in freeradius and do not know where else to turn. if i recreate a new account for the customers that are having problems they can then get in but this ius not an answer just a bandaid. any help would be great thank you very much Michael J. Humphries Network Engineer Delcomp/SOFTEK 1431 N. 26th Street Escanaba, MI 49829 Phone: 906-786-3583, ext 39 Fax: 906-786-4300

1 0

Cisco Pix
by Nicholas Thompson 21 Nov '05

21 Nov '05

I am new to Freeradius and have tried to search the boards for the answer to my question. If it has been asked and answered before I am sorry just point me in the right direction. Presently we use tacacs+ to authenicate users to all of our cisco devices. I have installed freeradius and have it working as the xauth authenication for VPN users. What I would like to do is move everything over to freeradius and have a single authenication system. But what I have not been able to find is how to limit what people can log into. For instance I have users that need to hit the Pix nas for the VPN xauth but I do not what then to be able to telnet to the Pix. Is there a way to authenicate/authorize a user for one part of the nas and not another, also is there a way to use ldap for user authenication from one nas box but use the some other password db from another box? I realize the goal is to have as many people as possible authenicate to one password system but presently this is not yet an option for my company --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.

1 0