- Freeradius-Users - lists.freeradius.org

Free RADIUS and ldap config
by Varun Marwah 20 Nov '05

20 Nov '05

Hi, Can anyone help me in providing a documentation as to how to configure freeradius server to fetch user access details from a specific group in lpad server on windows 2003. Also let me know the config details from ldap setting on the radius server. I was able to configure Freeradius config with PEAP. Regards Varun Marwah

1 0

Re: 802.1x machine authentication patch help
by Jamie Crawford 19 Nov '05

19 Nov '05

Hi, I finally got freeradius to strip the host/ and append the $ to the host name, but it still wont validate the workstation. I get "No logon workstation trust account (0xc0000199)" At least now it's narrowed down to the ntlm_auth command. I tried to run the command manually with different workstation accounts, and got the same error. I know I've modified the code correctly by changing: init_id_info2(&ctr.auth.id2, domain, 0x800, /* param_ctrl */ 0xdead, 0xbeef, /* LUID? */ Any suggestions??? Thanks, jamie Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/radius/proxy.conf Config: including file: /etc/radius/clients.conf Config: including file: /etc/radius/snmp.conf Config: including file: /etc/radius/eap.conf Config: including file: /etc/radius/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 256000 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth -d 10 --domain=central --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/radius/certs/cert-srv.pem" tls: certificate_file = "/etc/radius/certs/cert-srv.pem" tls: CA_file = "/etc/radius/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/etc/radius/certs/dh" tls: random_file = "/etc/radius/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/radius/huntgroups" preprocess: hints = "/etc/radius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/radius/users" files: acctusersfile = "/etc/radius/acct_users" files: preproxy_usersfile = "/etc/radius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 153.91.130.103:1958, id=225, length=149 NAS-IP-Address = 153.91.130.103 NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Framed-MTU = 1400 User-Name = "host/IS--000031176" Calling-Station-Id = "0013ce3ee800" Called-Station-Id = "00118806ad10" NAS-Identifier = "RoamAbout AP" EAP-Message = 0x0201001701686f73742f49532d2d303030303331313736 Message-Authenticator = 0xc8cf79cf435f7182a1d879819491bc89 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "host/IS--000031176", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "host/IS--000031176", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 23 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 59 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 225 to 153.91.130.103:1958 Filter-Id = "enterasys:version=1:policy=faculty_staff" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd7e3797fb8ffa169b236146b069f57b0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 153.91.130.103:1959, id=226, length=224 NAS-IP-Address = 153.91.130.103 NAS-Port-

1 0

Proposed patch for auth.c
by Alain cocconi 19 Nov '05

19 Nov '05

Hello, I've mad a small patch to the rad_authlog function in auth.c The purpose of this patch is to make a pair with the auth log message in it (Auth: login Ok ....). For this I use the Reply-Message attribute. What do you think, is it safe to use this one ? Or should I define a new one ? Thank you Here is the new function : /* * Make sure user/pass are clean * and then log them */ static int rad_authlog(const char *msg, REQUEST *request, int goodpass) { char clean_password[1024]; char clean_username[1024]; char buf[1024]; char msg_log[1024]; VALUE_PAIR *username = NULL; VALUE_PAIR *log_pair; if (!mainconfig.log_auth) { return 0; } /* * Get the correct username based on the configured value */ if (log_stripped_names == 0) { username = pairfind(request->packet->vps, PW_USER_NAME); } else { username = request->username; } /* * Clean up the username */ if (username == NULL) { strcpy(clean_username, "<no User-Name attribute>"); } else { librad_safeprint((char *)username->strvalue, username->length, clean_username, sizeof(clean_username)); } /* * Clean up the password */ if (mainconfig.log_auth_badpass || mainconfig.log_auth_goodpass) { if (!request->password) { strcpy(clean_password, "<no User-Password attribute>"); } else if (request->password->attribute == PW_CHAP_PASSWORD) { strcpy(clean_password, "<CHAP-Password>"); } else { librad_safeprint((char *)request->password->strvalue, request->password->length, clean_password, sizeof(clean_password)); } } if (goodpass) { sprintf(msg_log, "%s: [%s%s%s] (%s)", msg, clean_username, mainconfig.log_auth_goodpass ? "/" : "", mainconfig.log_auth_goodpass ? clean_password : "", auth_name(buf, sizeof(buf), request, 1)); } else { sprintf(msg_log, "%s: [%s%s%s] (%s)", msg, clean_username, mainconfig.log_auth_badpass ? "/" : "", mainconfig.log_auth_badpass ? clean_password : "", auth_name(buf, sizeof(buf), request, 1)); } radlog(L_AUTH, msg_log); log_pair = paircreate(PW_REPLY_MESSAGE, PW_TYPE_STRING); if (log_pair == NULL) { radlog(L_ERR|L_CONS, "no memory"); exit(1); } sprintf((char *)log_pair->strvalue, "%s", msg_log); log_pair->length = strlen((char *)log_pair->strvalue); pairadd(&request->reply->vps, log_pair); return 0; }

2 2

Re: 802.1x machine authentication patch help
by Jamie Crawford 18 Nov '05

18 Nov '05

Sorry for the typo, I meant to type rlm_mschap. Are there only certain files out of the /src/modules/rlm_mschap cvs snapshot that I need to copy over? Thanks, jamie >>> mgriego(a)utdallas.edu 11/18/2005 12:16:43 PM >>> Make sure you used the rlm_MSchap module from the snapshot, not the rlm_chap module. They're different. --Mike Jamie Crawford wrote: > Hi, > I am trying to get machine authentication working with freeradius. I > have patched the samba code and freeradius code. But am getting this > error when the machine tries to authenticate. I patched the rlm_chap > module by taking last nights cvs snapshot and copying over the rlm_chap > folder overwriting the contents of the same folder in the > freeradius-1.0.5 release and recompiling. I see that it is trying to > pass the username as "host/IS--000031176". I thought the updated > rlm_mschap was suppposed to strip the "host/" part of the username. Do > I need to create a realm to strip the "host/"? > Any help would be appreciated!!! > Thanks, > jamie > > > make clean > > ./configure --configure --with-raddbdir=/etc/radius > --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql > --without-rlm_ldap --without-rlm_krb5 > > make > > make install > > modcall: entering group Auth-Type for request 6 > rlm_mschap: No User-Password configured. Cannot create LM-Password. > rlm_mschap: No User-Password configured. Cannot create NT-Password. > rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with > NT-Password > radius_xlat: Running registered xlat function of module mschap for > string 'User-Name' > radius_xlat: Running registered xlat function of module mschap for > string 'Challenge' > mschap2: d3 > radius_xlat: Running registered xlat function of module mschap for > string 'NT-Response' > radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=ba9273ce0768615e > --nt-response=fd385f1011a2f799b5d62e04ba > d8bb39719fa48c3d11299e' > Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key > --username=host/IS--000031176 --challenge=ba9273ce0768615e > --nt-response=fd385f1011a2f799b5d62e04bad8bb39719fa48c3d11299e > Exec-Program output: Logon failure (0xc000006d) > Exec-Program-Wait: plaintext: Logon failure (0xc000006d) > Exec-Program: returned: 1 > rlm_mschap: External script failed. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

802.1x machine authentication patch help
by Jamie Crawford 18 Nov '05

18 Nov '05

Hi, I am trying to get machine authentication working with freeradius. I have patched the samba code and freeradius code. But am getting this error when the machine tries to authenticate. I patched the rlm_chap module by taking last nights cvs snapshot and copying over the rlm_chap folder overwriting the contents of the same folder in the freeradius-1.0.5 release and recompiling. I see that it is trying to pass the username as "host/IS--000031176". I thought the updated rlm_mschap was suppposed to strip the "host/" part of the username. Do I need to create a realm to strip the "host/"? Any help would be appreciated!!! Thanks, jamie make clean ./configure --configure --with-raddbdir=/etc/radius --with-logdir=/var/log/radius --disable-snmp --without-rlm_sql --without-rlm_ldap --without-rlm_krb5 make make install modcall: entering group Auth-Type for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/IS--000031176 with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: d3 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --domain= --request-nt-key --username=host/IS--000031176 --challenge=ba9273ce0768615e --nt-response=fd385f1011a2f799b5d62e04ba d8bb39719fa48c3d11299e' Exec-Program: /usr/bin/ntlm_auth --domain= --request-nt-key --username=host/IS--000031176 --challenge=ba9273ce0768615e --nt-response=fd385f1011a2f799b5d62e04bad8bb39719fa48c3d11299e Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed.

2 1

pam radius integration with http server
by nagaraj 18 Nov '05

18 Nov '05

hi, I have successfully integrated PAM radius client http boa server to facilitate remote authentication. However I am facing few issues. If the number of re-tries is configured to 2 and timeout value is set to 3, it takes 24 secs to timeout when radius server is not available. Http client is making 4 connections and hence it takes 24 secs(2*3*4) to timeout. In the event of server not being reachable, http server should default to local authentication that happens only after 24 secs which is not acceptable. Is there any way I can fine tune this? Has any body dealt with this kind of issue? Please reply. Thanks, Nagaraj

2 1

rlm_counter and rlm_sqlcounter configuration, help!
by Jorge Pomoro 18 Nov '05

18 Nov '05

Hi, I have a few questions: - What's the difference between rlm_counter and rlm_sqlcounter? - If I use freeradius with a mysql db, I have to use rlm_sqlcounter and NOT rlm_counter ? - The module (rlm_counter or rlm_sqlcounter) is including in freeradius or is necessary to download it? - After download and compiling the module, how I tell to the freeradius to use that module? - Is there any list of the attributes of this module? (rlm_counter or rlm_sqlcounter). I was looking on Internet but I did not find any listing. Thanks!!! Regards, Jorge

1 0

Failed to link to module 'rlm_eap'
by Nicola Iotti 18 Nov '05

18 Nov '05

Hi, I'm using Freeradius 1.0.5, I ran ./configure -disable-shared but when I start radiusd -s -X .. it stops with this message ... radiusd.conf[9] Failed to link to module 'rlm_eap': unknown error I see in past mail that other people had this problem but I can't find solution.. Ing. Nicola Iotti Network Manager mailto: nicola.iotti(a)guglielmo.biz Guglielmo S.r.l. Sede legale: Via Martiri di Minozzo, 12 Sede operativa: Via Sante Vincenzi , 2 / D 42100 Reggio Emilia ITALIA Tel.: +39-0522 - 40 63 67 Fax: +39-0522 - 54 08 16 Cell: +39-320 61 90 072 internet website: http://www.guglielmo.biz mailto:info@guglielmo.biz

1 0

sql.conf and case sensitive UserNames fr 1.0.5
by Andreas Engler 18 Nov '05

18 Nov '05

If i understand the sql.conf from freeradius-1.0.5 right, then the default queries do a case sensitive check for the UserName. The alternate queries are marked for case insensitive usernames. So i understand the default queries are for case sensitive usernames. Am i wrong in this understanding? That would be different from behavior in freeradius-1.0.4. After a few tests i would say, that the UserName is still case insensitive in the default queries for freeradius-1.0.5. Thank You Andreas

4 3

radsqlrelay queries
by Ming-Ching Tiew 18 Nov '05

18 Nov '05

Hi All, I have a configuration where I need to populate the free radius data into MS SQL database but over the wide area network. So what I do is I have a radius server writing to flat files and then I will write some scripts to compress to files and sent them over the wide area network and then on the other end, I will decompress it and then I will use 'radsqlrelay' to read the flat files and store them into MSSQL. But a quick check on the latest radius server snap shot revealed that the program 'radsqlrelay' - a perl script - only support 'mysql' and 'pg'. Any chance of it supporting unixODBC or iODBC ? What does it take to modify it to support unixODBC or iODBC ? Cheers.

2 1