- Freeradius-Users - lists.freeradius.org

PEAP Machine Authentication
by Jérémy Cluzel 21 Oct '05

21 Oct '05

Hi, I looked in the samba 3.0.20 source code and I only found 2 calls to the "init_id_info2()" function in the "samba/source/rpc_client/cli_netlogon.c" file: In the "cli_netlogon_sam_logon()" function: 701 init_id_info2(&ctr.auth.id2, lp_workgroup(), 702 0, /* param_ctrl */ 703 0xdead, 0xbeef, /* LUID? */ 704 username, cli->clnt_name_slash, chal, 705 local_lm_response, 24, local_nt_response, 24); And in the "rpccli_netlogon_sam_network_logon()" function: 802 init_id_info2(&ctr.auth.id2, domain, 803 0, /* param_ctrl */ 804 0xdead, 0xbeef, /* LUID? */ 805 username, workstation_name_slash, (const uchar*)chal, 806 lm_response.data, lm_response.length, nt_response.data, nt_response.length); But nothing in the "cli_netlogon_sam_network_logon()" function... Regards, Jeremy

3 2

RE: recommended restart-wrapper for freeradius
by Tariq Rashid 21 Oct '05

21 Oct '05

but from the doc/supervide-radiusd.txt we have "Note: The radwatch script that used to be part of this distribution, is depreciated and SHOULD NOT BE USED." is it still safe to use? tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Nicolas Baradakis Sent: 21 October 2005 14:28 To: FreeRadius users mailing list Subject: Re: recommended restart-wrapper for freeradius Tariq Rashid wrote: > hi - we're having the freeradius 1.0.2 daemon dying occasionally for > mysterious reasons - we're still investuigating the cause. You should upgrade to 1.0.5. http://freeradius.org/security.html > running in the foreground in an infinite loop is also not ideal as > this means the daemon doesn't run in threaded mode. I don't understand. This shouldn't be a problem. > can anyone recommend a good way to monitor/restart the daemon. You could look at scripts/radwatch in the FreeRADIUS source tree. -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Malformed RADIUS packet. Invalid attribute 0
by Ramon Barquier 21 Oct '05

21 Oct '05

2 1

SV: recommended restart-wrapper for freeradius
by Svein Hansen 21 Oct '05

21 Oct '05

I have the same problem.. I made a simple shell script that runs every 5 min.(crontab) #! /bin/bash if ! [ -n "`radtest username passwd localhost 10 secret | grep TRAPEZE`" ]; then service radiusd restart fi "TRAPEZE" i s the name of the user-assigned vlan.. rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=39, length=29 Tunnel-Private-Group-Id:0 = "TRAPEZE" Modify the line/word you want to grep if authentication works... Svein >>> tariq.rashid(a)uk.easynet.net 21.10.2005 11:56 >>> hi - we're having the freeradius 1.0.2 daemon dying occasionally for mysterious reasons - we're still investuigating the cause. however - when it dies the radiusd.pid file is not removed. this causes problems for most restart-wrappers ... running in the foreground in an infinite loop is also not ideal as this means the daemon doesn't run in threaded mode. can anyone recommend a good way to monitor/restart the daemon. tariq - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

mac address auth question
by kdr akm 21 Oct '05

21 Oct '05

Hi, i'm using freeradius 1.0.5. i make a pppoe server with rp-pppoe and freeradius without mysql and i make auth by username and password all i need to add to my configuration a check if mac address and if valid accept ( a mac address authentication but without mysql ) so how can i make this think and thanks in advanced . Sorry for my bad inglish --------------------------------- Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

2 2

Freeradius and What's Up Gold Question
by Linda Pagillo 20 Oct '05

20 Oct '05

Hi everyone: I'm going to try to explain this as best I can. I'm using Freeradius 1.0.5 on a Linux Redhat 9 server. I have a network monitoring program on another computer called What's Up Gold. It is made by a company called Ipswitch. There is a setting in the WUG program that lets you monitor a radius server. This is how Ipswitch explains how it works: "What we specified for a test is an INVALID test for the userid TEST as it not encoded using the secret key. Then what we expect back is a response telling us the userid doesn't exist. The main key for making it work on Radius servers is to ensure the requesting workstation has permissions to send Radius requests. This seems to be the most common error in implementation by users. You will have to include the Monitor station (that is, the computer running WUG) in the /etc./raddb/clients file on the Radius server." I completely understand what it is saying and I have done this. Now that I have given you some background on how this works, here is my actual situation and question: I keep getting false positives on my WUG telling me that freeradius is down even though it's not. This does not happen everytime WUG sends a request to the radius. It happens at random. When I search in the radius logs it shows that the request is being sent to freeradius from WUG and the user TEST is indeed being rejected just like it's suppose to. The request is sent to the radius every 20 minutes and it makes it there every time. Now, the way I see it, it can be one of two things... The first... I have my WUG set at 5 seconds as a time out. Could freeradius, at times, be taking more than 5 seconds to respond to a sent request? if this is the case, I figure it would take my customers a few times to dial up and get authenticated at times, which is not a good thing since I work for an ISP. We haven't had any customers calling tech support about this, but still we can't rule it out just yet. The second... does freeradius lock out users after a certain amount of bad requests and if so, is there a configuration change that I can make to avoid this? I have looked all over for an answer to this question and I haven't found it, so I thought I'd post it here with the hope that someone would know. I'm sorry about the huge post. I just wanted to give enough information for the person/people that may help me with this. Thank you and I look forward to any response. By the way, I just wanted to say thanks to everyone that has helped me in the past, especially Mr. DeKok who has had much patience with me. I love your freeradius program. It's the best radius server I have used yet. Thank you for giving it to us for free and for all of your support because I do realize that you don't need to give any support if you didn't want to. You are much appreciated. Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

3 4

PAM radius client usage
by nagaraj 20 Oct '05

20 Oct '05

Hi, Does PAM radius client need shared library support to be able to work ? I could port successfully PAM radius client to Router platform which has shared library support. However I need to port the same PAM radius client to other router platforms which do not have shared library support. Has anybody had any experience using PAM radius client in an environment with no shared library support ? Please reply. Regards, Nagaraj

1 0

RE: Vendor Specific Attributes
by Guy Davies 20 Oct '05

20 Oct '05

Which VSAs are you sending in the accounting packet? Are they correctly enumerated in a dictionary file? Is the dictionary file referenced in the main dictionary file? Can you send us the accounting packet you're seeing? Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Daniel Corbe Sent: 20 October 2005 15:52 To: FreeRadius users mailing list Subject: Vendor Specific Attributes Hello, How do you get FreeRADIUS to stop ingoring VSAs? I have a box that's sending them and FreeRADIUS is simply ignoring them in rad_recv rad_recv: Accounting-Request packet from host 10.10.0.90:1068, id=0, length=58 NAS-Identifier = "acme-sd" Acct-Status-Type = Accounting-On NAS-IP-Address = 10.10.0.90 NAS-Port = 0 Acct-Session-Id = "sd1#28249" I know there are more attributes being sent than that because I can see them in the RADIUS packet. Any help/advice is appriciated. Thanks. -Daniel - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Many thanks
by Iandc Davies 20 Oct '05

20 Oct '05

To all, Well, after months of trying to get this working and integrated into our system, guess what ...... I've managed it with the help of you lovely people to finally get this working with the aide also of lots and lots of full strength coffee and severe lack of excercise. Many thanks to the likes of Alan, Emile, Nicolas and Michael to name a few. Nearly had a close call though with management thinking of dropping the project after months of work because they thought they had the original design wrong and only causing a slip of 5 weeks. I'll keep monitoring the site and boards and drop a line now and again. Seeya :-)~ Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

1 0

ntlm_auth and machine authentication (workaround)
by Roy Hooper 20 Oct '05

20 Oct '05

After spending a fair bit of time searching list archives and google results, I've managed to make ntlm_auth work for both users and machine accounts. This fix requires patching of Samba (thanks go to Mike McCauley of OSC/Radiator for the howto on the fix and to Matthew Alexander for pointing it out in samba's lists). This patch may break Samba for other purposes, as I have only tested it to verify ntlm_auth can do both user and account challenge/response authentication for MSCHAPv2 for PEAP. The second part to the fix is an ntlm_auth wrapper that deals with DOMAIN\\user format usernames and translates WinXP "host/" machine names to NT machine usernames. ---BEGIN /usr/local/bin/ntlm_auth_hack--- #!/usr/bin/perl my $ARGS = join(" ",@ARGV); if ($ARGS =~ m{--username=host/\S+}) { $ARGS =~ s{--username=host/([^\s.]+)\S+}{--username $1\$}; } else { $ARGS =~ s{--username=([^\\]+)\\\\}{--domain=$1 --username=}; } system("/usr/local/bin/ntlm_auth", split(" ", $ARGS)); ---END /usr/local/bin/ntlm_auth_hack--- And so the example is somewhere other than my head, The following returns the appropriate attributes to a Cisco AP to assign a particular vlan, in this case, vlan-266, when doing EAP. # Assign a VLAN to any user from this station DEFAULT Calling-Station-Id == "1234.1234.1234" Framed-Type = Framed, Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802, Tunnel-Private-Group-ID:1 = 100 And another fun one: # Assign a particular VLAN to a user from a particular station DOMAIN\\user Calling-Station-Id == "1234.1234.1234" Framed-Type = Framed, Tunnel-Type:1 = VLAN, Tunnel-Medium-Type:1 = IEEE-802, Tunnel-Private-Group-ID:1 = 200 Naturally the DEFAULT should come after the specific user match. begin 644 cli_netlogon.c.patch M+2TM(&]R:6<O<V%M8F$M,RXP+C(P8B]S;W5R8V4O<G!C7V-L:65N="]C;&E? M;F5T;&]G;VXN8PE7960(a)3V-T(#$R(#$W.C`S.C(S(#(P,#4**RLK('!A=&-H M960O<V%M8F$M,RXP+C(P8B]S;W5R8V4O<G!C7V-L:65N="]C;&E?;F5T;&]G M;VXN8PE4:'4@3V-T(#(P(#`R.C,Y.C(W(#(P,#4*0$`@+38Y.2PW("LV.3DL M-R!`0`H@("`@("`@("`@("`@("`@(%--0DY496YC<GEP="AP87-S=V]R9"P@ M8VAA;"P@;&]C86Q?;G1?<F5S<&]N<V4I.PH@"B`@("`@("`@("`@("`@("`@ M:6YI=%]I9%]I;F9O,B@F8W1R+F%U=&@N:60R+"!L<%]W;W)K9W)O=7`H*2P@ M"BT@("`@("`@("`@("`@("`@("`@("`@("`@("`@("`P+"`O*B!P87)A;5]C M=')L("HO"BL@("`@("`@("`@("`@("`@("`@("`@("`@("`@("`P>#@P,"P@ M+RH@<&%R86U?8W1R;"`J+PH@("`@("`@("`@("`@("`@("`@("`@("`@("`@ M("`@,'AD96%D+"`P>&)E968L("\J($Q5240_("HO"B`@("`@("`@("`@("`@ M("`@("`@("`@("`@("`@("!U<V5R;F%M92P@8VQI+3YC;&YT7VYA;65?<VQA M<V@L(&-H86PL"B`@("`@("`@("`@("`@("`@("`@("`@("`@("`@("!L;V-A M;%]L;5]R97-P;VYS92P@,C0L(&QO8V%L7VYT7W)E<W!O;G-E+"`R-"D["D!` M("TX,#`L-R`K.#`P+#<@0$`*("`@("`@("`@8W1R+G-W:71C:%]V86QU92`] M($Y%5%],3T=/3E]465!%.PH@"B`):6YI=%]I9%]I;F9O,B@F8W1R+F%U=&@N M:60R+"!D;VUA:6XL"BT)"2`@("`@(#`L("\J('!A<F%M7V-T<FP@*B\**PD) M("`@("`@,'@X,#`L("\J('!A<F%M7V-T<FP@*B\*(`D)("`@("`@,'AD96%D M+"`P>&)E968L("\J($Q5240_("HO"B`)"2`@("`@('5S97)N86UE+"!W;W)K M<W1A=&EO;E]N86UE7W-L87-H+"`H8V]N<W0@=6-H87(J*6-H86PL"B`)"2`@ M("`@(&QM7W)E<W!O;G-E+F1A=&$L(&QM7W)E<W!O;G-E+FQE;F=T:"P@;G1? D<F5S<&]N<V4N9&%T82P@;G1?<F5S<&]N<V4N;&5N9W1H*3L* ` end

3 2