- Freeradius-Users - lists.freeradius.org

Prefix Usage and issues
by Curt LeCaptain 19 Oct '05

19 Oct '05

Yet another cropped up issue for me. I've got this in my users file: DEFAULT Prefix == "W", Auth-Type = "System" Service-Type == 0, Session-Timeout = 10, Fall-Through = No It's used by a perl script to do authentication. When the system attempts an authentication, I get a login failed for the username Wusername. Example: Mon Oct 17 11:07:43 2005 : Auth: Login incorrect: [Wusername/userpass] (from client webserver port 0) Any thoughts on something I could be doing wrong with the prefix? Thanks, Curt LeCaptain

6 7

newbie question on using digest authentication with postgresql
by Horton, Dave 19 Oct '05

19 Oct '05

I'm a newbie with freeradius (understand radius protocol though), and I'm struggling with some basics of configuration re: digest authentication and use of postgresql for subscriber database. I haven't found much documentation so far on the freeradius site about authentication using sql (besides the basic install of the schema), and I feel I'm probably missing something/somewhere, so please feel free to point me towards docs if this is covered somewhere. Anyways, my simple attempt at digest authentication is currently failing. Here is what I have done: 1. Provisioned the following simple data in my postgresql radius database (this is the area where I'm most in the dark, any pointers to information on the purpose and use of each of these tables would be useful): radius=# select * from radreply ; id | username | attribute | op | value ----+----------+--------------+----+------- 1 | dhorton | Idle-Timeout | == | 60 (1 row) radius=# select * from radcheck ; id | username | attribute | op | value ----+----------+-----------+----+------- 1 | dhorton | Password | == | 0276 (1 row) radius=# select * from usergroup ; id | username | groupname ----+----------+----------- 2 | dhorton | pactolus (1 row) 2. Edited my radiusd.conf file to uncomment the 'digest' lines in the 'authorize' and 'authenticate' sections. 3. Send an access-request message that looks like this (here is debug output from radiusd): rad_recv: Access-Request packet from host 10.10.105.11:1812, id=1, length=579 User-Name = "dhorton" User-Password = "NULL" NAS-IP-Address = 10.10.105.11 NAS-Port = 0 Cisco-AVPair = "h323-incoming-conf-id=664A92F5 C5305B22 A8C5F339 06C5803D" h323-conf-id = "h323-conf-id=68F37347 92CF847A 3676C449 5361F60E" Cisco-NAS-Port = "0:0" Cisco-AVPair = "sip-hdr=From: Dave Horton <sip:dhorton@voip.dogan.com>" Cisco-AVPair = "sip-hdr=Authorization: Digest username="dhorton",realm="voip.dogan.com",nonce="3e320b5b5dbd4a37cb7168b f607455b5",response="325d8976711bc76a7c1a25b53c8b0cf9",uri="sip:voip.dog an.com"" Acct-Status-Type = Start NAS-Port-Type = Virtual Digest-Response = "325d8976711bc76a7c1a25b53c8b0cf9" Digest-Attributes = 0x0110766f69702e646f67616e2e636f6d02223365333230623562356462643461333763 62373136386266363037343535623504147369703a766f69702e646f67616e2e636f6d03 0a52454749535445520a0964686f72746f6e Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/10.10.105.11/auth-detail-20051019' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m% d expands to /usr/local/var/log/radius/radacct/10.10.105.11/auth-detail-20051019 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_digest: Converting Digest-Attributes to something sane... Digest-Realm = "voip.dogan.com" Digest-Nonce = "3e320b5b5dbd4a37cb7168bf607455b5" Digest-URI = "sip:voip.dogan.com" Digest-Method = "REGISTER" Digest-User-Name = "dhorton" rlm_digest: Adding Auth-Type = DIGEST modcall[authorize]: module "digest" returns ok for request 0 rlm_realm: No '@' in User-Name = "dhorton", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'dhorton' rlm_sql (sql): sql_set_user escaped user --> 'dhorton' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'dhorton' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'dhorton' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'dhorton' ??ORDER BY id' rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'dhorton' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'dhorton' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): No matching entry in the database for request from user [dhorton] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type DIGEST auth: type "digest" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_digest: Configuration item "User-Password" is required for authentication. modcall[authenticate]: module "digest" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Login incorrect: [dhorton/NULL] (from client pcs-network port 0)

2 1

PEAP Machine Authentication
by Michael Griego 19 Oct '05

19 Oct '05

I'm happy to announce that 802.1x/PEAP machine authentication with the Windows built in supplicant is now possible using FreeRADIUS. In the past, machine authentication was only possible by proxying machine authentication requests to another RADIUS server capable of handling them, such as IAS. FreeRADIUS, along with some updates to Samba, is now capable of handling these authentications internally. Here's a synopsis on how to get this working right now: The first item required to get machine authentication is a patch to the Samba source. This patch sets a set of flags used when sending the authentication request to the domain such that workstation logons are allowed. I expect that the Samba team will include the ability to set these flags at runtime in a future release. You can find the details of the patching required at http://www.open.com.au/archives/radiator/2005-10/msg00037.html. It's a very simple patch to the samba/source/rpc_client/cli_netlogon.c file. In the cli_netlogon_sam_network_logon() function (be sure not to edit the cli_netlogon_sam_logon() function by mistake), there is a call to the init_id_info2() function. The param_ctrl flags parameter to this function sets all flags to 0. In order to enable machine authentication, they should be set to 0x800 (MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT). If you change this and recompile/reinstall Samba, your ntlm_auth command will now be able to handle machine authentications. As noted above, it is expected that these flags will become manipulable at runtime in some future release of Samba, so this fix is for those who need this functionality now. Next, when using ntlm_auth, the User-Name received in the request has to be rewritten. Windows supplicants send the machine name in the form of host/fully.qualified.domain.name. When you provide the user name to ntlm_auth, it must be in the form of machineshortname$, the SAM account form of the name. I have updated the rlm_mschap module so that a call to the xlat function mschap:User-Name will now properly format the machine name as above as well as format usernames. In addition, a call to the xlat function mschap:NT-Domain will also grab the domain name from the host/ formatted username. Therefore, with this updated code, the only change to the configuration in the radiusd.conf is to ensure that your ntlm_auth line looks like the following: ntlm_auth = "/path/to/ntlm_auth --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain:-DEFAULTDOMAIN} The updated rlm_mschap module is available in CVS now. You can grab the nightly CVS snapshot (the usual caveat of unstable code applies). In addition, for those familiar with CVS, it is available in the release_1_0 branch for use with the stable source tree. And, finally, it will be included in the next stable release of FreeRADIUS. --Mike

1 0

AW: OT: Freeradius and Redback SMS 1800
by Dominik Sennfelder 19 Oct '05

19 Oct '05

> > On Tue, Oct 18, 2005 at 05:11:54PM +0200, Dominik Sennfelder wrote: > > We are using Freeradius with two Redback SMS 1800 > > Authorizing and accounting works with mysql. > > > > Is it possible to log the IP-Address at > > the beginging of the accounting? > > see AOS Command Reference, AAA and Radius commands. > > aaa delay-start-record > > Oliver. > Great Thats it. Thank you Dominik

1 0

i need help to auth by using mac address in freeradius
by kdr akm 19 Oct '05

19 Oct '05

hi i made a pppoe-server with freeradius and i success to make it without mysql all going fine but i need to get authentication by mac address to my users ( username and password and mac address ) i need help guys thanks in advanced --------------------------------- Yahoo! Music Unlimited - Access over 1 million songs. Try it free.

1 0

specific realm accounting
by Chuck 19 Oct '05

19 Oct '05

Is there a way to have only 2 particular realms get entered into our local accounting database? We proxy for 34 realms and presently all their data as well as our 2 local auth realms are being posted into accounting which makes our accounting database really huge. I want to pass any accounting data I receive on to the downstream realms without keeping a record of it locally. I only want our 2 local domains to be in the accounting table. As long as all info we receive is passed along, we hae no need or desire to maintain data on any of our proxied realms other than the auth lines in radius.log. Is there a way to do this? We use mysql but soon will be converting to postgresql. -- Chuck

2 1

OT: Freeradius and Redback SMS 1800
by Dominik Sennfelder 19 Oct '05

19 Oct '05

Hello We are using Freeradius with two Redback SMS 1800 Authorizing and accounting works with mysql. Is it possible to log the IP-Address at the beginging of the accounting? I know that the readback is the device which has to be configured but perhaps sombody had a similar problem. Greets Dominik

2 1

Is rlm_perl a viable solution for production environments yet?
by Tim O'Donovan 18 Oct '05

18 Oct '05

Hi, I'm considering writing some Perl for use with the rlm_perl module, but before I do I need to know whether the module is ready for use in a production environment. Has anyone had any experience (both positive and negative) with rlm_perl, performance wise, that they could share with me to help my decision? Thanks. Kind regards, Tim O'Donovan

2 2

Ippool mysql....again :)
by Mark Novitzkas 18 Oct '05

18 Oct '05

Hi all Finally have ippool working but it seems my setting are messed-up somewhere Radiusd.conf ------------- ippool main_pool { range-start = x.x.x.x range-stop = x.x.x.x netmask = 255.255.255.0 cache-size = 800 session-db = /home/radius/db.ippool ip-index = /home/radius/db.ipindex override = yes Radius Db ---------- Radcheck mysql> select * from radcheck; +----+----------+---------------+----+---------------------------------- --+ | id | UserName | Attribute | op | Value | +----+----------+---------------+----+---------------------------------- --+ | 1 | tester | Pool-Name | == | main_pool | I get an access-reject message when sending a radtest? radtest tester <pass> 127.0.0.1 0 <secret> Does radcheck need the Pool-Name attribute? Where do you place the password for user tester in the sql DB? Thanks guys Mark Notice This email is intended for the addressee only and may contain legally privileged and/or confidential information. If you have received this email in error and are not the intended recipient, you are hereby informed that you are not entitled to read, broadcast, distribute or in any manner whatsoever use the contents of this email or any attachments thereto. You are requested to please notify Psitek that you have received the email and then delete it. Unless clearly stated otherwise, the content and sentiments expressed in this email or any attachments thereto are those of the sender and not of Psitek (Proprietary) Limited. Psitek does not accept liability for any damages, loss or expense of any nature whatsoever arising (a) out of or in connection with the email or any attachments thereto and/or (b) from any act or omission by the recipient relying upon the content of the email or attachments. Psitek further disclaims liability for any damages caused by computer and/or software viruses. Should this email contain the terms of a contract, no binding agreement will result until such time as a written (hardcopy) document is signed on behalf of Psitek.

1 0

dialup admin
by Madhvi Gokool 18 Oct '05

18 Oct '05

Hi Documentation of dialup admin says it works with a database. My current users file is plain text ( I manually add users and their attributes). can dialup admin be tweaked to work with this users file? Or is there a script that we can use to facilitate the administration of the users file. Regards Madhvi

2 1