- Freeradius-Users - lists.freeradius.org

FreeRadius Logging Abilities
by Chuck 04 Oct '05

04 Oct '05

I am totally lost here. I am getting this type entry in my radius.log listing the radius server contacting us. Sat Oct 1 12:05:07 2005 : Auth: Login OK: [user@domain] (from client upstream-radius5 port 7490 cli 2199340456) and I have a lot of useless (to us) account log directories in the radacct logging directory. What I want to do is lower the amount of detail in the accounting logs to a single file that can be rotated or just do away with it. We run 90% as a proxy server anyway, and the accounting tables in the database provide us with any reports we need. What i want to see in radius.log is an entry like this showing the nas-ip host/node name instead of radius client: Fri Sep 30 20:04:37 2005: Auth: Login OK: [user@domain] (from nas nas5.tempe1.az.us.da.qwest.net/S7428) socket 0 (0 sec) I have searched through the examples and text in every config file in the /etc/raddb and cannot find a way to accomplish this. The FreeRadius logging options look quite powerful so I am assuming there is a reasonably easy way of doing this that I am missing and/or not comprehending. I tried commenting out the detail area to eliminate accounting logs, but then radius complained bitterly about not having a detail section. Any clues how to accomplish this goal? The wanted format for radius.log is an absolute must. The entire log is useless to us showing the contacting radius client. We need to know the network node they dialed into. -- Chuck

2 2

radgroup mysql question
by John (yt) Hogenmiller 04 Oct '05

04 Oct '05

Hi, About two years ago I setup a freeradius server (as well as integration with their accounting system) with a mysql backend. Now, I need to make a change and I'm looking at either rewriting the programs or (hopefully) just making some changes to the configuration/database data. Basically I added a group to radgroupreply with all the attributes that a normal, authorized user would need. I added the user default to that group and enabled default_user_profile in sql.conf. Additionally, we created a "suspend" group that gave an Access-Reject. Anyone suspended by the accounting program is added to this group. Later, we made a change... suspended accounts were allowed to connect (Access-Accept), but they were given specific Ascend-Data-Filter packets in order to restrict them to one server that allows them to make payments. The default dialin group also has Ascend-Data-Filter packets (to restrict access to port 25 and 119 beyond our network). The problem with this setup is that when a "suspend" user authenticates to the freeradius server, it first grabs both the attributes associated with the 'suspend' group AND the 'dialin' group. This means that we are sending two blocks of Ascend-Data-Filter attributes. With most of the equipment, this didn't cause a problem.. it took the first group and ignored the rest. However, we have recently started using some equipment that is reading both and ends up allowing suspended users' traffic out. So, that is the situation. Basically, without individually putting every current user into the dialin group (which involves a major software re-write), is there a way to define a set of reply packets that every (valid authenticated) user will receive, unless they are in a group. Or, to ask that a different way, people in the group "suspend" should receive only the reply attributes associated with the GroupName "suspend". Everyone else should get a different, default set of attributes (wether defined in radgroupreply or radreply makes no difference to me). Thanks in advance for any help that you can give, John -- YourTech, LLC - http://yourtech.us/ (this account is used for mailing lists)

1 0

RE: cannot return access accept from proxy to client
by Wilson Lie 04 Oct '05

04 Oct '05

Dear Alan, Thanks for your help. Maybe I should ask the question in another way. Host B acted as both proxy/server. for realm A , -> proxy to other server for realm B -> process locally When the auth-accept is returned to proxy ( Host B) , it will process section [post-auth] in radiusd.conf no matter what host B receive. Q1. Any method such that host B won't goes into [post-auth] when it is receiving result from another server ? Q2. In case host B cannot bypass [post-auth] when receiving result from another server, how can I define multiple sql section in [post-auth] ? As I cannot find any rule that I can set in [post-auth] such that it can go to [sql1] for realm A and [sql2] for realm B Many thanks! -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Friday, September 23, 2005 1:10 AM To: FreeRadius users mailing list Subject: Re: cannot return access accept from proxy to client "Wilson Lie" <wilson.lie(a)ithlgroup.com> wrote: > But I'm afraid that you misunderstood the question. I understood it fine. My response should have been clear. > Yes, for normal Access-Accept if Host B act as server , the > access-accept can be sent back to client The problem has NOTHING to do with host B or Access-Accept. > But when access-accept is sent from host A -> Host B , from host B debug log, it can be seen that > as user-name is missing, the [sql] module cannot be run , No, the SQL module *is* run, but it is telling you that the query YOU CONFIGURED did not return any matches. > freeradius return failed in [sql] > where [sql] refers to post-auth query in this case and the statement contains "User-name" attribute > (e.g. update xxx set xxx where username=attribute ) The post-auth query is updating the SQL database with data from the Access-Request packet. If that Access-Request packet does not contain a User-name, then the SQL query will not work. This has nothing to do with Access-Accept, or host A, or host B. > So I would like to ask if any special handling by freeradius in this case ? I can't parse that sentence. > As the post-auth [sql] section is configured in sql.conf and it should be same because only one post-auth query > can be configured. You can configure multiple SQL modules, where one has a postauth_query and the other does not. See the documentation. > Or "user-name" attribute can never be included in the post-auth query in this case ? ( i.e. Host B acts as both proxy and auth-server) It's up to YOU to decide that. That's why the queries are configurable. If the queries aren't doing what you want, edit them. If the server isn't doing what you want, edit the configuration files. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________ (c) 2005 Interactive Technology Holdings Limited Group. All rights reserved. CONFIDENTIALITY: This communication and any attachment(s) is intended solely for the person or organisation to which it is addressed and it may be confidential. This communication may contain confidential or legally privileged material and may not be copied, redistributed or published (in whole or in part) without our prior written consent. This communication may have been intercepted, partially destroyed, arrive late, incomplete or contain viruses and no liability is accepted by any member of the Interactive Technology Holdings Limited Group as a result. If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you must not copy, disclose, distribute or take any action in reliance on it. If you have received this communication in error, please immediately reply and highlight the error to the sender immediately and destroy the original from your computer.

2 1

rlm_sql (sql): Unsupported Acct-Status-Type = 15
by Cameron Beattie 04 Oct '05

04 Oct '05

I am using FreeRadius 1.0.5. I have configured accounting with sql. When I run radiusd -X and watch what happens when I try to pass a record to FreeRadius, I see the following: rlm_sql (sql): Unsupported Acct-Status-Type = 15 modcall[accounting]: module "sql" returns noop for request 1 vi /usr/local/etc/raddb/dictionary $INCLUDE /usr/local/share/freeradius/dictionary $INCLUDE /usr/local/etc/ser/dictionary.ser vi /usr/local/share/freeradius/dictionary <snip> VALUE Acct-Status-Type Failed 15 </snip> vi /usr/local/etc/ser/dictionary.ser <snip> VALUE Acct-Status-Type Failed 15 # RFC2866, acc </snip> I've tried removing $INCLUDE /usr/local/etc/ser/dictionary.ser from /usr/local/etc/raddb/dictionary but the problem persists. I'm sure there's a configuration step I've missed. Could anyone suggest some other things to check? Thanks Cameron

2 1

Re: working rlm_perl example
by Abdul Lateef 03 Oct '05

03 Oct '05

I did the following configuration and it is working well with me. Try it, and let me it is working or not. user file: > ------------------- > DEFAULT Auth-Type := perl > ------------------- > > radiusd.conf > --------------------- > modules area: > > perl { > > module = /usr/local/etc/example.pl > func_accounting = accounting > func_authenticate = authenticate > func_authorize = authorize > func_preacct = preacct > func_checksimul = checksimul > func_xlat = xlat > } > > > > authorize { > > preprocess > chap > suffix > perl file > } > > > authenticate { > > Auth-Type Perl { > perl > } > } -------- Yours, Abdul Lateef Computer Programmer HATIF COM Mob: +974 - 5405022 Tel: +974 - 4883068 ICQ: 276994704 YM!: abdul_zu Fax: +974 - 4883063 Doha Qatar http://www.hatif.com __________________________________ Yahoo! Mail - PC Magazine Editors' Choice 2005 http://mail.yahoo.com

3 2

RE: Proxy of accounting message (Ashwin Gobind)
by Ashwin Gobind 03 Oct '05

03 Oct '05

Radiator required a valid Authenticator to be part of the Accouning Request. I am proxying from freeradius to radiator. How can this be resolved ? -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 30 September 2005 06:12 PM To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 5, Issue 103 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Proxy of accounting message (Ashwin Gobind) 2. EAP-PEAP-MSCHAPv2: use_tunneled_reply = yes (Bjarni Hardarson) 3. Re: freeradius and MS SQL -- anyone got it working? (Duane Cox) 4. Re: Expose RADIUS packet's identifier (James J J Hooper) 5. Re: Segmentation Fault - 1.0.5 (Alan DeKok) 6. Re: SSL3_GET_CLIENT_KEY_EXCHANGE (Alan DeKok) 7. Re: freeradius and MS SQL -- anyone got it working? (Alan DeKok) 8. Re: Proxy of accounting message (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Fri, 30 Sep 2005 14:39:18 +0200 From: "Ashwin Gobind" <Ashwin.Gobind(a)vodacom.co.za> Subject: RE: Proxy of accounting message To: <freeradius-users(a)lists.freeradius.org> Message-ID: <753BF83740BB6C48BF8A15B5C61C88470BC3B149(a)zamdc02100.vodacom.corp> Content-Type: text/plain; charset="us-ascii" Thanks nick. However when I proxy the message, the message-authenticator field has an <INVAILID TOKEN> (see trace below). Why is this Sending Accounting-Request of id 1 to 10.113.46.170:1813 Acct-Status-Type = Start Service-Type = Framed-User Called-Station-Id = "vlive" Framed-Protocol = GPRS-PDP-Context Framed-Protocol = GPRS-PDP-Context Acct-Delay-Time = 5 Calling-Station-Id = "27829800729" NAS-Identifier = "GMC-GGSN0-13-2" Acct-Session-Id = "20050529" User-Name = "27829800729" User-Name = "27829800729" NAS-Port = 6000 NAS-Port-Type = Virtual NAS-IP-Address = 10.111.14.46 Message-Authenticator <INVALID-TOKEN> 0x00000000000000000000000000000000 Proxy-State = 0x30 "This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx " ------------------------------ Message: 2 Date: Fri, 30 Sep 2005 14:51:25 +0200 From: "Bjarni Hardarson" <freeradius(a)hardarson.se> Subject: EAP-PEAP-MSCHAPv2: use_tunneled_reply = yes To: <freeradius-users(a)lists.freeradius.org> Message-ID: <000a01c5c5bd$af45b880$6400a8c0@client> Content-Type: text/plain; charset="us-ascii" Hi all, I'm using FreeRADIUS with Cisco 1200 Series Access points for dynamic VLAN assignment. When i set use_tunneled_reply = yes for PEAP i get an Access-Challenge with the correct attributes but the final Access-Accept has no attributes and the User-Name is the anonymous one from the outer tunnel. This username is then used by the AP for accounting. Is this by design or is my configuration wrong? Partial debug, Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 24 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 24 modcall: group authenticate returns ok for request 24 PEAP: Got tunneled reply RADIUS code 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x818f508 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS modcall[authenticate]: module "eap" returns handled for request 24 modcall: group authenticate returns handled for request 24 Sending Access-Challenge of id 8 to 127.0.0.1:33229 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Message-Authenticator = 0x00000000000000000000000000000000 EAP-Message = 0x010900501900170301002079fdf7026cf88ffd8c978e4fb62290b4d4f4a1596c767f55 7ada bdaf51b7437d17030100209a1de8e9b88b4654d03b0754d4f5a04887b57b329c94a6494e f84d 2bf74f294c State = 0x3c86d1f16a6312263ae7a01dbfc81a28 Finished request 24 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 127.0.0.1:33229, id=9, length=205 User-Name = "anon" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "00-00-00-00-00-02" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0209005019001703010020f8f585176e2220ba00055d66cd73494a9539cce8d52da81f f067 f5835fd4de1117030100207461f938bb9af8c154f926ab2eb5653392cb1ebb02782ac58c 3b6c ca8566fbdd State = 0x3c86d1f16a6312263ae7a01dbfc81a28 Message-Authenticator = 0x830975610af464574e583a2a9240068d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 25 modcall[authorize]: module "preprocess" returns ok for request 25 radius_xlat: '/var/log/radiusd/radiusd-20050930' rlm_detail: /var/log/radiusd/radiusd-%Y%m%d expands to /var/log/radiusd/radiusd-20050930 modcall[authorize]: module "auth_log" returns ok for request 25 modcall[authorize]: module "chap" returns noop for request 25 modcall[authorize]: module "mschap" returns noop for request 25 rlm_realm: No '@' in User-Name = "anon", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 25 rlm_eap: EAP packet type response id 9 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 25 modcall[authorize]: module "files" returns notfound for request 25 modcall: group authorize returns updated for request 25 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 25 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 25 modcall: group authenticate returns ok for request 25 Sending Access-Accept of id 9 to 127.0.0.1:33229 MS-MPPE-Recv-Key = 0x73f9e4f3cc50836d0d52db55ddceb6afb7fea6e50313380873101fe245e6532d MS-MPPE-Send-Key = 0xcbf30f484d74cc947dcd0ea4fb49f7d94adb6be677e23d4edae3a22d136ad3b9 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anon" Finished request 25 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 16 ID 0 with timestamp 433d25b6 Cleaning up request 17 ID 1 with timestamp 433d25b6 Cleaning up request 18 ID 2 with timestamp 433d25b6 Cleaning up request 19 ID 3 with timestamp 433d25b6 Cleaning up request 20 ID 4 with timestamp 433d25b6 Cleaning up request 21 ID 5 with timestamp 433d25b6 Cleaning up request 22 ID 6 with timestamp 433d25b6 Cleaning up request 23 ID 7 with timestamp 433d25b6 Cleaning up request 24 ID 8 with timestamp 433d25b6 Cleaning up request 25 ID 9 with timestamp 433d25b6 Nothing to do. Sleeping until we see a request. --------------------------------------------------- When i use TTLS everything works perfectly. If i set use_tunneled_reply = no for TTLS the outer tunnel identity is used in the Access-Accept and no attributes are returned. Partial debug, Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 7 modcall: group authenticate returns ok for request 7 TTLS: Got tunneled reply RADIUS code 2 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler TTLS: Freeing handler for user radtes modcall[authenticate]: module "eap" returns ok for request 7 modcall: group authenticate returns ok for request 7 Sending Access-Accept of id 7 to 127.0.0.1:33227 User-Name = "radtest" Tunnel-Private-Group-Id:0 = "310" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Message-Authenticator = 0x00000000000000000000000000000000 MS-MPPE-Recv-Key = 0xf250fa51ea382aef2f2ea5ebaab8596fa822cf6788ccd2782fe2e7df98cd06aa MS-MPPE-Send-Key = 0xca164c1041c8b439c99b13505ba04aaf48cabf6802df8c92738a2c12349b4be2 EAP-Message = 0x03070004 Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 433d1f58 Cleaning up request 1 ID 1 with timestamp 433d1f58 Cleaning up request 2 ID 2 with timestamp 433d1f58 Cleaning up request 3 ID 3 with timestamp 433d1f58 Cleaning up request 4 ID 4 with timestamp 433d1f58 Cleaning up request 5 ID 5 with timestamp 433d1f58 Cleaning up request 6 ID 6 with timestamp 433d1f58 Cleaning up request 7 ID 7 with timestamp 433d1f58 Nothing to do. Sleeping until we see a request. raddb/eap.conf eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = ******** private_key_file = ${raddbdir}/certs/srv_key.pem certificate_file = ${raddbdir}/certs/srv_cert.pem CA_file = ${raddbdir}/certs/demoCA/prv.pem dh_file = ${raddbdir}/certs/dh random_file = /dev/urandom } ttls { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = yes } mschapv2 { } } raddb/users DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name = "%{User-Name}", Fall-Through = Yes DEFAULT Huntgroup-name == "LAN", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := LAN DEFAULT Huntgroup-name == "AIR", FreeRADIUS-Proxied-To == 127.0.0.1, Autz-Type := AIR ------------------------------ Message: 3 Date: Fri, 30 Sep 2005 08:28:39 -0500 From: "Duane Cox" <duanec(a)mail.illicom.net> Subject: Re: freeradius and MS SQL -- anyone got it working? To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <006101c5c5c2$ded92ff0$7c01a8c0@COMPUTER> Content-Type: text/plain; format=flowed; charset="utf-8"; reply-type=original There are a few qwerks with getting FreeRadius to work with MSSQL. First thing, the FreeTDS files have been removed (more like abandonded) from FreeRadius. If you really want to call FreeTDS direclty, you will have to download the files from the "attic". But more than that you will also have to update the files as they do not currently compile properly, they are a bit old. I would suggest to go with unixodbc or iodbc, even though using FreeTDS is IMHO the best way, it's not supported. Second, in order to get MSSQL to work with the current version of FreeRadius 1.0.5, you will need to install either unixodbc or iodbc. I chose unixodbc; and in doing so it requires FreeTDS. So install both FreeTDS and unixODBC. Third. You will need to include mssql.conf and call rlm_sql_unixodbc. The mssql.conf has to many tricks to it. First the default driver is invalid and the "server" is really the DSN and must match that name found in /etc/odbc.ini. Also /etc/odbc.ini must be readable by the freeradius daemon. Also, there is an extra statement in the mssql.conf that is totaly not used and can be deleted; it's "authenticate_query". These things should help you out. If you need any further assistance, ie. configure/make commands and file contents ask again. Good Luck Duane Hi list, What is the status of MS SQL support for freeradius? Did anyone get it working? And if yes, which version do you use and what is required to get it work? I'm currently using freeradius 1.0.2 on Debian Sarge and I didn't manage to get it connect to the MS SQL server. As the rlm_sql_freetds module states that it is under development ans so, not enabled by default, I was wondering, if the iODBC or the unixodbc modules would work and if yes, how to set this up (aside from freeradius.. seems the 'drivers' are missing, whatever this means). Need some help here. Anyone? Cheers Arne ------------------------------ Message: 4 Date: Fri, 30 Sep 2005 15:24:39 +0000 From: James J J Hooper <jjj.hooper(a)bristol.ac.uk> Subject: Re: Expose RADIUS packet's identifier To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <B50EB08E7A3193762AED22AB(a)valium.cse.bris.ac.uk> Content-Type: text/plain; charset=us-ascii; FORMAT=flowed > > ATTRIBUTE Packet-Authentication-Vector 1088 octets > > Alan DeKok. can't get it to work: radius -X says: WARNING: Attempt to use unknown xlat function, or non-existent attribute in string %{Packet-Authentication-Vector} in radiusd.conf: exec logit { wait = yes input_pairs = request output_pairs = none program = "/etc/raddb/bin/logit.sh %{Packet-Authentication-Vector}" } logit called in authorize. Thanks in advance for any help you can give, James. ------------------------------ Message: 5 Date: Fri, 30 Sep 2005 11:01:25 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Segmentation Fault - 1.0.5 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050930150125.3446116CC1(a)mail.nitros9.org> "Rohaizam Abu Bakar" <haizam(a)myjaring.net> wrote: > cleaning up old files... recompile... and still segmentation fault... but > worse than before.. since the daemon cannot even up.. > > seems problem with rlm_ldap... That's bug #98. Either link statically, or put the libraries rlm_ldap needs in a place where the dynamic linker can find them. Alan DeKok. ------------------------------ Message: 6 Date: Fri, 30 Sep 2005 11:02:44 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: SSL3_GET_CLIENT_KEY_EXCHANGE To: Juan Daniel Moreno <juanitomoreno(a)gmail.com>, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050930150244.AA91016CC1(a)mail.nitros9.org> Juan Daniel Moreno <juanitomoreno(a)gmail.com> wrote: > Can you please tell me the client's exchange packet form the server is > attempting? How is it calculated? Read the FreeRADIUS source code. > Or, can you show me a typical byte suite from this message? (I hope > you understand me) Use ethereal. Alan DeKok. ------------------------------ Message: 7 Date: Fri, 30 Sep 2005 11:14:57 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: freeradius and MS SQL -- anyone got it working? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050930151457.9FDB316CC1(a)mail.nitros9.org> "Duane Cox" <duanec(a)mail.illicom.net> wrote: > First thing, the FreeTDS files have been removed (more like abandonded) from > FreeRadius. It was "abandoned" at the specific request of the FreeTDS project members, who told us the FreeTDS API used by the module was not stable, and shouldn't be used by anyone. > Second, in order to get MSSQL to work with the current version of FreeRadius > 1.0.5, you will need to install either unixodbc or iodbc. I chose unixodbc; > and in doing so it requires FreeTDS. So install both FreeTDS and unixODBC. Oh, so it *does* work with the unixODBC module, like I said. Why then the comments about the freetds module? > Third. You will need to include mssql.conf and call rlm_sql_unixodbc. The > mssql.conf has to many tricks to it. First the default driver is invalid > and the "server" is really the DSN and must match that name found in > /etc/odbc.ini. Also /etc/odbc.ini must be readable by the freeradius > daemon. Also, there is an extra statement in the mssql.conf that is totaly > not used and can be deleted; it's "authenticate_query". Please submit patches to the files & docs. We'll be glad to fix any issues with the project. Alan DeKok. ------------------------------ Message: 8 Date: Fri, 30 Sep 2005 12:02:34 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: Proxy of accounting message To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20050930160236.1CA4116CC1(a)mail.nitros9.org> "Ashwin Gobind" <Ashwin.Gobind(a)vodacom.co.za> wrote: > Thanks nick. However when I proxy the message, the > message-authenticator field has an <INVAILID TOKEN> (see trace below). > Why is this Message-Authenticator is NOT supported in Accounting packets. Alan DeKok. ------------------------------ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html End of Freeradius-Users Digest, Vol 5, Issue 103 ************************************************ �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

TLS establishment
by Juan Daniel Moreno 03 Oct '05

03 Oct '05

Hi, It's me again with my little problem. I have freeRadius 1.0.4 and I work at this moment with PEAP protocol. I have generated a certificate with a 128 byte length key. This is the server's certificate. The certificate is sent by the server, with server hello end to establish the TLS. By my part I send a Client_Key_exchange and a finished message, but the server responds me that the length is wrong. The finished message (as you see) is 128 length (the size of the server's public key). Can anybody help me please? I am really lost with this!! The freeRadis -X responses: rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept:error in SSLv3 read client key exchange A 6918:error:1408B0EA:SSL routines:SSL3_GET_CLIENT_KEY_EXCHANGE:tls rsa encrypted value length is wrong:s3_srvr.c:1450: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. In SSL Handshake Phase In SSL Accept mode rlm_eap_tls: BIO_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler Juan Daniel MORENO

1 0

Control user logins by NAS
by Shane Hart 03 Oct '05

03 Oct '05

Hi all, How can I control what groups can authenticate on what nas. I would like to create a batch of users and assign those users to only sucessfully login from a particular nas (or list of nas's) I have freeradius 1.04 and use sql for the user/password combinations Group 30 mins Simultanious Use := 1 Idle Timeout = 600 Max All Sessions := 1800 It is a wireless hotspot setup. Do I need to use huntgroups or can I add an attribute to the group? Thanks in advance Shane

1 0

RE: MSCHAPv2, MySQL, Freeradius
by Dan Russell 03 Oct '05

03 Oct '05

>"Dan Russell" <dan(a)in-house.com.au> wrote: >> Is there a way in which I can have encrypted passwords in the mysql >> database and use MSCHAPv2 to authenticate users? > > If they're NT hashed, yes. Otherwise, no. > >> If I used a third party tool like mkntpwd to create NT Hashes, could I >> put premade hashes in the database and use them to authenticate > > Yes. > Is there any specific config change I would need to make to enable this? >> or would rlm_mschap encrypt the password attribute anyway? > > I have no idea what that means. > How does freeradius identify that the password has already been NT hashed? What stops it from encrypting whatever it finds in the radcheck table for the password? Do I set it as User-Password or Encrypted-Password instead of Password? > Alan DeKok. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html Thanks in advance, Dan Russell

2 1

CHAP and LDAP
by Dmitry Alekhin 03 Oct '05

03 Oct '05

Hi there, New questions are ready. :) I have radiusd.conf authorize { chap preprocess suffix mschap ldap } ... authenticate { Auth-Type PAP { pap } Auth-Type LDAP { ldap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } } ... I am making VPN server with PPPD with radius module as NAS. Passwords are stored in LDAP database in clear text format. When i use PAP in connection setting, it works pretty fine ( connection is established) but with chap: What does it mean login attempt ? Mon Oct 3 02:16:05 2005 : Debug: rlm_ldap: checking if remote access for dmitry is allowed by dialupAccess Mon Oct 3 02:16:05 2005 : Debug: rlm_ldap: Password header not found in password qazxsw for user dmitry Mon Oct 3 02:16:05 2005 : Debug: rlm_ldap: looking for check items in directory... Mon Oct 3 02:16:05 2005 : Debug: rlm_ldap: looking for reply items in directory... Mon Oct 3 02:16:05 2005 : Debug: rlm_ldap: user dmitry authorized to use remote access Mon Oct 3 02:16:05 2005 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Mon Oct 3 02:16:05 2005 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 3 Mon Oct 3 02:16:05 2005 : Debug: modcall[authorize]: module "ldap" returns ok for request 3 Mon Oct 3 02:16:05 2005 : Debug: modcall: group authorize returns ok for request 3 Mon Oct 3 02:16:05 2005 : Debug: rad_check_password: Found Auth-Type CHAP Mon Oct 3 02:16:05 2005 : Debug: auth: type "CHAP" Mon Oct 3 02:16:05 2005 : Debug: Processing the authenticate section of radiusd.conf Mon Oct 3 02:16:05 2005 : Debug: modcall: entering group Auth-Type for request 3 Mon Oct 3 02:16:05 2005 : Debug: modsingle[authenticate]: calling chap (rlm_chap) for request 3 Mon Oct 3 02:16:05 2005 : Debug: rlm_chap: login attempt by "dmitry" with CHAP password Mon Oct 3 02:16:05 2005 : Debug: rlm_chap: Could not find clear text password for user dmitry Mon Oct 3 02:16:05 2005 : Debug: modsingle[authenticate]: returned from chap (rlm_chap) for request 3 Mon Oct 3 02:16:05 2005 : Debug: modcall[authenticate]: module "chap" returns invalid for request 3 Mon Oct 3 02:16:05 2005 : Debug: modcall: group Auth-Type returns invalid for request 3 Mon Oct 3 02:16:05 2005 : Debug: auth: Failed to validate the user.

2 1