- Freeradius-Users - lists.freeradius.org

RE: mod_radius, apache2 and the auth cookie.
by Palmer J.D.F. 28 Jul '05

28 Jul '05

Hi Alan, > > "Palmer J.D.F." <J.D.F.Palmer(a)swansea.ac.uk> wrote: > > Is it possible to set the timeout for the auth cookie used by the > mod_radius > > authentication module to 0; by Zero I mean no time, not infinite time? > > You mean re-authenticate for every request? That would require > source code changes. Effectively yes, see the description of what I'm trying to do below. > > Or, is there a way that I can clear the cookie on a failed login? > > The module doesn't set the cookie on a failed login, so there > shouldn't be any problem. If I get a failed login, then try to login again it just uses cached credentials and doesn't prompt for details, if I close and re-open the browser it does then allow me to enter details. I guess it may not be a cookie if one isn't set, but the credentials are being cached somewhere. > > > At present, if a user login fails the user has to close the browser and > open > > another in order to be able to re-enter their credentials, I want to try > to > > get round this if possible. > > I don't see why that would happen. The module was designed, and > tested to work properly in that situation. > > Can you explain more about what you're doing, how, and what browser > you're using? So far this has only been tested with IE on a patched up but otherwise std XP machine. The reason for the authentication is to log into a web-redirect gateway. An iptables rule redirects any un-authenticated IP/MAC pairs to the login page; on a successful login the page (a php page which resides in a protected folder) adds some iptables rules to allow that particular client (IP/MAC pair) through the gateway. This is why it doesn't matter that there is an instant timeout, as the client will not need to access the page again until his/her connection times out and the 'allowing' iptables rules are removed. The removal of stale connections is handled with a cron job script that compares iptables entries to the arp table on the internal interface, if there are iptables rules for an IP/MAC pair, but no arp entry for them then the iptables rules are removed. Quite crude, but it works. In summary, I have index.php that users are redirected to, this page contains a 'Log In' link to a page in a protected folder /gateway/go.php when they click the link they are challenged for credentials, if they are correct then /gateway/go.php loads setting some iptables rules, if it fails then we are currently loading a page called failed.php that explains to the user that they need to shut down the browser and open a new one and try again. An aside to this, is it possible to have a couple of text boxes on the login page where the user/pass are entered which are then sent to mod_radius, as opposed to having a pop up user/pass dialogue box? Thanks, Jezz Palmer.

3 2

help
by Liew Toh Seng 28 Jul '05

28 Jul '05

Hi, Is there any documentation for freeradius ? How and where to start ? Thanks. -- -------------------------------------------------------- Best Regards, Liew Toh Seng System Consultant, RedHat Certified Engineer http://www.redhat.com/rhce/rhce803005004313527.html My Directory Sdn Bhd, (http://www.md.com.my) "Your Open Source Partner"

3 2

Re: Access-Reject packet from host 127.0.0.1:1812
by Peter Cheng 28 Jul '05

28 Jul '05

> 3. Re: Access-Reject packet from host 127.0.0.1:1812 > ------------------------------ > Message: 3 > Date: Wed, 27 Jul 2005 21:34:01 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Access-Reject packet from host 127.0.0.1:1812 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20050727203401.GB21675(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> BAD PASSWORD: it is based on a dictionary word > > > I hope you dont let folk SSH into this box :-) > > >>[root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 >>Sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "testing" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>Re-sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "\271g\343\034{~\235\364M\344ID%\345\021j" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=251, length=20 > > > from a quick look att he logs, it looks as if the FreeRADIUS process > is unable to read your /etc/passwd file > > alan > > Hi Alan, i have do some chown on the shadow file and everything seem to be work fine.. Thank you very much for your advices.. check the below output:- ====================================================================== [root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 Sending Access-Request of id 226 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "testing" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=226, length=20 [root@cerebro ~]# ====================================================================== Best Regards, -- Peter Cheng Chief Technical Officer Open Source Edge O.S. Edge Sdn Bhd Mobile: +6.012.4766.202 Office: +6.03.4023.0337/8337 Fax : +6.03.4023.2337

1 0

Re: Freeradius-Users Digest, Vol 3, Issue 121
by Peter Cheng 28 Jul '05

28 Jul '05

> 3. Re: Access-Reject packet from host 127.0.0.1:1812 > ------------------------------ > Message: 3 > Date: Wed, 27 Jul 2005 21:34:01 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Access-Reject packet from host 127.0.0.1:1812 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20050727203401.GB21675(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > >> BAD PASSWORD: it is based on a dictionary word > > > I hope you dont let folk SSH into this box :-) > > >>[root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 >>Sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "testing" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>Re-sending Access-Request of id 251 to 127.0.0.1:1812 >> User-Name = "dummy" >> User-Password = "\271g\343\034{~\235\364M\344ID%\345\021j" >> NAS-IP-Address = cerebro.osedge.com >> NAS-Port = 1 >>rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=251, length=20 > > > from a quick look att he logs, it looks as if the FreeRADIUS process > is unable to read your /etc/passwd file > > alan > > Hi Alan, i have do some chown on the shadow file and everything seem to be work fine.. Thank you very much for your advices.. check the below output:- ====================================================================== [root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 Sending Access-Request of id 226 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "testing" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=226, length=20 [root@cerebro ~]# ====================================================================== Best Regards, -- Peter Cheng Chief Technical Officer Open Source Edge O.S. Edge Sdn Bhd Mobile: +6.012.4766.202 Office: +6.03.4023.0337/8337 Fax : +6.03.4023.2337

1 0

Access-Reject packet from host 127.0.0.1:1812
by peter＠osedge.com 27 Jul '05

27 Jul '05

Hi all, I am a complete newbie with radius. I have try to configure freeradius on fedora core 3 to authenticates against unix password /etc/passwd, /etc/shadow, but seem to be fail until now.. can any want pls guide me though this.. Besides, pls advice me if i doing anything wrong. My installation step:- 1) install freeradius using apt-get command:- ===================================================================== [root@cerebro ~]# apt-get install freeradius ===================================================================== 2) As i go though the doc, the default seem to be ok.., so i just start the services:- ===================================================================== [root@cerebro ~]# /etc/init.d/radiusd start Starting RADIUS server: [ OK ] [root@cerebro ~]# ===================================================================== 3) add a dummy user and assigh a password to user dummy:- ===================================================================== [root@cerebro ~]# adduser dummy [root@cerebro ~]# passwd dummy Changing password for user dummy. New UNIX password: testing BAD PASSWORD: it is based on a dictionary word Retype new UNIX password: testing passwd: all authentication tokens updated successfully. [root@cerebro ~]# ===================================================================== 4) testing to autheticate the user dummy:- ===================================================================== [root@cerebro ~]# radtest dummy testing localhost:1812 1 testing123 Sending Access-Request of id 251 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "testing" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 Re-sending Access-Request of id 251 to 127.0.0.1:1812 User-Name = "dummy" User-Password = "\271g\343\034{~\235\364M\344ID%\345\021j" NAS-IP-Address = cerebro.osedge.com NAS-Port = 1 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=251, length=20 [root@cerebro ~]# ===================================================================== The output of /var/log/radius/radius.log ===================================================================== [root@cerebro radius]# tail -f /var/log/radius/radius.log Thu Jul 28 03:54:16 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 28 03:54:16 2005 : Info: Ready to process requests. Thu Jul 28 03:55:38 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Jul 28 03:55:38 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 28 03:55:38 2005 : Info: Ready to process requests. Thu Jul 28 03:55:42 2005 : Info: Using deprecated naslist file. Support for this will go away soon. Thu Jul 28 03:55:42 2005 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Thu Jul 28 03:55:42 2005 : Info: Ready to process requests. Thu Jul 28 03:55:45 2005 : Auth: rlm_unix: [dummy]: invalid password Thu Jul 28 03:56:25 2005 : Auth: rlm_unix: [dummy]: invalid password Thu Jul 28 03:56:37 2005 : Auth: rlm_unix: [dummy]: invalid password ===================================================================== output of the command "radiusd -X" ===================================================================== Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. ===================================================================== Sorry, if i make you confuse Best Regards, -- Peter Cheng Chief Technical Officer Open Source Edge O.S. Edge Sdn Bhd Mobile: +6.012.4766.202 Office: +6.03.4023.0337 Fax : +6.03.4023.2337

2 1

Colubris-AVPairs
by Andrey 27 Jul '05

27 Jul '05

Hi, I have a problem with Freeradius returning Colubris-AVPairs. I have a CN3300 (Colubris AP) set up to authenticate from my radius server (FR), which in turn passes it information such as login pages, access lists, etc. All these attributes are defined in my "radgroupreply" table (3 in all), which look something as follows: 151 colubris_group Colubris-AVPair := access-list=loginserver, ACCEPT, tcp, x.x.x.138, ALL 152 colubris_group Colubris-AVPair := use-access-list=loginserver 153 colubris_group Colubris-AVPair := login-url=http://x.x.x.138/colubris/login.html When I attempt to authenticate the AP, the Access-Accept response has only the first Colubris-AVPair, whichever it might be (i've tried different orders). Is there any reason for this kind of behaviour? Do attributes have to have unique names? (since all three are called Colubris-AVPair). Thanks for any help. -Andrey

2 1

questions about a custom freeradius configuration
by Jeff Smith 27 Jul '05

27 Jul '05

Hi, Our wireless network currently authenticates and authorizes users via freeradius 0.8.1 with a custom module that talks to custom authentication and authorization servers. I'm upgrading the server side to freeradius 1.0.4. At the same time, the people who run the wireless network are switching to using EAP-PEAP with MS-CHAP v2. I'm fairly new to freeradius, but I have been spending a lot of time reading this list, the documents, the O'Reilly book, and experimenting with the server. So far I've been able to do PEAP authentications to the server via the users file. The custom authentication module I referred to in the first paragraph basically re-implemented MS-CHAP v2 and talked to the custom servers on the back end. It would not be easy to wedge into the rlm_eap code. Instead, I'd like to find a solution that makes the fewest possible (if any) modifications to stock freeradius, so we can track releases more closely. I would like to continue using the custom authentication and authorization servers. My thinking on this so far is that I might be able to use the Exec-Program-Wait atribute and/or the rlm_perl modules to call out to the custom servers, which have command-line interfaces. Ideally, I'd be able to do something like this: 1) In the authorization phase, call out to the custom authorization server and ask a question like "Is this user who claims to be ``joe'' authorized to use the wireless service?" I can get back a yes/no answer and send an Access-Reject with an explanation, or continue on if they are authorized. (I don't think Exec-Program-Wait can help here since I understand it only gets called after the user is authenticated. I could make this check after and only if mschap returns success, though.) 2) In the authorization phase, also call out to the custom authentication server to get pack the NT-Password and add that to the value pairs in the check list in the request packet, so that when EAP-PEAP finally gets down to the MS-CHAP v2 part, the NT-password is available. I have been having a hard time getting my mind around the complexity of RADIUS and freeradius. It may be that I'm taking a completely wrong-headed approach here. If anyone on this list has any thoughts on how this could be done best, I'd appreciate hearing your ideas. Thanks in advance! Jeff -- Jeff Smith Security Analyst - ITaP Identity & Access Management Purdue University W. Lafayette IN 47907-1408 Phone: 765-496-8285

2 1

Debug vs. Run mode
by Jamie Chitester 27 Jul '05

27 Jul '05

The servers (MYSQL and FREERADIUS)are running. The configuration works when I run it in debug. Then I issue the /etc/init.d/radiusd start command and get a OK back but then I can not connect to mysql Jamie Chitester Information Technology Department Manager City Light Gas & Water Phone: (573)888-5366 ext. 109 Cell: (573)888-7371 Fax: (573)888-3312 <http://www.clgw.net> http://www.clgw.net

1 0

Freeradius and Windows 2003 Active Directory Authentication (2)
by Tim P 27 Jul '05

27 Jul '05

Previous post sent before I was done, here is the full post: I am having trouble getting my radius setup to authenticate to windows 2003 active directory. when using the following string "radtest administrator "password" localhost 2 radiussecret rad_recv: Access-Request packet from host 127.0.0.1:32775, id=240, length=65 User-Name = "administrator" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "administrator", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for administrator radius_xlat: '(sAMAccountName=administrator)' radius_xlat: 'dc=company,dc=org' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to gtds-domcon.gtdsolutions.org:389, authentication 0 rlm_ldap: bind as cn=administrator,cn=Users,dc=company,dc=org/password to domcon.company.org:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=company,dc=org, with filter (sAMAccountName=administrator) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user administrator authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: group authenticate returns notfound for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 radiusd.conf - I didn't find a system or System auth type, did I miss something? <module configureation section> ldap { server = "domcon.company.org" basedn = "dc=company,dc=org" filter = "(sAMAccountName=%u)" password_attribute = "userPassword" identity = "cn=administrator,cn=Users,dc=company,dc=org" password = password <authorize section> ldap # this is enabled <authenticate sectoin> Auth-Type LDAP { ldap }

2 4

Can Calling-Station-Id be proxied
by shane 27 Jul '05

27 Jul '05

Hi, Does freeradius proxy the Calling-Station-Id ? I am sending a realm to another radius server that will record the mac address of the users computer. Effectivly locking the user login to the mac address. It seems the "Calling-Station-Id" is not proxied to the main server. *************************************** Sending Access-Request of id 4 to 127.0.0.1:1820 User-Name = "test" User-Password = "test" NAS-IP-Address = 10.0.0.100 Proxy-State = 0x33 *************************************** Is ther a way to send additional details with the proxy request? Thanks

2 1