- Freeradius-Users - lists.freeradius.org

Re: Password with comma fail with LDAP
by Turtiainen, Tero 19 Jul '05

19 Jul '05

Hi, > We have FreeRADIUS 0.9.3 using LDAP for authorisation. We now have a > problem that for example password with certain characters is cut. For > example password "test,ing" is cut to "test". This is caused by the > gettoken function in src/lib/token.c which is used by the rlm_ldap > module. Google search seems to indicate that the same problem has been > with the SQL-module which also uses gettoken. > > This kind of behaviour is of course quite evil. Is our problem unique? .... > I made a quick test fix by replacing all occurences of gettoken in > src/modules/rlm_ldap/rlm_ldap.c with getbareword-function (also in > src/lib/token.c) which does not care about the tokens .... I have looked at this a little bit more and I still don't get it. Why does the LDAP-module use the gettoken() function? I have thought that the authorisation data stored in LDAP should be usually taken "as is", but in the LDAP/gettoken case it seems that there could also be some special handling. But in our case this breaks the password handling if the password contains some of those delimiters (like ,=> etc...). Storing the passwords in MD5 or some other one-way encryption is not a solution as CHAP is used for authentication. And the gettoken also breaks other attributes, not just passwords. Is there something that I don't understand or is this a bug in the LDAP-module? Replacing gettoken with getbareword in the rlm_ldap.c seemed to fix this, but this may brake a lot of other things... :) Or should this be discussed in freeradius-devel? -- Tero Turtiainen Telecom, Media & Entertainment Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

1 0

Accessing IP list...
by Kamran Bukhari 19 Jul '05

19 Jul '05

Hello I want My Radius server not to access the clients IP List, and it should entertain everyother IP which sends the request. It must not block the IP to get info. HOw can i do this? Second, if there is any way that radius server should look for Mysql database for the IP which tries to connect to it. I mean, if i send some request from some new IP, then radius server should check the database for the list and then authenticate? Bye -- Kamran Bukhari

1 0

building
by DALE REAMER 18 Jul '05

18 Jul '05

I am new to tweaking freeradius code. Since I am having trouble forming the information to be encrypted by SSL and then sent to the wpa_supplicant (bad decryptopmn or bad mac error on the wpa_supplicant side, and also sometimes on the server side) I want to put in some printf's in freeradius, probably in tls.c. After I add code, what needs to be built and installed, every directory has a makefile. The encryption problem is after a successful handshake and after the first server encrypted start packet, so I trust the encryption process. Thanks

2 3

EAP/TLS and XP client
by ksochack 18 Jul '05

18 Jul '05

Hi, I configured a freeRADIUS(RH-FC4) server to authenticate Proxim AP700 clients via eap/tls. The radius server processes the authentication request and challenges however in the logs I don't see 'access-accepted' messages (see detailauth log below). The AP monitor shows a number of request and challenges but none accepted or rejected, I can get rejected if I point to the wrong cert on the server or change the shared secret. The problem is the client never gets connected to AP to grab a IP address after authentication. Any help would be greatly appreciated. TIA, Kevin Sochacki Detailauth log excert: Packet-Type = Access-Request Mon Jul 18 13:37:14 2005 User-Name = "RadiusIS-X01.frsd.k12.nj.us" NAS-IP-Address = 10.10.10.89 Called-Station-Id = "00-20-a6-58-ec-4c:RFLTC8-AP" Calling-Station-Id = "00-90-4b-2c-ed-88" NAS-Identifier = "RFLTC8-AP" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021200200152616469757349532d5830312e667273642e6b31322e6e6a2e7573 Message-Authenticator = 0x2dc2f241788db9a17495d302732c41d7 Client-IP-Address = 10.10.10.89 Packet-Type = Access-Request Mon Jul 18 13:37:15 2005 User-Name = "RadiusIS-X01.frsd.k12.nj.us" NAS-IP-Address = 10.10.10.89 Called-Station-Id = "00-20-a6-58-ec-4c:RFLTC8-AP" Calling-Station-Id = "00-90-4b-2c-ed-88" NAS-Identifier = "RFLTC8-AP" State = 0x161f68d6d1793490de3cdbb9dadab669 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021300500d800000004616030100410100003d030142dbe8cb6e242a151a510a83d4d4a61d 3672f6685afe6b0b2b92f1484e8f2ce700001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x18a80f1d01826f6bf20ed7afa13b5a4b Client-IP-Address = 10.10.10.89 Packet-Type = Access-Request Mon Jul 18 13:37:15 2005 User-Name = "RadiusIS-X01.frsd.k12.nj.us" NAS-IP-Address = 10.10.10.89 Called-Station-Id = "00-20-a6-58-ec-4c:RFLTC8-AP" Calling-Station-Id = "00-90-4b-2c-ed-88" NAS-Identifier = "RFLTC8-AP" State = 0x36ee47bde8d663c9102fa6cb7c84532c Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021400060d00 Message-Authenticator = 0xe69c50763abab6320cc27ebc402c3644 Client-IP-Address = 10.10.10.89

2 3

FreeRADIUS and LDAP
by Matt Juszczak 18 Jul '05

18 Jul '05

Hi all, Our setup in LDAP right now is: ou=People,dc=domain,dc=net Under the Organizational Unit of "People", we have our posixAccount users, which have valid UNIX uid's and have email accounts. However, not all of our Email users (ou=People) have radius accounts as well, and sometimes, user "bob" in Email is not the same user as user "Bob" in radius. Therefore, I'm thinking of just creating ou=Radius, and then putting our dial up customers in there. If I were to do that, is there a better schema I can use other than posixAccounts? Such as a radius-only schema that supports radius parameters as well? Thanks! -Matt

2 1

Problem with Aruba Attributes
by alfonso celestino 18 Jul '05

18 Jul '05

Hi, everybody I am using freeradius 1.0.2. I am treating to use Attributes of aruba, for what I had to add dictionary.aruba file to the directory: /usr/local/radius/share/freeradius/, and, in the file: /usr/local/radius/etc/raddb/dictionary, I add the following line: $INCLUDE/usr/local/radius/share/freeradius/dictionary.aruba but, I have a problem when I Execute freeradius. I will be grateful, that could say to me the problem that I am committing. here is the error: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/radius/etc/raddb/proxy.conf Config: including file: /usr/local/radius/etc/raddb/clients.conf Config: including file: /usr/local/radius/etc/raddb/snmp.conf Config: including file: /usr/local/radius/etc/raddb/eap.conf Config: including file: /usr/local/radius/etc/raddb/sql.conf main: prefix = "/usr/local/radius" main: localstatedir = "/usr/local/radius/var" main: logdir = "/usr/local/radius/var/log/radius" main: libdir = "/usr/local/radius/lib" main: radacctdir = "/usr/local/radius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/radius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/radius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/radius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary Errors reading dictionary: dict_init: /usr/local/radius/etc/raddb/dictionary[15]: Couldn't open dictionary " /usr/local/radius/share/freeradius/dictionary.aruba": No such file or directory Errors reading radiusd.conf dictionary.aruba file: # # dictionary.aruba # # Version: $Id$ # # VENDOR Aruba 14823 ATTRIBUTE Aruba-Admin-ole 4 String Aruba ATTRIBUTE Aruba-Priv-Admin-User 3 Integer Aruba ATTRIBUTE Aruba-Vlan 2 Integer Aruba ATTRIBUTE Aruba-User-Role 1 String Aruba ___________________________________________________________ Do You Yahoo!? La mejor conexión a Internet y <b >2GB</b> extra a tu correo por $100 al mes. http://net.yahoo.com.mx

1 0

Re: freeradius performance & cpu usage
by Fechete Raul 18 Jul '05

18 Jul '05

Nicolas Baradakis wrote: >> what bothers me is that the freeradius is handling such a small >> amount of authorizations, and keeping the processor usage below >> 10%. (?!) why doesn't it take 90% and do in the mean time more work? > Perhaps the client doesn't send enough requests to make the server > busy. How do you make your tests? thank you for your answer. that might just be it! :-) i have a test client also programmed by a colleague, that starts a number of threads (for each authorization one) that in the beginning wait for a semaphore. after all threads are ready, the semapfore is switched to green and all authorization requests are sent in a burst. maybe it needs some tuning.. anyway, do you know any radius eap-sim test clients that work for sure? regards, r.

2 1

accounting to db - duplicate entrys & missing stop time?
by Roger Kristiansen 18 Jul '05

18 Jul '05

2 3

freeradius performance & cpu usage
by Fechete Raul 18 Jul '05

18 Jul '05

hello, i have the following problem. i'm running freeradius (with the eap-sim module, and a special module a colleague of mine wrote) on a dual 3 ghz xeon, and all that i'm getting out of it are 25 (?) authorizations per second. i wanted to see just about how bad the module was and short-circuited it. it registers only two functions, an authorization and an accounting one. if they are _empty_, the freeradius manages to get up to 70 auth./sec. no back-end database, no network communication, just the test-clients and the radius with the module returning a simple RLM_MODULE_UPDATED. when using 3 clients with 200 authorization each, the number of threads jumps to 600. that's ok. what bothers me is that the freeradius is handling such a small amount of authorizations, and keeping the processor usage below 10%. (?!) why doesn't it take 90% and do in the mean time more work? if it used all the processor time, i could just scale it maybe and get the performance i need, but this way, the computer remains practically unused. thank you, raul f.

3 2

MS AD, LDAP works -> how to check for group membership?
by Shelbyville.Unwired 18 Jul '05

18 Jul '05

I would like to check group membership before authenticating user login requests. I currently have radiusd.conf setup such that all users can login. However after spending several days reading man pages, and searching these archives I haven't found the key that unlocks my problem. radiusd.conf # <snip> ldap { server = "xx.xx.xx.xx" # ad server address identity = "cn=some_user,cn=users,dc=domain,dc=com" # bind account password = "xxx" # bind account password basedn = "cn=users,dc=domain,dc=com" # base dn filter = "(sAMAccountName=%{Stripped-User-Name:-%{User-Name}})" # uid start_tls = no # nope dictionary_mapping = ${raddbdir}/ldap.attrmap # default ldap_connections_number = 5 # why not password_attribute = userPassword # no need to explain # ok this is where things get real fuzzy - I've read rlm_ldap several times... timeout = 4 timelimit = 3 net_timeout = 1 } Users file remains untouched. Specifically what else do I need to if a user is a member of XYZ_group and if so authenticate them. Any help would be greatly appreciated. TYIA.

2 1