- Freeradius-Users - lists.freeradius.org

RE: Active Directory and FreeRadius
by Talwar, Puneet (NIH/NIAID) 14 Jul '05

14 Jul '05

Well I can use pam_krb5, but what I am trying to accomplish here is that I have quite a few Linux workstation on my network and I thought if I can setup those Linux workstation to point to the radius server where they login using there Active Directory credentials. So I am not sure if this can be done or not? But would like hear if anybody who has done something similar to what I am doing. Thanks, -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: Wednesday, July 13, 2005 2:58 PM To: FreeRadius users mailing list Subject: Re: Active Directory and FreeRadius "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > I was able to auth against AD by setting up KRB5 on RHEL. Now I would like > to setup freeradius where I will have bunch of UNIX workstation that will > point to the freeradius server using pam_radius_auth module and will auth > against radius server using their AD credentials. Why not just use pam_krb5? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Dictionnary Permission - How to solve it ?
by Aime 14 Jul '05

14 Jul '05

Hello, I am calling "radclient" form a cgi perl script as follow : --- code fragment---------- $av_string = User-Name = fredf, User-Password = wilma, NAS-IP-Address = 192.168.89.1, NAS-Port = 0; my $response = `echo -E "$av_string | radclient -d /etc/freeradius -r $radretries -t $radtimeout $radiusip $radiustype $radiuspw 2>&1`; --- end code fragment------ and I am getting the following error: "radclient: dict_init: Couldn't open dictionary "/etc/freeradius/dictionary": Permission denied" I gave rwxrwxrwx to "/etc/freeradius/dictionary" but it does not help. Where can i look to solve this ? Using Freeradius 1.0.4 on Debian Sarge Testing --Aimé freeradius-users(a)lists.freeradius.org __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

RE: Active Directory and FreeRadius
by Zawacki Jason D Ctr AFRL/IFOS 14 Jul '05

14 Jul '05

I'd recommend skipping PAM and using MIT's kerberized telnet. I don't believe PAM supports single signon, whereas you can have single sign-on with kerberized telnet. > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Alan DeKok > Sent: Thursday, July 14, 2005 11:39 AM > To: FreeRadius users mailing list > Subject: Re: Active Directory and FreeRadius > > "Talwar, Puneet (NIH/NIAID)" <PTALWAR(a)niaid.nih.gov> wrote: > > Well I can use pam_krb5, but what I am trying to accomplish > here is that I > > have quite a few Linux workstation on my network and I > thought if I can > > setup those Linux workstation to point to the radius server > where they login > > using there Active Directory credentials. > > You said that already. > > What you may not know is that AD implements Kerberos. You can use > pam_krb5 on the Linux boxes to do *exactly* the same thing, but > without using RADIUS at all. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Password == "bla%1" (shooting into my foot)
by Stefan Nehlsen 14 Jul '05

14 Jul '05

hello, trying to get freeradius working (again) I figured out a strange behaviour: Authentication with CHAP as my testaccount failed until I tried it with PAP first. After one (or more) successful authentifications with PAP CHAP works. It took some time until I figured out that my password contained a % and the daemon tried some variable substitution. don't do this! How do I escape special chars in the users file and what characters are special? Stefan -- Stefan Nehlsen | ParlaNet Administration | sn(a)parlanet.de | +49 431 988-1260

2 1

RE: Password == "bla%1" (shooting into my foot)
by Guy Davies 14 Jul '05

14 Jul '05

Hi Stefan, I also saw this. The escape character is \. Special characters I would think of are !, #, *, ?, ^, $, &, % and (obviously) \. There may well be others. Rgds, Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Stefan Nehlsen > Sent: 14 July 2005 15:45 > To: freeradius-users(a)lists.freeradius.org > Subject: Password == "bla%1" (shooting into my foot) > > > hello, > > trying to get freeradius working (again) I figured out a > strange behaviour: > > Authentication with CHAP as my testaccount failed until I > tried it with PAP first. After one (or more) successful > authentifications with PAP CHAP works. > > It took some time until I figured out that my password > contained a % and the daemon tried some variable substitution. > > don't do this! > > How do I escape special chars in the users file and what > characters are special? > > Stefan > -- > Stefan Nehlsen | ParlaNet Administration | sn(a)parlanet.de | > +49 431 988-1260 > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Re: FreeRadius and PIX 520 accounting
by lmarante＠aerolineas.com.ar 14 Jul '05

14 Jul '05

You're right, sorry Here's what I get in my radius.log "Error: WARNING: Malformed RADIUS packet from host 172.17.xxxx: Vendor specific attributes do not exactly fill Vendor-Specific" That's the only error I get. "Alan DeKok" <aland(a)ox.org> Enviado por: freeradius-users-bounces(a)lists.freeradius.org 13/07/2005 10:34 p.m. Por favor, responda a FreeRadius users mailing list Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc: Asunto: Re: FreeRadius and PIX 520 accounting lmarante(a)aerolineas.com.ar wrote: > Last I checked, there was some kind of incompatibility between the packets > the firewall is sending and what FreeRadius is expecting to recieve. "some kind"? Can you say what, exactly? If you can't say what the incompatibility is, there's no way of knowing if the problem is fixed, or even can be fixed. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy
by Zawacki Jason D Ctr AFRL/IFOS 14 Jul '05

14 Jul '05

Thanks Dusty. I just implemented your suggestions and it's working very well. Once again I am pleasantly surprised by the flexibility of FreeRADIUS. Great job! Jason > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Dusty Doris > Sent: Wednesday, July 13, 2005 4:53 PM > To: FreeRadius users mailing list > Subject: RE: FreeRADIUS v1.0.4, rlm_ldap module, and redundancy > > > > > > > You're using the LDAP-Group attribute, which is set to use svr1, > > > which is down. There's currently no fail-over for the LDAP-Group > > > attribute. > > > > > > > I dig, that's kind of what I thought (even if I didn't word > it correctly). > > Thanks for your help! > > > > You can simulate redundancy for the Ldap-Group attribute, by > doing this. > > Instantiate your ldap modules in radiusd.conf. > > instantiate { > srv1 > srv2 > srv3 > } > > In users file, add multiple lines of the same ldap-group > lookup, for each > srv. > > For example, say you must have ldap-group of dial if coming > from a dial > huntgroup. > > DEFAULT Huntgroup-Name == dial, srv1-Ldap-Group == dial > > DEFAULT Huntgroup-Name == dial, srv2-Ldap-Group == dial > > DEFAULT Huntgroup-Name == dial, srv3-Ldap-Group == dial > > What will happen is if the huntgroup matches, then the server > will lookup > on the srv1 instance if ldap-group = dial. If so, it matches and the > users file ends. If not, it continues down the file, where > it will then > try srv2. If that fails, it continues to srv3. > > So, if one and two are down, then this will require 3 > different lookups to > finally get to srv3, but it will provide you with some type > of redundancy. > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

FreeRadius and PIX 520 accounting
by lmarante＠aerolineas.com.ar 14 Jul '05

14 Jul '05

Hello everyone This subject was once asked but I've never seen a clear answer about it. I'm using FreeRadius 0.9.3 to authenticate our VPN users connecting through our PIX 520 with OS version 6.3. I'd like to enable accounting also so I can restrict only one connection per user simultaneously. Last I checked, there was some kind of incompatibility between the packets the firewall is sending and what FreeRadius is expecting to recieve. I wanted to know if this is somehow "patched" in 1.0.4 or if it will still not work. Also, if it's not fixed in freeradius, anyone knows if upgrading to the OS version 7 will fix it ? Thanks in advance. Lior Marantenboim.

2 1

eap id bug
by DALE REAMER 14 Jul '05

14 Jul '05

When using freeradius with wpa_supplicant I have noticed freeradius does not bump the EAP id when sending back the Access-Accept packet. wpa_supplicant notices this and has a work around. Will the WPA drop this packet (it is important because it has the keys in the attributes). Has anyone reported this bug? The reason I ask is because after receiving the accept packet, wpa_supplicant goes into AUTHENTICATED state but cannot connect to the network, or associate. Any ideas? the wpa_supplicant (last part) trace: WPA: Sending EAPOL-Key 2/4 RX EAPOL from 00:0f:b5:7a:17:bc EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=1 type=3 length=119 EAPOL-Key type=254 WPA: RX message 3 of 4-Way Handshake from 00:0f:b5:7a:17:bc (ver=1) WPA: IE KeyData - hexdump(len=24): dd 16 00 50 f2 01 01 00 00 50 f2 02 01 00 00 50 f2 02 01 00 00 50 f2 01 WPA: No WPA/RSN IE for this AP known. Trying to get from scan results WPA: Found the current AP from updated scan results WPA: Sending EAPOL-Key 4/4 WPA: Installing PTK to the driver. WPA: RSC - hexdump(len=6): 00 00 00 00 00 00 RX EAPOL from 00:0f:b5:7a:17:bc EAPOL: Ignoring WPA EAPOL-Key frame in EAPOL state machines IEEE 802.1X RX: version=1 type=3 length=127 EAPOL-Key type=254 WPA: RX message 1 of Group Key Handshake from 00:0f:b5:7a:17:bc (ver=1) WPA: Group Key - hexdump(len=32): [REMOVED] WPA: Installing GTK to the driver (keyidx=1 tx=0). WPA: RSC - hexdump(len=6): 00 00 00 00 00 00 WPA: Sending EAPOL-Key 2/2 WPA: Key negotiation completed with 00:0f:b5:7a:17:bc [PTK=TKIP GTK=TKIP] Cancelling authentication timeout Removed BSSID 00:0f:b5:7a:17:bc from blacklist EAPOL: External notification - portValid=1 EAPOL: SUPP_PAE entering state AUTHENTICATED Signal 2 received - terminating ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed ndis_get_oid: oid=0xd010101 len (6) failed ndis_set_oid: oid=0xd010114 len (4) failed EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 wpa_driver_ndis_set_wpa: enabled=0 No keys have been configured - skip key clearing rmdir[ctrl_interface]: No such file or directory EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit the freeradius (last part trace): ending Access-Challenge of id 12 to 192.168.0.229:1075 EAP-Message = 0x010c00501900170301002028f83aa4e802c2965c29685e7521a11ea189ad707d72f340478950afc820a3dd1703010020c159819f4919952b824a4c2e7d71d92338cfeb7e35842ecca2590d0ec5e9a91f Message-Authenticator = 0x00000000000000000000000000000000 State = 0xed25ce47ac6c8028e663a2f6f53414e7 rad_recv: Access-Request packet from host 192.168.0.229:1075, id=13, length=251 Message-Authenticator = 0x508b7cdf35912a2b07a9f6f461200076 Service-Type = Framed-User User-Name = "dreamer" Framed-MTU = 1488 State = 0xed25ce47ac6c8028e663a2f6f53414e7 Called-Station-Id = "000FB57A17BC:NETGEAR" Calling-Station-Id = "00070EB38E2D" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020c005019001703010020d636529b1ced029a7bc635638d3d21e9e6eeff64ba0e2bbdae2f362655442a601703010020653e43e16142b6e7535d53a7306aad5bc40cf157a9fa7f38c067a870a649c184 NAS-IP-Address = 192.168.0.229 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Sending Access-Accept of id 13 to 192.168.0.229:1075 MS-MPPE-Recv-Key = 0x2ae009c01dc4c8af6bbf63b3a03eae0bf36d5f74277cd979e0aab0c7c0208b00 MS-MPPE-Send-Key = 0xed2e0e7f8242205404cecb7894a82d742f43a225b2f1ddae8231128e413f00ec EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "dreamer"

2 2

Re: MySQL Connection Failure
by Marcin Jessa 14 Jul '05

14 Jul '05

On Mon, 11 Jul 2005 17:18:00 -0500 "Thomas Tinsley" <ttinsley(a)everyones-wireless.com> wrote: > Marcin, > > > >> Hi my name is Tom and I am installing FreeRadius for the first time. > >> > >> Specifications: > >> OS: Fedora Core 4 > >> Linux Kernel 2.6.11smp > >> Freeradius version : 1.0.2 > > >1.0.2 has security holes. Use 1.0.4 > > Update complete. Problem still present. > > >> MySQL version : 4.1.11 > >> > >> DEBUG Info: > >> > >> Mon Jul 11 14:05:01 2005 : Error: rlm_sql (sql): Failed to connect DB > >> handle > >> #4 > >> Mon Jul 11 14:05:01 2005 : Info: rlm_sql (sql): There are no DB > >> handles to use! skipped 5, tried to connect 1 Mon Jul 11 14:05:10 2005 > >> : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. > >> Mon Jul 11 14:05:10 2005 : Info: rlm_sql_mysql: Starting connect to > >> MySQL server for #4 Mon Jul 11 14:05:10 2005 : Error: rlm_sql_mysql: > >> Couldn't connect socket to MySQL server root@localhost:radius Mon Jul > >> 11 14:05:10 2005 : Error: rlm_sql_mysql: Mysql error 'Can't connect to > >> local MySQL server through socket '/var/lib/mysql/mysql.sock' (13)' > > >Your MySQL is not running or you have wrong username and pass or no > database to connect to or wrong database name. > > MySQL is running. Username, Password, and Database have been confirmed > using Dialup-Admin to connect and administrate data records. > > >> Question? > >> > >> Does anyone have a method to trace the connection attempt? MySQL is > > >> not kicking out any log info that would help. > > >Read above. > I have been through the basic troubleshooting steps. Downloaded the newest > version (./configure, make, makeinstall) and still get an error. The error > points to a specific socket that does exist and is part of the MySQL > configuration. Ok, try to use this config: http://www.yazzy.org/configs/linux/my.cnf It's a standard config for gentoo but I am sure you can addapt it to RedHat. Pay attention to the socket variable. > >>I have confirmed the MySQL > >> server is running, and can connect to databases using PHP & PERL. > > >type mysql -u root -p > >You will be prompted to type in your pass if mysql is running ok. > > I do not have trouble using the mysql client to connect to the server and > select the radius database. I can even execute select statements against > tables to view the test data. > > Is there any chance that freeradius is not compatible with my current > version of MySQL? No. I run it on MySQL 5.x on FreeBSD. > > MyADMINPHP and Dialup-Admin are installed, configured, and tested > > successfully for the MySQL server. I just need to get Radius to do the > > same. Radius.conf & sql.conf are modified accordingly. > > > > Any help would be appreciated. Thank you. > > Cheers, > Marcin Jessa >

2 1