- Freeradius-Users - lists.freeradius.org

need help configuring ntlm_auth w/ freeradius 1.0.1
by Ken George 12 Jul '05

12 Jul '05

Alan as you suggested (thanks) I have commented out LDAP and I am now attempting to authenticate via ntlm_auth. I've configured and started Samba and windindd. I can authenticate via ntlm_auth outside of Freeradius, but not with it. I KNOW THE PROBLEM IS WITH MY CONFIGURATION AND NOT FREERADIUS! I'd appreciate help in locating / understanding what I have misconfigured? Also, my final goal is to authenticate clients to a Cisco Aironet 1200 via our Windows 2003 Active Directory usernames and passwords is ntlm_auth the correct method to use? [root@phllnxsrv01 raddb]# ntlm_auth --username="test ops" --password=xxxxxx --domain=usmisgnet --request-NT-key NT_STATUS_OK: Success (0x0) Below are the ntlm_auth section of radiusd.conf and the radtest string used and the debug output from the other window. ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } radtest "test ops" xxxxxx localhost 0 testing123 radiusd -xxyz -l stdout Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf [NORMAL OUTPUT SUPPRESSED] Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32784, id=232, length=60 --- Walking the entire request list --- Waking up in 31 seconds... Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) Threads: total/active/spare threads = 5/0/5 User-Name = "test ops" User-Password = "m1sg0ps" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_lowerpair: User-Name now 'test ops' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "test ops", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [test ops] (from client localhost port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 127.0.0.1:32784, id=232, length=60 Sending Access-Reject of id 232 to 127.0.0.1:32784 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 232 with timestamp 42d3e0ec Nothing to do. Sleeping until we see a request. Ken George Systems and Network Engineering Mi Services Group, Inc. +1 610-230-2500 x129

2 1

RE: need help configuring ntlm_auth w/ freeradius 1.0.1
by Guy Davies 12 Jul '05

12 Jul '05

Hi Ken, [..snip..] > > Below are the ntlm_auth section of radiusd.conf and the > radtest string used and the debug output from the other window. > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > --username=%{Stripped-User-Name:-%{User-Name:-None}} > --domain=%{mschap:NT-Domain} --challenge=%{mschap:Challenge:-00} > --nt-response=%{mschap:NT-Response:-00}" > } > > radtest "test ops" xxxxxx localhost 0 testing123 > > radiusd -xxyz -l stdout > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/raddb/proxy.conf > Config: including file: /etc/raddb/clients.conf > Config: including file: /etc/raddb/snmp.conf > Config: including file: /etc/raddb/eap.conf > Config: including file: /etc/raddb/sql.conf > > [NORMAL OUTPUT SUPPRESSED] > Listening on authentication *:1812 > Listening on accounting *:1813 > Listening on proxy *:1814 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32784, > id=232, length=60 > --- Walking the entire request list --- > Waking up in 31 seconds... > Thread 1 got semaphore > Thread 1 handling request 0, (1 handled so far) > Threads: total/active/spare threads = 5/0/5 > User-Name = "test ops" > User-Password = "m1sg0ps" > NAS-IP-Address = 255.255.255.255 > NAS-Port = 0 It looks like there's no NT Domain in the RADIUS request. It's certainly not in the output above. > rad_lowerpair: User-Name now 'test ops' > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > modcall[authorize]: module "preprocess" returns ok for request 0 > modcall[authorize]: module "chap" returns noop for request 0 > modcall[authorize]: module "mschap" returns noop for request 0 > rlm_realm: No '@' in User-Name = "test ops", looking up realm NULL > rlm_realm: No such realm "NULL" Yep, there you go, there is no REALM associated with this username so the REALM NULL is assumed but it hasn't been configured for that REALM. I would expect the username to be sent as <REALM>\<username> by a standard M$ supplicant. Are you just telling it to use your windows credentials? Rgds, Guy > modcall[authorize]: module "suffix" returns noop for request 0 > rlm_realm: No '\' in User-Name = "test ops", looking up realm NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "ntdomain" returns noop for request 0 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 0 > modcall[authorize]: module "files" returns notfound for request 0 > modcall: group authorize returns ok for request 0 > auth: No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > auth: Failed to validate the user. > Login incorrect: [test ops] (from client localhost port 0) > Delaying request 0 for 1 seconds Finished request 0 Going to > the next request Thread 1 waiting to be assigned a request > rad_recv: Access-Request packet from host 127.0.0.1:32784, > id=232, length=60 Sending Access-Reject of id 232 to 127.0.0.1:32784 > --- Walking the entire request list --- > Waking up in 3 seconds... > --- Walking the entire request list --- > Cleaning up request 0 ID 232 with timestamp 42d3e0ec > Nothing to do. Sleeping until we see a request. > > > > > Ken George > Systems and Network Engineering > Mi Services Group, Inc. > +1 610-230-2500 x129 > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

log_badlogins
by Edward Rempala 12 Jul '05

12 Jul '05

When I run this script I get [root@auth bin]# ./log_badlogins Could not open file none [root@auth bin]# What can I do to fix this?

2 2

Password with comma fail with LDAP
by Turtiainen, Tero 12 Jul '05

12 Jul '05

Hi, We have FreeRADIUS 0.9.3 using LDAP for authorisation. We now have a problem that for example password with certain characters is cut. For example password "test,ing" is cut to "test". This is caused by the gettoken function in src/lib/token.c which is used by the rlm_ldap module. Google search seems to indicate that the same problem has been with the SQL-module which also uses gettoken. This kind of behaviour is of course quite evil. Is our problem unique? This seems so obvious problem that I would guess that it has been encountered before. I looked at the CVS version and my guess is that this has not been fixed. I made a quick test fix by replacing all occurences of gettoken in src/modules/rlm_ldap/rlm_ldap.c with getbareword-function (also in src/lib/token.c) which does not care about the tokens and thus does not cut the attribute value if it contains comma, semicolon, brace or any other of the magic characters. Does this fix break more things than it fixes? Is it a valid fix in this case? Any better solutions? -- Tero Turtiainen Telecom, Media & Entertainment Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

1 0

Someone have Toplogie: Windows - Cisco 3550 - Freeradius
by Michael Langer 12 Jul '05

12 Jul '05

Hi, sorry i ask it some time ago, but get no answer. I there anybody who have this configuration? Windows (2k or XP) - Ciscoc 3550 - Freeradius? I have read that some people get problem and use other radius servers. Michael Langer -- Weitersagen: GMX DSL-Flatrates mit Tempo-Garantie! Ab 4,99 Euro/Monat: http://www.gmx.net/de/go/dsl

1 0

Download
by Shepherd, Dave 12 Jul '05

12 Jul '05

I'm having trouble downloading from: ftp://ftp.freeradius.org/pub/radius I've tried 1.0.4, 1.0.3 from the website. I've also tried to use fireFTP and plain old ftp but with no luck. The ftp.freeradius.org hostname resolves to 62.24.0.50 OK Is the site known to be down? Dave

1 0

RE: sql counter clarification and issues
by Ross Tsolakidis 12 Jul '05

12 Jul '05

Ok, now I'm really confused :( Can someone please clarify exactly what does the sqlcounter module do ? Basically I need to calculate the data on a daily basis for each user. Thanks for your patience :) Regards, -- Ross -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Ross Tsolakidis Sent: Tuesday, 5 July 2005 2:14 PM To: FreeRadius users mailing list Subject: RE: sql counter clarification and issues Yes the server is receiving accounting packets. The SQL rows are updating every 5 mins, (I have the NAS set to send accounting packets every 5 mins). I run it in debug mode, I see: Module: Loaded SQL Counter sqlcounter: counter-name = "Daily-Session-Time" sqlcounter: check-name = "Max-Daily-Session" sqlcounter: key = "User-Name" sqlcounter: sqlmod-inst = "sqlcca3" sqlcounter: query = "SELECT SUM(AcctSessionTime - GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" sqlcounter: reset = "1h" rlm_sqlcounter: Counter attribute Daily-Session-Time is number 1671 rlm_sqlcounter: Check attribute Max-Daily-Session is number 1672 rlm_sqlcounter: num=1, last=h rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Next reset 1120536000 [2005-07-05 14:00:00] rlm_sqlcounter: num=1, last=h rlm_sqlcounter: Current Time: 1120532709 [2005-07-05 13:05:09], Prev reset 1120532400 [2005-07-05 13:00:00] Module: Instantiated sqlcounter (dailycounter) But no reset. Does anyone have this working, if so, what am I looking for, what am I supposed to see ? Thanks :) Regards, -- Ross -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, 5 July 2005 2:05 AM To: FreeRadius users mailing list Subject: Re: sql counter clarification and issues "Ross Tsolakidis" <Ross.Tsolakidis(a)day3.com.au> wrote: > At midnight every night will it begin a new row in SQL ? I don't know, I've never used the module. > Because at the moment there are no new rows being created, no counters > being reset. Is the server receiving accounting packets? Run it in debug mode with "reset=hour", and spend some time looking at what it's doing. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Re: Compiling Problem concerning `crypt' !!!
by kkwong1＠sfc.hk 12 Jul '05

12 Jul '05

** Your attention is drawn to the note at the end of this message. ** MESSAGE Sent freeradius-users-bounces@l by: ists.freeradius.org To: FreeRadius users mailing Ext : list <freeradius-users(a)lists.fr eeradius.org> cc: From: "Alan DeKok" <aland(a)ox.org> Date: 12/07/2005 00:45 Our Ref: Subje Re: Compiling Problem concerning `crypt' !!! ct: -------------------------------------------------------------------------- Alan, The congifuration is fine , there are no errors inside. Attached the ./configure codes as below, =<path>. configure: warning: sql submodule 'unixodbc' disabled creating ./config.status creating Makefile configuring in src/modules/rlm_unix running /bin/sh ./configure --enable-ltdl-install --cache-file =../../.././confi g.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANT ICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANT ICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for system password file... /etc/passwd checking for system shadow password file... /etc/shadow checking for crypt... (cached) yes checking for crypt.h... (cached) yes checking for shadow.h... (cached) yes checking for getspnam... (cached) yes checking for getusershell... (cached) yes checking for getspnam in -lshadow... (cached) no checking for fgetpwent... (cached) yes checking for fgetspent... (cached) yes checking for fgetgrent... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged configuring in src/modules/rlm_x99_token running /bin/sh ./configure --enable-ltdl-install --cache-file =../../.././confi g.cache --srcdir=. loading cache ../../.././config.cache checking how to run the C preprocessor... (cached) gcc -E checking for inttypes.h... (cached) yes creating ./config.status creating Makefile configuring in src/modules/rlm_checkval running /bin/sh ./configure --enable-ltdl-install --cache-file =../../.././confi g.cache --srcdir=. loading cache ../../.././config.cache checking for gcc... (cached) gcc checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANT ICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) works... yes checking whether the C compiler (gcc -g -O2 -D_REENTRANT -D_POSIX_PTHREAD_SEMANT ICS -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG ) is a cross-compiler... no checking whether we are using GNU C... (cached) yes checking whether gcc accepts -g... (cached) yes checking how to run the C preprocessor... (cached) gcc -E checking for regex.h... (cached) yes creating ./config.status creating Makefile creating config.h config.h is unchanged -bash-3.00$ -bash-3.00$ kkwong1(a)sfc.hk wrote: > Attached the codes of error when I am compiling Radius 1.0.4 > > When I finish ./configure, then MAKE, the error happens. Did the "configure" process finish without errors? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ______________________________________________________________________ This is a personal e-mail that is not sent on behalf of the Securities and Futures Commission. The Securities and Futures Commission accepts no responsibility for its contents or any attachments.

1 0

MySQL Connection Failure
by Thomas Tinsley 11 Jul '05

11 Jul '05

Hi my name is Tom and I am installing FreeRadius for the first time. Specifications: OS: Fedora Core 4 Linux Kernel 2.6.11smp Freeradius version : 1.0.2 MySQL version : 4.1.11 DEBUG Info: Mon Jul 11 14:05:01 2005 : Error: rlm_sql (sql): Failed to connect DB handle #4 Mon Jul 11 14:05:01 2005 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 1 Mon Jul 11 14:05:10 2005 : Info: rlm_sql (sql): Trying to (re)connect unconnected handle 4.. Mon Jul 11 14:05:10 2005 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jul 11 14:05:10 2005 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server root@localhost:radius Mon Jul 11 14:05:10 2005 : Error: rlm_sql_mysql: Mysql error 'Can't connect to local MySQL server through socket '/var/lib/mysql/mysql.sock' (13)' Question? Does anyone have a method to trace the connection attempt? MySQL is not kicking out any log info that would help. I have confirmed the MySQL server is running, and can connect to databases using PHP & PERL. MyADMINPHP and Dialup-Admin are installed, configured, and tested successfully for the MySQL server. I just need to get Radius to do the same. Radius.conf & sql.conf are modified accordingly. Any help would be appreciated. Thank you. Tom Tinsley Justnerds on SKYPE

2 1

self user registration
by Michael Fisher 11 Jul '05

11 Jul '05

I am currently envolved in a wireless project. How ever we currently need a radius server with the ability for users to register them selfs, also it would be ideal if this solution offerd email authentication. Is this possible at all?

6 8