- Freeradius-Users - lists.freeradius.org

Re: How to use different ldap-modules?
by Stefan.Neis＠t-online.de 22 Jun '05

22 Jun '05

Hi, > I am really stuck :-( > > Let me try to explain what I inted to do: > > 1.) PAP is just the clear-text password??? > -> I thought pap is hashing the password with a challenge (MD-5). This > means the client is then transmitting this Hash to the radius, which > might hold the password in cleartext or as a MD-5-Hash as well. Either > comparing the Hashes or the passwords No. > So I want to the server to hold a crypted Password (MD-5) for PAP, but > retrieving that from the ldap server. In fact, that wouldn't even work if you where correct, as for encrypting password you typically add a random seed before hashing, so if you build two password hashes, they are different even for the same password (to avoid "replay attacks" in whatever flavour). > 2.) I do not want to do any binding to the ldap for authentication! > I just want to retrieve the information from the ldap, but then > authenticate only by the radius itself!! Gettig the plaintext password from the LDAP server should FreeRadius allow to always work. Some more details on the protocols, if you are interested: PAP: The RADIUS client takes the password and XORs it with a hash value obtained from the RADIUS secret that the client shares with the server and transmits the "encrypted" password. The server does the same computation and obtains the cleartext password. If it knows the cleartext password from your LDAP-Server it checks it and is done, if it knows a hash value from your LDAP-Server, it computes the hash value of the password it obtained from the client and compares the hash values. CHAP: During the authentication process, the machine trying to authenticate gets a challenge and responds to it, based on the cleartext password. The RADIUS client (i.e. the NAS) takes CHAP challenge and CHAP response and sends both of them to the RADIUS server. The server takes the cleartext password and checks that the given response is correct for the given challenge. If the server cannot get the cleartext password is cannot verify the CHAP data. MS-CHAP: Essentially the same with an initially somewhat less secure method for computing responses to challenges (probably to conform with US export laws of that time), meanwhile "updated" to use a reasonable protocol (if you use NT-Response and not the old LM-Response). Mostly interesting because it also computes/distributes session keys based on username and password. Note that if an attacker can guess (or brute-force) the password, he also obtains the communication keys, so this encryption is only worth mentioning, if you put your users under strict password policies (i.e. use complicated passwords, change them often and don't write them down). :-( Note that contrary to CHAP, where you do need the cleartext password to verify the response for the challenge, there's an intermediate result ("LM-Password" or "NT-Password" depending on whether you're using NT-Response or LM-Response mentioned above) which is sufficient to check the correctness of the response (OTOH, it's also sufficient to steal said intermediate result to convince NAS and RADIUS server to give you access, so if your server isn't secure, it doesn't help if you only stored those intermediate results instead of the cleartext passwords). Regards, Stefan

2 1

Compilation errors in 1.0.4
by Oleg M. Golovanov 22 Jun '05

22 Jun '05

I fixed the shown error but got the following. I set CPPFLAGS in my configure script as follows -- CPPFLAGS="-I/usr/local/include -I/usr/local/pgsql/include" LDFLAGS="-L/usr/local/lib -L/usr/local/pgsql/lib" ./configure --prefix=/usr/local/freeradius --with-raddbdir=/usr/local/freeradius/etc --with-logdir=/var/log/radius --with-radacctdir=/var/log/radacct --without-rlm-krb5 --without-rlm-sql-mysql --without-rlm-sql-oracle --with-iodbc-lib-dir=/usr/local/lib --without-rlm-sql-unixodbc --with-rlm-counter-include-dir=/usr/local/include 2>&1 > sci-freeradius.log -- But it don't help to solve it. -- gcc -g -O2 -pthread -D_THREAD_SAFE -DOPENSSL_NO_KRB5 -Wall -D_GNU_SOURCE -DNDEBUG -I../../include -c rlm_counter.c -o rlm_counter.o rlm_counter.c:38: gdbm.h: No such file or directory gmake[5]: *** [rlm_counter.o] Error 1 gmake[5]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules/rlm_counter' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /usr/home/olmi/com/freeradius-1.0.4 -- Respectively, Oleg Golovanov Krasnoyarsk city Russia

2 1

RE: Log / Dialup admin Nas lookup
by Shepherd, Dave 22 Jun '05

22 Jun '05

You could try radiusreport http://www.pgregg.com/projects/radiusreport/ Very nice perl script, and if I remember there is a switch to just list who has ever logged in. To get it from the specific NAS point it top the relevant detail file. HTH Dave Shepherd > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Cris Boisvert > Sent: 21 June 2005 16:09 > To: 'FreeRadius users mailing list' > Subject: Log / Dialup admin Nas lookup > > Freeradius fedora core 3 > Mysql with dialup admin.. > > Is their a way to have the dialup admin show all the users that have > logged > in to one > Nas Server in a one month period? But not list all the login and > accounting > info? > > I just need a list of the users not everytime each logged in. > > Currently I do this.. From the radius.log > > > Cat radius.log | grep nasserveraddress > NEWFILE > > Then I import the file and sort them and delete all the login lines but > one.. > > Any recccomenddations? > > Thanx > Cris > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Debian .deb Installation Version 1.0.2 Ca.all dosn' exist
by Michael Langer 22 Jun '05

22 Jun '05

Hi @all, i read some HowTo's for installing FreeRadius/PEAP and they have used the CA.all script to create the certificats. But i can't find this script after installing FreeRadius deb version 1.0.2 on my PC. I have to install other packets ? Openssl is already installed. (After installing Freeradius) thx for hints Michael L. -- Geschenkt: 3 Monate GMX ProMail gratis + 3 Ausgaben stern gratis ++ Jetzt anmelden & testen ++ http://www.gmx.net/de/go/promail ++

4 11

Compilation error
by Oleg M. Golovanov 22 Jun '05

22 Jun '05

I try to make FreeRADIUS 1.0.4 on FreeBSD 4.11 and got the followin ( the previous version has been made successfully). Does anybody know the problem or maybe where to search? In file included from rlm_attr_rewrite.c:31: /usr/include/regex.h:46: syntax error before `regoff_t' /usr/include/regex.h:46: warning: type defaults to `int' in declaration of `regoff_t' /usr/include/regex.h:46: warning: data definition has no type or storage class /usr/include/regex.h:56: syntax error before `regoff_t' rlm_attr_rewrite.c: In function `do_attr_rewrite': rlm_attr_rewrite.c:314: structure has no member named `rm_so' rlm_attr_rewrite.c:316: structure has no member named `rm_so' rlm_attr_rewrite.c:318: structure has no member named `rm_eo' rlm_attr_rewrite.c:318: structure has no member named `rm_so' rlm_attr_rewrite.c:330: structure has no member named `rm_eo' rlm_attr_rewrite.c:348: structure has no member named `rm_so' rlm_attr_rewrite.c:357: structure has no member named `rm_so' rlm_attr_rewrite.c:358: structure has no member named `rm_eo' rlm_attr_rewrite.c:358: structure has no member named `rm_so' rlm_attr_rewrite.c:359: structure has no member named `rm_eo' rlm_attr_rewrite.c:359: structure has no member named `rm_so' gmake[5]: *** [rlm_attr_rewrite.o] Error 1 gmake[5]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules/rlm_attr_rewrite' gmake[4]: *** [common] Error 2 gmake[4]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[3]: *** [all] Error 2 gmake[3]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src/modules' gmake[2]: *** [common] Error 2 gmake[2]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake[1]: *** [all] Error 2 gmake[1]: Leaving directory `/usr/home/olmi/com/freeradius-1.0.4/src' gmake: *** [common] Error 2 *** Error code 2 Stop in /usr/home/olmi/com/freeradius-1.0.4. -- Respectively, Oleg Golovanov Krasnoyarsk city Russia

2 1

Re: corrupt UDP packets sent to proxy (Alan DeKok)
by Taylor, Graham 21 Jun '05

21 Jun '05

Message: 2 Date: Fri, 17 Jun 2005 13:20:06 -0400 From: "Alan DeKok" <aland(a)ox.org> Subject: Re: corrupt UDP packets sent to proxy To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>> Message-ID: <20050617172007.F3ED716FAB(a)mail.nitros9.org>> "Taylor, Graham" <GrahamTaylor(a)michaelpage.com>> wrote: >> Hi People, I hope you can shed some light on a problem I am having with >> freeradius acting as a proxy. As you can see the packet below has a >> corrupt UDP header > The kernel creates the UDP header, including checksum. If it's >wrong, there's little FreeRADIUS can do. Alan I agree that the kernel creates the UDP header normally, I am concerned that FreeRADIUS is forwarding the packet to the proxy without re-calculating the UDP header. This would explain why the behaviour is different when proxying than when using radtest. >> If I use radtest then the packet is fine and I get authenticated, the >> problem only occurs when the request is proxied out, all of the packets >> forwarded to the secondary radius server have the UDP checksum error, > I've never seen that, and I'm not sure why it would happen. Alan DeKok.

2 1

mrtg
by Micko 21 Jun '05

21 Jun '05

HI! I use FreeRADIUS as proxy. I would like to know if I can create mrtg using snmp on how many users are currently connected? Thank you!

6 7

EAP Supplicant Authentictaed falied to Ping.
by Sudha 21 Jun '05

21 Jun '05

Hi List.. I tried to enable EAP MD5 authentication and the configration in the wpa_supplicant.conf file is as: network { ssid=valid ssid identity=some identity password=secret pass word key_mgmt=IEEE8021X eap_flags=0 auth_algo=OPEN WEP_key1="some key" WEP_keytxindex=1 priority = 1 } I'm authenticated with AP and got the state "AUTENTICATED" but it then goes to RECEIVE and I'm not able to Ping to the AP. Is there any changes I need to make in suppliccant.conf or /etc/sysconfig/networkscripts? Any help on this regard is appreciable. Thanks.

1 0

Log / Dialup admin Nas lookup
by Cris Boisvert 21 Jun '05

21 Jun '05

Freeradius fedora core 3 Mysql with dialup admin.. Is their a way to have the dialup admin show all the users that have logged in to one Nas Server in a one month period? But not list all the login and accounting info? I just need a list of the users not everytime each logged in. Currently I do this.. From the radius.log Cat radius.log | grep nasserveraddress > NEWFILE Then I import the file and sort them and delete all the login lines but one.. Any recccomenddations? Thanx Cris

1 0

Re: Local (system) account creation
by Haydur 21 Jun '05

21 Jun '05

Ok, so from what I've learnt it's not possible to create accounts via pam_radius_auth if they don't exist on the system. How about this? Is it possible to use pam_radius_auth only authentication with "login", and if the user does not exist in the local password file, a default dummy account is used? How would I do that? I have tried modifying the login PAM configuration file, but although the authentication succeeds, the system gives me errors like "session setup problem, abort" or "user not known to underlying authentication module" and reloads the login application. How can I fix that? On 6/20/05, Alan DeKok <aland(a)ox.org> wrote: > Haydur <haydur(a)gmail.com> wrote: > > Is there a way to have remote FreeRadius only authentication on a > > Linux box, and if successful, creation of a system / local account for > > that user. > > Not really. There's pam_radius_auth, but that's only for usernames > & passwors, as I could never figure out the PAM magic required to do > UID, etc. > > Alan DeKok. > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > ROUTING / This message may be Spam/Junk - Diese Email wird als Spam/Junk EMail eingestuft. Falls Sie diese Email nicht mehr erhalten moechten, erstellen Sie bitte eine Regel in Ihrem Mailclient, die diese Email automatisch loescht oder verschiebt (http:/ > /www.schnell-im-netz.de/spam). > > --

1 0