- Freeradius-Users - lists.freeradius.org

Passing attributes from freeradius to Cisco VPN 3000
by Scott Stursa 20 Jun '05

20 Jun '05

Is anyone using freeradius to authenticate users of a Cisco 3000 series VPN concentrator? If so, are you successfully passing attributes (such as "Framed-IP-Address") from freeradius to the 3000? If so, please contact me off-list. Thanks, - SLS ------------------------------------------------------------------------ Scott L. Stursa 850/644-2591 Network Security Analyst stursa(a)mailer.fsu.edu OTI Enterprise Security Group Florida State University - No good deed goes unpunished -

1 0

Exec-Program-Wait: plaintext:
by Americatel Centroamerica 20 Jun '05

20 Jun '05

Hi, i have two servers with diferent versions of freeradius, one with 0.9 and another with 1.0.1. I have an Exec-Program-Wait perl script configured to add some attributes to the reply, all is working flawlessly on the 0.9, but the same script doesnt work on the 1.0 server, the output items of the script dont appear on the reply items, this is the debug output on the server with 1.0 radius_xlat: '/root/get_credit_time.pl' Exec-Program: /root/get_credit_time.pl Exec-Program output: h323-credit-time = "h323-credit-time=1125" h323-return-code = "h323-return-code=0" Exec-Program-Wait: plaintext: h323-credit-time = "h323-credit-time=1125" h323-return-code = "h323-return-code=0" Exec-Program: returned: 0 Login OK: [3212244132] (from client private-network port 0 cli 50322660124) Sending Access-Accept of id 179 to 192.168.10.112:21679 h323-credit-amount = "h323-credit-amount=3.00" h323-prompt-id = "h323-prompt-id=1350" Finished request 13 Look at the Exec-Program-Wait: plaintext:??? on the other server (with 0.9) the reply is as expected: Sending Access-Accept of id 179 to 192.168.10.112:21679 h323-credit-amount = "h323-credit-amount=3.00" h323-prompt-id = "h323-prompt-id=1350" h323-credit-time = "h323-credit-time=1125" h323-return-code = "h323-return-code=0" Finished request 13 what is the configuration problem? thanks ____________________________________________________ Yahoo! Sports Rekindle the Rivalries. Sign up for Fantasy Football http://football.fantasysports.yahoo.com

2 2

hints and PPTP/MPPE
by David Batterham 20 Jun '05

20 Jun '05

Hi All, I'm trying to get hints and huntgroups working with PPTP using MPPE MSCHAPv2. I want users to be able to login with uname or uname.suffix. When logging in with uname.suffix, the suffix is stripped and a hint is set using the hints file. They are also set in a huntgroup. The users file as a DEFAULT entry for that hint and huntgroup. This *works* when users connect a certain way (ipsec using clear text passwords), but fails on PPTP connections using MPPE. When connecting via PPTP, the DEFAULT entry does not get hit and it falls through to the DEFAULT entry with Auth-Type := Reject. The correct entry is hit when connecting via IPSEC. Despite this, it still sends an Access-Accept (albeit with the Reply-Message in the Reject). My suspicion is that MS Windows is generating MPPE keys based on the username with the suffix, and freeradius is correctly authenticating against the system (SMBPASSWD file) without the suffix, but generating MPPE responses also without the SUFFIX, therefore windows drops the connection. Version is 1.0.3. Any ideas? Regs, Dave -- ----------------------------------------------------------------------------- David Batterham Information Systems & Services Manager Department of Electrical & Electronic Engineering The University of Melbourne, Victoria 3010 Email: d.batterham(a)ee.mu.oz.au Phone: +61 3 8344 3366 Fax: +61 3 8344 6678

2 1

Adding a custom attribute
by Radoslav Kolev 20 Jun '05

20 Jun '05

Hi, all! I'm using FreeRADIUS 1.0.1 with the MySQL backend. I want to send out a reply attribute which is not in the standard dictionary file. What I did is edit /etc/raddb/dictionary and added a line like: ATTRIBUTE Some-Attribute 229 string Then inserted a row in the radreply table: insert into radreply values ('','user','Some-Attribute', ':=', "text"); When I chek with radtest or actual NAS, the new reply attribute is not sent in the Access Accept packet. If I delete the above line from the dictionary file and run the server in debug mode, I see a Unknown attribute error from the mysql module("Error: rlm_sql: unknown attribute Some-Attribute"), which is normal. When the attribute is in the dictionary no errors are given, and it is still not appended to the reply. Is there something else I need to to except adding the line to the dictionary file? I have added new attributes like that to FreeRADIUS 0.9.3 and it worked, has anything changed since then? Regards, Rado

2 5

Local (system) account creation
by Haydur 20 Jun '05

20 Jun '05

Hi there, Is there a way to have remote FreeRadius only authentication on a Linux box, and if successful, creation of a system / local account for that user. Thanks, Neod

2 1

RE: Multiple Authentication REALMS - I hope in Plain Text
by Shepherd, Dave 20 Jun '05

20 Jun '05

Alan, Thanks for the advice; "As always, start with the default configuration: it works" As I've now got it working for my standard config. However, I still seem to be getting the request marked as complete after the authorize section:- Thread 1 handling request 0, (1 handled so far) Waking up in 5 seconds... User-Name = "unextest20" User-Password = "*****" Called-Station-Id = "**********" rad_lowerpair: User-Name now 'unextest20' modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched DEFAULT at 21 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'unextest20' rlm_sql (sql): sql_set_user escaped user --> 'unextest20' radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql (sql): Reserving sql socket id: 9 rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radcheck ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id' rlm_sql_postgresql: query: SELECT radgroupcheck.id, radgroupcheck.GroupName, ??radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op ??FROM radgroupcheck, usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupcheck.GroupName ??ORDER BY radgroupcheck.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id' rlm_sql_postgresql: query: SELECT id, UserName, Attribute, Value, Op ??FROM radreply ??WHERE Username = 'unextest20' ??ORDER BY id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = radius_xlat: 'SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id' rlm_sql_postgresql: query: SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, ??radgroupreply.Value, radgroupreply.Op ??FROM radgroupreply,usergroup ??WHERE usergroup.Username = 'unextest20' AND usergroup.GroupName = radgroupreply.GroupName ??ORDER BY radgroupreply.id rlm_sql_postgresql: Status: PGRES_TUPLES_OK rlm_sql_postgresql: affected rows = rlm_sql (sql): Released sql socket id: 9 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 Finished request 0 This only occurs when I match the following in my users file: # NexUS RAS DEFAULT Called-Station-Id == "********", Proxy-To-Realm := "sloxldap" Fall-Through = No If I match on my other statements, the user authenticates as expected. Any thoughts as to why this might be happening. I'm on version 0.9.3. TIA Dave Shepherd > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius- > users-bounces(a)lists.freeradius.org] On Behalf Of Alan DeKok > Sent: 14 June 2005 18:33 > To: FreeRadius users mailing list > Subject: Re: Multiple Authentication REALMS - I hope in Plain Text > > "Shepherd, Dave" <Dave.Shepherd(a)compass-group.co.uk> wrote: > > realm SPECIAL { > > type = radius > > authhost = LOCAL > > accthost = LOCAL > > } > > In the latest versions, this is realm "LOCAL", but that doesn't make > too much difference. > > > Auth-Type { > > mschap > > } > > Are you sure? How about "Auth-Type mschap {" ... > > > modcall: group authorize returns updated for request 14 > > Finished request 14 > > Hmm... something is marking the request as done, without calling the > "authenticate" section. I have no idea why, and I don't recall ever > seeing anything like that. > > > If one of you guys has had to do something similar, or can see any > > glaring omissions in my config (which I seem to think there is) could > > you please point me in the right direction. > > As always, start with the default configuration: it works. > > Then, gradually add your edits, testing after every edit, to be sure > that it still works. Once you're done, you should have your local > configuration , and it should still work. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

radiusd sending output to stdout without -X flag
by Ken Tyler 20 Jun '05

20 Jun '05

Hi all, I have downloaded, compiled, configured the latest CVS snapshot and it works fine. I have a question, the server is logging to stdout no matter what I do. I am not running with -X flag. Any ideas? I have config setup to log to syslog, tried file also, no luck. Ken

2 1

PAM_RADIUS_AUTH.so refuses to work on some machines
by Christiaan Ehlers 20 Jun '05

20 Jun '05

Hi I have installed pam_radius_auth to work on Redhat 7.3 and it seems to work fine. I then installed (compiled) it on a Redhat 9 box and it seems to be behaving quite strange. My pam.d/sshd file looks like this #%PAM-1.0 auth sufficient pam_radius_auth.so debug auth required pam_stack.so service=system-auth auth required pam_nologin.so account required pam_stack.so service=system-auth password required pam_stack.so service=system-auth session sufficient pam_radius_auth.so debug session required pam_stack.so service=system-auth session required pam_limits.so session optional pam_console.so The session (accounting) part of pam_radius_auth seems to work fine. I can see packets going to the radius server when I do a tcpdump on the client machine. This only works when I hash out the first line "auth sufficient pam_radius_auth.so debug". When the first line is not hasshed the authentication kicks in and nothing happens when I enter a username and password. I set tcpdump to sniff for all packets going to the radius server but there is nothing. My logs look like this. Jun 20 17:12:01 finpapp01 sshd[6881]: pam_radius_auth: Got user name root Jun 20 17:12:23 finpapp01 sshd[6887]: pam_radius_auth: Got user name test Jun 20 17:14:00 finpapp01 sshd[7161]: pam_radius_auth: Got user name test Jun 20 17:18:14 finpapp01 sshd[7673]: Failed password for test from 172.31.1.101 port 2276 Jun 20 17:18:45 finpapp01 sshd[7780]: Accepted password for root from 172.31.1.101 port 2277 Jun 20 17:18:45 finpapp01 sshd[7780]: pam_radius_auth: DEBUG: getservbyname(radacct, udp) returned 1108551052. Jun 20 17:18:48 finpapp01 sshd[7780]: pam_radius_auth: RADIUS server 172.31.10.1 failed to respond Jun 20 17:18:48 finpapp01 sshd[7780]: pam_radius_auth: All RADIUS servers failed to respond. Jun 20 17:22:26 finpapp01 sshd[8216]: pam_radius_auth: Got user name test Jun 20 17:24:50 finpapp01 sshd[8541]: pam_radius_auth: Got user name root Jun 20 17:28:40 finpapp01 sshd[8978]: Accepted password for root from 172.31.1.120 port 1916 ssh2 When I try and log into the box, the only info that pam_radius_auth give to the log is the "Got user name xxxx" message. What would the right syntax be for a strace command to trace this? So far I have recompiled, copy bin from other machines but nothing seems to work. Kind Regarsd Christiaan Ehlers

1 0

How to solve alive user who actually has loged off
by ??? 20 Jun '05

20 Jun '05

Hello everybody, I am using freeradius-1.0.4. In my situation, user "testuser" from domain "domain" logged from NAS 192.168.1.68, After a while,user "testuser" logged out,but the NAS did not send Accout-Stop packet(for some reason) and freeradius still thought that user "testuser" is alive,but Actually user "testuser" has logged off. I have set the Simulate-Use to 1 and now "testuser" can not log in any more from anywhere. I use radwho and it output as follows: # ./radwho -R User-Name = "testuser@domain" Acct-Session-Id = "02022911" NAS-IP-Address = 192.168.1.68 NAS-Port = 98335 Service-type = Login-User Framed-IP-Address = 0.0.0.0 Acct-Session-Time = 4112 Calling-Station-Id = "00d0-5926-e3fb" I want to do something to make freeradius to believe that user "testuser" is not alive,but do not konw how to do.Is there a way to solve the problem? Thanks!

3 2

Reid Canavan/FortErie is on Vacation
by Reid Canavan 20 Jun '05

20 Jun '05

I will be out of the office starting Mon 06/20/2005 and will not return until Mon 06/27/2005. I will respond to your message when I return.

1 0