- Freeradius-Users - lists.freeradius.org

DHCP broadcasts are not leaving the interface
by Diman 24 Feb '15

24 Feb '15

Hi All, I am trying to setup up freeradius as dchp server. Everything is Ok, exempt broadcast packets (dhcp offers) are not leaving the server interface. I use Ubuntu 14.04.2 LTS (GNU/Linux 3.13.0-45-generic i686) and FreeRADIUS Version 2.2.7,compiled from git v2.x.x sources. Firewall is off, radiusd runs as root. strace shows some sendto() errors like: EACCES (Permission denied) and EINVAL (Invalid argument). The EINVAL (Invalid argument) could be fixed with "--without-udpfromto" compile option. The full details are available at http://pastebin.com/625BEbr1 I have not a programmer at all, but my suspicion is that send socket option SO_BROADCAST is not set ... not sure. Unicast replies are Ok. My questions are: what else should I check? is there any workaround for this issue? Thanks. Dmitri

1 0

Why an access-request is sent before password entered?
by David Li 24 Feb '15

24 Feb '15

Hi, I am trying to narrow down a problem. Not sure if this is the right forum but it's a good starting point. The problem is that I see access-request sent to the FreeRadius server before the password is even entered in a SSH session. For example, ssh user(a)xxx.xxx.xxx.xxx ### Problem: Press Enter here and access-request is sent. Although once the password is entered, second request is sent and Radius server has no problem authenticating it. I don't have a idea right now where to start to look at this time. Is it in sshd or pam-radius? Is it a configuration issue? My set up is very standard on a Redhat 5.4 box with sshd and pam and pam-radius-auth module. Thanks. David

2 1

Version 3.0.7 has been released
by Alan DeKok 24 Feb '15

24 Feb '15

ChangeLog is available here: http://freeradius.org/version3.html Lots of minor little fixes, and some nice new features: - radmin now uses stdout / stderr for error messages - cow home_servers can be derived from client sections. - many new dynamic expansions - better SQL error messages. etc. Alan DeKok.

4 5

RE: Your message to Freeradius-Users awaits moderator approval
by Clement Ogedengbe 24 Feb '15

24 Feb '15

I posted a message giving more details and with attachment of logs captured on this problem, but unfortunately the message is being held until the list moderator can review it for approval. Can I please request for accelerated action please! Best Regards Clement Ogedengbe -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of freeradius-users-owner(a)lists.freeradius.org Sent: 24 February 2015 10:44 To: Clement Ogedengbe Subject: Your message to Freeradius-Users awaits moderator approval Your mail to 'Freeradius-Users' with the subject RE: Sudden User Authentication Rejection as a result Compatibility - error Is being held until the list moderator can review it for approval. The reason it is being held: Message body is too big: 352566 bytes with a limit of 100 KB Either the message will get posted to the list, or you will receive notification of the moderator's decision. If you would like to cancel this posting, please visit the following URL: http://lists.freeradius.org/mailman/confirm/freeradius-users/d02cacda23137f…

1 0

Salted SHA security
by Robert Graham 23 Feb '15

23 Feb '15

Question for the Freeradius programmers/admins: How does the authentication for the Salted SHA-512 get handled? Yes, I know you can pull the hashed/salted password from a sql database or locally, but how does the FreeRadius server compare the users input password which would only be the first 64 bytesand the rest being the salt, when the user has only entered in their username and password at the prompts (I.E. mobile devices or laptops). Doesnt the server need to have the users password and salt to be able to compare the pulled password with the entered in password? Ive been trying to do the format that was discussed earlier by changing our code to be hash/salt appended not prepended, and by using Arrans suggestions of: update control { SSHA2-512-Password := "0x%{sql:query to get hash in hex concatenated with salt in hex}" or update control { Tmp-String-0 := "%{sql:SELECT hash FROM <table> WHERE <clause>}" Tmp-String-1 := "%{sql:SELECT salt FROM <table> WHERE <clause>}" } update control { SSHA2-512-Password := "0x%{control:Tmp-String-0}%{control:Tmp-String-1}" If I use radtest everything works just fine locally, but once PEAP is integrated into the mix, it fails (i.e. laptop,cell phone). Am I reading the protocol compability matrix incorrectly then? Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

3 2

CHAP and Cleartext-Password
by Tevfik Ceydeliler 23 Feb '15

23 Feb '15

Hi, I am newbie about Freeradius. I have One time Password Server as proxy. My user comes to freeradius from GSM operator by using an APN Freeradius uses MySQL to store username and IP Pool.When a user come, Freeradius verifies password from OTP and assing an IP address. Thsi what I wanan doç In LAN tests, there was no problem. But when I try to test from APN to connect my user I get some error. Here is my user and log ##################################### mysql> select * from radcheck where username like '%yagmurgida6%'; +-----+----------------------+------------------------------+----+-------+ | id | username | attribute | op | value | +-----+-------------+---------------------------------------+-----+-------+ | 197 | yagmurgida6 | Cleartext-Password | := | test | +-----+-------------+--------------------------------------+------+-------+ ##################################### rad_recv: Access-Request packet from host 172.30.80.1 port 24160, id=115, length=388 Calling-Station-Id = "905330443893" User-Name = "yagmurgida6" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015044743893" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 56032450 3GPP-GPRS-Negotiated-QoS-profile = "99-13921F7396F7FE74FAF7FE" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.10 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610ec77e26f 3GPP-Attr-23 = 0x8000 3GPP-IMEISV = "3541140143174615" 3GPP-PDP-Type = 0 CHAP-Challenge = 0xae4696cc70b2fa9d1628d9b59e19d7c3 CHAP-Password = 0x0245569539ebb803dbc0534c0540ea2bc8 NAS-Port = 56400 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "yagmurgida6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> yagmurgida6 [sql] sql_set_user escaped user --> 'yagmurgida6' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE us$ [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE us$ [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'yagmurgida6' ORD$ rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "yagmurgida6" with CHAP password [chap] Using clear text password "test" for user yagmurgida6 authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> yagmurgida6 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 172.30.80.1 port 24160, id=115, length=388 Waiting to send Access-Reject to client TurkcellNasClient port 24160 - ID: 115 Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 115 to 172.30.80.1 port 24160 Waking up in 4.9 seconds. Cleaning up request 0 ID 115 with timestamp +3231 Ready to process requests. ################################# As I see, there is CHAP and Cleartext-Password not works together. Because of I use OTP as proxy local password not necessary. So to conenct successfully, what attribute I have to use? -- <br> <img src="http://www.yasar.com.tr/banner/yhbanner.jpg"> </img> <br><br> Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

DHCP option 252
by Дмитрий Симоненко 23 Feb '15

23 Feb '15

My DHCP server responds to DHCP-Relay, but need to respond to the client (in DHCP-Option-252 transmitted 0xfc). __________________________ С уважением, Симоненко Д.В.

1 0

DHCP Option 282
by Дмитрий Симоненко 23 Feb '15

23 Feb '15

How to get rid of DHCP-Inform requests (option 252..... WPAD)??? what add to the dictionary.dhcp and radiusd.conf??? Help please!!! __________________________ С уважением, Симоненко Д.В.

1 0

User file Includes and DEFAULT section.
by Marc Beaumont 23 Feb '15

23 Feb '15

Hi, I'm taking over admin of a bunch of freeradius servers and I'm trying to simplify the users definition file. >From the documentation I can see that you can specify a file to include using the $INCLUDE statement, but I wanted to know if it's possible to include a directory that just has files in and those are automatically included? Also I attempting to specify a DEFAULT section and move all common user entry lines there. Should the DEFAULT section be at the top of the users file or at the bottom as it doesn't seem to work correctly. My DEFAULT section has passthrough set. Marc Scanned by MailDefender - managed email security from intY - www.maildefender.net

2 1

Implementating Ldap userPassword in crypt/sha password with eap ttls mschapv2 /eap peap mschapv2
by Sautron Nick 23 Feb '15

23 Feb '15

Hello everyone, I installed freeradius 2.2.6, and I try to Implement an ldap server, however this ldap password server are "crypt" and "SHA". My question is: Would it be possible to implemente ldap with word passes into crypt/sha, with authentication method EAP TTLS mschapv2 / EAP peap mschapv2 ? Thank you for your answer and enlighten me on this. Best Regards

3 3