- Freeradius-Users - lists.freeradius.org

Need both Local (MySQL database) and Active directory authentications.
by ffgch2 11 Apr '13

11 Apr '13

Hi all, I have set up Freeradius (v.2.1.10) to do password authentication from MySQL database and it works fine but now I need to make some users be able to authenticate against Active directory accounts. I’ve setup winbind to authenticate windows accounts and it works but as a result freeradius lost ability to authenticate by local database. So if I comment the line: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" in /modules/mschap file then local database authentication works fine but Active directory doesn’t. With uncommented ntlm_auth Active directory works but local database doesn’t. The WiFi access points that queries the radius using WPA-Enterprise, so passwords encrypted in EAP messages and so there is no another way to validate the passwords, it have to go through mschap module anyway. Is there a way to tell mschap to use ntlm_auth depending on field in MySQL table and use the internal mechanisms if plain text passwords available in the MySQL table?

2 1

Radwho doesn't show full name
by mkeram 11 Apr '13

11 Apr '13

Hello, I have installed Debian Squeeze 6.0 with freeradius 2.1.10 + accel-ppp (PPPoE). Everything is working fine, but radwho and radwho -s doesn't return full username fetched from /etc/passwd. All users have real linux account and proper entry in /etc/freeradius/users. All details login and passwords are included in users file. In old freeradius 1.1.3 I got radwho output: zycha AnetaZych PPP S338 Sun 16:28 127.0.0.1 192.168.1.223 -where AnetaZych is full name fetched from /etc/passwd in new I have: zycha zycha PPP S338 Sun 16:28 127.0.0.1 192.168.1.223 Could you please advice where should I change configuration? I have made strace on radwho and I didn't find and information for checking file /etc/passwd. Please advice Best regards Marek

1 1

Radius Squid authentication REJECT
by Iftakhul Anwar 11 Apr '13

11 Apr '13

Hi All, I have successfully configure freeradius with mysql. i can radtest using command : sudo radtest alice password 192.168.2.3 1812 testing123 Sending Access-Request of id 187 to 192.168.2.3 port 1812 User-Name = "alice" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 192.168.2.3 port 1812, id=187, length=20 Now i try squid using radius authentication. i followed step by step from : http://safesrv.net/setup-squid-and-freeradius-on-centos-5/#comment-1043 But i got error message log on cache.log Warning: Received invalid reply digest from server Warning: Received invalid reply digest from server Warning: Received invalid reply digest from server squid_rad_auth: No response from RADIUS server On radius -X debug there is error message like bellow : Sending duplicate reply to client localprivate port 42003 – ID: 2 Sending Access-Reject of id 2 to 192.168.2.3 port 42003 Waking up in 2.9 seconds. rad_recv: Access-Request packet from host 192.168.2.3 port 42003, id=2, length=63 Sending duplicate reply to client localprivate port 42003 – ID: 2 Sending Access-Reject of id 2 to 192.168.2.3 port 42003 Waking up in 0.9 seconds. Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {…} [pap] login attempt with password “b9?I? +�(�Ч�Y�?” [pap] Using clear text password “password” [pap] Passwords don’t match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type REJECT What is that error ? How i can solve this Thanks -- *M.Iftakhul Anwar* Meruvian Integrator High Performance Computing / Cloud Computing (HPC/CC) Office Phone : 021-93586577 Mobile Phone : 085215331477 Blog : http://blog.mervpolis.com/roller/anwar FB : http://www.facebook.com/troya.adromeda Website : www.meruvian.org

3 6

Freeradius 3 & LDAP Generic Attributes
by Nicholas Lemberger 11 Apr '13

11 Apr '13

Hi, I've been puttering around with FR3 and haven't been able to figure out how to set up a mapping from LDAP 'radiusReplyItem' & 'radiusCheckItem' attributes to FR3 generic attributes. While we do often create a special LDAP attribute for what we need, the generic attributes in FR2 made testing and certain one-off configurations much quicker. I was hoping someone could point me in the correct direction! Thanks, -Nick

2 1

freeradius in cloud using openstack
by faizal ghazali 10 Apr '13

10 Apr '13

Hi, can anybody here teach me how to install freeradius in openstack infrastructure?

2 1

sql checkval Operator which work with Value comma (,)
by EasyHorpak.com 10 Apr '13

10 Apr '13

2 2

Freeradius + MySQL + Daloradius
by Erik Sellgren 10 Apr '13

10 Apr '13

I am trying to setup wireless authentication through my mikrotik router using freeradius with mysql and daloradius. I have the server setup and working, I can use NTradtest from my pc and I get Access-Accept messages in return with my cleartext user/password, username userclear password clear. But when I set it all up and try to access the wireless with the same credentials it is an access-reject. See below # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: userclear [mschap] Told to do MS-CHAPv2 for userclear with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. After reading the top of inner-tunnel I used the test they said to use : radtest USER PASSWORD 127.0.0.1:18120 0 testing123 When I use my user it fails, when I use the test user "user" and "pass" it succeeds. So do I have my innertunnel setup wrong or something? I have sql uncommented in /etc/raddb/sites-available/inner-tunnel Please let me know what info you need and I can supply it, please help me debug this issue.

2 1

Server dosn't detect any requests except from localhost
by Saeed Zanderahimi 10 Apr '13

10 Apr '13

Hello, I have a student project that I need a RADIUS server in it. I have access to two servers that I have to remotely connect to them (VPN required, of course two servers are on the same network and can see each other always), one is having windows server on it and another one has CentOS 64bit on it. Both are virtual in a company using VMWare tools I believe. I installed freeRadius on CentOS and I performed first tests from the server itself and it's working allright. I added the clients and users that I needed to the configuration files. Here is the problem: Whenever I send a request from a radius client (I tried some testers, and even radtest) to my freeRadius server I get time out, freeRadius is running in dubuging mode and I can see that it doesn't receive any request whether to accept or reject. I tried the windows server on that LAN and my computer which is connected to VPN and can see the freeRadius server. (successful pinging) I used -netstat to see what IPs and ports are listening, the result was 0.0.0.0:1812(udp) so I assume that it is listening to all IPs on 1812. whenever I try to start the server with -i and -p I get the message that server cannot bind on the address that I want because it is already listening to them on another thing. I can start the server with -i 172.16.150.*** which is its own address and -p 1812. I am stocked on this problem for two days, I read all the config files of freeRadius and I tried to make some changes (I revert them later) but none helped cause I think the problem is not there. I assume that server should see all the requests and then decide what to do with them. Any ideas where the problem is? Thank you Saeed Zanderahimi

4 5

Cellular Roaming Accounting
by Gerry Gasca 09 Apr '13

09 Apr '13

I have recently inherited working on a freeRadius on openSUSE server on a cellular implementation. I'll be upfront that my Linux skills are minimal and I know nothing about freeRadius. I don't know what version of freeRadius we are running I was afraid to run radiusd -v because the man page said it would run and exit. This is a production server and I didn't want to risk killing the process. I'll schedule a maintenance window to run that. My issue is I need to implement total data transferred daily logging for a particular realm to implement roaming. My first thought was to get it from the detail files. I can probably write a script to accomplish this but I can't find the RAT-Type attribute in the log entries. I need to break out 1xRTT and EVDO totals for this realm. The Radio Access Technology type would be perfect for this but as I said can't find it in the detail file. I know a little about mysql but not much. It is implemented on this server. Can I pull this data from the radacct table? I thought I might need to implement the rls_counter module. It is not currently implemented. Sorry I have short windows of time to try things on this server so I'm trying to line up as much as I can ahead of time before getting stuck and wasting a maintenance window. Here is a sample start record in the detail file: User-Name = "5558675309(a)companyx.com" NAS-IP-Address = ###.###.###.### Acct-Status-Type = Start Acct-Session-Id = "ecs+xv67" Acct-Delay-Time = 0 Acct-Authentic = RADIUS NAS-Port = 2265 NAS-Port-Type = Virtual Calling-Station-Id = "111115558675309" Framed-Protocol = PPP Framed-IP-Address = ###.###.###.### Event-Timestamp = "Apr 7 2013 00:00:02 EDT" Acct-Input-Octets = 0 Acct-Output-Octets = 0 3GPP2-Correlation-Id = "ecs+yshC" 3GPP2-User-Id = 0 3GPP2-Forward-FCH-Mux-Option = 2337 3GPP2-Reverse-FCH-Mux-Option = 2337 3GPP2-Service-Option = 33 3GPP2-Forward-Traffic-Type = 0 3GPP2-Reverse-Traffic-Type = 0 3GPP2-FCH-Frame-Size = 2 3GPP2-Forward-FCH-RC = 3 3GPP2-Reverse-FCH-RC = 3 3GPP2-IP-Technology = 1 3GPP2-Compulsory-Tunnel-Indicator = 0 3GPP2-PCF-IP-Address = ###.###.###.### 3GPP2-BSID = "14EE00010000" 3GPP2-Home-Agent-IP-Address = 0.0.0.0 3GPP2-Bad-PPP-Frame-Count = 0 3GPP2-Number-Active-Transitions = 0 3GPP2-Terminating-SDB-Octet-Count = 0 3GPP2-Originating-SDB-OCtet-Count = 0 3GPP2-Terminating-Number-SDBs = 0 3GPP2-Originating-Number-SDBs = 0 3GPP2-IP-QoS = 0 3GPP2-Session-Continue = 1 3GPP2-Inbound-Mobile-IP-Sig-Octets = 0 3GPP2-Outbound-Mobile-IP-Sig-Octets = 0 3GPP2-Airlink-Priority = 13 3GPP2-Received-HDLC-Octets = 0 3GPP2-Attr-41 = 0x486a95e1 3GPP2-Module-Orig-Term-Indicator = 0x00000000 3GPP2-Forward-DCCH-Mux-Option = 0 3GPP2-Reverse-DCCH-Mux-Option = 0 3GPP2-Forward-DCCH-RC = 0 3GPP2-Reverse-DHHC-RC = 0 3GPP2-Service-Reference-Id = 0x0104000102040001 3GPP2-DCCH-Frame-Size = 0 3GPP2-Begin-Session = 1 3GPP2-Active-Time = 0 Service-Type = Framed-User Acct-Unique-Session-Id = "efb3ccab5e594101" Stripped-User-Name = "5558675309" Realm = "companyx.com" Timestamp = 1365307202 Request-Authenticator = Verified

2 1

Re: RADIUS shared secret over internet
by Alan Buxey 09 Apr '13

09 Apr '13

RADSEC alan

6 5