- Freeradius-Users - lists.freeradius.org

another CHAP issue
by Nick 16 Aug '12

16 Aug '12

Hi, I have recently installed freeradius and am having some trouble authenticating a test adsl user. The users file is default plus the following additions:- DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP, Tunnel-Type == L2TP, Tunnel-Medium-Type == IP, Service-Type = Framed-User, Tunnel-Password = blahblah, Tunnel-Server-Endpoint = 192.168.0.1, Tunnel-Client-Auth-ID = Tunnel-21CN, Fall-Through = Yes testuser(a)randomdomain.net.uk Cleartext-Password :="test123", NAS-IP-Address == 1.1.1.1 Service-Type = Framed-User, Framed-Protocol = PPP, Framed-IP-Address = 10.1.1.1, Framed-IP-Netmask = 255.255.255.255, Cisco-AVPair = "ip:dns-servers=8.8.8.8" Ready to process requests. rad_recv: Access-Request packet from host 62.249.192.164 port 31625, id=13, length=145 Framed-Protocol = PPP User-Name = "testuser(a)randomdomain.net.uk" CHAP-Password = 0x027bcf494903b89f4cda018f7c8af60ce1 Connect-Info = "14292000/1000" NAS-Port-Type = ISDN NAS-Port = 21337 NAS-Port-Id = "Uniq-Sess-ID1337" Service-Type = Framed-User NAS-IP-Address = 62.249.255.146 Calling-Station-Id = "WBC BBEU00014378" # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "randomdomain.net.uk" for User-Name = "testuser(a)randomdomain.net.uk" [suffix] No such realm "randomdomain.net.uk" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "testuser(a)randomdomain.net.uk" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser(a)randomdomain.net.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 13 to 62.249.192.164 port 31625 Waking up in 4.9 seconds. Cleaning up request 0 ID 13 with timestamp +4 Ready to process requests. The main thing that strikes me is the below:- [chap] login attempt by "testuser(a)randomdomain.net.uk" with CHAP password [chap] Cleartext-Password is required for authentication ++[chap] returns invalid There is a Cleartext-Password set so unsure why this error is occurring. Any help most appreciated.

3 3

LDAP and FreeRadius
by Sonny Taberman 16 Aug '12

16 Aug '12

Hi everyone. This is my first post to this list. I have set up freeradius (V2.1.12) together with openldap (V2.4.31) and so with some success I think. But I have to say that setting this up using only users-file was a breeze. Setting up freeradius with ldap not so simple. I am using cleartext password in ldap. I am not using any special schema for freeradius in my ldap-setup. My problem is something I noticed many other users has struggled with and that is this part from my debug output: ++[pap] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} So you say what is the problem, the solution is in your debug message? I have to say it's not. I can't find where to modify my config so this message does not repeat in my log/debug. So please what do I have to do to get rid of this problem? /Sonny

4 14

Access reject problem
by Arvind Gupta 16 Aug '12

16 Aug '12

Hi I have configured RADIUS server in windows server 2008 R2 as mentioned in below link. http://docs.openvpn.net/how-to-tutorialsguides/administration/configuring-a… After that running radexample.c as it is available in free-radius client framework, but getting access reject error. I verified that what user I am using to authenticate is available in groups which is configured there. I am not getting any idea that why I am getting access reject (PW_ACCESS_REJECT) error. any help in this issue will be very helpful to me. Thanks Arvind Kumar Gupta

2 1

Problem with crypt passwords matching
by Robert Haskins 16 Aug '12

16 Aug '12

I am running Freeradius 2.1.12 on a Centos box. I am able to authenticate from the server command line, and from a Cisco ASR1k BRAS via the command line. However, when I attempt to authenticate customers from the DSL network, I get a reject, even though the crypt'd passwords match! Here is a sample from a trace: rad_recv: Access-Request packet from host 204.111.5.9 port 1645, id=235, length=89 Framed-Protocol = PPP User-Name = "k143rott" User-Password = "k*****" NAS-Port-Type = Virtual NAS-Port = 0 NAS-Port-Id = "0/0/0/304" Service-Type = Framed-User NAS-IP-Address = 204.111.5.9 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "k143rott", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "k143rott" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry DEFAULT at line 169 [files] users: Matched entry DEFAULT at line 172 [files] users: Matched entry DEFAULT at line 186 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "krt444" [pap] Using CRYPT password "*3u.3LS/VKTOVc" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Login incorrect (rlm_pap: CRYPT password check failed): [k143rott/k*****] (from client va-edbg-bras-1 port 0) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> k143rott attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 30 for 1 seconds Going to the next request Sending delayed reject for request 21 Sending Access-Reject of id 227 to 204.111.5.9 port 1645 The crypt'd password ("*3u.3LS/VKTOVc") is exactly what is in the /etc/shadow file. So I am confident the shared secret is correct. What am I doing wrong? -- Haskins Family Farm Middletown, VA web: http://www.haskinsfamilyfarm.com FB: http://www.facebook.com/pages/Middletown-VA/Haskins-Family-Farm/114984971161

5 5

Multiple incoming requests from unknown clients
by Diego Matute 14 Aug '12

14 Aug '12

Looked at the docs and am still unclear here. What is the best practice for handling incoming requests which require different policies (i.e. secret keys) whereby the client IP is unknown? Was thinking there may be a to setup virtual servers which listen on different server IPs somehow? Few thoughts: - route based on client configured DNS: SOMEPREFIX.mydomain.com - accept all and pass other RADIUS attributes down (not preferred) Thanks, Diego

4 12

Disable PEAP-TLS but allow PEAP
by Cotton, Jesse 14 Aug '12

14 Aug '12

We need to use a public certificate for PEAP b/c the majority of our clients are not on our domain. However I do not want to allow EAP-TLS with any cert signed by the 3rd party CA. Is it possible to prevent PEAP-TLS with a cert but allow PEAP? If so, what config options do I need to add and where? I've read several posts about this and none have been helpful. Jesse

5 6

Per-realm post-proxy
by Shaun Lowry 14 Aug '12

14 Aug '12

Is it possible to have a per-realm post-proxy section? We need to add a couple of attributes to our Access-Accepts which vary in content depending on which realm we've proxied. Otherwise, is there an easy way to distinguish realm in the global post-proxy section? Shaun.

4 3

rlm_sql Error
by Antonio Modesto 14 Aug '12

14 Aug '12

Hi, Here in the ISP which I work we have a Freeradius 1.X in production, and a 2.X that we're testing to replace the old one. On both Radius we get the following error sometimes, What can be causing this? The SQL Database is in the same server of freeradius 1.X, but the load is low, we have about 2500 subscribers. I was thinking about increasing the number of sql connections, which is set to 4, would it make any difference? Database server load: load averages: 1.10, 1.05, 1.03 Error: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Thanks in advance.

6 7

Problem with accounting insert into Oracle
by Aurélien Lafranchise 14 Aug '12

14 Aug '12

Hi Alan, Thanks for the answer. I need all these data so it is not a clean problem. But I will disable sqltrace when everything will be ok. Could you be more precise on where to increase the 2K limit ? Cheers, AL Aurélien Lafranchise wrote: > I have the same error for every request in dialup.conf (STOP, START, UPDATE). > > The database connection is working well but I have: > [sql] Couldn't insert SQL accounting STOP record - ORA-01756: quoted string not properly terminated > > with sqltrace on you can see the mistake at the end. The request seems to be truncated: Yes. You can't put infinie amounts of data into the SQL query. The limit is ~2K or so. > Any idea ? Is there a global option for the maximum number of characters for a request ? It's limited in the SQL module. You've edited the configuration to log tons of data. This generally isn't useful, or necessary. Fix that, or edit the SQL module to allow more than 2K of data in the expansion. Alan DeKok.

3 6

Problem with accounting insert into Oracle
by Aurélien Lafranchise 13 Aug '12

13 Aug '12

Hi, I have the same error for every request in dialup.conf (STOP, START, UPDATE). The database connection is working well but I have: [sql] Couldn't insert SQL accounting STOP record - ORA-01756: quoted string not properly terminated with sqltrace on you can see the mistake at the end. The request seems to be truncated: INSERT into radacct (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, IMSI_3GPP, ChargingID_3GPP, PDPType_3GPP, ChargingGwAddress_3GPP, GPRSNegotiatedQoSprofile_3GPP, SGSNAddress_3GPP, GGSNAddress_3GPP, IMSIMCCMNC_3GPP, GGSNMCCMNC_3GPP, NSAPI_3GPP, SessionStopIndicator_3GPP, SelectionMode_3GPP, ChargingCharacteristics_3GPP, ChargingGwIPv6Address_3GPP, SGSNIPv6Address_3GPP, GGSNIPv6Address_3GPP, IPv6DNSServers_3GPP, SGSNMCCMNC_3GPP, TeardownIndicator_3GPP, IMEISV_3GPP, RATType_3GPP, MSTimeZone_3GPP, CamelChargingInfo_3GPP, PacketFilter_3GPP, NegotiatedDSCP_3GPP, AllocateIPType_3GPP) VALUES('', 'D4090646343006F3', '64e5c1c4162df0d5', '447937700458', '', '10.100.100.3', '', 'Ethernet', NULL, TO_DATE('2012-08-13 11:35:27','yyyy-mm-dd hh24:mi:ss'), '74', 'RADIUS', '', '', '679' + ('0' * 4294967296), '83' + ('0' * 4294967296), 'internet.mbqt.net', '447937700458', 'User-Request', 'Framed-User', 'GPRS-PDP-Context', '10.73.248.60', '0', '0', '234507089001283', '875562739', '0', '', '98-1B631F', '80.10.0.97', '212.9.6.70', '23450', '', '5', '255', '0', '0800', '', '', '', '', '20801', '', '', '2', '; but in the dialup.conf file it is ok: accounting_stop_query_alt = "INSERT into ${acct_table2} (RadAcctId, AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay, IMSI_3GPP, ChargingID_3GPP, PDPType_3GPP, ChargingGwAddress_3GPP, GPRSNegotiatedQoSprofile_3GPP, SGSNAddress_3GPP, GGSNAddress_3GPP, IMSIMCCMNC_3GPP, GGSNMCCMNC_3GPP, NSAPI_3GPP, SessionStopIndicator_3GPP, SelectionMode_3GPP, ChargingCharacteristics_3GPP, ChargingGwIPv6Address_3GPP, SGSNIPv6Address_3GPP, GGSNIPv6Address_3GPP, IPv6DNSServers_3GPP, SGSNMCCMNC_3GPP, TeardownIndicator_3GPP, IMEISV_3GPP, RATType_3GPP, MSTimeZone_3GPP, CamelChargingInfo_3GPP, PacketFilter_3GPP, NegotiatedDSCP_3GPP, AllocateIPType_3GPP) \ VALUES('', '%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{SQL-User-Name}', '%{Realm}', \ '%{NAS-IP-Address}', '%{NAS-Port-Id}', '%{NAS-Port-Type}', NULL, TO_DATE('%S','yyyy-mm-dd hh24:mi:ss'), \ '%{Acct-Session-Time}', '%{Acct-Authentic}', '', '%{Connect-Info}', \ '%{Acct-Input-Octets}' + ('%{%{Acct-Input-Gigawords}:-0}' * 4294967296), \ '%{Acct-Output-Octets}' + ('%{%{Acct-Output-Gigawords}:-0}' * 4294967296), \ '%{Called-Station-Id}', '%{Calling-Station-Id}', '%{Acct-Terminate-Cause}', '%{Service-Type}', \ '%{Framed-Protocol}', '%{Framed-IP-Address}', '0', '%{Acct-Delay-Time:-0}', '%{3GPP-IMSI}', '%{3GPP-Charging-ID}', '%{3GPP-PDP-Type}', '%{3GPP-Charging-Gateway-Address}', '%{3GPP-GPRS-Negotiated-QoS-profile}', '%{3GPP-SGSN-Address}', '%{3GPP-GGSN-Address}', '%{3GPP-IMSI-MCC-MNC}', '%{3GPP-GGSN-MCC-MNC}', '%{3GPP-NSAPI}', '%{3GPP-Session-Stop-Indicator}', '%{3GPP-Selection-Mode}', '%{3GPP-Charging-Characteristics}', '%{3GPP-Charging-Gateway-IPv6-Address}', '%{3GPP-SGSN-IPv6-Address}', '%{3GPP-GGSN-IPv6-Address}', '%{3GPP-IPv6-DNS-Servers}', '%{3GPP-SGSN-MCC-MNC}', '%{3GPP-Teardown-Indicator}', '%{3GPP-IMEISV}', '%{3GPP-RAT-Type}', '%{3GPP-MS-TimeZone}', '%{3GPP-Camel-Charging-Info}', '%{3GPP-Packet-Filter}', '%{3GPP-Negotiated-DSCP}', '%{3GPP-Allocate-IP-Type}')" Any idea ? Is there a global option for the maximum number of characters for a request ? Cheers Aurélien Lafranchise

2 2