Simple Configuration of using passwd-like file, howto needed
Hello All freeradius users I have been trying to get my freeradius to do authentication against a passwd-like file using the passwd module. I'm running FreeRadius 2.1.8 on a Debian 4.0 Server used lenny-backports for the installation. My specific configuration to get this working looks like this Passwd module file filename = /etc/tac-plus/passwd format = *User-Name:User-Password hashsize = 0 delimiter = : authtype = pap the password file looks like this /etc/tac-plus/passwd jmd:TLw0SiK4QfQxg:159:20::/home/jmd:/bin/bash users file DEFAULT NAS-IP-Address == 172.31.254.4 Cisco-AVPair += 'Wireless-WCS:role0=SuperUsers', Cisco-AVPair += 'Wireless-WCS:task0=Users and Groups', Cisco-AVPair += 'Wireless-WCS:task1=Audit Trails', There is no problem in stating the freeradius server The debug output look like this when I try to do an authentication using radtest command rad_recv: Access-Request packet from host 127.0.0.1 port 40466, id=179, length=55 User-Name = "jmd" User-Password = "password" NAS-IP-Address = 172.31.254.4 NAS-Port = 0 Thu Jul 8 15:02:10 2010 : Info: +- entering group authorize {...} Thu Jul 8 15:02:10 2010 : Info: ++[preprocess] returns ok Thu Jul 8 15:02:10 2010 : Info: ++[chap] returns noop Thu Jul 8 15:02:10 2010 : Info: ++[mschap] returns noop Thu Jul 8 15:02:10 2010 : Info: [suffix] No '@' in User-Name = "jmd", looking up realm NULL Thu Jul 8 15:02:10 2010 : Info: [suffix] No such realm "NULL" Thu Jul 8 15:02:10 2010 : Info: ++[suffix] returns noop Thu Jul 8 15:02:10 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Jul 8 15:02:10 2010 : Info: ++[eap] returns noop Thu Jul 8 15:02:10 2010 : Info: [files] users: Matched entry DEFAULT at line 49 Thu Jul 8 15:02:10 2010 : Info: ++[files] returns ok Thu Jul 8 15:02:10 2010 : Info: ++[expiration] returns noop Thu Jul 8 15:02:10 2010 : Info: ++[logintime] returns noop Thu Jul 8 15:02:10 2010 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Thu Jul 8 15:02:10 2010 : Info: ++[pap] returns noop Thu Jul 8 15:02:10 2010 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Thu Jul 8 15:02:10 2010 : Info: Failed to authenticate the user. Thu Jul 8 15:02:10 2010 : Info: Using Post-Auth-Type Reject Thu Jul 8 15:02:10 2010 : Info: +- entering group REJECT {...} Thu Jul 8 15:02:10 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> jmd Thu Jul 8 15:02:10 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jul 8 15:02:10 2010 : Info: ++[attr_filter.access_reject] returns updated Thu Jul 8 15:02:10 2010 : Info: Delaying reject of request 19 for 1 seconds Thu Jul 8 15:02:10 2010 : Debug: Going to the next request Thu Jul 8 15:02:10 2010 : Debug: Waking up in 0.9 seconds. Thu Jul 8 15:02:11 2010 : Info: Sending delayed reject for request 19 Sending Access-Reject of id 179 to 127.0.0.1 port 40466 Thu Jul 8 15:02:11 2010 : Debug: Waking up in 4.9 seconds. Radtest command: radtest jmd password localhost 0 secret I have no clue of what I'm doing wrong !! Please help me Best regards Jan Madsen
Madsen.Jan JMD wrote:
My specific configuration to get this working looks like this
Passwd module file
filename = /etc/tac-plus/passwd
Hmm... there's more to it than that. What did you name the module?
The debug output look like this when I try to do an authentication using radtest command
Shows now "passwd" module listed in the "authorize" section. You need to do that. Alan DeKok.
So I need to change the passwd file name ? Now using : /etc/freeradius/modules/passwd or do I need to do somehting like this in the passwd file Passwd-name { filename = /etc/tac-plus/passwd format = "*User-Name:Password" hashsize = 0 delimiter = : authtype = pap } Best regards Jan Madsen -----Oprindelig meddelelse----- Fra: freeradius-users-bounces+jmd=kmd.dk@lists.freeradius.org [mailto:freeradius-users-bounces+jmd=kmd.dk@lists.freeradius.org] På vegne af Alan DeKok Sendt: 9. juli 2010 09:32 Til: FreeRadius users mailing list Emne: Re: Simple Configuration of using passwd-like file, howto needed Madsen.Jan JMD wrote:
My specific configuration to get this working looks like this
Passwd module file
filename = /etc/tac-plus/passwd
Hmm... there's more to it than that. What did you name the module?
The debug output look like this when I try to do an authentication using radtest command
Shows now "passwd" module listed in the "authorize" section. You need to do that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________________________________________________ KMD A/S, Lautrupparken 40-42, DK-2750 Ballerup, CVR-nr. 26911745 KMD er medlem af IT-Branchen og Dansk Erhverv samt anmeldt til Datatilsynet som edb-servicevirksomhed. KMD er certificeret i henhold til ISO 9001:2000, med Dansk Standard som certificerende organ og er desuden Microsoft Gold Certified Partner og Certificeret SAP Hosting Center. www.kmd.dk www.kundenet.kmd.dk www.organisator.dk www.kmdinternational.com Hvis du har modtaget denne e-mail ved en fejl, bedes du venligst give mig besked herom og slette den. If you received this e-mail by mistake, please notify me and delete it. Thank you.
Madsen.Jan JMD wrote:
So I need to change the passwd file name ? Now using : /etc/freeradius/modules/passwd
or do I need to do somehting like this in the passwd file
Passwd-name {
Something like that. See the "smbpasswd" file for an example of what you need to do. Alan DeKok.
Okay Alan I did like this now More /etc/freeradius/modules/passwd passwd kmdov3 { filename = /etc/tac-plus/passwd format = "*User-Name:Password:::::" hashsize = 0 delimiter = : authtype = pap } This looks very mutch like the smbpasswd file passwd smbpasswd { filename = /etc/smbpasswd format = "*User-Name::LM-Password:NT-Password:SMB-Account-CTRL-TEXT::" hashsize = 100 ignorenislike = no allowmultiplekeys = no } And still I just get a rejected login rad_recv: Access-Request packet from host 127.0.0.1 port 41186, id=97, length=55 User-Name = "jmd" User-Password = "password" NAS-IP-Address = 172.31.254.4 NAS-Port = 0 Fri Jul 9 10:27:18 2010 : Info: +- entering group authorize {...} Fri Jul 9 10:27:18 2010 : Info: ++[preprocess] returns ok Fri Jul 9 10:27:18 2010 : Info: ++[chap] returns noop Fri Jul 9 10:27:18 2010 : Info: ++[mschap] returns noop Fri Jul 9 10:27:18 2010 : Info: [suffix] No '@' in User-Name = "jmd", looking up realm NULL Fri Jul 9 10:27:18 2010 : Info: [suffix] No such realm "NULL" Fri Jul 9 10:27:18 2010 : Info: ++[suffix] returns noop Fri Jul 9 10:27:18 2010 : Info: [eap] No EAP-Message, not doing EAP Fri Jul 9 10:27:18 2010 : Info: ++[eap] returns noop Fri Jul 9 10:27:18 2010 : Info: ++[unix] returns updated Fri Jul 9 10:27:18 2010 : Info: [files] users: Matched entry DEFAULT at line 49 Fri Jul 9 10:27:18 2010 : Info: ++[files] returns ok Fri Jul 9 10:27:18 2010 : Info: ++[expiration] returns noop Fri Jul 9 10:27:18 2010 : Info: ++[logintime] returns noop Fri Jul 9 10:27:18 2010 : Info: ++[pap] returns updated Fri Jul 9 10:27:18 2010 : Info: Found Auth-Type = PAP Fri Jul 9 10:27:18 2010 : Info: +- entering group PAP {...} Fri Jul 9 10:27:18 2010 : Info: [pap] login attempt with password "q1001wqwe123" Fri Jul 9 10:27:18 2010 : Info: [pap] Using CRYPT encryption. Fri Jul 9 10:27:18 2010 : Info: [pap] Passwords don't match Fri Jul 9 10:27:18 2010 : Info: ++[pap] returns reject Fri Jul 9 10:27:18 2010 : Info: Failed to authenticate the user. Fri Jul 9 10:27:18 2010 : Info: Using Post-Auth-Type Reject Fri Jul 9 10:27:18 2010 : Info: +- entering group REJECT {...} Fri Jul 9 10:27:18 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> jmd Fri Jul 9 10:27:18 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Fri Jul 9 10:27:18 2010 : Info: ++[attr_filter.access_reject] returns updated Fri Jul 9 10:27:18 2010 : Info: Delaying reject of request 1 for 1 seconds Fri Jul 9 10:27:18 2010 : Debug: Going to the next request Fri Jul 9 10:27:18 2010 : Debug: Waking up in 0.9 seconds. Fri Jul 9 10:27:19 2010 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 97 to 127.0.0.1 port 41186 Fri Jul 9 10:27:19 2010 : Debug: Waking up in 4.9 seconds. Fri Jul 9 10:27:24 2010 : Info: Cleaning up request 1 ID 97 with timestamp +23 Fri Jul 9 10:27:24 2010 : Info: Ready to process requests. Best regards Jan Madsen -----Oprindelig meddelelse----- Fra: freeradius-users-bounces+jmd=kmd.dk@lists.freeradius.org [mailto:freeradius-users-bounces+jmd=kmd.dk@lists.freeradius.org] På vegne af Alan DeKok Sendt: 9. juli 2010 10:16 Til: FreeRadius users mailing list Emne: Re: SV: Simple Configuration of using passwd-like file, howto needed Madsen.Jan JMD wrote:
So I need to change the passwd file name ? Now using : /etc/freeradius/modules/passwd
or do I need to do somehting like this in the passwd file
Passwd-name {
Something like that. See the "smbpasswd" file for an example of what you need to do. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________________________________________________ KMD A/S, Lautrupparken 40-42, DK-2750 Ballerup, CVR-nr. 26911745 KMD er medlem af IT-Branchen og Dansk Erhverv samt anmeldt til Datatilsynet som edb-servicevirksomhed. KMD er certificeret i henhold til ISO 9001:2000, med Dansk Standard som certificerende organ og er desuden Microsoft Gold Certified Partner og Certificeret SAP Hosting Center. www.kmd.dk www.kundenet.kmd.dk www.organisator.dk www.kmdinternational.com Hvis du har modtaget denne e-mail ved en fejl, bedes du venligst give mig besked herom og slette den. If you received this e-mail by mistake, please notify me and delete it. Thank you.
Madsen.Jan JMD wrote:
I did like this now More /etc/freeradius/modules/passwd passwd kmdov3 {
OK.
And still I just get a rejected login
You need to list "kmdov3" in the "authorize" section. The debug log shows that the module is not being used... therefore the passwords are not being found. Alan DeKok.
Okay thanks alot Alan That was my missing link. I could really not find anything about this on any Docs man or web pages. Your help is really appreciated :D Best regards Jan Madsen -----Oprindelig meddelelse----- Fra: freeradius-users-bounces+jmd=kmd.dk@lists.freeradius.org [mailto:freeradius-users-bounces+jmd=kmd.dk@lists.freeradius.org] På vegne af Alan DeKok Sendt: 9. juli 2010 12:03 Til: FreeRadius users mailing list Emne: Re: SV: SV: Simple Configuration of using passwd-like file, howto needed Madsen.Jan JMD wrote:
I did like this now More /etc/freeradius/modules/passwd passwd kmdov3 {
OK.
And still I just get a rejected login
You need to list "kmdov3" in the "authorize" section. The debug log shows that the module is not being used... therefore the passwords are not being found. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________________________________________________ KMD A/S, Lautrupparken 40-42, DK-2750 Ballerup, CVR-nr. 26911745 KMD er medlem af IT-Branchen og Dansk Erhverv samt anmeldt til Datatilsynet som edb-servicevirksomhed. KMD er certificeret i henhold til ISO 9001:2000, med Dansk Standard som certificerende organ og er desuden Microsoft Gold Certified Partner og Certificeret SAP Hosting Center. www.kmd.dk www.kundenet.kmd.dk www.organisator.dk www.kmdinternational.com Hvis du har modtaget denne e-mail ved en fejl, bedes du venligst give mig besked herom og slette den. If you received this e-mail by mistake, please notify me and delete it. Thank you.
participants (2)
-
Alan DeKok -
Madsen.Jan JMD