December 2005 - Freeradius-Users - lists.freeradius.org

Windows WPA
by Stefan Adams 22 Dec '05

22 Dec '05

Does anyone know how it's possible to log into a windows domain (no local account) from a Windows XP computer using WPA when the user has never logged in before (making cached credentials impossible)? I work at a high school. We have several mobile carts with laptop computers that do NOT have local accounts for each student. Therefore, each student is required to logon to the windows domain using wireless. This works fine using WEP. However, using WPA, with the automatically supply windows username/password/domain checkbox selected, a user that has never logged into that machine before is not able to log on. The Windows computer complains that the domain controller is not available. This, of course, is true because there are no 'up' network interfaces. But wouldn't it be logical for Windows to first supply the entered credentials to the access point for authorization to the WPA WLAN and then supply those same credentials to the domain controller? Is that the way it works, is there some other way, or are people that have never logged on to these laptops before condemned to never logon at all given our new WPA infrastructure? Stefan

2 1

Freeradius Configure Help me
by Kai Geek 22 Dec '05

22 Dec '05

Hello, i am install Slackware 10.2 on freeradius server. root@slackware:/etc/raddb# radiusd Thu Dec 22 12:07:48 2005 : Info: Starting - reading configuration files ... root@slackware:/etc/raddb# what is this mistake ? >From where can i find Radius Install (Configuration) Guide ? Thank you... +-+-+- BEGIN PGP SIGNATURE -+-+-+ Version: GnuPG v1.4.2 (GNU/Linux) ___ / __) Kai "Ozgur" Geek \__ \ PGP ID: B1B63B6E (___/lackware Network Engineer +-+-+-+ END PGP SIGNATURE +-+-+-+ -- _______________________________________________ Check out the latest SMS services @ http://www.linuxmail.org This allows you to send and receive SMS through your mailbox. Powered by Outblaze

3 2

Problem writing config attributes from script
by Ignacio DelTroo 22 Dec '05

22 Dec '05

I'm trying to write an external script for authorization (rlm_exec) I want this script to pass some attributes (beyond clear text Password) in the config attributes, so that another post-auth external script can re-use this information without re-querying the database. It seems that my authorization script cannot write anything beyond Password. IT works fine when it justs output PAssword="XXXX". For instance, if it writes Post-Auth-Type= create_prepaid_account and Password = "XXX" to config attributes, the chap authentication modules does not get anything (log says clear text password not available) Relevant parts of radiusd.conf ========================================================= modules { ........ exec dump { wait = yes program = "/etc/raddb/scripts/dump %{User-Name}" input_pairs = config output_pairs = reply packet_type = Access-Request } exec authorize_prepaid_account { wait = yes program = "/etc/raddb/scripts/authorize %{User-Name}" output_pairs = config packet_type = Access-Request } exec create_prepaid_account { wait = yes program = "/etc/raddb/scripts/new %{User-Name}" input_pairs = config output_pairs = reply packet_type = Access-Request } } authorize { preprocess auth_log chap mschap authorize_prepaid_account files sql dump } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix } post-auth { reply_log create_prepaid_account } ========================================================= What am I doing wrong ? Thanks for your help. Yannick Deltroo

3 7

Re: Multiple accounting hosts for one realm?
by Johan Ramm-Ericson 22 Dec '05

22 Dec '05

On Wed, 2005-12-21 at 22:07 +0100, > Nicolas Baradakis wrote: > Johan Ramm-Ericson wrote: > > > While configuring freeradius 1.0.5 on Solaris 9 I began to look at > > setting up different accounting hosts for users depending on which realm > > users orginated from. That worked fine. However; I have now come across > > a situation where it might be valuable to send the same accounting > > information to multiple accounting hosts. > > > > I am hoping to do this by changing the accthost variable in > > etc/raddb/proxy.conf. Does anyone on the list know if (a) this is > > possible, and if it is possible (b) how to do it - i.e can I add further > > hosts in a list to the existing variable or do I need to use some other > > method? > > You might look at radrelay, it comes with FreeRADIUS. > http://freeradius.org/radiusd/doc/radrelay > > -- > Nicolas Baradakis Ooopps, sorry about that. I thought I'd gone through the documentation, but obviously my search was not thorough enough... Thanks! /Johan

1 0

segmentation fault on solaris,unable to call modules
by Qin Zhen 22 Dec '05

22 Dec '05

Hi All, installing freeradius on Solaris is already a big headache, afterwards i encountered Segmentation fault as well. i am using Freeradius-1.0.5 seems the problem is that it is not able to call any of the modules in radiusd.conf, if i commend up all the modules under 'Authorize' (files, preprocess, ldap, prefix, etc. ) in radiuad.conf, there won't be segmentation faults. and this configuration is able to work for freeradius-0.8 on solaris or freeradius-1.0.5 on debian. pls advise. thanks in advance. below is what the debug mode shows: >> ******************************************************* >> >> Wed Dec 14 10:15:31 2005 : Info: Starting - reading configuration files >> ... >> >> Wed Dec 14 10:15:31 2005 : Debug: reread_config: reading radiusd.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/proxy.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/clients.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/snmp.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: Config: including file: >> /usr/local/radius5/raddb/sql.conf >> >> Wed Dec 14 10:15:31 2005 : Debug: main: prefix = "/usr/local/radius5" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: localstatedir = >> "/usr/local/radius5/var" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: logdir = "/usr/local/radius5/log" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: libdir = "/usr/local/radius5/lib" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: radacctdir = >> "/usr/local/radius5/radacct" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: hostname_lookups = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: max_request_time = 40 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: cleanup_delay = 5 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: max_requests = 5120 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: delete_blocked_requests = 0 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: port = 1645 >> >> Wed Dec 14 10:15:31 2005 : Debug: main: allow_core_dumps = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_stripped_names = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_file = >> "/usr/local/radius5/log/radius.log" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_auth = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_auth_badpass = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: log_auth_goodpass = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: pidfile = >> "/usr/local/radius5/var/run/radiusd.pid" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: user = "radius" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: group = "radius" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: usercollide = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: lower_user = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: lower_pass = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: nospace_user = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: nospace_pass = "no" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: checkrad = >> "/usr/local/radius5/sbin/checkrad" >> >> Wed Dec 14 10:15:31 2005 : Debug: main: proxy_requests = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: retry_delay = 5 >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: retry_count = 3 >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: synchronous = no >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: default_fallback = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: dead_time = 120 >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: post_proxy_authorize = yes >> >> Wed Dec 14 10:15:31 2005 : Debug: proxy: wake_all_if_all_dead = no >> >> Wed Dec 14 10:15:31 2005 : Debug: security: max_attributes = 200 >> >> Wed Dec 14 10:15:31 2005 : Debug: security: reject_delay = 0 >> >> Wed Dec 14 10:15:31 2005 : Debug: security: status_server = no >> >> Wed Dec 14 10:15:31 2005 : Debug: main: debug_level = 0 >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading dictionary >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading naslist >> >> Wed Dec 14 10:15:31 2005 : Info: Using deprecated naslist file. Support >> for this will go away soon. >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading clients >> >> Wed Dec 14 10:15:31 2005 : Debug: read_config_files: reading realms >> >> Wed Dec 14 10:15:31 2005 : Debug: radiusd: entering modules setup >> >> Wed Dec 14 10:15:31 2005 : Debug: Module: Library search path is >> /usr/local/radius5/lib >> >> Segmentation Fault >> >> - List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >

4 9

RADIUS process looping...
by Stefan Adams 21 Dec '05

21 Dec '05

I am sure that this is not related to FreeRADIUS but I have seen the topic posted here so I wanted to post my research for those that search these archives. It appears to be a common problem of having a Windows Client (specifically with the wZc utility) which gets stuck in a loop of constantly verifying authorization and obtaining an IP. I, personally, can see from my radiusd -A -X output that the entire auth/autz process succeeds -- on EVERY pass of the loop. AFTER applying the MS Hotfix KB885453, I still have my clients periodically stuck in a loop (as according to the RADIUS server showing the same debug info over and over). I have found that it appears to be due to my access point (D-Link DWL-3200AP) REBOOTING! Here is what I told my D-Link rep: "These steps help to illustrate the problem: logged into the windows domain. configured the wireless interface for WPA using automatically provided windows credentials successfully and immediately logged on to the wireless WPA network logged out logged back into the windows domain and it successfuly and immediately connected to the WPA network rebooted logged into domain, it took 3 (THREE) minutes to login (using cached credentials) -- This entire time NO connections were made to the RADIUS server after finally logging in I notice that about 40 pings to the AP were dropped before it came back to life and suddenly 260 buffered RADIUS requests were sent to the RADIUS server After the 260th, the windows computer successfully connected to the wpa wireless network It is important to note that DURING a windows domain logon (and simultaneously a connection to the WPA wireless network) the AP REBOOTED." Is my hypothesis correct -- that it is the AP? Do I have enough information to make that determination? To anyone that would like to help me troubleshoot the issue, let me know if I can provide more information or logs or debug output or whatever... BTW, I also have syslog logs (DWL-3200AP can log to a syslogger...) proving that the AP REBOOTED and not just some of my pings were dropped. Stefan Here is my configuration: D-Link DWL-3200AP FW2.10, WPA-Enterprise w/AES, multi-SSID support, VLAN support FreeRADIUS 1.1.0-pre0 (snapshot-20051220) Windows XP SP2, 802.1x, EAP-PEAP, MS-CHAPv2 radiusd.conf: proxy_requests = no $INCLUDE ${confdir}/proxy.conf modules { unix { radwtmp = ${logdir}/radwtmp } mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } ldap { server = "<snip>" identity = "<snip>" password = <snip> basedn = "<snip>" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" tls { ... } access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 auto_header = no access_attr_used_for_allow = yes } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { private_key_password = <snip> private_key_file = /etc/1x/server.pem certificate_file = /etc/1x/server.pem CA_file = /etc/1x/root.pem dh_file = /etc/1x/DH random_file = /etc/1x/random include_length = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes } mschapv2 { } } realm ntdomain { format = prefix delimiter = "\\" } preprocess { : with_ntdomain_hack = no : } } authorize { preprocess ntdomain eap ldap } authenticate { Auth-Type MS-CHAP { mschap } eap } clients.conf: client 172.16.16.0/24 { secret = testing123 shortname = ap } client 172.16.254.0/24 { secret = testing123 shortname = server } proxy.conf: realm LOCAL { type = radius authhost = LOCAL accthost = LOCAL } realm DEFAULT { type = radius authhost = LOCAL accthost = LOCAL } [ If SSID Authorization is desired: modules { ldap { filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusCalledStationId=%{Called-Station-ID}))" } attr_rewrite getssid { attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = packet # Strip the MAC Address out of the Called-Station-ID # Resulting in just the SSID searchfor = ".................:" replacewith = "" ignore_case = yes new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended to th # append = no } } authorize { : eap getssid ldap : } ] Windows XP: Apply this Pre-SP3 Hotfix: http://support.microsoft.com/?kbid=885453 Windows Network Connection Properties: Preferred networks, [SSID] Properties: Association: Network Auth: WPA Data Enc: AES Authentication: EAP Type: PEAP Properties: X Validate Server certificate [You must install the Root CA certificate into the trsuted root ca list and choose it here.] EAP-MS-CHAP v2 Configure: X Automatically use my Windows logon name and Password (IF PC IS JOINED TO DOMAIN) [ ] Automatically use my Windows logon name and Password (IF NOT JOINED) X Enable Fast Reconnect

1 0

Re: Problem with CHAP, users file and radclient
by Andreas Engler 21 Dec '05

21 Dec '05

Hello Alan, >Andreas Engler <freeradius(a)arcor.de> wrote: > > >>> One question remains. Is it possible to resend an auth-detail file with >>> Access-Requests that once where successfully authenticated via radclient >>> and authenticate them successfully again, even if there are >>> Chap-Password and Chap-Challenge attributes in the auth-detail file and >>> so the Auth-Type will be CHAP? >> >> > > I have *no* idea what that means. > > Alan DeKok. > Ok, sorry. I try it with other words and hope the problem becomes clear. I try to test a fresh freeradius 1.0.5 installation. I use radclient to send Access-Request packets, which are stored in a file. These Access-Request packets were loged with an other freeradius server in production environment. These Access-Request packets contain Chap related attributes, so the Auth-Type will be CHAP. When i resend such Access-Request packet via radclient, it will not authenticate successfully again. Where is the problem in that test setup? Thank you Andreas Engler

2 1

Use Client-IP-Address in Hungroups?
by Dennis Skinner 21 Dec '05

21 Dec '05

Hello, First, before I forget again, this link: http://www.freeradius.org/radiusd/doc/ (linked from: http://www.freeradius.org/usage.html) is "Forbidden" and has been for some time. I keep forgetting to mention it when I see it since I just grab the tarball and get the info I need. Anyway, to my question... I read through the docs and man pages regarding huntgroups. All of the examples use items like this: alphen NAS-IP-Address == 192.168.2.5 alphen NAS-IP-Address == 192.168.2.6 Is it possible to do this? network1 Client-IP-Address == 192.168.2.5 network1 Client-IP-Address == 192.168.2.6 network2 Client-IP-Address == 192.168.6.45 network2 Client-IP-Address == 192.168.6.46 If I understand the way huntgroups work, then I think I can add: user Huntgroup := network1 to my radcheck table and restrict user to modems from a particular modem provider (who is proxying radius to us). They add and remove NAS's quite oftem, so using NAS-IP-Address would be painful. Hopefully I am understanding it correctly since it would be somewhat easier than our current method (using a passwd module and regex matching). If anyone has tried it and it definitely won't work with Client-IP-Address, then it will save me several hours testing and running back and forth from the dialup machine. Thanks! -- Dennis Skinner Systems Administrator BlueFrog Internet http://www.bluefrog.com

2 1

rlm_ldap filter problem
by Norbert Wegener 21 Dec '05

21 Dec '05

When I set my vars to the values below, ldapsearch succeeds: server="TDE002.mydomain.NET"^M identity="testrad(a)TDE002.mydomain.NET"^M password="!QAY2wsx3edc4"^M basedn="dc=TDE002,dc=mydomain,dc=NET"^M filter="(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID "^M ^M #ldapsearch -LLL -b "DC=TDE002,dc=mydomain,dc=NET" -s sub $FILTER -x $LOGON ^M ldapsearch -LLL -h $server -b "$basedn" -s sub $filter -x -D $identity -w $password ^M lnxad:/usr/local/etc/raddb # sh x^M dn: CN=26TEF001,OU=CAT-Computers,OU=OU16,OU=MchP,DC=tde002,DC=mydomain,DC=net^M primaryGroupID: 515^M servicePrincipalName: HOST/26TEF001^M servicePrincipalName: HOST/26tef001.tde002.mydomain.net^M ^M # refldap://DomainDnsZones.tde002.mydomain.net/DC=DomainDnsZones,DC=tde002,DC… itest,DC=net^M Having the same variables with the same values set on the same machine in radiusd.conf: ldap ldap1 { server = "tde002.mydomain.net" identity = "testrad(a)TDE002.SITEST.NET" password = "!QAY2wsx3edc4" basedn = "dc=TDE002,dc=SITEST,dc=NET" filter="(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID" ldap_debug=0xFFFF base_filter = "(objectclass=computer)" ldap_connections_number = 5 timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap } radiusd fails to get the values from the ldap server, claiming "Bad search filter": ..... rlm_ldap: performing user authorization for host/26tef001.tde002.mydomain.net radius_xlat: '(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID' radius_xlat: 'dc=TDE002,dc=MYDOMAIN,dc=NET' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=TDE002,dc=MYDOMAIN,dc=NET, with filter (&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID ldap_search put_filter: "(&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID" put_filter: AND put_filter_list "(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))" put_filter: "(servicePrincipalName=host/26tef001.tde002.mydomain.net)" put_filter: simple put_simple_filter: "servicePrincipalName=host/26tef001.tde002.mydomain.net" put_filter: "(objectclass=computer)" put_filter: simple put_simple_filter: "objectclass=computer" put_filter: "(!(userAccountControl:1.2.840.113556.1.4.803:=2))" put_filter: NOT put_filter_list "(userAccountControl:1.2.840.113556.1.4.803:=2)" put_filter: "(userAccountControl:1.2.840.113556.1.4.803:=2)" put_filter: simple put_simple_filter: "userAccountControl:1.2.840.113556.1.4.803:=2" put_filter: default put_simple_filter: "servicePrincipalName primaryGroupID" rlm_ldap: ldap_search() failed: Bad search filter: (&(servicePrincipalName=host/26tef001.tde002.mydomain.net)(objectclass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) servicePrincipalName primaryGroupID ldap_msgfree rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns fail for request 2 modcall: leaving group authorize (returns fail) for request 2 There was no response configured: rejecting request 2 Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 206 with timestamp 43942d52 Sending Access-Reject of id 207 to 222.25.36.124 port 1645 What did I forget to obey? Thanks Norbert Wegener

2 2

rlm_ldap behavior: authorize v.s. authenticate
by Brian A. Seklecki 21 Dec '05

21 Dec '05

>From reading debug logs, am I correct in concluding that rlm_ldap's behavior: - when processing authorize{ } is to bind to the LDAP as the provided administrative DN and search for the DN of the user in the Access-Request packet - when processing authenticate{ } is to, if successful during authorize, then re-bind to the LDAP using the provided username and password and return Access-Accept only if the bind-as-the-user succeeds? Correct, as the default behavior? ~BAS

3 4