December 2005 - Freeradius-Users - lists.freeradius.org

RE: FreeRadius cannot Authenticate to Windows AD
by Alhagie Puye 19 Dec '05

19 Dec '05

Michael, Try querying Active Directory with the "ldapsearch" utility. Here is an example. ldapsearch -LLL -h 1.2.3.4 -x -b 'dc=domain,dc=com' '(samaccountname=backops)' -D backops -w passofbackops This will make sure that the credentials are correct or not. Alhagie Puye - Network Engineer Datawave Group of Companies (604)295-1817 > >-----Original Message----- > >From: freeradius-users-bounces(a)lists.freeradius.org > >[mailto:freeradius-users-bounces@lists.freeradius.org] On > >Behalf Of Phil Mayers > >Sent: December 16, 2005 1:55 AM > >To: FreeRadius users mailing list > >Subject: Re: FreeRadius cannot Authenticate to Windows AD > > > >Michael Calizo wrote: > >> Hi, > >> > >> Same thing has happened, I still can not authenticate to > >WindowsAD. > >> Same Error is displayed when i debug radiusd.... > >> > >> I put quotes arround password.. > >> > >> radtest user 'mypass' 192.168.1.1:1812 > ><http://192.168.1.1:1812> 1812 > >> testing123 > >> or > >> radtest user 'mypass' 192.168.1.1:1812 > ><http://192.168.1.1:1812> 1812 > >> testing123 > >> > >> > >> What do you think is the problem? > >rlm_ldap: bind as > >cn=backops,cn=Admin,dc=domain,dc=com/passofbackops to > >192.168.1.1:389 > >rlm_ldap: waiting for bind result ... > >rlm_ldap: LDAP login failed: check identity, password > >settings in ldap section of radiusd.conf > > > >...that's pretty clear. The "identity"/"password" combo you > >have is wrong. Or AD thinks it's wrong. > >- > >List info/subscribe/unsubscribe? See > >http://www.freeradius.org/list/users.html > > This message (including any attachments) is confidential, may be privileged and is only intended for the person to whom it is addressed. If you have received it by mistake please notify the sender by return e-mail and delete this message from your system. Any unauthorized use or dissemination of this message in whole or in part is strictly prohibited. E-mail communications are inherently vulnerable to interception by unauthorized parties and are susceptible to change. We will use alternate communication means upon request.

5 6

Re: Freeradius-Users Digest, Vol 8, Issue 82
by Stefan Adams 19 Dec '05

19 Dec '05

Hey, guys! Thanks for the great replies!! I like what you suggested better than what I've come up with in the mean time. I think what I came up with will work, it just seems messy/wrong/inefficient. What do you think? modules { ldap { : filter = "(&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=%{Called-Station-ID}))" : } attr_rewrite getssid { attribute = Called-Station-Id searchin = packet searchfor = ".................:" replacewith = "" ignore_case = yes new_attribute = no } } authorize { # for WinXP, 802.1x, EAP-PEAP, MS-CHAPv2 preprocess eap getssid ldap } This cuts off the first 17 bytes and then a colon of the Called-Station-ID (My AP transmits a dash separated MAC followed by a colon and then the SSID). Then it uses this rewritten Called-Station-ID and uses that as a filter in the LDAP search. Therefore, if the SSID a user tries to connect to is not listed as an attribute of the user's LDAP object, the user is denied. Does that make sense? But I am definitely going to try implementing the suggestions from Dusty and Alan (below). Thanks, guys!! Stefan > Date: Mon, 19 Dec 2005 11:02:33 -0500 (EST) > From: Dusty Doris <freeradius(a)mail.doris.cc> > Subject: Re: Authorization > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20051219104900.T19542(a)mail.doris.name> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > > Let's say I have 2 groups: students and faculty. > > I want to authorize authenticated members of the LDAP group > > cn=students,ou=Groups IFF their Access-Request Called-Station-ID =~ > > "/:StudentWLAN$/" > > I want to authorize authenticated members of the LDAP group > > cn=faculty,ou=Groups IFF their Access-Request Called-Station-ID =~ > > "/:FacultyWLAN$/" > > > You left out your ldap part? Anyway it should look something like this. > > groupname_attribute = cn > groupmembership_filter = "(&(objectclass=GroupOfNames)(member=%{Ldap-UserDN}))" > > Of course you'll have to change that to fit with how your directory is > structured. Once you've got that part down, then in the users file you > could do something like this. > > DEFAULT Called-Station-ID =~ "/:StudentWLAN$/", Ldap-Group == "students" > > DEFAULT Called-Station-ID =~ "/:FacultyWLAN$/", Ldap-Group == "faculty" > > DEFAULT Auth-Type := Reject > > That would look to see if Called-Station-ID matches that regex. If so, it > would look to see if they are in the Ldap-Group of students. Your > groupmembership filter and groupname_attribute should look for a group > named cn=students and then see if the DN of the user is in it. > > If not, it would fall through to the Reject statement. Now, there are > other things going on outside of ldap that I don't really know about, so a > copy/paste of what I wrote might not work. But, it should help lead you > in the right direction. > > I'd give it a shot running in debug mode (radiusd -X) and then you can see > the exact queries that are taking place and what is happening. You can > then go back and modify those ldap group statements and the users file to > fit what you need. > > Once you've got it started if you need more help, please post debug output > and what you would expect vs what you got and we can probably help sort it > out. > > ------------------ > > Message: 6 > Date: Mon, 19 Dec 2005 11:47:24 -0500 > From: "Alan DeKok" <aland(a)ox.org> > Subject: Re: Authorization > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20051219164724.55C0717115(a)mail.nitros9.org> > > Stefan Adams <stefan(a)borgia.com> wrote: > > I have read all the man pages and /docs and am having a difficult time > > understanding the authorization. I keep wanting to write > > "if...elseif...else" stuff but I'm pretty sure that doesn't apply to > > FreeRADIUS config files. > > Unfortunately, yes. > > > How would I configure the checkval module? Is it even necessary to use the > > checkval module? How would I conifgure the users file? Is the users file > > even necessary? > > I wouldn't configure the checkval module. Just the "users" module, > something like: > > DEFAULT LDAP-Group == faculty, Called-Station-Id != "faculty", Auth-Type := Reject > > DEFAULT LDAP-Group == students, Called-Station-Id != "students", Auth-Type := Reject > > > P.S. I don't know who to direct compliments to, but the FreeRADIUS code is > > probably the most beautifully structured source code I have ever read. It > > is SO easy to read and extremely consistent! It's phenomenal! > > You can thank everyone who contributed so far. :) > > Alan DeKok.

2 1

Segmentation fault in 1.1.0-pre0
by Norbert Wegener 19 Dec '05

19 Dec '05

freeradius-1.1.0-pre0 crashes, when sending an Sending Access-Accept: Program received signal SIGSEGV, Segmentation fault. 0x4027ae77 in memset () from /lib/i686/libc.so.6 (gdb) bt #0 0x4027ae77 in memset () from /lib/i686/libc.so.6 #1 0x00000020 in ?? () #2 0x401f83eb in rad_vp2attr (packet=0x0, original=0x0, secret=0x0, vp=0x0, ptr=0x0) at radius.c:256 #3 0x00000000 in ?? () (gdb) The complete output of radiusd -AX is available at: http://www.wegener-net.de/fr/typescript Norbert Wegener

2 2

RE: (no subject)
by Bohannan, Chad W 19 Dec '05

19 Dec '05

Yes (using 802.1x or some other protocol) Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of debik Sent: Tuesday, December 13, 2005 6:15 PM To: FreeRadius users mailing list Subject: (no subject) Isit posible to authenicate users on LAN with freeradius, without any Access Point ? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Authorization
by Stefan Adams 19 Dec '05

19 Dec '05

I have read all the man pages and /docs and am having a difficult time understanding the authorization. I keep wanting to write "if...elseif...else" stuff but I'm pretty sure that doesn't apply to FreeRADIUS config files. In the radiusd.conf there is documentation on how to use checkval to compare against caller-id. That's exactly what I want to do, but I can't figure out how to *use* it. Let's say I have 2 groups: students and faculty. I want to authorize authenticated members of the LDAP group cn=students,ou=Groups IFF their Access-Request Called-Station-ID =~ "/:StudentWLAN$/" I want to authorize authenticated members of the LDAP group cn=faculty,ou=Groups IFF their Access-Request Called-Station-ID =~ "/:FacultyWLAN$/" All my users are authenticated against LDAP. If the user enters the correct username/password (as accepted by LDAP), the user should be able to associate to the WLAN, but only to the WLAN of which he/she is allowed. Students can connect to the StudentWLAN; Faculty can connect to the FacultyWLAN. How would I configure the checkval module? Is it even necessary to use the checkval module? How would I conifgure the users file? Is the users file even necessary? Just to show what I've got config'd at the moment... Using the config below, I am able to successfully allow users to join the WLAN using WPA and EAP-PEAP from Windows XP SP2. But again, the user should not be able to join just any ol' LAN. If anyone has any experience with using checkval or doing caller-id type activities, I'd love to read how you did it! P.S. I don't know who to direct compliments to, but the FreeRADIUS code is probably the most beautifully structured source code I have ever read. It is SO easy to read and extremely consistent! It's phenomenal! And no, I can't answer my question myself just cuz I read the code... ;) But it's helped me to get this far!! authorize { # for WinXP, 802.1x, EAP-PEAP, MS-CHAPv2 preprocess eap files ldap checkval } authenticate { # for WinXP, 802.1x, EAP-PEAP, MS-CHAPv2 Auth-Type MS-CHAP { mschap } eap } modules { mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } ldap { <snip> } eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { private_key_password = <snip> private_key_file = /etc/1x/server.pem certificate_file = /etc/1x/server.pem CA_file = /etc/1x/root.pem dh_file = /etc/1x/DH random_file = /etc/1x/random include_length = yes } peap { default_eap_type = mschapv2 } mschapv2 { } } } I have NOTHING in users at this moment.

3 2

Memory big problem
by Dmitry V. Pleganoff 19 Dec '05

19 Dec '05

Thanks for corrections, valgrind has shown MUCH less losses. ==9603== 21 bytes in 1 blocks are definitely lost in loss record 27 of 124 ==9603== at 0x1B90659D: malloc (vg_replace_malloc.c:130) ==9603== by 0x1D1A8E1F: ldap_instantiate (rlm_ldap.c:429) ==9603== by 0x80568A6: find_module_instance (modules.c:314) ==9603== by 0x8057192: setup_modules (modules.c:888) ==9603== by 0x80560A0: read_mainconfig (mainconfig.c:1088) ==9603== by 0x805976F: main (radiusd.c:281) ==9603== ==9603== ==9603== 45 bytes in 6 blocks are definitely lost in loss record 44 of 124 ==9603== at 0x1B90659D: malloc (vg_replace_malloc.c:130) ==9603== by 0x1BB4708F: strdup (in /lib/tls/libc-2.3.2.so) ==9603== by 0x804ECF2: cf_item_parse (conffile.c:747) ==9603== by 0x80562AF: read_mainconfig (mainconfig.c:884) ==9603== by 0x805976F: main (radiusd.c:281) ==9603== ==9603== ==9603== 492 (108 direct, 384 indirect) bytes in 3 blocks are definitely lost in loss record 64 of 124 ==9603== at 0x1B90659D: malloc (vg_replace_malloc.c:130) ==9603== by 0x1BBB6EE6: (within /lib/tls/libc-2.3.2.so) ==9603== by 0x1BBB6788: __nss_database_lookup (in /lib/tls/libc-2.3.2.so) ==9603== by 0x1BE0A797: ??? ==9603== by 0x1BB76A4B: getgrnam_r (in /lib/tls/libc-2.3.2.so) ==9603== by 0x1BB76170: getgrnam (in /lib/tls/libc-2.3.2.so) ==9603== by 0x80554AA: switch_users (mainconfig.c:501) ==9603== by 0x8055FDC: read_mainconfig (mainconfig.c:1016) ==9603== by 0x805976F: main (radiusd.c:281) ==9603== ==9603== ==9603== 340 bytes in 5 blocks are possibly lost in loss record 81 of 124 ==9603== at 0x1B906F75: calloc (vg_replace_malloc.c:175) ==9603== by 0x1B8F2678: (within /lib/ld-2.3.2.so) ==9603== by 0x1B8F294B: _dl_allocate_tls (in /lib/ld-2.3.2.so) ==9603== by 0x1B93E24A: allocate_stack (in /lib/tls/libpthread-0.60.so) ==9603== by 0x1B93DC54: pthread_create@@GLIBC_2.1 (in /lib/tls/libpthread-0.60.so) ==9603== by 0x805CD6C: spawn_thread (threads.c:703) ==9603== by 0x805CFDD: thread_pool_init (threads.c:878) ==9603== by 0x80597EB: main (radiusd.c:391) ==9603== ==9603== LEAK SUMMARY: ==9603== definitely lost: 174 bytes in 10 blocks. ==9603== indirectly lost: 384 bytes in 32 blocks. ==9603== possibly lost: 340 bytes in 5 blocks. ==9603== still reachable: 1554785 bytes in 25099 blocks. ==9603== suppressed: 0 bytes in 0 blocks.

6 6

phpMyPrepaid: Carl's radiusd.conf lost?
by Ariel Molina R 17 Dec '05

17 Dec '05

Hi, Does any of you have a copy of radiusd.conf? Carl's site is down. http://cpete.com/prepaidAdmin/ http://jabali.net/~carl I've succesfully got phpMyPrepaid up and running (downloaded it from SF), also, i have installed Freeradius and chilli, the only thing I need is the radiusd.conf file that i cant get from anywhere. Thanks in advance.

1 0

Problem : RadClient : no response from server for ID 77
by yao guoxian 17 Dec '05

17 Dec '05

I have installed FreeRadius 1.0.5 on the machine which has the Redhat 9 os. I entered" Radtest test test localhost 0 testing123" to check if i had installed FreeRdius correctly and just find the following message: Sending Access-Request of id 77 to 127.0.0.1:1812 User-Name = "test" User-Password = "test" NAS-IP-Address = redhat NAS-Port = 0 Re-sending Access-Request of id 77 to 127.0.0.1:1812 User-Name = "test" User-Password = "\002*\362\230y\233\002\221?\250\027x\027\370\3608" NAS-IP-Address = redhat NAS-Port = 0 ....... Re-sending Access-Request of id 77 to 127.0.0.1:1812 User-Name = "test" User-Password = "\002*\362\230y\233\002\221?\250\027x\027\370\3608" NAS-IP-Address = redhat NAS-Port = 0 radclient: no response from server for ID 77 I don't know what is wrong with it , is it because I need to configer the switch and router? For the machines in my room are conected to the Cisco switch 2900 series and connected through it to the internet. I apprieate your any help!

2 1

No Reply Proxy for Accounting Requests
by David Bickle 17 Dec '05

17 Dec '05

Does anyone know how to configure a proxy for the forwarding of no reply accounting requests? In particular I am interested in accounting start/stop packets. Thanks,

3 3

RADIUS packet did not have correct Message-Authenticator
by Norbert Wegener 17 Dec '05

17 Dec '05

I do an eap/tls authentication and after that an ad search. This works so far. But when setting the groupmembership in the ldap1 section, there are problems. I do not see the usual eap messages flying around, but nevertheless radius sends an Access-Accept: rlm_ldap::ldap_groupcmp: User found in group 515^M rlm_ldap: ldap_release_conn: Release Id: 0^M users: Matched entry DEFAULT at line 25^M modcall[authorize]: module "files" returns ok for request 0^M modcall: leaving group authorize (returns updated) for request 0^M rad_check_password: Found Auth-Type Accept^M rad_check_password: Auth-Type = Accept, accepting the user^M Sending Access-Accept of id 0 to 149.246.133.44 port 32770^M Tunnel-Type:0 = VLAN^M Tunnel-Medium-Type:0 = 802^M Tunnel-Private-Group-Id:0 = "Core1"^M Finished request 0^M On the client side, where I have eapol_test, I get an error: STA 00:00:00:00:00:02: Received RADIUS packet matched with a pending request, round trip time 0.24 sec No Message-Authenticator attribute found Incoming RADIUS packet did not have correct Message-Authenticator - dropped STA 00:00:00:00:00:02: No RADIUS RX handler found (type=0 code=2 id=0) - dropping packet This is from my radiusd.conf: When it is there, radius sends an Access-Accept. ldap ldap1 { server = "globalcatalogue" port = 3268 #global catalogue server identity = "testrad(a)TDE002.MYDOM.NET" password = "mypass" basedn = "dc=MYDOM,dc=NET" filter = "(&(servicePrincipalName=%{Stripped-User-Name:-%{User-Name}})(objectClass=computer)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))" ldap_debug= 0xFFFF timeout = 40 timelimit = 30 net_timeout = 10 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap groupmembership_attribute = "primaryGroupID" } authorize { preprocess eap ldap1 { notfound = reject } files } The complete output of radius -AX is lengthy and therefore nor included. It can be found at: http://www.wegener-net.de/fr/bad-group , where the error occurs, http://www.wegener-net.de/fr/ok-nogroup , where the authentication works as expected. As mentioned above, the only difference in the configuration is the use of groupmembership. Any hints are really appreciated. Thanks Norbert Wegener

3 5