December 2005 - Freeradius-Users - lists.freeradius.org

dictionary: adding MONTHLY-TIME-LIMIT
by don 06 Dec '05

06 Dec '05

Hi, I am trying to add MONTHLY-TIME-LIMIT to the freeradius dictionary. I will be using this parameter in the radreply table of the freeradius database. Exactly how do I add this to the freeradius dictionary? Sincerely, Don James

1 0

freeradius + LAN + auth + bandwidth (+ PPPOE?)
by TwoMan 06 Dec '05

06 Dec '05

Hi All, I would like to use radius to authenticate our users (using desktop pcs) on our lan, and give them access to internet based on their authentication data. (to give them bandwidth). I am planning it using a pppoe server, and then our users will use a pppoe client (eg. rasppoe) to make the connection. Clients can be linux,w9x,w2k,wxp Is it a good plan? :) If there's a better solution, could You tell me what it is? Which pppoe server is good enough to use for large number of users? (eg. Roaring Pengiuns' RP-PPPoE server?) How can I control their bandwidth? I could successfully install freeradius wisth myql backend, and I can use this to authenticate our wifi users, so, the basics of freeradius is ok. But this time I have to authenticate lan users with oridnary ethernet network card. Thx TM

2 1

persistent ldap connection
by Alexei Vasilyev 06 Dec '05

06 Dec '05

Freeradius uses persistent ldap connection. There are many reasons for this. But we have freeradius installed on server in dmz, and ldap-server in inside-zone. It is used just for vpn (1-2 times per day). Cisco PIX destroyes not used connections, so freeradius need to reconnect to ldap server. But freeradius detects lost connection for 5 minutes: Tue Dec 6 03:40:33 2005 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Tue Dec 6 03:43:03 2005 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Tue Dec 6 03:45:33 2005 : Error: rlm_ldap: ldap_search() failed: Timed out while waiting for server to respond. Please increase the timeout. Tue Dec 6 03:46:45 2005 : Error: rlm_ldap: ldap_search() failed: LDAP connection lost. Tue Dec 6 03:46:45 2005 : Info: rlm_ldap: Attempting reconnect How can I configure freeradius to reconnect to LDAP for each request? Thanks. -- Best regards, Alexei Vasilyev

2 1

RE: 802.1x ldap tls
by Paolo Barbato 06 Dec '05

06 Dec '05

Hi list, just to share my solution. Now I've both TTLS+PAP+LDAP and PEAP+MSCHAP+LDAP work. My LDAP server lives on CommunigatePro, and store password in various mode. This is not a problem for bind operation (TTLS+PAP), but have to be configured specifically for ldap search, method used by PEAP+MSCHAP. So problem didn't live in Freeradius. Regards, Paolo. >Still in trouble. > >I've verified differences from TTLS+PAP+LDAP that works, and >PEAP+MSCHAP+LDAP that doesn't work. I've also verified log from LDAP >server. > > >It seems that a succesful bind occurs only with TTLS+PAP+LDAP, but >not occurs with PEAP so authentication fails. > >My LDAP store really clear-text password, but PEAP+MSCHAP seems doesn't care ! > >Some more hints ? > >Regards, >Paolo. > > > >>Since my LDAP store all passwords in clear-text, how can I force >>such way, instead of NT/LM-Password check? >> >>Regards, >>Paolo. >> >>>Hi, >>> >>>as it says >>> >>>rlm_mschap: No User-Password configured. Cannot create LM-Password. >>> rlm_mschap: No User-Password configured. Cannot create NT-Password. >>> rlm_mschap: Told to do MS-CHAPv2 for myRfx with NT-Password >>> rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. >>> rlm_mschap: FAILED: MS-CHAP2-Response is incorrect >>> modcall[authenticate]: module "mschap" returns reject for request 9 >>> >>>you will need a clear-text password or a NT/LM password hash to be in your >>>LDAP directory. Then you have to map that attribute ( for example >>>sambaNTPassword ) to User-Password. You are trying to do MSCHAP but there is >>>simply no defined password for this authorization type. >>> >>>Regards, >>> >>>Edvin >>> >>>-----Original Message----- >>>From: freeradius-users-bounces(a)lists.freeradius.org >>>[mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Paolo >>>Barbato >>>Sent: Donnerstag, 01. Dezember 2005 09:48 >>>To: freeradius-users(a)lists.freeradius.org >>>Subject: 802.1x ldap tls >>> >>>Hi list, >>> >>>yes I know that this question has been discussed so many times but, >>>still I'm in trouble. >>> >>>I've set up freeradius in order to authenticate+authorize Cisco NAS of >>>Aironet. >>> >>>I've successfully connected PC/MAC wireless clients using TTLS+PAP >>>with in backend and LDAP DB. >>> >>>Problem arise when I try to make the same with TLS, I mean >>>PEAP+MSCHAP and LDAP DB. THis doesn't works. If I set a local user in >>>users file, that is good, but if I try a LDAP user nothing come. >>> >>>LDAP store plain password. Some hints ? >>> >>>Here, some extracts from log: >>> >>> >>>rlm_ldap: - authorize rlm_ldap: performing user authorization for myRfx >>>radius_xlat: '(uid=myRfx)' >>>radius_xlat: 'o=Consorzio RFX' >>>rlm_ldap: ldap_get_conn: Checking Id: 0 >>>rlm_ldap: ldap_get_conn: Got Id: 0 >>>rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) >>>rlm_ldap: looking for check items in directory... >>>rlm_ldap: looking for reply items in directory... >>>rlm_ldap: user myRfx authorized to use remote access >>>rlm_ldap: ldap_release_conn: Release Id: 0 >>> modcall[authorize]: module "ldap" returns ok for request 9 >>>modcall: group authorize returns updated for request 9 >>> rad_check_password: Found Auth-Type EAP >>>auth: type "EAP" >>> Processing the authenticate section of radiusd.conf >>>modcall: entering group authenticate for request 9 >>> rlm_eap: Request found, released from the list >>> rlm_eap: EAP/mschapv2 >>> rlm_eap: processing type mschapv2 >>> Processing the authenticate section of radiusd.conf >>>modcall: entering group Auth-Type for request 9 >>> rlm_mschap: No User-Password configured. Cannot create LM-Password. >>> rlm_mschap: No User-Password configured. Cannot create NT-Password. >>> rlm_mschap: Told to do MS-CHAPv2 for myRfx with NT-Password >>> rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. >>> rlm_mschap: FAILED: MS-CHAP2-Response is incorrect >>> modcall[authenticate]: module "mschap" returns reject for request 9 >>>modcall: group Auth-Type returns reject for request 9 >>> rlm_eap: Freeing handler >>> modcall[authenticate]: module "eap" returns reject for request 9 >>>modcall: group authenticate returns reject for request 9 >>>auth: Failed to validate the user. >>>Login incorrect: [myRfx/<no User-Password attribute>] (from client >>>localhost port 0) >>> PEAP: Got tunneled reply RADIUS code 3 >>> MS-CHAP-Error = "\tE=691 R=1" >>> EAP-Message = 0x04090004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> PEAP: Processing from tunneled session code 0x9db3b30 3 >>> MS-CHAP-Error = "\tE=691 R=1" >>> EAP-Message = 0x04090004 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> PEAP: Tunneled authentication was rejected. >>> rlm_eap_peap: FAILURE >>> modcall[authenticate]: module "eap" returns handled for request 9 >>>modcall: group authenticate returns handled for request 9 >>>Sending Access-Challenge of id 239 to 150.178.33.150:1645 >>> EAP-Message = >>>0x010a002a1900170301001f1daf025ff66ee7cba51f42762f540bf78052e745788d4144c970 >>>5681d67359 >>> Message-Authenticator = 0x00000000000000000000000000000000 >>> State = 0x2846493df32aa5a3d90a7d4d8c3b4867 >>>Finished request 9 >>>Going to the next request >>>--- Walking the entire request list --- >>>Waking up in 5 seconds... >>>rad_recv: Access-Request packet from host 150.178.33.150:1645, >>>id=240, length=176 >>> User-Name = "myRfx" >>> Framed-MTU = 1400 >>> Called-Station-Id = "0011.2075.ab11" >>> Calling-Station-Id = "0030.6519.c496" >>> Service-Type = Login-User >>> Message-Authenticator = 0x33f13f5d35c399dbc0f3422dc2c798d9 >>> EAP-Message = >>>0x020a002a1900170301001fa1cae4d87f9f3e55c42ec8b99729dadddf42ba9a8f4eba029615 >>>a9ece90eff >>> NAS-Port-Type = Wireless-802.11 >>> NAS-Port = 12652 >>> State = 0x2846493df32aa5a3d90a7d4d8c3b4867 >>> NAS-IP-Address = 150.178.33.150 >>> NAS-Identifier = "NET26" >>> Processing the authorize section of radiusd.conf >>>modcall: entering group authorize for request 10 >>> modcall[authorize]: module "preprocess" returns ok for request 10 >>> modcall[authorize]: module "chap" returns noop for request 10 >>> modcall[authorize]: module "mschap" returns noop for request 10 >>> rlm_realm: No '@' in User-Name = "myRfx", looking up realm NULL >>> rlm_realm: No such realm "NULL" >>> modcall[authorize]: module "suffix" returns noop for request 10 >>> rlm_eap: EAP packet type response id 10 length 42 >>> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation >>> modcall[authorize]: module "eap" returns updated for request 10 >>> modcall[authorize]: module "files" returns notfound for request 10 >>>rlm_ldap: - authorize >>>rlm_ldap: performing user authorization for myRfx >>>radius_xlat: '(uid=myRfx)' >>>radius_xlat: 'o=Consorzio RFX' >>>rlm_ldap: ldap_get_conn: Checking Id: 0 >>>rlm_ldap: ldap_get_conn: Got Id: 0 >>>rlm_ldap: performing search in o=Consorzio RFX, with filter (uid=myRfx) >>>rlm_ldap: looking for check items in directory... >>>rlm_ldap: looking for reply items in directory... >>>rlm_ldap: user myRfx authorized to use remote access >>>rlm_ldap: ldap_release_conn: Release Id: 0 >>> modcall[authorize]: module "ldap" returns ok for request 10 >>>modcall: group authorize returns updated for request 10 >>> rad_check_password: Found Auth-Type EAP >>>auth: type "EAP" >>> Processing the authenticate section of radiusd.conf >>>modcall: entering group authenticate for request 10 >>> rlm_eap: Request found, released from the list >>> rlm_eap: EAP/peap >>> rlm_eap: processing type peap >>> rlm_eap_peap: Authenticate >>> rlm_eap_tls: processing TLS >>> eaptls_verify returned 7 >>> rlm_eap_tls: Done initial handshake >>> eaptls_process returned 7 >>> rlm_eap_peap: EAPTLS_OK >>> rlm_eap_peap: Session established. Decoding tunneled attributes. >>> rlm_eap_peap: Received EAP-TLV response. >>> rlm_eap_peap: Tunneled data is valid. >>> rlm_eap_peap: Had sent TLV failure, rejecting. >>> rlm_eap: Handler failed in EAP/peap >>> rlm_eap: Failed in EAP select >>> modcall[authenticate]: module "eap" returns invalid for request 10 >>>modcall: group authenticate returns invalid for request 10 >>>auth: Failed to validate the user. >>>Login incorrect: [myRfx/<no User-Password attribute>] (from client >>>rfxnet1 port 12652 cli 0030.6519.c496) >>>Delaying request 10 for 1 seconds >>>Finished request 10 >>>Going to the next request >>> >>>Regards, >>>Paolo. >>>-- >>>---------------------------------------------------------------------------- >>>-------------------- >>>Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it >>>Network Administrator phone: (39-049)-829-5097 >>> (39-049)-829-5000 >>>Corso Stati Uniti,4 www: http://www.igi.cnr.it >>>35127 Camin-Padova PGP: >>>http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp >>>ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org >>>---------------------------------------------------------------------------- >>>-------------------- >>>- >>>List info/subscribe/unsubscribe? See >>>http://www.freeradius.org/list/users.html >>> >>>- >>>List info/subscribe/unsubscribe? See >>>http://www.freeradius.org/list/users.html >> >> >>-- >>------------------------------------------------------------------------------------------------ >>Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it >>Network Administrator phone: (39-049)-829-5097 >> (39-049)-829-5000 >>Corso Stati Uniti,4 www: http://www.igi.cnr.it >>35127 Camin-Padova PGP: >>http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp >>ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org >>------------------------------------------------------------------------------------------------ >>- List info/subscribe/unsubscribe? See >>http://www.freeradius.org/list/users.html > -- ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

1 0

Filter-Id denying access
by Josh 05 Dec '05

05 Dec '05

I have been successfully authenticating individual users between a PIX 515 VPN and FreeRadius server. I'm using mysql as the data storage on the radius server. Recently I began changing the way I manage the ACLs on the PIX and began setting up user specific ACLs that get set after logging in via the VPN. On the PIX: access-list myvpntest permit ip... and so forth On radius (mysql): insert into radcheck (UserName,Attribute,op,Value) values ('josh','Filter-Id','=','myvpntest'); Now when I attempt to login with my VPN client I get denied. Here's a snippet of the debug: ------ BEGIN DEBUG ------ radius_xlat: 'josh' rlm_sql (sql): sql_set_user escaped user --> 'josh' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'josh' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'josh' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): No matching entry in the database for request from user [josh] rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns notfound for request 0 modcall: group authorize returns ok for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Finished request 0 ------ END DEBUG ------ For reference, here's the debug info when I remove the Filter-Id for user 'josh': ------ BEGIN DEBUG ------ radius_xlat: 'josh' rlm_sql (sql): sql_set_user escaped user --> 'josh' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'josh' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'josh' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'josh' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type PAP auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 1 rlm_pap: login attempt by "josh" with password ******** rlm_pap: Using password "********" for user josh authentication. rlm_pap: Using MD5 encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 1 modcall: group Auth-Type returns ok for request 1 Sending Access-Accept of id 119 to 10.5.0.1:1812 Finished request 1 ------ END DEBUG ------ Any ideas? __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

2 2

XP auth + PEAP
by debik 05 Dec '05

05 Dec '05

Have enybody connect the client running Windows XP SP2 to the radius server with peap auth ???

1 0

RE: RADIUS Auth-Type
by Bohannan, Chad W 05 Dec '05

05 Dec '05

I don't think that is the issue. The NAS authenticates my users just fine so long as the /etc/raddb/users file specifies the users "Auth-Type= System". What I want to figure out is how to make the authentication request proxy out to the AD server. Based on the tutorial & test results everything should be working, but I need to know what auth-type to use. Chad -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Phil Mayers Sent: Saturday, December 03, 2005 9:08 AM To: FreeRadius users mailing list Subject: Re: RADIUS Auth-Type Bohannan, Chad W wrote: > OK, here is the situation. I have successfully configured RADIUS to > authenticate/authorize NAS requests from my Cisco gear so long as the > user "Auth-Type= System". I have also managed to get Samba working and > have joined the radius server to the AD realm in question. This is > confirmed through the following: The radius server doesn't specify MSCHAP. The NAS *tells* the radius server that this request *is* using MSCHAP by virtue of sending the appropriate MSCHAP attributes. Configure your NAS (dialup server, VPN, IPSec+xauth, whatever) to do MSCHAP, and as long as the mschap module is in the authorize and authenticate sections, it will work. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Update on Samba and PEAP Machine Authentication
by Michael Griego 05 Dec '05

05 Dec '05

The Samba team has recently released Samba version 3.0.21rc2. The 3.0.21 releases include the necessary fixes to Samba to allow for PEAP machine authentication, so those versions of Samba can be used without requiring the patches previously posted to the list. --Mike

1 0

What are the advantage and disadvantage about ntlm_auth and LDAP?
by darkblue 05 Dec '05

05 Dec '05

There two type of method to integrate freeradius with AD, ntlm_auth and ldap, with help by experts such as Alan DeKok and Nicolas Baradakis , I had been setup the 802.1x+freeradius+ntlm_auth+AD. and I wonder what are the advantage and disadvantage about ldap and ntlm_auth.LDAP sounds better than ntlm_auth, is that right? -- He is nothing

2 1

EAP-TTLS/PAP and proxying
by Samuel Degrande 05 Dec '05

05 Dec '05

Hello. I have one other question concerning proxying, and once again excuse me if I don't use the good terminology. I use EAP-TTLS/PAP between a 802.1X supplicant and a radius server. I would like to proxy the authentication to an other radius server. So, is it possible to 'decapsulate' the authentication protocol from EAP on the first radius server, and only send user-name/user-password attributes to the central radius server ? (i guess that my question is stupid, but I don't know how to express it in the good way...) thanks -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]

3 2