September 2005 - Freeradius-Users - lists.freeradius.org

CHAP Authentication But LDAP Authorization?
by Adam Tauno Williams 09 Sep '05

09 Sep '05

I have CHAP (PEAP) authentication working against my Samba PDC via ntlm_auth. I want to use that authentication but have users and their parameters from an LDAP DSA (that contains the SAM Samba is using). I see that a radius schema file is included and has an auxilliary objectclass. But I can't seem to find any informaiton on using LDAP for the user database but EAP/ntlm_auth for the authentication. Is this possible? -- Adam Tauno Williams - http://www.whitemice.org

1 0

Re: Not going past "Sending Access-Challenge"
by Adam Tauno Williams 09 Sep '05

09 Sep '05

Adam Tauno Williams <E-mail Protected> wrote: >> I'm trying to setup RADIUS/WPA authentication using PEAP as >> described in - >> http://www.ibiblio.org/pub/Linux/docs/HOWTO/8021X-HOWTO - but I >> never seem to get past the "Sending Access-Challenge" after I enter >> my username and password on the client. User is simply an entry in >> the users file with a clear text password. I've gone over the >> config several times, but nothing jumps out at me as an error >> message. Alan DeKok wrote: > The problem most likely is that the AP isn't seeing the response, or >it isn't liking the response. Check the IP addresses that the packet >use, via "tcpdump". Okay, I've etherealled the connection and I see an "Access-Request" from the WAP to the RADIUS server, then an "Access-Challenge" from the RADIUS serve to the WAP, and nothing else. What should the WAP's response to an "Access-Challenge" response be? The WAP is 192.168.1.42 and the RADIUS server is 192.168.1.47 No. Time Source Destination Protocol Info 8 0.839425 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=26, l=133) Frame 8 (175 bytes on wire, 175 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1a (26) Length: 133 Authenticator: 14E77EEE7405E31F02AB6A803EB478A1 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=15 t=EAP-Message(79) Last Segment[1] Length: 13 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 1 Length: 13 Type: Identity [RFC3748] (1) Identity (8 bytes): awilliam AVP: l=18 t=Message-Authenticator(80): 92C34CC691D9BC0D5B49F180B2F4EA59 Length: 16 Message-Authenticator: 92C34CC691D9BC0D5B49F180B2F4EA59 No. Time Source Destination Protocol Info 15 0.842887 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=26, l=83) Frame 15 (125 bytes on wire, 125 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1a (26) Length: 83 Authenticator: DE3DC989610D986213D85EF526EA47BD Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=8 t=EAP-Message(79) Last Segment[1] Length: 6 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 2 Length: 6 Type: PEAP [Palekar] (25) Flags(0x20): Start PEAP version 0 AVP: l=18 t=Message-Authenticator(80): 36719CCCEE09502EA6C644C5EEC62B87 Length: 16 Message-Authenticator: 36719CCCEE09502EA6C644C5EEC62B87 AVP: l=18 t=State(24): 4CA90CA7DE0086900AEB2E8BB35E773A Length: 16 State: 4CA90CA7DE0086900AEB2E8BB35E773A No. Time Source Destination Protocol Info 16 0.879314 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=27, l=218) Frame 16 (260 bytes on wire, 260 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1b (27) Length: 218 Authenticator: FBD53DBF46F4F69697F2427EDE5176A3 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=82 t=EAP-Message(79) Last Segment[1] Length: 80 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 2 Length: 80 Type: PEAP [Palekar] (25) Flags(0x80): Length PEAP version 0 Length: 70 Secure Socket Layer AVP: l=18 t=State(24): 4CA90CA7DE0086900AEB2E8BB35E773A Length: 16 State: 4CA90CA7DE0086900AEB2E8BB35E773A AVP: l=18 t=Message-Authenticator(80): DF3CCA452EF2AF5D0CAA8EB46534127D Length: 16 Message-Authenticator: DF3CCA452EF2AF5D0CAA8EB46534127D No. Time Source Destination Protocol Info 23 0.885616 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=27, l=1119) Frame 23 (1161 bytes on wire, 1161 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1b (27) Length: 1119 Authenticator: 51DB666236DA04D0B72A4E99FAE73956 Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=255 t=EAP-Message(79) Segment[1] AVP: l=255 t=EAP-Message(79) Segment[2] AVP: l=255 t=EAP-Message(79) Segment[3] AVP: l=255 t=EAP-Message(79) Segment[4] AVP: l=24 t=EAP-Message(79) Last Segment[5] Length: 22 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 3 Length: 1034 Type: PEAP [Palekar] (25) Flags(0xC0): Length More PEAP version 0 Length: 3974 EAP-TLS Fragments (3974 bytes): #23(1024), #35(1024), #46(1024), #54(902) Secure Socket Layer AVP: l=18 t=Message-Authenticator(80): F4814C72EEE61CD5CEFC53B36B267D4C Length: 16 Message-Authenticator: F4814C72EEE61CD5CEFC53B36B267D4C AVP: l=18 t=State(24): D338F7D46B55BA06D75A99DAB2F12D57 Length: 16 State: D338F7D46B55BA06D75A99DAB2F12D57 No. Time Source Destination Protocol Info 27 2.062088 192.168.1.42 192.168.1.47 RADIUS Access-Request(1) (id=28, l=144) Frame 27 (186 bytes on wire, 186 bytes captured) Ethernet II, Src: noor.morrison.iserv.net (00:0f:3d:43:6a:3c), Dst: tor.morrison.iserv.net (00:0d:60:0f:fd:4a) Internet Protocol, Src: 192.168.1.42 (192.168.1.42), Dst: 192.168.1.47 (192.168.1.47) User Datagram Protocol, Src Port: groove-dpp (1211), Dst Port: radius (1812) Radius Protocol Code: Access-Request (1) Packet identifier: 0x1c (28) Length: 144 Authenticator: 77439BFA74CDEE8C8B73E043554916F0 Attribute Value Pairs AVP: l=10 t=User-Name(1): awilliam AVP: l=6 t=NAS-IP-Address(4): 192.168.1.42 AVP: l=6 t=NAS-Port(5): 0 AVP: l=19 t=Called-Station-Id(30): 00-0F-3D-43-6A-3C AVP: l=19 t=Calling-Station-Id(31): 00-14-A5-30-BC-27 AVP: l=8 t=NAS-Identifier(32): wap001 AVP: l=6 t=Framed-MTU(12): 1380 AVP: l=6 t=NAS-Port-Type(61): Wireless-802.11(19) AVP: l=8 t=EAP-Message(79) Last Segment[1] Length: 6 EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 3 Length: 6 Type: PEAP [Palekar] (25) Flags(0x0): PEAP version 0 AVP: l=18 t=State(24): D338F7D46B55BA06D75A99DAB2F12D57 Length: 16 State: D338F7D46B55BA06D75A99DAB2F12D57 AVP: l=18 t=Message-Authenticator(80): 7A8DCF047F1B584608FE71A8EAB584AC Length: 16 Message-Authenticator: 7A8DCF047F1B584608FE71A8EAB584AC No. Time Source Destination Protocol Info 35 2.068415 192.168.1.47 192.168.1.42 RADIUS Access-challenge(11) (id=28, l=1115) Frame 35 (1157 bytes on wire, 1157 bytes captured) Ethernet II, Src: tor.morrison.iserv.net (00:0d:60:0f:fd:4a), Dst: noor.morrison.iserv.net (00:0f:3d:43:6a:3c) Internet Protocol, Src: 192.168.1.47 (192.168.1.47), Dst: 192.168.1.42 (192.168.1.42) User Datagram Protocol, Src Port: radius (1812), Dst Port: groove-dpp (1211) Radius Protocol Code: Access-challenge (11) Packet identifier: 0x1c (28) Length: 1115 Authenticator: 2A5E1665347BA87046D857CAB331686F Attribute Value Pairs AVP: l=19 t=Reply-Message(18): EAPTEST Hello, %u Length: 17 Reply-Message: EAPTEST Hello, %u AVP: l=255 t=EAP-Message(79) Segment[1] AVP: l=255 t=EAP-Message(79) Segment[2] AVP: l=255 t=EAP-Message(79) Segment[3] AVP: l=255 t=EAP-Message(79) Segment[4] AVP: l=20 t=EAP-Message(79) Last Segment[5] Length: 18 EAP fragment Extensible Authentication Protocol Code: Request (1) Id: 4 Length: 1030 Type: PEAP [Palekar] (25) Flags(0x40): More PEAP version 0 EAP-TLS Fragments (3974 bytes): #23(1024), #35(1024), #46(1024), #54(902) Secure Socket Layer AVP: l=18 t=Message-Authenticator(80): 755BE6D63AA6F48DC661705F2EE3A5AD Length: 16 Message-Authenticator: 755BE6D63AA6F48DC661705F2EE3A5AD AVP: l=18 t=State(24): 6A14161A7B2A4D2A2B0EED6451D7555F Length: 16 State: 6A14161A7B2A4D2A2B0EED6451D7555F -- Adam Tauno Williams - http://www.whitemice.org

1 1

radius timeout
by Callis 09 Sep '05

09 Sep '05

Hi all I have freeradius-1.0.1-1 (with Petr Nixon's patch) running on FC-3 and using a postgresql backend to collect cisco AAA (stop only) records. My cisco IOS is 12.3(2)T2. I see a lot of radius timeout on my cisco router while the ping times is < 10ms and my radius timeout is set to 50. I even went further to connect the radius server and the router back to back with a cross cable and still have some timeouts. What could be wrong with my configs? Any help will be appreciated. Thank you.

3 3

Need to conditionally update user data in authentication process (mysql) - Clues?
by Mark Elkins 09 Sep '05

09 Sep '05

Hi I need to conditionally update some user data whilst in the authentication process - I'm looking for clues as how to do this. Background: I'm providing vouchers with a username and password on them. The first time the voucher details are used - I need to update that users details (change their group, add an expiry date - etc). All my users are in groups and its only users in a particular group that I want this to happen too... Everything is in MySQL. Sort of... pre_authorize_check = "UPDATE useracct SET groupname='newgroup', expireaccount='now() + 30 days' IF (SELECT groupname FROM useracct WHERE Username='%{Stripped-User-Name}' AND realm='%{Realm}' ) == 'voucher_group'; ie - If the person trying to login is a member of my 'voucher_group', make some changes to their SQL details first.... then authenticate them as normal... How would I do something like this? This process would only ever happen once to a user in the lifetime of their account, unlike repetitively logging in and using the service afterwards. ps - I also want to send them some welcoming e-mail at the same time and as their username@realm is actually their e-mail address .. the address is easy...but the process of doing so? -- . . ___. .__ Posix Systems - Sth Africa. e.164 VOIP ready /| /| / /__ mje(a)posix.co.za - Mark J Elkins, Cisco CCIE / |/ |ARK \_/ /__ LKINS Tel: +27 12 807 0590 Cell: +27 82 601 0496

1 0

About update of CRL
by Kouji Amemiya 09 Sep '05

09 Sep '05

Hi, all! I use FreeRADIUS-1.0.4 and OpenSSL on cygwin in Windows XP for EAP-TLS. I want to ask a question about the specification of FreeRADIUS. If CRL is updated, FreeRADIUS should be rebooted? When CRL was updated, I executed "c_rehash" command only. But the new CRL's information was not updated for FreeRADIUS. Or is there any other method? Please help me. Best regards, amemiya

1 0

listuser@peternixon.net
by Lee Bobby 08 Sep '05

08 Sep '05

thank u for your reply.I have resolved this problem. you are right.FreeRADIUS can't find the oracle library. by the way,are you familair with OID.w wanna keep in touch with u. my msn:bjldlee@hotmail.com bobby from beijing

1 0

Mixed-mode authentication enviornment
by Daniel Corbe 08 Sep '05

08 Sep '05

Hello, I have a FreeRADIUS server authenticating against an LDAP back-end. Some of my applications (such as my SIP proxy server) currently require DIGEST-MD5 authentication and others (such as my E-Mail server, and my Cisco routers) do not. Ideally I'd like everything to work harmoneously. Since the SIP server requires DIGEST authentication, the Auth-Type attribute is present and it is set to DIGEST which forces FreeRADIUS to attempt a digest authentication. Once this fails an Access-Reject packet is sent back to the RADIUS client Is there a way to configure FreeRADIUS so it first attempts a DIGEST authentication, and when that fails, we go ahead and attempt normal authentication? Thanks. -Daniel

2 15

RE: one question
by Guy Davies 08 Sep '05

08 Sep '05

Hi Richie, Simply look in the /usr/local/share/freeradius/dictionary file. It includes a load of $INCLUDE lines pointing to each of the dictionary.foo files. All you need to do is add $INCLUDE dictionary.fortinet to that file and make sure that the file dictionary.fortinet is in the correct format and is located in the same directory. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org on behalf of Richie Lee Sent: Thu 09/08/05 7:58 PM To: freeradius-users(a)lists.freeradius.org Subject: one question My company is a security vendor company(www.fortinet.com). How to add dictionary.fortinet to the server's list of vendor dictionaries in later freeradius version? Does anyone know it? _________________________________________________________________ Designer Mail isn't just fun to send, it's fun to receive. Use special stationery, fonts and colors. http://join.msn.com/?pgmarket=en-ca&page=byoa/prem&xAPID=1994&DI=1034&SU=ht… Start enjoying all the benefits of MSN® Premium right now and get the first two months FREE*. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

RE: Some questions about freeRADIUS implementation, PLEASE HELP ME!!
by Guy Davies 08 Sep '05

08 Sep '05

Here my doubt: I am using EAP-TLS I generated a client Certificate with CN "redes" then I add at LDAP database a user with these atributes cn: redes uid: redes radiusGroupName: academicos ..others Attributes but without userpassword and in the users file i add: DEFAULT Ldap-Group == academicos, Simultaneous-Use := 1 Aruba-User-Role = "STAFF", A user with client certificate can access at Wireless network and get the Role STAFF perfectly, but the process of authentication and authorization seems like very very redundant, is normal that?. I attach the file of process auth. [GD] Hi Alfonso, The authentication and authorization are different things. Authentication is asking may this user connect. Authorization is asking once this user has connected (i.e. Authentication has passed) what may they do (e.g. what type of user are they [student/staff], what VLAN should they be associated with, what is their access level [e.g. on Cisco routers = 1 to 15]) That allows you to provide more than a simple yes/no answer to the request to login. Rgds, Guy This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

need somehelp plz
by kdr akm 08 Sep '05

08 Sep '05

hi all i.am new in radius system and i need help to make auth by mac address for my users and thanks --------------------------------- Click here to donate to the Hurricane Katrina relief effort.

1 0