October 2006 - Freeradius-Users - lists.freeradius.org

Machine Accounts against AD
by King, Michael 31 Oct '06

31 Oct '06

I had this working before, and I can't figure out what I'm missing to get it working on this server. Samba Version 3.0.23b FreeRADIUS version 1.0.4 Users successfully authenticate with the domain, Machine accounts do not however. My ntlm_auth line is: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response}" I have: with_ntdomain_hack = yes in the mschap section. The debug is below The only thing that looks different than last time is it looks like the host/ isn't getting stripped off. Should it? rad_recv: Access-Request packet from host 10.0.1.22:32769, id=171, length=324 User-Name = "host/boytel2883.campus.bridgew.edu" Calling-Station-Id = "00-90-96-F4-2A-BB" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.22 NAS-Identifier = "BUWISM2-2" Vendor-14179-Attr-1 = 0x00000007 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x0207007419001703010069fad4edfbbed6d8fb51dcf6cb01ead274ca25439081be3955 bfd614a066335309bfcc72d0f20a0891d43fd085e948c3a635622fcd52658bdc817970b8 7e859a66ec970d7433349e6cbd2d19184182eb762ea246e13202349e8c32c8acd5e5c322 df88f7fd45aa24e13f State = 0xdfdc87766140b541e2ac318d7ce82e0f Message-Authenticator = 0x42318a374d505be3af9ffa7af0c39484 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 19 modcall[authorize]: module "preprocess" returns ok for request 19 modcall[authorize]: module "chap" returns noop for request 19 modcall[authorize]: module "mschap" returns noop for request 19 rlm_realm: No '@' in User-Name = "host/boytel2883.campus.bridgew.edu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 19 rlm_eap: EAP packet type response id 7 length 116 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 19 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 19 modcall: group authorize returns updated for request 19 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 19 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to host/boytel2883.campus.bridgew.edu PEAP: Adding old state with f4 4b Processing the authorize section of radiusd.conf modcall: entering group authorize for request 19 modcall[authorize]: module "preprocess" returns ok for request 19 modcall[authorize]: module "chap" returns noop for request 19 modcall[authorize]: module "mschap" returns noop for request 19 rlm_realm: No '@' in User-Name = "host/boytel2883.campus.bridgew.edu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 19 rlm_eap: EAP packet type response id 7 length 93 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 19 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 19 modcall: group authorize returns updated for request 19 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 19 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 19 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for host/boytel2883.campus.bridgew.edu with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: c4 radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '/usr/bin/ntlm_auth --request-nt-key --username=host/boytel2883.campus.bridgew.edu --challenge=896edabb073ecbba --nt-response=ed45bb2d412865db09406089a5c4145c142b682a469717cb' Exec-Program: /usr/bin/ntlm_auth --request-nt-key --username=host/boytel2883.campus.bridgew.edu --challenge=896edabb073ecbba --nt-response=ed45bb2d412865db09406089a5c4145c142b682a469717cb Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 19 modcall: group Auth-Type returns reject for request 19 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 19 modcall: group authenticate returns reject for request 19 auth: Failed to validate the user. Login incorrect: [host/boytel2883.campus.bridgew.edu] (from client localhost port 0) PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 19 modcall: group authenticate returns handled for request 19 Sending Access-Challenge of id 171 to 10.0.1.22:32769 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User EAP-Message = 0x010800261900170301001b117712344a946d2ec4a5810ca84e7e8d679cd4db81a9d3ba 62f02c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xda9104a0e99cbf878c499197750025dd Finished request 19 Going to the next request Waking up in 3 seconds... rad_recv: Access-Request packet from host 10.0.1.22:32769, id=172, length=246 User-Name = "host/boytel2883.campus.bridgew.edu" Calling-Station-Id = "00-90-96-F4-2A-BB" Called-Station-Id = "00-0B-85-5B-55-A0:test" NAS-Port = 29 NAS-IP-Address = 10.0.1.22 NAS-Identifier = "BUWISM2-2" Vendor-14179-Attr-1 = 0x00000007 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "4000" EAP-Message = 0x020800261900170301001b8391b7780fd0e65e7da0ff923b9c0239457f612ac17c7904 4626be State = 0xda9104a0e99cbf878c499197750025dd Message-Authenticator = 0x58d7a64496d15d4c60e90495b86ab1db Processing the authorize section of radiusd.conf modcall: entering group authorize for request 20 modcall[authorize]: module "preprocess" returns ok for request 20 modcall[authorize]: module "chap" returns noop for request 20 modcall[authorize]: module "mschap" returns noop for request 20 rlm_realm: No '@' in User-Name = "host/boytel2883.campus.bridgew.edu", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 20 rlm_eap: EAP packet type response id 8 length 38 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 20 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 20 modcall: group authorize returns updated for request 20 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 20 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Had sent TLV failure, rejecting. rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 20 modcall: group authenticate returns invalid for request 20 auth: Failed to validate the user. Login incorrect: [host/boytel2883.campus.bridgew.edu] (from client BUWiSM-2-2 port 29 cli 00-90-96-F4-2A-BB) Delaying request 20 for 1 seconds Finished request 20

2 2

PROBLEM - Proxy + SQLIPPOOL + Framed-IP-Address
by Guilherme Franco 31 Oct '06

31 Oct '06

Hi, Doing proxy, freeradius always ignore the static Framed-IP-Address set in radreply table and sets the random SQLIPPOOL instead. Without proxy, SQLIPPOOL won't assign an IP from the pool and grabs the Framed-IP-Address correctly. I guess it's because the Framed-IP-Address = 255.255.255.254 contained in the Access-Accept packet from the proxy home server. Played with attrs but no luck. Please help! Thanks!

1 0

FreeRadius slower than SBR
by Sean.Boran＠swisscom.com 31 Oct '06

31 Oct '06

Hi, I'm proposing a FreeRadius solution for 802.1x authentication of Wired client based on Client certificates, a CRL lookup, and vlan assoociation from Active Directory. The IT department, who usuall buy Steel Belted Radius from Juniper, are saying FreeRadius is just too slow, and could not handle the traffic. The SBR: http://www.juniper.net/products/aaa/sbr/ Now, I don't see the basis for these assertions and I would imagine the bottlenext being the CRL lookups and AD requests. I estimate the number of authentication sper sec to reach about 60 to 100 for this project. However I'd like to humbly ask the list what they think of such assertions, is there something in SBR that would make them much more scalable or faster? Where would the bottlenecks be? How many client cert auths/sec could FR handle, on say an entry level single CPU server HW? Thanks in advance, Sean

2 1

Freeradius is mad ! Or me...
by benodilo＠free.fr 31 Oct '06

31 Oct '06

Hi, I have a Freeradius on a fedora core 5 with a backend mysql. It's work fine 20 days. But i have stopped it (/etc/init.d.radiusd stop) and use radiusd -A commande for testing another login for mysql. An since this change the serveur radius can connect to serveur mysql on debug mode (rdiusd -X), if i use the command "/etc/init.d/radiusd start" the clients can't connect et in the log (see bottom) say it can't connect to mysql sevrer. Why the command "radiusd -A" work fine and not "/etc/init.d/raduisd start" ??? I really don't understand why ! I will be mad

2 2

Freeradius with Comindico
by Cory Robson 31 Oct '06

31 Oct '06

I'm configuring freeradius 1.0.4-1.FC4.1 for the first time in an attempt to interface with Comindico's system. Comindico are totally unhelpful hese days with most support issues other than suggesting I buy a copy of radiator as that's all they apparently know. Anyway I have configured freeradius to use mysql for authentication and accounting. Has anyone done a step by step config or able to assist me in understanding this process better. NTRadping confirms authentication and accounting packets are functional but I cannot find any information to support commindico's process I have most of my dialup services through comindico. Thanks in advance Cory

2 1

AP and radius attributes
by Manuel Sánchez Cuenca 31 Oct '06

31 Oct '06

Hello all, does anybody knows if the linksys wrt54g AP support any radius attribute, such as Session-Timeout. Anyway, can anybody tell me which APs applies the radius attributes sent by the freeradius server after a successful authentication? Thanks in advance. -- ----------------------------- Manuel Sanchez Cuenca Departamento de Ingenieria de la Informacion y las Comunicaciones Facultad de Informatica. Universidad de Murcia Campus de Espinardo - 30080 Murcia (SPAIN) Tel.: +34-968-364644 Fax: +34-968-364151 email: msc(a)dif.um.es | manuelsc(a)um.es url: http://libra.inf.um.es/~lolo

2 1

Wiki
by King, Michael 31 Oct '06

31 Oct '06

Anyone else having trouble getting to the Wiki right now?

3 2

proxy + rlm_perl question
by Francois-Xavier GAILLARD 30 Oct '06

30 Oct '06

Hi list, I have 2 questions: 1/ I'll have to proxy auth requests to a client's home radius. He is just allowed to check the user's username/password. I know how to filter attributes using attrs and the post-proxy section of radiusd.conf. But I don't know how to ADD attributes, like Framed-IP-Address for example. User-Name isn't sent back from the home radius to the proxy radius in the Access-Accept, thus I can't make any sql query (I use mysql backend) based on the username to get the Framed-IP-Address I want to assign to the users. I could do a sql query in the pre-proxy section (don't know if it's ok, because you can't use the sql module in post-proxy) but I don't want to send anything else than UserName and Password to the client's home radius. Any idea how I could do that ? 2/ when I try to use example.pl in the post-proxy section I get the following error: Can't load '/usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so' for module Data::Dumper: /usr/lib/perl/5.8/auto/Data/Dumper/Dumper.so: undefined symbol: Perl_sv_cmp at /usr/lib/perl/5.8/XSLoader.pm line 68. at /usr/lib/perl/5.8/Data/Dumper.pm line 27 Compilation failed in require at /usr/local/libexec/post-proxy.pl line 31. BEGIN failed--compilation aborted at /usr/local/libexec/post-proxy.pl line 31. Doesn't look that there's any problem with the perl script (the script doesn't do anything actually, it's just for testing purpose): root@debvm1 :/etc/freeradius#/usr/local/libexec/post-proxy.pl root@debvm1 :/etc/freeradius# I'm a real *dick* a perl programming, I guess the problem might be a pebcak, but maybe it's not. I'm using FR 1.1.2 with Debian Sarge. Thanks for any hint. regards, Fox.

2 2

how to check multiple value of same attribute
by open source 30 Oct '06

30 Oct '06

Hi Everyone, I want to check an attribute against multiple value. But I couldn't do that. I'm using mysql with freeradius. I want my users belonging to Surfing group to have access from 9pm to 9am but on saturday they could access till 12pm. The radgroupcheck able has following entries: ------------------------------------------------------------------------------------------ | id | GroupName | Attribute | op | Value | ------------------------------------------------------------------------------------------ | 1 | Surfing | Login-Time | := | Any2100-0900 | | 2 | Surfing | Login-Time | += | Sa0900-1200 | ------------------------------------------------------------------------------------------- The radius is checking only against the first check item, it's not checking the second one. I tried by using fall-through attribute in radgroupreply table also, but no use. The radgroupreply able has following entries: ------------------------------------------------------------------------------------------ | id | GroupName | Attribute | op | Value | ------------------------------------------------------------------------------------------ | 1 | Surfing | Fall-Through | = | Yes | ------------------------------------------------------------------------------------------- What could be the problem? Can anyone help me ? thanks opn

3 2

EAP and accounting
by Angel L. Mateo 30 Oct '06

30 Oct '06

Hello, I am developing my freeradius server (version 1.1.2) to use it in a WPA wireless environment with EAP authentication. Until this moment (without EAP) the accounting information collected by freeradius is in the form: - detail-YYYYMMDD: Fri Oct 20 11:07:59 2006 User-Name = "<username>@<realm>" NAS-Port = 2161 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Address = X.X.X.X Class = 0x69636172756d Calling-Station-Id = "172.18.201.166" Acct-Status-Type = Start Acct-Session-Id = "15D003FA" Tunnel-Client-Endpoint:0 = "172.18.201.166" Acct-Authentic = RADIUS Acct-Delay-Time = 0 NAS-IP-Address = <nas IP address> NAS-Port-Type = Virtual Proxy-State = 0x323034 Client-IP-Address = <client ip address> Acct-Unique-Session-Id = "e43a1da655ba3ef3" Stripped-User-Name = "<username>" Realm = "<realm>" Timestamp = 1161335279 - auth-detail-YYYYMMDD: Packet-Type = Access-Request Fri Oct 20 11:10:14 2006 User-Name = "<username>@<realm>" User-Password = "190482" NAS-Identifier = "<nas id>" NAS-IP-Address = <nas ip> Proxy-State = 0x323433 Client-IP-Address = <client ip> But with EAP the files has the same form, but username is always "anonymous", because the real authentication is made through the tunnel connection. I want to know if there is any way to configure radius to log the real username instead of anonymous in the log files. Thanks. -- Angel L. Mateo Martínez Sección de Telemática Área de Tecnologías de la Información _o) y las Comunicaciones Aplicadas (ATICA) / \\ http://www.um.es/atica _(___V Tfo: 968367590 Fax: 968398337

4 4