December 2007 - Freeradius-Users - lists.freeradius.org

sqlippool issue
by hadi golestani 13 Dec '07

13 Dec '07

Hi, I'm using freeradius to assign ip to my vpn clients. so I've configured sqlippool to bind ips to my users and groups. and in pptpd.conf I choose not to assign ip in pptpd. but connections to pptpd fails ( from win xp ) with error: no assigned ip. what's wrong in my configurations? my DB state: insert into radcheck ( username , attribute , op , value ) values ( 'newuser3' , 'Cleartext-Password' , ':=' , 'newpass3'); insert into usergroup (username , groupname ) values ( 'newuser3' , 'offpart1'); insert into radgroupcheck ( groupname , attribute , op , value ) values ('offpart1' , 'Pool-Name' , ':=' , '1515'); insert into radippool ( 'pool_name' , 'framedipaddress' ) values ('1515',' 10.15.15.3'); it's the output of debug mod: rad_recv: Access-Request packet from host 127.0.0.1:34045, id=149, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "newuser3" MS-CHAP-Challenge = 0xc2af22b4941ad3a9f8ffba6ca9793eea MS-CHAP2-Response = 0x220069907d4b717d6e15a59053bead0f51900000000000000000283b13c9c3bd7f543ae7385f6b5749cb18330955aade9ea7 Calling-Station-Id = "xx.xx.xx.xx" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 8 rlm_realm: No '@' in User-Name = "newuser3", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 8 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 8 radius_xlat: 'newuser3' rlm_sql (sql): sql_set_user escaped user --> 'newuser3' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'newuser3' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'newuser3' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'newuser3' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'newuser3' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 8 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 8 modcall: leaving group authorize (returns ok) for request 8 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 8 rlm_mschap: Told to do MS-CHAPv2 for newuser3 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 8 modcall: leaving group MS-CHAP (returns ok) for request 8 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 8 rlm_sqlippool: Framed-IP-Address already exists modcall[post-auth]: module "sqlippool" returns noop for request 8 rlm_sql (sql): Processing sql_postauth radius_xlat: 'newuser3' rlm_sql (sql): sql_set_user escaped user --> 'newuser3' radius_xlat: 'INSERT into radpostauth (user, pass, reply, date) values ('newuser3', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (user, pass, reply, date) values ('newuser3', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 modcall[post-auth]: module "sql" returns ok for request 8 modcall: leaving group post-auth (returns ok) for request 8 Sending Access-Accept of id 149 to 127.0.0.1 port 34045 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0x22533d36413732333834453141433843323544364432373245454244333734303038463238363630453439 MS-MPPE-Recv-Key = 0x0d42ffa8adfe8471a692876c86a6b26d MS-MPPE-Send-Key = 0x5110ed91d6d36bb4c9d44e2a0f6367e1 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 8 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 149 with timestamp 4760fe8f Nothing to do. Sleeping until we see a request.

2 8

Re: Example listed in huntgroup file does not work
by Reynolds, Walter 13 Dec '07

13 Dec '07

I am looking at that option, but I should not have to. Per the huntgroups file: "# This file can also be used to define restricted access # to certain huntgroups. The second and following lines # define the access restrictions (based on username and # UNIX usergroup) for the huntgroup. #" So I can create a huntgroup with multiple Nas, but the 'second and following lines' are only recognized by the last entry in the huntgroup. So If I go with groups, I should be able to add the following: (can someone tell me if this is the write syntax, or do I still have to add something to the dictionary.... have to leave right now to catch a flight. Thanks) File radiusd.conf passwd etc_group { filename = /usr/local/ett/raddb/grouplist format = "=Group-Name:*,User-Name" hashsize = 50 ignorenislike = yes allowmultiplekeys = yes delimiter = ":" } ================= File /usr/local/etc/raddb/grouplist: datacenter:user1,user2,usera ================== File huntgroups: Limit1 NAS-IP-Address == 192.168.2.5 Limit1 NAS-IP-Address == 192.168.2.6 Group-Name == datacenter --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438 > > Message: 8 > Date: Thu, 13 Dec 2007 12:55:51 +0000 > From: A.L.M.Buxey(a)lboro.ac.uk > Subject: Re: Example listed in huntgroup file does not work > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20071213125551.GA29697(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > > I should say that I do not want to use an external solution. > Creating a > > huntgroup for each NAS with the exact same user list does work, but > then > > if I have to change a user I would then have to modify what could be > > over 100 groups. > > i think, therein, lies your problem - you havent looked at the whole > logical design - and are fixated on the singular huntgroups file. > > if you want to control users, in groups, with huntgroups etc then > you should be using the huntgroup file to define NAS in groups, and > then another config file eg users to tie users to those huntgroups. > > alan > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 32, Issue 37 > ************************************************

3 2

RE: Example listed in huntgroup file does not work
by Reynolds, Walter 13 Dec '07

13 Dec '07

> Message: 9 > Date: Wed, 12 Dec 2007 22:41:54 +0100 > From: <tnt(a)kalik.co.yu> > Subject: RE: Example listed in huntgroup file does not work > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <MmeHNnnk.1197495714.6796440.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > >But I guess here is my problem. How do you assign more than one NAS > to > >a huntgroup? > > > The way it is shown in the huntgroups file. > I did, but the user list is not being recognized by more than one. How can I get that user list to be used for all NAS that are in that huntgroup? Or is this a bug? > >But this uses SQL which we are not using and would prefer not to. > > > Use LDAP then. Or feel free to list (same) users for every huntgroup > entry. I should say that I do not want to use an external solution. Creating a huntgroup for each NAS with the exact same user list does work, but then if I have to change a user I would then have to modify what could be over 100 groups. > > Ivan Kalik > Kalik Informatika ISP > > --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

3 2

Need help to test EAP-MD5
by Nilanjan Sarkar 13 Dec '07

13 Dec '07

Hi Friends, I want to test radiusd with radeapclient. I am following from radeapclient man page, and using "./radeapclient -x localhost auth testing123 <req.txt". req.txt is like this, User-Name = "bob" EAP-MD5-Password = "hello" NAS-IP-Address = marajade.sandelman.ottawa.on.c EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "bob" Message-Authenticator = 0x00 NAS-Port = 0 But radeapclient is getting access-reject with Failure EAP-Code from radiusd (running like ./radiusd -X in another console). ============== +++> About to send encoded packet: User-Name = "bob" EAP-MD5-Password = "hello" NAS-IP-Address = 255.255.255.255 EAP-Code = Response EAP-Id = 210 EAP-Type-Identity = "bob" Message-Authenticator = 0x00 NAS-Port = 0 Sending Access-Request of id 116 to 127.0.0.1 port 1812 User-Name = "bob" NAS-IP-Address = 255.255.255.255 Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Message = 0x02d2000801626f62 rad_recv: Access-Challenge packet from host 127.0.0.1:1812, id=116, length=80 EAP-Message = 0x01d30016041066eb786fd424a0ee6f85a194ea8c9d30 Message-Authenticator = 0x323ec83f657e741fc131ba05f1bac39f State = 0xa3e884a46fc0e687c2bce84c917cc61e <+++ EAP decoded packet: EAP-Message = 0x01d30016041066eb786fd424a0ee6f85a194ea8c9d30 Message-Authenticator = 0x323ec83f657e741fc131ba05f1bac39f State = 0xa3e884a46fc0e687c2bce84c917cc61e EAP-Id = 211 EAP-Code = Request EAP-Type-MD5 = 0x1066eb786fd424a0ee6f85a194ea8c9d30 +++> About to send encoded packet: User-Name = "bob" EAP-MD5-Password = "hello" NAS-IP-Address = 255.255.255.255 EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Type-MD5 = 0x108d31440ff81df18a9294cd9bd36bdce6 State = 0xa3e884a46fc0e687c2bce84c917cc61e Sending Access-Request of id 117 to 127.0.0.1 port 1812 User-Name = "bob" NAS-IP-Address = 255.255.255.255 Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 State = 0xa3e884a46fc0e687c2bce84c917cc61e EAP-Message = 0x02d3001604108d31440ff81df18a9294cd9bd36bdce6 Re-sending Access-Request of id 117 to 127.0.0.1 port 1812 User-Name = "bob" EAP-MD5-Password = "hello" NAS-IP-Address = 255.255.255.255 EAP-Code = Response EAP-Id = 211 Message-Authenticator = 0x00000000000000000000000000000000 NAS-Port = 0 EAP-Type-MD5 = 0x108d31440ff81df18a9294cd9bd36bdce6 State = 0xa3e884a46fc0e687c2bce84c917cc61e EAP-Message = 0x02d3001604108d31440ff81df18a9294cd9bd36bdce6 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=117, length=44 EAP-Message = 0x04d30004 Message-Authenticator = 0x083613356791ba254aa786ddbb62d393 <+++ EAP decoded packet: EAP-Message = 0x04d30004 Message-Authenticator = 0x083613356791ba254aa786ddbb62d393 EAP-Id = 211 EAP-Code = Failure ============== I have added in radiusd.conf the following info eap { default_eap_type = md5 md5 { } ==================================== My queries are as following.. Do I need to add any md5 related attributes in server configuration? I have found in some file like digest-auth-MD5 "<>/freeradius-1.1.7/src/tests", but not sure how to inform radiusd server about this file. Also do not find any documentation about usage of "digest-auth-MD5". Any information/help regarding this is highly appreciated. Kind Regards, Nilanjan

3 6

Event-timestamp conversion
by manIP 13 Dec '07

13 Dec '07

Hi all, I have a problem when I receive a "Event-Timestamp" attribute. The provider assures me that he sends it in seconds (...elapsed since Jan 1st 1970) but My radius server "convert it into a date. For instance, the operator has sent Event-Timestamp = 1197392955 and I receive Event-Timestamp = "Dec 11 2007 12:09:15 EST". How I could deactivate that conversion because I want that attribute is seconds? Many Thanks!!

2 1

RSA SecurID Authentication
by Arran Cudbard-Bell 13 Dec '07

13 Dec '07

Hi, Just wondering if anyone on here had some experience with authenticating against a SecurID management server. I think the easiest way would be just to proxy to the RSA RADIUS Server (Funk), but I see there are some PAM modules available from RSA. So if anyone been successful using either of these methods, FR Version and Method (PAM,Proxy) info would be greatly appreciated. Seems like something useful that could go into the wiki. Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

4 3

MAC or user auth
by CoMeC 12 Dec '07

12 Dec '07

Hi, I try to configure such a solution: Authorization via MAC Address (with no username required) - if the machine is using a valid IP Address, it is automatically allowed to surf. (I know there is a Calling-Station-id attribute in radcheck) But I need also a support for username/password authentification (via WWW) too. When I try to log in only with MAC, I get a Radius responce "no username", and the machine is denied. How/where in radiusd.conf can I make changes? Thx in advance, Best regards, CoMeC

3 7

RE: Example listed in huntgroup file does not work
by Reynolds, Walter 12 Dec '07

12 Dec '07

Replying to both suggestions inline, but neither will work. >> >> Try this: >> >> alphen NAS-IP-Address =~ '^192\.168\.2\.[56]$' >> User-Name == test1, >> User-Name == test2 >> Problem is in real deployment the IPaddress will be varied from different subnets. >> Regards, >> Frank Ranner >> > Date: Tue, 11 Dec 2007 22:28:54 +0100 > From: <tnt(a)kalik.co.yu> > > Example is fine. "Reply" items apply only to the huntgroup under which > they are listed. They won't apply to others even with the same name. But I guess here is my problem. How do you assign more than one NAS to a huntgroup? > Try this (not sure if Huntgroup-Name works in preprocess): > > alphen NAS-IP-Address == 192.168.2.5 > alphen NAS-IP-Address == 192.168.2.6 > let_in Huntgroup-Name == alphen > User-Name == test1, > User-Name == test2 This did not work as is. > > Normally, you would add those users to a group and use Huntgroup-Name > check in radgroupcheck. But this uses SQL which we are not using and would prefer not to. > > Ivan Kalik > Kalik Informatika ISP > > Dana 11/12/2007, "Reynolds, Walter" <waltr(a)umich.edu> pi?e: > > >I have tried to set up a huntgroup to match based on the example that > is > >given in the file itself, but am not getting expected results. I want > >to limit the users that can connect to specific NAS's which works well > >if there is only one NAS in the huntgroup, but does not work for more > >than one. So I am sure that there is something simple I am missing > > > >Following is what I have. It will prevent user test3 from > >authenticating on 192.168.2.6, but not .5 > > > > > >alphen NAS-IP-Address == 192.168.2.5 > >alphen NAS-IP-Address == 192.168.2.6 > > User-Name == test1, > > User-Name == test2 > > > >So why does the authorize section not see the first NAS listed in the > >huntgroup? I have many boxes that need the same users while limiting > >all others. This could be done with a huntgroup for each NAS, but > then > >if a user changes I am forced to modify every huntgroup. I am using > >1.1.6. Thanks. > > > > > >--- > >Walt Reynolds > >Principal Systems Security Development Engineer > >Information Technology Central Services > >University of Michigan > >(734) 615-9438 > >

2 1

RE: MAC or user auth
by CoMeC 12 Dec '07

12 Dec '07

Ok, Sorry for unsufficent informations. :) For both authentifications methods there will be 2 separate NAS (one for username/pass auth and one for MAC auth) As NAS I will use Mikrotik routers. The thing is - router will lease DHCP Address to a clients machine. - router sends Calling-Station-id Attribute in Access-Request, so I know the client's MAC In radcheck I have for example a user "John" with attribute Calling-Station-id := MAC I would like freeradius to ignore username and only check table for MAC. If he found a valid MAC, then it knows that the user is "John" and it can send an Access-Accept with parameters. I know that radius can authenticate a Username with MAC. But how to make radius ignores the username? So, if Radius found no Calling-Station-id:=MAC attribute, and it has got Username, then it has to authenticate user using username and password. :) Is it possible? And if not would you advice me another solution? Thanks, Best regards, CoMeC :) On Wed, 12 Dec 2007 13:13:34 +0100, "Edvin Seferovic" <edvin.seferovic(a)kolp.at> wrote: >>Authorization via MAC Address (with no username required) > > This is being done by your NAS ! Username is usually the MAC address. > >> if the machine is using a valid IP Address, it is automatically allowed > to > surf. >> (I know there is a Calling-Station-id attribute in radcheck) > > IP address has to be given by DHCP or your NAS. FreeRADIUS has nothing to > do > with the firewall rules ( NAT etc ). > >>But I need also a support for username/password authentification (via > WWW) > too. > > This also depends on your NAS ! > >>When I try to log in only with MAC, I get a Radius responce "no > username", >>and the machine is denied. > > Run freeradius in debug mode ( freeradius -X ) and see what attribute is > used for MAC address and use it as i.e. username. > > You should send us more information about your NAS. Nobody will be able to > help you in other case. > > Regards, > E:S > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

1 0

RE: rlm_eap: Identity does not match User-Name...
by Michael Patzer 12 Dec '07

12 Dec '07

if anybody has the same problem, here's the solution.. i've installed 2.0.0-pre2 and made just the following changes to radiusd.conf: mschap { with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge} --nt-response=%{mschap:NT-Response} --domain=%{mschap:NT-Domain}" } after that averything works fine, so i started to add my perl-module to every section. after that it fails with the same error as pre1. so i remove "perl" from the authorize section - where it wasn't realy required, and now everything works fine. i think this will also works with pre1, but now i'll stay on pre2 :-) for 2.0.0 final: the sample "ntlm_auth"-line in radiusd.conf won't work! thx for help, Alan. regards, michael

2 1