July 2007 - Freeradius-Users - lists.freeradius.org

EAP-Handshakes: every reply runs the full authorize-section
by Rainer Brinkmann 13 Aug '07

13 Aug '07

FreeRADIUS Version 1.1.0: Hello, we run EAP-TTLS and what we get in Debug-Mode is, that every received EAP-Packet within the TLS-Tunnel-establish runs the complete authorize-section and slows down the overall time to create a TTLS-Tunnel. Reason is, that the User-Name e.g. "NTB-BRINK-610", which is the EAP-Identity, comes with every received EAP-Packet and is always checked against the full authorize-section. Is it possible to skip this redundant checks in the following EAP-responses that build a specific EAP-Session? (the EAP-Idents cant be resolved in our LDAP, cause that machinenames are always unknown to us. What we have to check are the inner-Tunnel - credentials) kind regards Rainer Brinkmann Network-Management University-Clinicum Hamburg / Germany -- Pflichtangaben gemäß Gesetz über elektronische Handelsregister und Genossenschaftsregister sowie das Unternehmensregister (EHUG): Universitätsklinikum Hamburg-Eppendorf Körperschaft des öffentlichen Rechts Gerichtsstand: Hamburg Vorstandsmitglieder: Prof. Dr. Jörg F. Debatin (Vorsitzender) Dr. Alexander Kirstein Ricarda Klein Prof. Dr. Dr. Uwe Koch-Gromus

2 2

Problems with DBM and MS-CHAP
by Tom Griffin 08 Aug '07

08 Aug '07

Hello, I am having a problem with Freeradius v1.1.6. We have one server (running v1.0.1) which works as we want it to, but when trying to build a new v1.1.6 server to act in the same way is proving to be difficult. All our users are stored in a local DBM database and authentication is either by MS-CHAP (when coming via a Cisco VPN 3000 concentrator) or by EAP (when coming via Cisco Aironet 1200). Using the Cisco client (and also the VPN concentrator test function) the authentication is successful, the same is true with EAP (ie. the DBM module is working). But when using MS-CHAP authentication is rejected. Here is the debug output; rad_recv: Access-Request packet from host xx.xx.xx.xx:1044, id=176, length=154 User-Name = "cs1tg" NAS-Port = 4054 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "xx.xx.xx.xx" MS-CHAP-Challenge = 0xd1076979a50becf0731656741b3a469a MS-CHAP2-Response = 0x0200ca320fdd144e34edc132ba42560c4619000000000000000064a36039b976de05bc0e340fbd2b5b0b1bff37a302ccc3f2 NAS-IP-Address = xx.xx.xx.xx NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "cs1tg", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_dbm: try open database file: /usr/local/etc/raddb/../usradmin/users rlm_dbm: Call parse_user: sm_parse_user.c: check for loops Add cs1tg to user list sm_parse_user: start parsing: user: cs1tg parse buffer: <<Auth-Type := Local, User-Password == "BLANKED">> rlm_dbm: recod parsed process pattern rlm_dbm: Pattern matched, look for request parse buffer: <<Service-Type = Framed-User, Framed-Protocol = PPP, Class = "OU=Unishef">> rlm_dbm: recod parsed rlm_dbm: Reply found Remove cs1tg from user list modcall[authorize]: module "dbm" returns ok for request 1 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [cs1tg] (from client vpn2 port 4054) My main concern is the apparent incorrect Auth-Type of 'mschap' rather than 'MS-CHAP' that I would have expected to see (which is most likely why rad_check_password is falling back to Local). The interesting thing is that when I disable DBM and add a test user locally, the MS-CHAP module successfully authenticates the user, suggesting there is some incompatibility between newer versions of freeradius, dbm and mschap (since we are using this combination on another server with v1.0.1) Here are the main sections of the config; modules { mschap { authtype = MS-CHAP # I have tried with this line blanked also } dbm { usersfile = ${confdir}/../usradmin/users } } authorize { preprocess suffix dbm mschap eap } authenticate { Auth-Type MS-CHAP { mschap } eap } I have tried many different orderings of the authorize section as well as combinations of variables in the mschap module config, but these have all given the same result. The config shown above is the version that is working on the older server. Any help would be greatly appreciated. Regards, Tom Griffin

2 4

Nas Type
by Roberto Greiner 03 Aug '07

03 Aug '07

Hi, I was starting to look at checkrad, and found (based on http://www.freeradius.org/radiusd/doc/Simultaneous-Use) that using "other" as the NAS-type will actually check only radutmp instead of looking at the actual NAS. Now, Could someone point me what would be the proper NAS type to use for each of the devices below(or the proper reference document to use)? I'm using the following NASes in my network: Monowall pfSense (3Com) Total Control PopTop (in Linux) What I want to do is to use checkrad as one of the steps to make sure that whoever appears as logged is really logged in, because I'm trying to use Simultaneous-use check, and some of the above (notably monowall) doesn't seem to be clearing properly sometimes. Thank you very much, Roberto Greiner -- ----------------------------------------------------- Marcos Roberto Greiner The optimists believe we are in the best of worlds The pessimists are afraid that this is true Murphy -----------------------------------------------------

4 7

Radius proxy: Assertionfailed problem
by Janne Peltonen 01 Aug '07

01 Aug '07

Hi! I seem to be getting errors such as Tue Jul 31 11:50:23 2007 : Error: Assertion failed in request_list.c, line 1012 in my Radius logs from time to time, especially during high load. This assertion failure leads to Radius server getting stuck, which in turn results in my clients getting stuck... My Radius server functions solely as a proxy to an another server. Any suggestions would be greatly appreciated. Cheers, --Janne Peltonen -- Janne Peltonen <janne.peltonen(a)helsinki.fi>

3 3

Re: Freeradius as a proxy to Windows IAS - not solved after all :-(
by Clive Gould 01 Aug '07

01 Aug '07

Hi everyone Thanks for all the help and advice so far :-) I have installed freeradius 1.1.7 and get the appended message when I try to use it as a proxy between a Linux/Moodle/PHP radius client and a Windows IAS server. The shared secrets are definitely the same. The Linux/Moodle/PHP radius client authenticates directly with the Windows IAS server without any problems, but it will not authenticate with the freeradius proxy in between! I need a working freeradius proxy. Help... Clive Sending Access-Request of id 0 to 10.200.0.2 port 1812 NAS-Identifier = "vle.bromley.ac.uk" NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "127.0.0.1" User-Name = "cliveg(a)staff.bromley.local" MS-CHAP2-Response = removed from message MS-CHAP-Challenge = removed from message NAS-IP-Address = 10.200.0.14 Proxy-State = 0x3832 --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 10.200.0.2:1812, id=0, length=235 Received Access-Accept packet from client 10.200.0.2 port 1812 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response.

4 3

Adding a NAS via SQL
by Paul Lambert 31 Jul '07

31 Jul '07

Hi all, I think I might be being a little dense but when I add a NAS to my SQL database, it doesn't appear to be enabled until I restart my radius server. Is there a way to automatically activate a new NAS device that I add to the SQL database? Kind regards, Paul.

12 26

Radius Client
by Sofia Silva 31 Jul '07

31 Jul '07

Hi! i'm trying to authenticate a Linux client but i'm having some problems. I'm running the server in debbuging mode, and when i send a request from the linux client, the server rejects it saying "invalid password". The password it shows is sth like"/245/eer/m43...." and so on, so i thougth the problem could be the secret word. however, i've checked it, both in the server's clients.conf file, and in the client's servers file, and it's ok. I've also tried with "radstatus" and the message i get is "Packet does not contain required Message-Authenticator attribute" I would appreciate a lot if sb could help me. regards, Sofia _________________________________________________________________ Visita MSN Latino Noticias: Todo lo que pasa en el mundo y en tu paín, ¡en tu idioma! http://latino.msn.com/noticias/

1 0

Re: Freeradius as a proxy to Windows IAS - Solved!
by Clive Gould 31 Jul '07

31 Jul '07

Hi everyone Please ignore my postings about problems with IAS authentication. I have just read this in the FAQ: "FreeRADIUS is limited to 16 characters for the shared secret." The shared secret on our IAS server is 25 characters long :-( Thanks anyway Clive

3 3

CalledStationID
by Jeffrey Sewell 31 Jul '07

31 Jul '07

I'm trying to solve a design issue and wonder if anyone has done something similar with hotspots. I would like to send back different values in the VSAs when a user logs in from one calledStationID vs another. For example. User joe logs in from hotspot1. the calledStationID is sent. FreeRADIUS takes that and sends back the local DNS server IP address (or whatever is specific to that region) instead of the one tied to, say, hotspot100. The goal is to allow me to setup different regions in FreeRADIUS with region-specific parameters. I had some things that I thought would work, but I'm wondering how others have solved this problem. Jeffrey

4 8

EAP-TLS
by abhishek singh 31 Jul '07

31 Jul '07

Hi, I have a setup where my client is trying to perform authentication to server by using EAP-TLS. The server is a pass through server, which forwards the packet to the free radius. The free radius, instead of sending the server certificates, bails out on seeing the client Hello and the TLS handshake aborts. I am not being able to figure out the exact cause. Any help will be appreciated. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/root/temp/freeradius- 1.1.6/raddb/certs/cert- srv.pem" tls: certificate_file = "/root/temp/freeradius-1.1.6/raddb/certs/cert- srv.pem" tls: CA_file = "/root/temp/freeradius-1.1.6/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/root/temp/freeradius-1.1.6/raddb/certs/dh" tls: random_file = "/root/temp/freeradius-1.1.6/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 172.25.13.61:32772, id=172, length=112 EAP-Message = 0x02f9001d01727361757365723140736166656e65742d696e632e636f6d User-Name = "rsauser1@****** inc.com" Framed-MTU = 1400 Message-Authenticator = 0x2250f6cd977a5d08a36d9b763bcbb0e4 NAS-Identifier = "127.0.0.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: Looking up realm "******inc.com" for User-Name = "rsauser1(a)safenet-inc.com " rlm_realm: No such realm "*****inc.com" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 249 length 29 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 172 to 172.25.13.61 port 32772 EAP-Message = 0x01fa00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xab07f776af1e85b77ff4701c377b35b0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772 , id=6, length=164 EAP-Message = 0x02fa003f0d160301003501000031030146ae5a6d0160fe0dfa54bb07a4621ff0f61c35aeb429d6b516224dc14464553200000a0004000500070009000a0100 User-Name = " rsauser1(a)safenet-inc.com" Framed-MTU = 1400 State = 0xab07f776af1e85b77ff4701c377b35b0 Message-Authenticator = 0xb29d99250e4ec7907b0db64636f40e2d NAS-Identifier = " 127.0.0.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: Looking up realm "safenet-inc.com" for User-Name = "rsauser1(a)safenet-inc.com " rlm_realm: No such realm "safenet-inc.com" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 250 length 63 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: Need to read more data: SSLv3 read client hello B rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 1 modcall: leaving group authenticate (returns reject) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.25.13.61:32772, id=6, length=164 Sending Access-Reject of id 6 to 172.25.13.61 port 32772 EAP-Message = 0x04fa0004 Message-Authenticator = 0x00000000000000000000000000000000 --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 6 with timestamp 46af0b4f Cleaning up request 0 ID 172 with timestamp 46af0b4f Nothing to do. Sleeping until we see a request.

1 0