September 2007 - Freeradius-Users - lists.freeradius.org

Re: Controlling access to my Wireless network
by Arjuna Scagnetto 19 Sep '07

19 Sep '07

>> network, mac & xp. I wouldn't mind using plain text passwords if that could >> be forced. The only configurations that get close to working get as far as >> machapv2, then fail because of no nt/lm password. If I could use the >> password from my ldap connection which seems to be working nicely, then I >> would be thrilled. Could you give me the eap.conf that would do that? >> Thanks a million > > it wouldnt be in your eap.conf for a start - if you want to use PEAP against > your LDAP then you'll most likely need to put the NT hash of their password > into your LDAP directory and point to that instead in your LDAP checks. > a lot (a LOT) of people do this and are present on this list. if you want > to use plain test password checks then EAP-TTLS with PAP inner is one > of the only ways - but for that you'll need to install extra software > on the WinXP machines securew2 is free and enables winxp to recognize ttls-pap packets. arjuna

1 0

RE: RFC 3579 and Access-Accepts
by Josh Howlett 19 Sep '07

19 Sep '07

Hi Stefan, > Whereas RFC 3579 , chapter 2.6.5 says: > "An EAP-Message/EAP-Request/Notification SHOULD NOT be > included within an Access-Accept or Access-Reject packet." I think this is a case of mis-reading the (confusing?) notation used by the RFC. What the RFC is saying is that you are not permitted to include a Notification within an EAP-Request within an EAP-Message within an Access-Accept. It's not saying you're not allowed to include an EAP-Message attribute _per se_. FWIW, I don't think it would be possible to implement a compliant EAP method without including an EAP-Message in the Access-Acccept; you need to return an EAP-Success or EAP-Failure, and IIRC you can't do that in an Access-Challenge. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

1 0

RFC 3579 and Access-Accepts
by Stefan Winter 19 Sep '07

19 Sep '07

Hello, it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in: Packet-Type = Access-Accept Wed Sep 19 11:59:25 2007 MS-MPPE-Recv-Key = stuff MS-MPPE-Send-Key = morestuff EAP-Message = 0x03070004 Message-Authenticator = 0x593773a711f50bd8b4ce98434a7e1590 User-Name = "anonymous(a)restena.lu" Proxy-State = 0x323039 Whereas RFC 3579 , chapter 2.6.5 says: "An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet." This is now the second RADIUS implementation I see that behaves like that - is there a reason for the EAP-Message and something wrong with 3579, or is that SHOULD NOT just ignored by most? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 3

Re: Denying user from authentication
by anoop_c＠sifycorp.com 19 Sep '07

19 Sep '07

Hi Please explain brief about certificate revocation process as i am new to it.I have used openssl for creating certificates, Regards Anoop > Message: 3 > Date: Wed, 19 Sep 2007 10:36:18 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <QH9ZAN8X.1190194578.4188440.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > That won\'t work with EAP-TLS. As you found out. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 19/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> pi?e: > > >HI > > Thank you for the response.But as per users file configuration it > should deny the user if i include that user name-reject file.Do i need > to do any config for this to work. > > > >Regards > >Anoop > > > > > >> Message: 3 > >> Date: Tue, 18 Sep 2007 11:30:53 +0100 > >> From: <tnt(a)kalik.co.yu> > >> Subject: Re: Denying user from authentication > >> To: \"FreeRadius users mailing list\" > >> <freeradius-users(a)lists.freeradius.org> > >> Message-ID: <PsdtHepQ.1190111453.3996530.tnt(a)kalik.co.yu> > >> Content-Type: text/plain; charset=ISO-8859-2 > >> > >> Revoke the certificate. > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> > >> Dana 18/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> > pi?e: > >> > >> >Hi > >> > I am using EAP_TLS authentication with free radius 1.1.7 .The > >> authentication is a certificate based one. > >> > > >> > I want to reject one user .I have done config in users file > >> > > >> > anoop07 Auth-Type := Reject > >> > Reply-Message = \"Your account has been disabled.\" > >> > > >> >Stll the user autheticates.How can i prevent user like this? > >> > > >> >Regards > >> >Anoop > >> > > >> > > >> > > >> > > >> > >> > >>

2 1

Denying user from authentication
by anoop_c＠sifycorp.com 19 Sep '07

19 Sep '07

HI Thank you for the response.But as per users file configuration it should deny the user if i include that user name-reject file.Do i need to do any config for this to work. Regards Anoop > Message: 3 > Date: Tue, 18 Sep 2007 11:30:53 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <PsdtHepQ.1190111453.3996530.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Revoke the certificate. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 18/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> pi?e: > > >Hi > > I am using EAP_TLS authentication with free radius 1.1.7 .The > authentication is a certificate based one. > > > > I want to reject one user .I have done config in users file > > > > anoop07 Auth-Type := Reject > > Reply-Message = \"Your account has been disabled.\" > > > >Stll the user autheticates.How can i prevent user like this? > > > >Regards > >Anoop > > > > > > > > > > > > ------------------------------ > > Message: 4 > Date: Tue, 18 Sep 2007 14:12:50 +0200 > From: inverse <inverse(a)ngi.it> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <32deb3e30709180512k2361fb99x10f3e4693930f899(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > and make sure to use check_crl = yes in eap.conf > > On 9/18/07, tnt(a)kalik.co.yu <tnt(a)kalik.co.yu> wrote: > > Revoke the certificate. > > > ------------------------------ >

2 1

Controlling access to my Wireless network.
by Kent Thomas 19 Sep '07

19 Sep '07

Hello all, I'm looking for a simple way to protect access to my wireless network. I'm seeing a lot of old documentation on how to use EAP-TLS to protect the wireless network. I've found lots of old documentation on how to setup WPA Enterprise. I would like some updated docuentation on how to do this. I have a couple SonicWall SonicPoint devices that have the capability to do WPA Enterprise or WPA2 enterprise or both. I would like to be able to have a user attempt to join my wireless network, but be presented with the request for Username and Password. From there I would like to be able to have their connection authenticated and then allow them on. No authentication, no getting on. Securing the wireless signal is not the primary focus here. Securing the access to the network is. Is there a way to do this? I have FreeRadius 1.1.7 installed and working and currently will authenticate against my ldap server. Thank you for lending a hand to a newby here. Kent

5 8

Radrelay with multiple accounting files, radrelay via NFS
by Adam Bultman 19 Sep '07

19 Sep '07

Good morning, freeradius users. I have 2.5 questions. 1. Can radrelay be used with multiple accounting directories? I have multiple (7) directories with files I need to be watching with radrelay. I haven't been able to get radrelay to work properly when I use "-a /accounting-dir/" multiple times at the command line. 1.5: Can one use wildcards for the detailfile? I have two RADIUS servers, and each writes to it's own file (detail-radius1, detail-radius2) 2. On linux, radrelay doesn't appear to agree with NFS. I tried to host my detail files via NFS, and radrelay would 'run', but not actively process records. The radrelay debug would tell me it was "processing records", but would never send any packets. Meanwhile, the detail file it was supposed to be watching is ballooning with records. 2.5. Note: We have a solaris server where radrelay runs fine via NFS. I'm not too big a newbie to freeradius, but I'm trying to avoid running one process per NAS I need to monitor, and have my radius detail files split (some detail files via NFS, other detail files locally on the machine.) I've read man pages and googled, but haven't found answers. I *do* need to store my files via NFS, for accounting reasons, and doing copies to an NFS mount isn't really an option, either. Any help would is welcomed. Adam

2 1

Intel Proset Wireless Client does not process RFC3580 Attributes.
by Terry Pelley 18 Sep '07

18 Sep '07

FreeRADIUS Version 1.1.3-r0.1.2 (Upgrade to 1.1.7 is Pending) I am running FreeRADIUS to authenticate wireless users on a bunch of Cisco AP1231's. My wireless supplicants are running a combination of the standard Windows XP client which works fine and the Intel Proset Client which is causing problems. The Radius setup is for PEAP/MSChapv2 and each user has the following attributes assigned. Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-ID = "X" (Where X is the assigned VLAN Number) The Proset Clients do manage to eventually authenticate, but the above attributes do not appear to get processed. I think this is happening because the Proset Client sends the User-Name as "anonymous" and as there is no "anonymous" user defined, the attributes do not get applied. How do I get the User-Name to be sent correctly? Thanks in advance. Terry Pelley Network Analyst Business and Learning Technologies Ottawa-Carleton District School Board terry.pelley(a)ocdsb.ca

2 2

Denying user from authentication
by anoop_c＠sifycorp.com 18 Sep '07

18 Sep '07

Hi I am using EAP_TLS authentication with free radius 1.1.7 .The authentication is a certificate based one. I want to reject one user .I have done config in users file anoop07 Auth-Type := Reject Reply-Message = \"Your account has been disabled.\" Stll the user autheticates.How can i prevent user like this? Regards Anoop

3 2

Authentication failure via PAP
by Thomas Schmitz 18 Sep '07

18 Sep '07

Hi, I'm using Freeradius 1.1.6 inside a Solaris 10 zone and compiled it from vanilla sources. I configured rlm_ldap since the usernames and cleartext-passwords are stored in an LDAP directory and it works just fine for applications like Cisco-VPN or 802.1X EAP-TTLS. Now I wanted to set up the Captive Portal of pfsense/m0n0wall to authenticate against radius, which is using PAP for password transmission but authentication always fails even if I triple-check the entered user credentials. The freeradius log always says: Auth: Login incorrect (rlm_ldap: Bind as user failed): [my_username] (from client pfsensebox port 1 cli 00:17:f2:xx:yy:zz) Of course I also checked if the radius client is using the correct secret. I set auto_headers to "yes" as it is suggested in the rlm_pap manpage and put pap at the end of the authorize section. I also included an excerpt of my radiusd.conf ---begin radiusd.conf--- modules { pap { auto_header = yes } ldap { server = "ldapserver.mydomain.com" basedn = "ou=people,o=my organization,c=de" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } } authorize { auth_log chap mschap suffix eap ldap files daily pap } authenticate { pap chap mschap ldap eap } ---end radiusd.conf--- Here is an output of radiusd -X: ---begin radiusd -X output--- rad_recv: Access-Request packet from host 111.222.333.444:51087, id=255, length=131 NAS-IP-Address = 111.222.333.444 NAS-Identifier = "pfsense.local" User-Name = "my_username" User-Password = "\301q\202\355g\264g)N\265\315\311\374\205i" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 1 Framed-IP-Address = 192.168.23.200 Called-Station-Id = "00:01:02:xx:yy:zz" Calling-Station-Id = "00:17:f2:aa:bb:cc" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/opt/radiusd/var/log//radacct/auth-detail-200709' rlm_detail: /opt/radiusd/var/log//radacct/auth-detail-%Y%m expands to /opt/radiusd/var/log//radacct/auth-detail-200709 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "my_username", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "my_username" rlm_realm: Proxying request from user my_username to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for my_username radius_xlat: '(uid=my_username)' radius_xlat: 'ou=people,o=my organization,c=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to directory.fernuni-hagen.de:389, authentication 0 rlm_ldap: bind as / to directory.fernuni-hagen.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=my organization,c=de, with filter (uid=my_username) rlm_ldap: checking if remote access for my_username is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding uid as User-Name, value my_username & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user my_username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "my_username" with password "Áq?íg ´g)NµÍÉü?i" rlm_ldap: user DN: uid=my_username,ou=People,o=my organization,c=de rlm_ldap: (re)connect to directory.fernuni-hagen.de:389, authentication 1 rlm_ldap: bind as uid=my_username,ou=People,o=my organization,c=de/Áq?íg´g)NµÍÉü?i to directory.fernuni-hagen.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [my_username] (from client pfsensebox port 1 cli 00:17:f2:aa:bb:cc) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! ---end radiusd -X output--- What seems very curious to me is that my password, though delivered in cleartext, seems broken since the password in the following line is actually not the real password: rlm_ldap: login attempt by "my_username" with password "Áq?íg ´g)NµÍÉü?i" Is it the client that does those nasty things or is my freeradius just misconfigured? How can I get it to work? Thanks in advance, Thomas

2 1