January 2008 - Freeradius-Users - lists.freeradius.org

Bug?
by Dave Gibelli 07 Jan '08

07 Jan '08

This is a snippet from radiusd -X rad_recv: Access-Request packet from host 192.166.0.10:1645, id=216, length=78 NAS-IP-Address = 192.166.0.10 NAS-Port = 1 NAS-Port-Type = Virtual User-Name = "daveg" Calling-Station-Id = "192.166.0.231" User-Password = "abcdef" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "daveg", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 1 modcall[authorize]: module "files" returns ok for request 0 My users file is just: DEFAULT Auth-Type == "PAP" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 1 there should be no match on line 1 because the check item doesn't match. I get the same match if I change PAP to EAP, is this a bug?

2 1

proxied connection - please example
by kupkar＠rkcompdesign.info 07 Jan '08

07 Jan '08

Hi Alan, thank you for your quick answer. Please send me some example about this proxy configuration. Rgdrs, Radim > Hi, > > > Everything work OK, Ovislink send request to FreeRadius > > server, FreeRadius send Access-Request to IAS (mschapv2) > > IAS send Access-Accept, but Ovislink received > Access-Challenge from FreeRadius, one two, three ... and > > on the end authetication failed. > > proxied connection - by default you will probably have the > default proxy attributes set - which will filter out > required attributes for successful replies to be returned. > you will need to add a new entry to 'trust' the IAS return > values - and have more attributes allowed through. > > alan > Hi all, > > I found very much usefull information about this > configuration on the internet. But I have still problem > with this configuration. I need terminated PEAP locally on > the Freeradius and redirect only mschapv2 to IAS server > for authentication. > > Authentication server: FreeRadius.net version: 1.1.7 > Supplicant: Win XP SP2 (with PEAP) > Authenticator: Ovislink WL-5460AP v2 > > - users.conf > DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm > := Safeword > > - proxy.conf > realm Safeword { > ??????? type = radius > ??????? authhost??????? = <ip>:1645 > ??????? accthost??????? = <ip>:1646 > ??????? secret????????? = <secret> > ??????? } > > - eap.conf > peap { > ? ???????????? default_eap_type = mschapv2 > ?????????????? proxy_tunneled_request_as_eap = no > } > > Everything work OK, Ovislink send request to FreeRadius > server, FreeRadius send Access-Request to IAS (mschapv2) > IAS send Access-Accept, but Ovislink received > Access-Challenge from FreeRadius, one two, three ... and > on the end authetication failed. > > If I use user database on FreeRadius everything work OK. > (Access-Request, Access-Accept) no problem. > > Is it possible configure FreeRadius as only resend reply > from IAS to Ovislink? Or I have problem with > configuration. > > If you want I send you configuration files and log from > debug mode. > > I want this configuration because I want use one time > password authetication, but Safeword plugin on Active > Directory doesn't understand PEAP protocol. > Only one way is use FreeRadius as proxy. > > Thank you for your help. > > Rgdrs, > Radim

2 1

RE: Error on radius
by Ackbar Joolia 07 Jan '08

07 Jan '08

Thanks Alan, will try this. -----Original Message----- Sent: 07 January 2008 12:40 To: FreeRadius users mailing list Subject: Re: Error on radius Hi, > Thanks Alan, > We are using SQL for authentication and accounting - do you think this could be the issue? > > I could potentially have thousands of requests coming in almost simultaneously, is this going to be too much for the process to handle? i dont know how good your SQL database is - specification or throughput capability etc. have you done benchmarks? I would personally suggest that you use the sqlrelay method for the accounting to stop the threads being caught in accounting processes - as accounting causes update/write to SQL which is a performance hit (compared to authentication which is just usually a read) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55 No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

1 0

RE: Error on radius
by Ackbar Joolia 07 Jan '08

07 Jan '08

Thanks Alan, We are using SQL for authentication and accounting - do you think this could be the issue? I could potentially have thousands of requests coming in almost simultaneously, is this going to be too much for the process to handle? Ackbar -----Original Message----- From: freeradius-users-bounces+ackbar.joolia=bglobalplc.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ackbar.joolia=bglobalplc.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: 07 January 2008 10:40 To: FreeRadius users mailing list Subject: Re: Error on radius Hi, > 'The maximum number of threads (32) are active, cannot spawn new thread to handle request' FreeRADIUS is getting many many requests but cannot handle them in real time - usually due to the authentication or accounting being too slow - you use SQL or AD for authentication? SQL for accounting? > Also, do people know what is the maximum simultaneous incoming authentication calls that the radius process can handle? Or what ways can be adopted to deal with this? we have ours at over 128 without any local issues alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html *** Email COnfidentiality Notice *** This message is private and confidential.If you have received this in error, please notify us and remove it from your system. Contact info(a)bglobalmetering.com No virus found in this incoming message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55 No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

2 1

Cisco command authorization
by Stefan Winter 07 Jan '08

07 Jan '08

Hi all, there are inquiries every once in a while here about how to enable command authorization for Cisco devices in a Cisco-AVPair. The usual answer is: find out if the NAS has an attribute for it. Now I'm myself trying to get rid of a haunting daemon, the tac_plus daemon, and so I investigated. Cisco claims that there is a complete mapping scheme to translate TACACS+ expressions into Cisco-AVPair Vendor-Specific. This works for example with the priv-lvl attribute: cisco-avpair = "shell:priv-lvl=15" There is a web page for Cisco IOS at http://www.cisco.com/en/US/products/ps6350/products_configuration_guide_cha… detailing which TACACS+ commands exist, and it suggests that cisco-avpair = "shell:cmd=show" would do the trick to authorize the "show" command. EXCEPT that there is a tiny note for the commands "cmd" and "cmd-arg" saying that they cannot be used for encapsulation in the Vendor-Specific space. These two are the ONLY ones. Since it's just about parsing the string content of cisco-avpair at the router side, there is absolutely no technical reason why these two wouldn't go through. The only explanation then is that this is a deliberate step by Cisco to make sure that TACACS+ is "superior" to RADIUS by arbitrarily cutting down functionality. Probably the code in IOS is larger with an exception handling to make sure that it doesn't work. I must say: I'm pissed. But I hope I could at least clarify this topic. My next-best approach to circumvent this would be to define an intermediate privilege level that only has the permission to do the commands in question, and only assign the users in question to that lower priv-level. Scales poorly, but enough for us. Maybe that approach serves some others as well. Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

4 4

mschapv2 problem
by Cristian Novac 07 Jan '08

07 Jan '08

Hello all, I am trying to authenticate to freeradius using ttls with mschapv2 and i don't succeed; Attached is my eap.conf file; If you think something is wrong there or something should be added please tell me; also if you think other files should be configured as well. Thank you in advance! # -*- text -*- # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4.4.1 2006/01/04 14:29:29 nbk Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = ttls # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # # md5 { # } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # # leap { # } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # # auth_type = PAP # } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { # private_key_password = whatever private_key_password = asb#1234 # private_key_file = ${raddbdir}/certs/cert-srv.pem private_key_file = ${raddbdir}/certs/NEW/server-key.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # certificate_file = ${raddbdir}/certs/cert-srv.pem certificate_file = ${raddbdir}/certs/NEW/server.pem # Trusted Root CA list # CA_file = ${raddbdir}/certs/demoCA/cacert.pem CA_file = ${raddbdir}/certs/NEW/ca-cert.pem dh_file = ${raddbdir}/certs/NEW/dh random_file = ${raddbdir}/certs/NEW/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd check_crl = yes # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # check_cert_cn = %{User-Name} } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. default_eap_type = mschapv2 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} copy_request_to_tunnel = yes # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} use_tunneled_reply = yes } sim { } # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. # default_eap_type = mschapv2 # the PEAP module also has these configuration # items, which are the same as for TTLS. # copy_request_to_tunnel = no # use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # proxy_tunneled_request_as_eap = yes #} # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } }

3 7

reject proxy users
by Roar Pettersen 07 Jan '08

07 Jan '08

Hi ! We have a FreeRadius-1.1.7 which proxy radius request from several vpn servers. We need to reject students connecting to a employee vpn server. raddb/users : DEFAULT Realm == "student", NAS-IP-Address == 10.0.0.4, Auth-Type := Reject Reply-Message = "No VPN Access for students on 10.0.0.4", Fall-Through = 0 DEFAULT Realm == "student.domain.com", NAS-IP-Address == 10.0.0.4, Auth-Type := Reject Reply-Message = "No VPN Access for students on 10.0.0.4", Fall-Through = 1 The first with realm "student" doesn't work, but the last with realm "student.domain.com" does work. If I change the realm's then the first one always doesn't work, and the last one always work. -- Med vennlig hilsen / Regards; Roar Pettersen roar.pettersen(a)it.uib.no - http://www.uib.no

2 1

FreeRadius as PEAP proxy to IAS
by Radim KUPKA 06 Jan '08

06 Jan '08

Hi all, I found very much usefull information about this configuration on the internet. But I have still problem with this configuration. I need terminated PEAP locally on the Freeradius and redirect only mschapv2 to IAS server for authentication. Authentication server: FreeRadius.net version: 1.1.7 Supplicant: Win XP SP2 (with PEAP) Authenticator: Ovislink WL-5460AP v2 - users.conf DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := Safeword - proxy.conf realm Safeword { type = radius authhost = <ip>:1645 accthost = <ip>:1646 secret = <secret> } - eap.conf peap { default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no } Everything work OK, Ovislink send request to FreeRadius server, FreeRadius send Access-Request to IAS (mschapv2) IAS send Access-Accept, but Ovislink received Access-Challenge from FreeRadius, one two, three ... and on the end authetication failed. If I use user database on FreeRadius everything work OK. (Access-Request, Access-Accept) no problem. Is it possible configure FreeRadius as only resend reply from IAS to Ovislink? Or I have problem with configuration. If you want I send you configuration files and log from debug mode. I want this configuration because I want use one time password authetication, but Safeword plugin on Active Directory doesn't understand PEAP protocol. Only one way is use FreeRadius as proxy. Thank you for your help. Rgdrs, Radim

2 1

Re : freeradius & sql server with high loads
by A.Dupont 06 Jan '08

06 Jan '08

hi, I want to ask you for a service, can you please send me an example for radiusd.conf and rlm_sql.c and sql.c files for only accounting use of freeradius without any authentication or authorization. I have very high loads and just 5% of the accounting wich is registred in the database. I don't have problem in database the problem is that freeradius can't relay all request to database server. Thank you in advance ----- Message d'origine ---- De : "A.L.M.Buxey(a)lboro.ac.uk" <A.L.M.Buxey(a)lboro.ac.uk> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 3 Janvier 2008, 11h32mn 51s Objet : Re: freeradius & sql server with high loads hi, your database is too slow to handle all the accounting in real time. hence the error messages. hence the lack of accounting either speed the DB up - and/or add more handles - or move to putting the details in in 'after real time' - eg with SQL-Relay - putting them into a file then using the sql-relay script to put them into the DB - therefore the process wont wait at the accounting stage. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail http://mail.yahoo.fr

2 1

PEAP help!
by Dave Gibelli 06 Jan '08

06 Jan '08

All Here is a snippet from radiusd -X I just want mschap to allow the user on without checking the password, but I cannot work out where to configure freeradius to allow access without checking the password. All I want to do is place the port into the correct vlan. (I assume I have to use PEAP with XP.) Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 6 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for daveg with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 6 modcall: leaving group MS-CHAP (returns reject) for request 6 Dave

2 1