May 2008 - Freeradius-Users - lists.freeradius.org

Re : Re : EAP-TLS/PEAP problem
by Joel MBA OYONE 02 May '08

02 May '08

Hello list, I've just installed SUSE 10.3 and freeradius 2.0.2.2-3 to easily setup my prevoious prob with eap. right now, when i run "radiusd -W" i encounter this error message: === /etc/raddb/certs/bootstrap: line 15: make: command not found Exec-Program output: Exec-Program: returned: 127 rlm_eap: Failed to initialize type tls /etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /etc/raddb/sites-enabled/default[252]: Failed to find module "eap". /etc/raddb/sites-enabled/default[199]: Errors parsing authenticate section. } } Errors initializing modules == reading the readme file in certs/ directory, i understood that the script bootstrap should create the certificates and some other stuffs, and the should be renamed or destroyed. - that i see is: the script didn't create nothing and could not be run. could you please help me to fix it? ( my final goes is to use eap-tls / eap-peap to athenticate wireless clients, and like i said before, i am really newbie on linux. thanx for help) MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Mercredi, 30 Avril 2008, 11h39mn 36s Objet : Re: Re : EAP-TLS/PEAP problem http://www.freeradius.org/download.html Find the OS version that you have and download the latest freeradius version rpm. Ivan Kalik Kalik Informatika ISP Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piše: >Well, as i am very very newbie on Linux. iuse to work on win2000/2003 before. >Â i chose the easyway to install freeradius; the "yum" commaand gave me that version. >if the latest version is easy to install manuallyÂ on fedora and is able to work on a hp proliant ml-370 g5, i take it. >Why not the latest version. It will create and install the certificates >for you. Even if you don't want to install it you can download it and >use it to create certificates. > >Ivan Kalik >Kalik Informatika ISP > > >Dana 30/4/2008, "Joel MBA OYONE" <mba_oyone(a)yahoo.fr> piĹĄe: > >>Hello list. >>I am sorry about my poor english skills but hope iĂÂ could be understood anyway. >>I use freeradius 1.1-7 on fedora 8 (installed with yum command).ĂÂ right now, my users in the "/etc/raddb/users" file are able to authenticate without no problem. >>iĂÂ intend to use eap-tls and eap-peap to authenticate my users. to do so, i read this tutorial: http://www.wi-fiplanet.com/tutorials/article.php/3557251ĂÂ (two sheets) which is very helpfull. >>but on the second part of the tuto,ĂÂ i encounter a problem with the extensions part: >>- it is said to create a file named "extensions" (my case /etc/pki/tls/extensions) and to copy that lines into: >>[ xpclient_ext] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.2 >>[ xpserver_ext ] >>extendedKeyUsage = 1.3.6.1.5.5.7.3.1 >>and then to modify my previous certificate like that: >># openssl ca -out master_cert.pem -extensions xpserver -infiles ./masterreqpem >># openssl ca -out client_cert.pem -extensions xpserver -infiles ./clientreqpem >>when i do this, the system give me an error message: >>[root@ensiasra ensiasCA]# pwd >>/etc/pki/CA/ensiasCA >>[root@ensiasra ensiasCA]# openssl ca -out certs/ensias_cert.pem -extensions xpserver_ext -infiles certs/radiusserverreq.pem >>Using configuration from /etc/pki/tls/openssl.cnf >>Enter pass phrase for /etc/pki/CA/ensiasCA/private/cakey.pem: >>Error Loading extension section xpserver_ext >>4230:error:0E06D06C:configuration file routines:NCONF_get_string:no value:conf_lib.c:329:group=CA_default name=email_in_dn >>[root@ensiasra ensiasCA]# >> >>i suppose i have problem creating extensions.... >>there's a long time i try to fix it (and some many before), and right now, i come and ask your help to fix it. >>thanx for helping >> >>ĂÂ >>MBA OYONE JoÄĹ¤l >>Lot.. El Firdaous >>BÄËt GH20, Porte A 204, Appt 8 >>20000 Oulfa >>Casablanca - Maroc >>ĂÂ >>TÄĹ l. : +212 69 25 85 70 >> >>__________________________________________________ >>Do You Yahoo!? >>En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitÄĹ s >>http://mail.yahoo.fr Yahoo! Mail >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >__________________________________________________ >Do You Yahoo!? >En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicitĂŠs >http://mail.yahoo.fr Yahoo! Mail > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 02 May '08

02 May '08

>No, there is a digest module in default radiusd.conf that should decode >the attributes. Post radiusd -X for request with Digest-Attributes. >Those attributes you want are not in the request - have you tried >$RAD_CHECK. hi Kalik, I've tried $RAD_CHECK but still i didn't get the values of these attributes 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response', I've found a digest module in radiusd.conf but actually don't have any idea how to handle the module. Please tell me how to get the value of these attributes. Here is the full output when the radius is run in debugging mode: [root@localhost raddb]# radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 9 2008 at 21:42:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 192.168.1.227 { require_message_authenticator = no secret = "johnson" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/etc/raddb/myperltemp.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } perl { max_clones = 32 start_clones = 32 min_spare_clones = 0 max_spare_clones = 32 cleanup_delay = 5 max_request_per_clone = 0 } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. and here is the output after when rejecting the users rad_recv: Access-Request packet from host 127.0.0.1 port 32795, id=73, length=59 User-Name = "johnson" User-Password = "johnson" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x92fa6c8 asigned new request. Handled so far: 1 found interpetator at address 0x92fa6c8 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: User-Name = johnson rlm_perl: RAD_REQUEST: User-Password = johnson rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: ############################################################### rlm_perl: Added pair User-Name = johnson rlm_perl: Added pair User-Password = johnson rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x92fa6c8 ++[perl] returns reject Invalid user: [johnson/johnson] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> johnson attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 73 to 127.0.0.1 port 32795 Reply-Message = "Incorrect Password" Waking up in 4.9 seconds. Cleaning up request 0 ID 73 with timestamp +3 Ready to process requests. Thank you Kalik. Wtih Regards, Elangbam Johnson

2 1

Duplicate accounting packets
by Tim Lightfoot 02 May '08

02 May '08

Freeradius 2.0.3 FreeBSD 6.3 I have a problem where accounting packets are not getting acknowledged by Freeradius. I have been using the NTRadPing testing tool and have determined that if the Accounting Start packet contains a NAS-Port attribute, the packet will timeout. If I remove the NAS-Port attribute from the Accounting Start packet I get an instant response. Please see below output from radiusd -X - the line that seems to vary between successful and failed attempts is ++[unix] returns fail (its ++[unix] returns noop when successful). Ready to process requests. User-Name = "80001(a)test.net.uk" Acct-Status-Type = Start Acct-Session-Id = "2476" NAS-IP-Address = 10.0.1.110 NAS-Port = 1073 +- entering group preacct ++[preprocess] returns ok rlm_acct_unique: Hashing 'NAS-Port = 1073,Client-IP-Address = 10.0.1.110,NAS-IP-Address = 10.0.1.110,Acct-Session-Id = "2476",User-Name = "80001(a)test.net.uk"' rlm_acct_unique: Acct-Unique-Session-ID = "22a2bff7af67d3ea". ++[acct_unique] returns ok rlm_realm: Looking up realm "test.net.uk" for User-Name = "80001(a)test.net.uk <mailto:s80001@test.net.uk> " rlm_realm: Found realm "test.net.uk" rlm_realm: Proxying request from user 80001 to realm test.net.uk rlm_realm: Adding Realm = "test.net.uk" rlm_realm: Accounting realm is LOCAL. ++[suffix] returns noop acct_users: Matched entry DEFAULT at line 22 WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: %{Stripped-User-Name:-%{User-Name}} -> 80001(a)test.net.uk ++[files] returns ok +- entering group accounting expand: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radacct/10.0.1.110/detail-20080502 rlm_detail: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.0.1.110/detail-20080502 expand: %t -> Fri May 2 09:06:38 2008 ++[detail] returns ok ++[unix] returns fail Finished request 1. Many thanks Tim Any opinions expressed in this email are those of the individual and not necessarily those of Sota Solutions Limited. It is intended only for the person(s) to whom it is addressed and may contain privileged and/or confidential information. Accordingly, the copying, dissemination, distribution, or use of this message to any other person may constitute a breach of Civil or Criminal Law. Please notify the sender immediately if you have received this email by mistake and delete it from your system.

2 1

Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record
by 여친급구 02 May '08

02 May '08

Hello Fedora Core 5 freeradius-1.1.7.tar.gz /var/log/radius/radius.log Thu May 1 05:53:35 2008 : Error: rlm_radutmp: Logout for NAS localhost port 3, but no Login record Thu May 1 05:53:37 2008 : Error: rlm_radutmp: Logout for NAS localhost port 13, but no Login record Thu May 1 06:19:45 2008 : Info: rlm_sqlippool: ip=[172.16.1.2] len=10 Thu May 1 06:23:19 2008 : Info: rlm_sqlippool: ip=[172.16.2.1] len=10 Thu May 1 06:23:52 2008 : Info: rlm_sqlippool: ip=[172.16.2.15] len=11 Thu May 1 06:24:15 2008 : Info: rlm_sqlippool: ip=[172.16.2.18] len=11 Thu May 1 06:46:20 2008 : Info: rlm_sqlippool: ip=[172.16.2.1] len=10 Thu May 1 06:49:58 2008 : Info: rlm_sqlippool: ip=[172.16.2.7] len=10 Thu May 1 07:10:33 2008 : Error: rlm_radutmp: Logout for NAS localhost port 15, but no Login record Thu May 1 07:32:56 2008 : Error: rlm_radutmp: Logout for NAS localhost port 6, but no Login record Thu May 1 07:35:40 2008 : Error: rlm_radutmp: Logout for NAS localhost port 1, but no Login record Thu May 1 08:03:33 2008 : Error: rlm_radutmp: Logout for NAS localhost port 10, but no Login record Thu May 1 08:14:10 2008 : Error: rlm_radutmp: Logout for NAS localhost port 8, but no Login record Thu May 1 08:46:54 2008 : Info: rlm_sqlippool: ip=[172.16.2.19] len=11 Thu May 1 09:10:02 2008 : Info: rlm_sqlippool: ip=[172.16.1.2] len=10 Thu May 1 09:11:05 2008 : Info: rlm_sqlippool: ip=[172.16.1.8] len=10 Thu May 1 09:11:44 2008 : Info: rlm_sqlippool: ip=[172.16.1.9] len=10 Thu May 1 09:22:00 2008 : Info: rlm_sqlippool: ip=[172.16.2.15] len=11 Thu May 1 09:22:33 2008 : Info: rlm_sqlippool: ip=[172.16.2.4] len=10 Thu May 1 09:37:14 2008 : Info: rlm_sqlippool: ip=[172.16.2.19] len=11 Thu May 1 09:55:46 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 10:10:48 2008 : Info: rlm_sqlippool: ip=[172.16.2.13] len=11 Thu May 1 10:59:31 2008 : Error: Invalid operator for item Expiration: reverting to '==' Thu May 1 10:59:31 2008 : Info: rlm_sqlippool: ip=[172.16.2.6] len=10 Thu May 1 11:16:17 2008 : Info: rlm_sqlippool: ip=[172.16.2.3] len=10 Thu May 1 11:21:35 2008 : Error: rlm_radutmp: Logout for NAS localhost port 16, but no Login record Thu May 1 11:24:37 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 11:26:33 2008 : Info: rlm_sqlippool: ip=[172.16.2.19] len=11 Thu May 1 11:38:15 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 11:39:46 2008 : Info: rlm_sqlippool: ip=[172.16.2.16] len=11 Thu May 1 11:48:10 2008 : Info: rlm_sqlippool: ip=[172.16.2.8] len=10 Thu May 1 11:56:14 2008 : Info: rlm_sqlippool: ip=[172.16.2.18] len=11 Thu May 1 12:30:39 2008 : Info: rlm_sqlippool: ip=[172.16.1.13] len=11 Thu May 1 13:05:56 2008 : Info: rlm_sqlippool: ip=[172.16.2.5] len=10 Thu May 1 13:08:26 2008 : Info: rlm_sqlippool: ip=[172.16.2.3] len=10 Thu May 1 13:09:47 2008 : Info: rlm_sqlippool: ip=[172.16.2.9] len=10 Thu May 1 13:20:23 2008 : Info: rlm_sqlippool: ip=[172.16.2.17] len=11 Thu May 1 13:55:59 2008 : Info: rlm_sqlippool: ip=[172.16.2.18] len=11 Thu May 1 14:09:19 2008 : Info: rlm_sqlippool: ip=[172.16.2.3] len=10 Thu May 1 14:09:47 2008 : Info: rlm_sqlippool: ip=[172.16.2.1] len=10 Thu May 1 14:24:28 2008 : Error: rlm_radutmp: Logout for NAS localhost port 0, but no Login record Thu May 1 14:28:16 2008 : Error: rlm_radutmp: Logout for NAS localhost port 17, but no Login record Thu May 1 14:29:15 2008 : Error: rlm_radutmp: Logout for NAS localhost port 7, but no Login record Thu May 1 14:30:05 2008 : Error: rlm_radutmp: Logout for NAS localhost port 11, but no Login record Thu May 1 14:30:17 2008 : Error: rlm_radutmp: Logout for NAS localhost port 2, but no Login record Thu May 1 14:33:03 2008 : Info: rlm_sqlippool: ip=[172.16.1.1] len=10 ________________________________________________________ 180도 달라진 야후! 메일 - 여러 개의 메시지를 동시에 확인? 새로운 야후! 메일의 탭으로 가능해집니다. http://kr.content.mail.yahoo.com/cgland

1 0

HOWTO PEAP + FreeRadius + XP Client
by George KNIGHT 02 May '08

02 May '08

Hello everyone, Before I write my question here, I just want to let all of you know that I did lots of searching in both google and this email list. But couldn't find anything to get the answer. My question is I have been looking for a HOWTO paper for a beginner to set freeradius as an AAA server in a wireless environment to Windows XP SP2 clients. I will use Windows' own PEAP client. Is there such a paper someone can give me the link? I'm very frustrated to find out that there is no information available for a setup from the scratch. I wrote papers like that before for various topics such as subversion implementation for a multiple OS environment, VoIP implementation with a Linux based open sources S/W etc. I have intention to write such a paper for how to set up PEAP implementation with freeradius as well. But for that, I'm hoping someone can give me a good start. OK, here is my network settings and needed information; I have a SUSE SLES 10 server to be used as an AAA server. This server is called store-AAA and also acts as a DHCP server for the clients. I have a few of Cisco 1242 AP as an authenticator. Clients are going to be computers with WinCE as their OS and they will contact to the LAN wirelessly. What I want to achieve is authenticating this clients with server-AAA using PEAP before letting them use the other network resources. Thank you in advance for your time and effort. George Knight

5 16

LDAP Not recognising User-Name attribute in tunneled authentication FR 2.0.4
by Arran Cudbard-Bell 02 May '08

02 May '08

Hi, Exactly the same config used between 2.0.3 and 2.0.4, but now the LDAP module fails lookups because it claims it can't find the User-Name attribute.... PEAP: Got tunneled EAP-Message EAP-Message = 0x02fe004d1a02fe004831623806335a6bfd5678650649fdd76c200000000000000000949c9809c8a97e6c717a5 PEAP: Setting User-Name to ac221(a)sussex.ac.uk PEAP: Sending tunneled request EAP-Message = 0x02fe004d1a02fe004831623806335a6bfd5678650649fdd76c200000000000000000949c9809c8a97e6c717a5 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "ac221(a)sussex.ac.uk" State = 0xc771177ac78f0d80e7ad35c717d8d32f Framed-MTU = 1480 NAS-IP-Address = 139.184.6.156 NAS-Identifier = "hp-e-falm-g-77-sw1" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001c2ec47180" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" server default-inner { +- entering group authorize expand: %{outer.request:Realm} -> local expand: %{outer.request:NAS-Flags} -> 010010110000000 expand: %{outer.request:SS-Flags} -> 0000000000 expand: %{outer.request:Supplicant-Flags} -> 0001000000 expand: %{outer.request:Called-Station-SSID} -> ++[request] returns notfound ++? if ("%{User-Name}") expand: %{User-Name} -> ac221(a)sussex.ac.uk ? Evaluating ("%{User-Name}") -> TRUE ++? if ("%{User-Name}") -> TRUE ++- entering if ("%{User-Name}") +++? if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) expand: %{User-Name} -> ac221(a)sussex.ac.uk ? Evaluating ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) -> TRUE +++? if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) -> TRUE +++- entering if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) expand: %{1} -> ac221 ++++[request] returns notfound expand: %{3} -> sussex.ac.uk expand: %{%{3}:-sussex.ac.uk} -> sussex.ac.uk ++++[request] returns notfound +++- if ("%{User-Name}" =~ /^([^@]*)(@([-[:alnum:].]+))?$/) returns notfound +++ ... skipping else for request 5: Preceding "if" was taken ++- if ("%{User-Name}") returns notfound rlm_ldap: - authorize rlm_ldap: Attribute "User-Name" is required for authorization. ++[ldap] returns noop Relevant filter line in LDAP is : filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" Why is there now a static requirement for the User-Name attribute to be present anyway? Especially when the filter is defined in the config... -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 3

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 01 May '08

01 May '08

>No, there is a digest module in default radiusd.conf that should decode >the attributes. Post radiusd -X for request with Digest-Attributes. >Those attributes you want are not in the request - have you tried >$RAD_CHECK. hi Kalik, I've tried $RAD_CHECK but it doesn't work, I've found a digest module in radiusd.conf but actually don't have any idea how to handle the module. Here is the full output when the radius is run in debugging mode: [root@localhost raddb]# radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 9 2008 at 21:42:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 192.168.1.227 { require_message_authenticator = no secret = "johnson" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/etc/raddb/myperltemp.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } perl { max_clones = 32 start_clones = 32 min_spare_clones = 0 max_spare_clones = 32 cleanup_delay = 5 max_request_per_clone = 0 } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. and here is the output after when rejecting the users rad_recv: Access-Request packet from host 127.0.0.1 port 32795, id=73, length=59 User-Name = "johnson" User-Password = "johnson" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x92fa6c8 asigned new request. Handled so far: 1 found interpetator at address 0x92fa6c8 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: User-Name = johnson rlm_perl: RAD_REQUEST: User-Password = johnson rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: ############################################################### rlm_perl: Added pair User-Name = johnson rlm_perl: Added pair User-Password = johnson rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x92fa6c8 ++[perl] returns reject Invalid user: [johnson/johnson] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> johnson attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 73 to 127.0.0.1 port 32795 Reply-Message = "Incorrect Password" Waking up in 4.9 seconds. Cleaning up request 0 ID 73 with timestamp +3 Ready to process requests. Regards Elangbam Johnson

2 1

Deny AD groups
by rmp dmd 01 May '08

01 May '08

Hi, I have a security group in AD 'noremote' that I would like to deny VPN access. Reading the FAQ, I edit users to include DEFAULT Group == "noremote", Auth-Type := Reject Reply-Message = "Your account is not allowed." but this doesn't work. I also tried below which I based on my previous query to deny AD users (this is working) DEFAULT Group == "noremote", MS-CHAP-Use-NTLM-Auth := 0,Auth-Type := Reject Reply-Message = "Your account is not allowed." but still doesn't work. I'm not sure how the group should be used. So I also tested including the domain such as Group==DOMAIN\\noremote, Group==DOMAIN+noremote but still no success. Thanks in advance! Roehl

2 1

FR 1.1.7 + AD 2003 + LDAP
by Charlie B 01 May '08

01 May '08

Hello everyone, We have setup FreeRadius w/ Active Direcotry using LDAP and ntlm as per the wiki and everything is working great save one item of concern. When our users are needing to reset their password or have reset their password ntlm fails I'm pretty certain that this is not a freeradius issue and I'm sorry to post here however this would be the largest base for user whom may have experienced this issue We can correct the issue if we remove the registry key located HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters however this removes the 802.1x configuration for the machine. rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user Raduser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_mschap: Told to do MS-CHAPv2 for Raduser with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=Raduser' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 88 radius_xlat: '--challenge=5fb05b4d0e49743a' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=abc64919a43a42c675c516ce59001bb4a3ef65d68f8de407' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 48 modcall: leaving group MS-CHAP (returns reject) for request 48 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 48 modcall: leaving group authenticate (returns reject) for request 48 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [Raduser/<no User-Password attribute>] (from client localhost port 0) freeradius-1.1.7-3.1 samba-3.0.28-0 samba-client-3.0.28-0 samba-common-3.0.28-0 Any help much appreciated, we currently running about 1500 users with this setup and everything is great save the password issue. Thanks

5 14

Deny Users AD on Freeradius + Wireless&VPN
by rmp dmd 01 May '08

01 May '08

Hi, We have a wireless network that uses freeRadius integrated with AD for authentication. There are some test user accounts on AD that I would like to deny access on our Wireless and VPN. I have tried "How do I deny access to a specific user, or group of users" on FAQ but it is not working. I'm guessing that this is not the correct method. Please help me on how to set-up correctly. Thanks! Roehl

3 8