December 2009 - Freeradius-Users - lists.freeradius.org

Re: MAC authentication bypass --- How am I supposed to?edit?theusersfile to include multiple MAC addresses??
by Difan Zhao 22 Dec '09

22 Dec '09

So..., Alan suggested using unlang. I am actually reading un-language (5). If I use it, where or what file do I put your script in? =============================Script that Alan wrote==================================== authorise { if("%{User-Name}" =~ /[0-9a-z]{12}/i && "%{Huntgroup-Name}" == "MAB-switches"){ update control { Auth-Type := MAB } ok = return } } authenticate { Auth-Type MAB { ok } } ======================================================================== ================ I do understand that I need to revise it to make it only authenticate the right MAC addresses and only respond if the request meets certain criteria or have certain attributes. Can I include these logics in unlang such as User-Name == Calling-Station-Id or Service-Type == Call-Check? In addition, I want to assign these devices to a specific VLAN. Can I add the attributes here as well? Is this vlan assignment part of authentication or authorization? Alexander, I did read the links you gave me very carefully and I guess I understand the logic... However it seems that I have to edit many files. I am new to the FreeRadius and I don't have any programming experience... Is there a document which can tell me briefly what these files are for and how FreeRadius is using them? I don't really want to edit those files when I don't know enough about them... Thank you both for your advice! Difan

2 1

NTLM, Kerberos 5 or LDAP
by Difan Zhao 22 Dec '09

22 Dec '09

Greetings, I am trying to authenticate my network against Windows 2003 Active Directory. With help from Ivan Kalik, I was able to use NTLM to communicate with Windows 2003 server and authenticate EAP clients. On the EAP side I am using PEAP since they are mostly windows XP clients and I don't think there is another choice (please correct me if I am wrong). However on the Radius server side, I seem to have options. It seems that I can use NTLM, Kerberos 5 or LDAP to authenticate with Windows Domain Controller. So my questions are: Can I use any of them? If yes, could you send me helpful links about how to use Kerberos 5 and LDAP? Which one is the most recommended and why? You may have noticed that I have posted several questions these days and I really appreciate your help! Now I am really a fan of FreeRadius. I really want to learn it well and understand what it's capable of. I am a Cisco guy and I have some Linux experience but no programming experience. Can any of you recommend me a book about how to use FreeRadius? I think that will stop me asking stupid questions... Thank you! Difan Zhao Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com <http://www.guest-tek.com/> Office: 403-509-1010 ext 3048 Cell: 403-689-7514

2 1

David Suarez De Lis/UN24956/OPERACION Y MANTENIMIENTO/TSM está ausente de la oficina.
by david.suarezdelis＠telefonica.es 22 Dec '09

22 Dec '09

Estaré ausente de la oficina desde el 22/12/2009 y no volveré hasta el 28/12/2009. Responderé a su mensaje cuando regrese. Si tiene alguna emergencia, puede contactar con Accesos_SOR@telefonica (900 111 245 opción 3, 2)o Jose Manuel Gomez Perez (jmgomez(a)telefonica.es) ___________________________________________________________________________ Este mensaje se dirige exclusivamente a su destinatario y puede contener información privilegiada o confidencial. Si no es vd. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización está prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción. El correo electrónico vía Internet no permite asegurar la confidencialidad de los mensajes que se transmiten ni su integridad o correcta recepción. Telefónica no asume ninguna responsabilidad por estas circunstancias. This message is intended exclusively for its addressee and may contain information that is CONFIDENTIAL and protected by a professional privilege or whose disclosure is prohibited by law.If you are not the intended recipient you are hereby notified that any read, dissemination, copy or disclosure of this communication is strictly prohibited by law. If this message has been received in error, please immediately notify us via e-mail and delete it. Internet e-mail neither guarantees the confidentiality nor the integrity or proper receipt of the messages sent. Telefónica does not assume any liability for those circumstances. ___________________________________________________________________________

1 0

ttls+eap-md5
by anyi_9 22 Dec '09

22 Dec '09

Hello,Alan DeKok!Thank you very much for the clear answer. Now i encounter a new problem and would be very appreciated if you could give me some advice. My problem:The authentication is failed.Part of the information from freeradius server is: ... [eap]Handler failed in EAP/md5 [eap]Failed in EAP select ++[eap]returns invalid Failed to authenticate the usr Using Post-Auth-Type Reject +-entering group REJECT{...} [attr_filter.access_reject] expand: %{User-Name} -> anh attr_filter:Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 1 seconds Going to the next request ...

3 2

FR 2.1.7 and Hints File
by Bruce Nunn 22 Dec '09

22 Dec '09

The problem I'm trying to solve relates to Windows users who leave that "Automatically use my Windows login name and password" property checked. At my site, we authenticate with PEAPv0/MSCHAPv2 with usernames and mschapv2 password hashes stored in an ldap database, not in a Windows Domain. I'd like to get FreeRadius to strip off the computer name and password for these requests based on regular expression. As things are right now my hints file looks something like this. DEFAULT Prefix == "DOMAIN\\", Strip-User-Name = Yes Hint = "CAMPUS" DEFAULT Prefix == "DOMAIN.EDU\\", Strip-User-Name = Yes Hint = "CAMPUS" DEFAULT Prefix == "@DOMAIN.EDU\\", Strip-User-Name = Yes Hint = "CAMPUS" And I have a bunch of these but not every computer name of course. My users file uses this for the hint. DEFAULT Hint == "CAMPUS", MS-CHAP-Use-NTLM-Auth := No Session-Timeout == 10800, Fall-Through = No I'd like to set the hint with something like this, but I have not been able to get anything to work nor do I know if it is even possible to use regular expressions in the hints file. I have made sure freeradius was compiled with extended regular expression support. DEFAULT Prefix =~ "^(.*[\\\\]+)", Strip-User-Name = Yes Hint = "CAMPUS" None of these have worked, even with a subset of requests. DEFAULT Prefix =~ "^DOMAIN\\\\" User-Name := "%{Stripped-User-Name}", Hint = "CAMPUS" DEFAULT Prefix =~ /*\\\\/, Strip-User-Name = Yes searchfor = "^(.*[\\/]+)" DEFAULT Prefix =~ "^(.*[\\\\]+)", Strip-User-Name = Yes Hint = "CAMPUS"

1 0

Compile freeradius with wimax support
by Drazen Milosevic 22 Dec '09

22 Dec '09

Hello all, I'm trying to compile freeradius with wimax support but no success. This is my configure line ./configure --prefix=/usr/local/freeradius --with-mysql-lib- dir=/usr/local/mysql/lib/mysql --with-mysql-include- dir=/usr/local/mysql/include/ --with-rlm_eap_tls --with-rlm_eap_ttls --with- rlm_eap_peap --with-rlm_wimax --enable-ltdl-install --with-openssl Haven't found anything on the net, nor at this list... -- Drazen Milosevic VeratNet IT - IT Platforms and Security Department Senior System Administrator 37 Vojvode Misica Boulevard, Belgrade, Serbia Phone: +381 11 360 53 85 Fax: +381 11 360 53 30 E-mail: dmilosevic(a)it.verat.net Web: http://www.verat.net

2 4

"check_crl = yes" leads to "verify error:num=3:unable to get certificate CRL"
by Vieri 22 Dec '09

22 Dec '09

Hi, I'm doing something wrong with my Certificate Revocation List but I can't seem to understand what. I'm using freeradius 2.1.7 and openssl 0.9.8k. I'm self-signing the certificates. With "check_crl = no" everything works well. However, authentication does not work with "check_crl = yes" and I get an "unable to get certificate CRL" error. How can I debug this and understand why it can't get the CRL? Here are the steps I perform: # cd /etc/ssl # openssl ca -gencrl -keyfile FHM-CA/certs/radius_client_D_831_key.pem -cert FHM-CA/certs/radius_client_D_831_cert.pem -out FHM-CA/crl/FHM_crl.pem -crldays 60 # c_rehash FHM-CA/crl # cp FHM-CA/cacert.pem /etc/raddb/certs/FHM/ # cat FHM-CA/crl/FHM_crl.pem >> /etc/raddb/certs/FHM/cacert.pem # openssl verify -CApath FHM-CA/crl FHM-CA/crl/radius_client_D_831_cert.pem FHM-CA/crl/radius_client_D_831_cert.pem: OK eap.conf tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = xxxxx private_key_file = ${certdir}/FHM/radius_server_keycert.pem certificate_file = ${certdir}/FHM/radius_server_keycert.pem CA_file = ${cadir}/FHM/cacert.pem dh_file = ${certdir}/FHM/dh random_file = ${certdir}/FHM/random # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) uncomment the line below. # 5) Restart radiusd check_crl = yes CA_path = /etc/ssl/FHM-CA/crl/ crl_file = /etc/ssl/FHM-CA/crl/FHM_crl.pem crl_path = /etc/ssl/FHM-CA/crl/FHM_crl.pem The supplicant has the radius_client_D_831_cert.p12 certificate but I get this error on the freeradius server: +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 1812 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 05fe], Certificate --> verify error:num=3:unable to get certificate CRL [peap] >>> TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert write:fatal:unknown CA TLS_accept:error in SSLv3 read client certificate B rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation Any ideas are greatly appreciated. Vieri

1 0

Re: Compile freeradius with wimax support
by Drazen Milosevic 22 Dec '09

22 Dec '09

Freeradius get's compiled and installed with make install. But when I uncomment wimax in sites-enabled and start radius -X I get /usr/local/freeradius/etc/raddb/modules/wimax[92]: Failed to link to module 'rlm_wimax': rlm_wimax.so: cannot open shared object file: No such file or directory /usr/local/freeradius/etc/raddb/sites-enabled/default[104]: Failed to find module "wimax". /usr/local/freeradius/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. On Tuesday 22 December 2009 11:50:35 Timothy wrote: > He's asking what happens when you run "make" without the " > > Tim > > Drazen Milosevic wrote: > > On Tuesday 22 December 2009 11:39:18 Alan DeKok wrote: > >> Drazen Milosevic wrote: > >>> Hello all, > >>> > >>> I'm trying to compile freeradius with wimax support but no success. > >> > >> Perhaps you could try posting the error messages that are produced. > >> > >> Alan DeKok. > > > > There are no errors, configure just ends with all modules included except > > rlm_wimax? > > The version of freeradius is 2.1.7.

1 0

ttls+eap-md5
by anyi_9 21 Dec '09

21 Dec '09

Hello,all! Please help!I've to resolve this problem before tommorrow. My task is to cofigure the freeradius using TTLS+EAP-MD5 to authenticate users.I've found much information about how to configure this type on Internet,but there are some differences between different vesions. My freeradius version is:2.1.7 Please tell me the specific steps to configure the freeradius.Which files do I need to modify and how?Thank you very much!

2 1

RADIUS 2.x - modules not loaded correctly
by Axel Vogel 21 Dec '09

21 Dec '09

Hi all I want to inform the community about a mistake I run into and wish that nobody run into this after me. It's my style to copy an original file to a backup version before modifying it. Therefore I copied the ${confdir}/modules/mschap to ${confdir}/modules/mschap.ori and edited the ${confdir}/modules/mschap. Watching radiusd -xX I saw that my modifications to mschap did not work. It took me hours to figure out the following: All files (matching the regex /[a-zA-Z0-9_.]+/) in directory ${confdir}/modules are loaded into radiusd at startup time. ${confdir}/mschap.ori is loaded previous to ${confdir}/modules/mschap [I don't know why] and gives the old settings to the radiusd. After renaming ${confdir}/mschap.ori to ${confdir}/mschap-ori everything worked well. Because the minus sign don't match /[a-zA-Z0-9_.]+/ My warning: Beware of having private files in ${confdir}/modules. -- To the developers: I propose to name the module files with static suffix (like .mod or .rlm) and load only files with this suffix via $INCLUDE ${confdir}/modules/*.mod. Best regards Axel Vogel

6 11