March 2009 - Freeradius-Users - lists.freeradius.org

Samba 3.2
by Casartello, Thomas 10 Mar '09

10 Mar '09

Did anyone ever find out if the samba guys fixed the problem with ntlm_auth returning the NT_KEY that was causing XP's 802.1x client to barf? Thomas E. Casartello, Jr. Staff Assistant - Wireless Technician/Linux Administrator Information Technology Wilson 105A Westfield State College (413) 572-8245 Red Hat Certified Technician (RHCT)

1 0

802.1x Auth Problem - Windows Login case sensitive?
by cn 10 Mar '09

10 Mar '09

Hi List, I have quite a interesting problem. And I don't think it's freeRADIUS-related, but I hope somebody else already had the same issue and can give me a hint. Also a hint where to dig / ask would be very nice... Okay, the setup: I'm using freeRADIUS aus 802.1x/PEAP authenticator for our WLAN-deployment and MS-AD als backend. It's the setup described in: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO And it's working quite well - for all machine accounts and most user accounts. So I assume my freeradius/samba/kerberos config is fine so far... The things I tracked: It seems all accounts migrated from the old NT or Windows2000 Domain are "Case Sensitive": For those accounts the Windows-User has to use exact the same upper/lower case for the user name used in AD's sAMAccountName - otherwise it won't work. For all new created accounts (after the migration) the case dosn't matter. Anybody heard of this or had the same issue? I already googled quite a lot, but I didn't come up with a solution. Just found some reports about similar problems. To the details: In my radius requests, I see following: For all new created accounts the windows login doesn't same to be case-sensitive. Regardless how the user name is written during login, in my radius requests I always see the username in exact the same way then it is stored in the AD. It seems the XP Client is doing some adjustments during auth. For the migrated accounts I see the user accounts in the same case then entered in the windows login - so it seems the client isn't doing these adjustments. And if the account is written in a different way, ntlm_auth is failing. Some parts of the trace for a successful request (sAMAccountName=testuser): rad_recv: Access-Request packet from host 10.1.1.5:32822, id=139, length=286 User-Name = "DOMAIN\\testuser" NAS-IP-Address = 10.1.1.254 NAS-Port = 2 NAS-Identifier = "10.1.1.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00XXXXXXXXX" Called-Station-Id = "000XXXXXXXXX" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = XXXXXXXXXXXXXX State = XXXXXXXXXXXXXX Aruba-Essid-Name = "mySSID" Aruba-Location-Id = "test-ap" Message-Authenticator = XXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 modcall[authorize]: module "mschap" returns noop for request 16 rlm_eap: EAP packet type response id 18 length 98 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 modcall[authorize]: module "files" returns notfound for request 16 modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = XXXXXXXXXXXXX PEAP: Setting User-Name to DOMAIN\testuser PEAP: Adding old state with 97 88 PEAP: Sending tunneled request EAP-Message = XXXXXXXXXXXXXX FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\testuser" State = XXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 16 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=testuser --challenge=bba9adXXXXXXXXXX --nt-response=565bc73aa70b1fXXXXXXXXXXXX07f081266171807c68d90 Exec-Program output: NT_KEY: 8066616C0E1F32C93158XXXXXXXXX Exec-Program-Wait: plaintext: NT_KEY: 8066616C0E1F32C9315866XXXXXXXXX Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 16 modcall: leaving group MS-CHAP (returns ok) for request 16 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 16 The same with different case (failed request): rad_recv: Access-Request packet from host 10.1.1.6:32822, id=110, length=286 User-Name = "DOMAIN\\TESTUSER" NAS-IP-Address = 10.1.1.254 NAS-Port = 1 NAS-Identifier = "10.1.1.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00XXXXXXXX" Called-Station-Id = "000XXXXXXXXX" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = XXXXXXXXXXXXXXX State = 0xXXXXXXXXXXXXXXXXXXX Aruba-Essid-Name = " mySSID" Aruba-Location-Id = "test-ap" Message-Authenticator = 0xXXXXXXXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: entering group authorize for request 329 modcall[authorize]: module "auth_log" returns ok for request 329 modcall[authorize]: module "mschap" returns noop for request 329 rlm_eap: EAP packet type response id 8 length 98 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 329 modcall[authorize]: module "files" returns notfound for request 329 modcall: leaving group authorize (returns updated) for request 329 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 329 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = XXXXXXXXXXXXXXXXXXXXXXXXX PEAP: Setting User-Name to DOMAIN\TESTUSER PEAP: Adding old state with 89 3f PEAP: Sending tunneled request EAP-Message = XXXXXXXXXXXXXXXXXXXXXXXXXXX FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\TESTUSER" State = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: entering group authorize for request 329 modcall[authorize]: module "preprocess" returns ok for request 329 modcall[authorize]: module "mschap" returns noop for request 329 rlm_eap: EAP packet type response id 8 length 75 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 329 modcall[authorize]: module "files" returns notfound for request 329 modcall: leaving group authorize (returns updated) for request 329 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 329 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 329 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for TESTUSER with NT-Password Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=TESTUSER --challenge=52972ee6749XXXXXXXX --nt-response=13c2b8dd52e6591e0c568a02802fb9450cc91XXXXXXXXXXXXXX Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 329 modcall: leaving group MS-CHAP (returns reject) for request 329 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 329 modcall: leaving group authenticate (returns reject) for request 329 auth: Failed to validate the user. Login incorrect: [DOMAIN\\TESTUSER/<no User-Password attribute>] (from client localhost port 0) If you need more information just ask... I hope somebody can give me a hint where to look or what to do. I also asked my Windows-People (I'm a unix guy...) but all the idea's they had didn't help... Thanks, Chris

2 1

Variables' content as a reply
by Augusto G. Andreollo 10 Mar '09

10 Mar '09

Hello all! I've been trying unsuccessfully to get this setup to work, but unfortunately haven't been able so far. My need is to return the contents of three LDAP fields as replies on the Access-Accept package. The setup is for EAP/TTLS, mostly following eduRoam's setup guide (EduROAM Cookbook -- DJ 5.1.5,3). My config is as follows: on ldap.attrmap: > checkItem cLDAPdepartmentNumber departmentNumber > replyItem rLDAPdepartmentNumber departmentNumber > checkItem cLDAPaffiliation eduPersonPrimaryAffiliation > replyItem rLDAPaffiliation eduPersonPrimaryAffiliation > checkItem cLDAPou ou > replyItem rLDAPou ou on dictionary.university: > VENDOR Unicamp 12345 > > BEGIN-VENDOR Unicamp > ATTRIBUTE University-LDAP-departmentNumber 1 string > ATTRIBUTE University-LDAP-affiliation 2 string > ATTRIBUTE University-LDAP-organizationUnit 3 string > END-VENDOR University (the attributes, at least, are recognized correctly on the reply). on the inner-tunnel configuration file:: > post-auth { > reply_log > Post-Auth-Type REJECT { > reply_log > } > redundant { > sql-server1 > sql-server2 > } > update outer.reply { > User-Name := %{reply:User-Name} > University-LDAP-departmentNumber := %{rLDAPdepartmentNumber} > } radiusd -v is: > radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.0, built on Jan 9 2009 at 07:02:31 but unfortunately, something does not translate right: From that I've gathered running on radiusd -X, the relevant parts are: - first, an error on rlm_ldap: > ++- entering policy redundant {...} > [ldap1] performing user authorization for user@university > [ldap1] expand: (eduPersonPrincipalName=%{User-Name}) -> (eduPersonPrincipalName=user@university) > [ldap1] expand: dc=university -> dc=university > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to ldap1.university:389, authentication 0 > rlm_ldap: starting TLS > rlm_ldap: bind as / to ldap1.university:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in dc=university, with filter (eduPersonPrincipalName=user@university) > [ldap1] checking if remote access for user@university is allowed by dialupAccess > [ldap1] looking for check items in directory... > rlm_ldap: Failed to create the pair: Invalid octet string "cc " for attribute name "cLDAPou" > rlm_ldap: Failed to create the pair: Invalid octet string "staff" for attribute name "cLDAPaffiliation" > rlm_ldap: Failed to create the pair: Invalid octet string "20.5.2.4.0.0.0" for attribute name "cLDAPdepartmentNumber" > rlm_ldap: radiusSimultaneousUse -> Simultaneous-Use == 1 > [ldap1] looking for reply items in directory... > rlm_ldap: Failed to create the pair: Invalid octet string "cc " for attribute name "rLDAPou" > rlm_ldap: Failed to create the pair: Invalid octet string "staff" for attribute name "rLDAPaffiliation" > rlm_ldap: Failed to create the pair: Invalid octet string "20.5.2.4.0.0.0" for attribute name "rLDAPdepartmentNumber" > WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? > [ldap1] Setting Auth-Type = LDAP > [ldap1] user user@university authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > +++[ldap1] returns ok - second: the reply's content is not getting translated right. Instead of sending the content's of the variables, it just sends the variable names outright: > Sending Access-Accept of id 235 to xxx.xxx.xxx.xxx port 32783 > User-Name = "%{reply:User-Name}" > University-LDAP-departmentNumber = "%{rLDAPdepartmentNumber}" > MS-MPPE-Recv-Key = blah > MS-MPPE-Send-Key = blah > EAP-Message = 0x03050004 > Message-Authenticator = 0x00000000000000000000000000000000 > Finished request 5. So, the most important question is: how do i reference the content's of the variables on the post-auth update section? Second: what's causing the check and reply items not to get translated? could this be an LDAP error or is there an error on the ldap.attrmap file? By the way, the authentication, authorization, everything is working fine already (including the TTLS/PAP part). Thanks in advance for any thoughts..

2 4

NLTM_AUTH (PAP) and MS-CHAP2 together?
by Mike Diggins 10 Mar '09

10 Mar '09

After getting NTLM_AUTH working using PAP, I decided to try the MS-CHAP2 as well and that appears to work, but I had to remove the line "DEFAULT Auth-Type := ntlm_auth" from my users file. When I do that MS-CHAP2 works, but PAP doesn't. I will have various radius clients, some of which support MS-CHAP2, but some do not. How can I use both together? My users will be connecting to both services, so defining a specific AUTH-TYPE for each user won't work. -Mike

3 6

Next release of freeradius
by Clare Scally 10 Mar '09

10 Mar '09

Hi, Can anyone tell me when the next freeradius release is due? Regards, Clare Scally.

3 2

proxy acct records best practices
by TR Missner 10 Mar '09

10 Mar '09

Hello, I am a new user of freeradius ( no experience with the 1.x version at all ). I am in the process of setting up radius for accounting of voip records. Due to the nature of my system blocking must be avoided at all costs. With this in mind I have configure FR to write accounting records locally to a file then I have the records proxied to a remote freeradius instance where the records are written to a database. My question revolves around best practices and speed. Reading and shipping the records off box is very slow ( somewhere around 5 - 10 records per second ). I believe this may be caused by the latency between the proxy and the master which is around 150ms. Of course I could just insert the records in the DB across the WAN but am not sure whether this would be any faster. I'm convinced latency is the issue because even when I turn off the databasing of records on the master and only write to flat files the speed remains in the same range. Keeping in mind my newness to freeradius I thought it might be a good idea to ask the community for suggestions. Thanks T

3 5

Assistance with FreeRADIUS and Windows Authentication via LDAP
by Edwin Isada 09 Mar '09

09 Mar '09

Hello, I am running FreeRADIUS version 1.1.3. I'm trying to setup LDAP authentication for Windows users accessing our networking devices especially with Cisco switches and routers. Windows authentication is working properly on my FreeRADIUS server, but I'm trying to figure out how to give different users special privilege access without providing them the enable password. I'd like to specify another Security group with providing them a read-only or special privilege mode with their Windows account. Is this possible? I'm new with using FreeRADIUS, please help. Thanks, Edwin

3 2

Problem compiling on OSX 10.5
by Paul Bartell 09 Mar '09

09 Mar '09

I have two problems: One is with compiling in mysql support. Despite using the following ./configure line ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include/ --with-mysql-lib-dir=/usr/local/mysql-5.1.30-osx10.5-x86/lib/ it still says checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed checking for SQLConnect in -liodbc... yes checking for isql.h... yes configure: creating ./config.status config.status: creating Makefile === configuring in ./drivers/rlm_sql_mysql (/Users/admin/radiusd/src/modules/rlm_sql/./drivers/rlm_sql_mysql) configure: running /bin/sh ./configure '--prefix=/usr/local/freeradius' '--with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include/' '--with-mysql-lib-dir=/usr/local/mysql-5.1.30-osx10.5-x86/lib/' '--enable-ltdl-install=no' --cache-file=/dev/null --srcdir=. checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... Im am using the version from cvs. Am I not fetching the mysql module or something (which doesnt seem likely as the latest stable gives the same error)? It appears that freeradius is trying to compile a universal binary. On a PPC machine I don't have this problem. The intel machine im installing on appears to have some ppc libraries missing. Is there any way to prevent this cross compiling or does anyone know a fast fix. Ive seen numerous posts on this issue with the same errors, and all of them seem unanswered. Im using the following to configure: ./configure --prefix=/usr/local/freeradius --with-mysql-include-dir=/usr/local/mysql-5.1.30-osx10.5-x86/include when running make I get build errors. I cant get to the machine at the moment, or else i would give the exact errors, but it has something to do with rlm_perl. -- Random quote of the week/month/whenever i get to updating it: "Opportunity knocked. My doorman threw him out." - Adrienne Gusoff "At school you don't get parole, good behavior only brings a longer sentence." - The History Boys

2 1

Conversion to Version 2
by Doug Hardie 09 Mar '09

09 Mar '09

I have been using FreeRadius 1.x for a number of years. It has worked just fine. All I am using it for is to authenticate and authorize dial-in users (its about as simple as you can get). The only unusual item is I have a couple of fairly complex modules for authorization and accounting. The question is should I bother to upgrade to 2.x. I don't have a need for any of the new features it provides. I don't even use most of the features in 1.x. My largest concern is the modules. I don't recall seeing anything here about what changes would be required for them other than I believe they have to be compiled with the server. Currently the modules are compiled separately and placed in /usr/local/lib and everything just works.

4 20

Re: Re: No accounting Freeradius + EAP/PEAP/TLS
by Leonardo Mártyres 09 Mar '09

09 Mar '09

>Is your NAS sending them? If it is, there is a firewall stopping them. >Ivan Kalik >Kalik Informatika ISP Thanks Ivan for fast reply, So, I'm very newer with linux also freeradius. If you permit, how can I see if the NAS send the account package? I'm using a ZINWELL G220 Plus and TP LInk WA501G. At zinwell I received an Authentication Failed, but is passed. NONREPLAY or something else.. Tanks again. _________________________________________________________________ News, entertainment and everything you care about at Live.com. Get it now! http://www.live.com/getstarted.aspx

2 1