March 2009 - Freeradius-Users - lists.freeradius.org

No known good password
by Ove Fagerheim 05 Mar '09

05 Mar '09

Hello all Are there room for a newbee question here? This is my first Radius server. I get the message "No known good password" when trying to authenticate users. The users are coming from one of two possible VPN tunnels. I assume "clients.conf" is correctly configured. Any help is highly appreciated. Best regards Ove Fagerheim >From "Users.conf": <snip> user1 Service-Type == Framed-User, User-Password == "password", # Adresses from 10.194.0.1 to 10.194.63.254 # Auth-Type = System, Framed-IP-Address = 10.194.0.1, Framed-IP-Netmask = 255.255.192.0, Fall-Through = Yes DEFAULT Service-Type == Framed-User, Huntgroup-Name == "Huntgroup-1", Framed-Protocol = GPRS-PDP-Context, NAS-Identifier = STCGGSN3, Called-Station_id = "My-Station-Id-String", Reply-Message = "%u is granted access" user1 Service-Type == Framed-User, User-Password == "password", # Adresser fra 10.192.64.1 til 10.192.127.254 # Auth-Type = System, Framed-IP-Address = 10.192.64.1, Framed-IP-Netmask = 255.255.192.0, Fall-Through = Yes DEFAULT Service-Type == Framed-User, Huntgroup-Name == ""Huntgroup-2", ", Framed-Protocol = GPRS-PDP-Context, NAS-Identifier = FBUGGSN3, Called-Station_id = "My-Station-Id-String", Reply-Message = "%u is granted access" <snip> >From "Huntgroups": <snip> Huntgroup-1 NAS-IP-Address == 172.x.x.0 Huntgroup-1 NAS-IP-Address == 172.x.x.1 . . . Huntgroup-1 NAS-IP-Address == 172.x.x.14 # # Huntgroup-2 NAS-IP-Address == 172.y.y.240 Huntgroup-2 NAS-IP-Address == 172.y.y.241 . . . Huntgroup-2 NAS-IP-Address == 172.y.y.254 <snip> logfile "log\radius\radacct\"NAS-IPAddress"\auth-detail-20090303.log: (username is client telephone number) <snip> Packet-Type = Access-Request Tue Mar 3 08:37:36 2009 NAS-IP-Address = 172.x.x.2 NAS-Identifier = "STCGGSN3" Called-Station-Id = "My-Station-Id-String" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 16861232 User-Name = "user1" User-Password = "password" Calling-Station-Id = "user1" Client-IP-Address = 172.x.x.2 Huntgroup-Name = "Huntgroup-1" <snip> logfile "log\radius\radius.log" <snip> Mon Feb 16 12:00:54 2009 : Info: Ready to process requests. Mon Feb 16 12:01:49 2009 : Auth: Login incorrect: [user1/password] (from client TelenorTVK1 port 35970456 cli 4790622859) Mon Feb 16 12:02:04 2009 : Auth: Login incorrect: [user1/password] (from client TelenorTVK1 port 33168936 cli 4790622859) Mon Feb 16 12:02:17 2009 : Auth: Login incorrect: [user1/password] (from client TelenorTVK1 port 30960664 cli 4790622859) Mon Feb 16 12:03:57 2009 : Info: Using deprecated naslist file. Support for this will go away soon. Mon Feb 16 12:03:57 2009 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Mon Feb 16 12:03:57 2009 : Info: rlm_eap_tls: Loading the certificate file as a chain Mon Feb 16 12:03:57 2009 : Info: WARNING: rlm_eap_tls: Unable to set DH parameters. DH cipher suites may not work! Mon Feb 16 12:03:57 2009 : Info: Ready to process requests. <snip> If the abow errors is unrelated to my issue, I still would very much appreciante any hints on how to fix them.

6 16

Can freeradius do a CoA Push.
by Simon Herriotts 04 Mar '09

04 Mar '09

Hey, New user to freeradius, nice little bit of work. Wondering if anyone knows how/if you can do a CoA Push. ie change SLA policy-map levels via a radius push to an existing user. Cheers Simon

3 7

Rejections
by Jack D. Martin Jr. 04 Mar '09

04 Mar '09

I am using freeradius 2.1.3 using MySQL for my IP pool and user auth tables in my small ISP. What I need to do is have customers that get rejected with a bad password assigned to a particular IP pool. I am sure this is possible, but can't find it. I assume I am just looking for the wrong keywords - LOL. Can somebody point me in the right direction? Thanks in advance. Jack Martin Magic Wireless Internet Service Providers LLC P.O. Box 278 104 W. Main Oilton, OK 74052 www.magicwisp.com

4 7

OT: Implementing RSA's SecurID
by Greg Vickers 04 Mar '09

04 Mar '09

Hi, (Apologies for an OT post) I was wondering if anyone know of any user list that would contain a community of people who implement systems like RSA's SecurID? The reason is that I am researching who else has implemented SecurID and am trying to find if there is another company or organisation who has implemented it in the way we wish to. Thanks, -- Greg Vickers Phone: +61 7 3138 6902 IT Security Engineer & Project Manager Queensland University of Technology, CRICOS No. 00213J

3 2

Please can someone help I'm new on the list
by Gustavo Román 04 Mar '09

04 Mar '09

I'm trying to install Radius EAP/TLS but when I enable the EAP module, I get the following Error: rlm_eap: Failed to link EAP-Type/tls: rlm_eap_tls.so: cannot open shared object file: No such file or directory radiusd.conf[10]: eap: Module instantiation failed. radiusd.conf[1960] Unknown module "eap". radiusd.conf[1907] Failed to parse authenticate section. Can someone help me. Thanks

2 1

Two factor authentication to both LDAP directory and SecurID
by Greg Vickers 03 Mar '09

03 Mar '09

Hi all, Firstly, this relates to a question asked for our project by Amy Hawke: http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-January/msg… Since the above conversation, I've had an email discussion with Alan DeKok and clarified a few things - it seems that what we want to do is achievable with FreeRADIUS so I'd like to ask the list. Situation: We have an existing LDAP directory which holds username and password information. We purchased RSA's SecurID with the intention of implementing a second factor of authentication to be used in conjunction with our existing username and password. At the time, it was not realised that the intention of SecurID is to replace your existing source of authentication information - which will not be doing! Scenario: To pilot the SecurID product, we selected VPN access to a part of our network, protected by a Cisco ASA5500 series device. We are in the process of moving away from the MS IAS RADIUS solution to FreeRADIUS. We know that MS IAS cannot do what we want to do. What we want to do: When a user attempts to access the VPN, have them provide their username/password as well as (their same) username and tokencode from their SecurID fob. It is OK if they provide the password and tokencode separately or together. (I spoke to the folks at Radiator, and they have a programming ability in their RADIUS server to chop up the password field before it's authenticated, i.e. have the tokencode and password provided in the same field at the client, then take the first eight characters of the 'password' field, send that string plus the username to SecurID via RADIUS, and the rest of the characters from the 'password' field and the username to our LDAP directory.) Ideally we would prompt them for username, password and tokencode at the same time. Can FreeRADIUS do this (it seems that Access-Challenge is exactly what we want: http://en.wikipedia.org/wiki/RADIUS#AAA) or a similar thing to solve our requirement? Thanks, -- Greg Vickers Phone: +61 7 3138 6902 IT Security Engineer & Project Manager Queensland University of Technology, CRICOS No. 00213J

2 6

FR 2.1.3 compile problem
by Chris Howley 03 Mar '09

03 Mar '09

Alan, I encountered the following problem (see below) when attempting to compile the latest version of 2.1.3 (stable code) from the git tree. Your help in fixing this problem would be appreciated. Thanks, Chris Environment: SunOS XXXXXX 5.10 Generic_120012-14 i86pc i386 i86p gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o /sandbox/radiusd/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt /usr/local/lib/libltdl.so -lssl -lcrypto -R/usr/local/lib Undefined first referenced symbol in file lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/sandbox/radiusd/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/sandbox/radiusd/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/sandbox/radiusd/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/sandbox/radiusd' gmake: *** [all] Error 2

3 2

Redundant Oracle instances
by Anders Holm 03 Mar '09

03 Mar '09

Hi folks. I've got FR 2.1.3 running hooked up to an Oracle instance. While testing failure scenarios I'm finding that the module never fails. I'm testing failures where the server has initially been able to connect to the database and then subsequently the database goes away. I'm testing by doing a nasty ifdown on the interface to simulate dropping network connectivity. Hence, this is for disaster type situations where something suddenly severs our connectivity. What I see when running a radtest to localhost is that FR tries the initial SELECT query we have defined and then sits doing nothing until something eventually times out about 18 minutes later and then it proceeds to process whatever else has been sent to it. I'd be curious in knowing how this timeout can be tweaked as 18 minutes is way too long for us, though I've been unable to find any documentation leading me to an answer. Seems this may be somewhere in the Oracle side of things, but I'm really not sure to be honest. I'd also be highly curious to know how one may return an Access-Accept even though we have not been able to actually authenticate the account, seeing as our DB is down which holds all the credentials. It seems the Fail-Over Wiki has a section on if-else branching which may be useful here, as I'd really only want to send Access-Accept when the DB truly has failed. though the wiki states "Documentation will be updated later..." and doesn't go into any details on how this could be achieved. Reason we'd want this "Fail-Open" as we have dubbed it, is that our end customers shouldn't unnecessarily be blocked from using our services. Relevant debug lines (yes, we have tweaked the SQL queries to suit our needs): Tue Mar 3 15:29:22 2009 : Info: [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test2' ORDER BY id Tue Mar 3 15:29:22 2009 : Debug: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test2' ORDER BY id ... time passes ... Tue Mar 3 15:46:56 2009 : Error: rlm_sql_oracle: query failed in sql_select_query: ORA-03135: connection lost contact Tue Mar 3 15:46:56 2009 : Error: rlm_sql_oracle: OCI_SERVER_NORMAL Tue Mar 3 15:46:56 2009 : Error: rlm_sql_getvpdata: database query error Tue Mar 3 15:46:56 2009 : Error: [sql] SQL query error; rejecting user Tue Mar 3 15:46:56 2009 : Debug: rlm_sql (sql): Released sql socket id: 3 Tue Mar 3 15:46:56 2009 : Info: +++[sql] returns fail Tue Mar 3 15:46:56 2009 : Info: +++[ok] returns ok Tue Mar 3 15:46:56 2009 : Info: ++- policy redundant returns ok Tue Mar 3 15:46:56 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Mar 3 15:46:56 2009 : Info: ++[pap] returns noop Tue Mar 3 15:46:56 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Mar 3 15:46:56 2009 : Info: Failed to authenticate the user. Tue Mar 3 15:46:56 2009 : Auth: Login incorrect: [test2/test2] (from client localhost port 1812) Tue Mar 3 15:46:56 2009 : Info: Using Post-Auth-Type Reject Tue Mar 3 15:46:56 2009 : Info: +- entering group REJECT {...} Tue Mar 3 15:46:56 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test2 Tue Mar 3 15:46:56 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Mar 3 15:46:56 2009 : Info: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 253 to 127.0.0.1 port 33032 Tue Mar 3 15:46:56 2009 : Info: Finished request 0. Tue Mar 3 15:46:56 2009 : Debug: Going to the next request Tue Mar 3 15:46:56 2009 : Debug: Waking up in 4.9 seconds. Here's another interesting part. As the server continues its work, it at this stage works through the remaining requests sitting in the buffers.. rad_recv: Access-Request packet from host 127.0.0.1 port 33032, id=253, length=57 Tue Mar 3 15:46:56 2009 : Info: Sending duplicate reply to client localhost port 33032 - ID: 253 Sending Access-Reject of id 253 to 127.0.0.1 port 33032 Tue Mar 3 15:46:56 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 33032, id=253, length=57 Tue Mar 3 15:46:56 2009 : Info: Sending duplicate reply to client localhost port 33032 - ID: 253 Sending Access-Reject of id 253 to 127.0.0.1 port 33032 ... and so on and so forth for all remaining in buffer requests ... Of course, tweaking this timeout value somehow to rather be in the seconds than minutes if not even sub-seconds would be preferable. Has anyone done this before and if so could I get a snippet of your configuration showing me how to achieve this? Thanks in advance. //anders

2 2

Re: User-Id and Calling-Station-Id matching
by tech.subscriptions＠shepherdhill.biz 03 Mar '09

03 Mar '09

> Put Calling-Station-Id, expression and =~ as operator for that user in > radcheck. But regex is not working well in 2.1.3. Better wait a few days > for 2.1.4. Please when would version 2.1.4 be released. Cheers, Chris.

2 1

NAS not found! message
by Bogdan Tancic 03 Mar '09

03 Mar '09

Hello all, I have freeradius server v1.1.7 and radius manager installed. After I configure mikrotik NAS as well as freeradius and radius manager I constantly get this: rad_recv: Access-Request packet from host 10.100.5.249:58662, id=82, length=201 NAS-Port-Type = Ethernet Calling-Station-Id = "00:1F:D0:6E:09:87" Called-Station-Id = "server1" NAS-Port-Id = "lan1" User-Name = "00:1F:D0:6E:09:87" NAS-Port = 2151677983 Acct-Session-Id = "8040001f" Framed-IP-Address = 10.100.7.43 Mikrotik-Host-IP = 10.100.7.43 CHAP-Challenge = 0x7618d4d358243ffa585f8686280d96c3 CHAP-Password = 0x9974f2cefb821ab9ff0736fd9a36e44320 Service-Type = Login-User WISPr-Logoff-URL = "http://0.0.0.0/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 10.100.5.249 rlm_chap: Setting 'Auth-Type := CHAP' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "00:1F:D0:6E:09:87" with CHAP password rlm_chap: Using clear text password "" for user 00:1F:D0:6E:09:87 authentication. rlm_chap: chap user 00:1F:D0:6E:09:87 authenticated succesfully rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 Exec-Program-Wait: value-pairs: Reply-Message="NAS not found!" Exec-Program: returned: 1 rad_recv: Access-Request packet from host 10.100.5.249:58662, id=82, length=201 Sending Access-Reject of id 82 to 10.100.5.249 port 58662 Reply-Message = "NAS not found!" User authenticated successfully but exec-program returned non zero value... What can be wrong? thank you in advance

4 6