March 2009 - Freeradius-Users - lists.freeradius.org

MySQL and PEAP not talking
by Doe Hoe 31 Mar '09

31 Mar '09

Hi. I'm quite a newbie, so please keep it simple. I have been fighting with this for the past 10 hours! I am trying to do PEAP authentication (without certificates) where a client (Windows XP/Vista) gains WPA wi-fi access with a username and password using FreeRADIUS (v2.1.4) as the RADIUS server on Ubuntu Linux 8.10. I have gotten as far as compiling FreeRADIUS with SSL/TLS support and getting a Windows client to gain WPA access where his username/pass is in the "/etc/freeradius/users" file. I'm not interested in doing any LDAP or Active Directory stuff (don't want to use ntlm_auth), so obviously "MS-CHAP-Use-NTLM-Auth := No" was included with the user/pass in the "/etc/freeradius/users" file. And as I said, the client could gain Wi-fi WPA access using PEAP authentication. However, I would like to manage usernames and passwords in a MySQL database. The relevant part of the MySQL schema that I have been trying is as follows: radcheck (id,username,attribute,op,value) radreply (id,username,attribute,op,value) I have configured FreeRADIUS to talk to MySQL using various tutorials on the internet and have confirmed this works with the "radtest" shell command (I get an accept-accept back for any users in the "radcheck" table. So to try do it with PEAP authentication I inserted the following in the tables. INSERT INTO radcheck (username,attribute,op,value) VALUES ('user1','Cleartext-Password',':=','pass1') INSERT INTO radreply (username,attribute,op,value) VALUES ('user1','MS-CHAP-Use-NTLM-Auth',':=','No') Note how I have included "MS-CHAP-Use-NTLM-Auth := No" as a reply attribute. But, no matter what I do, this does not allow a client to authenticate. freeradius debug (with -X switch) gives me the following (I've only included the parts which I think are relevant: .................. [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'user1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'user1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'user8' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok .................. EAP-Message = 0x0108001f1a0108001a1025124f5e6a8bc7778687e657b729c16b7573657238 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x31f7332531ff293ae0350b28678bf4db [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x0108001f1a0108001a1025124f5e6a8bc7778687e657b729c16b7573657238 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x31f7332531ff293ae0350b28678bf4db [peap] Got tunneled Access-Challenge ++[eap] returns handled ................... [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for user1 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. .................. The parts that gives away the fact that the "MS-CHAP-Use-NTLM-Auth := No" is not being read from the database: 1) no users are found in the "SELECT FROM radreply" query 2) underneath "[peap] Got tunneled reply code 11" there is no "MS-CHAP-Use-NTLM-Auth := No" as there is when a user is authenticated from the "users" file. 3) The fact that I cannot get the client to gain access! I really don't know what to do from this point. I haven't included any of my freeradius configuration files because I really don't know which ones to include. So if you want to see them just let me know which ones you want. Thanks in advance Doron

3 6

Meaning of errormessage?
by Tom Schmitt 31 Mar '09

31 Mar '09

Hi, i use an old version of freeradius, 1.1.2. And yes, I will upgrade to a new version soon. But for now I have a question regarding a few errormessages I see in my logfile. Maybe someone caould help me to understand them. I use EAP with TSL to authenticate clients which are sending their certificate which are installed on each client and I have on my Radiusserver the root certificate to verify them. It is working, the clients are authenticated and happy, but in the logfile of the Radiusserver I see each time the following messages: > Wed Mar 25 16:49:53 2009 : Error: TLS_accept:error in SSLv3 read client certificate A > Wed Mar 25 16:49:53 2009 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > Wed Mar 25 16:49:54 2009 : Error: rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) > Wed Mar 25 16:49:54 2009 : Auth: Login OK: [host/client01.example.com] (from client WLANCONTROLLER nasid WLANCONTROLLER port 29 cli 00-23-34-35-36-36) As I understand the first lines, the Radiusserver can't read the certificate. But if this is true, how the hell could the Login be OK? Without certificate the Authentication should fail, shouldn't it? But if the certificates are okay, what is the meaning of the errormessages? Sorry if this is trivial for some of you, but I really have no idea what to do with this. Tom. -- Neu: GMX FreeDSL Komplettanschluss mit DSL 6.000 Flatrate + Telefonanschluss für nur 17,95 Euro/mtl.!* http://dsl.gmx.de/?ac=OM.AD.PD003K11308T4569a

2 1

Storing Realms on database
by Giovanni Lovato 30 Mar '09

30 Mar '09

Currently we store realms on a SQL database and a cron script updates proxy.conf. This is ugly and unstable due to the required restart of FreeRADIUS. There is a native method to store Realms on a SQL database like users, groups, clients, ip pools and huntgroups?

2 1

Trouble with PPTP & FreeRadius
by Mike Diggins 30 Mar '09

30 Mar '09

I have a cisco vpn3030 concentrator with both IPSec and PPTP clients. IPSec clients can successfully connect using my FreeRadius 2.1.3 server. They use PAP, I believe. My PPTP clients are failing to connect. Every indication on the Radius server is they have authenticated successfully, although the client says no (both Macintosh and Windows XP clients). When I point my cisco vpn3030 back to the CiscoSecure Radius server they use now (what I'm migrating from), the clients work again. There must be something different about the reply from each server. Any idea what might be happening? VPN logs from my failing PPTP connection: Mar 27 15:03:30 macvpn-inside 13885796 03/27/2009 15:03:30.520 SEV=4 PPTP/47 RPT=37605 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:03:30 macvpn-inside 13885797 03/27/2009 15:03:30.590 SEV=4 PPTP/42 RPT=37421 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:03:33 macvpn-inside 13885798 03/27/2009 15:03:33.800 SEV=5 PPP/8 RPT=33514 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:03:33 macvpn-inside 13885799 03/27/2009 15:03:33.890 SEV=4 PPTP/35 RPT=37406 76.64.100.68 Session closed on tunnel 76.64.100.68 (peer 0, local 61694, serial 44796), reason: User request (No additional info) FreeRadius debug log of failed connection: Ready to process requests. rad_recv: Access-Request packet from host 172.26.69.8 port 1479, id=77, length=146 User-Name = "test26" NAS-Port = 8057 Service-Type = Framed-User Framed-Protocol = PPP Tunnel-Client-Endpoint:0 = "76.64.100.68" MS-CHAP-Response = 0x02010000000000000000000000000000000000000000000000002f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 MS-CHAP-Challenge = 0x5e0b3b68c24784e0 NAS-IP-Address = 172.26.69.8 NAS-Port-Type = Virtual +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test26", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 5 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=test26 [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-ap1} -> --domain=ap1 [mschap] mschap1: 5e [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=5e0b3b68c24784e0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=2f97e1c84fea6fedbd12aa551c2d84282f6d2089f5e9d345 Exec-Program output: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program-Wait: plaintext: NT_KEY: D3D489B13ACA7C5E93887C212EFCCB0B Exec-Program: returned: 0 ++[mschap] returns ok Login OK: [test26] (from client macvpn port 8057) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 77 to 172.26.69.8 port 1479 Finished request 5. Going to the next request And my VPN logs from a working connection (ciscosecure radius): Mar 27 15:08:11 macvpn-inside 13886204 03/27/2009 15:08:11.640 SEV=4 PPTP/47 RPT=37606 76.64.100.68 Tunnel to peer 76.64.100.68 established Mar 27 15:08:11 macvpn-inside 13886205 03/27/2009 15:08:11.710 SEV=4 PPTP/42 RPT=37422 76.64.100.68 Session started on tunnel 76.64.100.68 Mar 27 15:08:14 macvpn-inside 13886215 03/27/2009 15:08:14.920 SEV=5 PPP/8 RPT=33515 76.64.100.68 User [test26] Authenticated successfully with MSCHAP-V1 Mar 27 15:08:17 macvpn-inside 13886216 03/27/2009 15:08:17.790 SEV=5 PPP/49 RPT=33002 76.64.100.68 User [test26] IPCP assigned IP Address 172.26.94.7 Mar 27 15:08:17 macvpn-inside 13886217 03/27/2009 15:08:17.790 SEV=4 AUTH/22 RPT=354231 76.64.100.68 User [test26] Group [Base Group] connected, Session Type: PPTP -Mike

5 11

Rp-speed limit help
by Mordor Networks 30 Mar '09

30 Mar '09

Hi , i added RP-upsteam-speed-limit and RP-down-speed-limit attributes to my freeradius and i can see the outout with radiusd -X Sending Access-Accept of id 250 to 127.0.0.1 port 37116 Framed-Protocol = PPP Framed-IP-Address = 255.255.255.254 Framed-IP-Netmask = 255.255.255.255 Framed-MTU = 1492 Session-Timeout = 43200 Idle-Timeout = 1200 Port-Limit = 1 RP-Upstream-Speed-Limit := 128 RP-Downstream-Speed-Limit := 128 Finished request 3 but i cannt see RP-Upstream-Speed-Limit := 128 RP-Downstream-Speed-Limit := 128 in /var/run/radattr.pppX for example cat /var/run/radattr.ppp13 Framed-Protocol PPP Framed-IP-Address 255.255.255.254 Framed-IP-Netmask 255.255.255.255 Framed-MTU 1492 Session-Timeout 43200 Idle-Timeout 1200 Port-Limit 1 anyone can help me with this issue please regards

2 4

pam -- how to handle reply attributes
by krishna Mohan 30 Mar '09

30 Mar '09

Hi,I wrote my PAM module (to authenticate a user against Sun AM) for freeRadius and that part is working fine. Now, the PAM module will receive few response attributes from the authenticating application for each user, for whom the authentication is success.How to receive this kind of application specific attributes and how to insert them in Radius-Accept packet? This is an urgent requirement for me.Appreciating your helpThanks,Sri.

2 1

RE: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, Never mind i figure out my problem. I add this line in my configuration: ldap { notfound = reject } So if user is not in my ldap. Then its rejected. Br, Ville -----Original Message----- From: freeradius-users-bounces+ville.leinonen=solodel.com(a)lists.freeradius.org on behalf of Ville Leinonen Sent: Mon 30/03/2009 14:36 To: freeradius-users(a)lists.freeradius.org Subject: Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem. Hi, Maybe im not started this post clearly. So i try open again what i want to do. I have a computer certificates. I also have openldap and that ldap includes my computer accounts. Now I want to use those certificates to authenticate computers and get authorization information inside my ldap. If computers dont have account in my ldap it's rejected. But if i put only ldap in my authorization section radius gives: "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" If i put also eap in authorization section, the radius uses eap for authorization and give access-accept. Even if user not found in ldap. Br, Ville >Here is some other logs if i use only ldap for authorize section: > >You have butchered the configuration and now you are wondering why it's >not working? If you don't know what you are doing - don't do it. If >you feel the urge to disable something (disbling unused modules is >hardly going to make any impact on preformance) get things working first >- than remove things you feel you must one by one. If you remove >something vital you will know what it was and will be able to put it >back. >Use default configuration. Configure *only* ldap module. Don't make >*any* changes to virtual servers (authorize, authenticate etc.). And it >will work. >Ivan Kalik >Kalik Informatika ISP

1 0

Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, Maybe im not started this post clearly. So i try open again what i want to do. I have a computer certificates. I also have openldap and that ldap includes my computer accounts. Now I want to use those certificates to authenticate computers and get authorization information inside my ldap. If computers dont have account in my ldap it's rejected. But if i put only ldap in my authorization section radius gives: "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" If i put also eap in authorization section, the radius uses eap for authorization and give access-accept. Even if user not found in ldap. Br, Ville >Here is some other logs if i use only ldap for authorize section: > >You have butchered the configuration and now you are wondering why it's >not working? If you don't know what you are doing - don't do it. If >you feel the urge to disable something (disbling unused modules is >hardly going to make any impact on preformance) get things working first >- than remove things you feel you must one by one. If you remove >something vital you will know what it was and will be able to put it >back. >Use default configuration. Configure *only* ldap module. Don't make >*any* changes to virtual servers (authorize, authenticate etc.). And it >will work. >Ivan Kalik >Kalik Informatika ISP

1 0

Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, I read that, but what if user not found in ldap? Radius seems to need some auth-type. How i can force auth-type using ldap? My radius gives this message -> "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" Here is some other logs if i use only ldap for authorize section: rad_recv: Access-Request packet from host 10.10.1.100 port 1024, id=198, length=224 Framed-MTU = 1466 NAS-IP-Address = 10.10.1.100 NAS-Identifier = "8021x" User-Name = "lnx01.demo.local" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 37 NAS-Port-Type = Ethernet NAS-Port-Id = "37" Called-Station-Id = "00-16-b9-55-48-c0" Calling-Station-Id = "00-e0-00-1c-1e-c1" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x02330016017375736530312e64656d6f2e6c6f63616c Message-Authenticator = 0x5c313918e00d0d385d435e3194c284ed +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "lnx01.demo.local", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 190 ++[files] returns ok [ldap] performing user authorization for lnx01.demo.local [ldap] expand: (cn=%u) -> (cn=lnx01.demo.local) [ldap] expand: ou=8021x,dc=demo,dc=local -> ou=8021x,dc=demo,dc=local rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.10.101.31:389, authentication 0 rlm_ldap: setting TLS CACert Directory to /path/to/ca/dir/ rlm_ldap: bind as cn=Directory Manager/ to 10.10.101.31:389 rlm_ldap: waiting for bind result ... request done: ld 0x9ba2480 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in ou=8021x,dc=demo,dc=local, with filter (cn=lnx01.demo.local) request done: ld 0x9ba2480 msgid 2 [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user suse01.demo.local authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [suse01.demo.local/<no User-Password attribute>] (from client 8021x port 37 cli 00-e0-00-1c-1e-c1) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> suse01.demo.local attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 10.10.1.100 port 1024 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +6 Ready to process requests. Br, Ville >We have openldap which includes our machine accounts. We >have also computer certificates. Now what i want to do that freeradius, >checks authorization against ldap and authenticate against certificates. > >I have tested to put ldap to authorization section and eap to authentication >section, but this wont work. I have also tested to put both ldap and eap to >authorization section, but ldap wont return reject if user's noot found. > >Is there any method to return reject for authorization section if user not >found in ldap and stop processing there? Or is there any other method to do this? > >Read doc/rlm_ldap about access_attr. >Ivan Kalik >Kalik Informatika ISP

2 1

Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, We have openldap which includes our machine accounts. We have also computer certificates. Now what i want to do that freeradius, checks authorization against ldap and authenticate against certificates. I have tested to put ldap to authorization section and eap to authentication section, but this wont work. I have also tested to put both ldap and eap to authorization section, but ldap wont return reject if user's noot found. Is there any method to return reject for authorization section if user not found in ldap and stop processing there? Or is there any other method to do this? We also have printers, which uses 802.1x mac-auth. Br, Ville Leinonen

2 1