March 2009 - Freeradius-Users - lists.freeradius.org

proxy questions
by Sebastien Boucher 26 Mar '09

26 Mar '09

i don't know if this was asked before but here it goes : we are currently using FreeRADIUS Version 1.1.1 that authenticates local users via LDAP I am trying to setup an IPASS realm for another company and can't get any success .. here is what i have done so far: i have the following in radiusd.conf realm IPASS { format = prefix delimiter = "/" ignore_default = yes ignore_null = yes } i also uncommented IPASS in authorize and preacct and this is what i have in proxy.conf realm IPASS { type = radius authhost = server.ip.here:1812 accthost = server.ip.here:1813 secret = **** retry_delay = 10 retry_count = 3 dead_time = 1 nostrip } realm NULL { type = radius authhost = LOCAL accthost = LOCAL } this what i get when i run radiusd in debug : rad_recv: Access-Request packet from host nas.ip.address:1645, id=82, length=168 Framed-Protocol = PPP User-Name = "IPASS/user(a)company.com" User-Password = "somepassword" Called-Station-Id = "5143174746" Calling-Station-Id = "5148776026" Cisco-NAS-Port = "Async1/8/97" NAS-Port = 3013 NAS-Port-Type = Async Service-Type = Framed-User NAS-IP-Address = nas.ip.address Acct-Session-Id = "0017A2FD" NAS-Identifier = "NAS01.MTLCNDS." rlm_ldap: Entering ldap_groupcmp() rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: object not found or got ambiguous search result rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for IPASS/user(a)company.com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 Sending Access-Reject of id 82 to 206.80.253.252 port 1645 i am sure i am missing something .. if i understand radius is trying to validate it in LDAP before sending the proxy request to the other server any help would be very appreciated thanks seb

4 6

rlm_sql_getvpdata: database query error
by Delcamp, Christopher D CTR SPAWAR SSC LANT, 50DE 26 Mar '09

26 Mar '09

We are implementing 802.1x authentication with MAB (Mac Address Bypass) on our Cisco switches and are getting some freeradius errors. Just as a note, when using MAB the username and password given to radius is the MAC address of the device (workstation, server, printer, etc) that is attempting to connect to the network. The authentication succeeds, but I'm wondering what these errors mean and if they can be fixed. Here is a sample of the radius.log. Thu Mar 26 09:08:08 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:08:08 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:08:08 2009 : Auth: Login OK: [001b63933f59/001b63933f59] (from client technet port 50232 cli 00-1B-63-93-3F-59) Thu Mar 26 09:16:03 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:16:03 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:16:03 2009 : Auth: Login OK: [000c29604a22/000c29604a22] (from client technet port 50246 cli 00-0C-29-60-4A-22) Thu Mar 26 09:19:35 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:19:35 2009 : Error: rlm_sql_getvpdata: database query error Thu Mar 26 09:19:35 2009 : Auth: Login OK: [00188b0251ba/00188b0251ba] (from client technet port 50246 cli 00-18-8B-02-51-BA) Thanks in advance for any help I can get. Chris Delcamp

4 5

Problems starting radius daemon
by Sanz Malagón, Jorge 26 Mar '09

26 Mar '09

Hi every body, My name is Jorge Sanz, from Spain, and this is my first mail in this list. I'm working with a Freeradius installed over OpenSUSE 11.0. It was working properly until I tryed to add a new client in /etc/raddb/clients.conf I add the new client like this client xxx.xxx.xxx.xxx{ secret = xxx shortname = xxx nastype = cisco } Alter that, I restart the service like this /etc/init.d/freeradius restart and I get this error since then Starting RADIUS daemon radiusd: pthread_mutex_lock.c:115: __pthread_mutex_lock: Assertion `mutex->__data.__owner == 0' failed. failed I have checked there is no other freeradius process in memory. I have comment the new lines, and try to put it up again with the same error. Does anybody know something about this? I have been surfing in google and appears similar errors with other applications (pidgin, galeon...) but nothing with freeradius. Thanks in advance Jorge Sanz Malagón Unidad de Redes Departamento de ingenieria Pº Club Deportivo, 1 Edificio 4, Planta Baja 28223 - Pozuelo de Alarcon (Madrid) España M +34 685102456 jsanzma(a)indra.es www.indra.es

3 3

Simple authentication by users file.
by Michel GAUDET 26 Mar '09

26 Mar '09

Hello Everybody ! Sorry for my english : the french people are known to be bad in other langage than french ! To make my (new) experience with freeRADIUS I try to authenticate with simple User-name and password in the users file. Sorry for the long post but I want to give all is necessary to understand. My conf is following (some big extract) : modules { pap { auto_header = no } chap { authtype = CHAP } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } pam { pam_auth = radiusd } always fail { rcode = fail } always reject { rcode = reject } always noop { rcode = noop } always handled { rcode = handled } always updated { rcode = updated } always notfound { rcode = notfound } always ok { rcode = ok simulcount = 0 mpp = no } } server ensmp { authorize { files } authenticate { # I don't know what is mandatory here } } Client.conf file : client 1.2.3.4 { secret = XXXX shortname = Linux nastype = other } users file : myself Auth-Type := Accept,User-Password == "YYYYYY" And I try to access with a radius client (radexample) : Linux# radexample login: myself Password: "myself" RADIUS Authentication failure (RC=2) My server in launch in debug mode ( /usr/sbin/freeradius -Xxx) without errors at the moment of my try : Thu Mar 26 18:13:01 2009 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 1.2.3.4 port 48655, id=88, length=65 User-Name = "myself" User-Password = "YYYYYY" Service-Type = Authenticate-Only NAS-Port = 0 NAS-IP-Address = 10.3.5.136 Thu Mar 26 18:13:18 2009 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejectig the user Thu Mar 26 18:13:18 2009 : Debug: auth: Failed to validate the user. Thu Mar 26 18:13:18 2009 : Auth: Login incorrect: [mgaudet/ifqj1cf5] (from client turing port 0) Thu Mar 26 18:13:18 2009 : Debug: Delaying reject of request 0 for 1 seconds Thu Mar 26 18:13:18 2009 : Debug: Going to the next request Thu Mar 26 18:13:18 2009 : Debug: Waking up in 0.9 seconds. Thu Mar 26 18:13:19 2009 : Debug: Sending delayed reject for request 0 Sending Access-Reject of id 88 to 10.3.5.136 port 48655 Thu Mar 26 18:13:19 2009 : Debug: Waking up in 4.9 seconds. Thu Mar 26 18:13:24 2009 : Debug: Cleaning up request 0 ID 88 with timestamp +17 The request have been received and acknowledge but rejected because missing Auth-Type. I don't understand WHAT AND WHERE to put Auth-Type elsewhere in my conf. Some ideas ? Thank's in advance. Regards. Michel. -- Michel GAUDET Centre de Calcul et des Systèmes d'Information Ecole Nationale Supérieure des Mines de Paris 60-62, Boulevard Saint Michel 75272 PARIS cedex 06 FRANCE Tel : 01.40.51.92.03 Fax : 01.40.51.93 01 mail : michel.gaudet(a)mines-paristech.fr

2 1

Account preProcessing
by Larry Ross 26 Mar '09

26 Mar '09

Good Afternoon All; Currently my institution allows for registered users to create guest accounts for visitors to enable wireless access for the guest users (Wireless access is controlled via Captive Portal/PAP with a Kerberos Directory backend). Registered users create the guest accounts using the guest users eMail address, such as Jdoe(a)gmail.com jdoe(a)hotmail.com etc etc etc. This poses a slight problem though as the "@" sign is a reserved character for Kerberos and thus principles with the "@" cannot be created within our KDC. To solve this problem the account generation application substitutes the "@" for a "+" (so kerberos principles are created in the form jdoe+gmail.com jdoe+hotmail.com) If guest users remember to sub a "+" for their "@" all is well, however often times people forget this and get stuck wondering why their username jdoe(a)gmail.com is failing when they have been assured all is well. To completely eradicate this situation we would like to place a Freeradius instance in place of our proprietary radius solution and have it perform the substitution during authentication, so neither the Guest or registered user need concern themselves with the whole "@" "+" thing (so from their standpoint the principle is jdoe(a)gmail.com nice and easy... for them ;) I have been trying to determine the best way to accomplish this and would greatly appreciate any ideas as to how this may be completed. Thank you much. Larry

2 2

Error binding to port for 0.0.0.0 port 1812
by Bruno Noronha 26 Mar '09

26 Mar '09

Dawgs, I received the following error when starting debug mode or issuing "freeradius reload" and catching the error in radius.log: Tue Mar 24 16:16:05 2009 : Error: Failed binding to socket: Address already in use Tue Mar 24 16:16:05 2009 : Error: /etc/raddb/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 I disabled IPv6 and verified if there is another service running on this port... RADIUS:~ # lsof -i:1812 COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME radiusd 3568 root 5u IPv4 10046 0t0 UDP *:1812 RADIUS:~ # netstat -unpl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 0.0.0.0:1812 0.0.0.0:* 3568/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 3568/radiusd udp 0 0 0.0.0.0:1814 0.0.0.0:* 3568/radiusd udp 0 0 0.0.0.0:43956 0.0.0.0:* 2564/avahi-daemon: udp 0 0 0.0.0.0:5353 0.0.0.0:* 2564/avahi-daemon: udp 0 0 0.0.0.0:111 0.0.0.0:* 2347/portmap udp 0 0 0.0.0.0:631 0.0.0.0:* 2663/cupsd According to the outputs above there is just one service running on this port... I don't know what else I can do. I saw all topics related to my problem but no one gave me a solution.

5 10

WPA + Freeradius + Chillispot
by Leonardo Mártyres 26 Mar '09

26 Mar '09

Does anyone use Chillispot to use WPA and FReeradius? Could tell me what I have to configure at dd-wrt? thanks _________________________________________________________________ Show them the way! Add maps and directions to your party invites. http://www.microsoft.com/windows/windowslive/products/events.aspx

2 1

Retrieve an user attribute from AD for vlan assignment in PEAP auth
by Frad 26 Mar '09

26 Mar '09

Hi everyone, I am configuring a freeradius server with authentication PEAP/Mschap with an Active Directory. The authentication works :) There is my question: I have on my AD an attribute for each user such as "vlanId = 12" and I would like to get this value to assign the user authenticated on this VLAN. Any idea ? Thanks, Frad -- View this message in context: http://www.nabble.com/Retrieve-an-user-attribute-from-AD-for-vlan-assignmen… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Problem with attribute transfer to an external script
by Dmitry Lyubimkov 26 Mar '09

26 Mar '09

Hello. We use FreeRADIUS as an intermediate server (proxy) between commercial billing system and radius clients (NAS, servers, etc). In this case it is a question about SIPProxy. The billing system sends some additional attributes. Here a example from FreeRADIUS log: rad_recv: Access-Reject packet from host 172.16.2.9 port 1812, id=99, length=70 Reply-Message = "Authorization failed." h323-return-code = "h323-return-code=-2" We receive this from billing system. And we should transmit to the RADIUS-client the same plus additional attribute, calculated from h323-return-code. Approximately so: Sending Access-Reject of id 164 to 172.16.2.6 port 42424 SIP-AVP := "AUTHCODE:3" Reply-Message = "Authorization failed." h323-return-code = "h323-return-code=-2" I have described the application in a radiusd.conf exec siph323code { wait = yes input_pairs = reply output_pairs = reply packet_type = Access-Reject program = "/usr/bin/python -u /usr/sbin/radscripts/siph323code.py %{h323-return-code} } Also add it in section post-proxy { .... siph323code .... The application is started, attribute SIP-AVP is added. But there is a problem. Value of {h323-return-code} attribute is not transferred to this application. FreeRADIUS declares: rlm_exec (siph323code): WARNING! Input pairs are empty. No attributes will be passed to the script expand: %{h323-return-code} -> I.e.it cannot substitute value of h323-return-code attribute. But if I write on this place any attribute from initial request, for example %{Cisco-AVPair} that its value is substituted. Questions: 1. How correctly to describe my application. What value of output_pairs and input_pairs fields I should use? 2. In what section I should start this application (post-proxy, pre-proxy, post-auth...)? 3. Why it is not substituted attribute % {h323-return-code}? Thanks. Dmitry

1 0

Get fail [MS-CHAP2-Response is incorrect] while proxy the mschapv2 between two Freeradius 2.1.4
by Jacky Chan 26 Mar '09

26 Mar '09

Hi all, I installed two freeradius, one for home server(x.x.x.239/24) and one for proxy purpose, the home server is working normally with LEAP with mschapv1, WPA2 and PEAP with mschapv2. For other purpose, I need to established one more freeradius and work as proxy radius server(x.x.x.238/24) to proxy all request to other home radius that including the existing home freeradius server mention above, but after test, PAP and LEAP are proxyed successfully but PEAP/WPA2 with mschapv2 always get fail, the following is the debug log from these two freeradius 2.1.4 Freeradius (home server) x.x.x.239 rad_recv: Access-Request packet from host x.x.x.238 port 1814, id=58, length=179 NAS-IP-Address = x.x.x.21 (NAS for testing) NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "test33", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry test33 at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for test33 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Login incorrect: [test33/<via Auth-Type = mschap>] (from client fd-1 port 0 cli 000000000000) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test33 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 58 to x.x.x.238 port 1814 Proxy-State = 0x3134 Waking up in 4.9 seconds. Cleaning up request 0 ID 58 with timestamp +13 Ready to process requests. Freeradius (proxy server) x.x.x.238 rad_recv: Access-Request packet from host x.x.x.21 port 32846, id=14, length=191 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33(a)aaa.com" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] Looking up realm "aaa.com" for User-Name = "test33(a)aaa.com" [suffix] Found realm "aaa.com" [suffix] Adding Stripped-User-Name = "test33" [suffix] Adding Realm = "aaa.com" [suffix] Proxying request from user test33 to realm aaa.com [suffix] Preparing to proxy authentication request to realm "aaa.com" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 58 to x.x.x.239 port 1812 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 Proxying request 10 to home server x.x.x.239 port 1812 Sending Access-Request of id 58 to x.x.x.239 port 1812 NAS-IP-Address = x.x.x.21 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "test33" Calling-Station-Id = "000000000000" Called-Station-Id = "000B86611110" MS-CHAP-Challenge = 0x09a864e7160039f4a3947f3b856feb68 MS-CHAP2-Response = 0x00004b0a36e235cca75db5e5d5664eae3cde0000000000000000f2b3d55d43419bcb905569ef7e9c5ea6467e4633eeb10993 Service-Type = Login-User Aruba-Location-Id = "N/A" Proxy-State = 0x3134 Going to the next request Waking up in 0.9 seconds. Waking up in 18.9 seconds. rad_recv: Access-Reject packet from host x.x.x.239 port 1812, id=58, length=24 Proxy-State = 0x3134 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Login incorrect (Home Server says so): [test33(a)aaa.com/<via Auth-Type = mschap>] (from client Controller-1 port 0 cli 000000000000) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test33(a)aaa.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 14 to x.x.x.21 port 32846 Finished request 10. Going to the next request Waking up in 4.9 seconds. Cleaning up request 10 ID 14 with timestamp +9947 Waking up in 17.2 seconds. Sending Status-Server of id 70 to 127.0.0.1 port 1812 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" You can see that the MS-CHAP-Challenge and the MS-CHAP2-Response are same within two server, but why home server said that the password is wrong? Can anyone help me to check whether there are something wrong in my configuration, thanks. The following is the EAP and the mschap module of these two server: mschap { use_mppe = no require_encryption = no require_strong = no with_ntdomain_hack = no } eap { default_eap_type = "mschapv2" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } -- View this message in context: http://www.nabble.com/Get-fail--MS-CHAP2-Response-is-incorrect--while-proxy… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4