July 2009 - Freeradius-Users - lists.freeradius.org

ntlm_auth problem using EAP-TLS with MSCHAP authentication to LDAP server
by Clement Ogedengbe 03 Jul '09

03 Jul '09

Can someone please help provide a clue into the problems with using ntlm_auth in a Freeradius config running on Debian. The user/password information are held in the LDAP server. I have been able to authenticate successfully with packets coming from non-EAP clients. But for EAP authentication clients, I have been receiving the following error lines. (I am using ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challenge=%{mschap:Challenge:-00} to call the LDAP server. Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for otha1_00 with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=otha1_00 [mschap] mschap2: 18 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=b06bae6a129ec4e7 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=c0bec1a04bdd9fb489ef30a2bc22e5806405493ac2038167 Exec-Program output: Invalid handle (0xc0000008) Exec-Program-Wait: plaintext: Invalid handle (0xc0000008) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\026E=691 R=1" EAP-Message = 0x04160004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\026E=691 R=1" EAP-Message = 0x04160004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. Clement

5 9

Can?t bring it to work on Centos 5.2...
by Mike 03 Jul '09

03 Jul '09

Dear list, after 4 days of work and lots of google searches I?m really in the need for some help! My Setup: A Centos 5.2 x86_64 box, running source installations of postfix 2.5.x and Dovecot Imap with domain and users stored in mysql, all with tls enabled. Edimax AccessPoint 7206PDg My goal: Allowing User authentication for iPhone and Macs with user/password My current Setup: <http://www.howtoforge.com/wifi-authentication-accounting-with-freeradius-on…> I?ve followed this as far as possible. Only one difference: I did build freeradius 1.1.7 from source in the lag of a rpm-package. I?ve configured with "./configure --libdir=/usr/lib64". While it only complains about some missing oracle odbc and other sql stuff and I don?t want to use sql I don?t think that this will cause any problems. Added a user, tested it local on the box, no problems. When trying to connect from an iPhone or OS X box with username@LOCAL password I can see in the output radiusd -X that radius finds the user but doesn?t accept him for some reason. Here is the complete output: rad_recv: Access-Request packet from host 200.0.0.35:3072, id=111, length=183 User-Name = "heinatz@LOCAL" NAS-IP-Address = 200.0.0.35 NAS-Port = 0 Called-Station-Id = "001f1f0b642d" Calling-Station-Id = "001cb35cbaf8" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000012016865696e61747a404c4f43414c Message-Authenticator = 0xdcc5aaa0f32561169a2a05d747304337 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: Looking up realm "LOCAL" for User-Name = "heinatz@LOCAL" rlm_realm: Found realm "LOCAL" rlm_realm: Adding Stripped-User-Name = "heinatz" rlm_realm: Proxying request from user heinatz to realm LOCAL rlm_realm: Adding Realm = "LOCAL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 0 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry heinatz at line 1 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 111 to 200.0.0.35 port 3072 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3007b9dfcccdaed8744c14b1f8483417 Finished request 5 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 200.0.0.35:3072, id=112, length=183 User-Name = "heinatz@LOCAL" NAS-IP-Address = 200.0.0.35 NAS-Port = 0 Called-Station-Id = "001f1f0b642d" Calling-Station-Id = "001cb35cbaf8" NAS-Identifier = "Realtek Access Point. 8181" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Framed-User Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02010012016865696e61747a404c4f43414c Message-Authenticator = 0x4ff89acc02de903bb99910a0da6f0be9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: Looking up realm "LOCAL" for User-Name = "heinatz@LOCAL" rlm_realm: Found realm "LOCAL" rlm_realm: Adding Stripped-User-Name = "heinatz" rlm_realm: Proxying request from user heinatz to realm LOCAL rlm_realm: Adding Realm = "LOCAL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 1 length 18 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry heinatz at line 1 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 112 to 200.0.0.35 port 3072 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x119b990a80c7f24ac94f61626e747416 Finished request 6 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 5 ID 111 with timestamp 4a4dcc9d Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 6 ID 112 with timestamp 4a4dcca2 Nothing to do. Sleeping until we see a request. I?m really at the end of my knowledge, please help, Mike

3 3

[Access-Accept with shared key incorrect]
by Thomas Fagart 03 Jul '09

03 Jul '09

Hello, We use freeradius as a proxy server successfuly with many home server. But Today with a new customer we're having an issue with shared key. Here are some debugs. srv-orhy# radiusd -v radiusd: FreeRADIUS Version 2.1.3, for host x86_64-unknown-freebsd6.1, built on Dec 16 2008 at 23:42:12 Sending Access-Request of id 22 to X.X.X.X port 1645 User-Name = "toto@toto" Acct-Session-Id = "erx GigabitEthernet 1/0.11074:11-74:0041982426" CHAP-Password = 0x9005d4c0511e1344a478d2e04ce155b0e2 CHAP-Challenge = 0xd7872df753f8fd7becff63c4298c36bf7a066335ebe758754c3b1fded3 Service-Type = Framed-User Framed-Protocol = PPP ERX-Pppoe-Description = "pppoe 00:1f:9f:4c:68:88" Calling-Station-Id = "#bas-val92-01#E10#74" NAS-Port-Type = Virtual NAS-Port = 268435530 NAS-Port-Id = "dsl-val92-02 atm 0/3/0/1:8.35 " NAS-IP-Address = Y.Y.Y.Y NAS-Identifier = "bas-val92-01" Proxy-State = 0x313338 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host X.X.X.X port 1645, id=22, length=131 Received Access-Accept packet from client X.X.X.X port 1645 with invalid signature (err=2)! (Shared secret is incorrect.) Dropping packet without response. At first, we though that was a dumb story about not having the same secret at both side. But after having tried many times, we think it's something else. Using radtest from the proxy with the correct secret (eg the same that the one which is in proxy.conf) gives a correct answer srv-orhy# radtest toto@toto pipo X.X.X.X:1645 268435530 secret Sending Access-Request of id 192 to X.X.X.X port 1645 User-Name = "toto@toto" User-Password = "pipo" NAS-IP-Address = 127.0.0.1 NAS-Port = 268435530 rad_recv: Access-Reject packet from host 194.158.122.20 port 1645, id=192, length=34 Vendor-Specific = 0x00004e200000000000000008 In that case the home server radius response (even if this is a reject) is properly decoded by the proxy. Do you have any clue about this issue ? Best Regards Thomas

1 0

Need help no of users and capacity load
by ramesh p 03 Jul '09

03 Jul '09

We are going to have up to 3 million users in our radius setup in the next month. At present we are using freeradius1.1.6 in linux platform and over 1 million users. we are planning to upgrade to latest version. How the performance matter with 3 million users. Please suggest interms of load balancing and capacity per server.? How many radius servers will be ideal to keep. Thanks, Rams.

3 2

Authenticating to LDAP not stripping prefix
by Christopher Shields 02 Jul '09

02 Jul '09

Hello All, I'm new to the list so please excuse any obvious exclusions. I have setup free radius to authenticate against our ldap directory and this works fine until I try to use the windows login and password instead of being prompted for one. It puts the prefix of either the workstation name or the domain name in front. How do I strip these out? My ldap configuration is below and tls is configured and working I just left it out. Freeradius 2 on SUSE. Thanks. ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "ldap-server" identity = "cn=admin,o=wcc" password = sfasdf basedn = "ou=users,o=wcc" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" #base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # Christopher Shields Network Support Services Manager 630.466.5732 cshields(a)waubonsee.edu

1 0

Access Req from HA rejected
by Kiran Kumar 02 Jul '09

02 Jul '09

Hi All, I am using the Free Radius to test Proxy Authentication from H-AAA, the initial Authentication (proxied through H-AAA) goes through fine. But the HA then triggers an Access Request message (we are using PMIP), but this fails at the Free radius. I suspect this is because the HA root keys etc are not generated by Free radius but by the H-AAA. Can you please let me know what configuration needs to be done to get this scenario working. Sending Access-Accept of id 161 to 10.142.139.65 port 52687 MS-MPPE-Recv-Key = 0x6ef829271559b13ef642c20c60522275590132e27a5b64d744e77799f12508b0 MS-MPPE-Send-Key = 0x3b0dfc2d198cebbd3fe32e9b3a8e1fad36f26f1b8595ea5cd1698eb52d29d872 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user(a)isp2.wimaxlab.com" Finished request 7. Going to the next request Waking up in 4.3 seconds. rad_recv: Access-Request packet from host 10.142.139.65 port 52687, id=162, length=201 User-Name = "user(a)isp2.wimaxlab.com" NAS-IP-Address = 10.142.139.68 Service-Type = Framed-User Framed-IP-Address = 0.0.0.0 Vendor-Specific = 0x00001fe4180600000003 Vendor-Specific = 0x00001fe4a9060a8e8b46 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = 3 WiMAX-GMT-Timezone-offset = 3600 WiMAX-hHA-IP-MIP4 = 10.142.139.70 WiMAX-MN-hHA-MIP4-SPI = 512 WiMAX-HA-RK-SPI = 512 NAS-Identifier = "HA_ISP1" Event-Timestamp = "Jun 18 2009 09:36:50 GMT" Message-Authenticator = 0x7fc30b3f450c08556a469367efb2d166 Chargeable-User-Identity = "NUL" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "isp2.wimaxlab.com" for User-Name = "user(a)isp2.wimaxlab.com" [suffix] No such realm "isp2.wimaxlab.com" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry user(a)isp2.wimaxlab.com at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user(a)isp2.wimaxlab.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 8 for 1 seconds Going to the next request Waking up in 0.1 seconds. Thanks and Regards, Kiran Kumar.B WiMAX Test Engineer Fujitsu Telecommunications Europe Solihull Parkway, Birmingham B37 7YU Work Phone: +44 (0) 121 717 6299 Mobile: +44 (0) 7549 203 655

4 3

Re: Accounting help please
by David Hobley 02 Jul '09

02 Jul '09

Chris, When you put it like that, it does make rather a large amount of sense. Sorry about that. Login details attached. Cheers, David ----- Original Message ----- From: "Chris" <cjl(a)viptalk.net> On Jun 30, 2009, at 3:29 PM, David Hobley wrote: > I have freeradius2 configured and authenticating properly. I would > like to be able to get radwho and radlast working properly, but for > some reason the files do not get created (permission are correct in > that directory). I thought I have set up accounting correctly, but > obviously haven't. I have attached the output from radiusd -X, any > pointers anyone could give me, I would appreciate. Might help if you included debug output which included processing of an accounting packet. Preferably a start and a stop. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 2

Re: timestamp in radpostauth and radacct
by Ivan Kalik 02 Jul '09

02 Jul '09

>> To include information about the NAS in a listing of the radpostauth >> (which >> doesn't have an entry regarding the nas >> from which the request originated from) I am joining the tables based on >> the >> radacct.acctstarttime = radpostauth.date >> which works "part" of the time. Meaning, for most of my tests it works >> just >> fine but I've seen logs where the timestamp >> in both of these tables differ (for the same request ofcourse). >> >> I was hoping someone can clear this issue, what's a normal behavior >> here? >> are the timestamp supposed to be the >> same/different and why. > > Different. Post-auth is timestamp of access request and acctstarttime of > accounting request. > > Ivan Kalik > Kalik Informatika ISP >

2 1

Using ippool and how to pass DHCP Options
by Zemke, Kai 02 Jul '09

02 Jul '09

Hi everyone, just a question for my understanding. When using the modules rlm_ippool or rlm_sqlippool, IP Adressses from a pool get assigned to the remote device as framed-ip-address. What I'm wondering about is, in case that I start using this type of address distribution, how can I pass for example DHCP options for DNS1, DNS2, TFTP and so on..... How this is typically managed? Mit freundlichen Grüßen Kai Zemke =========================================================== smartnet Online Service GmbH, Schnackenburgallee 177, 22525 Hamburg =========================================================== Geschäftsführer: Christian Suding, Claus Masch Ust.IdNr.:DE191136350 Handelsregister HRB 66463 Steuernummer: FA: Hamburg 54/855/01047 Fon: +49 (0) 40 5540-0 Fax: +49 (0) 40 5540-1040 kai.zemke(a)smartnet.de<mailto:kai.zemke@smartnet.de> Weitere Informationen siehe: http://www.smartnet.de<http://www.smartnet.de/> =========================================================== Hinweis: Diese Email kann vertrauliche und/oder rechtlich geschützte Informationen enthalten. Wenn Sie nicht der beabsichtigte Empfänger sind oder diese Email irrtümlich erhalten haben, informieren Sie bitte sofort den Absender telefonisch oder per Email und löschen Sie diese Email aus Ihrem System. Das unerlaubte Kopieren, sowie die unbefugte Weitergabe dieser Email ist nicht gestattet.Wir haften nicht für die Unversehrtheit von Emails, nachdem sie unseren Einfluss- Bereich verlassen haben.

3 2

Error downloading
by Ted Behling 01 Jul '09

01 Jul '09

Hi, In case the admin(s) of the FreeRADIUS download servers is on this list, I thought I'd point out that I received an error just now when trying to download 2.1.6. Following the links at http://freeradius.org/download.html, the link to: ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.6.tar.bz2 shows a "Not Found" error in my browser, as does the UK link to ftp://ftp.uk.freeradius.org/pub/radius/freeradius-server-2.1.6.tar.gz However, the German (DE) link works fine and I was able to download the tarball. Ted Behling ISP Systems Analyst, Hargray Communications

2 1