August 2009 - Freeradius-Users - lists.freeradius.org

Re: String Validation
by Neville 16 Aug '09

16 Aug '09

>> If a connection that comes in with a GROUP NAME from SQL of "USUK-XX" >> or "WUK-XX" and I want to strip of the "-XX", how would I do this with >> ulang so I only validate the following? > > Using the regexp feature, you can match part of an attribute then > reference it later, like so: > if (SQL-GROUP =~ /(.*)-XX/) { > update request { > SQL-GROUP := "%{1}" > } > } > > --Mike Thx Mike, Sorry, I don't think my example help as XX could be ANYTHING. E.g. USUK-5GB ; USUK-1GB ; USUK-10GB, so looking to STRIP everying after the "-" and including the "-" to the end of the string. The reason for doing this as I only want to validate against the first part of the String, otherwise the Nested IF Statment will be Huge. If your able, would appreciate if you can update the IF statement below to reflect what I'm trying to do. if(SQL-GROUP == "USUK") { ok } elsif(NAS-IP-Address == AAA.BBB.CCC.DDD && SQL-GROUP == "WUK") { ok } else { reject } Thx in advance Nev

2 1

String Validation
by Neville 16 Aug '09

16 Aug '09

Hi, If a connection that comes in with a GROUP NAME from SQL of "USUK-XX" or "WUK-XX" and I want to strip of the "-XX", how would I do this with ulang so I only validate the following? if(SQL-GROUP == "USUK") { ok } elsif(NAS-IP-Address == AAA.BBB.CCC.DDD && SQL-GROUP == "WUK") { ok } else { reject } Thx in advance Nev

2 1

Request for opinion - central admin user server LDAP+FreeRADIUS
by Andres Kaaber 15 Aug '09

15 Aug '09

Hello all I'm assigned with a project to make a central admin user database for all kind of servers / devices you can imagine (routers, switches, firewalls, linux servers, windows servers, databases, etc.). The point is that when a news employee arrives you just make him a user in this database, maybe check which type of devices he can and all the devices are configured to authenticate users against this db. We have over 200 switches alone in our company so making user accounts in every single one of them and when this dude leaves to disable all of them is huge (or impossible) work. So I thought a linux server LDAP+FreeRADIUS for authentication sounds quick, easy and good solution, or not? There is no problem with servers Linux and Windows servers can authenticate against radius. Most popular DB -s can do this also (Oracle, MySQL, PostgresSQL). I don't know about Cisco switches and roters but as far I found in google there should be no problems the same goes for juniper devices. So what do you think? Or maybe you know a free software solution for this kind of problem already? Sun identity management is one that i checked out but it seems too bloated and complicated. So what are your thoughts? -- Andres Kaaber

5 5

radius.log with timestamp in filename
by RadiusGuy 15 Aug '09

15 Aug '09

Hi all, I'm using FreeRADIUS Version 2.0.4 and i would like to have timestamps within the filename of the radius.log, i.e. radius.log-20090804. For the other logfiles, like the detailfile, this is the default setting in the radiusd.conf: detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d In good faith I have tried the same thing with the radius.log... file = ${logdir}/radius.log-%Y%m%d but it didn't work. Freeradius then creates a logfile with the explicit name radius.log-%Y%m%d, but not with the timestamp of the actual day. Can anyone help? Thanks in advance! -- View this message in context: http://www.nabble.com/radius.log-with-timestamp-in-filename-tp24804436p2480… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

MSCHAP Authentication Issue
by Garber, Neal 15 Aug '09

15 Aug '09

I realize that this issue has been brought up many times in the past. However, I believe I have new information that I haven't seen reported before.. I'm having a problem with Windows XP supplicant authenticating to FR with PEAP/MSCHAPv2 where authentication fails "sometimes" depending upon various factors. The same device I'm using to test wireless authentication, never has an issue authenticating to my old dain-bramaged Cisco ACS servers. As a result, I decided to investigate what might be different about FreeRadius (perhaps Samba I thought, but didn't want to make assumptions). I don't profess to be an MS-CHAP expert, so what I'm about to say may be completely off-base.. After performing many tests (see below) and reviewing RFC2579 and the code in rlm_mschap.c, I'm hypothesizing that the problem is with how rlm_mschap calculates the challenge hash that is passed to ntlm_auth. Specifically, rlm_mschap uses the User-Name attribute as part of the calculation of the hash. What I'm finding is that, in some cases, the User-Name attribute doesn't match the case of the Name field in the MS-CHAP response (i.e., the userid is the same, it just differs in case). In the tests I've performed, when these userids don't match in case, I get a Logon Failure from ntlm_auth. I'd really like this to "just work" as is commonly said around these parts without additional gymnastics (such as changing all userids to lowercase). Does this seem like a plausible explanation for what's happening? If not, does anyone have any other ideas? I need to resolve this in order to retire two old and cranky (and fairly useless because they don't really do authorization) ACS servers! I'm going to try a change to rlm_mschap so it passes the Name field from the MS-CHAP response to the challenge_hash function (as opposed to the User-Name attribute) to see if that resolves the issue. I realize that ultimately it's Windows fault that it doesn't pass the userid with consistent case (i.e., Identity vs. MS-CHAP response); but, I don't want the ACS server to be seen as a better, more tolerant solution. So, it would be great to make FR more tolerant of this aberrant behaviour. Thanks in advance for any advice/help/suggestions you can provide.. Here's what I tested and what I observed that caused me to draw the above conclusion: Background: Windows XP SP3 laptop using std. Windows wireless supplicant EAP/PEAP/MS-CHAPv2 -> Cisco 1232AP -> FR 2.1.6 (with rlm_perl patch) running on FreeBSD 7.2. In all the tests below, the same SSID, wireless network configuration on the laptop, AP, userid and password were used (the domain and user listed below are contrived, but are representative of the case I saw in the debug output). Laptop Logon Method Wireless Credentials Passed Man/Auto MS-CHAP Response Packet Name field User-Name Request Attribute ntlm_auth Authentication Result Domain logon (via Ethernet) with all lowercase userid entered on gina Manually entered all lowercase userid when supplicant prompted MYDOMAIN\myuser MYDOMAIN\myuser SUCCESS Domain logon (via Ethernet) with all lowercase userid entered on gina Supplicant configured to auto. pass Windows credentials MYDOMAIN\MyuseR MYDOMAIN\myuser Logon failure (0xc000006d) Locally cached credentials (on laptop) with all lowercase userid entered on gina Manually entered all uppercase userid when supplicant prompted MYUSER MYUSER SUCCESS Locally cached credentials (on laptop) with all lowercase userid entered on gina Manually entered all lowercase userid when supplicant prompted myuser myuser SUCCESS Locally cached credentials (on laptop) with all lowercase userid entered on gina Supplicant configured to auto. pass Windows credentials MYDOMAIN\MyuseR MYDOMAIN\MyuseR SUCCESS

3 6

Authentication with Active Directory with CHAP Passwords
by Luiz Gustavo de Villa Scandelari 15 Aug '09

15 Aug '09

Hello everyone, I would like to receive some help on authentication with AD using CHAP Passwords. I´ve already configured the radius (v 2.1.6) to authenticate in the AD (Microsoft) using LDAP and clear-text passwords, until now it works perfectly, but in the radius debug appear the following message: rad_recv: Access-Request packet from host 192.168.0.100 port 64871, id=7, length=50 User-Name = "1000700025" User-Password = "123456" +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "1000700025", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ldap] performing user authorization for 1000700025 [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (sAMAccountName=%{Stripped-User-Name:-%{User-Name}}) -> (sAMAccountName=1000700025) [ldap] expand: dc=pedagogico,dc=net -> dc=pedagogico,dc=net rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.17.16.4:389, authentication 0 rlm_ldap: bind as wni@pedagogico.net/wni@2009 to 172.17.16.4:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=pedagogico,dc=net, with filter (sAMAccountName=1000700025) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... è WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? ç [ldap] Setting Auth-Type = LDAP [ldap] user 1000700025 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = LDAP +- entering group LDAP {...} [ldap] login attempt by "1000700025" with password "123456" [ldap] user DN: CN=LUIZ RICARDO DE VILLA SCANDELARI,OU=Users,OU=UNIFAE,OU=Users and Computers,DC=PEDAGOGICO,DC=NET rlm_ldap: (re)connect to 172.17.16.4:389, authentication 1 rlm_ldap: bind as CN=LUIZ RICARDO DE VILLA SCANDELARI,OU=Users,OU=UNIFAE,OU=Users and Computers,DC=PEDAGOGICO,DC=NET/123456 to 172.17.16.4:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful [ldap] user 1000700025 authenticated succesfully ++[ldap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 7 to 192.168.0.100 port 64871 Finished request 0. I suppose that happens because I cannot read the AD user password, right? The important is that works with LDAP authentication. The problem is that I have a system that sends Access-Requests with Username and CHAP-Passwords (CoovaChilli), so radius authorize the user but cannot authenticate it. I´ve already read the Allan´s webpage (http://deployingradius.com/documents/configuration/active_directory.html) about integration of AD and RADIUS but I still have some questions. Can I use CHAP with SAMBA ntlm_auth method or should i need to change the password encryption to another protocol such as PAP or MS-CHAP? If I modify the coovachilli to send PAP passwords, am I going to be able to use ldap for authorization and authentication or do I need just plain? I hope somebody can help me. Thanks, LUIZ GUSTAVO SCANDELARI Skype: luiz.gustavo.wni

2 1

PEAP / mschapv2 Error Messages
by Michael Bryant 14 Aug '09

14 Aug '09

Hi, Using the default eap/peap & inner-tunnel configuration, a failure gives rise to this: Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled How can I take that MS-Chap-Error attribute and pass it back in the final access-reject, as a Reply-Message attribute for example. Cheers --Mike

5 5

Problem with MAC authorization..(again)
by Sunardo Panjaitan 14 Aug '09

14 Aug '09

i'm sos sorry to ask again.. This problem 've already discussed in FreeRadius MAC address authorization (http://lists.cistron.nl/pipermail/freeradius-users/2008-August/msg00155.html) I'm using Fedora core 6, freeRadius 2.1.3 (installed from source code tarball)And use linksys WAP4400 as Access Point. i got guide from http://wiki.freeradius.org/Mac-Auth.... this is my configuration raddb/policy.conf rewrite_calling_station_id { if("%{request:Calling-Station-Id}" =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2,})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i){ update request { Calling-Station-Id := "%{1}%{2}%{3}%{4}%{5}%{6}" } } else { noop } } raddb/client.conf client 10.1.0.6 { secret = testing123 nastype = other shortname = tk03 } client 10.1.0.0/24 { # # secret and password are mapped through the "secrets" file. secret = testing123 nastype = other shortname = tk03 } client silimbat.win2k.del.ac.id{ secret = testing123 shortname = tk03 } raddb/modules/mschap Ganti nilai use_mppe = no menjadi use_mppe = yes. Uncomment require_encryption = yes dan require_strong = yes. mschap { use_mppe = yes require_encryption = yes require_strong = yes } raddb/modules/file # files authorized_macs files { # The default key attribute to use for matches. The content # of this attribute is used to match the "name" of the # entry. key = "%{Calling-Station-ID}" usersfile = ${confdir}/authorized_macs # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } raddb/sites-available/default authorize{} # # (Optional) May help if your NAS doesn't let you specify separators for the User-Name value # #rewrite_calling_station_id # # Machine (Calling-Station-ID based) authentication # # RFC 2865 says that a Service-Type value of Call Check is used # to specify this kind of authentication (though were now dealing with ethernet ports instead of lines). # if(Service-Type == 'Call-Check'){ update control { Auth-Type = 'CSID' } } raddb/sites-available/default authenticate{} # # Authentication based on Calling-Station-ID # # Calling-Station-ID authentication is usually done by comparing normalised # forms of the Calling-Station-ID and User-name fields. # Auth-Type CSID { if(User-Name =~ /^%{Calling-Station-ID}$/i){ # # Optionally a CHAP-Password attribute is included which is # md5(ChapID + Calling-Station-ID + Request Authenticator). # if(Chap-Password){ update control { Cleartext-Password := "%{User-Name}" } chap } else{ ok } } else{ reject } } raddb/sites-available/default post-auth{} if("%{control:Auth-Type}" == 'CSID'){ # Authorization happens here authorized_macs.authorize if(notfound){ reject } } raddb/authorized_macs # MAC_address Auth-Type 00-1C-BF-10-EA-34 Auth-Type := Accept 00-1E-E5-9D-64-32 Auth-Type := Accept 00-1D-E0-5E-E2-3B Auth-Type := Accept 00-1B-9E-32-E4-DE Auth-Type := Accept This the output of radiusd -X : rad_recv: Access-Request packet from host 10.1.0.6 port 1024, id=5, length=139 NAS-IP-Address = 10.1.0.6 NAS-Port = 0 Called-Station-Id = "00-1E-E5-9D-64-B1:TK_03" Calling-Station-Id = "00-1B-9E-32-E4-DE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201000501 Message-Authenticator = 0x60827fcdaecda43af294e5ad9cc9fc5e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Proxy reply, or no User-Name. Ignoring. ++[suffix] returns ok [eap] EAP packet type response id 1 length 5 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns noop [files] expand: %{Calling-Station-ID} -> 00-1B-9E-32-E4-DE [files] users: Matched entry 00-1B-9E-32-E4-DE at line 4 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [<no User-Name attribute>/<via Auth-Type = Accept>] (from client tk03 port 0 cli 00-1B-9E-32-E4-DE) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 5 to 10.1.0.6 port 1024 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 5 with timestamp +23 But the client can't connect.Anybody can help me???

3 2

ERROR 734
by Danie J. Steenkamp 14 Aug '09

14 Aug '09

Hi, I have loaded Freeradius 2.1.6 on a Centos 5.3 server with Mysql. The server is responding perfectly to any Authentication. >From a Windows XP it connects, verifies the username, password & Calling-Station-ID. It then immediately disconnects with Error 734: The PPP link control protocol was terminated. In the log on the Radius server it shows that the connection was OK: Thu Aug 13 09:40:39 2009 : Auth: Login OK: [Danie1234/xxxx] (from client MTN-RB-J20 port 24329888 cli 27XXXXXXXXX) Using NTRadPING, authentication is successful. However, using "Accounting Start" on NTRadPING it sends the accounting packet through to the server and can clearly be seen when using debug mode: "rad_recv: Accounting-Request packet from host 10.18.205.5 port 4923, id=4, length=56 User-Name = "Danie1234" Acct-Status-Type = Start Acct-Session-Id = "2120" Calling-Station-Id = "27833873873" Finished request 5." NTRadPING reports back that there is no response from the server. Under Listen in radiusd.conf I have the following: listen { ipaddr = * port = 1813 type = acct } Under site-enabled/default I have the following: accouting { detail sql } I will appreciate any help in solving this issue. __________ Information from ESET NOD32 Antivirus, version of virus signature database 4314 (20090807) __________ The message was checked by ESET NOD32 Antivirus. http://www.eset.com (GAAP DISCLAIMER) The above message and all attachments may contain privileged and confidential information intended only for the person or entity to which it is addressed. Any review, retransmission, dissemination, copy or other use of, or taking of any action in reliance upon this information by persons or entities other than the intended recipient is prohibited. If you received this message in error, please notify the sender immediately by e-mail, facsimile or telephone and thereafter delete the material from your computer. Any views expressed in this message are those of the individual sender, except where the sender specifically states them to be the view of the entity transmitting the message. UCS Group Limited and all of its subsidiary companies hereby distance themselves from and accept no liability in respect of the unauthorised use of its e-mail facility or the sending of e-mail communications for other than strictly business purposes. -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

3 5

how i can match the number that is calling to me
by Magui 13 Aug '09

13 Aug '09

Hello I am new with freeradius ,I wan to know if is posible to restrict an acces to the network using the telelephon number of who is calling for the acces to the network by the ppp conection How I can use radius for match user password and telephone number combination as conditions for acces to my network I will be very grateful if somebody can help me -- Este mensaje le ha llegado mediante el servicio de correo electronico que ofrece Infomed para respaldar el cumplimiento de las misiones del Sistema Nacional de Salud. La persona que envia este correo asume el compromiso de usar el servicio a tales fines y cumplir con las regulaciones establecidas Infomed: http://www.sld.cu/

1 0