October 2010 - Freeradius-Users - lists.freeradius.org

Default behavior for users not in any group
by Maxim S. Denisov 12 Oct '10

12 Oct '10

Hello. I have freeradius 2.1.6 with rlm_sql_oracle. There is a plenty of users in radcheck table and several of them are a members of a group. As stated in comments in the dialup.conf all other users are a members of the group DEFAULT if I understood it right. I put the fields DEFAULT Auth-Type := Reject in the radgroupcheck table but it seems that radius doesn't process the group checks if there is no explict group record for the user in radusergroup table even if I set read_groups. The radius accepts the requests if the username and password matches. How can I reject users not stated in the group without explictly assigning them to the DEFAULT group in radusergroup? Regards, Maxim S. Denisov

2 2

RE: Problem with MSCHAP
by Mark Holmes 12 Oct '10

12 Oct '10

OK, Just to recap, I'm working on setting Freeradius up to authenticate users to our wireless network. We want to use PEAP-MSCHAPv2 and authenticate against Active Directory. I'm using samba and ntlm_auth. Versions:freeradius2-2.1.7-7.el5 and samba3.0.33-3.29 Needless to say it's failing. I set the mydomain.ox.ac.uk realm in proxy.conf as someone on here suggested on Friday, and that has cleared up the warning about unknown realms. When connecting, I still get several errors before auth fails. I've pasted my debug output into the web tool and it picks out the following in red security { max_attributes = 200 reject_delay = 1 (This line in red) status_server = yes } (all in red) Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. (In yellow) I also see (not highlighted) that I'm still getting [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for holmes(a)mydomain.ox.ac.uk with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect I have configured modules/mschap to use ntlm_auth as follows ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Am I missing something in the MSCHAP config? Cheers, Mark

2 3

SQL query error; rejecting user
by Daniel Sandulescu 12 Oct '10

12 Oct '10

Hello! I got a erroarea following logging and do not know where to look. Can someone ajunte me? rad_recv: Access-Request packet from host 127.0.0.1:42096, id=227, length=116 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "phlander" CHAP-Challenge = 0x153961bc09eaeddf1226af8d60538ee6819b24ede1c1 CHAP-Password = 0xacf1701244e94be1dffe4e11ee08f0caa4 Calling-Station-Id = "00:42:15:11:24:57" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 rad_lowerpair: User-Name now 'phlander' rad_rmspace_pair: User-Name now 'phlander' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 radius_xlat: '' rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns fail for request 0 modcall: group authorize returns fail for request 0 There was no response configured: rejecting request 0 Server rejecting request 0. Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 227 to 127.0.0.1:42096 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 227 with timestamp 4cb2ee7d Nothing to do. Sleeping until we see a request.

4 14

Store Access-Request packet information in database
by c.schwarz＠funknetz.at 11 Oct '10

11 Oct '10

Hi, I would like to achieve some kind of a tracking system for 802.11 wireless clients, therefore every login attempt should be accepted and the necessary information (e.g. nas-ip-address, calling-station-id) should be stored in an extra database table. Example output: rad_recv: Access-Request packet from host 192.168.30.216 port 43128, id=5, length=200 NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00:1A:73:59:25:4B" Called-Station-Id = "hotspot1" NAS-Port-Id = "wlan1" User-Name = "christoph" NAS-Port = 2152726535 Acct-Session-Id = "80500007" Framed-IP-Address = 10.50.0.254 Mikrotik-Host-IP = 10.50.0.254 CHAP-Challenge = 0x12321805f00ad380736bd946aefe0389 CHAP-Password = 0x1153fcb1c99609b962baa8042aca266905 Service-Type = Login-User WISPr-Logoff-URL = "http://10.50.0.1/logout" NAS-Identifier = "test-loop21" NAS-IP-Address = 192.168.30.216 Does anybody have an idea how to store this kind of information when freeradius receives an access-request packet? Thanks in advance Chris

2 1

Re: Problem with Alcatel 4604 and Cisco ACS
by matteo＠crs4.it 10 Oct '10

10 Oct '10

Hello, Am I right if I use attr_rewrite module to solve my problem? Thanks a lot ------------------------------- On 10/07/2010 10:11 AM, Johan Meiring wrote: [Hide Quoted Text] On 2010/10/07 10:01 AM, matteo wrote: Hello, I'm in trouble trying to authenticate a client connecting to an Alcatel 4604 (Aruba device) to a Cisco ACS, because my alcatel send as Called-Station-Id value its mac-address. On the Cisco side, this value correspond to the SSID value, while this attribute on Alcatel is send via Aruba-Essid-Name (attribute 5 in dictionary.aruba). Is there a way to change this behavior or a remap of this attribute for Alcatel? ---------------------------------- Where is Freeradius involved? --------------------------------------- My freeradius 2.1.x is proxying requests for a realm managed by the ACS Thanks ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.

1 0

Clear text password not available
by Daniel Sandulescu 09 Oct '10

09 Oct '10

Hi ! Login incorrect (rlm_chap: Clear text password not available): [phlander/<CHAP-Password>] Does anyone know where to change? Tks!

3 4

Question about NAS-Port attribute when using freeradiusclient
by Ali Majdzadeh 08 Oct '10

08 Oct '10

Hello All I am using freeradiusclient in combination with PPP in order to setup RADIUS authentication for PPTP users. Actually, I managed to authenticate users using RADIUS but I noticed that the NAS-Port attribute which is sent to RADIUS server is always 0. Is this normal? Is there any way to generate proper values for NAS-Port? Is this attribute set by radiusclient or is it extracted from somewhere else? (PPP, maybe?) Warm Regards Ali Majdzadeh Kohbanani

2 4

Problem with MSCHAP
by Mark Holmes 08 Oct '10

08 Oct '10

This is my first post to this list, so first of all, hi! I'm new to freeradius, I'm working on setting it up to authenticate users to our wireless network. We want to use PEAP-MSCHAPv2 and authenticate against Active Directory. I'm using samba and ntlm_auth. Versions:freeradius2-2.1.7-7.el5 and samba3.0.33-3.29 I have the ntlm_auth part working in as far as I can put DEFAULT Auth-Type = ntlm_auth in users and then do radtest user password localhost 0 testing123 and I see the server returns Access-Accept. I then configure MS-CHAP, removing the DEFAULT Auth-Type from users and editing modules/mschap as follows ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MYDOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" and set up a wireless access point up to, add it to clients and have it point at the radius server Now when I try to connect I get Access-Reject - I've tried a couple of devices - an iPhone and a Win XP machine. Output from radius -X at the bottom of this message. The bit that looks relevant to me is ++[mschap] returns noop Which I guess indicates a problem with mschap somewhere Also [suffix] Looking up realm "mydomain.ox.ac.uk" for User-Name = "firstname.lastname(a)mydomain.ox.ac.uk" [suffix] No such realm "mydomain.ox.ac.uk" However I'm not sure I need to worry about that bit - at the moment this is just a single, stand alone RADIUS server so I'm not sure I need to worry about realms or do I?.... Not sure where to go from here - are there some basic things I should check? I haven't included my conf files in this post but happy to do so if required. Any advice/hints much appreciated as to how I should look to troubleshoot this. Thanks, Mark Output from -X Waking up in 4.7 seconds. rad_recv: Access-Request packet from host 192.168.1.10 port 1286, id=39, length=267 Message-Authenticator = 0x2e5d3be1821aead988b3d37cba9afd08 Service-Type = Framed-User User-Name = "firstname.lastname(a)mydomain.ox.ac.uk" Framed-MTU = 1488 State = 0x0f85e60107a2ffd7a9724559c0c7d131 Called-Station-Id = "00-24-73-54-22-C2:Test-WLAN" Calling-Station-Id = "78-E4-00-B2-E2-D5" NAS-Identifier = "Wireless AP - I6" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0227002b1900170301002067b2b3a9663cb4262b845b709b8619eb1d6ae803961cb66e52227722f3d8e496 NAS-IP-Address = 192.168.1.10 NAS-Port = 4 NAS-Port-Id = "STA port # 4" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "mydomain.ox.ac.uk" for User-Name = "firstname.lastname(a)mydomain.ox.ac.uk" [suffix] No such realm "mydomain.ox.ac.uk" ++[suffix] returns noop [eap] EAP packet type response id 39 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Had sent TLV failure. User was rejected earlier in this session. [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> firstname.lastname(a)mydomain.ox.ac.uk attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 99 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 99 Sending Access-Reject of id 39 to 192.168.1.10 port 1286 EAP-Message = 0x04270004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.7 seconds. Cleaning up request 90 ID 30 with timestamp +1733 Cleaning up request 91 ID 31 with timestamp +1733 Cleaning up request 92 ID 32 with timestamp +1733 Cleaning up request 93 ID 33 with timestamp +1733 Cleaning up request 94 ID 34 with timestamp +1733 Cleaning up request 95 ID 35 with timestamp +1733 Cleaning up request 96 ID 36 with timestamp +1733 Cleaning up request 97 ID 37 with timestamp +1733 Cleaning up request 98 ID 38 with timestamp +1733 Waking up in 0.9 seconds. Cleaning up request 99 ID 39 with timestamp +1733 Ready to process requests.

5 6

Re: Problemes with the mystic of freeradius configuration
by Alan DeKok 08 Oct '10

08 Oct '10

Klaus Ethgen wrote: > Phil Mayers <p.mayers(a)imperial.ac.uk> schrieb: >> Try this: ... > Doesn't work: > server probes { > +- entering group authorize {...} > ++[ok] returns ok > ++[handled] returns handled > } # server probes The debug log shows that you did *not* try Phil's suggestion. > I believe that. But I defined a authenticate method: "ok" And I do not > want freeradius to think that it should do some extra work than that > what I told them. Go back and read the default configuration files. The "authenticate" section is composed of a set of *individual* authentication methods. You can't just delete them all and expect them to work. i.e. If you don't understand how the server works, it's not a good idea to butcher the configuration. Go back and try Phil's suggestion. It works. Don't put anything else in the "authorize" section. Don't use an "authenticate" section. > Hmmm.. I'll try. I want to have all configuration concerning one virtual > server to be encapsulated within this server. As I read the > documentation and the examples, that work for some configuration > settings but not for all. Exactly. If you want different configurations for a virtual server, use different configuration files. See raddb/radrelay.conf for an example. > Well, ok, I will the next time. Principle it is all the same that the > documentation about freeradius only covers the standard tasks but if you > need a configuration that is a bit special you are on your own. Exactly. The server includes documentation on how it works, and what each configuration option does. It's left to you to figure out how to translate that into your requirements. The server does *not* include documentation for how to set up your environment. We don't know what you want, and there are millions of possible configurations. Alan DeKok.

1 0

Re: Problemes with the mystic of freeradius configuration
by Alan Buxey 08 Oct '10

08 Oct '10

Hi, > Another quest for me is to encapsulate the configuration for eduroam > (including the users and proxy.conf(!)) into a complete independent > configuration to use the radius server for more than eduroam. > Unfortunately all tries to us a other file for users and proxy.conf only > in the eduroam virtual server was unsuccessful. the proxy.conf entries are global - so you cannot have a single isolated way - you need to share the file. our current recipe is quite simple, in 'human readable' terms : is this user a local user? yes -> mark realm as local no -> mark realm as eduroam if realm = local then update the control proxy to local if realm = eduroam then update the control proxy to eduroam then, in proxy.conf have your eduroam config as a nice boilerplate. its okay - but I really really wouldnt want to drop such a configuration on top of someone elses server as, the joy of FreeRADIUS , is that people can do whtings in so many ways...and by defining realms and control lgoic you could/may break their internal logic, unlang etc. what we DO suggest is that sites have a virtual server for dealing with things that come from their national proxies - as the proxy would already have checked that the user is theirs etc - so you can skip lots of stuff and go straight to the authorization/authentication stages. alan

1 0