October 2010 - Freeradius-Users - lists.freeradius.org

rlm_ldap and (automagic) xlat
by Sven Hartge 29 Oct '10

29 Oct '10

Hi all! I am using freeradius 2.1.10 (from backports) on a Debian Lenny server to authenticate wireless users using EAP and normal users (from Ascend NAS and ASA5510) with CHAP and PAP and so on. My backend is a LDAP directory (OpenLDAP). So far, everything is fine and working great. My question is more about fine tuning some aspects and some understanding issues with the way rlm_ldap adds (or doesn't add) attributes to the query/reply. I need to explain a bit about my environment: I have two LDAP attributes, which control the state of the account of a user: a) gifb-Status ("1" means enabled) b) gifb-NetzAccStatus ("1" again means enabled) - gifb-status gets set to "0" if the password expires or the account gets disabled because of other reasons. - gifb-NetzAccStatus gets set to "0" if the networking account has to be disabled If any of the two attributes is != 1, then the user has to be rejected. To achieve this, until recently I had a filter like the following for the ldap module: filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=gifb-NetzAccount)((gifb-status=1)(gifb-NetzAccStatus=1))" This worked OK, ie. the user was rejected if his account was disabled, because he wasn't even found by the ldap module. But this also resulted in somewhat ugly log entries: Sun Oct 3 20:38:18 2010 : Auth: Login incorrect ( [ldap] User not found): [XXXX123] (from client alb13 port 5 cli 00236CDEADBF via TLS tunnel) Sun Oct 3 20:38:18 2010 : Auth: Login incorrect: [XXXX123] (from client alb13 port 5 cli 00236CDEADBF) So, using unlang I created the following, adjusting my filter first ... filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=gifb-NetzAccount))" ... adding to the dictionary ... ATTRIBUTE GIFB-NetzAccStatus 3000 integer ATTRIBUTE GIFB-Status 3001 integer and then in the inner-tunnel: ,----[sites-enabled/inner-tunnel | ldap | | if ( !notfound ) { | update request { | GIFB-NetzAccStatus := "%{ldap:ldap:///dc=fh-giessen-friedberg,dc=de?GIFB-NetzAccStatus?sub?uid=%u}" | GIFB-Status := "%{ldap:ldap:///dc=fh-giessen-friedberg,dc=de?GIFB-Status?sub?uid=%u}" | } | if ( GIFB-NetzAccStatus != 1 ) { | update reply { | Reply-Message = "User denied by GIFB-NetzAccStatus" | } | reject | } | if ( GIFB-Status != 1 ) { | update reply { | Reply-Message = "User denied by GIFB-Status" | } | reject | } | } `---- This also works great, I get meaningful log-entries and everything is OK. Now, for my rather simple question: Why can't I just add the following to ldap.attrmap and have the ldap module add those two attributes automagically. Why do I have to use two separate ldap_xlat queries: checkItem GIFB-NetzAccStatus GIFB-NetzAccStatus checkItem GIFB-Status GIFB-Status I also tried this with "replyItem" instead of checkItem and also tried adding ":=" as the operator, but without the separate ldap_xlat queries both RADIUS-Attributes are not available after the normal ldap module ran. It seems I am missing some crucial part of information here or just lack the understanding of this part of Freeradius. Please enlighten me. Grüße, Sven. -- Sig lost. Core dumped.

2 5

Re: EAP-SIM authentication / Supplicant
by tmuehlhoff 29 Oct '10

29 Oct '10

Any more activities in this context ? I'm trying to set up soemthing in this area. T. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-SIM-authentication-Supplicant-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

duplicate users + Free Radius
by Tyler Nally 29 Oct '10

29 Oct '10

Curious... assuming FreeRadius is configured to allow people to use the NAS via a username/password combination... would that allow johndoe to use both laptop computer and iPhone (and other wifi enabled devices) concurrently? or does FreeRadius boot the oldest authenticated login off of duplicate uses? Thanks -- Tyler Nally tnally(a)technally.com

3 2

FreeRadius + MySQL + Multiple Dynamic Clients
by Tyler Nally 29 Oct '10

29 Oct '10

Hello, I'm the IT fellow for a bus company that is about to implement WiFi on a fleet of a couple dozen buses (or so), so that passengers can pull out their laptops, iPhones, iPads, iWhatevers and connect thru the wandering networks from inside the comfort of the bus while traveling to their various destinations. We'll be using a Wireless Broadband device that will provide the broadband signal to a router. The router will be configured to use a Radius server so that as people connect they'll go through the Radius authentication protocols to get their wifi connection to the network. I'm assuming that whenever these power on, they'll be getting a new dynamically assigned IP address. Not to mention that potentially, as the bus roams aruond and as it loses and gains service between the different cell sites, I guess it's possible that each time it loses/gains a cell site, it might even get a new IP address. So, what I want to avoid is having set each router's access password (which would be 1 or 2 at first) each week .. manually. Up to a maximum of 20 or 30 of these .. manually. I figure that I can capture the the users email address (or username) and a password, and make just THAT combination of authentication available WHILE their scheduled route is running. Sooo.. just prior to the dispatch of the bus, I add that list of good authentications to the records of FreeRADIUS server setup. When the route is over, I remove the records (or somehow toggle them off). The idea being that they'll only be allowed one login per user while on the bus. And if they don't check/select that they want wifi access, they won't get access from a previous user/password combination. What I've got working is FreeRADIUS with MySQL. But not with a dynamic client. It's refusing the authentication connection with the client. Do I define 1 dynamic client that maybe 20-30 of these will be using? Or should they be numbered from 01 thru whatever. Either way, they'll all have different IP's as they are traveling down the road. The error message I see in the logs is: Thu Oct 28 16:10:26 2010 : Error: Ignoring request to authentication address * port 1812 from unknown client 98.212.198.111 port 2048 So.. I know the network is open to get the request, it's just not processing it. I've looked through the WIKI and can't find any specific dynamic client setup parameters/settings. I'm running freeradius v 2.1.8 on a Ubuntu 10.04 machine. With a test connection via a Netgear WNR834v2 that's been reflashed as a DD-WRT mini hotspot to give me the router configuration. Any help would be appreciated. -- Tyler Nally tnally(a)technally.com

2 3

RE: Wireless WPA2 enterprise Radius authentication
by Maurice James 29 Oct '10

29 Oct '10

Working settings I will be stating the changes from the default settings that I made to get it to work. All file names are followed by a colon : <<<<< = notes changes ****First you must have your ldap server store password in clear text. They CANNOT be hashed in any way**** eap.conf: default_eap_type = peap <<<<< ldap.attrmap: checkItem Cleartext-Password userPassword <<<<< (this entire line was added to the top of the list) inner-tunnel: # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap <<<<<(this must be uncommented) ldap: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "xxx.xxx.xxx" <<<<<(your ldap server) identity = "uid=xxx,ou=xxx,ou=TopologyManagement,o=xxx" <<<<<(your ldap admin user) password = xxxxx <<<<<(your ldap admin password) basedn = "dc=xxx,dc=xxx" <<<<<(your base dn) filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" mschap: use_mppe = yes<<<<<(not sure if this is needed but I changed it from no to yes) with_ntdomain_hack = yes<<<<<(not sure if this is needed but I changed it from no to yes) default: # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap<<<<<(uncomment) These are all of the setting that I changed to get Windows 7/Vista x64 > WPA2 > freeradius > 389-DS(Fedora Directory Server) to work -----Original Message----- From: freeradius-users-bounces+midnightsteel=msn.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] On Behalf Of Maurice James Sent: Thursday, October 28, 2010 4:37 PM To: 'FreeRadius users mailing list' Subject: RE: Wireless WPA2 enterprise Radius authentication OK gentlemen, After many sleepless nights I finally got it working. I was almost in tears (lol) but its done. Full authentication and authorization for a mix of Windows7 x64/Vista x64 clients using WPA2 Enterprise, Freeradius, 389-DS(Fedora Directory Services). I will post the configs in a follow-up email. Special thanks to the following John Dennis Sven Hartge Phil Mayers Thanks guys MCITP Enterprise + Server GIAC Security Leadership Certification (GSLC) -----Original Message----- From: freeradius-users-bounces+midnightsteel=msn.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] On Behalf Of John Dennis Sent: Wednesday, October 27, 2010 8:54 PM To: FreeRadius users mailing list Subject: Re: Wireless WPA2 enterprise Radius authentication On 10/27/2010 07:56 PM, Maurice James wrote: > I will give it another try. I've been trying to the last hour to get > the clear text password policy to stick to a user. Every time I run > the radius debug I see hashed value passed from LDAP. I have to search > online for the instructions on how to get 389-ds server to use clear > text. Thanks for all the help and advice all. This is one of the most > responsive lists that I have ever been a member of 389-ds has most all the features I mentioned. The Administrators Guide is your friend. 389-ds doc can be found here: http://directory.fedoraproject.org/wiki/Documentation#389_Documentation The Administrators Guide can be found here: http://www.redhat.com/docs/manuals/dir-server -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Problems getting a linux server to join a AD domain
by Rowley, Mathew 28 Oct '10

28 Oct '10

In an attempt to integrate Radius with AD, and following the tutorial (http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO) I have set up an AD server in our lab, and having trouble adding my linux box to the domain. Can anyone see what im doing wrong? The error I keep getting is: $ sudo net join -w SECLAB -I 10.252.159.137 -U Administrator [sudo] password for wuntee: Enter Administrator's password: [2010/10/28 12:23:36.656829, 0] utils/net_rpc_join.c:406(net_rpc_join_newstyle) Error in domain join verification (credential setup failed): NT_STATUS_INVALID_COMPUTER_NAME Unable to join domain SECLAB. Kerberos seems to work fine: $ kinit mrowle000 Password for mrowle000(a)SECLAB.SECURITY.LAB.NET: $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: mrowle000(a)SECLAB.SECURITY.LAB.NET Valid starting Expires Service principal 10/28/10 12:27:29 10/28/10 22:27:23 krbtgt/SECLAB.SECURITY.LAB.NET(a)SECLAB.SECURITY.LAB.NET renew until 10/29/10 12:27:29 CONFIGS: krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log kdc = SYSLOG:INFO:AUTH admin_server = FILE:/var/log/kadmind.log admin_server = SYSLOG:INFO:AUTH [libdefaults] default_realm = SECLAB.SECURITY.LAB.NET dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [realms] SECLAB.SECURITY.LAB.NET = { kdc = seclab.security.lab.net:88 default_domain = seclab.secuitry.lab.net } [domain_realm] .seclab.security.lab.net = SECLAB.SECURITY.LAB.NET seclab.security.lab.net = SECLAB.SECURITY.LAB.NET Samba.conf [global] workgroup = SECLAB.SECURITY.LAB.NET server string = %h server (Samba, Ubuntu) dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d security = ads encrypt passwords = true passdb backend = tdbsam obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes map to guest = bad user idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/bash winbind use default domain = no password server = seclab.security.lab.net //your AD-server realm = SECLAB.SECURITY.LAB.NET //your real usershare allow guests = yes [homes] comment = Home Directories browseable = no writable = yes [printers] comment = All Printers browseable = no path = /var/spool/samba printable = yes guest ok = no read only = yes create mask = 0700 [print$] comment = Printer Drivers path = /var/lib/samba/printers browseable = yes read only = yes guest ok = no

5 9

Assign VLANS based on AD groups.
by Johnson, Neil M 28 Oct '10

28 Oct '10

Now that I have authentication working. I would like to assign users to VLANS based on AD group membership. Google searches haven't produced any examples, but I'm assuming that I need to do something with LDAP ? Any examples would be appreciated. Thanks. -Neil -- Neil Johnson Network Engineer Information Technology Services The University of Iowa 319 384-0938 neil-johnson(a)uiowa.edu

2 1

Wireless WPA2 enterprise Radius authentication
by midnightsteel 28 Oct '10

28 Oct '10

Has anyone gotten Freeradius 2.x and LDAP (OpenLDAP, FDS, etc...) to properly authenticate users? I get the following in my radius log Auth: Login incorrect: [wii/<via Auth-Type = EAP>] (from client access port 0 via TLS tunnel) Auth: Login incorrect: [wii/<via Auth-Type = EAP>] (from client access port 14 cli 78e400881f19) This is driving me crazy. I can authenticate users from the radius serve to ldap but not from the access point to radius to ldap If anyone has gotten it to work please post the example config files that you used. Im open to answer any questions that you may have about my configs. Access point using WPA2-Enterprise >> Freeradius 2.x >> 389-DS(Fedora LDAP) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Wireless-WPA2-enterprise-Radius-aut… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 21

WPA2 Enterprise, Freeradius/Mysql Test Data
by Dirk Leas 28 Oct '10

28 Oct '10

Is there a reference for test data given default Ubuntu freeradius/freeradius-mysql packages modified to mysql back end (successfully verified with trivial radtest test case)? Any other config changes required to demonstrate WPA2 Entrprise authentication? TIA, D

2 1

vlan assignment in radius reply when using eap/peap
by Josh Hiner 28 Oct '10

28 Oct '10

Hello, I have working setups of mac authentication where I use mysql and use radgroupreply to hand out the appropriate vlans to my hp procurve switches based on what mac address is authenticating. I also have working setups for eap/peap where I use the mschapv2 module to auth off a samba server via ntlm_auth. What I'd like to do is hand out vlans in my eap/peap setup similar to how Im doing via mysql and mac-auth. How are others out there handing out vlans in your eap-peap setups? Thanks for any help and ideas! I use freeradius versions from 2.1.6 to 2.1.9. -Josh

1 0