November 2010 - Freeradius-Users - lists.freeradius.org

Crypt Passwords in SQL
by William 18 Nov '10

18 Nov '10

Greetings, First, Thanks Alan DeKok. That was exactly what I needed for NAS_Showt_Name. Second, I just discovered a new issue. Not sure if this is a radius or a MySQL issue. When I crypt a password (MySQL CRYPT command) the password matches anything and everything that matches the first 8 characters of the password. Is this a limitation of Radius crypt or is it a Mysql crypt ? I need 16+ character password that match. Wm

2 4

Re: Re: LDAP auth success / User reject
by Michael Arndt 18 Nov '10

18 Nov '10

Alan, >Use "-X". You've added an additional "-x", which makes the output harder to read. ok, understood, attached below > Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Found Auth-Type Reject > Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Auth-Type = Reject, rejecting user Well... something is setting that. Go find out what, and fix it. any hints, how to proceed to debug from where the "Reject" for rad_check_passwd is caused ? I checked ldap atributes and verified correctness of user passwd for simple bind with ldapsearch So i at last have exluded trivial errors like testing with a dn or wrong user password But now i d not see how to trace why the radius request comes back with reject lm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in l=Stadt,dc=de,o=Organisation, with filter (uid=test1) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user test11 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 4 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [test1/testpass] (from client wlanhsp port 0 cli 00:1e:c2:a3:4d:b3) TIA Micha

2 1

LDAP auth success / User reject
by Michael Arndt 18 Nov '10

18 Nov '10

hello * Szenario: freeradius auth via LDAP simple bind with user passwd / user name for a hot spot Used config works with two other setups of same environment Problem: simple bind returns ok then another module rejects the user Any hints where i should look ? Used Freeradius Version: FreeRADIUS Version 1.1.6 below debug output hu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: - authorize Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: performing user authorization for test1 Thu Nov 18 11:20:52 2010 : Debug: radius_xlat: '(uid=test1)' Thu Nov 18 11:20:52 2010 : Debug: radius_xlat: 'l=Stadt,dc=de,o=Organisationr' Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: attempting LDAP reconnection Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: bind as cn=LDAPADMIN,o=Customer/sharedsecret to 127.0.0.1:389 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: waiting for bind result ... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: Bind was successful Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: performing search in l=Stadt,dc=de,o=Organisation, with filter (uid=test1) Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: looking for check items in directory... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: looking for reply items in directory... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: Setting Auth-Type = ldap Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: user test1 authorized to use remote access Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "ldap" returns ok for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_eap: No EAP-Message, not doing EAP Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Thu Nov 18 11:20:52 2010 : Debug: users: Matched entry DEFAULT at line 3 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "files" returns ok for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "pap" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall: leaving group authorize (returns ok) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Found Auth-Type Reject Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Auth-Type = Reject, rejecting user Thu Nov 18 11:20:52 2010 : Debug: auth: Failed to validate the user. Thu Nov 18 11:20:52 2010 : Auth: Login incorrect: [test1/testpasswd] (from client wlanhsp port 0 cli 00:1e:c2:a3:4d:b line from users DEFAULT Called-Station-Id =~ ".*:LIBRARY" , Ldap-group == "cn=city,cn=Groups,l=Stadt,dc=de,o=Organisation" thx for any hints :-) I have anonymized the ldap Attributes Michael

2 1

Help: 802.1x with freeRadius and mySql database
by Xuan Sun 18 Nov '10

18 Nov '10

Hi Everyone I have set up a freeRadius in Ubuntu server 10.0.4. I also set up a Cisco switch as a NAS and enable 802.1x in the switch port. I used the configuration first (clients.conf, users). The 802.1x authentication just works fine. Then I start to use mySql database, instead of clients.conf and users. I followed the instructions from this link http://wiki.freeradius.org/SQL_HOWTO. I use the "radtest" command to test the username/password. It works fine. Then I use the Cisco switch to test the username/password and NAS, it also works fine. But the 802.1x authentication does not work. Here is the output from "freeradius -X" Ready to process requests. rad_recv: Access-Request packet from host 10.5.84.14 port 1645, id=213, length=265 User-Name = "anonymous" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-6C-79-7F-89" Calling-Station-Id = "00-18-8B-B2-74-CE" EAP-Message = 0x0207006b190017030100603436ac7bdf2130158ce653dea69c9c5c155d4a677f8bf6a3330838e2ca749c29c00d7fef558443728826479cb9dbd75b4e3fc4e62b27ecc64a942b06784ae85df1499325a9c927f9e0de86a9989d7349874019e3a286ebb4ab95347d704aaf79 Message-Authenticator = 0x8a020beb0674cb778f3feb2400792a88 NAS-Port-Type = Ethernet NAS-Port = 50107 NAS-Port-Id = "FastEthernet1/0/7" State = 0xc7b0e155c2nt (0018.8bb2.74ce) on Interface Fa1/0/7 AuditSessionID 0A05540E0000005E17970995b7f81cdb855c0280b00b4a NAS-IP-Address = 10.5.84.14 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700401a0207003b31c49dddfb7a41c1b1af6d0248706af94e0000000000000000d2f582ba4490575f7f0c78eb1e81b3dc81c41b0cb19cfc81003833303038 server { PEAP: Setting User-Name to 83008 Sending tunneled r 020358: Nov 17 11:41:28.199 PST: %AUTHMGR-5-FAIL: Authorization failed for client (0018.8bb2.74ce) on Interface Fa1/0/7 AuditSessionID 0equest EAP-Message = 0x020700401a0207003b31c49dddfb7a41c1b1af6d0248706af94e0000000000000000d2f582ba4490575f7f0c78eb1e81b3dc81c41b0cb19cfc81003833303038 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "83008" State = 0xe741fb76e746e148ba5c58c22edbac30 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "83008", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- enA05540E0000005E17970995tering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for 83008 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. 83008 is my user id. Why it tries to use MSCHAP module and use NT-Password ? Here is the fradius database information in mySql. mysql> show tables; +-------------------+ | Tables_in_fradius | +-------------------+ | nas | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | radusergroup | +-------------------+ 8 rows in set (0.00 sec) mysql> select * from nas; +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ | 2 | 10.5.84.14 | lab-3750b | cisco | NULL | spl00t | NULL | RADIUS Client | +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ 1 row in set (0.00 sec) mysql> select * from radcheck; +----+----------+--------------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------+ | 1 | sqltest | Password | == | testpwd | | 2 | 83008 | Cleartext-Password | := | testing123 | +----+----------+--------------------+----+------------+ 2 rows in set (0.00 sec) mysql> select * from radreply; +----+----------+--------------+----+-------------------+ | id | username | attribute | op | value | +----+----------+--------------+----+-------------------+ | 2 | 83008 | cisco-avpair | = | shell:priv-lvl=15 | +----+----------+--------------+----+-------------------+ 1 row in set (0.00 sec) The other tables is empty. Thank to take a lootk

2 1

freeradius on ubuntu
by Jia Fang (Matthew) 17 Nov '10

17 Nov '10

Hello I am lost in Freeradius on Ubuntu.... I want to use peap authentication in ubuntu platform, but it seems that the rlm_eap_tls.so has license problem and not built in the ubuntu freeradius, then I try to build the source code and find that in hardy 8.04, it need the debhelper version >=6.04. Then i donwload the debhelpler 8.00 and try to make it a deb package by using: matt@radius:~/debhelper$ dpkg-buildpackage -rfakeroot dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set LDFLAGS to default value: -Wl,-Bsymbolic-functions dpkg-buildpackage: source package debhelper dpkg-buildpackage: source version 8.0.0 dpkg-buildpackage: source changed by Joey Hess <joeyh(a)debian.org> dpkg-buildpackage: host architecture i386 fakeroot debian/rules clean ./run dh clean Undefined subroutine &Getopt::Long::GetOptionsFromArray called at /home/matt/debhelper/Debian/Debhelper/Dh_Getopt.pm line 156. make: *** [clean] Error 255 dpkg-buildpackage: failure: fakeroot debian/rules clean gave error exit status 2 How can I have rlm_eap_tls.so on Ubuntu platform? thanks!!!!! ------------------ Best Regards Matthew (方嘉)

2 1

postproxy breaks eap authentication
by hans.bornemann＠tu-dortmund.de 17 Nov '10

17 Nov '10

Hi, I have 2 freeradius server: 1 as proxy server, 1 as authentication server. Everything is working fine (Auth. for WPA2, MSCHAPv2 ) until I implement the postproxy function: Then the authentication process did not finished. Putting the vlanid etc into radreply on the authentication radius, everything is working also. Is there something wrong in my config? Version: freeradius/lucid uptodate 2.1.8+dfsg-1ubuntu1 /etc/freeradius/sites-enabled/default: .... post-proxy { post_proxy_log #attr_rewrite attr_filter.post-proxy eap # Post-Proxy-Type Fail { # detail # } /etc/freeradius/attrs: tu-dortmund.de Tunnel-Private-Group-ID :=8, Fall-Through = Yes DEFAULT Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Regards hans -- Hans Bornemann IT & Medien Centrum - TU Dortmund Tel. 0049 231 7552132

4 6

rlm_exec and 'No such file or directory' error
by mark.leese＠stfc.ac.uk 17 Nov '10

17 Nov '10

Hi, I'm using FreeRADIUS 2.1.3. At the end of the authorize section I need to call a Perl script to do some LDAP checking and either set the Auth-Type to Reject (to forcibly reject a user) or leave it set to whatever value FreeRADIUS has previously set (always LDAP). I used to do this with rlm_perl but it looks like backslashes in the plaintext User-Password attribute causes things to break, and I need a quick fix while I look at what to do about the rlm_perl problem. I have the exec module enabled in the instantiate section of radiusd.conf and I have the following at the end of the authorize section in the sites-enabled/default file: if (control:Auth-Type == LDAP) { update control { Auth-Type = `%{exec:/etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type}}` } } When I run the basic test with debug (-X) turned on I see the following trace: [snip] radiusd: #### Instantiating modules #### Wed Nov 17 17:36:20 2010 : Debug: instantiate { Wed Nov 17 17:36:20 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Nov 17 17:36:20 2010 : Debug: Module: Linked to module rlm_exec Wed Nov 17 17:36:20 2010 : Debug: Module: Instantiating exec Wed Nov 17 17:36:20 2010 : Debug: exec { Wed Nov 17 17:36:20 2010 : Debug: wait = yes Wed Nov 17 17:36:20 2010 : Debug: input_pairs = "request" Wed Nov 17 17:36:20 2010 : Debug: shell_escape = no Wed Nov 17 17:36:20 2010 : Debug: } [snip] Wed Nov 17 17:49:21 2010 : Info: ++? if (control:Auth-Type == LDAP) Wed Nov 17 17:49:21 2010 : Info: ? Evaluating (control:Auth-Type == LDAP) -> TRUE Wed Nov 17 17:49:21 2010 : Info: ++? if (control:Auth-Type == LDAP) -> TRUE Wed Nov 17 17:49:21 2010 : Info: ++- entering if (control:Auth-Type == LDAP) {...} Wed Nov 17 17:49:21 2010 : Info: Executing /etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type} Wed Nov 17 17:49:21 2010 : Info: expand: %{control:Ldap-UserDn} -> CN=bill,OU=Facility Users,DC=foo,DC=ac,DC=uk Wed Nov 17 17:49:21 2010 : Info: expand: %{control:Auth-Type} -> LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program output: LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program-Wait: plaintext: LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program: returned: 0 Wed Nov 17 17:49:21 2010 : Info: result 0 Wed Nov 17 17:49:21 2010 : Info: expand: %{exec:/etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type}} -> LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program output: Wed Nov 17 17:49:21 2010 : Error: Exec-Program: FAILED to execute LDAP: No such file or directory Wed Nov 17 17:49:21 2010 : Debug: Exec-Program-Wait: plaintext: Wed Nov 17 17:49:21 2010 : Error: Exec-Program: FAILED to execute LDAP: No such file or directory Wed Nov 17 17:49:21 2010 : Debug: Exec-Program: returned: 1 Wed Nov 17 17:49:21 2010 : Info: +++[control] returns invalid Wed Nov 17 17:49:21 2010 : Info: ++- if (control:Auth-Type == LDAP) returns invalid Wed Nov 17 17:49:21 2010 : Auth: Invalid user: [bill] (from client localNas port 52340 cli AB-CD-EF-00-00-00) In this case the call to the Perl script (facilityUsers.pl) returns LDAP, but it looks like rlm_exec then tries to execute this result as a command, which fails and then the whole Access-Request message is rejected. I'm clearly doing something wrong, but I can't see what. Can anyone offer any suggestions? Thanks in advance, Mark. -- Scanned by iCritical.

2 1

Settign up postauth to record radius-client name and other information
by William 17 Nov '10

17 Nov '10

Greetings, I am trying to figure out how to record the full Auth information into the postauth table in SQL... here is the /var/log/radius/radius.log output: Thu Nov 16 15:06:07 2010 : Auth: Login OK: [testuser/kikikat] (from client Local2 port 21) Thu Nov 16 15:10:00 2010 : Auth: Login incorrect (rlm_pap: CRYPT password check failed): [testuser/kikikat2] (from client Local2 port 1) What I want to store int he radpostauth table is: (These are already working) Date/time, Username, Password, reply(accept/reject), (I want to add these) Calling_Station, Called_Station, NAS_Short_name from clients.conf What %{Attributes} would I use for these? Wm

2 1

Execute PRISM into HOSTAPD?
by Octavio Ramirez 17 Nov '10

17 Nov '10

Hello, I am working with ubuntu 9.10, I installed freeradius server 2.1.10, Radius server is ok, but I am trying to implement "hostapd" in order to have a management of several access points. Thus, I installed the "hostapd" program, but I have a question concerning with other software related to hostapd. I downloaded PRISM by using the "update manager" utility provided by Ubuntu. How can I execute PRISM by using a terminal? Which are the commands to execute PRISM? Do you have a "quick install" document to install PRISM? Thanks in advance. Octavio Ramírez Rojas

1 0

EAP-SIM and EAP-AKA support
by dfds fds 17 Nov '10

17 Nov '10

From: dfds fds <srinujob2004(a)yahoo.com> Subject: EAP-SIM and EAP-AKA support To: freeradius-users(a)lists.freeradius.org, freeradius-devel(a)lists.freeradius.org Date: Wednesday, November 3, 2010, 6:47 PM Hi, I am trying to setup a radius server with EAP-SIM and EAP-AKA supportIt seems to be freeradius server supports EAP-SIM but i am not sure about AKA , is freeradius supports EAP-AKA also. Could you please fwd procedure to setup freeradius server with EAP-SIM and AKA support. is there is any freely available servers , which supports these features? Thanks for your help RegardsSrinivas

3 3