February 2010 - Freeradius-Users - lists.freeradius.org

03 Feb '10

hi I have 2 ldap servers containing computers accounts with the same DN I don't know how differentiate access-accept or "ldap_1/2 returns ok" I want to put ldap_1's computers in vlan 1 and ldap_2 's computers in vlan 2 . What is the best practice to do this ? maybe with unlang ??? i've read the man authorize { ... group { ldap_1 ldap_2 } ... } authenticate{ Auth-Type ldap { group { ldap_1 { reject = 1 ok = return } ldap_2 { reject = 1 ok = return } } } Help please!

1 0

Another command authorization question
by Rija perso 03 Feb '10

03 Feb '10

Hi all, I'm trying to do per-command authorization with extreme networks switch (x450) and FR. According to extreme it's possible to do this with FR ... http://www.extremenetworks.com/libraries/services/ExtremeXOSConceptsGuideSo… page 816. "Command authorization is enabled in the users file on a FreeRADIUS server, and configured in the profiles file. Additional configuration is required in the dictionary file and the clients file." All you need is : -extreme VSA in dictionary -in users file : test Password = "test", Service-Type = Administrative, Profile-Name = "Profile1" Filter-Id = "unlim" Extreme:Extreme-CLI-Authorization = Enabled -in clients file : type:extreme:nas + RAD_RFC + ACCT_RFC -in profiles file (???) PROFILE1 deny { enable *, disable ipforwarding show switch } **** After some syntax tweaking : --Adding "Profile-Name" to dictionnary ATTRIBUTE Profile-Name 3500 string --adding in clients.conf client 10.0.0.10 { nastype = nas secret = XtremeSecret shortname = X450 } --adding in users file test Auth-Type := System, Service-Type := Administrative-User,Profile-Name := "PROFILE1" Service-Type = Administrative-User, Filter-Id = "unlim", Extreme-CLI-Authorization = Enabled --creating and filling /etc/freeradius/profiles file **** i've got : --- login to the switch : OK --- the switch send every user command to the FR server : OK --- FR check the "profiles" file to see if the user is authorized to execute this command : NOT OK It seems that FR don't care about the "profiles" file. The switch had only 2 level of authorization : - Service-Type = Administrative-User = read-write - Service-Type = anything else = read-only Maybe i've missed something ... My questions are : Is it possible to do what they claim with FR ? Is it possible to check an external file (by using external script) from "users" file or from any other FR config files to do the job ? Regards Rija

1 0

Default entry to allow all
by Godfrey Peart 03 Feb '10

03 Feb '10

At present my setup uses peap/ms-chapV2 to authenticate users is it possible to have an entry in the users file that will allow users to connect regardless of the username/password combo they input at the login box . I did try *DEFAULT Auth-Type := Accept*, but it didn't work rad_recv: Access-Request packet from host 10.10.3.29 port 1645, id=208, length=154 User-Name = "anything" Framed-MTU = 1400 Called-Station-Id = "0021.55ac.f2d0" Calling-Station-Id = "0013.0229.bf35" Cisco-AVPair = "ssid=swordfish" Service-Type = Login-User Message-Authenticator = 0x02152f851db652adcceccf557c2c9b5f EAP-Message = 0x0202000b01747972757275 NAS-Port-Type = Wireless-802.11 NAS-Port = 13008 NAS-Port-Id = "13008" NAS-IP-Address = 10.107.3.29 NAS-Identifier = "THEO" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anything", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 11 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 207 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 208 to 10.10.3.29 port 1645 Finished request 0. Version: FR-2.1.8

3 2

Re:Default entry to allow all
by Godfrey Peart 02 Feb '10

02 Feb '10

I know, that's what baffling me, under my normal setup I get the TLS tunnel established and authentication works fine, but here there is no TLS setup just an accept mesage that matches the default entry but the client doesn't connect. Do I need to do any other tweaking concerning the peap setup

2 1

WPA Certificate Question
by Mike Diggins 02 Feb '10

02 Feb '10

I was able to get freeradius 2.1.3 and wireless WPA working, likely due to the fact that FreeRadius was mostly configured for me (thanks ;) ). I’m a little confused about the certificate that is required in the process, and what the relationship is with the client, the Wireless Controller and the FreeRadius server. The README file states: “ In general, you should use self-signed certificates for 802.1x (EAP) authentication.” Why self signed versus CA signed? Ideally I would like my clients to not be questioned about the certificate at all. Is that even possible with WPA? If I purchase a CA signed cert, would that eliminate the requirement on the client to acknowledge the certificate or import it? -Mike

6 14

pfSense + PPTP + FreeRADIUS + LDAP
by Fabio Rampazzo Mathias 02 Feb '10

02 Feb '10

Helo there, I'm relative new to freeradius, and i'm trying to configure a PPTP VPN on pfSense, authenticating in a FreeRADIUS with LDAP module. But, I'm getting the following error : Found Auth-Type = LDAP WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. The authorize process works fine, but the authentication not. I can't find "Auth-Type = Local" as it says. This is my access request : rad_recv: Access-Request packet from host 192.168.7.1 port 2067, id=132, length=182 NAS-Identifier = "yoda" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "189.102.177.232" User-Name = "fmathias" MS-CHAP-Challenge = 0xbb1e68338ed8f5047a5224fc502acaf9 MS-CHAP2-Response = 0x0100e017671426d787073d90dcb6a30ab3550000000000000000a5d5fa96e3770592a1df0039fcc812ea53a3684636f16cb3 I've tried many of google searches troubleshooting MS-CHAP problems and most of them is saying me to get a Cleartext-Password entry on my database. But I can't consider this an option, because the security of my accounts in LDAP would be extremely compromised. Can you help me? Thanks in advance, Fábio Rampazzo Mathias

2 4

Re: using Oracle with FreeRADIUS - I need a clue
by William Bulley 02 Feb '10

02 Feb '10

According to Alan DeKok <aland(a)deployingradius.com> on Tue, 02/02/10 at 14:29: > > > If Oracle support in FreeRADIUS is meant to at least include logging > > of session records, if RADIUS requests arrive at two FreeRADIUS server > > instances (say, primary and backup/failover), say Acct-Start to server > > "A" and the corresponding Acct-Stop to server "B" for the same RADIUS > > session, would both accounting log records end up in the same Oracle > > table (assuming both server "A" and server "B" are configured to send > > session logs to an Oracle instance on server "C")? > > That's a database replication issue, not a FreeRADIUS confi question. Just to clarify, given a server "C" running an instance of Oracle, and given the two FreeRADIUS boxes "A" and "B", if they both are configured to "talk" to Oracle on server "C" (just what that means is left as an exercise for me), there is nothing preventing a Acct-Start record from a RADIUS session 123 from server "A" _plus_ a Acct-Stop record from the same session 123 from server "B" being directed to the Oracle server "C", correct? This scenario hypothetizes the unlikely circumstance where server "A" is unavailable after the session 123 Acct-Start is received and hence the Acct-Stop fails-over to server "B". Given all that, it does seem to boil down to an Oracle issue, but I had to start here for FreeRADIUS. Next step: ask some Oracle expert about updating this one table, in real time, from two _different_ connections. Thanks for your timely reply. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

Freeradius replacing Cisco ACS in an Active Directory Environment (Wifi PEAP+MSCHAP and other uses)
by George Shearer 02 Feb '10

02 Feb '10

Ugh. Please ignore my previous post to the list, gmail 'plain text' mode ate most of the message. All, this is my attempt at giving back to the freeradius community. Maybe others will find my configuration useful in their efforts. I'm a network guy, and I do quite a bit of consulting work for various companies. I have a customer in particular who (prior to this) wasusing a very out-of-date Cisco ACS Server, and couldn't afford the renewal/licensing fees to bring it uptodate. They are using Microsoft's Active Directory on Windows Server 2000 as the primary database for all identities/passwords. The goals of this configuration are: 1. Provide AAA for administrative access to network devices (mostly, SSH access to Cisco routers/switches/firewalls) 2. Provide AAA for 802.11 WLAN users who are using Windows XP and "Wireless Zero" clients. (Cisco 1231 series access points) 3. Provide AAA for VPN Users who use cisco Secure VPN client from remote locations (cisco 3000 series concentrators) The freeradius server itself will run on a CentOS 5.4 Linux box. The company doesn't like "make install" application installs (nor do I), so I simply grabbed the SRPM from the Fedora project's KOJI build server for the latest freeradius, and built it. This process is outside the scope of this particular posting, as I want to focus on Freeradius itself. The Fedora spec file builds multiple binary packages that you can install based on what you want to do with freeradius. These are the packages I'm using: freeradius-utils-2.1.8-2 freeradius-2.1.8-2 freeradius-ldap-2.1.8-2 The company has one Active Directory forest, and one subdomain. Users exist under both. So, for this configuration, we'll call the primary zone COMPANY.COM and SUB.COMPANY.COM <http://SUB.COMPANY.COM>. Both domains must be queried for authorization & authentication. The following rules apply for access: 1. User must exist within the AD forest. (as defined by my LDAP search parameters) 2. User must be a member of a particular group (defined by the Users file) for certain types of access: a) For administrative access to network device, the user must be a member of the group networkteam. b) Access to use the VPN, user must be a member of the group vpnusers. c) Access to the Wireless network, user must be a member of group wifiusers. VPN and Network-Admin users achieve both Authorization and Authentication using nothing more than the rlm_ldap module. Wireless users do not use ldap at all, but instead, they use the eap and mschap modules. The mschap module is configured to use ntlm_auth which requires samba's winbind to be configured on the backend. It took me some time (and I will not admit how much time) to figure out how to make this all work. I blame most of this on the fact that freeradius has been around a long time, and as result there's lots of obsolete documentation out there for google to find. I believe this configuration uses mostly uptodate syntax, however I'm always interested in advice on improvements. Interestingly, this process gave me quite a case of dejavu. I wrote a combination tacacs/radius server WAY back when the Livingston Portmaster 2 series was king of dialup. Many sers on the livingston mailing list used my source code. This really made me feel old. :( Anyway, on to the good stuff: Annoyances: 1. Cisco does not support command accounting via Radius. Only Tacacs. Why? They want you to buy ACS ! Sorry Cisco, I love ya, but.. cmon! 2. Cisco PIX/ASA do not support radius for command authorization. So, you have to type 'enable' and your AD account password AGAIN. 3. Cisco 1231-series access points running IOS 12.3(8)JED or earlier do not include NAS-Port-Type in subsequent password attempts for SSH access. So, you only get one shot at typing your password right when you SSH for admin access into a WAP. It'll ask you for your password again, and it'll try to get approval from your Radius server, however, it will not include the port type in the request. So freeradius will not classify the request in the proper huntgroup. Unfortunately, you may think you just keep fat fingering your password, so you just keep trying. This will eventually get your AD account locked and you'll have to bug the windows guys to re-enable it. :) 4. Cisco 3000 platform does not support AAA for admin access.. again, only with tacacs. I know, I know, this platform is OLD, but... you have to admit, it has to be one of the most reliable platforms cisco has ever sold. It's hard to say goodbye. radiusd.conf --------------------------------------------------------------------------------------------- # freeradius config for a typical company using Active Directory for password management # George Shearer (doc at lame dot org) # Primary uses: # 1. AAA for admin access to network devices (ldap) # 2. AAA for user access to 802.11 Wireless Networks (WPA2-Enterprise / EAP-PEAP / EAP-MSCHAPv2) # 3. AAA for remote user access to VPN (ldap) name = radiusd # Locations prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid # Security #chroot = /path/to/chroot/directory user = radiusd group = radiusd security { max_attributes = 200 reject_delay = 1 status_server = yes } # Network hostname_lookups = yes proxy_requests = no listen { type = auth ipaddr = ip-addr-of-eth0 port = 1812 } listen { type = acct ipaddr = ip-addr-of-eth0 port = 1813 } listen { type = control socket = ${run_dir}/${name}.sock mode = ro } # Performance max_request_time = 10 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no regular_expressions = yes extended_expressions = yes thread pool { start_servers = 5 max_servers = 15 min_spare_servers = 3 max_spare_servers = 5 max_requests_per_server = 0 } # Logging log { destination = syslog syslog_facility = authpriv stripped_names = no auth = yes auth_badpass = yes auth_goodpass = no } # freeradius modules modules { # Create unique acct ID's per session -- so tell network devices to use common id's and let radiusd handle acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } preprocess { huntgroups = ${confdir}/huntgroups } detail { detailfile = ${radacctdir}/%{Huntgroup-Name}/detail-%Y%m%d detailperm = 0600 header = "%t" } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users compat = no } ldap { server = "ip-addr-of-domain-contoller" port = 3268 # Global Catalog port not LDAP. This allows combined searches of both SUB.MYCOMPANY.COM and MYCOMPANY.COM identity = "CN=myqueryacct,OU=System Accounts,DC=mycompany,DC=com" password = "mypassword" basedn = "DC=mycompany,DC=com" filter = "(&(objectCategory=person)(sAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}}))" groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=group)(member=%{control:Ldap-UserDn}))" groupmembership_attribute = memberOf ldap_connections_number = 3 timeout = 4 timelimit = 3 net_timeout = 1 directory_mappings = ${confdir}/ldap.attrmap } eap { default_eap_type = peap timer_expire = 60 max_sessions = 500 ignore_unknown_eap_types = no tls { cert_dir = ${confdir}/certs rsa_key_length = 2048 dh_key_length = 2048 private_key_password = password-for-my-encrypted-key private_key_file = ${cert_dir}/combined-cert-and-key-file.pem certificate_file = ${private_key_file} CA_file = ${cert_dir}/my-ca-cert-file.pem dh_file = ${cert_dir}/dh random_file = ${cert_dir}/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" cache { enable = yes lifetime = 24 max_entries = 500 } } peap { default_eap_type = mschapv2 } mschapv2 { } } mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{mschap:User-Name}:-None} --domain=%{%{mschap:NT-Domain}:-EDLENDING} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} --require-membership-of=wifiusers" } radutmp { filename = ${logdir}/radutmp username = %{%{Stripped-User-Name}:-%{User-Name}} case_sensitive = yes check_with_nas = yes perm = 0600 } realm ntdomain { format = prefix delimiter = "\\" } } instantiate { } authorize { preprocess eap { ok = return updated = return } # The eap {} stuff above prevents your ldap server from being used for wireless users. Since we handle this via ntlm, no need to bug ldap. # also, the ntdomain stuff isnt even needed because the mschap module has variables to do the stripping built in.. ntdomain files ldap } authenticate { Auth-Type LDAP { ldap } Auth-Type MS-CHAP { mschap } eap } preacct { preprocess update request { NAS-Port = 1 # Cisco ASA's annoyingly do not include NAS-Port for administrative logins. This breaks radwho. The # above statement forces Nas-Port to be '1' if it doesn't already exist. } ntdomain acct_unique } accounting { detail radutmp } session { radutmp } # Realms (domains) realm MYCOMPANY { authhost = LOCAL accthost = LOCAL type = radius } realm SUB { authhost = LOCAL accthost = LOCAL type = radius } realm NULL { authhost = LOCAL accthost = LOCAL type = radius realm = MYCOMPANY } # Include our clients $INCLUDE clients.conf --------------------------------------------------------------------------------------------- huntgroups # All devices that network-admins want to log into for administrative access # Cisco sends "Virtual" for type on most things I've tried for SSH access network-admin NAS-IP-Address == ipaddr1, NAS-Port-Type == "Virtual" network-admin NAS-IP-Address == ipaddr2, NAS-Port-Type == "Virtual" network-admin NAS-IP-Address == ipaddr3, NAS-Port-Type == "Virtual" network-admin NAS-IP-Address == ipaddr4, NAS-Port-Type == "Virtual" # Cisco 1200 series WAPs # Since I handle AAA for wireless via ntlm_auth (not LDAP), this group isnt even necessary # However you could expand upon my config and use this group to create a seperate # accounting file, or various other uses. wireless NAS-IP-Address == ipaddr1, NAS-Port-Type == "Wireless-802.11" wireless NAS-IP-Address == ipaddr2, NAS-Port-Type == "Wireless-802.11" wireless NAS-IP-Address == ipaddr3, NAS-Port-Type == "Wireless-802.11" # Cisco 3000 Concentrators # These also send "VirtuaL" as type for users connecting via IPsec. Unfortunately, # the 3000 platform does not support radius AAA for administrative access :( vpn NAS-IP-Address == ipaddr1, NAS-Port-Type == "Virtual" vpn NAS-IP-Address == ipaddr2, NAS-Port-Type == "Virtual" --------------------------------------------------------------------------------------------- users # this 'locally managed' account matches the same account thats in the local configs on the devices # various scripts use this account for things like downloading configs or whatever. And its not in # active directory. It also has a limited security level. admin Huntgroup-Name == "network-admin", Cleartext-Password := "localadminaccountpw" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=2" # This drops all users who are a member of the 'networkteam' group right into an "enabled" prompt # Unfortunately, PIX/ASA's do not support this cisco-avpair on Radius, so you'll still type 'enable' # but when you're asked for a password, you'll give your AD account password again as opposed to # the real enable password. The only time you should need the real enable password for any device # is when the radius server is down DEFAULT Huntgroup-Name == "network-admin", Ldap-Group == "networkteam" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15", Auth-Type := LDAP DEFAULT Huntgroup-Name == "vpn", Ldap-Group == "vpnusers" Auth-Type := LDAP DEFAULT Auth-Type := Reject Reply-Message := "Access Denied. Your attempt has been logged.", --------------------------------------------------------------------------------------------- Cisco IOS based device config: (relevant parts, anyway) aaa new-model aaa authentication login networkteam group radius local-case aaa authentication login wifi-access group radius aaa authorization exec default group radius local aaa accounting session-duration ntp-adjusted aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius aaa session-id common ! ! Obviously you dont need the wireless stuff for non-access points dot11 ssid OURSSID authentication open eap wifi-access authentication key-management wpa accounting default ! ! The "accounting-default" statement is what causes IOS to send accounting packets for that SSID radius-server host my-radius-server auth-port 1812 acct-port 1813 key myradiuskey ! line con 0 login authentication networkteam line vty 0 15 login authentication networkteam --------------------------------------------------------------------------------------------- Cisco ASA/PIX config: username admin password whatever aaa-server radius protocol radius max-failed-attempts 3 aaa-server radius (INSIDE) host my-radius-server timeout 3 key slxradkey2010 authentication-port 1812 accounting-port 1813 aaa authentication ssh console radius LOCAL aaa authentication enable console radius LOCAL aaa authentication serial console radius LOCAL aaa authentication telnet console radius LOCAL aaa authentication http console radius LOCAL aaa accounting ssh console radius aaa accounting telnet console radius aaa accounting serial console radius

1 0

using Oracle with FreeRADIUS - I need a clue
by William Bulley 02 Feb '10

02 Feb '10

When I have used FreeRADIUS in the past, it has been in the traditional "users" file model - that is, very simplistic installation. To date, I have not used FreeRADIUS with Oracle. Is the Oracle support in FreeRADIUS mature, or developmental, in its current state? I cannot determine this answer from a search of the mailing list archives dating back a couple of years. In addition to authentication using Oracle, is the Oracle support also meant for FreeRADIUS configuration, or session logging (accnt, auth, etc.), or some combination of the above? If Oracle support in FreeRADIUS is meant to at least include logging of session records, if RADIUS requests arrive at two FreeRADIUS server instances (say, primary and backup/failover), say Acct-Start to server "A" and the corresponding Acct-Stop to server "B" for the same RADIUS session, would both accounting log records end up in the same Oracle table (assuming both server "A" and server "B" are configured to send session logs to an Oracle instance on server "C")? It has been a while since I used FreeRADIUS, so a pointer to the RTFM would also be an acceptable answer. Thanks in advance. Regards, web... -- William Bulley Email: web(a)umich.edu 72 characters width template ----------------------------------------->|

2 1

how to generate chap-password chap-challenge on radius
by Alisson 02 Feb '10

02 Feb '10

hi, I need to use chap-password and chap-challenge to authenticate mikrotik on radius and i'm trying to use some pear extensions to do it... but mikrotik use passwords like this password=1 CHAP-Challenge = 0xad2c7efe802ea7bea94e270404eb01ae CHAP-Password = 0x000ad48b2d944948e8014118aeb4e56923 and on pear crypt-chap it generates ChallResp : 641af097fc49501791740dcf0684c0e2 expected : 8f028814450d66d94c72331ef455a172 -- Att. Alisson F. Gonçalves Sistemas de Informação - UFGD

2 3