March 2010 - Freeradius-Users - lists.freeradius.org

problem with PEAP/MSCHAPv2
by Christian Pinedo Zamalloa 31 Mar '10

31 Mar '10

hello, I have found some errors in my freeradius server logs. It seems that some clients are having problems to authenticate againts them. I'm using PEAP/MSCHAPv2 with the latest freeradius version and SUSE OS. Mon Mar 29 14:20:56 2010 : Error: TLS Alert write:fatal:protocol version Mon Mar 29 14:20:56 2010 : Error: rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number Mon Mar 29 14:20:56 2010 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. I have debuged the servers and when this error appears there are differences in the TLS negotiation of PEAP: example of succesful negotiation: ------------------------------------------------ [peap] processing EAP-TLS TLS Length 102 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED example of unsuccesful negotiation: ---------------------------------------------------- [peap] processing EAP-TLS TLS Length 109 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0061], ClientHello [peap] TLS_accept: SSLv3 read client hello C [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 05aa], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] >>> Unknown TLS version [length 0002] TLS Alert write:fatal:protocol version [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A rlm_eap: SSL error error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version num ber SSL: SSL_read failed in a system call (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS I will look if something is bad configured in the user's wifi profile, but does anybody have this problem previously? Thanks, -- Christian Pinedo Zamalloa (zako) PGP keyID: 0x828D0C80 Fingerprint: 7BFF 4105 F46B 7977 BD96 348C 1007 4FF8 828D 0C80

3 2

Somewhat OT: Windows VIsta annoyance: sends local login credentials
by Sergio Belkin 31 Mar '10

31 Mar '10

2010/3/30 Julien Savoie <julien.savoie(a)usainteanne.ca>: > Check if you have this enabled in radiusd.conf > > mschap { > with_ntdomain_hack = yes > } > > realm ntdomain { > format = prefix > delimiter = "\\" > ignore_default = no > ignore_null = no > } > > and proxy.conf > > realm DEFAULT { > strip > } > > If you only have one domain this will work. If you have different domains > you'll need to setup the individual realms. Sounds like in your case you > don't though. > > Hi Julien, file /etc/raddb/modules/mschap is as original one. I use no domain, only user+password. Sorry, but I forget the subject before. Thanks in advance! > Sergio Belkin wrote: > > There are a few log entries like as as follows > Auth: Login incorrect (rlm_ldap: User not found): > [QSARGENTINA\\amumenthaler] (from client UP-PVIII-VIII-Bis port 0 via > TLS tunnel) > > Please could you help me to find a fix? > > - -- -- Open Kairos http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 3

Dan Schaffer is not in the office
by Dan Schaffer 31 Mar '10

31 Mar '10

I will be out of the office starting Wed 03/31/2010 and will not return until Thu 04/01/2010. I will have limited email and voicemail access during the week at the Phoenix Contact Kickoff meetings. If this is an urgent issue, please contact our Tech Support group at 800-586-5525. Thanks, Dan

1 0

Multiple LDAP searches
by Rob Brickhouse 31 Mar '10

31 Mar '10

I am setting up freeradius 2.1.6 and seem to be stuck on how do I go about setting up my ldap module to search multiple basedn if the user is not found in the first? I have four that I need to search in my LDAP tree but cannot figure out the correct way to make it search more than one. I feel like this is probably something simple I'm missing but can't seem to see it atm. Thanks Rob

3 2

Overriding Auth Type in Post Auth
by Johan Meiring 31 Mar '10

31 Mar '10

Hi, In another recent email Alan mentioned that you cannot override a reject in Post-Auth >> post-auth { >> > Post-Auth-Type REJECT { >> > # attr_filter.access_reject >> > Auth-Type := Accept >> > } >> > } > > It's too late to over-ride the reject at that point. I want to implement something differently. I want to override an Accept to a Reject in post-auth (using rlm_perl). I got the impression from another email that that is possible. >> >> >> I basically want freeradius to do the PAP/CHAP stuff and AFTER that I >> want to do things like check the users CAP. > > Use post-auth. The way this sounds, is that you can change an Accept into a Reject, but not the other way around in post-auth. Or am I confused? Thanks, -- Johan Meiring Cape PC Services CC Tel: (021) 883-8271 Fax: (021) 886-7782

1 0

Re: Converting attributes from hex to ASCII
by Aaron Paetznick 31 Mar '10

31 Mar '10

Thanks Arran, but I'm already pretty clear on how to update variables in the request. I just don't know how to go about adding the logic to convert hex/octal strings to ASCII values in unlang. This is untested, but my current line of thinking is to modify the queries in sql.conf with something like this: ... IF('%{Some-Trigger-Attribute}'="TRIGGER-VALUE", UNHEX('%{Called-Station-Id}'), '%{Called-Station-Id}'), \ ... A little bit of overhead to every query, but I suspect it will be manageable on our network. Alternatively, I suppose I could do something like this (untested): ... if ("%{Some-Trigger-Attribute}" =~ /^TRIGGER-VALUE$/) { update request { Called-Station-Id := '%{sql:SELECT UNHEX(%{Called-Station-Id})}' } } ... This somehow seems less desirable though. --Aaron On 3/30/2010 10:06 PM, Arran Cudbard-Bell wrote: > update request { > Tmp-String-1 := `printf etc...` > } > > Then use variable expansion %{request:Tmp-String-1}. Variables in the > backticks will also be expanded. > > -Arran > > On 3/30/10 4:59 PM, Aaron Paetznick wrote: >> I'm receiving User-Name and various Cisco-AVPair attributes as hex. >> >> The situation is complicated. We have a Calix NAS doing something >> called DHCP-triggered RADIUS accounting through a Cisco ASR. This >> means neither vendor wants to accept responsibility, and here we are. >> >> I just thought it would be nice if FreeRADIUS supported a perl-like >> regex system for manipulating strings. I think I'll have to try to fix >> this by jiggering the SQL. >> >> I just wanted to see if anybody else has dealt with something like this. >> >> >> --Aaron >> >> >> Alan DeKok wrote: >>> Aaron Paetznick wrote: >>>> I am receiving certain accounting attributes as hex encoded strings, >>> >>> Why? Which attributes are they? >>> >>>> and >>>> I would like to convert them back to cleartext ASCII before sending >>>> them >>>> to MySQL. >>>> >>>> I can't simply update the SQL with UNHEX() functions, as not all of the >>>> requests are hex encoded this way. >>> >>> It sounds like the NAS is broken. Not that I'm surprised... >>> >>>> If I could use perl, I would do something like this: >>> >>> Why not use Perl? The server doesn't have generic string handling >>> functions, and I don't see the need to invent yet another language. >>> >>> Alan DeKok. >>> - >>> List info/subscribe/unsubscribe? See >>> http://www.freeradius.org/list/users.html >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >

1 0

Question: How do I forcibly accept all rest requests??
by Difan Zhao 31 Mar '10

31 Mar '10

Good afternoon guys! I am running version 2.1.6. The server is currently doing 802.1x authentication for network devices. Some devices are PCs and users use their Windows domain user/password to login. The rest are special network equipments and I use "MAC address authentication bypass" to authenticate them. Now I have a dilemma that I need to make all other devices (guest devices from out of my company) to be authenticated as well... Currently if these devices (usually laptop running Windows XP) support 802.1x, they will fail and they will be put in an Auth-failed VLAN. The VLAN itself is fine and they can do whatever they want on this VLAN. However it's just that annoying icon on their laptops. It pops up from time to time to notify users that they failed authentication and even prompted for username and password if configured to do so... So I want to make all rest devices to be authenticated. It will be even better if I can assign them to a specific VLAN. I was reading ./sites-avaliable/default and I found that "forcibly accept the user (Auth-Type := Accept)". Where do I put it? I tried: post-auth { Post-Auth-Type REJECT { # attr_filter.access_reject Auth-Type := Accept } } And obviously it's not working... Any ideas how I should configure it? Thank you! Difan Zhao Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com Office: 403-509-1010 ext 3048 Cell: 403-689-7514

2 4

acct-session-id
by Marlon Duksa 31 Mar '10

31 Mar '10

Hi - The acct-session-id attribute has the length defined as =>3 in RFC 2059. Is anyone aware of any practical limitations on the length of this attribute? Does FreeRadius support the length of this attribute to be let say 300bytes, and are you aware of any other Radius servers that may have problem with larger lengths? Thanks, Marlon

2 3

Converting attributes from hex to ASCII
by Aaron Paetznick 30 Mar '10

30 Mar '10

I am receiving certain accounting attributes as hex encoded strings, and I would like to convert them back to cleartext ASCII before sending them to MySQL. I can't simply update the SQL with UNHEX() functions, as not all of the requests are hex encoded this way. If I could use perl, I would do something like this: preacct { if ("%{SomeAtribute}" =~ /^MATCHING\:(.+)\:MATCHING$/) { update request { Calling-Station-Id := s/([a-fA-F0-9]{2})/chr(hex(%{1}))/eg } } ... } Maybe I can simply flag these attributes somehow by prefixing them with "FLAG::", and use the MySQL IF() function to "post process" them with the UNHEX() function? Any help would be appreciated. Thanks! --Aaron

2 2

What does the NAS-Port mean?
by CaiMuzhang 30 Mar '10

30 Mar '10

Hello! See the packet info below: rad_recv: Access-Request packet from host 168.2.8.28 port 5001, id=142, length=121 User-Name = "licheng" EAP-Message = 0x0201000c016c696368656e67 Message-Authenticator = 0xb11d9a0d22d86cfb58038fe5832a9f9a NAS-IP-Address = 168.2.8.28 NAS-Identifier = "000fe281c738" NAS-Port = 268517377 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "0006-5b28-47aa" Notice the NAS-Port = 268517377. It should represent the ID of the port, from which the packet is sent. But when I look up the MIB info of the switch, I can't find such an ID of the port. Instead, the base port number is another integer. How can I get this number (say 268517377) by SNMP? Thank you! _________________________________________________________________ SkyDrive电子画册，带你领略精彩照片，分享“美”时“美”刻! http://www.windowslive.cn/campaigns/e-magazine/ngmchina/?a=c

2 1