April 2010 - Freeradius-Users - lists.freeradius.org

variable expansions in Reply-Message
by Isidor Zeuner 20 Apr '10

20 Apr '10

Hi, when using FreeRADIUS 1.1, I could store RADIUS replies like Reply-Message := "Hello, %u", and get the %u expanded to the username in the reply. After upgrading to FreeRADIUS 2.1, this doesn't seem to work anymore, the reply contains the unexpanded %u. Has this feature been removed, or do I have to configure it explicitly? Best regards, Isidor Zeuner

6 13

Freeradius and AD
by Aniss Nazerian 20 Apr '10

20 Apr '10

Hi, I have a problem with authenticating users against an AD. I'm connecting to a WPA2-Ent with PEAP and MS-CHAPv2 But it wont just work. Any ideas? freeradius is running in "SUSE enterprise 11-64bit" Here is the output from "radiusd -f -X" (the relative parts) FreeRADIUS Version 2.1.1, for host x86_64-suse-linux-gnu, built on Feb 23 2009 at 21:43:09 ... including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 2048 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = no } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "*****" nastype = "other" } client ***** { require_message_authenticator = no secret = "*****" shortname = "*****" nastype = "other" } client ***** { require_message_authenticator = no secret = "*****" shortname = "WLC-1" nastype = "cisco" } client ***** { require_message_authenticator = no secret = "*****" shortname = "WLC-2" nastype = "cisco" } client ***** { require_message_authenticator = no secret = "*****" shortname = "WLC-3" nastype = "cisco" } client ***** { require_message_authenticator = no secret = "*****" shortname = "*****" } client ***** { require_message_authenticator = no secret = "*****" shortname = "*****" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = yes dead_time = 120 wake_all_if_all_dead = no } realm LOCAL { } realm NULL { nostrip authhost = LOCAL accthost = LOCAL } realm XXX.YY { authhost = LOCAL accthost = LOCAL } realm student.XXX.YY { authhost = LOCAL accthost = LOCAL } home_server r1 { ipaddr = ***** port = 1812 type = "auth+acct" secret = "*****" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server r2 { ipaddr = ***** port = 1812 type = "auth+acct" secret = "*****" response_window = 30 max_outstanding = 65536 zombie_period = 40 status_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 300 status_check_timeout = 4 } home_server_pool e { type = fail-over home_server = r1 home_server = r2 } realm DEFAULT { pool = e nostrip } radiusd: #### Instantiating modules #### instantiate { } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{%{mschap:NT-Domain}:-XXX.YY} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/XX.pem" certificate_file = "/etc/raddb/certs/XX.pem" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = yes with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sql_log Module: Instantiating sql_log sql_log { path = "/var/log/radius/radacct/sql-relay" Post-Auth = "INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Packet-Type}', '%S');" sql_user_name = "%{%{User-Name}:-DEFAULT}" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ... [suffix] Looking up realm "XXX.YY" for User-Name = "XXX(a)XXX.YY" [suffix] Found realm "XXX.YY" [suffix] Adding Stripped-User-Name = "XXX" [suffix] Adding Realm = "XXX.YY" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 7 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunnled request EAP-Message = 0x020700481a0207004331e30f33d1e124710448204a6e25d9755400000000000000008df3fed6694b35de41b212cb1934fa5f3424d673bf77a35e00616e6161646d406c6e752e7365 server (null) { PEAP: Setting User-Name to XXX(a)XXX.YY Sending tunneled request EAP-Message = 0x020700481a0207004331e30f33d1e124710448204a6e25d9755400000000000000008df3fed6694b35de41b212cb1934fa5f3424d673bf77a35e00616e6161646d406c6e752e7365 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "XXX(a)XXX.YY" State = 0x6d8c88d76d8b92c17ae789947f3c59f7 Calling-Station-Id = "00-21-00-d1-4b-12" Called-Station-Id = "00-27-0d-0b-73-30:e" NAS-Port = 29 NAS-IP-Address = ****** NAS-Identifier = "WLC-03" Airespace-Wlan-Id = 6 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "402" server inner-tunnel { +- entering group authorize {...} ++[mschap] returns noop [suffix] Looking up realm "XXX.YY" for User-Name = "XXX(a)XXX.YY" [suffix] Found realm "XXX.YY" [suffix] Adding Stripped-User-Name = "XXX" [suffix] Adding Realm = "XXX.YY" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++[control] returns ok [eap] EAP packet type response id 7 length 72 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for XXX(a)XXX.YY with NT-Password [mschap] expand: %{Stripped-User-Name} -> XXX [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=XXX [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] expand: --domain=%{%{mschap:NT-Domain}:-XXX.YY} -> --domain=XXX.YY [mschap] mschap2: 4f [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=dfa47fd86ca54f4c [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=8df3fed6694b35de41b212cb1934fa5f3424d673bf77a35e Exec-Program output: NT_KEY: 2EBA93A16D9710267492F18DCECF976B Exec-Program-Wait: plaintext: NT_KEY: 2EBA93A16D9710267492F18DCECF976B Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010800331a0307002e533d33463938464544443536383339444238354239373630333137383231354144323643383837304239 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d8c88d76c8492c17ae789947f3c59f7 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010800331a0307002e533d33463938464544443536383339444238354239373630333137383231354144323643383837304239 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6d8c88d76c8492c17ae789947f3c59f7 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 146 to ****** port 32768 EAP-Message = 0x0108005b1900170301005059a0d3a675e31e8fc6d47fda4b7492977ebdc0452c0e942ba1b5551f62eacf262f6d53617f01affe37c82f4fc57a26b67e4b7a866ede35f70531f854cbb3ca25414eafac826012bf9f069e4d4304f358 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x61d6d78867dece39fc17cc5aff936f9d Finished request 6. Going to the next request Waking up in 4.8 seconds. Cleaning up request 0 ID 140 with timestamp +281 Cleaning up request 1 ID 141 with timestamp +281 Cleaning up request 2 ID 142 with timestamp +281 Cleaning up request 3 ID 143 with timestamp +282 Cleaning up request 4 ID 144 with timestamp +282 Cleaning up request 5 ID 145 with timestamp +282 Cleaning up request 6 ID 146 with timestamp +282 Ready to process requests. -- Aniss Nazerian, IT-Department, Linnaeus University Phone: +46-470-708183, E-mail:aniss.nazerian@vxu.se O< ascii ribbon campaign - stop html mail - www.asciiribbon.org

1 0

Authenticate computers with their hostnames
by Difan Zhao 19 Apr '10

19 Apr '10

Good afternoon, Sorry to bother you guys again! I am trying to authenticate Windows XP PCs (sp2) with their hostnames. It looks like PC will try to use its hostname (in format host/<computer_name.domainname>) to authenticate when no user is logged in. I configured the "users" file and also the post-auth section of "default" file to force accepting the request. In the debug it shows it does accept and send back the response. I also captured the packets in the wireshark. However the NAS (Cisco 3750 switch with newest firmware) doesn't take it and simply ignored it and send the request again. It repeated three times and eventually failed... Users file: host/neteng-sp1.gtcorp.com Auth-Type := Accept Tunnel-Type:0 = VLAN, Tunnel-Medium-Type:0 = IEEE-802, Tunnel-Private-Group-Id:0 = "3", Tunnel-Preference = 0x000000 Sites-available/default file: post-auth { ... if(request:User-Name == "host/neteng-sp1.gtcorp.com"){ update reply { Auth-Type := Accept Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = 3 Tunnel-Preference = 0 } } ... } Actually it doesn't look like it's Freeradiusd's problem since it did send back the response. It's the NAS which doesn't process the reply... However does anybody know why? Did I miss any attributes? Anyway to work around this problem? Alan, I think you told me once that it's not easy to fool the NAS to accept all requests... Is this one of the case we are talking about?? Thank you and have a good weekend! Difan Zhao Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com <http://www.guest-tek.com/> Office: 403-509-1010 ext 3048 Cell: 403-689-7514 Guest-tek(tm) delivers broadband networking solutions to businesses serving mobile users. Our products provide fast and easy plug-and-play Internet access, IP Video-on-Demand, and Voice over IP to end users. Through our superior implementation and support services, our partners gain a sustainable competitive edge. With headquarters in Calgary and Irvine, Guest-tek(tm) has been serving hospitality and related industries since 1996. The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

2 2

FAQ
by Jonathan Hutchins 19 Apr '10

19 Apr '10

Thanks to whoever fixed the FAQ!

1 0

Win PPP auth in Debian
by Jonathan Hutchins 19 Apr '10

19 Apr '10

This feels like trying to set up NORAD just to catch a baseball.

1 0

3GPP2-Prepaid-Acct-Quota
by Alexander 19 Apr '10

19 Apr '10

Dear all, after solving my 'check user traffic quota at login time' problem I try to take the next step and disconnect active sessions if user's traffic limited is exceeded. My Cisco LNS supports 3GPP2 VSA attributes. Therefore I took a look at 3GPP2-Prepaid-Acct-Quota AKA cdma-prepaid-accounting-quota. AFAIK FR does not support 3GPP but does its features suffice to achieve what I described above? If not, are there other ways to disconnect an active user from an Cisco LNS based on RADIUS attributes and user traffic quota? I would like to avoid another script and radkill if possible. Are there best practices to do this? Cheers, Alexander

2 2

FR 2.1.8 + dialup admin: Online users
by Alexander 19 Apr '10

19 Apr '10

Dear all, I am having troubles with user_finger.php3 because "Online users" do not show up. Problem is that there are no entries in radacct with 'AcctStopTime'. Entries show up in my radacct table when the user session ends and a AcctStopTime gets logged. But then the user is not online anymore ;-) Any ideas? Cheers, Alexander

1 0

FreeRadius 2.1.8 doesn't compile under Cygwin 1.7.5 `_lt_libltdl_LTX_preloaded_symbols'
by José Manuel Jiménez Ramírez 19 Apr '10

19 Apr '10

Trying to build FreeRadius from Cygwin I always have the same compilation error: gcc .libs/radiusd.def .libs/radiusdS.o -o radiusd.exe .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o -Wl,--export-dynamic /freeradius-server-2.1.8/src/lib/.libs/libfreeradius-radius.a -lws2_32 -lresolv -lpthread -lcrypt /usr/lib/libltdl.dll.a -lssl -lcrypto /usr/lib/gcc/i686-pc-cygwin/4.3.4/../../../../i686-pc-cygwin/bin/ld: warning: --export-dynamic is not supported for PE targets, did you mean --export-all-symbols? .libs/modules.o: In function `setup_modules': /freeradius-server-2.1.8/src/main/modules.c:1358: undefined reference to `_lt_libltdl_LTX_preloaded_symbols' collect2: ld returned 1 exit status rm -f .libs/radiusdS.o make[4]: *** [radiusd] Error 1 make[4]: Leaving directory `/freeradius-server-2.1.8/src/main' make[3]: *** [common] Error 2 make[3]: Leaving directory `/freeradius-server-2.1.8/src' make[2]: *** [all] Error 2 make[2]: Leaving directory `/freeradius-server-2.1.8/src' make[1]: *** [common] Error 2 make[1]: Leaving directory `/freeradius-server-2.1.8' make: *** [all] Error 2 I think that there are some problems with libtool and libltl, then searching in the mail list I made the changes said by Alan Dekok, in the src file 'freeradius-server-2.1.8\src\main\modules.c', Adding: #define lt__PROGRAM__LTX_preloaded_symbols \ lt_libltdl_LTX_preloaded_symbols And in the Make.inc: Update CFLAGS to add -DIE_LIBTOOL_DIE But always obtain the same compilation error. I need to use a FreeRadius version which supports Sha256 as the certificate signature Any help would be fantastic. I need to use FreeRadius under Cygwin and there isn´t a lot of information in the mailing list. Thanks, Jose Manuel

1 0

Compiling rlm_perl on Solaris 10
by Dean, Barry 19 Apr '10

19 Apr '10

I have been having problems compiling rlm_perl on Solaris 10 Intel and have spent days googling for an answer. Most answers say: "use --without-rlm_perl", which is not much use when you actually *need* it! Here is what I did to solve it, hopefully this will save someone some pain: Firstly, my source that built without rlm_perl fine on 9th April 2010, stopped compiling on 16th April 2010 after some Solaris patches! I got an error telling me that ltdl.h was not found. This is fixed by defining CFLAGS in the environment before the ./configure stage: setenv CFLAGS -I/<path to freeRADIUS source>/libltdl (C shell type shells) CFLAGS="-I/<path to freeRADIUS source>/libltdl" ; export CFLAGS (sh shells and derivatives) Over hurdle one! What caused this I still have no idea. Now you have to do: ./configure --with-static-modules=perl When that is complete, you have to edit <path to freeRADIUS source>/src/main/Makefile> and locate the line: MODULE_LIBS = $(STATIC_MODULES) and edit it to include the path to your DynaLoader.a for your version of Perl, mine was as below: MODULE_LIBS = $(STATIC_MODULES) /usr/perl5/5.8.4/lib/i86pc-solaris-64int/auto/DynaLoader/DynaLoader.a Now build the source with make. It should compile! Over hurdle two... Before you can now run radiusd, you will need to do what it says at the end of the make, and add a library path to LD_LIBRARY_PATH so libperl.so can be found, mine was: setenv LD_LIBRARY_PATH ${LD_LIBRARY_PATH}:/usr/perl5/5.8.4/lib/i86pc-solaris-64int/CORE and it all comes together and you get a radiusd with rlm_perl that actually runs.. Over the last hurdle! All I have to do now is write some clever Perl, figure out where to call it and I will be on the home straight! Best of luck to other Solaris users... ---------------------- Barry Dean Principal Programmer/Analyst Networks Group Computing Services Department

1 0

overwrite ldap dynamic vlan assigment
by Marc Boisis-Delavaud 19 Apr '10

19 Apr '10

Hello, For all of my ssid, I use dynamic vlan assigment according to ldap attribute. -> rlm_ldap: radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 = "4" Now , only with eduroam ssid , I want to staticly assign a new vlan. This is what I want : if Cisco-AVPair = "ssid=eduroam" then Tunnel-Private-Group-Id:0 = "40" What is the best method to do it ? Merci de penser à la planète! N'imprimez pas inutilement les documents transmis par courrier électronique. ----------------------------------- Marc Boisis-Delavaud tel: 05 46 45 82 14 Centre de Ressources Informatiques (http://cri.univ-lr.fr) Université de La Rochelle -----------------------------------

1 0