July 2010 - Freeradius-Users - lists.freeradius.org

NULL realm reject
by Velpi 05 Jul '10

05 Jul '10

Hi, is it possible to configure an instant reject for a certain realm (in proxy.conf)? I'd like to set this for the NULL realm to disable usernames without a suffix. (any other suggestion to accomplish this is welcomed too!) Thanks! -- /--------------------------------------------- | Jan "Velpi" Van der Velpen | Velpi(a)industria.be || +32 (0) 498 61 24 89 \---------------------------------------------

2 4

how to return attribute with more than one value in an access-accept packet?
by WWF 05 Jul '10

05 Jul '10

Hello, all! Now I use fr 2.19 for our WiMAX network. It works well now! Thanks for all who have helped us on this maillist. however, I still have an important question. Our vendor asked us to return some attributes which are listed in WiMAX Forum Standard as return 0-n or 1-n. That is, in a single access-accept packet, there may 2 or 3 value for attribute like "Packet-Flow-Descriptor", "Time-Of-Day-Time". I don't know how to achieve this? Thanks in advance for your kindly help!

2 1

mschap/peap question
by Wegener, Norbert 05 Jul '10

05 Jul '10

With 2.1.8 and the configuration from http://deployingradius.com/scripts/eapol_test/peap-mschapv2.conf I want to test a radius configuration. The linux server running radius is member of the AD domain, mschap succeeds but finally the authentication fails. freeradius sends Challenges to which eapol_test will not respond. This should not be the behaviour mentioned in eap.conf regarding windows compatibility as eapol_test says: ... EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10 EAP-MSCHAPV2: Received success EAP-MSCHAPV2: Invalid authenticator response in success request EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL and finally fails. What is going wrong when freeradius says: ++[mschap] returns ok^M MSCHAP Success while eapol_test declares: EAP-MSCHAPV2: Invalid authenticator response in success request ? Thie result is the same whether eapol_test and radius run on the same host or on different machines. Below an extract from radius debug and eapol_test output. The complete logs are at http://tinyurl.com/36wn5lz ... Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for ZZZZZ1EC-TST with NT-Password [mschap] expand: --username=%{mschap:User-Name} -> --username=ZZZZZ1EC-TST [mschap] mschap2: c9 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8dcf3f854091b5b0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=32025f3e02109f45a23b3468721d538944af5d633f31afe2 Exec-Program output: NT_KEY: F2203599C0AD93B00507898A198A3698 Exec-Program-Wait: plaintext: NT_KEY: F2203599C0AD93B00507898A198A3698 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010b00331a030a002e533d35423746314132333037313436343646314439373138453036333834454238383541454432384246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6aef51466be44b4f70ee0c4182d406d0 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010b00331a030a002e533d35423746314132333037313436343646314439373138453036333834454238383541454432384246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6aef51466be44b4f70ee0c4182d406d0 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 10 to 127.0.0.1 port 58631 EAP-Message = 0x010b005b19001703010050de110c863ab2d5e21f07b010fc9adbfcda106b35f8cee8549fde8851ad1ba75da7bd114c1481cf7d9edb8adc3b2e4d8d2b5f7e62ba0fcea0b7e8e7e6e3edf45c2a1847d9195e7a0421a854d5ce12a3cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cecf09536e7e9bedf3400a6b087488e Finished request 10. Going to the next request Waking up in 4.5 seconds. eapol_test : ... Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=10 length=149 Attribute 79 (EAP-Message) length=93 Value: 01 0b 00 5b 19 00 17 03 01 00 50 31 9a b2 e5 49 18 04 ab eb 62 5c cc 03 11 93 ba e9 60 5d 66 bc 6b fb 67 97 92 75 f3 cd d7 d7 1b 5b ae bc aa 12 1f c1 a2 a5 41 2a e7 10 11 c1 b9 6f 3d 39 87 04 6e f8 b8 a5 0a a7 9d f8 79 91 cd 6d 3f 32 e1 2e fc df 43 4b 4c 96 99 fc 14 07 2c Attribute 80 (Message-Authenticator) length=18 Value: b0 cf e3 2a 75 f5 18 48 50 99 4b b4 e3 c8 50 70 Attribute 24 (State) length=18 Value: 65 71 c9 7b 6f 7a d0 fc 26 6f 03 8b 5c fc f1 85 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.09 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=11 len=91) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=11 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=91) - Flags 0x00 EAP-PEAP: received 85 bytes encrypted data for Phase 2 EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=47): 1a 03 0a 00 2e 53 3d 35 33 36 46 30 44 42 30 36 42 43 45 36 42 43 37 32 31 34 33 33 37 39 46 39 38 33 35 46 33 41 31 37 38 41 43 46 44 43 39 EAP-PEAP: received Phase 2: code=1 identifier=11 length=51 EAP-PEAP: Phase 2 Request: type=26 EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10 EAP-MSCHAPV2: Received success EAP-MSCHAPV2: Invalid authenticator response in success request EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: startWhen --> 0 EAPOL test timed out EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 1 FAILURE Thanks Norbert Wegener With best regards, Norbert Wegener Siemens AG Siemens IT Solutions and Services SIS GO NW PSU SDC AS&INS Bruchstraße 5 45883 Gelsenkirchen, Germany Tel.: +49 (209) 94565716 Fax: +49 (201) 8165581284 mailto:norbert.wegener@siemens.com Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Gerhard Cromme; Managing Board: Peter Loescher, Chairman, President and Chief Executive Officer; Wolfgang Dehen, Heinrich Hiesinger, Joe Kaeser, Barbara Kux, Hermann Requardt, Siegfried Russwurm, Peter Y. Solmssen; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

3 7

ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Hi, We are using freeRADIUS talk to multiple ADs integration. I updated my freeRADIUS from 1.1.6 to 2.1.9 recently. "xjtu" is our default domain, for users under this domain will only use username to authenticate to RADIUS. With 1.1.6, it will get "xjtu" as domain; But with 2.1.9, it will not, please see the debug info below. It is the related part in configuration file: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" It is debug info: [mschap] Told to do MS-CHAPv2 for hhe with NT-Password [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain= [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=hhe [mschap] mschap2: a6 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ddca17e9bfdaf05a [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=741e305efc7bce1071682eee0b3c37142b184b9544242304 John

3 2

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Hi, It is the whole debug info. I think the problem is we could not get the default domain name "xjtu". Listening on authentication address * port 1812 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.85 port 32807, id=118, length=125 Service-Type = Authorize-Only NAS-Port-Type = Wireless-802.11 User-Name = "hhe" MS-CHAP-Challenge = 0xd764c8cce93255c4478d7aa05d83f3ea MS-CHAP2-Response = 0x9c00a2b7249b043e23cd2866211bff3783d60000000000000000924fed02a24dee7533a7b9af370e858e1b798d9151617838 NAS-IP-Address = 10.155.20.85 +- entering group authorize {...} ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for hhe [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=hhe) [ldap] expand: OU=Domain Controllers,dc=xjtu,dc=cn -> OU=Domain Controllers,dc=xjtu,dc=cn [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 10.155.3.250:389, authentication 0 [ldap] bind as hhe(a)xjtu.cn/w2006njh to 10.155.3.250:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in OU=Domain Controllers,dc=xjtu,dc=cn, with filter (sAMAccountName=hhe) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user hhe authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for hhe with NT-Password [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain:-xjtu} -> --domain= [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=hhe [mschap] mschap2: d7 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=cf5ba32b520debdd [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=924fed02a24dee7533a7b9af370e858e1b798d9151617838 Exec-Program output: No such user (0xc0000064) Exec-Program-Wait: plaintext: No such user (0xc0000064) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.6 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 118 to 10.155.20.85 port 32807 MS-CHAP-Error = "\234E=691 R=1" Waking up in 4.9 seconds. Cleaning up request 0 ID 118 with timestamp +33 Ready to process requests. --- 10年7月1日，周四, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月1日,周四,下午2:02 John wrote: > "xjtu" is our default domain, for users under this domain will only use > username to authenticate to RADIUS. With 1.1.6, it will get "xjtu" as > domain; But with 2.1.9, it will not, please see the debug info below. You have deleted nearly all of the debug information, including the information we need to help you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 5

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

It is debug info when I use freeRADIUS-1.1.6. rad_recv: Access-Request packet from host 10.155.20.85:32790, id=171, length=125 --> Service-Type = Authorize-Only --> NAS-Port-Type = Wireless-802.11 --> User-Name = "hhe" --> MS-CHAP-Challenge = 0x837a4fb32a47a5bda0c24d5e4329fcdc --> MS-CHAP2-Response = 0xe40069bdb5799e2fa75ccc2d53415669f4d900000000000000008cad47a91a94b2a475bda048fda283bf23e702b5129a3164 --> NAS-IP-Address = 10.155.20.85 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modsingle[authorize]: calling chap (rlm_chap) for request 2 modsingle[authorize]: returned from chap (rlm_chap) for request 2 modcall[authorize]: module "chap" returns noop for request 2 modsingle[authorize]: calling mschap (rlm_mschap) for request 2 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modsingle[authorize]: returned from mschap (rlm_mschap) for request 2 modcall[authorize]: module "mschap" returns ok for request 2 modsingle[authorize]: calling eap (rlm_eap) for request 2 rlm_eap: No EAP-Message, not doing EAP modsingle[authorize]: returned from eap (rlm_eap) for request 2 modcall[authorize]: module "eap" returns noop for request 2 modsingle[authorize]: calling ldap (rlm_ldap) for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for hhe radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '(sAMAccountName=hhe)' radius_xlat: 'dc=xjtu,dc=cn' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: ldap_release_conn: Release Id: 0 modsingle[authorize]: returned from ldap (rlm_ldap) for request 2 modcall[authorize]: module "ldap" returns ok for request 2 modsingle[authorize]: calling ldap (rlm_ldap) for request 2 modsingle[authorize]: calling pap (rlm_pap) for request 2 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modsingle[authorize]: returned from pap (rlm_pap) for request 2 modcall[authorize]: module "pap" returns noop for request 2 modcall: leaving group authorize (returns ok) for request 2 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 2 modsingle[authenticate]: calling mschap (rlm_mschap) for request 2 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for hhe with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' rlm_mschap: No NT-Domain was found in the User-Name. radius_xlat: '--domain=xjtu' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=hhe' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 83 radius_xlat: '--challenge=cfdb7016e508348d' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=8cad47a91a94b2a475bda048fda283bf23e702b5129a3164' rlm_mschap: adding MS-CHAPv2 MPPE keys modsingle[authenticate]: returned from mschap (rlm_mschap) for request 2 modcall[authenticate]: module "mschap" returns ok for request 2 modcall: leaving group MS-CHAP (returns ok) for request 2 Sending Access-Accept of id 171 to 10.155.20.85 port 32790 --> MS-CHAP2-Success = 0xe4533d41313535304434313643373437413542363236393941394135393532374335424630423438384537 --> MS-MPPE-Recv-Key = 0x6ac9* --> MS-MPPE-Send-Key = 0xcfe2* --> MS-MPPE-Encryption-Policy = 0x00000001 --> MS-MPPE-Encryption-Types = 0x00000006 Finished request 2 --- 10年7月5日，周一, John <elmer_radius(a)yahoo.com.cn> 写道：发件人: John <elmer_radius(a)yahoo.com.cn> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月5日,周一,下午3:06 Yes. You are right. If I use hhe(a)xjtu.cn, it will work. If I use old freeRADIUS-1.1.6, username "hhe" can work well. I think it is because I set default domain name "xjtu" in mschap module (ntlm_auth) . But freeRADIUS-2.1.9 could not work without domain. ---- ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" --- 10年7月2日，周五, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月2日,周五,下午3:45 John wrote: > Hi, > It is the whole debug info. I think the problem is we could not get the > default domain name "xjtu". Because the username does not include the domain. Log in with "hhe(a)xjtu.cn", and it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -----下面为附件内容----- - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Yes. You are right. If I use hhe(a)xjtu.cn, it will work. If I use old freeRADIUS-1.1.6, username "hhe" can work well. I think it is because I set default domain name "xjtu" in mschap module (ntlm_auth) . But freeRADIUS-2.1.9 could not work without domain. ---- ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" --- 10年7月2日，周五, Alan DeKok <aland(a)deployingradius.com> 写道：发件人: Alan DeKok <aland(a)deployingradius.com> 主题: Re: ntlm_auth fails for none domain 收件人: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> 日期: 2010年7月2日,周五,下午3:45 John wrote: > Hi, > It is the whole debug info. I think the problem is we could not get the > default domain name "xjtu". Because the username does not include the domain. Log in with "hhe(a)xjtu.cn", and it will work. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

What Next??
by Thomas Reeves 05 Jul '10

05 Jul '10

Greetings, All I have a FreeBSD-based gateway server running pfSense software. This is the only server directly connected to the internet. It distributes (port forwards) all incoming internet requests to about five back-end servers based on static IP address and/or ports. I have a new FreeRADIUS/MySQL server among the five back-end servers. I just completed installation, configuration and testing of this server. I want to authenticate and authorize all incoming http(s) requests before allowing access to any back-end services. However, I seemed to have missed something fundamental about the FreeRADIUS server - what do I do next?? How do I "attach" FreeRADIUS to the inbound TCP stream to accept/reject requests?? Where does the accept/reject response go?? The available documentation did not discuss deployment... Any links or tips would be appreciated. Cheers, Rubix Cube

2 2

the termination of Lost-Carrier
by Spacelee 05 Jul '10

05 Jul '10

e , I want to ask some Termination status some people was terminated because of Session-Timeout some people was terminated because of User-Request some people was terminated because of Lost-Carrier Session-Timeout means he has reached his expiration time User-Request means he request to terminate but what does lost-carrier means? I can't find in freeradius's wiki, but I saw this status in Daloradius and when will the termination be Lost-Carrier? and the user whose termination is Lost-Carrier can't login the next day, the the next next day, he can login again, I don't know why? can somebody figure this out? -- Spacelee

2 4

how to encrypting accounting?
by Fabio Dive 04 Jul '10

04 Jul '10

Hello, yesterday I successful installed freeswitch 1.0.6 with mod_radius_cdr accounting on a remote freeradius 2.1.9 server, freeswitch use freeradius-client 1.1.6 library. I am looking for a way to TLS encrypt accounting messages between Freeswitch and remote Freeradius, actually I can do only clear text accounting with simple shared key auth. Is there a way using configurations files to setup TLS accounting? Do I need to code a bit with freeradius-client library? I keep trying, for the moment many thanks, cheers, Fabio

3 2