July 2010 - Freeradius-Users - lists.freeradius.org

PAP dont decrypt
by Lionne Stangier 23 Jul '10

23 Jul '10

I need help with the pap module. I set modules/pap auto_header = yes, but if I start a test connect pap say: [pap] No clear-text password in the request. Not performing PAP. The password is MD5. Lionne Stangier Radius -X Its looks like the pap module can't load. ----------------------------------------------------- set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS MD5-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x825fe58 Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.125.1 port 1220, id=0, length=143 User-Name = "lionne.stangier" NAS-IP-Address = 192.168.125.1 Called-Station-Id = "0016b61397d9" Calling-Station-Id = "00166f09d8c6" NAS-Identifier = "0016b61397d9" NAS-Port = 23 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000014016c696f6e6e652e7374616e67696572 Message-Authenticator = 0x67e298801458a6efcc4a916db9d62383 +- entering group authorize {...} ++[chap] returns noop [ldap] performing user authorization for lionne.stangier [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> lionne.stangier [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=lionne.stangier) [ldap] expand: dc=allesklar,dc=com -> dc=allesklar,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap.allesklar.org:389, authentication 0 [ldap] bind as / to ldap.allesklar.org:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=allesklar,dc=com, with filter (uid=lionne.stangier) [ldap] looking for check items in directory... [ldap] userPassword -> MD5-Password == 0x7b4d44357d556f73777963326e6b556d48634d3773674f713755513d3d [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user lionne.stangier authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> lionne.stangier attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.6 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 192.168.125.1 port 1220 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +22 Ready to process requests.

3 6

No-AUTH method
by Isabelle RECH 23 Jul '10

23 Jul '10

Hi, Dear Feeradius USER After correcting my default file in /etc/freeradius/sites-available, I've got the following errors after testing authentication: It's seems to be a missing authentification method in my configuration. We're using a CISCO4400 controler, and the 'Web RADIUS authentication' parameter is set to 'PAP' on my Controller./ Cleaning up request 1 ID 14 with timestamp +376 Waking up in 1.0 seconds. Cleaning up request 2 ID 15 with timestamp +377 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 40925, id=168, length=57 User-Name = "irech" User-Password = "tmcqtv0" NAS-IP-Address = 192.168.55.150 NAS-Port = 10 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "irech", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [irech/tmcqtv0] (from client localhost port 10) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> irech attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 168 to 127.0.0.1 port 40925 Waking up in 4.9 seconds. Cleaning up request 3 ID 168 with timestamp +548 Ready to process requests. auth: No authenticate method (Auth-Type) configuration found for the re/q Could you help me to go on ? Best Regards -- __________________________________ Isabelle RECH LE RECIS Enssib Département informatique 17-21 Bd du 11 Novembre 1918 69623 Villeurbanne Cedex Tel : 04 72 44 43 34 http://www.enssib.fr/ __________________________________

2 1

Mac-auth checking in sites-enabled/default
by Tom Leach 23 Jul '10

23 Jul '10

I'm currently using Freeradius v2.1.9 and I'm trying to write a condition in the authorize section to use a different module depending on whether Mac-auth or someother auth is being called. In reading the wiki (http://wiki.freeradius.org/Mac-Auth) it appears that I want to check (Chap-Password == hash(User-Name)) but I'm having a problem getting the unlang syntax correct. So far, I've tried: if (Chap-Password == hash(User-Name)){ which fails with: Consecutive conditions at (User-Name)) /etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. and: if (Chap-Password == hash %{request:User-Name}) { which fails with: Consecutive conditions at %{request:User-Name}) /etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. So, it appears that I'm having a fundamental failure to understand the conditional statements in unlang. So, is the wiki old/out-of-date, just pseudo code, or is the hash function something that I need to write? My NAS doesn't send a Service-Type and the Calling-Station-Id is in a different format that I can munge to get into the same format as User-Name, but I thought the hash option would be the quickest. Thanks! Tom Leach

3 2

No "known good" password was found in LDAP
by newtownz 22 Jul '10

22 Jul '10

Hi, I have a setup with a laptop, access-point, wireless-controller, freeradius 2.1.8 (ubuntu 10.04) and SLES 10 eDirectory. When I put the username and password in the users file everything works fine (802.1x, PEAP) When I try to move authentication with the eDirectory with ldap, I get the Warning no known... but then the user is authorized. ([ldap] user aruba authorized to use remote access) [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=aruba) [ldap] expand: o=org -> o=org [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to xxx.yyy.110.136:389, authentication 0 [ldap] bind as cn=admin,o=org/admin to xxx.yyy.110.136:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in o=org, with filter (uid=aruba) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user aruba authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 The password stored in eDirectory is valid. My understanding of eDirectory is that it will never let you see the actual password of a user, it will hash it first. Is this behavior of freeradius normal? Later in the process the user is rejected because no Auth-Type was found, is this related? Jean -- View this message in context: http://old.nabble.com/No-%22known-good%22-password-was-found-in-LDAP-tp2923… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

How to apply logical OR in the auth. modul
by Jevos, Peter 22 Jul '10

22 Jul '10

Hi I have in the modules/ntlm_auth_vpn command: exec ntlm_auth_vpn { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --password=%{User-Password} --require-membership-of=domain1" } Is it possible to add another command ( with different domain ) and to add OR in order to choose which one will pass ? Something like this: exec ntlm_auth_vpn { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --password=%{User-Password} --require-membership-of=domain1" OR program = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --password=%{User-Password} --require-membership-of=domain2" } It means that auth-type ntml_auth_vpn is right if one of these command will pass Thank pet

3 5

How to display Auth-type in th log
by Jevos, Peter 22 Jul '10

22 Jul '10

HI Is it possible to display type of authentication ( Auth-type ) that the clients used during the authentication ? Thank pet

2 3

Freeradius XP Client without certificate
by Lionne Stangier 22 Jul '10

22 Jul '10

I need some help again. Is it possible to use Freeradius without certificate on the XP client? If I connect to the WLAN with my Iphone, I don’t need the certificate. Lionne Stangier

3 9

Documentation question
by Sallee, Stephen (Jake) 22 Jul '10

22 Jul '10

HELLO ALL! I am new to FreeRADIUS and I am looking for a good place to get some documentation. I know about the wiki and the .org site, but what I am looking for is somewhere I can get all of that info in a printable format, I am also interested if anyone knows of some good reference books. Thank you in advance. Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

3 2

How to allow group login on some devices?
by Martin Whinnery 22 Jul '10

22 Jul '10

Hiya... I've got a freeradius setup which is consulting LDAP quite happily, providing password logins for all our users to our wireless network. Which is lovely. :D Now, I'd like to set up our switches to use radius to allow our technicians to login. And they are all members of an LDAP group. Let's call it "cn=techies,ou=groups,dc=example,dc=org". I only want this to be the case for some client devices, namely our switches. Can anyone point me towards the documentation I should have read? Sorry to be a pain. Mart -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Same user-name/password question
by Fabricio Viana 22 Jul '10

22 Jul '10

I am with the following question: I have two requests as follows: First: User-Name = "john" User-Password = "john" NAS-IP-Address = 200.xxx.xxx.10 NAS-Port = 0 Second: User-Name = "john" User-Password = "john" NAS-IP-Address = 202.xxx.xxx.200 NAS-Port = 0 There are two requests for the same username and password but from different NAS. For each, the answer must be different. In this case are the same user-name, how do I differentiate the answers? I'm using freeradius + mysql 2. Thank you! Fabricio _________________________________________________________________ CONVERSE COM SEUS AMIGOS E OS VEJA PELA WEBCAM NO MESSENGER. CLIQUE AQUI E VEJA COMO. http://www.windowslive.com.br/public/tip.aspx/view/84?product=2&ocid=WLCRM:…

2 1