August 2010 - Freeradius-Users - lists.freeradius.org

RE: Suffix authentication
by Sallee, Stephen (Jake) 11 Aug '10

11 Aug '10

I have found a working solution for my environment and wanted to share it with the list in case it may help someone else. In my proxy.conf file I added the following ------------------ realm domainName1 { } Realm domainName2{ } ------------------ That fixed my realm problem, not sure why... We use Microsoft AD and ntlm_auth for authenticating our users through MSCHAPv2 tunneled through a peap session. I have 2 domains one is a child of the other the FreeRADIUS server is joined to the parent domain so it can authenticate users from both domains but passing the correct domain for the user request was a bugger! In the end what I got to work was modifying the ntlm_auth statement at the bottom of the mschap module to be the following: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{outer.request:Realm} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" *** --domain=%{outer.request:Realm} was the key, now the realm of the request is passed to the ntlm_auth script perfectly and the user is authenticated like we all love them to be : ) This does seem to break the domain\username style of logging in though ... but due to time constraints this will have to do for now. Thanks to everyone who everyone who helped out, especially Alan. Thank you. Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221 -----Original Message----- From: freeradius-users-bounces+jake.sallee=umhb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.o rg] On Behalf Of Alan DeKok Sent: Tuesday, August 10, 2010 3:42 PM To: FreeRadius users mailing list Subject: Re: Suffix authentication Sallee, Stephen (Jake) wrote: > Quickly, my problem is users cannot log in using username@domain but > can login fine with domain\username. So... what is different in the debug log between the two requests? > One person mentioned the realms module, but when I look at it the > default conf looks fine. The delimiter is correctly set to '@'. I > tried adding my domains to the realm module by copying the default > suffix config and using my domain info but that causes FR to fail its > sanity check. Because you made some random change without understanding how the server works, or reading the documentation. > I am using MSCHAPv2 with PEAP authentication and when the user fails > the logon with username@domain the ntlm_auth program reports a bad > password even though the same user will have no problem with domain\username. > > Also, the FR wiki says the realms file is depreciated ... so what am I > supposed to do? Read proxy.conf. It defines the realm names. The "realms" module just searches the User-Name in various ways (suffix, prefix, ntdomain), and then sees if there is a matching realm. > What would be really great would be a script I could use to determine > the domain of the user BEFORE they reach ntlm_auth so I can > prepopulate the command with the correct domain and just forget this suffix stuff : > ) I think the best place for this would be in the mschap module but > what is the language? Would it be unlang or regular bash scripting? The default config documents how to define realms. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Using postauth_users and Access-Reject
by Peter Lambrechtsen 11 Aug '10

11 Aug '10

Using FreeRadius 2.1.7 and trying to get the postauth_users to return an access reject however it always seems to return either a noop or ok. This is what I get in my radiusd -X trace: [files] postauth_users: Matched entry DEFAULT at line 30 ++[files] returns ok Sending Access-Accept of id 53 to 192.168.143.72 port 2503 Reply-Message = "Your account has been disabled." And this is what is in my postauth_users file: DEFAULT Auth-Type := REJECT Post-Auth-Type = Reject, Reply-Message = "Your account has been disabled." Checking the rlm_files.c it seems that either ok or noop are the two options returned: /* * See if we succeeded. */ if (!found) return RLM_MODULE_NOOP; /* on to the next module */ return RLM_MODULE_OK; Ideally I would assume if the Auth-Type := Reject then the return should be "RLM_MODULE_REJECT". Since otherwise I think I will need to lookup if the Reply-Message is set to disabled, and then do a reject. I'm no C developer hence why I am not offering up a patch, but I might try and see how difficult it would be. Cheers Peter

2 7

[OT?] Systemwide authentication on Windows
by Lukas Haase 10 Aug '10

10 Aug '10

Hi, I think I have a simple question: Today I upgraded from WPA-PSK to WPA Enterprise and use PEAP-MSCHAPv2 for users (using logins) now and I want to use EAP-TLS for machines. How can I configure a WinXP machine such that login is *not* associated to a user but to the machine? As such, WLAN connection should be established before logon! (e.g. for roaming profiles) It just works with WPA-PSK.. I tried to add the client certificate for EAP-TLS to the computer certificate store. But the certificate is only found if it is in the user's store :-( This can't be true?! there must be a way to connect the whole machine using a certificate (not just the current user) , mustn't it? Regards, Luke

2 2

LDAP group check on inner-tunnel.
by Jason Fenner 10 Aug '10

10 Aug '10

I am running FreeRadius version 2.1.7-7 I am doing clear-text password authentication against Active Directory using ntlm_auth. Then ldap is used for group checking. Finally, I have moved my policies to postauth_users in the postauth group. This clear-text functionality works fine. However, when I test PEAP using eapol_test authentication also works fine, but the ldap group checking occurs only on the outer-tunnel username. In this case, the outer tunnel is created using the username "anonymous". This user doesn't exist in AD, so a failure is the response. In inner-tunnel post-auth I have this snippet: update outer.reply { User-Name = "%{request:User-Name}" } My understanding was that this should copy the real username from the inner tunnel to the outer tunnel. This should then allow ldap groupcheck to test the correct username. I never see a ldap check on the inner tunnel at all. I see this strange output in debug in relation to the snipet above: [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} expand: %{request:User-Name} -> radius_user ++[outer.reply] returns noop } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radius_user" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radius_user" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later I would think that outer.reply should return ok or something other then noop. Looking forward to any help with getting ldap group check working on the inner tunnel username. Jason Fenner, CCNP Network Engineer & Storage Administrator Vita-Mix Corporation 8615 Usher Road, Cleveland, Ohio 44138 +1 (440) 782-2603 | JFenner(a)Vitamix.com IT Support: +1 (440) 782-2222 eMail: Helpdesk(a)Vitamix.com CONFIDENTIALITY NOTE: This message is intended for use only by the individual or entity to which it is addressed and may contain information that is privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify me by telephone and permanently delete the original and any copy of this e-mail and destroy any printout thereof.

2 1

PPTP auth vs samba-ldap, 691
by Cory Johnson 10 Aug '10

10 Aug '10

Greetings, Trying to get FreeRADIUS 2.1.8 to authenticate VPN users for PfSense's PPTP server. I am having an issue similar to the one in this old list post: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg40632.…. When I try to log into the VPN from a Windows client, I get the error message: "Error 691: Access was denied because the user name and/or password was invalid on the domain.", but radius logs show "Access-Accept". My major difference is that I am using a LDAP backend which contains NT passwords (it is also the LDAP backend for my samba server). Tried fiddling with mppe and encryption settings in the mschap module, but always get the same results. "freeradius -X" debug below, as always any reply would be great. rad_recv: Access-Request packet from host 192.168.1.55 port 43210, id=116, length=166 NAS-Identifier = "pfsense.local" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "192.168.1.153" User-Name = "cjohnson" MS-CHAP-Challenge = 0xbc4e68fb2822b769cef9f48f6420925f MS-CHAP2-Response = 0x0100991b81f3bbq3859d8qa75ae826662d8600000000000000009584dde386742b71bc7c72fca79a678ebf1fee00b74a36e2 server vpn { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "cjohnson", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [vpn] expand: dc=corp,dc=example,dc=com -> dc=corp,dc=example,dc=com [vpn] expand: %{Stripped-User-Name} -> [vpn] ... expanding second conditional [vpn] expand: %{User-Name} -> cjohnson [vpn] expand: (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 192.168.1.99:389, authentication 0 [ldap] bind as cn=admin,dc=corp,dc=example,dc=com/s3cr3t to 192.168.1.99:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] ldap_release_conn: Release Id: 0 [vpn] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [vpn] ... expanding second conditional [vpn] expand: %{User-Name} -> cjohnson [vpn] expand: (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=cjohnson)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(cn=VPN)(&(objectClass=posixGroup)(memberUid=cjohnson))) rlm_ldap::ldap_groupcmp: User found in group VPN [ldap] ldap_release_conn: Release Id: 0 [vpn] users: Matched entry DEFAULT at line 5 ++[vpn] returns ok [ldap] performing user authorization for cjohnson [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> cjohnson [ldap] expand: (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] expand: dc=corp,dc=example,dc=com -> dc=corp,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x4039323544423042363155514544454138343541433236383039324641284532 [ldap] sambaLmPassword -> LM-Password == 0x3145314444423038343342393233433141414433423444454235313430333545 [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user cjohnson authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Great Success! -> Great Success! Login OK: [cjohnson] (from client 192.168.1.55 port 0 cli 192.168.1.153) Great Success! +- entering group post-auth {...} ++[exec] returns noop } # server vpn Sending Access-Accept of id 116 to 192.168.1.55 port 43210 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 116 with timestamp +23 Ready to process requests. --CJ

2 1

EAP-TLS and "default user"?!
by Lukas Haase 10 Aug '10

10 Aug '10

Hi, I want to secure my WPA network with PEAP-MSCHAPv2 and EAP-TLS. The first one already works (including LDAP server) but the second one fails. This is the output of freeradius -X: n Ready to process requests. rad_recv: Access-Request packet from host 192.168.200.151 port 2049, id=0, length=111 NAS-IP-Address = 192.168.200.151 Called-Station-Id = "0016b6a3ee04" Calling-Station-Id = "001de0121c0d" NAS-Identifier = "0016b6a3ee04" NAS-Port = 3 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000501 Message-Authenticator = 0x31e54d9d928ba685321f40fd2d46667a +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Proxy reply, or no User-Name. Ignoring. ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 5 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: UserIdentity Unknown rlm_eap: Identity Unknown, authentication failed rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [<no User-Name attribute>/<via Auth-Type = EAP>] (from client ap port 3 cli 001de0121c0d) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 192.168.200.151 port 2049 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +106 Ready to process requests. As client I use Windows XP SP2. I searched a lot in the net and all I found was that the supplicant should be broken because it should send a username along. Well, I can not image this because then this would be mentioned in ANY of these tutorials. Maybe I also need to add a special "default" entry to the users file? I played around but still I did not get it working. Can anybody give me a hint where to start? Regards, Luke

2 2

Suffix authentication
by Sallee, Stephen (Jake) 10 Aug '10

10 Aug '10

I hope someone can help me. I have written in about this problem before so please forgive me, but it is still plaguing me : ) Quickly, my problem is users cannot log in using username@domain but can login fine with domain\username. One person mentioned the realms module, but when I look at it the default conf looks fine. The delimiter is correctly set to '@'. I tried adding my domains to the realm module by copying the default suffix config and using my domain info but that causes FR to fail its sanity check. I am using MSCHAPv2 with PEAP authentication and when the user fails the logon with username@domain the ntlm_auth program reports a bad password even though the same user will have no problem with domain\username. Also, the FR wiki says the realms file is depreciated ... so what am I supposed to do? What would be really great would be a script I could use to determine the domain of the user BEFORE they reach ntlm_auth so I can prepopulate the command with the correct domain and just forget this suffix stuff : ) I think the best place for this would be in the mschap module but what is the language? Would it be unlang or regular bash scripting? Thanks for any assistance! Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1

Rlm_Perl question
by tyllerd 10 Aug '10

10 Aug '10

Hello. I realise how stupid this question sounds, but I just don't know the answer. In the example file it says this # Function to handle authenticate sub authenticate { # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^baduser/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } What is "/^baduser/i" ? I am wanting to use the perl module with freeradius, but I am still learning Perl and I currently have that (the example.pl) file running and have replaced baduser with test. so it looks like # Function to handle authenticate sub authenticate { # For debugging purposes only # &log_request_attributes; if ($RAD_REQUEST{'User-Name'} =~ /^test/i) { # Reject user and tell him why $RAD_REPLY{'Reply-Message'} = "Denied access by rlm_perl function"; return RLM_MODULE_REJECT; } else { # Accept user and set some attribute $RAD_REPLY{'h323-credit-amount'} = "100"; return RLM_MODULE_OK; } } However I can still login with test. I just would like to know should it be "test", 'test'.. I have tried those and they also do not work, so maybe it is something else. Thank you if anyone can help. -- View this message in context: http://old.nabble.com/Rlm_Perl-question-tp29375020p29375020.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

Accounting info
by JOE 10 Aug '10

10 Aug '10

Hi all, Does freeradius support receiving Interim-Update with the accounting info? meaning updating the radacct table with user usage / session time at regular intervals? Regards

2 2

RE: RE: MAC based authentication
by ralfheise＠freenet.de 10 Aug '10

10 Aug '10

Phil Mayers wrote: > You've enabled 802.1x, not MAC-based VLANs. You'll need to configure 802.1x at the servers or configure MAC-based auth at the switch. I thought I'd. Indeed authentication is working now, however the switch doesn't assign clients to the VLAN the RADIUS server instructs to. May be off-topic, but would you mind give me hint? The EX monitor output gives me: Aug 10 17:57:42.740610 Processing authentication response complete Aug 10 17:57:42.740657 authentication client Aug 10 17:57:42.740723 Sending message to authentication client Aug 10 17:57:42.742750 Received message from authentication client Aug 10 17:57:42.742815 reply: 1aba028 rply_hdr: 1abc000 bytes_remnant :0 len:2757 reply_len:2757 Aug 10 17:57:42.742845 hdr_bytes_read 0 Aug 10 17:57:42.742865 len read : 28 reply_len: 2735 Aug 10 17:57:42.742917 bytes_remnant 2707 tot_bytes_read 28 Aug 10 17:57:42.742954 bytes_read 2707 Aug 10 17:57:42.742974 Creating background job to process reply from authentication client Aug 10 17:57:42.743103 Entering background job to process message from authentication client Aug 10 17:57:42.743132 process_auth_reply len:2735 Aug 10 17:57:42.743157 Received VLAN ID/name 110 from authentication server Aug 10 17:57:42.743199 Invoking state machine for authentication response for mac address AA:00:00:7F:9C:90 Aug 10 17:57:42.743223 on intf ge-1/0/4.0 . ... and root@EX4200-VC> show dot1x interface 802.1X Information: Interface Role State MAC address User ge-1/0/4.0 Authenticator Authenticated AA:00:00:7F:9C:90 aa00007f9c90 However: root@EX4200-VC> show vlans PRIV0 Name Tag Interfaces PRIV0 110 None root@EX4200-VC> show vlans default Name Tag Interfaces default ge-1/0/4.0*, ge-1/0/5.0* That's odd, since I think I did everything appropriate. A snippt from configuration: interfaces { . .. ge-1/0/4 { unit 0 { family ethernet-switching; } } ge-1/0/5 { unit 0 { family ethernet-switching; } } . .. protocols { . .. dot1x { traceoptions { file dot1x; flag state; flag dot1x-debug; } authenticator { authentication-profile-name auth; interface { ge-1/0/4.0 { supplicant multiple; mac-radius { restrict; } } ge-1/0/5.0 { supplicant multiple; mac-radius { restrict; } } } } . .. access { radius-server { 10.10.10.10 { . .. } } profile auth { authentication-order radius; radius { authentication-server 10.10.10.10; } } } vlans { . .. PRIV0 { vlan-id 110; } } freenetMail mobil – Alle E-Mails auf Ihrem Handy versenden und empfangen. Jetzt kinderleicht und kostenlos einrichten. http://tls.freenet.de/tipp/handymail/index.html

2 2