September 2010 - Freeradius-Users - lists.freeradius.org

Problem with rlm_perl
by Nasser Heidari 07 Sep '10

07 Sep '10

Dear Folks, I'm using a perl module to record and save clients MAC address to DB. In situations that cisco-av-pair is not included in RADIUS packet, I'm replacing it with 0000.0000.0000. Everything is working just fine in test environment but when running on production servers the recorded MAC address for those clients without cisco-av-pair attribute in their packet is not 0000.0000.0000 but it's a wrong MAC which belongs to another packet received seconds ago. We even captured all the RADIUS traffic sent form NASes and replayed it in our test environment but I wanted to capture users mac address, so I've added a perl module , and after parsing cisco-av-pair attribute , I save it to DB. In normal situation everything works like a charm , but in some cases, If NAS doesn't send mac-address attribute, I expect to save a 0000.0000.0000 mac address in DB , but no success. There is a condition that I check if mac-address attribute exists in request or not, if exist it's ok , if not it should update request with a 0000.0000.0000 mac address.

2 3

EAP-MD5 testing with radeapclient and eapol_test
by Chidanand Gangur 07 Sep '10

07 Sep '10

Hi All, I have a proxy setup ( proxy server 192.168.6.134) where users are proxied to home server (192.168.7.40). Host IP address = 192.168.6.181 FreeRADIUS version 2.1.9 User authentication using radclient works fine when I issue following command echo "User-Name=raduser(a)mytest.com,Password=pass123" | radclient 192.168.6.134 auth testing123 I get following response on my proxy server rad_recv: Access-Accept packet from host 192.168.7.40 port 1812, id=104, length=68 Proxy-State = 0x3737 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x52a505b1000001370001c0a8072801cb4d87ddbf246a0000000000000016 I try the same test to work out with EAP using following command: echo "User-Name=raduser(a)mytest.com ,Password=pass123,EAP-Code=Response,EAP-Id=210,EAP-Type-Identity= raduser(a)mytest.com" | radeapclient -x 192.168.6.134 auth testing123 I see following output on proxy server: rad_recv: Access-Request packet from host 192.168.6.181 port 32771, id=108, length=107 User-Name = "raduser(a)mytest.com" User-Password = "pass123" EAP-Message = 0x02d2001a0172616475736572406e65766973746573742e636f6d Message-Authenticator = 0xe61561c7667d60c2fbc37709b16e8193 Mon Sep 6 06:48:30 2010 : Info: +- entering group authorize {...} Mon Sep 6 06:48:30 2010 : Info: ++[preprocess] returns ok Mon Sep 6 06:48:30 2010 : Info: ++[chap] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[mschap] returns noop Mon Sep 6 06:48:30 2010 : Info: [suffix] Looking up realm "mytest.com" for User-Name = "raduser(a)mytest.com" Mon Sep 6 06:48:30 2010 : Info: [suffix] Found realm "mytest.com" Mon Sep 6 06:48:30 2010 : Info: [suffix] Adding Stripped-User-Name = "raduser" Mon Sep 6 06:48:30 2010 : Info: [suffix] Adding Realm = "mytest.com" Mon Sep 6 06:48:30 2010 : Info: [suffix] Proxying request from user raduser to realm mytest.com Mon Sep 6 06:48:30 2010 : Info: [suffix] Preparing to proxy authentication request to realm "mytest.com" Mon Sep 6 06:48:30 2010 : Info: ++[suffix] returns updated Mon Sep 6 06:48:30 2010 : Info: [eap] Request is supposed to be proxied to Realm mytest.com. Not doing EAP. Mon Sep 6 06:48:30 2010 : Info: ++[eap] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[unix] returns notfound Mon Sep 6 06:48:30 2010 : Info: [files] users: Matched entry DEFAULT at line 195 Mon Sep 6 06:48:30 2010 : Info: [files] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:48:30 2010 : Info: ++[files] returns ok Mon Sep 6 06:48:30 2010 : Info: ++[expiration] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[logintime] returns noop Mon Sep 6 06:48:30 2010 : Info: ++[pap] returns noop Mon Sep 6 06:48:30 2010 : Info: WARNING: Empty pre-proxy section. Using default return values. Mon Sep 6 06:48:30 2010 : Info: Proxying request 0 to home server 192.168.7.40 port 1812 Sending Access-Request of id 40 to 192.168.7.40 port 1812 User-Name = "raduser" User-Password = "pass123" EAP-Message = 0x02d2001a0172616475736572406e65766973746573742e636f6d Message-Authenticator = 0x00000000000000000000000000000000 NAS-IP-Address = 192.168.6.181 Proxy-State = 0x313038 Mon Sep 6 06:48:30 2010 : Debug: Going to the next request Mon Sep 6 06:48:30 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 192.168.7.40 port 1812, id=40, length=69 Proxy-State = 0x313038 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x52a605b2000001370001c0a8072801cb4d87ddbf246a0000000000000017 Mon Sep 6 06:48:30 2010 : Info: +- entering group post-proxy {...} Mon Sep 6 06:48:30 2010 : Info: [force_username] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:48:30 2010 : Debug: force_username: Added attribute User-Name with value 'raduser(a)mytest.com' Mon Sep 6 06:48:30 2010 : Info: ++[force_username] returns ok Mon Sep 6 06:48:30 2010 : Info: [eap] No pre-existing handler found Mon Sep 6 06:48:30 2010 : Info: ++[eap] returns noop Mon Sep 6 06:48:30 2010 : Info: Found Auth-Type = Accept Mon Sep 6 06:48:30 2010 : Info: Auth-Type = Accept, accepting the user Mon Sep 6 06:48:30 2010 : Info: +- entering group post-auth {...} Mon Sep 6 06:48:30 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 108 to 192.168.6.181 port 32771 Framed-Protocol = PPP Service-Type = Framed-User Class = 0x52a605b2000001370001c0a8072801cb4d87ddbf246a0000000000000017 User-Name = "raduser(a)mytest.com" When I use eapol_test client to using following command: eapol_test -c /tmp/eapol.conf -a 192.168.6.134 -p 1812 -s testing123 -r 1 eapol.conf is as follows network={ key_mgmt=NONE eap=MD5 identity="raduser(a)mytest.com" password="pass123" } I see following output on my proxy server: Mon Sep 6 06:53:49 2010 : Info: Proxying request 0 to home server 192.168.7.40 port 1812 Sending Access-Request of id 166 to 192.168.7.40 port 1812 User-Name = "raduser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001a0172616475736572406e65766973746573742e636f6d Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Challenge packet from host 192.168.7.40 port 1812, id=166, length=109 Proxy-State = 0x30 Session-Timeout = 6 EAP-Message = 0x0101002304101f3bc497bfe2cfaf507a66218e4dcb01524f4f54544553544c41424144 State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x467eeb430357cbddf194719353853d80 Mon Sep 6 06:53:49 2010 : Info: +- entering group post-proxy {...} Mon Sep 6 06:53:49 2010 : Info: [force_username] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Debug: force_username: Added attribute User-Name with value 'raduser(a)mytest.com' Mon Sep 6 06:53:49 2010 : Info: ++[force_username] returns ok Mon Sep 6 06:53:49 2010 : Info: [eap] No pre-existing handler found Mon Sep 6 06:53:49 2010 : Info: ++[eap] returns noop Sending Access-Challenge of id 0 to 192.168.6.181 port 32771 Session-Timeout = 6 EAP-Message = 0x0101002304101f3bc497bfe2cfaf507a66218e4dcb01524f4f54544553544c41424144 State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "raduser(a)mytest.com" Mon Sep 6 06:53:49 2010 : Info: Finished request 0. Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.6.181 port 32771, id=1, length=171 User-Name = "raduser(a)mytest.com" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604100ff84736f21760abada91fdb828e888c State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0xe1da93d7d4f4d4b68cf9ef4333a1f8eb Mon Sep 6 06:53:49 2010 : Info: +- entering group authorize {...} Mon Sep 6 06:53:49 2010 : Info: ++[preprocess] returns ok Mon Sep 6 06:53:49 2010 : Info: ++[chap] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[mschap] returns noop Mon Sep 6 06:53:49 2010 : Info: [suffix] Looking up realm "mytest.com" for User-Name = "raduser(a)mytest.com" Mon Sep 6 06:53:49 2010 : Info: [suffix] Found realm "mytest.com" Mon Sep 6 06:53:49 2010 : Info: [suffix] Adding Stripped-User-Name = "raduser" Mon Sep 6 06:53:49 2010 : Info: [suffix] Adding Realm = "mytest.com" Mon Sep 6 06:53:49 2010 : Info: [suffix] Proxying request from user raduser to realm mytest.com Mon Sep 6 06:53:49 2010 : Info: [suffix] Preparing to proxy authentication request to realm "mytest.com" Mon Sep 6 06:53:49 2010 : Info: ++[suffix] returns updated Mon Sep 6 06:53:49 2010 : Info: [eap] Request is supposed to be proxied to Realm mytest.com. Not doing EAP. Mon Sep 6 06:53:49 2010 : Info: ++[eap] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[unix] returns notfound Mon Sep 6 06:53:49 2010 : Info: [files] users: Matched entry DEFAULT at line 195 Mon Sep 6 06:53:49 2010 : Info: [files] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Info: ++[files] returns ok Mon Sep 6 06:53:49 2010 : Info: ++[expiration] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[logintime] returns noop Mon Sep 6 06:53:49 2010 : Info: ++[pap] returns noop Mon Sep 6 06:53:49 2010 : Info: WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 177 to 192.168.7.40 port 1812 User-Name = "raduser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604100ff84736f21760abada91fdb828e888c State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x31 Mon Sep 6 06:53:49 2010 : Info: Proxying request 1 to home server 192.168.7.40 port 1812 Sending Access-Request of id 177 to 192.168.7.40 port 1812 User-Name = "raduser" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604100ff84736f21760abada91fdb828e888c State = 0x1a2902ae000001370001c0a8072800000003235c233800 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x31 Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 192.168.7.40 port 1812, id=177, length=47 Proxy-State = 0x31 EAP-Message = 0x04010004 Message-Authenticator = 0x9ce0e5c3b355540c348cbff29f5f40f2 Mon Sep 6 06:53:49 2010 : Info: +- entering group post-proxy {...} Mon Sep 6 06:53:49 2010 : Info: [force_username] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Debug: force_username: Added attribute User-Name with value 'raduser(a)mytest.com' Mon Sep 6 06:53:49 2010 : Info: ++[force_username] returns ok Mon Sep 6 06:53:49 2010 : Info: [eap] No pre-existing handler found Mon Sep 6 06:53:49 2010 : Info: ++[eap] returns noop Mon Sep 6 06:53:49 2010 : Info: Using Post-Auth-Type Reject Mon Sep 6 06:53:49 2010 : Info: +- entering group REJECT {...} Mon Sep 6 06:53:49 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> raduser(a)mytest.com Mon Sep 6 06:53:49 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Sep 6 06:53:49 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Sep 6 06:53:49 2010 : Info: Delaying reject of request 1 for 1 seconds Mon Sep 6 06:53:49 2010 : Debug: Going to the next request Mon Sep 6 06:53:49 2010 : Debug: Waking up in 0.9 seconds. Mon Sep 6 06:53:50 2010 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.6.181 port 32771 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Mon Sep 6 06:53:50 2010 : Debug: Waking up in 3.9 seconds. Mon Sep 6 06:53:54 2010 : Info: Cleaning up request 0 ID 0 with timestamp +48 Mon Sep 6 06:53:54 2010 : Debug: Waking up in 0.9 seconds. Mon Sep 6 06:53:55 2010 : Info: Cleaning up request 1 ID 1 with timestamp +48 Mon Sep 6 06:53:55 2010 : Info: Ready to process requests. I have never succedded with eapol_test. I doubt on NAS-IP-Address attribute in Access=Request which is 127.0.0.1. Can some body point me where am I going wrong? -- Chidanand Gangur Pune.

4 9

Save Passwords Encrypted in DB
by Nasser Heidari 06 Sep '10

06 Sep '10

Hi, I want to save encrypted passwords in DB. As I reviewed mailing list , it looks that I don't need major changes on my Freeradius and DB records. Currently my users password in database is like this : +------------+---------------+------------------+----+------------------ ----+ | id | UserName | attribute | op | value | +------------+---------------+------------------+----+------------------ ----+ | 10001 | nasser | User-Password | := | plainpass | +------------+---------------+------------------+----+------------------ ----+ And I authenticate users with pap module . I've changed DB entry to this : # openssl passwd -1 plainpass $1$n.cKdTKy$.N.o9XkpX.RkCHC5EbZds/ +------------+---------------+------------------+----+------------------ ------------------------------------------+ | id | UserName | attribute | op | value | +------------+---------------+------------------+----+------------------ ------------------------------------------+ | 10001 | nasser | Crypt-Password | := | $1$n.cKdTKy$.N.o9XkpX.RkCHC5EbZds/ | +------------+---------------+------------------+----+------------------ ------------------------------------------+ But no success, also I add Password-With-Header := "{crypt}" to my sql.conf but no success ! Do I missing something ? What kind of changes do I need? My Freeradius Version is 2.1.7 Thanks in advance.

2 4

RADIUS reading LDAP attributes
by Sigurd Foshaug 04 Sep '10

04 Sep '10

Hi all, I have a freeradius 2.1.3 running and I can successfully authenticate users. I would like to use a users LDAP attribute so I can provide them with different permissions on the proxy server. I have currently mapped a RADIUS attribute to the LDAP attribute and it successfully reads the attribute when a user is authenticating. >From radiusd -X: rlm_ldap: description -> My-Local-LDAP-Comment = "STAFF" So the user in question has STAFF as a comment in his ldap description attribute. I have added the My-Local-LDAP-Comment into the raddb/dictionary file like this: ATTRIBUTE My-Local-LDAP-Comment 3000 string and in the raddb/ldap.attrmap I have added: replyItem My-Local-LDAP-Comment description Now, what I am failing to understand is how I can get the proxy server to receive the My-Local-LDAP-Comment attribute from RADIUS, so I can make rules depending on its contents? Any suggestions on what to do, or which documentation to read would be appreciated. Thanks, Sigurd

2 2

Re: detail configuration file: how to save lines
by Alan DeKok 04 Sep '10

04 Sep '10

Stefan A. wrote: > I have a detail configuration file, which has several sections for different > files, to be handled by different listener > > As the NASses are GGSNs, which are sending more than 40 attributes, I will > save space on HD and will remove unneeded attributes using suppress. > Do I have to put every attribute in every detail-x configuration area or is > there a kind of template to do this? read raddb/templates.conf Alan DeKok.

2 1

Configure PEAP on FreeRadius using openssl.
by Stephane Brodeur 03 Sep '10

03 Sep '10

Hi, I am trying to configure FreeRADIUS for the PEAP authentication method. I am using the following link to set up the FreeRADIUS server: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO This documents indicates that the file radiusd.conf should include the following entry: authtype = MS-CHAP It also refers to the utilization of the CA.all script The version of FreeRADIUS running on version 5.5 does not have any entry for authtype = MS-CHAP in radiusd.conf file and does not have CA.all script. Is there anybody kind enough to tell me if it is possible that my version of FreeRADIUS, do not know how to find it, does not need the authtype = MS-CHAP entry in radiusd.conf file I also would like to know if we can used something equivalent to CA.all script and how can we modify eap.conf accordingly. Any information on what CA.all script or any equivalent is all about would also be really helpful. Thanks Stephane

2 1

..::Block username after 3 failed authentications::..
by Alfonso Alejandro Reyes Jiménez 03 Sep '10

03 Sep '10

Hi Everyone. I was wondering if there's some way to block the brute force attack. for example block the username after 3 invalid password attempts. This could be possible? if it's possible how? Thanks in advance. Regards. Alfonso.

2 2

Freeradius Authentication
by jorge88 03 Sep '10

03 Sep '10

Good afternoon, I wanted to make the following question to see if someone can help me. Is it possible to configure freeradius to consult users in two different tables within the same database? Otherwise, is it possible to associate a user name to a NAS so it will not be logging in from another NAS differently? Thank you very much -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius-Authentication-tp2802389… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

..::Huntgroup Issues::..
by Alfonso Alejandro Reyes Jiménez 03 Sep '10

03 Sep '10

Hi, I'm trying to use the huntgroup feature on the freeradius software with out luck. I think I'm missing something that's why I'm sending this email maybe you can help me. Right now I have the following files: huntgroups file at the end: squid NAS-IP-Address == 127.0.0.1 users file at the end: alfonso Auth-Type := Local, User-Password == "testing", Huntgroup-Name == "squid" clients.conf at the end: client 127.0.0.1 { secret = xxxxxxxxxxx shortname = squid } When I try with the radtest to log in, I get an access-reject. Here's the client side response: [root@mscitum raddb]# radtest alfonso testing localhost 10 xxxxxxx Sending Access-Request of id 134 to 127.0.0.1 port 1812 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=134, length=20 Here's the output of the debug, it seems that it doesn't find the config file. rad_recv: Access-Request packet from host 127.0.0.1:36858, id=134, length=59 User-Name = "alfonso" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "alfonso", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 modcall[authenticate]: module "unix" returns notfound for request 1 modcall: leaving group authenticate (returns notfound) for request 1 auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 134 to 127.0.0.1 port 36858 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 134 with timestamp 4c7319f1 Nothing to do. Sleeping until we see a request. May be I'm missing to enable some feature, thanks in advance for your help. Regards Alfonso.

3 4

Problem with rlm_perl
by Nasser Heidari 03 Sep '10

03 Sep '10

Dear Folks, Apologies for previous unwanted / half complete email, We are using a perl module to record and save clients MAC address to DB. In situations that cisco-av-pair is not included in RADIUS packet, We are replacing it with 0000.0000.0000. Everything is working just fine in test environment but when running on production servers the recorded MAC address for those clients without cisco-av-pair attribute in their packet is not 0000.0000.0000 but it's a wrong MAC which belongs to another packet received seconds ago. We even captured all the RADIUS traffic sent form NASes and replayed it in our test environment but everything was working fine again. The only difference is our test environment is 32bit and production is 64bit. We suspect even something wrong with 32/64 bit or a threading issue with perl module on 64 bit platform. Anyone seen something like this before or anything special regarding 64bit / perl multi-threading? Current version: radiusd: FreeRADIUS Version 2.1.7, for host x86_64-redhat-linux-gnu, built on Mar 31 2010 at 00:14:28 We also have perl compiled with multi-threading support : v5.8.8 built for x86_64-linux-thread-multi best regards,

1 0