January 2011 - Freeradius-Users - lists.freeradius.org

SSH-Login libpam-radius-auth
by Marius.Meisner 29 Jan '11

29 Jan '11

Hi, I have a problem with passwor-matching. Everything seams to be all right, but radius still won't accept shared_secret. I use radius with mysql-database for ssh authenticate. If I try to authenticate with radtest on server (10.10.10.11) - it works fine. If I try to authenticate vom client with IP 10.10.10.200 it works as well. If I try to authenticate from ssh I receive this message: rad_recv: Access-Request packet from host 127.0.0.1 port 3666, id=208, length=88 User-Name = "lisa" User-Password = "\010\n\r\177INCORRECT" NAS-IP-Address = 10.10.10.11 NAS-Identifier = "sshd" NAS-Port = 2641 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.10.10.200" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "lisa", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> lisa rlm_sql (sql): sql_set_user escaped user --> 'lisa' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'lisa' ORDER BY id rlm_sql (sql): User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'lisa' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'lisa' ORDER BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): User found in group dynamic expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated rad_check_password: Found Auth-Type auth: type "PAP" +- entering group PAP rlm_pap: login attempt with password "? INCORRECT" rlm_pap: Using clear text password "lisa123" rlm_pap: Passwords don't match ++[pap] returns reject auth: Failed to validate the user. Login incorrect (rlm_pap: CLEAR TEXT password check failed): [lisa/\010\n\r\177INCORRECT] (from client localhost port 2641 cli 10.10.10.200) WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> lisa attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 1.0 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 208 to 127.0.0.1 port 3666 Waking up in 4.9 seconds. clients.conf: ============= client 127.0.0.1 { secret = Test shortname = localhost nastype = other # localhost isn't usually a NAS... } client 10.10.10.0/24 { secret = Test shortname = local-net } pam_radius_auth.conf: ===================== 127.0.0.1 Test 3 10.10.10.11 Test 3 pam.d/common-auth: ================== # Radius auth # For these next three lines to grant auth, you must have a local user name # This must be the same as your RADIUS name # Remove the "debug" argument on the next line after everything works auth sufficient pam_radius_auth.so debug account required pam_radius_auth.so session required pam_radius_auth.so # Generic unix auth services below auth required pam_unix.so nullok_secure users: ====== "susi" Cleartext-Password := "123" If I add the user susi out of users with adduser susi and the user lisa from database adduser lisa, then NTRadPING receives Reject. If password is set in passwd - authentication works. But the password shouldn't read out of passwd... Any suggestions, where my fault or what to do? Cheers MM

2 2

Sample code for external program w/ EAP?
by McCann, Brian 29 Jan '11

29 Jan '11

Hi all. I hate to be a pest...but I cannot find anything really on what I'm trying to do. My setup is a wireless AP (running OpenWRT) using WPA2 - 802.1x authentication, to Freeradius. I'm trying to use a Python program as an "external authenticator", so I can check various things with the username and password in my already existing authentication schemes. I thought this would be easy...I was wrong. Through some trial and error, I've determined that the Python app needs to return "Cleartext-Password" with "some value"...that value is unclear to me since I've returned anything and it takes it. I've tried to mimic the setup at http://wiki.freeradius.org/Rlm_perl , but using Python instead of perl. My question to everyone is this: Is there an example program, in Python or perl, that is complete and works somewhere? Everything I've seen just says things like "your code here", and never specifies what the returns need to be formatted like and/or include for EAP. I had been assuming that I just simply had to return a simple "OK" or "FAIL", but that's clearly not right. I'm including some testing below for those who want to see more of what I'm doing. Thanks, --Brian When I run radtest now, here's what I get (showing that there's an EAP error, but it does give an Access-Accept): [root@xxxx: /usr/local/etc/raddb]#radtest -t eap-md5 user pass 127.0.0.1 0 testing123 Sending Access-Request packet to host 127.0.0.1 port 1812, id=49, length=0 User-Name = "user" User-Password = "pass" NAS-IP-Address = 192.168.12.18 NAS-Port = 0 EAP-Code = Response EAP-Type-Identity = "user" Message-Authenticator = 0x00 EAP-Message = 0x023000090175736572 rlm_eap: EAP-Message not found Received Access-Accept packet from host 127.0.0.1 port 1812, id=49, length=20 Here's the function that's running in my python program: def authorize(p): print "*** authorize ***" print radiusd.radlog(radiusd.L_INFO, '*** radlog call in authorize ***') print print p. sys.stdout.flush() return (radiusd.RLM_MODULE_OK, (('Cleartext-Password','pass'),), (('Auth-Type', 'python'),)) Here's the output from radius -X : rad_recv: Access-Request packet from host 127.0.0.1 port 49493, id=49, length=85 User-Name = "user" User-Password = "pass" NAS-IP-Address = 192.168.12.18 NAS-Port = 0 Message-Authenticator = 0x4b08938d78fe92d1f7a6d60152c9fbc0 EAP-Message = 0x023000090175736572 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 48 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 1 ++[files] returns ok *** authorize *** *** radlog call in authorize *** (('User-Name', '"user"'), ('User-Password', '"pass"'), ('NAS-IP-Address', '192.168.12.18'), ('NAS-Port', '0'), ('Message-Authenticator', '0x4b08938d78fe92d1f7a6d60152c9fbc0'), ('EAP-Message', '0x023000090175736572'), ('EAP-Type', 'Identity')) rlm_python:authorize: 'Cleartext-Password' = 'pass' rlm_python:authorize: 'Auth-Type' = 'python' ++[python] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP Found Auth-Type = Python Warning: Found 2 auth-types on request for user 'user' # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group Python {...} *** authenticate *** *** radlog call in authenticate *** (('User-Name', '"user"'), ('User-Password', '"pass"'), ('NAS-IP-Address', '192.168.12.18'), ('NAS-Port', '0'), ('Message-Authenticator', '0x4b08938d78fe92d1f7a6d60152c9fbc0'), ('EAP-Message', '0x023000090175736572'), ('EAP-Type', 'Identity')) ++[python] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 49 to 127.0.0.1 port 49493 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 49 with timestamp +5 Ready to process requests. When I try to connect from my iPad, it just hangs...probably because it's waiting for that "EAP-Message" that radtest was complaining about.

3 5

daemon for the freeradius rlm_smsotp plugin?
by Pasi Kärkkäinen 28 Jan '11

28 Jan '11

Hello, https://github.com/alandekok/freeradius-server/blob/stable/raddb/modules/sm… Are there any daemons available that can be used by the freeradius rlm_smsotp plugin? Or do I need to write my own.. Thanks! -- Pasi

2 2

Rejecting EAP-TLS based on cert Subject field
by Matt Garretson 28 Jan '11

28 Jan '11

For years, we've been doing simple EAP-TLS with various versions of FreeRADIUS. Now, a new requirement has come down to me such that radius will have to reject certain valid client certs based on a string in the Subject field of the client cert. I've met this need (using 2.1.11 from git) with a simple bit of unlang in post-auth{}: if ( "%{TLS-Client-Cert-Subject}" =~ /OU=Evil/ ) { reject } It works, but there are two non-ideal things about the way it works: 1) Windows XP doesn't seem to notice the rejection and keeps retrying for a minute or two, ultimately failing to show any failure/error message to the user. 2) The rejection is not logged in radiusd.log; rather, three "Auth: Login OK" lines are logged (the repetition is due to XP's retries) Is there any way I can address these two issues? I did try putting the above unlang into eap.conf's tls{} section (where check_cert_issuer and check_cert_cn would be), in hopes that the rejection would occur during the auth rather than after it, but the code doesn't seem to have any effect there. Thanks in advance for any clues... -Matt

4 10

freeradius data encryption modes
by mcabh＠gmx.de 28 Jan '11

28 Jan '11

Hi @all, I have installed a freeradius server succesfully. I can login with all my clients using WPA2 (AES-CCMP) PEAP with mschapv2. Last week I got a new notebook that don´t support the data ecryption AES-CCMP. The data encryption that I can specify (in WPA2 with PEAP/mschapv2) only is AES, AES MFP, TKIP and TKIP MFP. Here´s my question, can I configure my freeradius server to support logins with AES/AES MFP/TKIP/TKIP MFP? Thanks for help... Greetings Gustav -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

3 2

SQL Logging
by Kristoffer Milligan 28 Jan '11

28 Jan '11

Hello again, I'm still fighting my little battle in copying attributes from the inner to the outer tunnel etc. I have now gotten as far that logging access-accepts is working as I want, but I'm now struggling logging access-rejects. Here's my SQL from dialup.conf: postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) VALUES \ ('%{reply:SQL-User-Name}', '%{reply:Packet-Type}', \ '%{reply:Calling-Station-Id}', '%S');" From a rejected session, I get this: Fri Jan 28 09:48:05 2011 : Info: (5) [ttls] Got tunneled reply code 3 Filter-Id = "OBFUSCATED" SQL-User-Name = "OBFUSCATED" Calling-Station-Id = "OBFUSCATED" MS-CHAP-Error = "\226E=691 R=1" .... Fri Jan 28 09:48:05 2011 : Info: (5) +- entering group REJECT {...} Fri Jan 28 09:48:05 2011 : Info: (5) [sql] expand: %{Stripped-User-Name} -> {am=1}OBFUSCATED Fri Jan 28 09:48:05 2011 : Info: (5) [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> {am=1}OBFUSCATED Fri Jan 28 09:48:05 2011 : Info: (5) [sql] sql_set_user escaped user --> '{am=1}OBFUSCATED' Fri Jan 28 09:48:05 2011 : Info: (5) [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{reply:SQL-User-Name}', '%{reply:Packet-Type}', '%{reply:Calling-Station-Id}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('', 'Access-Reject', '', '2011-01-28 09:48:05'); Fri Jan 28 09:48:05 2011 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('', 'Access-Reject', '', '2011-01-28 09:48:05'); From an accepted session, everything works fine and the SQL-User-Name and Calling-Station-Id are logged as expected. How come the attributes are empty, even though they are in the reply, only when an access-reject is given? - Kristoffer

2 3

Re: Freeradius-Users Digest, Vol 69, Issue 93
by vijay s sheelavantar 28 Jan '11

28 Jan '11

Hello Alan,there was some problem with my firewall. I disabled it. and now it is working fine. Thank you. :) On Thu, 27 Jan 2011 16:41:20 , freeradius-users-request(a)lists.freeradius.org wrote Send Freeradius-Users mailing list submissions to    freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit    http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to    freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at    freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics:   1. Re: Python module/program (Terry Simons)   2. Radius authentication problem. (vijay s sheelavantar)   3. reset sql counter every 30 minute (piston)   4. Re: reset sql counter every 30 minute (Bishal Pun)   5. Re: Radius authentication problem. (Alan Buxey) ---------------------------------------------------------------------- Message: 1 Date: Wed, 26 Jan 2011 15:06:58 -0800 From: Terry Simons <terry.simons(a)gmail.com> Subject: Re: Python module/program To: FreeRadius users mailing list    <freeradius-users(a)lists.freeradius.org> Message-ID:    <AANLkTi=pjYQ7Uk2QxrHGy4X5z-NRZOrb0NB=uf=cVr9-(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Is the python module catching all exceptions? You need to make sure you don't mask out the KeyboardInterrupt exception... otherwise, you may prevent Control-C from being passed up the stack. I'm not sure if that's your issue, but it sounds like it could be.  It's considered a Python best practice to explicitly catch the exact exceptions that you know how to handle, and let exceptions that you're not going to handle directly trickle up. That is to say that you should never do something like: try:    <some code> except:   <some code> because you *will* end up masking things like KeyboardInterrupt. You should always do something like: try:    <some code> except TheExceptionClass:    <some code> HTH, - Terry On Wed, Jan 26, 2011 at 2:47 PM, McCann, Brian <bmccann(a)andmore.com> wrote: > Hi all.  I've got freeradius working using a python library for auth, but > something interesting happened when I did.  When I run "radius -X", and > press  CRTL+C, it no longer exits.  It just returns "Ready to process > requests.".  The PID doesn't change, so it's not like its exiting and > restarting. > > I looked at http://wiki.freeradius.org/Rlm_perl (yes...I know...perl != > python, but as the python page doesn't say much, I'm going on the perl page > for a starting point) and it doesn't look like the script has to do anything > to handle exits.  Does anyone know what I'm missing? > > Thanks, > --Brian > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

4 5

reset sql counter every 30 minute
by piston 27 Jan '11

27 Jan '11

Hi Is that possible to reset the sql counter every 30 minute? Basically, i need to get user free access of 20 minutes, after 20 minutes NAS will logout the user. And the user is allow to login again after 30 minute. Thanks

3 2

radius.log records individual client IP. Possible??
by Difan Zhao 27 Jan '11

27 Jan '11

Hi experts, I'm wondering if it's possible for the radius.log file to show the NAS IP instead of the "client" name (which is IP range in my case). Currently the log looks like: Thu Jan 27 11:53:15 2011 : Auth: Login incorrect: [08000f513f60/08000f513f60] (from client 10.143.115.0/24 port 50303 cli 08-00-0F-51-3F-60) It'd be ideal if it can show the IP of the NAS where the request is coming from. I know I could configure the client file to have individual IP for each client instead of entire subnet. However just wondering if there is easy "switch" to turn it on lol Thanks! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com<mailto:difan.zhao@guest-tek.com> Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com<http://www.guest-tek.com> [http://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/Logo.jpg] INTERNET | MEDIA | VOICE [http://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/image004.jpg] The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

2 1

Python module/program
by McCann, Brian 27 Jan '11

27 Jan '11

Hi all. I've got freeradius working using a python library for auth, but something interesting happened when I did. When I run "radius -X", and press CRTL+C, it no longer exits. It just returns "Ready to process requests.". The PID doesn't change, so it's not like its exiting and restarting. I looked at http://wiki.freeradius.org/Rlm_perl (yes...I know...perl != python, but as the python page doesn't say much, I'm going on the perl page for a starting point) and it doesn't look like the script has to do anything to handle exits. Does anyone know what I'm missing? Thanks, --Brian

3 3