February 2011 - Freeradius-Users - lists.freeradius.org

Radius + LDAP + SecurID
by Marc Phillips 02 Feb '11

02 Feb '11

So I've been beating my head against a wall on this for a few days, so I figured I'd share what "worked" now that the swelling has gone down. Configuration is fairly straight forward. I have authorization via LDAP (AD), and Authentication via SecurID (via PAM..yeah, I know you aren't s'posed to use PAM 'cause of mem leaks, and the SecurID one certainly had 'em, but the latest module has been stable in Radius 1.1.7 for me for over 2 years on multiple platforms). I previously had a simple radius to securid bridge I'm just now adding in LDAP. Using FreeRadius 2.1.10 (I patched it for an exec callout which can be found in the devel group). Used the "default" site and enabled ldap: authorize { preprocess auth_log # This is important and (it's ommision) was # the cause of the lump on my skull files ldap } authenticate { pam } modules/ldap ldap { server = "mydc" port = 636 identity = "exec:my_callout" password = "exec:my_callout" basedn = "dc=some,dc=corp,dc=com" filter = "(CN=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls_mode= yes tls { start_tls = no cacertfile = /path/to/cafile require_cert = "demand" } dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no groupmembership_filter = "(&(objectClass=group)(member=%{Ldap-UserDn}))" groupmembership_attribute = "memberOf" chase_referrals = no rebind = no set_auth_type = no } users file: DEFAULT Ldap-Group == "admins", Auth-Type = pam Reply-Message = "Hello (admin), %{User-Name}", ....(other attributes) Fall-Through = No DEFAULT Ldap-Group == "Operators", Auth-Type = pam Reply-Message = "Hello (operator), %{User-Name}", ....(other attributes) Fall-Through = No DEFAULT Auth-Type := Reject Reply-Message = "you are not authorized" So what happens is the user sends his request, the user ID is looked up in AD and then the groups are looked up for that user, in the order listed in the users file, until a match is found. If a match is found, it passes to the Auth-Type for authentication otherwise sends back a reject. Note, this is a basic POC config. As another note, I found a python module (pyrad, not py-radius) very helpful in debugging this. radtest is nice, but I don't like entering my pin in he clear on a shared unix box. Here's a script I used for that (merged the good of the py-radius example with the pyrad example): -------------cut -------------------------- #!/usr/bin/python import socket, sys import pyrad.packet from getpass import getpass from pyrad.client import Client from pyrad.dictionary import Dictionary secret = '' uname,passwd = None,None while not secret: secret = getpass('RADIUS Secret? ') while not uname: uname = raw_input("Username? ") while not passwd: passwd = getpass("Password? ") srv=Client(server="localhost", secret=secret, dict=Dictionary("/path/to/dictionary")) print "read dictionary" req=srv.CreateAuthPacket(code=pyrad.packet.AccessRequest, User_Name=uname) req["User-Password"]=req.PwCrypt(passwd) req["Service-Type"] = "Login-User" try: print "Sending authentication request" reply=srv.SendPacket(req) except pyrad.client.Timeout: print "RADIUS server does not reply" sys.exit(1) except socket.error, error: print "Network error: " + error[1] sys.exit(1) if reply.code==pyrad.packet.AccessAccept: print "Access accepted" else: print "Access denied" print "Attributes returned by server:" for i in reply.keys(): print "%s: %s" % (i, reply[i]) -----------cut --------------------------- R. Marc

1 0

MAC Authentication - Bad Idea?
by Jim Rice 02 Feb '11

02 Feb '11

Greetings, Still a newbie, but getting there... (Alan, do you ever sleep?) I have been asked to implement MAC authentication for a local service provider with a Canopy radio network and MikroTik routers. No, really. I was able to test this and received Accept-Accept after placing the MAC address in the UserName (Password is ""), but had to set Auth-Type := Accept. I haven't found much in the way of documentation regarding MAC authentication in some of the "dated" books I have on Radius and 802.1x, nor in the FreeRadius docs. The goal is to provide for different classes of service, bandwidth management, accounting, etc. I imagine some of this can be done through vendor specific attributes to dynamically configure the routers (VLANs, data rates, priority queues and such), based on which group a user belongs. Dumb question #1: Just because you can do a thing, it doesn't mean you should. Can someone give me the "you idiot" speech and talk me out of this? Deploying client certificates to every device in their network seems an administrative nightmare. Using usernames/passwords doesn't make sense since most devices will always be connected. In the days of dial-up, users understood having to "login" to connect. Today, not so much. So, are there better alternatives? Or am I still just a clueless newbie? Thanks for your patience, Jim

7 11

Active Directory and authorize section
by Harry Hoffman 02 Feb '11

02 Feb '11

Hi All, I'm trying to find out what to use (if anything) in the authorize section when authenticating clients via MSCHAP-v2 and AD credentials. The how-to at deployingradius.com only speaks to the authentication section. If I only want to ensure that the username/password credentials are valid do I need to run through authorize or just go straight to authenticate? Cheers, Harry

6 9

Re: EAP-TTLS & Kerberos
by Alan Buxey 02 Feb '11

02 Feb '11

not a single bit of EAP being triggered according to these logs. Look at the default server and how it used EAP and pushes request to inner-tunnel. You won't have any password details outside of the EAP tunnel and that ain't been created in your setup. Alan

1 0

How to store clients.conf in LDAP?
by c0re 02 Feb '11

02 Feb '11

Hello freeradius users! I've configured authentication and authorization via freeradius that looking in openldap for users and passwords. In radius.conf in ldap section I used filter filter = "(&(cn=%{Stripped-User-Name:-%{User-Name}})(description=%{NAS-IP-Address}))" So I only need to make description field with IP address of device to give user access to some device. But when I add new device I always have to edit clients.conf, add new IP address and secret. I do not want to use 0.0.0.0 and same secret for all devices. Is it possible to store device secrets in openldap? If yes, please, point me to right direction. And may be it's possible change way how can I give access to devices for users? I mean something like group cn=someSwitch,ou=devices,dc=domain,dc=com, and this group has field with IP address of device and something like "member: user1" or "memberUid: cn=user1,ou=users,dc=domain,dc=com". I'm a bit confused about how to implement it... Thanks in advance for advices!

3 4

Question on Radius logs
by Brett Littrell 02 Feb '11

02 Feb '11

Hi All, Real quick and I am sure easy question here. I read through the unlang man page, really helped in getting a clue. One thing I was wondering though, is there a way to output text to the log based on a condition? What I mean is something like if x!=y then printf(" x did not equal y"). This would be for debugging and log review. Currently we use Cisco ACS, which with all it's limitations the one thing that is great about it is it's pass/fail logs. Our techs use them all the time to diagnose problems. If I could inject text strings into the logs when certain issues occur it would make it a lot easier to figure out scripts as well as make common issues easier for techs to troubleshoot. From what I can tell in the unlang man page it did not mention this, perhaps I missed it though. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE

5 6

freeradius dhcp file configuration details needed for multiple vlan
by Anagh Pramanik 02 Feb '11

02 Feb '11

Sorry in users i sent the wrong vlan id it is corrected --- On Tue, 2/1/11, Anagh Pramanik <anagh_pramanik(a)yahoo.com> wrote: From: Anagh Pramanik <anagh_pramanik(a)yahoo.com> Subject: freeradius dhcp file configuration details needed for multiple vlan To: freeradius-users(a)lists.freeradius.org Date: Tuesday, February 1, 2011, 11:30 PM I am using VLANs and want different IP ranges for different access privileges, So I use Q-Trunks as our network equipment permits. After surfing internet i have sucessfuly configured the below mentioned case My existing (sample) scenario is In my L3 switch ip 192.168.0.1/24 which is in vlan1 vlan 2 ip 192.168.1.1/24 vlan 3 ip 192.168.2.1/24 vlan 4 ip 192.168.3.1/24 All vlans are internally routed and dhcp helper address for every vlan in pointed to 192.168.1.3. I have installed through yum freeradius and dhcpd My freeradius and dhcp server is in fedora 13 having ip 192.168.1.3 -------------------- in /etc/dhcp/dhcpd.conf ----------------------- default-lease-time 86400; max-lease-time 86400; ddns-update-style interim; ddns-updates on; allow client-updates; allow unknown-clients; subnet 192.168.0.0 netmask 255.255.255.0 { # --- default gateway option routers 192.168.0.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.0.255; option domain-name-servers 192.168.1.2; default-lease-time 86400; max-lease-time 86400; host ciscoap { hardware ethernet 00:26:99:4c:ea:f8; fixed-address 192.168.0.110; } } subnet 192.168.1.0 netmask 255.255.255.0 { # --- default gateway option routers 192.168.1.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.1.255; option domain-name-servers 192.168.1.2,202.54.9.1,202.54.1.30; default-lease-time 86400; max-lease-time 86400; host facultylaptop { hardware ethernet 00:0f:b5:ca:c2:c1; fixed-address 192.168.1.150; } } subnet 192.168.2.0 netmask 255.255.255.0 { # --- default gateway option routers 192.168.3.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.3.255; option domain-name-servers 192.168.1.2,202.54.9.1,202.54.1.30; default-lease-time 86400; max-lease-time 86400; host studentlaptop { hardware ethernet 10:21:6b:0e:44:62; fixed-address 192.168.2.150; } } ------------------------- /etc/raddb/users.conf --------------------- 000fb5cac2c1 Cleartext-Password := "000fb5cac2c1" Reply-Message = "facultylaptop", Tunnel-Medium-Type ="IEEE-802", Tunnel-Private-Group-ID = "2", Tunnel-Type = "VLAN", Fall-Through = "NO" 10216b0e4462 Cleartext-Password := "10216b0e4462" Reply-Message = "studentlaptop", Tunnel-Medium-Type ="IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-ID = "3", Fall-Through = "NO" It is working fine As recently I watched that freeradius currently supports dhcp i also watched mentioned sample file now i want to use freeradius for my dhcp work After installing version 2.1.10 in os fedora 13 as given in site documentation i.e configuring with dhcp .I saw now in the new pc freeradius is installed /usr/local/etc/raddb Now Please help me to configure binding differnet ip network address to each of laptop wireless mac address what will be the configuration value of /usr/loacl/etc/raddb/sites-vailable/dhcp According to my dhcpd.conf please give me the details of the dhcp file I understood that my mac2ip file should be 00:26:99:4c:ea:f8,192.168.0.110 00:0f:b5:ca:c2:c1,192.168.1.150 10:21:6b:0e:44:62,192.168.2.150 --------------- is it correct?? ------------------ where to write dns,router address of each network???? --------------------------------------- I already visit this site but not getting my answers properly in the existing thread Anagh Pramanik

1 0

FR 2.1.0 (ubuntu) proxying to NPS/IAS.
by Ville Leinonen 02 Feb '11

02 Feb '11

Hi, I try to use FR to forwarding access-request to NPS servers, but some reason FR/NPS gives "User password is incorrect" message. I have tripple check that password is correct. When i test IAS to NPS proxy it works. I have enable in NPS side MS-CHAP-v2, MS-CHAP, CHAP and PAP/SPAP methods. Any clue what is wrong? Here is some logs: rad_recv: Access-Request packet from host 192.168.21.150 port 1025, id=57, length=154 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "vle", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "vle" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user vle to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop +- entering group pre-proxy {...} ++[files] returns noop Sending Access-Request of id 118 to 192.168.21.200 port 1812 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" Proxy-State = 0x3537 Proxying request 0 to home server 192.168.21.200 port 1812 Sending Access-Request of id 118 to 192.168.21.200 port 1812 User-Name = "vle" User-Password = "\2063\261m\301\344J\216sCÑ \035\003\2328" NAS-Port = 626688 Called-Station-Id = "192.168.21.150" Calling-Station-Id = "192.168.1.114" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "192.168.1.114" NAS-IP-Address = 192.168.21.150 Cisco-AVPair = "ip:source-ip=192.168.1.114" Proxy-State = 0x3537 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 192.168.21.200 port 1812, id=118, length=52 Proxy-State = 0x3537 Reply-Message = "User password is incorrect" Br, Ville

6 11

freeradius dhcp file configuration details needed for multiple vlan
by Anagh Pramanik 02 Feb '11

02 Feb '11

I am using VLANs and want different IP ranges for different access privileges, So I use Q-Trunks as our network equipment permits. After surfing internet i have sucessfuly configured the below mentioned case My existing (sample) scenario is In my L3 switch ip 192.168.0.1/24 which is in vlan1 vlan 2 ip 192.168.1.1/24 vlan 3 ip 192.168.2.1/24 vlan 4 ip 192.168.3.1/24 All vlans are internally routed and dhcp helper address for every vlan in pointed to 192.168.1.3. I have installed through yum freeradius and dhcpd My freeradius and dhcp server is in fedora 13 having ip 192.168.1.3 -------------------- in /etc/dhcp/dhcpd.conf ----------------------- default-lease-time 86400; max-lease-time 86400; ddns-update-style interim; ddns-updates on; allow client-updates; allow unknown-clients; subnet 192.168.0.0 netmask 255.255.255.0 { # --- default gateway option routers 192.168.0.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.0.255; option domain-name-servers 192.168.1.2; default-lease-time 86400; max-lease-time 86400; host ciscoap { hardware ethernet 00:26:99:4c:ea:f8; fixed-address 192.168.0.110; } } subnet 192.168.1.0 netmask 255.255.255.0 { # --- default gateway option routers 192.168.1.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.1.255; option domain-name-servers 192.168.1.2,202.54.9.1,202.54.1.30; default-lease-time 86400; max-lease-time 86400; host facultylaptop { hardware ethernet 00:0f:b5:ca:c2:c1; fixed-address 192.168.1.150; } } subnet 192.168.2.0 netmask 255.255.255.0 { # --- default gateway option routers 192.168.3.1; option subnet-mask 255.255.255.0; option broadcast-address 192.168.3.255; option domain-name-servers 192.168.1.2,202.54.9.1,202.54.1.30; default-lease-time 86400; max-lease-time 86400; host studentlaptop { hardware ethernet 10:21:6b:0e:44:62; fixed-address 192.168.2.150; } } ------------------------- /etc/raddb/users.conf --------------------- 000fb5cac2c1 Cleartext-Password := "000fb5cac2c1" Reply-Message = "facultylaptop", Tunnel-Medium-Type ="IEEE-802", Tunnel-Private-Group-ID = "18", Tunnel-Type = "VLAN", Fall-Through = "NO" 10216b0e4462 Cleartext-Password := "10216b0e4462" Reply-Message = "studentlaptop", Tunnel-Medium-Type ="IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-ID = "19", Fall-Through = "NO" It is working fine As recently I watched that freeradius currently supports dhcp i also watched mentioned sample file now i want to use freeradius for my dhcp work After installing version 2.1.10 in os fedora 13 as given in site documentation i.e configuring with dhcp .I saw now in the new pc freeradius is installed /usr/local/etc/raddb Now Please help me to configure binding differnet ip network address to each of laptop wireless mac address what will be the configuration value of /usr/loacl/etc/raddb/sites-vailable/dhcp According to my dhcpd.conf please give me the details of the dhcp file I understood that my mac2ip file should be 00:26:99:4c:ea:f8,192.168.0.110 00:0f:b5:ca:c2:c1,192.168.1.150 10:21:6b:0e:44:62,192.168.2.150 --------------- is it correct?? ------------------ where to write dns,router address of each network???? --------------------------------------- I already visit this site but not getting my answers properly in the existing thread Anagh Pramanik

1 0

Different Installation paths between source and yum giving error of missing directory
by Samuel 01 Feb '11

01 Feb '11

Please pardon me if this has been addressed before; my search on the site has not helped me solve my problem. I installed freeradius 2.1.10 from source and the raddb folder was put in /usr/local/etc whereas yum put it in /etc. I deleted the files in /usr/local/etc/ and used yum to install but i get an error that /usr/local/etc/raddb cannot be found when I run radiusd -X. Where is radiusd picking that path from ? Thanks for your help Samuel

4 4