February 2011 - Freeradius-Users - lists.freeradius.org

Freeradius + LDAP for WPA-Enterprise
by Max Schröder 11 Feb '11

11 Feb '11

Hello to all, I would like to use Freeradius to authenticate my wireless network using OpenWRT and Freeradius + LDAP. What I've done: First Authenticated Users in WLan using EAP-TTLS and files in Freeradius. WORKED! Then I've configured ldap-Modul + added "ldap" in the authorize- and "Auth-Type LDAP { ldap }" in the authenticate-section. The test via radtest succeeded. But now the authentication using OpenWRT (EAP-TTLS) like the first try with files - now with ldap did not work. I do noticed the following comment # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Auth-Type LDAP { ldap } but I don't know what to change that it worked like my first try with the difference the users are in LDAP instead of a file. Hope to get any hints Best regards. MS

5 11

Verschlüsselte Übertragung von Passwörtern
by Marius.Meisner 11 Feb '11

11 Feb '11

Hello, I'am searching for a good way to secure the transmission of passwords with decryption between clients and a radius-server (there is no NAS between) without client zertificates. At the moment I use default PAP configuration. Which ways are possible? Any hind, how I get this working or could find solutions? In the dokumentation I haven't found something like that with PAP? Is there a posiblity to get this work with PAP or should I change form PAP to EAP or something else? thx & greets MM

2 5

rlm_python and the Tunnel-Private-Group-Id attribute
by Bob Brandt 11 Feb '11

11 Feb '11

Not sure if there isn't another forum or mailing list for rlm_python specifically, but... I have been using freeradius for a while now with great results, thanks! We are using a very simple configuration to authenticate users against LDAP (eDirectory) and that part works great! I am trying to add a component that will return the necessary attributes to allow for dynamic VLANs I was able to get this working using the /etc/raddb/users file, however do to the size of the organization, this is very messy. I have started using python to extract this information from another database and return the information. All my testing seems to indicate it should work, but it is not. I believe the problem is in how rlm_python returns the "Tunnel-Private-Group-Id" attribute. My users file (which works) looks like this: # Generic LDAP return attributes DEFAULT Auth-Type == "LDAP" Class = "Staff", Service-Type = Login, Tunnel-Medium-Type = IEEE-802, Tunnel-Type = VLAN, Tunnel-Private-Group-ID = 99, Fall-Through = Yes brandtb Reply-Message += "You are a member of the IT Group", Class := "CACS:0/ebf42/ac8c8e6/administrator", Tunnel-Private-Group-ID := 150, Alcatel-Lucent-Asa-Access = "all", Fall-Through = No Below are the two snipets of the debugs. The first is from the old(working) system which uses the users file and the second is from the new system using the rlm_python module: Sending Access-Challenge of id 172 to 10.200.113.99 port 18699 Class := 0x434143533a302f65626634322f616338633865362f61646d696e6973747261746f72 Service-Type = Login-User Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 := "150" Reply-Message += "You are a member of the IT Group" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc146d1a4c144c80f46bec9bc87d3208b Finished request 0. ----- Sending Access-Challenge of id 130 to 10.200.113.99 port 18673 Reply-Message = "You are a member of the IT Group" Tunnel-Type:0 = VLAN Class = 0x4f50575374616666 Class = 0x434143533a302f65626634322f616338633865362f61646d696e6973747261746f72 Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Login-User Tunnel-Private-Group-Id:0 = "150" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8cd4aac48cd6b3a6430ea766ccfa9b91 Finished request 0. The debug output looks for the most part identical! Now, initially when using the users file, I had the same problem I am having now, where the wireless access point was getting the attributes but was not putting me in the correct VLAN. The problem turned out that I was passing a string to the "Tunnel-Private-Group-Id" attribute instead of an integer. Once I removed the quotes from the VLAN ID everything was working perfectly. Thinking that the problem was that within Python I was storing the "Tunnel-Private-Group-Id" attribute as a string I changed it to an integer, however I got immediately got the error: return tuple must be (str,str) I don't know who to get around this and I have not been able to find too many examples of how to use the rlm_python module. Any help would be greatly appreciated. Thanks Bob Brandt -- What's the point of having a rapier wit if I can't use it to stab people? - Jeph Jacques

3 5

EAP and Accounting
by David Peterson 11 Feb '11

11 Feb '11

I am working with a NAS that only sends accounting packets with the EAP style username. Other than matching up =7Bam=3D1=7Df717cc32fff26ff29ca0baac5833f8fc(a)WiMax.com with "Bob(a)WiMax.com" manually in the database are there other methods for achieving this? David

2 1

Framed-IP-Address AVP missing
by Rajkumar R 11 Feb '11

11 Feb '11

Hi, This query is related to Cisco-7206 equipment behavior. We have a Cisco 7206(IOS12.2(33)) equipment associated with freeRadius server2.1.10. Upon PPPOE client start, dynamic IP is assigned from the IP-Pool to the PPPOE client. However this IP address, is not included in the Frame-IP-Address AVP sent in the Access-Request message from the NAS. Request to provide your inputs on this, as this is reported across other forums(unfortunately, no answers available there :)) I have enabled this AVP inclusion with the NAS command, radius-server attribute 8 include-in-access-req Also find the configuration which I have used for your info: Current configuration : 3420 bytes ! version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname CISCOBRAS ! boot-start-marker boot-end-marker ! enable secret 5 $1$NS9k$AMTl8utX2OqwQbWtVsNQX0 enable password abcd ! aaa new-model ! ! aaa group server radius bsnl server 172.31.113.137 auth-port 1812 acct-port 1813 ! aaa group server radius gsds server 172.31.113.135 auth-port 1812 acct-port 1813 ! aaa authentication ppp default group radius aaa authorization network default group radius aaa authorization subscriber-service default local aaa accounting network default start-stop broadcast group bsnl group gsds ! ! ! ! aaa server radius dynamic-author client 172.31.113.135 server-key testing123 server-key testing123 auth-type any ignore session-key ! aaa session-id common ip subnet-zero ! ! ! ip cef ip host gsds 172.31.113.135 ip host bsnl 172.31.113.137 ip host isp 172.31.113.137 ip address-pool local ! ! service-policy type control L2_ACCESS redirect server-group GSDS_SRV server ip 172.31.113.135 port 80 ! redirect server-group ISP_SRV server ip 172.31.113.136 port 80 ! multilink bundle-name authenticated no call rsvp-sync ! ! ! ! ! ! ! username abcd password 0 abcd ! class-map type traffic match-any PPP_SESSION_TRAFFIC_GRAS match access-group input name ACL_GRAS_USER ! class-map type traffic match-any PPP_SESSION_TRAFFIC match access-group input name ACL_BSNL_USER ! class-map type control match-all GRASBERG match unauthenticated-domain gsds ! class-map type control match-all PPP_SESSION match protocol ppp ! policy-map type service SVC_GSDS service local class type traffic PPP_SESSION_TRAFFIC_GRAS redirect to group GSDS_SRV ! ! policy-map type service SVC_GSDS_TO_INTERNET service local class type traffic PPP_SESSION_TRAFFIC_GRAS redirect to group ISP_SRV ! ! policy-map type control L2_ACCESS class type control PPP_SESSION event session-start 1 collect identifier unauthenticated-domain 2 service-policy type control DOMAIN_BASED_ACCESS ! ! policy-map type control DOMAIN_BASED_ACCESS class type control GRASBERG event session-start 1 authenticate aaa list default 2 service-policy type service name SVC_GSDS ! ! ! ! ! ! ! bba-group pppoe BSNL_BBA_GROUP virtual-template 1 ! ! interface FastEthernet1/0 ip address 172.31.113.150 255.255.255.0 no ip route-cache cef no ip route-cache duplex full ! interface FastEthernet1/1 description PPPoE ip address 10.10.10.4 255.255.255.0 no ip route-cache cef no ip route-cache duplex full pppoe enable group BSNL_BBA_GROUP ! interface Virtual-Template1 ip unnumbered FastEthernet1/1 peer default ip address pool GRAS_IP_POOL ppp authentication chap callin ! ip local pool GRAS_IP_POOL 10.10.10.20 ip default-gateway 10.10.10.4 ip classless ! ! no ip http server no ip http secure-server ! ip access-list standard ACL_GRAS_USER permit 10.10.10.0 0.0.0.255 ! ! ! radius-server attribute 8 include-in-access-req radius-server attribute 11 default direction in radius-server host 172.31.113.137 auth-port 1812 acct-port 1813 radius-server host 172.31.113.135 auth-port 1812 acct-port 1813 radius-server key testing123 radius-server vsa send accounting radius-server vsa send authentication ! control-plane ! ! dial-peer cor custom ! ! ! ! gatekeeper shutdown ! ! line con 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 password cisco ! end thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Re: How to get fractions of seconds?
by Alan DeKok 10 Feb '11

10 Feb '11

Stefan A. wrote: > Best would be to have something like '%l', but in a resolution of > milliseconds. This is impossible. The dates and elapsed times in RADIUS have a resolution down to one second, but no more. It's possible to "fake" adding milliseconds, but they will bear little relation to the actual session times. Network delays, processing delays, etc. will all affect the results. Alan DeKok.

3 3

FreeRADIUS + Cygwin + Active Directory authentication?
by Moe, John 10 Feb '11

10 Feb '11

I'm trying to set up a FreeRADIUS server in our organization, and the corporate preference is to run on Windows. I've got FreeRADIUS to compile and have successfully completed the PAP test (from http://deployingradius.com/documents/configuration/pap.html) to make sure it works. Now I'm looking to set up Active Directory authentication. To do that, all the documentation I've read is geared towards Linux servers running Samba. From what I gather, it uses the ntlm_auth program to authenticate to the Windows Active Directory, which returns "NT_KEY output, which is needed in order for FreeRADIUS to perform MS-CHAP authentication." Is there a way I can do this on a Windows/Cygwin server? I tried to get Samba to compile and install to test if it'd work on a Windows server, but it needed Kerberos to talk to AD, and Kerberos didn't seem to want to compile without shared libraries, which apparently Cygwin doesn't support. Does anyone know any other programs that can be used to provide this authentication mechanism, that also run on Windows? Or do I need to do this on a Linux server? I've tried to Google for the answers to this without luck. Any help or pointers would be appreciated. Thanks. John H. Moe Network Support - Hatch IT HATCH Tel: +61 (7) 3166 7777 Direct: +61 (7) 3166 7684 Fax: +61 (7) 3368 3754 Mobile: +61 438 772 425 61 Petrie Terrace, Brisbane, Queensland Australia 4011 ***************************** NOTICE - This message from Hatch is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential or proprietary. Internet communications cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, arrive late or contain viruses. By communicating with us via e-mail, you accept such risks.� When addressed to our clients, any information, drawings, opinions or advice (collectively, "information") contained in this e-mail is subject to the terms and conditions expressed in the governing agreements.� Where no such agreement exists, the recipient shall neither rely upon nor disclose to others, such information without our written consent.� Unless otherwise agreed, we do not assume any liability with respect to the accuracy or completeness of the information set out in this e-mail.� If you have received this message in error, please notify us immediately by return e-mail and destroy and delete the message from your computer.

4 3

How to authorize login users using FreeRadius???
by vijay s sheelavantar 09 Feb '11

09 Feb '11

Hello friends, I am running pam_radius_auth.so client on one machine and freeRadius server on the other machine. Authentication is happening fine for the user accounts. I want to give certain privilege levels to each user on client machine. For example network_admin, security_admin, guest etc privilages. How can i configure these previlage leves for authorization on client and server side? Thanks & Regards, VIJAY S.

1 0

RE: Proxy Maintenance Process
by Gary Gatten 09 Feb '11

09 Feb '11

Was reading (I know, scary) and came across this in the policy.conf: # # If you want the server to pretend that it is dead, # then use the "do_not_respond" policy. # do_not_respond { update control { Response-Packet-Type := Do-Not-Respond } handled Not sure if that would help you or not, but "policy's" are apparently deprecated... G -----Original Message----- From: Gary Gatten Sent: Monday, February 07, 2011 6:05 PM To: 'FreeRadius users mailing list' Subject: RE: Proxy Maintenance Process Perhaps some sort of access list or host (/32) null route to make the NAS think the home server is dead? -----Original Message----- From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Monday, February 07, 2011 5:27 PM To: FreeRadius users mailing list Subject: Re: Proxy Maintenance Process Brian Carpio wrote: > So are there any other options then restarting radiusd? > > I have tried to comment out a home_server and even send a hup: > > radmin -e "hup" > > But that doesn't see to make freeradius reread the proxy.conf file... That won't work. Home servers aren't reloaded on HUP. > I don't see in the radmin command how I can disable a server (except mark it dead but since my backend server still replies to heartbeat messages its marked alive immediately). Hmm... no, you can't disable a home server. The simplest thing would be to turn off the home server if it's not responsive. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

1 0

PEAP MSCHAPv2 error..
by Mark Holmes 09 Feb '11

09 Feb '11

Tested with PAP and radtest, as per http://deployingradius.com/documents/configuration/pap.html All works OK Now I want to test from a Windows 7 wireless client using PEAP (MSCHAPv2). The page seems to indicate this should pretty much work with default config. So:- I added wireless AP to clients.conf --------------- client 163.1.40.141 { secret = testing } ---------------- Disabled 'Validate server certificate' on the client Entered bob as username, testing123 as password I get No such realm 'NULL' So added --------------------- realm test { authhost = LOCAL accthost = LOCAL } To proxy.conf - not sure this is the correct way of resolving a null realm, though..... ---------------- And this time entered bob@test as the username, testing123 as password Now I get rejected - the following from the debug output looks relevant [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for bob@test with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\010E=691 R=1" EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE I posted the full debug output at http://www.nuffield.ox.ac.uk/scratch2/test-peap.log - as I wasn't sure posting all 900+ lines to this list would be appreciated - or is that OK in future? The MSCHAP errors are line 901 onwards. I'm doing something silly, no doubt - but what? Should this config just work out of the box? Appreciate any help. Cheers Mark

2 2