March 2011 - Freeradius-Users - lists.freeradius.org

Freeradius2 and OSX clients no TLS
by Guy 08 Mar '11

08 Mar '11

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I'm setting up Freeradius2 (FreeRADIUS Version 2.1.7) for WPA Enterprise 2, and I have it basically working. my iPhone/iPad are able to authenticate and connect via the base station. However my Mac (OSX 10.6 Snow leopard) Laptops are having issues. I do not want to push out Client certificates to the laptops. I also do not want people to have to perform any customisations on the clients. When the laptop attempts to join the network I get a nice login window, with username/password. This is fine. However without playing with the network settings (802.1x settings). I'm not able to join the network because I do not have a client Cert: Sat Mar 5 16:21:28 2011 : Error: --> verify error:num=19:self signed certificate in certificate chain Sat Mar 5 16:21:28 2011 : Error: TLS Alert write:fatal:unknown CA Sat Mar 5 16:21:28 2011 : Error: TLS_accept:error in SSLv3 read client certificate B Sat Mar 5 16:21:28 2011 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Sat Mar 5 16:21:28 2011 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Sat Mar 5 16:21:28 2011 : Auth: Login incorrect: [guy/<via Auth-Type = EAP>] (from client extreme port 0 cli 00-19-E3-E1-BA-C5) However if I do change the 802.1x settings on the mac to not try and to TLS then I'm able to connect just fine. either by PEAP, or TTLS.. So finally my question... How can I reconfigure Radius to not try and offer TLS or if it does offer TLS to not die if a cert is not presented?? I have tried some suggestions such as commenting out the CA in the eap.conf file, but still I fail to pass the TLS. Thanks - ---Guy -----BEGIN PGP SIGNATURE----- Version: GnuPG/MacGPG2 v2.0.17 (Darwin) iEYEARECAAYFAk1yaQcACgkQDc8ue1+sfKEcAQCfYRVtzNb1UcRa9hf+PM3ipToT zCgAn2TGSTOAjigyWLYwTm4HDcy12l9L =JyX7 -----END PGP SIGNATURE-----

9 19

Only run a single post-auth when using inner-tunnel
by paul smith 07 Mar '11

07 Mar '11

Hi, I have an exec script that I want to run when authenticating a user. The script takes in the username. I want to run the script both for PEAP authentications and PAP authentications. The problem I have is that if I put the exec in the inner-tunnel post-auth section it will work fine for the PEAP transactions, as it has the username. However if I also want to authenticate PAP, then I need to put it in the default post-auth. So it will work fine for PAP transactions as it has the username. However if its in the default, the script will be run for PEAP transactions with the wrong username (anonymous) and then will fail. Is there some way I can tell the server not to run things in the default post-auth, if the request has been through the inner-tunnel? I'm thinking putting something like the following in the default post-auth section if (!proxy-reply:Packet-Type == "Access-Accept") { radius-user-auth } However this always evaluates as true, even though I can see the inner-tunnel authenticating successfully. thanks, paul

2 4

using Ldap-Group attribute checks in policy.txt
by Thomas Wunder 07 Mar '11

07 Mar '11

Hi, i'd like to specify my auth-policies using the rlm_policy module (since i like it's obvious flexibility and the cleanness of it's policy syntax and because i wasn't able to solve some particular problems with rlm_files) but there's one big problem left: until now i've been using the Ldap-Group attribute within my users file (i want to get rid of rlm_files) to check whether the user -- which is to be authorized -- is a member of a particular ldap group. i also need to do this check within my intended 'policy setup' but it turned out that i can't get conditions of the form (e.g.) if( Ldap-Group==vpn-staff ){ ... } to work. conditions that comprise this attribute in any way always evaluate to false while others like e.g. Called-Station-Id, NAS-Identifier, NAS-Port and any combination thereof work as expected. might this have something to do with the fact that Ldap-Group is not a 'real' attribute? rlm_ldap is active by the way. it says 'rlm_ldap: Registering ldap_groupcmp for Ldap-Group' when the daemon starts up and obviously it doesn't matter whether 'policy' is before or after 'ldap' in the authorize sections of 'sites-available/default'/'sites-available/inner-tunnel' in this respect. by browsing the code of rlm_policy a bit i figured that 'find_vp' returns 0 if it gets passed 'Ldap-Group' (i might be wrong). it's called approximately around line 589 (by 'vp = find_vp(state->request, this->lhs);') of 'rlm_policy/evaluate.c'. what can i do to get the 'Ldap-Group'-stuff working? could anyone (otherwise) tell me how to fit the 'paircompare(...)' (as is used in rlm_files) function in the rlm_policy context or provide a patch which does? thanks in advance best regards thomas

2 1

failed to add client/duplicate client
by Jan Strauch 07 Mar '11

07 Mar '11

1 0

Exec-Program-Wait and reply-detail log
by AHMED KHIDR 07 Mar '11

07 Mar '11

Dear All , I am upgrading from 1.1.7 To 2.1.10 I am using Exec-Program-Wait to run a script In the old ver, I can find the out put of my script in reply-detail log , But in the new ver. I Only find the attribute Exec-Program-Wait = "/usr/bin/php /var/www/html/check.php testuser 1" but i need all the ourput to be printed in the reply-detail log, so is there any way to do that ?? regards

1 0

How to know and limit the freeradius-client
by Spacelee 07 Mar '11

07 Mar '11

I have pptp + ppp, l2tp + ppp, openvpn to connect to the same freeradius to authenticate, and my question is how to meet this need: I want to limit some user could just access pptp, some could just access l2tp, and some could just access openvpn. and is there any variable in freeradius to implement this? -- *Space Lee*

1 0

decoupled accounting cron check
by Alexander Clouter 06 Mar '11

06 Mar '11

Hi, For those out there using decoupled accounting, especially in an 'eduroam' environment, might find the following helpful. I receive a lot of random rubbish from the various NAS's deployed internationally send to my FreeRADIUS installation. Such moments of fun are accounting stop packets with a zero session length (CISCO_ACCOUNTING_HACK) resulting in a DoS when received in the decoupled accounting case...plus the other usual hings that trigger corner cases my custom (bad?) SQL statements do not catch when logging this information to our database. The unfortunate outcome means after a bad accounting packet, the mountpoint I use for recording my journal fills up until FreeRADIUS hangs with no warning (meanwhile FreeRADIUS works fine so it is not something trivially monitored by NAGIOS or such). The solution I slapped together is a quick minutely run script by cron that notifies me by email when a problem occurs. My preference is to place my detail journal files on a separate tmpfs mountpoint (as I use low powered ARM boxes, OpenRD's if you are curious, that only have a NAND): ---- tmpfs /var/log/freeradius/radacct/journal tmpfs nosuid,nodev,noexec,size=32M,mode=700,uid=freerad,gid=freerad 0 0 ---- Then the following script is used. ---- #!/bin/sh MOUNT=/var/log/freeradius/radacct/journal TRIGGER=1024 RCPT="jill(a)example.com bob(a)example.com" MESSAGE="FreeRADIUS is on the road to implosion...yer might want to look into it. Cheers" SELF=$(basename $0) if [ -e "/var/lock/$SELF" ]; then if [ $(df "$MOUNT" | tail -n1 | awk '{ print $3 }') -lt $(($TRIGGER/2)) ]; then rm "/var/lock/$SELF" else exit 1 fi fi [ $(df "$MOUNT" | tail -n1 | awk '{ print $3 }') -lt $TRIGGER ] && exit 0 DATE=$(date -R) TO=$(echo $RCPT | sed 's/ /, /g') cat <<EOF | /usr/sbin/sendmail -i $RCPT To: $TO Date: $DATE Subject: $MOUNT exceeds ${TRIGGER}kB $MESSAGE EOF [ $? -eq 0 ] && touch "/var/lock/$SELF" exit 1 ---- That's it. The above script will email you only a single time when more that 1024kB of journal is sitting around waiting to be processed and will re-enable notifications once it drops to half the trigger mark (512kB). Cheers -- Alexander Clouter .sigmonster says: T-shirt: Life is *not* a Cabaret, and stop calling me chum!

3 3

Hopefully quick question: conditional processing sneaking in and setting Auth-Type
by Gary Gatten 05 Mar '11

05 Mar '11

I can't find where this conditional processing is happing. I have two FR servers with "nearly" the same config. Auth works on one, but not the other: Both servers set auth type to MS-CHAP: "[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok" Everything is the same up to the "PAP" warning message, then: - Server that works uses MSCHAP: Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} ... Login OK: - Server that FAILS: ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE ++? if (!control:Auth-Type) -> FALSE Found Auth-Type = ntlm_auth +- entering group authenticate {...} ... Login incorrect: Ignore why ntlm_auth is failing - I'll figure that out later if needed. What I need to know is WHY it's not just using MSCHAP like the working server and doing some conditional processing to set the Auth-Type? I checked "all" the conf files I can think of and can't seem to find this... Any clues would be appreciated. Thanks! Gary <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 2

Freeraidus 2
by Usuário do Sistema 05 Mar '11

05 Mar '11

Hello everyone, I'm Maicon from Brazil. I'm in a project with Freeradius. I want to deployment authentication with certificate from my wireless users EAP-TLS but I'm finding some difficult. there is a good how to for version 2 ?? I've started with version 1.x but decided to change for version 2 and I'm not finding where I set the LDAP conection. at the older version it was inside radiusd.conf. anybody help me ?? thank!

4 3

mschap with ntlm_auth and Active Directory
by robert22 04 Mar '11

04 Mar '11

I am trying to setup freeRadius to process requests from our Wireless Controller. The controller uses the wireless devices MAC address as the username, and a predefined password. These MAC addresses all excist in Active Directory as user accounts, with the same password set. This works fine with our current Windows 2003 Server but Im trying to get it going with FreeRadius. the mschap module line in MSCHAP for ntlm_auth is as such: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MY.ACTUAL.DOMAIN} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" the ntlm_auth module itself contains: program = "/usr/bin/ntlm_auth --request-nt-key --domain=MY.ACTUAL.DOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" I havent changed anything to the users file except adding in a test local user as part of the initial FreeRadius install guide, and uncommenting the DEFAULT Auth-Type = ntlm_auth line for using the following to test: root@FREERADIUS:/etc/freeradius# radtest localhost 0 sharedsecret which seems to work: rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=217, length=20 but when I set the Wireless controller to point to the FreeRadius server, this is the debug log: ----start---- rad_recv: Access-Request packet from host 10.0.9.101 port 32987, id=83, length=163 User-Name = "001E52805980" MS-CHAP-Challenge = 0x86acd2fc97136970 MS-CHAP-Response = 0x33013cd70c5db14d0ff0ba01097baeee613883c7711e96028461bc25975c513bb7dc3b2b1068d2ac048fe46e52a840f4f662 NAS-IP-Address = 0.0.0.0 NAS-Port = 0 NAS-Port-Type = Wireless-Other NAS-Identifier = "redlan1" Calling-Station-Id = "001E52805980" Called-Station-Id = "001F457E67A8" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "001E52805980", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=001E52805980 [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] ... expanding second conditional [mschap] expand: --domain=%{%{mschap:NT-Domain}:-MY.ACTUAL.DOMAIN} -> --domain=MY.ACTUAL.DOMAIN [mschap] mschap1: 86 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=86acd2fc97136970 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=bc25975c513bb7dc3b2b1068d2ac048fe46e52a840f4f662 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 001E52805980 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request ----END---- Hoping somone can point me in the right direction of where I might have messed up, or what further readiing I might need to do? Many Thanks Robert -- View this message in context: http://freeradius.1045715.n5.nabble.com/mschap-with-ntlm-auth-and-Active-Di… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 15