March 2011 - Freeradius-Users - lists.freeradius.org

MS-CHAP-V2 with no retry
by John Hayward 27 Apr '11

27 Apr '11

According to RFC2759 section 9.1.3 - 9.1.5 an authentication failure can return (E=691 R=0) --- failure no retry or (E=691 R=1) failure, disable short timeout and allow a retry with ++ID. freeradius apparently only returns (E=691 R=1) in three different places in src/modules/rlm_mschap/rlm_mschap.c apple wireless clients have a known bug Bug ID# 8112557 which fails to increment the ID in the response to the challenge failure message. The Microsoft NPS logs this failure and silently discards the retry attempt. The effect is that the user of the apple device never sees a message that tells them the need to change their password. I am unsure if free radius checks the ID of a retry packet from a device but the effect is similar - users are left in the dark as to why they cannot connect when their password has been changed. It has been reported that if the Microsoft NPS server is configured for no retries (E=691 R=0) that mac/iphones/ipads then act like windows xp machines in that they report to the user that the password needs attention. Would it be possible to modify rlm_mschap.c to be conigured as to how many retries were allowed before returning authentication failure with no retry? johnh...

6 59

EAP-TTLS & Kerberos
by Thorsten Fischer 20 Apr '11

20 Apr '11

All, I have a number of NASs - wireless APs running hostapd. I am setting up a freeradius 2.1.10 server to control the authentication of username(a)net.example.com to the wireless network; the decision is to be made by a Kerberos server. The setup is not working as intended, which I think stems either from my misunderstanding of the protocols involved or of how to set up freeradius correctly. Or both. Later, all authentication requests of username(a)example.com (without the net.) are to be forwarded to another Radius server. There will likely be more services integrated in the same vein later, so I would like to branch out into separate virtual servers based on realm. My understanding is that the communication between a user(a)net.example.com and freeradius needs to involve EAP-TTLS, because of the cleartext password which is required to be passed on to kerberos. The required keytab is set up and configured correctly. modules/krb5 is set up accordingly. bootstrap in raddb/certs has been run to create self-signed certs. I have an entry in the users file: DEFAULT Realm == "net.example.com", Auth-Type = Kerberos The realm is set up like this: realm net.example.com { virtual_server = net.example.com } And the virtual server as well as the inner-tunnel have Auth-Type Kerberos { krb5 } in their authenticate section, right after Auth-Type PAP. Key changes in eap.conf: eap { default_eap_type = ttls ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } } Local tests succeed as follows: $ radtest -t pap thorsten(a)net.example.com pwd 127.0.0.1 0 testing123 $ radtest -t eap-md5 thorsten(a)net.example.com pwd 127.0.0.1 0 testing123 $ radtest -t pap thorsten(a)net.example.com pwd 127.0.0.1:18120 0 testing123 In each of these cases, the reason for success is successful communication with Kerberos, as exemplified by the following lines (and wrong kerberos passwords let authentication fail): Wed Feb 2 15:59:06 2011 : Info: Found Auth-Type = Kerberos Wed Feb 2 15:59:06 2011 : Info: # Executing group from file /etc/freeradius/sites-enabled/net.example.com Wed Feb 2 15:59:06 2011 : Info: +- entering group Kerberos {...} Wed Feb 2 15:59:06 2011 : Info: ++[krb5] returns ok Wed Feb 2 15:59:06 2011 : Auth: Login OK: [thorsten] (from client localhost port 0 via TLS tunnel) However, tests with eapol_test locally as well as with the actual access points fail: $ cat eap-ttls.conf network={ ssid="myssid" key_mgmt=WPA-EAP eap=TTLS identity="thorsten(a)net.example.com" password="pwd" phase2="auth=PAP" } $ eapol_test -c eap-ttls.conf -s testing123 produces: rad_recv: Access-Request packet from host 127.0.0.1 port 60596, id=0, length=172 User-Name = "thorsten(a)net.example.com" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 Calling-Station-Id ="02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000250174686f727374656e406e65742e742d6c6162732e74752d6265726c696e2e6465 Message-Authenticator = 0x3f0be4354cfc77a6285a0ad074341101 Wed Feb 2 15:33:32 2011 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Feb 2 15:33:32 2011 : Info: +- entering group authorize {...} Wed Feb 2 15:33:32 2011 : Info: ++[preprocess] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[chap] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[mschap] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[digest] returns noop Wed Feb 2 15:33:32 2011 : Info: [suffix] Looking up realm "net.example.com" for User-Name = "thorsten(a)net.example.com" Wed Feb 2 15:33:32 2011 : Info: [suffix] Found realm "net.example.com" Wed Feb 2 15:33:32 2011 : Info: [suffix] Adding Stripped-User-Name = "thorsten" Wed Feb 2 15:33:32 2011 : Info: [suffix] Adding Realm = "net.example.com" Wed Feb 2 15:33:32 2011 : Info: [suffix] Proxying request from user thorsten to realm net.example.com Wed Feb 2 15:33:32 2011 : Info: [suffix] Preparing to proxy authentication request to realm "net.example.com" Wed Feb 2 15:33:32 2011 : Info: ++[suffix] returns updated Wed Feb 2 15:33:32 2011 : Info: [eap] Request is supposed to be proxied to Realm net.example.com. Not doing EAP. Wed Feb 2 15:33:32 2011 : Info: ++[eap] returns noop Wed Feb 2 15:33:32 2011 : Info: [files] users: Matched entry DEFAULT at line 71 Wed Feb 2 15:33:32 2011 : Info: ++[files] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[expiration] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[logintime] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[pap] returns noop Wed Feb 2 15:33:32 2011 : Info: WARNING: Empty pre-proxy section. Using default return values. Wed Feb 2 15:33:32 2011 : Info: >>> Sending proxied request internally to virtual server. Wed Feb 2 15:33:32 2011 : Info: server net.example.com { Wed Feb 2 15:33:32 2011 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/net.example.com Wed Feb 2 15:33:32 2011 : Info: +- entering group authorize {...} Wed Feb 2 15:33:32 2011 : Info: ++[preprocess] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[digest] returns noop Wed Feb 2 15:33:32 2011 : Info: [suffix] Request already proxied. Ignoring. Wed Feb 2 15:33:32 2011 : Info: ++[suffix] returns ok Wed Feb 2 15:33:32 2011 : Info: [files] users: Matched entry DEFAULT at line 71 Wed Feb 2 15:33:32 2011 : Info: ++[files] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[expiration] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[logintime] returns noop Wed Feb 2 15:33:32 2011 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Feb 2 15:33:32 2011 : Info: ++[pap] returns noop Wed Feb 2 15:33:32 2011 : Info: Found Auth-Type = Kerberos Wed Feb 2 15:33:32 2011 : Info: # Executing group from file /etc/freeradius/sites-enabled/net.example.com Wed Feb 2 15:33:32 2011 : Info: +- entering group Kerberos {...} Wed Feb 2 15:33:32 2011 : Auth: rlm_krb5: Attribute "User-Password" is required for authentication. Wed Feb 2 15:33:32 2011 : Info: ++[krb5] returns invalid Wed Feb 2 15:33:32 2011 : Info: Failed to authenticate the user. [...] Apparently, the cleartext password does not get passed on. And I need to figure out why. This is were you come in, mailing list ;) Thank you in advance for suggestions. Cheers, t -- Thorsten Fischer, BOWL Project Administrator <thorsten(a)net.t-labs.tu-berlin.de> Technische Universität Berlin, FG INET, TEL16, 18th floor Ernst-Reuter-Platz 7, 10587 Berlin, Germany Tel: +49 30 835358542, Fax: +49 391 53478347

3 3

MLPPP Acct-Session-Id
by Jay Kuhne (jkuhne) 11 Apr '11

11 Apr '11

Hi, Is there another attribute syntax on radclient that could be used aside from Acct-Session-Id to perform COA to a session We are using MultilinkPPP (single session per bundle still) and it is not working as it normally would with PPP. Thanks, Jay RADIUS: COA received from id 48 x.x.x.99:1052, CoA Request, len 149 COA: x.x.x.20 request queued RADIUS: authenticator 70 8D C4 4D 97 82 50 02 - 73 6B 53 27 81 52 29 BD RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Acct-Session-Id [44] 10 "000110A4" RADIUS: Vendor, Cisco [26] 46 RADIUS: Cisco AVpair [1] 40 "ip:sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 48 RADIUS: Cisco AVpair [1] 42 "ip:sub-qos-policy-out=policy_session_out_coa" COA: Message Authenticator missing or failed decode ++++++ CoA Attribute List ++++++ 7FD2EA5DA700 0 00000009 username(447) 23 user1(a)asr_5_6_mlp.com1 7FD2EA5DB090 0 00000001 session-id(409) 4 69796(110A4) 7FD2EA5DB0A8 0 00000009 sub-qos-policy-in(421) 17 policy_session_in_coa 7FD2EA5DB0C0 0 00000009 sub-qos-policy-out(423) 18 policy_session_out_coa RADIUS/ENCODE(00000000):Orig. component type = Invalid RADIUS(00000000): sending RADIUS(00000000): Send CoA Nack Response to x.x.x.99:1052 id 48, len 157 RADIUS: authenticator 76 2F 9A 52 29 2C 26 57 - 27 F6 E0 CC A6 E6 F1 13 RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Vendor, Cisco [26] 43 RADIUS: Cisco AVpair [1] 37 "sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 45 RADIUS: Cisco AVpair [1] 39 "sub-qos-policy-out=policy_session_out_coa" RADIUS: Reply-Message [18] 18 RADIUS: 4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session] RADIUS: Dynamic-Author-Error[101] 6 Unsupported Service [405]

3 11

Per Vendor NAS-Port documentation
by Olivier Bilodeau 08 Apr '11

08 Apr '11

Hi, I was wondering if there has been a collective effort to document the meaning of the NAS-Port by the various Network Vendors? We are working on PacketFence here (an open source NAC) and we translate the NAS-Port to the ifIndex so we can request a dot1x reauthentication to the ifIndex if we want to (ie: IDS event). We've done the translation by ourselves since vendor documentation is often lacking and I was thinking there must exist such a resource. Does anyone here know? I know we could use CoA with the original NAS-Port but it's less supported than the SNMP PAE Reauthenticate MIBs. Thanks! -- Olivier Bilodeau obilodeau(a)inverse.ca :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

4 5

I need help and some advice !!!
by striderblue 06 Apr '11

06 Apr '11

about IPv6 on freeradius v.2.1.test9 for ubuntu so this version is support IPv6 right? but I try to test local with IPv6 ::1 it response like this : http://freeradius.1045715.n5.nabble.com/file/n4167834/0bcb3b1056e7d9151be5f… radclient: Failed to find ip address for host ::1: success but radtest ipv4 worked!!! ---------------------------------------------------------------------- at clients.conf I config : client localhost { ipaddr = 127.0.0.1 ipv6addr = :: secret = testing } client ::1 { secret = testing123 shortname = localhost } ---------------------------------------------------------------------- at radiusd.conf I config : listen { type = auth ipaddr = * ipv6addr = :: port = 0 } listen { ipaddr = * ipv6addr = :: port = 0 type = acct } ---------------------------------------------------------------------- so where I missed and do wrong config ? please help thank you very much. golf -- View this message in context: http://freeradius.1045715.n5.nabble.com/I-need-help-and-some-advice-tp41678… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 9

Re: Strip off the domain part from the User-Name
by Thomas Wunder 04 Apr '11

04 Apr '11

Hi On Friday 25 March 2011 15:42:30 you wrote: > In which case, you *must* enable "with_ntdomain_hack = yes" As you suggested I changed the 'with_ntdomain_hack' option to 'yes' in four different locations (modules/preprocess, modules/mschap, eap.conf, modules/inner-eap) but still it doesn't work. I get the following error message (for a full debug log see attachment) which is new: ++[ldap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [tom1] (from client swtswitch01 port 0 via TLS tunnel) } # server inner-tunnel [peap] Got tunneled reply code 3 [peap] Got tunneled reply RADIUS code 3 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled I'm obviously missing something but I can't seem to find out what it is... Any ideas? Regards Tom

2 8

multiple authentication methods
by Nick Kalen 01 Apr '11

01 Apr '11

Hello, looking at the docs, it looks like it's not possible to try to authenticate against a local LDAP server and in case it failes send it to another radius server? Can someone please prove me wrong?

2 1

sqlcounter & returning Gigawords?
by YvesDM 01 Apr '11

01 Apr '11

Hi, We 're about to upgrade our radius which is still running 1.1.7 We use monthly datalimits so we patched the sqlcounter in order to make it reply max 4GB of left quota (to avoid wrapping), even if the user still has 10GB quota left. Of course this results in a logged out user when he reaches a session of 4GB. As general datatraffic increases we would like to avoid this in our new radius setup. In the newest version, is there a way to reply gigawords from sqlcounter? If not, is there another solution to this? Many thx. Yves

2 2

same username different password on different NAS
by Richard Thornton 01 Apr '11

01 Apr '11

I am just learning about freeradius now, and would like to see if I can use it to manage access and logging for users at a few hundred locations. Each remote office has between 1 and 50 users, and at first glance freeradius will do the job, but I just noticed a problem with overlapping usernames. I am not sure if I need to use virtual servers, or if there is a better / easier way. The problem is that each location may have a user with the same login name as a different location. For a simple example, each site could have a login of "manager", but the manager username at each site would probably pair up with a different password. Without using virtual servers, is there a way to link the username "manager" to the NAS name or IP of the location? I'm picturing something like the radcheck table containing an additional field for NAS such that freeradius would key off the combined of NAS address and username fields, rather than just the username field. I am not opposed to using virtual servers if that is a better idea, but I'm worried about the overhead of several hundred of them... Any ideas or pointers to docs would be appreciated. -Richard

4 4

Installing to pfsense
by Franz 01 Apr '11

01 Apr '11

Hi, I have currently installed freeradius 2.1.10 and Mysql 5..5.10 on a pfsense box which is freebsd. I want this to work with mysql however I was wondering how to install freeradius with mysql support as I am unable to do it via ports or try any commands or flags with ./configure via tarball. Only pkg_add is available, can I recompile or install from scratch to get freeradius to bind to mysql? Thanks, Frank

4 10