July 2011 - Freeradius-Users - lists.freeradius.org

Re: MS-CHAP Auth fail, password cache ?
by Alexey Shildyakov 11 Jul '11

11 Jul '11

11.07.2011 15:06 пользователь "Alan DeKok" <aland(a)deployingradius.com> написал: > > Bastien Semene wrote: > > I'm currently - trying to - set up a radius server. > > The backend used is MySQL. I'm using FreeRADIUS 2.1.11 on FreeBSD 8 > > > > During my tests, for the same user I used "test" password, then "blabla" > > password. > > Now, I use "blabla" and it's not working. instead "test" is still > > working ... > > I tested with a third string ("ahaha") , there's a third error output... > > I have no idea what that means. I think he mean that only first password is worked. The second and third version of tye password for the same user aren't worked. > > > I tried restarting radiusd and the jail it's running into, this does > > changes nothing. > > All this commands/outputs are from the same running server (I mean no > > reboot). > > > > How can this happen > > The server reads it's configuration files only when it starts. If you > edit the configuration files, you will need to restart the server. But is it apply for MYSQL too? Think I don't need to restart the server in case MYSQL because each time tye server does SELECT from MySQL, doesn't it? > > Alan DeKok. > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

freeradius-client lib documentation
by Kevin Lemonnier 11 Jul '11

11 Jul '11

Hello, I have to make an application using a RADIUS lib. I want to use the freeradius-client lib, but I can't find the documentation. I downloaded the bz2 archive as said on the wiki, and installed it, but I don't have any help with it, neither ad in the wiki. Is there a doc somewhere ? A example program at least ? I've looked at the .h in the include folder, but there is too much funcs for me to understand how to use it just with that. Thanks.

2 1

Freeradius 2.1.10: authentication (uid and password) or (macaddress) in LDAP
by Maciej Łukasz Wojszkun 11 Jul '11

11 Jul '11

Hello, somebody can tell me how I should configure freeradius to authenticate in order (all is in openldap): check mac-address in ldap if exist authenticate computer else authenticate with uid/password or try authenticate using macaddress if rejected - try authenticate via uid/password -- Regards Maciej Łukasz Wojszkun [MWO]

2 2

auth fails
by Paulo Maia 08 Jul '11

08 Jul '11

Hello everyone, Im trying to use plain mac auth ( http://wiki.freeradius.org/Mac%20Auth#Plain+Mac-Auth) and at the radius server says Login Ok , Acceptin user , but at the client says auth fails (w7) here is the output of it : Does any1 knows what might be the problem ? Thanks , *rad_recv: Access-Request packet from host 172.20.0.11 port 1645, id=28, length=139 User-Name = "host/Bala-PC" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-22-56-05-0C-8F" Calling-Station-Id = "00-1F-16-AD-16-0A" EAP-Message = 0x0202001101686f73742f42616c612d5043 Message-Authenticator = 0x082125c878f325cb3b54c88dbc6e2e82 NAS-Port-Type = Ethernet NAS-Port = 50015 NAS-IP-Address = 172.20.0.11 +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++- entering if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...} expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-1F-16-AD-16-0A ++++[request] returns ok +++- if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok +++ ... skipping else for request 2: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok [authorized_macs] expand: %{Calling-Station-ID} -> 00-1F-16-AD-16-0A [authorized_macs] users: Matched entry 00-1F-16-AD-16-0A at line 3 ++[authorized_macs] returns ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++- entering else else {...} +++[control] returns ok ++- else else returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [host/Bala-PC/<via Auth-Type = Accept>] (from client 4500 port 50015 cli 00-1F-16-AD-16-0A) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 28 to 172.20.0.11 port 1645 Reply-Message = "OK" Finished request 2.*

3 3

Re: Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

/ > Phil Mayers wrote: > > The (untested) patch below might help on 2.1.x: > > > > https://github.com/philmayers/freeradius-server/commit/3c1ed71cde100268dba5… > > > > > > ...or for 3.x: > > > > https://github.com/philmayers/freeradius-server/commit/6877b70f442536c93ed0… > > Added, thanks. > > Alan DeKok. /Alan, Just did git pull (master branch), and tried - it failed - as described by Phil in an earlier post, since mschapv2 callback is not called --------------------<snip-3.x log>----------------------------------------- (19) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (19) group authenticate { (19) - entering group authenticate {...} (19) eap : Request found, released from the list (19) eap : EAP/peap (19) eap : processing type peap (19) peap : processing EAP-TLS (19) peap : eaptls_verify returned 7 (19) peap : Done initial handshake (19) peap : eaptls_process returned 7 (19) peap : FR_TLS_OK (19) peap : Session established. Decoding tunneled attributes. (19) peap : Peap state send tlv success (19) peap : Received EAP-TLV response. (19) peap : Client rejected our response. The password is probably incorrect. (19) peap : We sent a success, but received something weird in return. (19) eap : Handler failed in EAP/peap (19) eap : Failed in EAP select (19) [eap] = invalid (19) Failed to authenticate the user. (19) Using Post-Auth-Type Reject ------------------------------------------------------------- Then tried with removing this patch: https://lists.freeradius.org/pipermail/freeradius-users/2011-April/msg00295… and it is working properly like in 2.x branch. Hence I think, also you need to remove this patch. -- Nitin.

1 0

Question about Access-Challenge
by Jamshid Abedi 08 Jul '11

08 Jul '11

Hello, I've got Mobile OTP to work with FreeRadius, I'd like to take this one step further and turn this into a two phase process. The objective is to first take the pin, authenticate that and then communicate to the NAS with a challenge to receive the OTP from the user. I think this can be done via an access-challenge reply to the NAS. My question is how do I get FreeNAS to send an Access-Challenge once it has verified the PIN is correct? If anyone can kindly give me some hints or point me in the right direction. Thank you, JJ Abdi

3 2

Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

> On 08/07/11 11:20, Nitin Bhardwaj wrote: > > However, one doubt: Shouldn't this code be conditional based on whether > "use_tunneled_reply" is yes/no. Presently the outer PEAP > does take care of it, is this taken care of in this callback > (mschap_postproxy) ? > > No. The code doesn't need to be conditional, because copying of the > attributes to the final, outer, access-accept is already conditional > on "use_tunneled_reply" - that's what it does. Ok. So do you think this patch is fit to be brought into mainline-2.x ? I will try the 3.x patch too, and let you know soon. -- Nitin.

1 0

Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

/ > Nitin Bhardwaj wrote: > > Hi, > > Please edit your posts. It's not nice to go through hundreds of lines > of garbage in order to read the *real* content of the message. /Alan, I posted the output of "radiusd -X" in the previous message as is the norm on the mailing-list, and replied to the same in last message. That is not a *garbage*, isn't it ? / > > Found out that this works perfectly fine in freeradius 3.0.0 (master git > > branch). > > That's nice to know. > > > Can anyone please suggest which patches I need to back-port to 2.1.11 to > > make this work in 2.1.x branch too ? > > You can't. The code is *completely* different. > > Alan DeKok. /In 2.1.11, I observed that the problem happens when you set "proxy_tunneled_request_as_eap = no" (with "default_eap_type = mschapv2"). Hence it seems the function mschap_postproxy() in rlm_eap_mschapv2.c is somehow wiping off the extra attributes. Comparing radiusd -X logs of 2.x with 3.x, corroborate this observation: -------------------------< snip-log 2.x >------------------------------- # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] Doing post-proxy callback [eap] Passing reply from proxy back into the tunnel. server proxy-inner-tunnel { [eap] Passing reply back for EAP-MS-CHAP-V2 # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/proxy-inner-tunnel +- entering group post-proxy {...} [eap] Doing post-proxy callback rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8e86e20 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. } # server proxy-inner-tunnel -------------------------< snip-end >------------------------------- -------------------------< snip-log 3.x >--------------------------- (8) # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default (8) group post-proxy { (8) - entering group post-proxy {...} (8) eap : Doing post-proxy callback (8) eap : Passing reply from proxy back into the tunnel. server proxy-inner-tunnel { (8) eap : Passing reply back for EAP-MS-CHAP-V2 (8) # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/proxy-inner-tunnel (8) group post-proxy { (8) - entering group post-proxy {...} (8) [eap] = noop (8) WARNING: Empty post-auth section. Using default return values. } # server proxy-inner-tunnel -------------------------< snip-end >------------------------------- In 3.x code, We are returning a RLM_MODULE_NOOP from eap_post_proxy() : 582 /* 583 * Just in case the admin lists EAP in post-proxy-type Fail. 584 */ 585 if (!request->proxy_reply) return RLM_MODULE_NOOP; But we are not doing so in 2.1.11 code. We call the MSCHAPv2 callback, i.e. mschap_postproxy(), which might be wiping off the attributes. So, my question is: will adding this code patch to 2.x code prudent to make it work ? Or we need to fix the mschapv2 handler itself : mschap_postproxy() in rlm_eap_mschapv2.c,so that it retains the extra attributes sent by the RADIUS home server ? Please advise. -- Thanks, Nitin.

3 8

Mac-Auth
by Paulo Maia 07 Jul '11

07 Jul '11

Hi Guys , Here is the thing , im trying to use Mac-Auth , I managed to get working using authorized-macs files , although i need to use a mysql table witch i already have with the ssid and mac-address fields and i need to add an operator to expired macs , coz i work at a college campus and students mac-addresses need to expire acording to their course period . Any ideas ? Thanks in advance .

7 11

password logging only for local users
by Meike Stone 07 Jul '11

07 Jul '11

Hello, we are using the freeradius server with authentication against ldap as "local database" and proxy and realms (IPASS) to authenticate users are not in our database. So is is possible, to disable the password logging only for the proxied request. The local requests are only users who got a temporary voucher. In case of failure, the helpdesk should use the log to check if the user did use the correct password. But the password for IPASS users should not be logged. If I disable the password logging in the detail section (suppress {User-Password}), the complete password logging will be disabled. Is it possible, to disable this selective? Thanks for help - Meike

1 0