October 2012 - Freeradius-Users - lists.freeradius.org

rlm_exec
by Thomas Raabo - Zitcom A/S 10 Oct '12

10 Oct '12

Could you implement (minisqueeze) [~/work/smsotpd] ./pap_challenge_request.pl Enter username: directory\Administrator Enter password: server response type = Access-Challenge (11) Enter otp: 97350 server response type = Access-Accept (2) This sort of thing with rlm_exec? Med venlig hilsen | Best regards Thomas Raabo Senior Network Engineer CCIE #33466 _____________________________________________ tr(a)zitcom.dk | Direkte: +45 69 10 60 18 | Tlf.: +45 70 23 55 66

1 0

Re-transmits arriving via a different proxy / EAP duplicate detection
by Phil Mayers 10 Oct '12

10 Oct '12

All, Bit of an odd one here. Not sure where best to bring it up... if anyone has a more suitable discussion forum, please point me that way! As I iterate through our logging config, I'm gaining increasing visibility of all kinds of peculiar stuff. This one I spotted today - we are seeing remote RADIUS servers (eduroam visited sites) sending retransmits via different intermediate proxies. This goes wrong in two ways. First, the FreeRADIUS duplicate detect / retransmit logic doesn't apply because the source IP, shared secret, Proxy-State and Message-Authenticator are all different, even though all other attributes are identical. This is correct behaviour AFAICT from the RFCs. Second, because the retransmits aren't eaten by the duplicate detection, they arrive as real packets in the server core, but are rejected because the "State" attribute is no longer valid - this is because FR mutates "State" on every round-trip, mixing in the EAP type/id/exchange number. This latter (being reprocessed) is a problem two ways. The first is that these retransmits always generate a "reject" due to invalid "State". If the original "accept" was dropped (thereby causing the remote server to move to another intermediate proxy, and trigger this issue), we're effectively cancelling that "accept" and issuing a "reject". We're also generating a lot of logging and noise, though that's an internal problem. Does anyone have any thoughts on the matter? Absent RADIUS-over-TCP, this seems like a really tricky one... Cheers, Phil

3 3

Encode multiple sub-attributes in single vsa?
by Far.Runner 10 Oct '12

10 Oct '12

Hi, RFC2865 states "Multiple subattributes MAY be encoded within a single Vendor-Specific attribute, although they do not have to be." in section 5.26. Does Freeradius support this? if yes, how to enable it? F.R

5 9

Expired Active Directory Passwords & Wireless Authentication
by Jason Agress 10 Oct '12

10 Oct '12

Hi all, We're currently using Microsoft IAS for RADIUS on our Cisco managed wireless network. We do wireless logon on our clients, which requires the user to first authenticate to RADIUS to initiate the wireless connection, then authenticate against Active Directory to complete the login process. The problem we run into is when a user's password expires and RADIUS authentication is unsuccessful; since the wireless connection cannot be made, AD cannot be contacted to authenticate the user and, ideally, prompt to change the password. I've read lots about this problem with FreeRADIUS and have seen some implied solutions, but nothing concrete. So here's my question: With FreeRADIUS, is there a way to allow successful RADIUS authentication with an expired password? This way the AD login process can commence and the user can be prompted to change his/her password wirelessly. Thanks in advance!

3 2

store encypted passwords
by jon jon 10 Oct '12

10 Oct '12

Hello, I have set up FreeRADIUS Version 2.1.10 on an Ubuntu server 12.04, Mysql Server version: 5.5.24. Everything is up and running but the users passwords are stored in plain text in raddacct. I tried changing the attribute to Crypt-Password but it doesn't change anything. Do I need to make a change to a config file also? Not sure what type of encryption would be best one that works MD5? Thanks,

4 7

Re: Auth All and Logging
by Alan Buxey 10 Oct '12

10 Oct '12

Possible....but unlikely to get what you want if you are using EAP methods and wireless alan

1 0

Auth All and Logging
by Metcalf, David 10 Oct '12

10 Oct '12

Can freeradius be configured to authenticate all requests and only log the authentication attempts, including username and password in plain text.

2 1

Upgrade to 2.2.0
by Morris, Andi 10 Oct '12

10 Oct '12

I've just updated my freeradius servers from 2.1.7 to 2.1.12 via yum update and it worked like a charm, I'd always been a little nervous to do this until now. This has given me the confidence to look into upgrading the servers from the source files to get up to 2.2.0. Reading the README and the INSTALL file from within the tar.gz file I can see that I need to run ./configure make make install Firstly running ./configure failed because my server (CentOS 5.5) didn't have a C compiler installed. I installed GCC via yum, and on we go. Now the configure.log tells me I don't have make installed. I installed that via yum, and on we go. Now configure seems to be going along like the clappers, quicker than I can read the output to look for errors. I then ran make, which also seemed to go along just fine. Then make install, and likewise, nothing obviously wrong. However when I ran the service in debug mode I can see that it hasn't been touched by the installer and is still running version 2.1.12, and working. Looking back through and grepping config.log for 'error' I see the following: conftest.c:8:28: error: ac_nonexistent.h: No such file or directory conftest.c:8:28: error: ac_nonexistent.h: No such file or directory conftest.c:16: error: size of array 'off_t_is_large' is negative conftest.c:26: error: 'not' undeclared (first use in this function) conftest.c:26: error: (Each undeclared identifier is reported only once conftest.c:26: error: for each function it appears in.) conftest.c:26: error: expected ';' before 'big' | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. conftest.c:66:22: error: resource.h: No such file or directory conftest.c:33:22: error: resource.h: No such file or directory conftest.c:83:21: error: winsock.h: No such file or directory conftest.c:50:21: error: winsock.h: No such file or directory conftest.c:85:26: error: sys/security.h: No such file or directory conftest.c:52:26: error: sys/security.h: No such file or directory conftest.c:90:18: error: prot.h: No such file or directory conftest.c:57:18: error: prot.h: No such file or directory conftest.c:94:17: error: sia.h: No such file or directory conftest.c:61:17: error: sia.h: No such file or directory conftest.c:94:18: error: siad.h: No such file or directory conftest.c:61:18: error: siad.h: No such file or directory | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. conftest.c:102: error: void value not ignored as it ought to be conftest.c:109: error: 'struct utmpx' has no member named 'ut_xtime' | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. conftest.c:114: error: too many arguments to function 'ctime_r' I guess there's something here to show what's wrong? Is there any log created by make and make install? Do I need to specify an installation directory or does the code know where my existing installation is? Cheers in advance for any help. Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o'r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

7 11

v2.2
by David Peterson 09 Oct '12

09 Oct '12

I seem to be losing it today. How do I check out the 2.2 version from git? David

2 2

Outpairs not working on external script when user is located in MYSQL
by Thomas Raabo - Zitcom A/S 09 Oct '12

09 Oct '12

Need som help getting my external script to work Here is my External module exec MOTP { wait = yes program = "/etc/raddb/otpverify.sh %{User-Name} %{User-Password} %{reply:Secret} %{reply:Pin} %{reply:Offset}" input_pairs = request output_pairs = reply } >From radcheck (211, 'test', 'Pin', ':=', '0201'), (212, 'test', 'Secret', ':=', '43ab97e05b3a11cb'), (213, 'test', 'Offset', ':=', '0'), (214, 'test', 'Auth-Type', ':=', 'External'); Output from debug. rad_recv: Access-Request packet from host 172.16.24.4 port 38043, id=190, length=74 User-Name = "test" User-Password = "ce3e3e3ebdbf" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 Message-Authenticator = 0x3492fb805715bd7da5ec0371282f71b5 Mon Oct 8 23:52:57 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group authorize {...} Mon Oct 8 23:52:57 2012 : Info: ++[preprocess] returns ok Mon Oct 8 23:52:57 2012 : Info: ++[chap] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[mschap] returns noop Mon Oct 8 23:52:57 2012 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Mon Oct 8 23:52:57 2012 : Info: [suffix] No such realm "NULL" Mon Oct 8 23:52:57 2012 : Info: ++[suffix] returns noop Mon Oct 8 23:52:57 2012 : Info: [eap] No EAP-Message, not doing EAP Mon Oct 8 23:52:57 2012 : Info: ++[eap] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[unix] returns notfound Mon Oct 8 23:52:57 2012 : Info: ++[files] returns noop Mon Oct 8 23:52:57 2012 : Info: [sql] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [sql] sql_set_user escaped user --> 'test' Mon Oct 8 23:52:57 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] User found in radcheck table Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'test' ORDER BY priority Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT groupname FROM usergroup WHERE username = 'test' ORDER BY priority Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] User found in group test Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Mon Oct 8 23:52:57 2012 : Info: ++[sql] returns ok Mon Oct 8 23:52:57 2012 : Info: ++[expiration] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[logintime] returns noop Mon Oct 8 23:52:57 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Oct 8 23:52:57 2012 : Info: ++[pap] returns noop Mon Oct 8 23:52:57 2012 : Info: Found Auth-Type = External Mon Oct 8 23:52:57 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group External {...} Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Password} -> ce3e3e3ebdbf Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Secret} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Pin} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Offset} -> Mon Oct 8 23:52:57 2012 : Debug: Exec-Program output: FAIL Mon Oct 8 23:52:57 2012 : Debug: Exec-Program-Wait: plaintext: FAIL Mon Oct 8 23:52:57 2012 : Debug: Exec-Program: returned: 13 Mon Oct 8 23:52:57 2012 : Info: ++[MOTP] returns fail Mon Oct 8 23:52:57 2012 : Info: Failed to authenticate the user. Mon Oct 8 23:52:57 2012 : Info: Using Post-Auth-Type Reject Mon Oct 8 23:52:57 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group REJECT {...} Mon Oct 8 23:52:57 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Oct 8 23:52:57 2012 : Info: ++[attr_filter.access_reject] returns updated Mon Oct 8 23:52:57 2012 : Info: Delaying reject of request 0 for 1 seconds Mon Oct 8 23:52:57 2012 : Debug: Going to the next request Mon Oct 8 23:52:57 2012 : Debug: Waking up in 0.9 seconds. Mon Oct 8 23:52:58 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 190 to 172.16.24.4 port 38043 Mon Oct 8 23:52:58 2012 : Debug: Waking up in 4.9 seconds. As you can see it dosent seem to get the reply vars Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Password} -> ce3e3e3ebdbf Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Secret} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Pin} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Offset} -> In /usr/share/freeradius/dictionary I have $INCLUDE dictionary.motp And from my Dictionary.motp # ATTRIBUTE Secret 960 string ATTRIBUTE Pin 961 string ATTRIBUTE Offset 962 string All my configuration is based on http://nicoblog.goralski.fr/tag/Radius Med venlig hilsen | Best regards Thomas Raabo Senior Network Engineer CCIE #33466 _____________________________________________ tr(a)zitcom.dk | Direkte: +45 69 10 60 18 | Tlf.: +45 70 23 55 66

3 3