October 2012 - Freeradius-Users - lists.freeradius.org

MAC authorization with rlm_sql not working
by Stefano Zanmarchi 11 Oct '12

11 Oct '12

Hi, our Freeradius is working fine with PEAP (NT hash passwords stored in Openldap). We'd like to add MAC authorization using Mysql: only people with MAC contained in radcheck should have access (provided they also type in the right password!). Radcheck has only one entry: +----+----------------------------+--------------------+----+-------------------+ | id | username | attribute | op | value | +----+----------------------------+--------------------+----+-------------------+ | 1 | uto.ughi(a)studenti.unipd.it | Calling-Station-Id | == | 98-4B-4A-F5-BF-40 | +----+----------------------------+--------------------+----+-------------------+ The problem is that uto.ughi(a)studenti.unipd.it gets an AccessAccept packet, regardless of his Calling-Station-Id. Don't know if it's related but strangely (to me) when uto.ughi(a)studenti.unipd.it has Calling-Station-Id 98-4B-4A-F5-BF-40 (the one in radcheck) radiusd performs this sql query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'uto.ughi(a)studenti.unipd.it' ORDER BY id and the radiusd -X output shows "[sql] User found in radcheck table" Same user, different Calling-Station-Id (73-1C-5C-B4-E0-55, not the one in radcheck), shows "[sql] User uto.ughi(a)studenti.unipd.it not found." Still, in both cases the user gets an AccessAccept packet. I can't see what I'm doing wrong, any help would be greaty appreciated! I enclose these files: - sites-enabled/eduroam-inner-tunnel - sites-enabled/eduroam - eap.conf Attached is the output of radiusd -X when uto.ughi(a)studenti.unipd.it is accessing with Calling-Station-Id 73-1C-5C-B4-E0-55, not present in radcheck. [eduroam-inner-tunnel file]: server eduroam-inner-tunnel { authorize { auth_log eap sql openldap mschap } authenticate { ntlm_auth Auth-Type MS-CHAP { mschap } eap } post-auth { reply_log Post-Auth-Type REJECT { reply_log } } } [sites-enabled/eduroam file]: server eduroam { authorize { auth_log suffix eap { ok = return } } authenticate { ntlm_auth eap } preacct { suffix } accounting { } post-auth { reply_log Post-Auth-Type REJECT { reply_log } } pre-proxy { pre_proxy_log if (Packet-Type != Accounting-Request) { attr_filter.pre-proxy } } post-proxy { post_proxy_log attr_filter.post-proxy } } [/etc/raddb/eap.conf]: eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = klabssrlviasalgari17 private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = /dev/urandom fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } ttls { default_eap_type = gtc copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" } mschapv2 { } }

2 3

Authentification Problem with Cisco AP, freeradius and LDAP
by Florian Arenz 11 Oct '12

11 Oct '12

Hello, i have got a realy annoing authentification problem and i would be glad if you could help me. I use a Cisco Aironet 1130ag Access Point, the radius-server is a Debian Squeeze (6.0.5) and i installed FreeRadius Version 2.1.10 from the packet sources. After i made some changes to the /etc/freeradius/modules/ldap to let my radius know where the LDAP is and some other things it looks like this: ----------> /etc/freeradius/modules/ldap ldap { server = 172.26.100.1 identity = "uid=binduser,cn=users,ou= Infrastruktur,dc=tarent,dc=de" password = xxxxxxxx basedn = "dc=tarent,dc=de" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=posixAccount)" groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" # groupmembership_attribute = radiusGroupName groupmembership_attribute = WLAN # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes dictionary_mapping = /etc/freeradius/ldap.attrmap password_attribute = CleartextPassword set_auth_type = yes } when i start the freeradius with freeradius -X this is the output i get: FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 11 2012 at 17:06:46 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client man-netz { ipaddr = 10.10.20.0 netmask = 23 require_message_authenticator = no secret = "testing123" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes } Module: Linked to module rlm_ldap Module: Instantiating module "ldap" from file /etc/freeradius/modules/ldap ldap { server = "172.26.100.1" port = 389 password = "AhRohr7Z" identity = "uid=binduser,cn=users,ou=Infrastruktur,dc=tarent,dc=de" net_timeout = 10 timeout = 20 timelimit = 20 tls_mode = no start_tls = no tls_require_cert = "allow" basedn = "dc=tarent,dc=de" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=posixAccount)" password_attribute = "CleartextPassword" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(&(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}}))" groupmembership_attribute = "WLAN" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/freeradius/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP userPassword mapped to RADIUS Password-With-Header rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x1c6dbf0 Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" private_key_password = "3TBR4yYD1ok1Ki5H" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = yes check_cert_cn = "%{User-Name}" cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = yes } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_always Module: Instantiating module "fail" from file /etc/freeradius/modules/always always fail { rcode = "fail" simulcount = 0 mpp = no } } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = * port = 1645 } listen { type = "acct" ipaddr = * port = 1646 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address * port 1645 Listening on accounting address * port 1646 Ready to process requests. I dont see any critical errors so i tried the radtest command. ------ radtest -x testuser password123 127.0.0.1 10 testing123 Sending Access-Request of id 247 to 127.0.0.1 port 1812 User-Name = "testuser" User-Password = "password123" NAS-IP-Address = 10.10.20.36 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=247, length=20 ------- radius output: rad_recv: Access-Request packet from host 127.0.0.1 port 58762, id=247, length=58 User-Name = "testuser" User-Password = "password123" NAS-IP-Address = 10.10.20.36 NAS-Port = 10 # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for whaeri [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> testuser [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser) [ldap] expand: dc=tarent,dc=de -> dc=tarent,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 172.26.100.1:389, authentication 0 [ldap] bind as uid=binduser,cn=users,ou=Infrastruktur,dc=tarent,dc=de/xxxxxxxxx to 172.26.100.1:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=tarent,dc=de, with filter (uid=testuser) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}$1$l4Je/bMr$IEKzWS2SQ78eEfM/a6VB7/" [ldap] looking for reply items in directory... [ldap] Setting Auth-Type = LDAP [ldap] user whaeri authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = LDAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group LDAP {...} [ldap] login attempt by "testuser" with password "password123" [ldap] user DN: uid=whaeri,cn=users,dc=tarent,dc=de [ldap] (re)connect to 172.26.100.1:389, authentication 1 [ldap] bind as uid=testuser,cn=users,dc=tarent,dc=de/password123 to 172.26.100.1:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] user testuser authenticated succesfully ++[ldap] returns ok Login OK: [testuser] (from client localhost port 10) # Executing section post-auth from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group post-auth {...} ++? if (!(Ldap-Group == WLAN)) [ldap] Entering ldap_groupcmp() expand: dc=tarent,dc=de -> dc=tarent,dc=de expand: %{Stripped-User-Name} -> ... expanding second conditional expand: %{User-Name} -> whaeri expand: (&(objectClass=posixGroup)(memberUid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=testuser)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=tarent,dc=de, with filter (&(cn=WLAN)(&(objectClass=posixGroup)(memberUid=testuser))) rlm_ldap::ldap_groupcmp: User found in group WLAN [ldap] ldap_release_conn: Release Id: 0 ?? Evaluating (Ldap-Group == WLAN) -> TRUE ? Converting !TRUE -> FALSE ++? if (!(Ldap-Group == WLAN)) -> FALSE Sending Access-Accept of id 247 to 127.0.0.1 port 58762 Finished request 0. Going to the next request I am very happy to see that my request was accepted, so i configured my Cisco Access Point so i could access the w-lan with my mobile phone or my linux laptop. ----- Login attempt with eap tls rad_recv: Access-Request packet from host 10.10.20.43 port 1645, id=134, length=151 User-Name = "farenz" Framed-MTU = 1400 Called-Station-Id = "001b.8f8a.ac30" Calling-Station-Id = "1cb0.9475.d65a" Service-Type = Login-User Message-Authenticator = 0x5dfdd286bcfbe2d2ec991382dfdb612a EAP-Message = 0x02020006030d NAS-Port-Type = Wireless-802.11 NAS-Port = 335 NAS-Port-Id = "335" State = 0x8775567a8777525d448a92d78bfaa32e NAS-IP-Address = 10.10.20.43 NAS-Identifier = "ap-bn-test" # Executing section authorize from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [ldap] performing user authorization for farenz [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> farenz [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=farenz) [ldap] expand: dc=tarent,dc=de -> dc=tarent,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=tarent,dc=de, with filter (uid=farenz) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{crypt}$1$wNTQUAjn$f0ragZNFWuArJ3FMbA2WW1" [ldap] looking for reply items in directory... [ldap] user farenz authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/inner-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/tls [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 134 to 10.10.20.43 port 1645 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8775567a86765b5d448a92d78bfaa32e Finished request 4. Going to the next request Near the end the Radius output says: > [tls] Requiring client certificate Then i've read http://deployingradius.com/documents/configuration/eap.htmlbut i cant finde such a Validate Server Certificate option to uncheck. Now even if i am able to create a good certificate, i had to deploy it on about 500 Computers. Is it possible to use freeradius without such certificates? And if not, you might show me how to create a certificate and get this server running? Thank you in advance. With best regards, Florian

1 0

(no subject)
by Andrew Precht 10 Oct '12

10 Oct '12

Hi users, I've setup a new virtual FR 2.1.12 server on centos6. I have got the new server setup per the docs at freeradius.org. Radtest locally and NtradPing remotely are working. Now, I need FR to use a Perl script to authenticate against a proprietary DB. I have put in a bit of time researching how to use the Perl module. But, as a newbie to FR I can't seem to find any step-by-step documentation to use the Perl module. Could someone point me to such documentation? Here is the script that the old FR 1.13-1.6.el5 was using, I need this to run on the new FR server. sub authenticate { my $logfile = "/dev/null"; my $date = `/bin/date`; chomp $date; my $url = "http://ProprietaryServer.PropritartyIssue.Bad:4500/PATRONAPI/" . $RAD_REQUEST{'User-Name'} . "/" . $RAD_REQUEST{'User-Password'} . "/pintest"; my $output = get($url); # For debugging purposes only # &log_request_attributes; if ($output =~ /RETCOD=0/) { `echo "$date : SUCCESS $RAD_REQUEST{'User-Name'} - $RAD_REQUEST{'User-Password'}" >> $logfile`; $RAD_REPLY{'Reply-Message'} = "Success"; return RLM_MODULE_OK; } else { `echo "$date : FAIL $RAD_REQUEST{'User-Name'} - $RAD_REQUEST{'User-Password'}" >> $logfile`; $RAD_REPLY{'Reply-Message'} = "Denied access by RADIUS"; return RLM_MODULE_REJECT; } } Any help is appreciated...

4 8

freeradius force authentication reject for some users?
by Eero Volotinen 10 Oct '12

10 Oct '12

Hi List, I am using radius based otp ubikey authentication like this: http://www.linuxforu.com/2011/08/setip-two-factor-authentication-using-open… is there nice way to reject some users? just want to reject radius authentication for user foo. this user has account on otp, but want to reject all authentication attempts on radius? is there option to force-reject-authentication for user foo2,foo3? on freeradius? thanks, -- Eero

1 0

Re: No Realm in table radacct
by Alan Buxey 10 Oct '12

10 Oct '12

A quick guess, your mysql user-name is set to be stripped-user-name? Check sql.conf and dialup.conf alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Re: your mail
by Alan Buxey 10 Oct '12

10 Oct '12

Return rlm_module_updated alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

2 1

Force a freeradius proxy server to parse users file to append AV Pairs to reply
by Gianni Costanzi 10 Oct '12

10 Oct '12

Hi, I have the following setup: (A) CLIENT ROUTER <---> (B) Freeradius 2.2.0 <--> (C) Other radius server I configured a realm on (B) to proxy requests toward radius server (C). For example, the realm is XYZ and the user is USER, so when on router (A) USER@XYZ tries to authenticate, (B) proxies the request sending user USER with the given password to (C). Then (C) replies to (B), which forwards the reply back to (A), WITHOUT looking at the users file, where I've defined the following: USER Auth-Type = System Service-Type = Administrative-User In fact, the user privileges are not returned back to the router (A). I've tried also to ad the non-stripped user to the users file without luck: USERXYZ Auth-Type = System Service-Type = Administrative-User How and where should I configure the post_proxy section in order to tell to (B) when you get replies from (C) for a particular realm then look at your users file to append attributes to the reply? Thanks in advance for any help. Gianni -- -------------------------------------------------------------------------------------------------------------- | Gianni Costanzi (gianni.costanzi(a)gmail.com) | http://it.linkedin.com/in/giannicostanzi | http://utenti.multimania.it/giannicostanzi/my-projects.html | | My Fotoblog: | http://giannicostanzi.fotoblog.it --------------------------------------------------------------------------------------------------------------

1 0

.rpmnew files during RPM upgrade
by Jonathan Gazeley 10 Oct '12

10 Oct '12

I rolled and deployed an RPM of FreeRADIUS 2.2.0. As expected for RPM packages, it left a number of *.rpmnew files in /etc/raddb. Trouble is, FreeRADIUS reads these files as live configs and was unable to start after the upgrade, until I had manually intervened and deleted the .rpmnew files. This isn't a new issue, I found this old thread in the archive: http://lists.freeradius.org/pipermail/freeradius-users/2008-December/033694… It seems to me that the "broken" behaviour is not with RPM but with FreeRADIUS. Can the regular expression that includes config files and modules be tweaked to exclude *.rpmnew files? It would be nice if an automated package management system didn't require manual intervention to ensure that a critical service keeps running upon upgrade. If I hadn't rolled my own RPM, I would eventually have received an overnight update from CentOS, and my RADIUS servers would have remained broken until the morning. That's something I'd rather avoid, and something a lot of other admins would run into as well. I don't really know much C but I looked at the source code. Blacklisting specific file suffixes seems like a bad way to do it, but I suppose it's too late now to insist that all config files end with .conf. Any other ideas? Thanks, Jonathan

6 8

Re: Expired Active Directory Passwords & Wireless Authentication
by Jason Agress 10 Oct '12

10 Oct '12

Will that allow successful RADIUS authentication - and, therefore wireless access - before the password change is initiated? Because our clients are Macs that won't prompt for password change until after they are connected to the wireless and authenticating against AD. Alan DeKok Wrote: Jason Agress wrote: > I've read lots about this problem with FreeRADIUS and have seen some > implied solutions, but nothing concrete. So here's my question: With > FreeRADIUS, is there a way to allow successful RADIUS authentication > with an expired password? This way the AD login process can commence and > the user can be prompted to change his/her password wirelessly. Use the git "master" branch. It supports changing passwords via PEAP. See raddb/mods-available/mschap Alan DeKok.

3 3

Re: Expired Active Directory Passwords & Wireless Authentication
by Alan Buxey 10 Oct '12

10 Oct '12

No. You cannot do a successful auth against an incorrect password as you haven't got agreement from both ends and therefore no keying material required for WPA-RADIUS...therefore no key for the wireless association. Password change can only be performed INSIDE the PEAP negotiation. As has already been said, latest version already supports this...some clients do to. alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2