November 2012 - Freeradius-Users - lists.freeradius.org

Re: files Authentication problem
by Matthew Newton 26 Nov '12

26 Nov '12

On Mon, Nov 26, 2012 at 12:13:06PM +0100, alexdhelmet(a)free.fr wrote: > Thanks, it's working now. That's good. > I will try with PAP as soon as I have more time. There's nothing to try - your debug log shows that PAP is already being called (it's in be default), so all you need to to is remove the auth-type := local from your config. It will work exactly as it does now. Setting Auth-Type like this has been deprecated for *years*, and is only likely to cause you problems some time in the future. There are very few situations where it should be set manually. Matthew > >On Mon, Nov 26, 2012 at 08:17:21AM +0100, alexdhelmet(a)free.fr wrote: > >>Thanks for your answer. > >I've just re-read what you're doing - you're looking up the > >lowercase password in the users file instead of the username (e.g. > >you're ignoring the username), but then your password check > >is between User-Password and Cleartext-Password, as usual. > > > >Try something like this in your sites-enabled/default, after > >preprocess: > > > > update request { > > User-Password := "%{tolower:%{User-Password}}" > > } > > > >>But, at the moment, we must keep this Auth-Type, to be compatible > >>wirth an old version of freeradius, we couldn't update at the > >>moment. > >No, you still don't need it. The PAP module will do it for you - > >read the debug output. > > > >Matthew > > > >(waiting for 3.x so that Auth-Type := Local will actually break > >things at last). > > > > > > > >>>On Wed, Nov 21, 2012 at 09:01:22AM +0100, alexdhelmet(a)free.fr wrote: > >>>>"00c51180d29c" Auth-Type := Local, Cleartext-Password := "00c51180d29c" > >>>> Alcatel-Lucent-Auth-Group = 4 > >>>As the debug log says, Remove "Auth-Type := Local" from the above. > >>> > >>>Matthew > >>> > >>> > >>- > >>List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

1 0

files Authentication problem
by alexdhelmet＠free.fr 26 Nov '12

26 Nov '12

Hello, I have a problem of authentication with the files method. I am using freeradius: FreeRADIUS Version 2.1.10 I try to configure freeradius to have authentication with non-sensitive password and user. I am using ntradping to test my radius server. In both case, ++[files] returns ok , so it seems to be ok. But the client receive on ok, and one bad. See the output of freeradius -X NON-WORKING : the last C is in capital letter. ============= rad_recv: Access-Request packet from host 100.100.16.3 port 44994, id=1, length=57 User-Name = "00c51180d29c" User-Password = "00c51180d29C" Vendor-Specific = 0x383030 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [files] expand: %{User-Password} -> 00c51180d29C [files] expand: %{tolower:%{User-Password}} -> 00c51180d29c [files] users: Matched entry 00c51180d29c at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. Login incorrect: [00c51180d29c/00c51180d29C] (from client pc1461 port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 00c51180d29c attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds WORKING ========= rad_recv: Access-Request packet from host 100.100.16.3 port 45055, id=3, length=57 User-Name = "00c51180d29c" User-Password = "00c51180d29c" Vendor-Specific = 0x383030 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [files] expand: %{User-Password} -> 00c51180d29c [files] expand: %{tolower:%{User-Password}} -> 00c51180d29c [files] users: Matched entry 00c51180d29c at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request is correct. Login OK: [00c51180d29c/00c51180d29c] (from client pcXX port 0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 3 to 100.100.16.3 port 45055 Alcatel-Lucent-Auth-Group = 4 Finished request 3. Config of the files modules ==================== files { # The default key attribute to use for matches. The content # of this attribute is used to match the "name" of the # entry. #key = "%{Stripped-User-Name:-%{User-Name}}" usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users key = "%{tolower:%{User-Password}}" case_sensitive = no # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } Users file (all in lower letters) ======== "00c51180d29c" Auth-Type := Local, Cleartext-Password := "00c51180d29c" Alcatel-Lucent-Auth-Group = 4 Thanks for the help. Alexandre

2 3

Problem with freeradius + openldap for AP authentication
by Nicolas Lathiere 26 Nov '12

26 Nov '12

Hiya I need some help to configure freeradius with openldap. I have a ldap database which stores password in SSHA format, so i choose PAP for authentication. I want to use freeradius to authenticate on a netgear Wifi access point. (http://deployingradius.com/documents/protocols/compatibility.html) I've set up the AP in client freeradius in clients.conf, with a secret and shortname like in documentation. Next i've put auto_header = yes in pap.conf And uncomment the line ldap to activate module in /site-enable/default When i start server in debug mode, authorization works fine but server have problems to authentication step and i don't understand why Here is the debug comments : rad_recv: Access-Request packet from host 192.168.0.201 port 32774, id=85, length=169 User-Name = "cyril" NAS-IP-Address = 192.168.0.201 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "4C-60-DE-D2-22-61:easyBridge2" Calling-Station-Id = "7C-C5-37-14-16-C9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0200000e016e6c61746869657265 Message-Authenticator = 0x2bf3ec3446adc97ea15c4c160ee8b0bbThu Nov 22 15:04:36 2012 : Wed Nov 21 18:39:17 2012 : Info: [ldap] looking for reply items in directory... Wed Nov 21 18:39:17 2012 : Info: [ldap] user cyril authorized to use remote access Wed Nov 21 18:39:17 2012 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Wed Nov 21 18:39:17 2012 : Info: ++[ldap] returns ok Wed Nov 21 18:39:17 2012 : Info: ++[expiration] returns noop Wed Nov 21 18:39:17 2012 : Info: ++[logintime] returns noop Wed Nov 21 18:39:17 2012 : Info: [pap] Normalizing NT-Password from hex encoding Wed Nov 21 18:39:17 2012 : Info: [pap] Normalizing SSHA1-Password from base64 encoding Wed Nov 21 18:39:17 2012 : Info: [pap] Found existing Auth-Type, not changing it. Wed Nov 21 18:39:17 2012 : Info: ++[pap] returns noop Wed Nov 21 18:39:17 2012 : Info: Found Auth-Type = PAP Wed Nov 21 18:39:17 2012 : Info: +- entering group PAP {...} Auth: [pap] Attribute "Password" is required for authentication. Thu Nov 22 15:04:36 2012 : Info: ++[pap] returns invalid Thu Nov 22 15:04:36 2012 : Info: Failed to authenticate the user. Thu Nov 22 15:04:36 2012 : Auth: Login incorrect: [cyril/<via Auth-Type = PAP>] (from client WNAP320 port 0 cli 44-A7-CF-CD-C5-C7) Thu Nov 22 15:04:36 2012 : Info: Using Post-Auth-Type Reject Thu Nov 22 15:04:36 2012 : Info: +- entering group REJECT {...} Thu Nov 22 15:04:36 2012 : Debug: expand: %{User-Name} -> cyril Thu Nov 22 15:04:36 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 22 15:04:36 2012 : Info: ++[attr_filter.access_reject] returns updated Thu Nov 22 15:04:36 2012 : Info: Delaying reject of request 5 for 1 seconds Thu Nov 22 15:04:36 2012 : Debug: Going to the next request Thu Nov 22 15:04:36 2012 : Debug: Waking up in 0.9 seconds. Thu Nov 22 15:04:37 2012 : Info: Sending delayed reject for request 5

2 1

How to perform certain actions on Access Accept
by Shravan S G 25 Nov '12

25 Nov '12

Hi, I have configured FreeRadius to authenticate users based on entries in a Database. On successful authentication, an Access-Accept is returned. Now I want to send a message with some random content to another machine connected to the FreeRadius server, as soon as the user is authenticated. How can I configure some completely unrelated action like this, or say a file transfer to be performed on successful authentication of a user? Thanks in advance, Shravan

2 1

Re: Newbie question about rlm_exec usage
by Alan Buxey 24 Nov '12

24 Nov '12

What EAP type? eg if using PEAP, the client never sends a password, instead its challenge-response which works because the SQL contains a copy of the password so MSCHAP can derive an agreement. Gmhow dies your curl do this? Are you trying thus in the authenticate section and feeding an authorization method? radiusd -X is your and our friend alan

3 3

Duplicate NAS name
by Lorenzo Milesi 24 Nov '12

24 Nov '12

Hi. I'm performing some test upgrades from 1.1.x and ran into the nas table problem: in FR1 I had a list of NASes with duplicate names, maybe because we had several hotspots with different shortnames NAT'ed on the same ip. I see now FR complains at startup for duplicate name. How can I deal with such situation, where two nas share the same ip? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 2

Re: problem with test aaa-server in ciscoasa
by studyfordo 24 Nov '12

24 Nov '12

firstly, thanks Mathew Newton and alan buxey. I run freeradius -X and run test in ciso asa5520. details as follows. rad_recv: Access-Request packet from host 192.168.30.254 port 1025, id=72, length=61 User-Name = "tsb" User-Password = "123456" NAS-IP-Address = 192.168.30.254 NAS-Port = 64 NAS-Port-Type = Virtual # Executing section authorize from file /opt/freeadius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tsb", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /opt/freeadius/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tsb attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 72 to 192.168.30.254 port 1025 Waking up in 4.9 seconds. Cleaning up request 1 ID 72 with timestamp +430 Ready to process requests. I have add user such as following format cat users | sed -n '/^[^#]/p' tsb Cleartext-Password := "123456" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP So I still problem with user fomat in file users? pls give me some advice. thanks

2 1

Re: problem with test aaa-server in ciscoasa
by Alan Buxey 24 Nov '12

24 Nov '12

...oh, and make sure you are editing the CORRECT users file ;) alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Re: problem with test aaa-server in ciscoasa
by Alan Buxey 24 Nov '12

24 Nov '12

As previously mentioned, only add that user/pass to the users file... nothing else. Don't add all that stuff that you did alan

1 0

dhcp/bootp server filename
by Lev Bronshtein 23 Nov '12

23 Nov '12

FreeRadius 2.2.0 Redhat Linux 6.2 Please forgive me in advance if some of the things I say seem to be generalities and not per RFC, the firm where I work has recently decided to start using freeradius DHCP as DHCP server and I am the programmer/integrator/project lead for the entire thing. Our preliminary tests were very successful, we were able to hand out leases to various clients and also various options as well. However when it came to PXE Boot we sem to have run afoul of either my lack of knowledge or Microsoft going out of their way to "help" network admins. Here is the problem, as expected I have set option 66 -- DHCP-TFTP-Server-Name and option 67 DHCP-Boot-File-Name, however tge PXE boot process has not been completed and we get an error message PXE-E32 and according to this article http://www.bootix.com/support/problems_solutions/pxe_e32_tftp_open_timeout.… we have to set option 066 next server. However this is not what option 66 is. Looking at the tcp dump that was produced on the freeradius server I can see that "next server" field is the same as the "DHCP-Server-Identifier", and while changing this value to the one of the TFTP server also changed the next server field as expected it also broke dhcp. Also the people who have successfully booted their PXE hardware in the lab sent me a a pcap where clearly the next server and Identifier are clearly different and also the boot-file-name is set as well, where as in my pcap I only see it in the dhcp options not in boot options header (I must clarify at this point that I am using ethereal to decode and read packets). Which is why I am thinking that options 66 and 67 are not used for PXE boot, but microsoft dhcp seeing those options also takes care of backword compatibility, and so as far as everyone in windows land is concerned they need to set options 66 and 67. Can anyone help please? Regards, Lev Bronshtein P.S. I figured out that I ned to set both DHCP-Server-Identifier and DHCP-Server-IP-Address, which gave me the next-address. However I still can't figure out the boot file option

1 1