February 2012 - Freeradius-Users - lists.freeradius.org

VMPS fallback vlan
by Walter Gould 10 Feb '12

10 Feb '12

All, I have FR vmps configured to query postgresql for a mac address and return the vlan that is assigned to it. That is working well. However, I would like to configure vmps to return a "fallback" or guest vlan for cases when a mac address is not in the database. Can anyone give me some suggestions or config examples? Thanks, Walter

3 3

Another LDAP/MSCHAPv2 problem
by Francois Gaudreault 10 Feb '12

10 Feb '12

Hi, I am trying to make PEAP working with an LDAP/Samba backend and MSCHAPv2. It works well for the user authentication (they have lm and nt stored in the LDAP). However, the machine auth is causing issues. It appears to have only the NT-Password stored in the LDAP. I thought it should be sufficient for the MSCHAP to handle the auth, is it? ldap] looking for check items in directory... [ldap] acctFlags -> SMB-Account-CTRL-TEXT == "[W ]" [ldap] userPassword -> Password-With-Header == "..." [ldap] ntPassword -> NT-Password == 0x34343446...242 [ldap] looking for reply items in directory... [ldap] user host/dti-dahport authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/packetfence-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Creating challenge hash with username: host/dti-dahport [mschap] Told to do MS-CHAPv2 for host/dti-dahport with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject My MSCHAP Config : mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes } Any thoughts? Thanks! -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

4 13

how to disable a particular EAP type in freeradius2 for a particular ESSID ?
by Riccardo Veraldi 10 Feb '12

10 Feb '12

Hello, I have a radius infrastructure with multiple ESSID. in particular I have the eduroam ESSID and another local ESSID. They are managed by my freeradius2 server with 2 virtual-server instances, one for eduroam and the other for my local ESSID. Both are 802.1x infrastructures. I have always been disabling EAP-TLS in my local infrastructure writing this in the users file DEFAULT EAP-Type == EAP-TLS, Auth-Type := Reject but now I need EAP-TLS to be avaliable for eduroam and I do not like the solution to have a completely different radius server, I wanted to do it with only one freeradius server with virtual server configuration. Thus I need to enable EAP-TLS for eduroam and disable EAP-TLS for my local SSID. How is possible to do this on freeradius2 ? After many attempts I could not figure out... thank you Rick

2 3

Receiving Pseudonym Identity for EAP-SIM
by Rami AlZaid 10 Feb '12

10 Feb '12

Hello, I have used the configuration in src/tests/eapsim-03 for the EAP-SIM setup and it seems to be working fine using v2.1.11 when using Nokia E71. On the other hand, when I use an iPhone (iOS 5.0.1) I'm always getting the Pseudonym Identity from the iPhone and thus it is not able to authenticate as there isn't anything matching in the users file. Once I add the pseudonym identity that the iPhone is sending to the users file to test the authentication everything works. I am, however, getting the following message after the first Access-Request from the iPhone and I'm guessing that this is the cause of it: rlm_eap: No EAP Start, assuming it's an on-going EAP conversation The following is the first Access-Request from the phone: rad_recv: Access-Request packet from host 10.10.5.13 port 33173, id=3, length=245 User-Name = "32d12973c32e1af77(a)wlan.mnc000.mcc000.3gppnetwork.org" NAS-IP-Address = 10.10.5.13 NAS-Port = 0 Called-Station-Id = "00-44-B0-55-BE-66:EAPSSID" Calling-Station-Id = "D0-33-DB-44-F1-55" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11g" EAP-Message = 0x0200003901234264346539373325383365316166333040776c616e286319633030322e6d6363343139abcde770706e6574776f726b2e6f1237 Message-Authenticator = 0x0a12341babcdec2651f01e2722abcde6 Anyone faced such problems? Also, anyone had any success with EAP-SIM and iPhone using freeradius? I would appreciate any help on this subject as I couldn't find anything in the archives. Thanks, -- R ~ ~ :wq!

2 1

Blocked user not disconnected for 12+ hours
by Christ Schlacta 09 Feb '12

09 Feb '12

I'm using WPA2-EAP-TLS to verify certificates, and matching certificates to accounts in LDAP to verify accounts are in good standing. This morning around 7AM local time I blocked an offending user from the wifi network by adding their account to the disabled-users group in the ldap directory. Until 7PM, I got no entries in my log specifying Login incorrect for the offending host until approximately 7PM. The client was able to connect and continue to access the network successfully the entire time. I also effectively kicked the user at the access point after setting the account to disabled. For over 12 hours the user account was able to continue to connect unhindered. Is there a setting in FreeRadius that would allow me to limit this time period, or is it a setting in my access point I would need to set? If no clear answer is available, I can attempt to determine an answer experimentally, but I'd prefer to have an absolute answer from someone knowledgeable.

4 5

Using radgroupcheck to reject user's login
by tonimanel 09 Feb '12

09 Feb '12

Hi, Do you know if is possible to reject a login with radgroupcheck? In latest versions of FreeRADIUS, if we want to reject a user's request that tries to do login with some attributes, we should to use radcheck because if we use radgroupcheck FreeRADIUS doesn't produce a reject. In radcheck we should to define all compulsary attributes, because if there are attributes into radgroupchek and not correspond with NAS' attributes, FreeRADIUS will continues checking other groups. I would like to know if any attribute doesn't correspond, if is possible, that FreeRADIUS rejects the request and doesn't continues checking other groups from radgroupcheck. We are interested in maintain radgroupcheck table with compulsary attributes (if is possible). Maybe changing some settings, can we achieve this? Thanks for your help. Best regards, Toni. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Using-radgroupcheck-to-reject-user-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 6

Rejecting login with radgroupcheck attributes
by tonimanel 09 Feb '12

09 Feb '12

Hi again, Sorry if this message gets doubled. I thought it had not been sent. I have been testing with the definition of DEFAULT Auth-Type := Reject in users file, but does not works. I don't know if I should to define this into another directive or in another file or in sql table. Now, I'm thinking in to define radgroupcheck's attributes directly into radcheck table and the same with radgroupreply's attributes because, I'm interested in reject a user if doesn't correspond with its group's attributes. Is this really the way to achieve this? Thanks and regards, Toni. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Rejecting-login-with-radgroupcheck-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

How to encrypt Passwords?
by Peter Moreton 09 Feb '12

09 Feb '12

I have a working Freeradius server with user information held in "/etc/raddb/users" in the form username Cleartext-Password = "ABCD" We have to store the passwords in some hashed or encrypted format and I'm posting the the list to ask how this is done. Can the 'users' file support ciphertext passwords? Or do we have to store our users in some SQL database? Thanks, Peter *************************************************************************************** The CBI's (Confederation of British Industry's) registered address is: Centre Point, 103 New Oxford Street, London WC1A 1DU Company number: RC000139

2 1

Re: Password change after expire with Cisco ASA to local FR user DB (text file) Not Working
by Will Richmond 09 Feb '12

09 Feb '12

thx all, i am stuck on this point now: mschap { passchange { local_cpw = "%{xlat:...} } Does there exist an "xlat:" that NT-hashs new cleartext password, deletes the change pass xtrl attribute in users file and then writes the new pass there? or am I going about this the wrong way? thx, Will -----Original Message----- From: Fajar A. Nugraha [mailto:list@fajar.net] Sent: Wednesday, February 8, 2012 12:42 PM To: will(a)bootit.com, 'FreeRadius users mailing list' Subject: Re: Password change after expire with Cisco ASA to local FR user DB (text file) Not Working On Thu, Feb 9, 2012 at 3:38 AM, Will Richmond <will(a)bootit.com> wrote: > Thx alan, I found/read read the docs, but still trying to determine this: Which config file contains this setting: > > To actually force a client to change passwords, you must set the expiry bit in the SMB-Account-Ctrl value - for example: > > update control { > # U == user > # e == expired > SMB-Account-Ctrl-Text := '[Ue]' > } > > and how can i control this on a per user basis in teh users file? IOW, i dont want to force everyone to change their password. so there must be some sort of per-user flag to configure in the users file? any attribute that you put in the control block should also be able to go into first line of users file (where you put Expiration earlier), or radcheck table. see "man 5 users" and doc/rlm_sql. -- Fajar

3 2

Sample Radius Accounting Data
by Christ Schlacta 08 Feb '12

08 Feb '12

I'm trying to find some sample accounting data from freeradius, preferably in a mysql database to run some test analyses on. I'm considdering using Freeradius + Mysql accounting in my environment, and don't have the infrastructure to generate test data, and would like to analyze some to see what useful metrics I can actually extract from it. If anyone here knows of some good sample data online (my searches have turned up nothing) or is willing to provide some in the form of a sanitized mysql dump, I'd much appreciate it and I'm sure others might as well :) Thanks in advance!

1 0