March 2012 - Freeradius-Users - lists.freeradius.org

RE: Windows 7 prompting several times
by Aman Arneja 06 Mar '12

06 Mar '12

Hi guys I am from the Microsoft EAP team, and we have not seen this issue. Can you please send the following logs to me for investigating at aman.arneja(a)microsoft.com >From an elevated command prompt : Netsh ras set tr * en <run scenario> Netsh ras set tr * di Also, you can consider me a Microsoft contact for authentication related issues. Thanx Aman Arneja Sent from my Windows Phone From: Francois Gaudreault Sent: 06-Mar-12 3:59 AM To: freeradius-users(a)lists.freeradius.org Subject: Re: Windows 7 prompting several times Hi Andi, I did see the behavior, and it appears to be a bug with the windows supplicant. Apparently, the credentials are not even passed to the EAP module to initiate the session with the NAS... We do not have any kind of contact at Microsoft to open a bug, so I believe you are stuck with those issues :S On 12-03-05 11:16 AM, Morris, Andi wrote: > Hi all, > > Apologies for being slightly off topic. > > Does anyone else get a problem with Windows 7 clients prompting for the > radius credentials 2 or 3 times before finally accepting them? No errors > are shown on the radius side, and I’ve read that this is a problem with > the operating system, but wondered whether anyone in this knowledgeable > community had overcome this? > > Cheers, > > Andi > > ------------------------------------------------------------------------ > > >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan > University. From the 6th December 2011, as part of this change, all > email addresses which included @uwic.ac.uk have changed to > @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University > will now be sent from the new @cardiffmet.ac.uk address. *Please could > you ensure that all of your contact records and databases are updated to > reflect this change.* Further information can be found on the website > here. <http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org) - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 3

RFC2661
by Joe Holden 06 Mar '12

06 Mar '12

Hi guys, Forgive me if I've missed something blatantly obvious here, but is there a TX/RX speed RADIUS attribute to match the L2TP AVP? Can't find anything that suggests there is - if not, is it best to implement my own vendor attribute or reuse an existing "standard" attribute? Thanks, J

2 2

Re: LDAP (POSIX attibutes) password expiry
by up＠3.am 06 Mar '12

06 Mar '12

> On 28/02/12 21:16, up(a)3.am wrote: >> However, we just noticed that password expiry isn't working. I suspect this is because we are still using all the original POSIX attributes and none of them look >> like good for mapping to the ones supplied by FreeRADIUS. I see: checkItem Expiration radiusExpiration Our LDAP attributes use the following POSIX attributes to determine expiry: shadowMax: 90 >> shadowLastChange: 15215 > > Other replies should have convinced you that there's no built-in support for this. You will need to either: > > 1. Arrange for a FreeRADIUS-ready "radiusExpiration" attribute to be > set in LDAP alongside the POSIX/shadow schemas > > 2. Synthesize an Expiration attribute, or otherwise locally check the > POSIX/shadow attributes. > > > One way you might accomplish the 2nd is as follows: > > == Create some local RADIUS attributes for the shadow values == > > /etc/raddb/dictionary: > > ATTRIBUTE Shadow-Max-Age 3000 integer > ATTRIBUTE Shadow-Last-Change 3001 integer > ATTRIBUTE Shadow-Expires 3002 integer > ATTRIBUTE Shadow-Current 3003 integer > > /etc/raddb/ldap.attrmap: > > checkItem Shadow-Max-Age shadowMax > checkItem Shadow-Last-Change shadowLastChange > > == Read these attributes from LDAP, then perform some maths == > > /etc/raddb/sites-enabled/<server>: > > authorize { > ... > ldap > update control { > Shadow-Expires := "%{expr:%{control:Shadow-Last-Change} + > %{control:Shadow-Max-Age}}" > Shadow-Current := "%{expr:%l / 86400}" > } > if (control:Shadow-Current > control:Shadow-Expires) { > reject > } > ... > } > > Hopefully it's clear what this does, but basically: > > 1. Pulls last-change & max-age from LDAP > 2. Adds them together, to get expiry (in days since epoch) > 3. Divides %l (epoch) by 86400 to get today, in days since epoch 4. Compares them > - It looks to me like it should do all of those things swimmingly...however, I am running into an issue that looks like it might be because we run redundant LDAP servers. I put your 'update control' here, in the authorize : redundant LDAP{ ldap1 ldap2 update control {<ETC> } } The above allows us to define two LDAP servers in radiusd.conf. Debug shows this error: /usr/etc/raddb/sites-enabled/default[76]: redundant sections cannot contain a "update" statement /usr/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. I see in man unlang that "redundant" can only contain a list of modules. If that's the case, either these two things won't work together, or I am trying to put it in the wrong place. If I try to uncomment the "ldap" module further down in the authorize section I get "Failed to load module "ldap" (can post entire debug if necessary).

3 2

FYI: Logging Access Accept & Reject messages using linelog module
by Peter Lambrechtsen 06 Mar '12

06 Mar '12

I was trying to get linelog to log a CSV style log file with the Access Accept and Reject messages for auditing purposes. Took a while to see that the "Access-Reject" verb doesn't work in the modules/linelog file, it only ever uses the Access-Request since all the requests are Access-Request messages. So I had to log the %{reply:Packet-Type} So this is what I did in the end in the linelog module file: Access-Request = "\"%S\",\"%{reply:Packet-Type}\",\"%{Packet-Src-IP-Address}\",\"%{NAS-IP-Address}\",\"%{Client-Shortname}\",\"%{User-Name}\"" Then I updated the post-auth section of the default file to include the linelog module in both the main and the Post-Auth-Type REJECT to log the Access-Reject messages too. post-auth { * linelog* Post-Auth-Type REJECT { * linelog* reject } And I get this in the linelog file. "2012-03-06 20:40:02","Access-Accept","192.168.1.2","192.168.1.2","APP","Peter" "2012-03-06 20:40:46","Access-Reject","192.168.1.2","192.168.1.2","APP","Peter" Which is what we needed to have logged. Hope it helps someone else. Cheers Peter

1 0

RE: using windows 8's builtin eap-ttls w/ freeradius
by Aman Arneja 05 Mar '12

05 Mar '12

Hi Alan I am from the Microsoft EAP team for windows 8 , if you face any issues or need clarity on any of our features please feel free to email me at aman.arneja(a)microsoft.com BTW we have tested our TTLS with freeradius successfully ! also thanx for the feedback I am processing it and will reply to you in a bit about it. Please feel free to email me on any Win8 authentication related issues/feedback. We have an interesting auto discoverability feature as well in our client , where if the profile has not been created we detect the method on the basis of credential type and a few more parameters. Also for Tls there is a new cert filtering mechanism. We also now support connecting to a server in peap if we do not have the root cert , by throwing a warning ( this is configurable of course ) We would love your feedback on these as well ! Thanx Aman Arneja Sent from my Windows Phone From: Alan Buxey Sent: 06-Mar-12 1:54 AM To: FreeRadius users mailing list Subject: Re: using windows 8's builtin eap-ttls w/ freeradius hi, right. interesting. I've just been looking into Windows 8 and I found that if I chose a non-EAP method with TTLS (eg PAP or MSCHAP) then it didnt work. but if I chose an EAP method with TTLS - eg EAP-MSCHAPv2 then it worked fine. so more needs to be looked at there. based on the UI it seems that theres 2 groups of people coding the stuff as the PEAP interface has updated options and layout - whereas the TTLS page is based on the old windows XP PEAP pane - from layout/options. its a little hideous. importing of CAs has changed again - since Win7 - the auto detect for cert import now puts it into the wrong place again...but manually choosing the store and choosing Root CAs gets it in the very small list of CAs that Win8 knows... it seems you can choose whatever you want for the anonymous ID in TTLS too - whereas the PEAP anonymous is more conservative. ..and none of this can be done via the new 'metro' interface....yes, its funky and looks pretty but once again, it doesnt show you much detail when you hover over the wireless - signal strength bars, encyption and 802.11n - so what about channel or SNR? couldnt find an obvious 'disconnect' option in the interface either...but it did take me a minute or 2 to find the 'shutdown/reset' option! ;-) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

ntlm_auth works but not radtest
by Scott McLane Gardner 05 Mar '12

05 Mar '12

I'm attempting to follow the guide at http://deployingradius.com/ Things were going very well until I tried to set up Active Directory authentication. Testing with ntlm_auth, I get a success: $ ntlm_auth --request-nt-key --domain=MYDOMAIN --username=myuname --password=mypass NT_STATUS_OK: Success (0x0) But when I test with radtest it fails. I'm not sure I understand all of the debug output, but I thnk maybe it has to do with it thinking the realm is NULL. I have set it up in both smb.conf and krb5.conf as well as in the mschap module of freeradius. I am using freeradius version 2.1.10 on Ubuntu 11.10. Here's the output from the command line as well as the debug output: $ radtest -t mschap myuname mypass localhost 0 testing123 Sending Access-Request of id 99 to 127.0.0.1 port 1812 User-Name = "myuname" NAS-IP-Address = <mynasip> NAS-Port = 0 MS-CHAP-Challenge = 0xb89b59d41385c67c MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003edd0cff110926a15d402 f5204078f2d78d908e773c3a9c6 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=99, length=20 rad_recv: Access-Request packet from host 127.0.0.1 port 42379, id=209, length=115 User-Name = "myuname" NAS-IP-Address = <mynasip> NAS-Port = 0 MS-CHAP-Challenge = 0x09d5dfb63fba5357 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000000704b6897326b27adb243 658c300fcd922f008014ee7e25b Mon Mar 5 14:45:54 2012 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Mon Mar 5 14:45:54 2012 : Info: +- entering group authorize {...} Mon Mar 5 14:45:54 2012 : Info: ++[preprocess] returns ok Mon Mar 5 14:45:54 2012 : Info: ++[chap] returns noop Mon Mar 5 14:45:54 2012 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Mon Mar 5 14:45:54 2012 : Info: ++[mschap] returns ok Mon Mar 5 14:45:54 2012 : Info: ++[digest] returns noop Mon Mar 5 14:45:54 2012 : Info: [suffix] No '@' in User-Name = "myuname", looking up realm NULL Mon Mar 5 14:45:54 2012 : Info: [suffix] No such realm "NULL" Mon Mar 5 14:45:54 2012 : Info: ++[suffix] returns noop Mon Mar 5 14:45:54 2012 : Info: [eap] No EAP-Message, not doing EAP Mon Mar 5 14:45:54 2012 : Info: ++[eap] returns noop Mon Mar 5 14:45:54 2012 : Info: ++[files] returns noop Mon Mar 5 14:45:54 2012 : Info: ++[expiration] returns noop Mon Mar 5 14:45:54 2012 : Info: ++[logintime] returns noop Mon Mar 5 14:45:54 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Mar 5 14:45:54 2012 : Info: ++[pap] returns noop Mon Mar 5 14:45:54 2012 : Info: Found Auth-Type = MSCHAP Mon Mar 5 14:45:54 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Mon Mar 5 14:45:54 2012 : Info: +- entering group MS-CHAP {...} Mon Mar 5 14:45:54 2012 : Info: [mschap] Told to do MS-CHAPv1 with NT-Password Mon Mar 5 14:45:54 2012 : Info: [mschap] expand: %{Stripped-User-Name} -> Mon Mar 5 14:45:54 2012 : Info: [mschap] ... expanding second conditional Mon Mar 5 14:45:54 2012 : Info: [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details Mon Mar 5 14:45:54 2012 : Info: [mschap] expand: %{User-Name:-None} -> myuname Mon Mar 5 14:45:54 2012 : Info: [mschap] expand: --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} -> --username=myuname Mon Mar 5 14:45:54 2012 : Info: [mschap] No NT-Domain was found in the User-Name. Mon Mar 5 14:45:54 2012 : Info: [mschap] expand: %{mschap:NT-DOMAIN} -> Mon Mar 5 14:45:54 2012 : Info: [mschap] ... expanding second conditional Mon Mar 5 14:45:54 2012 : Info: [mschap] expand: --domain=%{%{mschap:NT-DOMAIN}:-MYDOMAIN} -> --domain=MYDOMAIN Mon Mar 5 14:45:54 2012 : Info: [mschap] mschap1: 09 Mon Mar 5 14:45:54 2012 : Info: [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=09d5dfb63fba5357 Mon Mar 5 14:45:54 2012 : Info: [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=0704b6897326b27adb243658c300fcd922f008014ee7e25b Mon Mar 5 14:45:55 2012 : Debug: Exec-Program output: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly. (0xc0000022) Mon Mar 5 14:45:55 2012 : Debug: Exec-Program-Wait: plaintext: winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on /var/run/samba/winbindd_privileged are set correctly. (0xc0000022) Mon Mar 5 14:45:55 2012 : Debug: Exec-Program: returned: 1 Mon Mar 5 14:45:55 2012 : Info: [mschap] External script failed. Mon Mar 5 14:45:55 2012 : Info: [mschap] MS-CHAP-Response is incorrect. Mon Mar 5 14:45:55 2012 : Info: ++[mschap] returns reject Mon Mar 5 14:45:55 2012 : Info: Failed to authenticate the user. Mon Mar 5 14:45:55 2012 : Info: Using Post-Auth-Type Reject Mon Mar 5 14:45:55 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Mon Mar 5 14:45:55 2012 : Info: +- entering group REJECT {...} Mon Mar 5 14:45:55 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> myuname Mon Mar 5 14:45:55 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Mar 5 14:45:55 2012 : Info: ++[attr_filter.access_reject] returns updated Mon Mar 5 14:45:55 2012 : Info: Delaying reject of request 0 for 1 seconds Mon Mar 5 14:45:55 2012 : Debug: Going to the next request Mon Mar 5 14:45:55 2012 : Debug: Waking up in 0.9 seconds. Mon Mar 5 14:45:55 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 209 to 127.0.0.1 port 42379 Mon Mar 5 14:45:55 2012 : Debug: Waking up in 4.9 seconds. Mon Mar 5 14:46:01 2012 : Info: Cleaning up request 0 ID 209 with timestamp +10 Mon Mar 5 14:46:01 2012 : Info: Ready to process requests.

3 3

Authentification
by Javier Ruiz Escalante 05 Mar '12

05 Mar '12

Good afternoon, I'm new in Radius and I have no clue what happens, can anybody help me? from the server in the command line works fine, from the wireless client get this one. Thanks Regards ad_recv: Access-Request packet from host 127.0.0.1 port 35226, id=0, length=200 User-Name = "mysqltest" User-Password = "O%:snv\nB\334Îž\300H\035\235e" NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.5 Calling-Station-Id = "68-A3-C4-37-A2-59" Called-Station-Id = "08-00-27-26-2C-CD" NAS-Identifier = "nas01" Acct-Session-Id = "4f54a3d900000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x6fb3594ad7f0fad5aa33deab91da2216 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Mon Mar 5 12:36:33 2012 : Info: # Executing section authorize from file /etc/freeradius/radiusd.conf Mon Mar 5 12:36:33 2012 : Info: +- entering group authorize {...} Mon Mar 5 12:36:33 2012 : Info: ++[preprocess] returns ok Mon Mar 5 12:36:33 2012 : Info: ++[chap] returns noop Mon Mar 5 12:36:33 2012 : Info: ++[mschap] returns noop Mon Mar 5 12:36:33 2012 : Info: [suffix] No '@' in User-Name = "mysqltest", looking up realm NULL Mon Mar 5 12:36:33 2012 : Info: [suffix] No such realm "NULL" Mon Mar 5 12:36:33 2012 : Info: ++[suffix] returns noop Mon Mar 5 12:36:33 2012 : Info: [eap] No EAP-Message, not doing EAP Mon Mar 5 12:36:33 2012 : Info: ++[eap] returns noop Mon Mar 5 12:36:33 2012 : Info: [sql] expand: %{User-Name} -> mysqltest Mon Mar 5 12:36:33 2012 : Info: [sql] sql_set_user escaped user --> 'mysqltest' Mon Mar 5 12:36:33 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 0 Mon Mar 5 12:36:33 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'mysqltest' ORDER BY id Mon Mar 5 12:36:33 2012 : Info: [sql] User found in radcheck table Mon Mar 5 12:36:33 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'mysqltest' ORDER BY id Mon Mar 5 12:36:33 2012 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'mysqltest' ORDER BY priority Mon Mar 5 12:36:33 2012 : Debug: rlm_sql (sql): Released sql socket id: 0 Mon Mar 5 12:36:33 2012 : Info: ++[sql] returns ok Mon Mar 5 12:36:33 2012 : Info: ++[pap] returns updated Mon Mar 5 12:36:33 2012 : Info: Found Auth-Type = PAP Mon Mar 5 12:36:33 2012 : Info: # Executing group from file /etc/freeradius/radiusd.conf Mon Mar 5 12:36:33 2012 : Info: +- entering group PAP {...} Mon Mar 5 12:36:33 2012 : Info: [pap] login attempt with password "O%:snv Bï¿½ï¿½?ï¿½H??e" Mon Mar 5 12:36:33 2012 : Info: [pap] Using clear text password "testsecret" Mon Mar 5 12:36:33 2012 : Info: [pap] Passwords don't match Mon Mar 5 12:36:33 2012 : Info: ++[pap] returns reject Mon Mar 5 12:36:33 2012 : Info: Failed to authenticate the user. Mon Mar 5 12:36:33 2012 : Debug: WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Mon Mar 5 12:36:33 2012 : Info: Using Post-Auth-Type Reject Mon Mar 5 12:36:33 2012 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Mon Mar 5 12:36:33 2012 : Info: +- entering group REJECT {...} Mon Mar 5 12:36:33 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> mysqltest Mon Mar 5 12:36:33 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Mar 5 12:36:33 2012 : Info: ++[attr_filter.access_reject] returns updated Mon Mar 5 12:36:33 2012 : Info: Delaying reject of request 14 for 1 seconds Mon Mar 5 12:36:33 2012 : Debug: Going to the next request Mon Mar 5 12:36:33 2012 : Debug: Waking up in 0.9 seconds. Mon Mar 5 12:36:34 2012 : Info: Sending delayed reject for request 14 Sending Access-Reject of id 0 to 127.0.0.1 port 35226 Mon Mar 5 12:36:34 2012 : Debug: Waking up in 4.9 seconds. Mon Mar 5 12:36:39 2012 : Info: Cleaning up request 14 ID 0 with timestamp +3498 Mon Mar 5 12:36:39 2012 : Info: Ready to process requests. Javier Ruiz Escalante Teléfono: 00 34 512 700 524 Skype: fruiz002

10 23

A lot of users connected with radwho
by Carina V. Barca 05 Mar '12

05 Mar '12

Hello everybody, I have a freeradius that autenticate users using mysql database. When I use the command radwho I saw a lot of users wich are old users. The question is, How should I disconnect those users so don't showed up with the radwho command? Regards Carina

1 0

TCP transport
by Wenjuan Lin 05 Mar '12

05 Mar '12

Hello, I just had a freeradius server (2.1.12, prebuilt for x86_64-redhat-linux-gnu) setup for development testing purpose. However I couldn’t configure this server for TCP connection. By the email thread dated back 09/2009, freeradius should have TCP transportatation support. Can you please shed some light: 1. Does the version I installed have this feature? If yes, how can I enable it? 2. If not, what versions have this feature and what are the configuration steps? Thanks a lot, Victoria --------------------------------------------------------------------------------- >From Alan DeKok. 09/2009 I've just committed patches that enable TCP transport in the server. It was previously off by default. The code is a lot cleaner than the previous attempt, and (not surprisingly), smaller and easier to understand. It should provide all of the functionality of 2.1.7, plus TCP transport for high load systems. If anyone has spare cycles to check the usual edge cases, that would help a lot.

2 1

(no subject)
by Houston-III, Lester L 05 Mar '12

05 Mar '12

Hello all, I'm trying to figure out how to access vendor specific attributes from JRADIUS via my FreeRADIUS server. I have defined the dictionary file and have included them in FreeRADIUS and JRADIUS. Using wireshark I can verify that the attributes that I've defined are included in the access-request packet that is sent to my FreeRADIUS server. There are no errors shown in the output, but I don't see an attribute of type 26, which I believe is the type used for VSA, being passed to JRADIUS. There doesn't appear to be an option in the jradius module file where you can specify what attributes should be included the exchange between FreeRADIUS and JRADIUS. Is there some configuration or code change that I need to make to get these attributes included in the packet that's sent to JRADIUS? Lester Houston 111 Boeing Research & Technology Electronics Prototyping and Integration Center (EPIC) lester.l.houston-iii(a)boeing.com 314-234-0621

1 0