March 2012 - Freeradius-Users - lists.freeradius.org

newbiie
by Khapare Joshi 29 Apr '12

29 Apr '12

I am just a new with freeradius. so please consider. This is what I am trying to do today. 1. installed pptpd server on centos 6 box, tested with chap-secert password and worked. 2. installed freeradius server to handle stuff like ip pool and authenticaton, and integrate with my existing openldap server for authentication. 3. I looked at the /etc/raddb/radiusd.conf but I do not see the the LDAP section 4. how can I integrate the my freeradius server to hook up with ldap server ? I followed this doc but got stucked. I am nearly there I think wiki.freeradius.org/PopTop any help, guide or tips would be great help. here are my versino of freeradius Installed Packages Name : freeradius Arch : x86_64 Version : 2.1.10 Release : 5.el6 Size : 5.5 M and client Installed Packages Name : radiusclient-ng Arch : x86_64 Version : 0.5.6 Release : 5.el6 Size : 102 k Repo : installed >From repo : epel Tell me what I am missing! Khapare

6 15

[Home server Radius in "always accept mode with mschap"]
by Thomas Fagart 20 Apr '12

20 Apr '12

Hello, As we've got some bad ISPs or maybe because they use other radius than freeradius :-), we would like, when their home server does not work properly (bad response time or completely down), to continue authenticating wimax users on our proxy. (So that users does not get disconnected after their lease / network entry). So I wanted to build a "welcome" home server (meaning a home server that always say yes whithout checking anything). I've tried a physical one and also a dedicated virtual server that I use either as fallback home server or as secondary home server. I've successfully been able to send "Access Accept" for any Access Request by configuring the following : authorize { preprocess auth_log chap mschap unix files if (!ok) { reject } else { update control { Auth-Type := Accept } } expiration logintime pap } .... But then it's not enough, Mschap Attributes are required so that it really work (below is "normal" authentication when ISPs home server answer). on Dec 5 11:37:39 2011 : Debug: Received Access-Accept packet from host X.Y.Z.W port 1812, id=98, length=184 Mon Dec 5 11:37:39 2011 : Debug: MS-CHAP2-Success = 0x78533d44303235443041393935354646383733384143443137364244433544463336393436373139333937 Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Recv-Key = 0xa0d43ffe6f017d74813ad8d12b35797e Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Send-Key = 0x5f6a95b54ef1d283134925733845429a Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Encryption-Policy = 0x00000001 Mon Dec 5 11:37:39 2011 : Debug: MS-MPPE-Encryption-Types = 0x00000006 Mon Dec 5 11:37:39 2011 : Debug: Proxy-State = 0x323233 Mon Dec 5 11:37:39 2011 : Debug: +- entering group post-proxy {...} As I was not very familiar with MS-CHAP, I've google a little and it seems to me that my goal (ie ms chapv2 welcome server without having user/passwd of users) is not reachable as the home server MUST have users/passwd to generate challenge. Could you confirm that I'm not wrong so that I will stop looking for unfeasible things ? Many thanks Thomas

4 7

using windows 8's builtin eap-ttls w/ freeradius
by Brian Gold 19 Apr '12

19 Apr '12

We've been using SecureW2's client with our Freeradius server using EAP-TTLS/PAP authentication. From doing some very preliminary testing with the Windows 8 consumer preview, I've noticed that MS is now including EAP-TTLS support directly in windows. Unfortunately, I haven't had any luck getting this working yet. From looking over the radius logs, everything appears to be authenticating correctly, but then windows sits at "Checking network requirements" for a few minutes before dying. Below are the steps I have taken to configure windows to connect to our network so far. Has anyone else had luck with this yet? 1. Open the "Network and Sharing Center" either through the control panel or by right clicking the network icon in your tray 2. Click "Set up a new connection or network" 3. Click "Manually connect to a wireless network" 4. Enter the network name and choose WPA2-Enterprise for Security Type, then click Next 5. Click "Change connection settings" 6. Go to the security tab and choose "Microsoft EAP-TTLS" from the "Network Authentication Method" dropdown 7. Click "Settings" and uncheck "Enable identity privacy" 8. Click OK twice 9. Click the wifi icon in your tray and choose your secure wireless network 10. You will now be prompted for your username & password Brian Gold System Administrator Bard College at Simon's Rock

5 6

Using DHCP
by Franz 18 Apr '12

18 Apr '12

Hi, I was wondering if when using DHCP with freeradius we can control the lease time depending on the group the user belongs to. Thanks, Franz

3 7

Windows 7 prompting several times
by Morris, Andi 11 Apr '12

11 Apr '12

Hi all, Apologies for being slightly off topic. Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I've read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

10 38

load balancing and if statements
by Scott McLane Gardner 06 Apr '12

06 Apr '12

FR 2.1.10 on Linux I want to load balance my LDAP servers, but I also want to do some checking for group membership. Reading the documentation at http://wiki.freeradius.org/Load-balancing#Interaction+with+%22if%22+and+%22 else%22 makes me think I can use if and elsif statements in a load balancing block, as long as the rules in the table are followed. However, when I try to do this, I get the following errors in my log: >/etc/freeradius/sites-enabled/default[173]: load-balance sections cannot >contain a "if" statement Here is the configuration I am attempting: > load-balance { > ldap1 > > if (Ldap-Group == "NET Staff") { > if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4") { > update reply { > Passport-Access-Priority = 6 > } > } > } > # Reject everyone else to the routers > elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == >"10.51.0.2") { > reject > } > > ldap2 > > if (Ldap-Group == "NET Staff") { > if (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4") { > update reply { > Passport-Access-Priority = 6 > } > } > } > # Reject everyone else to the routers > elsif (NAS-IP-Address == "10.52.6.5" || NAS-IP-Address == >"10.52.6.4" || NAS-IP-Address == "10.51.0.1" || NAS-IP-Address == >"10.51.0.2") { > reject > } > } If I can't use if statements in a load balance block, can anyone suggest another way to go about accomplishing what I want to do here? Thank you, Scott

6 19

MAC-Auth issues with rlm_perl
by Glen Harris 05 Apr '12

05 Apr '12

Server: Debian 6 (Squeeze) 2.6.32-5-amd64 FreeRadius: 2.1.10 (Debian package) Client: HP E-MSM460 AP (MSCHAPv2, Use message authenticator) Authentication methods for the MSM460 are: MSCHAPv2, MSCHAP, CHAP, EAP MD5 and PAP. I'm trying to set up a simple MAC-Auth based network using HP 2610 switches and MSM640 wireless APs as radius clients. I've added the AP to the clients.conf and configured the AP to use MAC-based authentication and it appears to be talking to FreeRadius using MSCHAPv2 correctly. We only have a few dozen clients, so I'm using the perl module to read and cache a text file of MAC addresses. My script watches the file's mtime and re-loads it as necessary. I've followed the instructions on http://wiki.freeradius.org/Rlm_perl, but I get the following error: /etc/freeradius/users[204]: Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type After some trial and error, I found that adding perl to the authorize and authenticate sections of sites-available/inner-tunnel would get rid of the error, but I have no idea if that solved the problem or merely masked it and caused he next one. There appears to be something seriously wrong with the way this config is working, because rlm_perl is calling the AUTHORIZE function but not AUTHENTICATE. I've pasted the debug of an authentication attempt below. It appears to be taking the CLIENT mschap authentication and somehow applying those attributes to mangle USER authentication. rad_recv: Access-Request packet from host 192.168.0.29 port 35063, id=48, length =275 Acct-Session-Id = "1ca83cd8-00013b2c" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 User-Name = "984b4af5bf40" Calling-Station-Id = "98:4b:4a:f5:bf:40" Called-Station-Id = "2c:41:38:f4:f5:c0" Service-Type = Login-User MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc6800000000000000 00fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba Colubris-AVPair = "ssid=TSV-UC" Colubris-AVPair = "phytype=IEEE802dot11n" Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "984b4af5bf40", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 204 ++[files] returns ok rlm_perl: AUTHORIZE rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 rlm_perl: RAD_REQUEST: Acct-Session-Id = 1ca83cd8-00013b2c rlm_perl: RAD_REQUEST: Service-Type = Login-User rlm_perl: RAD_REQUEST: Called-Station-Id = 2c:41:38:f4:f5:c0 rlm_perl: RAD_REQUEST: Calling-Station-Id = 98:4b:4a:f5:bf:40 rlm_perl: RAD_REQUEST: Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e rlm_perl: RAD_REQUEST: MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 rlm_perl: RAD_REQUEST: User-Name = 984b4af5bf40 rlm_perl: RAD_REQUEST: NAS-Identifier = CN18D332BD rlm_perl: RAD_REQUEST: MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba rlm_perl: RAD_REQUEST: Colubris-AVPair = ARRAY(0x127d4d8) rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.0.29 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Acct-Session-Id = 1ca83cd8-00013b2c rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Called-Station-Id = 2c:41:38:f4:f5:c0 rlm_perl: Added pair Calling-Station-Id = 98:4b:4a:f5:bf:40 rlm_perl: Added pair Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e rlm_perl: Added pair MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 rlm_perl: Added pair User-Name = 984b4af5bf40 rlm_perl: Added pair NAS-Identifier = CN18D332BD rlm_perl: Added pair MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba rlm_perl: Added pair Colubris-AVPair = ssid=TSV-UC rlm_perl: Added pair Colubris-AVPair = phytype=IEEE802dot11n rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 192.168.0.29 rlm_perl: Added pair Auth-Type = MSCHAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: 984b4af5bf40 [mschap] Told to do MS-CHAPv2 for 984b4af5bf40 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 984b4af5bf40 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 48 to 192.168.0.29 port 35063 Regards, Glen.

5 11

Disconnect a Mikrotik NAS client from Daloradius
by Javier Ruiz Escalante 04 Apr '12

04 Apr '12

Hello all, I would like to disconnect a client which is connected through a Mikrotik Hotspot and the command used normally via Chillispot does not work, I know that I have to use several attributes like session id and so on, but no clue how to use them. Can somebody give me a clue? Thank you very much in advance. Regards

3 2

Blackberry disabled server certificates query
by lmgo5991 03 Apr '12

03 Apr '12

Hi We are testing various deivces with our new eduroam wirelss and so far so good. However, an issue cropped up with blackberrys where during the setup, if you leave the box unchecked "disable server certificate validation" then the blackberry connects fine if you uncheck connection fails "failed to connect". I have checked other institutions and they have conflicting guides some say leave it checked others say uncheck. Can anyone advise the status - to check or uncheck? Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Blackberry-disabled-server-certific… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 6

Proxy + copy accounting to passive home server
by mimir 03 Apr '12

03 Apr '12

Hello, I am trying to deploy proxy configuration to my radius server. I added home_server_pool with two home_servers. I can successfully send accounting packets (with load-balance) to other two radius servers. I also can use attribute filtering for proxy via acct_users as below. acct_users: DEFAULT Called-Station-Id = "internet1", Proxy-To-Realm := TEST1 But, I want to send same packet to both servers when proxying. If I proxied the accounting packet to server A successfully, then I want to also copy to it to the other radius server. (means that passive one for each packet while load-balancing) I read some forums and see that it can be done via "copy-acct-to-home-server". But, I could not configure it. (I also could not understand where I should edit it? on proxy ? or home_servers? Can you please help me on this issue? Thanks... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Proxy-copy-accounting-to-passive-ho… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 25