March 2012 - Freeradius-Users - lists.freeradius.org

Inserting NT-Passwords in MySQL database
by pamela pomary 18 Mar '12

18 Mar '12

Hello once again, Please how can I insert into MySQL database, encrypted passwords for radius users. In an earlier mail I posted to the list, Phil suggested NT hash (MD4 of little-endian UTF-16 form password) since it was *not possible to do* *MD5 with mschap. * I have tried to do: insert into radcheck(userName,Attribute,op,value) values ('test','NT-Password',':=',NT-hash( 'password' )); but it failed because I guess it doesn't exist. I edited ntlm_auth module to specify the path for ntlm_auth like this #######/ etc/raddb/modules/ntlm_auth ###### exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } I dont know how to apply ntlm_auth to cleartext passwords to insert into MySQl database. How can I achieve encrypting password for radius users in MySQL using NT-Password. Thank You.

3 2

Two-Factor Auth using FreeRADIUS
by Ryon Day 17 Mar '12

17 Mar '12

Hello all, long-time reader, first time poster to this list. I've watched many posters go down in flames on this list, so I'm going to try to learn from their mistakes and be as precise as possible; I'm also going to make it known at the outset that I have read all the documentation that I can get my hands on and I am running FreeRADIUS -X to start it in debug mode! I am attempting to implement two-factor authentication with LDAP combined with FreeRADIUS. As you probably know at this point, many SSL-VPN and network control devices only offer both LDAP/AD and RADIUS authentication for their devices (some have native SecurID support as well). The client is authenticating users with Active Directory as the first-level auth. It is on the second-level auth that I have questions. The authentication mechanism that we are using for the second-factor authentication is a one-time password sent to the user via an out-of-band mechanism. Therefore, this requires two different interactions with the RADIUS server: 1: Access-Request: SSL-VPN -> FreeRADIUS. This sends the username (and another piece of data that I am currently putting in the password field) to the RADIUS server. *At this point, I have written a JRadius component: * On the SSL-VPN side I have PAP authentication selected. That is because as above, I am using the password field to transfer another piece of data (the delivery method) to RADIUS. * It resides in the "authorize" stage of the "default" site in FreeRADIUS * It looks the user up in LDAP (again) to obtain his/her E-Mail address to send. It then sends the OTP to the e-mail address. This part works perfectly! * Then, I construct a new Access-Challenge packet in JRadius, creating a new State and copying the initial Access-Request packet's identifier, and return from the JRadius handler. This part also works perfectly. 2: Access-Challenge: FreeRADIUS -> SSL-VPN device This step is where the wheels are falling off the bus. FreeRADIUS does not seem to want to send out my Access-Challenge packet; it automatically changes it to an Access-Reject. I have even put another handler in the post-auth reject handler to change it BACK to a Access-Challenge. At that point if I do that, FreeRADIUS' debug mode reports that it is sending an Access-Request packet to the IP address of the NAS (or my RADIUS test program)! 3: Access-Request (original Using state and Packet ID so I can identify the request on the back-end JRadius component) * Compare passed OTP to stored OTP for that "session". Act accordingly. * Obviously this step does not yet work! I have tried many permutations of Auth-Methods. Since I am using PAP authentication on the SSL-VPN side, I initially chose that module, however it really does not like my sending that Access-Challenge packet out. I have tried commenting lots of things out, even using jradius in the 'PAP' handler of the authentication section. At that point, even though the PAP module is not running, FreeRADIUS puts the kibosh on my Access-Challenge packet. This leads me to believe that FreeRADIUS has a very rigid idea of what these packets should be depending on auth method. Is there really no use case at all for PAP where you would ever send an access challenge? Are there any "dummy" auth methods that just, well, let me do whatever the hell I want? Is it possible to implement a new Auth method like this? Questions: * Is there any way with current functionality, I can Implement a custom challenge flow like the one I am describing? * Are there examples of this kind of functionality out there "in the wild" that I can look at and use as a model? * I greatly enjoy working with JRadius in spite of its occasional wonkiness, but I can dust off my C if necessary. Is some sort of JRadius handler combined with C FreeRADIUS mods possible? I do not mind writing code if it is necessary, but of course I'd prefer not to if it's at all avoidable! (Is this a question better posed to the dev list?) Thank you for any help or guidance you can give me in this matter!

3 5

Re: Add Users in MySQL database
by Fabricio Flores 17 Mar '12

17 Mar '12

Mmm I have a web service so I have users and password... So If somebody wants to login in the captive portal first i want to see in the web service if ther is this user, and if the user exists i add the user in the mysql database and freeradius athenticate thes user from the mysql database... El 16/03/2012 19:37, "Alan Buxey" <A.L.M.Buxey(a)lboro.ac.uk> escribió:

3 5

IF-MAP Support
by Francois Gaudreault 16 Mar '12

16 Mar '12

Hello, I believe some work have been done on this topic lately with external log modules to populate an IF-MAP database, correct? I am wandering if there is a "working -as-PoC" piece of code available somewhere? We are interested in testing and add the support for IF-MAP in PacketFence (long term project). Thanks! -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

Re: Add Users in MySQL database
by Alan Buxey 16 Mar '12

16 Mar '12

This isn't a freeradius question, thus is a mysql question. There are many many tools, webfront ends and scripts that you can use. One simple one actually comes with freeradius, others are eg Daloradius or php_mysqladmin alan

3 4

proxy server goes deaf after "Client has closed connection" (RadSec to home server)
by Brian Julin 16 Mar '12

16 Mar '12

It appears there was another layer to my latest issue. Sometimes a server using RadSec to proxy to a home server ends up just waiting around unable to see any more incoming requests, and not having completed the current request. In this case the server is 3.0, and is sandwiched between our internal instance and our federation server (doing radsecproxy-ish stuff.) This may only happen in a corner case when the federation server is taking a while to reply, perhaps in this case where it exceeds our internal instance's response_window. I'm testing now whether using an immense response_window on the internal instance works as a workaround (assuming the federation server doesn't have any prolonged issues, of course) which would help support that theory. Info: (32) Proxying request to home server XXX.XXX.XXX.XXX port 2083 Tue Mar 6 13:59:08 2012 : Debug: Proxy is writing 122 bytes to SSL Tue Mar 6 13:59:08 2012 : Debug: Thread 3 waiting to be assigned a request Tue Mar 6 13:59:08 2012 : Debug: Proxy SSL socket has data to read Tue Mar 6 13:59:08 2012 : Debug: Client has closed connection (though, the client is UDP which has no transport layer connection, so... maybe that's talking about the home server, not a client? Not sure if that's coming from listen.c or tls_listen.c) (at this point the server does not see any additional requests sent to it, so we kill it to see if it is hanging out anywhere interesting... really should do this several times more to verify... maybe try a kill -9 next time...) Program received signal SIGINT, Interrupt. 0x0000003c7520dff4 in __lll_lock_wait () from /lib64/libpthread.so.0 #0 0x0000003c7520dff4 in __lll_lock_wait () from /lib64/libpthread.so.0 #1 0x0000003c75209328 in _L_lock_854 () from /lib64/libpthread.so.0 #2 0x0000003c752091f7 in pthread_mutex_lock () from /lib64/libpthread.so.0 #3 0x000000000042bb54 in remove_from_proxy_hash (request=0x805170) at process.c:1579 #4 0x000000000042d4f5 in request_done (request=<value optimized out>, action=<value optimized out>) at process.c:532 #5 0x000000000042f42d in remove_all_proxied_requests ( ctx=<value optimized out>, data=<value optimized out>) at process.c:1540 #6 0x00007ffff7de7822 in WalkNodeInOrder (X=<value optimized out>, callback=0x42f400 <remove_all_proxied_requests>, context=0x7fffec003710) at rbtree.c:551 #7 0x0000000000431354 in event_new_fd (this=0x7fffec003710) at process.c:3553 #8 0x000000000043c648 in proxy_tls_recv (listener=0x7fffec003710) at tls_listen.c:499 #9 0x0000000000430a8a in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0x7fffec003710) at process.c:3309 #10 0x00007ffff7deddfb in fr_event_loop (el=0x7d0b10) at event.c:415 #11 0x0000000000422534 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:413 Just one of those occasions where the grass looks greener on the SEGV side of the fence :-)

2 6

md5 passwords in mysql database
by pamela pomary 16 Mar '12

16 Mar '12

Hello Please I have a challenge encrypting passwords using md5 in MySQL database for radius users. When I do a radtest like this: radtest test password localhost 0 key for user test with md5(password) in MySQL database it is successful. However when do this : radtest -t mschap testmd5 password localhost 0 key, I get MS-CHAP Error Sending delayed reject for request 0 Sending Access-Reject of id 143 to 127.0.0.1 port 55008 MS-CHAP-Error = "\000E=691 R=1" I read online,it is not possible to do md5 with MS-CHAP. I don't want to save users passwords in clear text. How can I achieve encrypting user's passwords in MySQL database. I have Freeradius2.1.12 installed. Please I will be grateful for suggestions. I have the following in modules #### /etc/raddb/modules/pap ### pap { auto_header = yes encryption_scheme = md5 } #### /etc/raddb/modules/mschap ### mschap { use_mppe = yes require_encryption = yes } Any help will be very much appreciated Thank You ---- Pamela Pomary ICTD, University of Ghana.

2 1

LDAP Search Questions
by ryuukuu 16 Mar '12

16 Mar '12

Hello All, I've got a question about the settings for limiting access/authenticating to a specific LDAP group. I have setup a group on my OpenLDAP called "RADIUS" and I want the users in there to be the only ones that have access. The problem I am having is with the filters. Below is my /etc/raddb/modules/ldap (given I cleaned up alot of the comments just for posting reasons) server = "example.com" port = "389" identity = "cn=example,dc=company,dc=local" password = xxxxx basedn = "ou=People,dc=company,dc=local" # access_attr = ? # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" # filter = "(objectclass=ogranizationalPerson)(de" # base_filter = "(objectclass=organizationalPerson)" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # require_cert = "demand" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = userPassword auto_header = yes # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName # compare_check_items = yes # do_xlat = yes # chase_referrals = yes # set_auth_type = yes } -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-Search-Questions-tp5565845p556… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

FreeRadius 2.1.12, why is EAP AKA support in eap2 module
by Altaf Husain 16 Mar '12

16 Mar '12

> > Hi, > We are using FreeRadius ver 2.1.12, I had query regarding EAP-AKA > support in eap2 module, its mentioned in FreeRadius website that "This > module is experimental, and may not be ready for use in a production > environment", Is it still in experimental state, can't it be used as > EAP-SIM, is performance tested for EAP-AKA. I am waiting for response so > that we supporting EAP-AKA in our product using FreeRadius, any specific > reason for keeping it in eap2 module rather then mainline eap module. > Waiting for positive and quick response, Thanks in advance. > > Thanks > Altaf >

3 5

Windows 7 clients
by Scott McLane Gardner 15 Mar '12

15 Mar '12

Okay, I've finally got the server certificate sorted out, signed by GeoTrust and installed, but now I have another certificate problem. I believe this one is that the client doesn't recognize my ca.pem as being signed by a trusted authority. Do I need to get another root cert signed by GeoTrust? If so, how do I go about doing that? FR v2.1.10 [peap] <<< TLS 1.0 Alert [length 0002], fatal unknown_ca TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [peap] eaptls_process returned 4 [peap] EAPTLS_OTHERS [eap] Handler failed in EAP/peap [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user.

6 10