April 2012 - Freeradius-Users - lists.freeradius.org

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 12 Apr '12

12 Apr '12

Hi, it seems that is not possible that a user can change the password on loggon screen in windows 7 with freeradius after it has expired, except i use a windows IAS / NPS Server, or not ? I debugged the RAS crap on windows side and in the Logs i have: [3564] 04-12 12:02:33:182: EapChapBeginMSChapV2 [3564] 04-12 12:02:33:182: ReadUserData [3564] 04-12 12:02:33:182: Version three user blob is passed, size: 1018 [3564] 04-12 12:02:33:182: ReadConnectionData [3564] 04-12 12:02:33:182: EapChapBeginCommon [3564] 04-12 12:02:33:182: ChapBegin(fS=0,bA=0x81) [3564] 04-12 12:02:33:182: StoreCredentials [3564] 04-12 12:02:33:198: ChapBegin done. [3564] 04-12 12:02:33:198: ChapMakeMessage,RBuf=0000000000000000 [3564] 04-12 12:02:33:198: ChapCMakeMessage... [3564] 04-12 12:02:33:198: CS_Initial [3564] 04-12 12:02:33:198: EapMSChapv2MakeMessage [3564] 04-12 12:02:33:198: EapMSChapv2CMakeMessage (DOMAIN\test) [3564] 04-12 12:02:33:198: EMV2_Initial [3564] 04-12 12:02:33:198: EapMSChapv2CMakeMessage: Rcvd packet size: 37 [3564] 04-12 12:02:33:198: ChapMakeMessage,RBuf=0000000004352B35 [3564] 04-12 12:02:33:198: ChapCMakeMessage... [3564] 04-12 12:02:33:198: CS_WaitForChallenge [3564] 04-12 12:02:33:198: MakeResponseMessage... [3564] 04-12 12:02:33:198: Generating Challenge [3564] 04-12 12:02:33:198: GetChallenge. [3564] 04-12 12:02:33:198: GetChallenge: LsaCallAuthenticationPackage succeeded [3564] 04-12 12:02:33:198: GetChallenge. [3564] 04-12 12:02:33:198: GetChallenge: LsaCallAuthenticationPackage succeeded [3564] 04-12 12:02:33:198: GetChallengeResponse [3564] 04-12 12:02:33:198: GetDESChallengeResponse [3564] 04-12 12:02:33:198: GetDESChallengeResponse Success [3564] 04-12 12:02:33:198: GetMD5ChallengeResponse Success [3564] 04-12 12:02:33:198: GetMD5ChallengeResponse Success [3564] 04-12 12:02:33:198: GetChallengeResponse Success [3564] 04-12 12:02:33:198: GetChallengeResponse=0 02 09 00 41 31 1F C4 A4 0B D5 E9 77 D5 CB E9 34 |...A1......w...4| 94 7E 7B 04 E2 00 00 00 00 00 00 00 00 85 83 94 |.~{.............| DF 03 C5 95 73 46 E5 57 2D A5 03 D5 1B 75 EE 7F |....sF.W-....u.| 26 D3 16 59 DE 00 5A 4F 4F 50 4C 55 53 5C 77 74 |&..Y..DOMAIN\tes| 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |t...............| [3564] 04-12 12:02:33:245: EapMSChapv2MakeMessage [3564] 04-12 12:02:33:245: EapMSChapv2CMakeMessage (DOMAIN\test) [3564] 04-12 12:02:33:245: EMV2_ResponseSend [3564] 04-12 12:02:33:245: Got a Code Failure when expecting Response. Failing Auth [3728] 04-12 12:02:34:290: EapMSChapv2End [3728] 04-12 12:02:34:290: ChapEnd Maybe the FR send a wrong EAP Messages to the Client ? Is it anyway possible to get the whole unencrypted EAP Message from FR ? Network traces are useless cause crypted traffic. thanks, C. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

1 0

MS-CHAPv2, allow_retry=yes, but no code to handle the retry?
by James J J Hooper 12 Apr '12

12 Apr '12

Hi All, FR 2.1.x Git, doing PEAP against AD via ntlm_auth. I thought that with: allow_retry = yes [in modules/mschap] and send_error = yes [in modules/eap] ...FR has the functionality to take the second password attempt, and re-try it against AD i.e. The scenario outlined in section 9.1.4 of RFC2759: <http://tools.ietf.org/html/rfc2759#section-9.1.4> I can't get it to work: Configuring as above does indeed make Windows re-prompt for the password if the first attempt is bad, but when this comes back to FR, nothing seems to be done with it. I've had a look at the code. From the little I can understand of it, the new challenge is generated into 'buffer', and sent back to the client in the MS-CHAP-Error attribute (C=<new-challenge>). However the challenge in buffer is not then "put somewhere safe" until the client sends it's response against the new challenge [having re-prompted the user for the correct password], and when the response comes in it isn't sent to do_mschap() Am I mistaken and this functionality hasn't been written yet? ...or have I mis-configured something? Debug snippet appended. Thanks, James ## INITIAL ATTEMPT WITH BAD PASSWORD: Debug: modsingle[authorize]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: [eduroamlocaleap-bris-ca] EAP packet type response id 9 length 80 Debug: [eduroamlocaleap-bris-ca] No EAP Start, assuming it's an on-going EAP conversation Debug: modsingle[authorize]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: +++[eduroamlocaleap-bris-ca] returns updated Debug: ++- else else returns updated Debug: Found Auth-Type = eduroamlocaleap-bris-ca Debug: # Executing group from file /usr/local/etc/raddb/sites-enabled/eduroamlocal-inner Debug: +- entering group eduroamlocaleap-bris-ca {...} Debug: modsingle[authenticate]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: [eduroamlocaleap-bris-ca] Request found, released from the list Debug: [eduroamlocaleap-bris-ca] EAP/mschapv2 Debug: [eduroamlocaleap-bris-ca] processing type mschapv2 Debug: [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/eduroamlocal-inner Debug: [mschapv2] +- entering group MS-CHAP {...} Debug: [mschapv2] modsingle[authenticate]: calling eduroamlocalmschap (rlm_mschap) for request 629 Debug: [eduroamlocalmschap] Creating challenge hash with username: jh01761(a)bristol.ac.uk Debug: [eduroamlocalmschap] Told to do MS-CHAPv2 for jh01761(a)bristol.ac.uk with NT-Password Debug: [eduroamlocalmschap] expand: %{Stripped-User-Name} -> jh01761 Debug: [eduroamlocalmschap] expand: --username=%{%{Stripped-User-Name}:-%{eduroamlocalmschap:User-Name}} -> --username=jh01761 Debug: [eduroamlocalmschap] radius_xlat: Running registered xlat function of module eduroamlocalmschap for string 'Challenge' Debug: [eduroamlocalmschap] Creating challenge hash with username: jh01761(a)bristol.ac.uk Debug: [eduroamlocalmschap] expand: --challenge=%{eduroamlocalmschap:Challenge} -> --challenge=3db717d83ec4e184 Debug: [eduroamlocalmschap] radius_xlat: Running registered xlat function of module eduroamlocalmschap for string 'NT-Response' Debug: [eduroamlocalmschap] expand: --nt-response=%{eduroamlocalmschap:NT-Response} -> --nt-response=0b7588b2a33b43f7379d4bded3d69adcfbe5da07911b8485 Debug: [eduroamlocalmschap] External script failed. Debug: [eduroamlocalmschap] FAILED: MS-CHAP2-Response is incorrect Debug: modsingle[authenticate]: returned from eduroamlocalmschap (rlm_mschap) for request 629 Debug: ++[eduroamlocalmschap] returns reject Debug: ++? if (reject) Debug: >>> RECURSING WITH ... reject) Debug: >>> LOOKING AT reject) Debug: >>> Comparison returned 1 Debug: ? Evaluating (reject) -> TRUE Debug: >>> GOT result 1 Debug: >>> AT EOL -> 1 Debug: >>> AFTER RECURSION ... ) Debug: >>> AT EOL -> 1 Debug: ++? if (reject) -> TRUE Debug: ++- entering if (reject) {...} Debug: ::: FROM 1 TO 25 MAX 26 Debug: ::: Examining UOB-Info-Type Debug: ::: APPENDING UOB-Info-Type FROM 0 TO 25 Debug: ::: TO in 25 out 26 Debug: ::: to[0] = EAP-Message Debug: ::: to[1] = FreeRADIUS-Proxied-To Debug: ::: to[2] = User-Name Debug: ::: to[3] = State Debug: ::: to[4] = Calling-Station-Id Debug: ::: to[5] = Called-Station-Id Debug: ::: to[6] = NAS-Port Debug: ::: to[7] = Cisco-AVPair Debug: ::: to[8] = NAS-IP-Address Debug: ::: to[9] = NAS-Identifier Debug: ::: to[10] = Airespace-Wlan-Id Debug: ::: to[11] = Service-Type Debug: ::: to[12] = Framed-MTU Debug: ::: to[13] = NAS-Port-Type Debug: ::: to[14] = Tunnel-Type Debug: ::: to[15] = Tunnel-Medium-Type Debug: ::: to[16] = Tunnel-Private-Group-Id Debug: ::: to[17] = UOB-Stripped-MAC Debug: ::: to[18] = Stripped-User-Name Debug: ::: to[19] = Realm Debug: ::: to[20] = EAP-Type Debug: ::: to[21] = MS-CHAP-Challenge Debug: ::: to[22] = MS-CHAP2-Response Debug: ::: to[23] = NTLM-User-Name Debug: ::: to[24] = Module-Failure-Message Debug: ::: to[25] = UOB-Info-Type Debug: +++[request] returns reject Debug: modsingle[authenticate]: calling eduroaminfo (rlm_linelog) for request 629 Debug: [eduroaminfo] expand: %{UOB-Info-Type} -> BADP Debug: [eduroaminfo] expand: %{Virtual-Server}.%{%{UOB-Info-Type}:-UNKN} -> eduroamlocal-inner.BADP Debug: [eduroaminfo] expand: BADP, %{UOB-Stripped-MAC}, USER PASSWORD or ADS GROUP INCORRECT [%{User-Name}] [%{Virtual-Server}], [%{Module-Failure-Message}] [%{reply:MS-CHAP-Error}] -> BADP, 68:7f:74:f2:a3:4e, USER PASSWORD or ADS GROUP INCORRECT [jh01761(a)bristol.ac.uk] [eduroamlocal-inner], [eduroamlocalmschap: External script says Logon failure (0xc000006d)] [\011E=691 R=1 C=077b54f94a5230c9ecb273bfff3ef93b V=3 M=Verify username and re-enter your password] Debug: modsingle[authenticate]: returned from eduroaminfo (rlm_linelog) for request 629 Debug: +++[eduroaminfo] returns ok Debug: modsingle[authenticate]: calling reject (rlm_always) for request 629 Debug: modsingle[authenticate]: returned from reject (rlm_always) for request 629 Debug: +++[reject] returns reject Debug: ++- if (reject) returns reject Debug: modsingle[authenticate]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 629 Debug: ++[eduroamlocaleap-bris-ca] returns handled ## THEN 4 SECONDS LATER (user has re-typed their password) Debug: ++- entering else else {...} Debug: modsingle[authorize]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: [eduroamlocaleap-bris-ca] EAP packet type response id 10 length 80 Debug: [eduroamlocaleap-bris-ca] No EAP Start, assuming it's an on-going EAP conversation Debug: modsingle[authorize]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: +++[eduroamlocaleap-bris-ca] returns updated Debug: ++- else else returns updated Debug: Found Auth-Type = eduroamlocaleap-bris-ca Debug: # Executing group from file /usr/local/etc/raddb/sites-enabled/eduroamlocal-inner Debug: +- entering group eduroamlocaleap-bris-ca {...} Debug: modsingle[authenticate]: calling eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: [eduroamlocaleap-bris-ca] Request found, released from the list Debug: [eduroamlocaleap-bris-ca] EAP/mschapv2 Debug: [eduroamlocaleap-bris-ca] processing type mschapv2 Debug: [eduroamlocaleap-bris-ca] Freeing handler Debug: modsingle[authenticate]: returned from eduroamlocaleap-bris-ca (rlm_eap) for request 673 Debug: ++[eduroamlocaleap-bris-ca] returns reject Debug: Failed to authenticate the user. Wed Apr 11 15:53:04 2012 : Auth: Login incorrect: [jh01761(a)bristol.ac.uk] (from client WISM4 port 13 cli 68:7f:74:f2:a3:4e via TLS tunnel)

2 2

One session per user
by Fabricio Flores 11 Apr '12

11 Apr '12

Hi everyone, I have a little problem.... I work with Ubuntu, freeradius, coovachilli. I want that when a user loged in he can´t log in from another pc with his username and password... but he can... how can i controle it? -- Fabricio A. Flores G. Egresado en Ingeniería en Sistemas MSN: fabri_floresg(a)hotmail.com Google: fabrifloresg(a)gmail.com Twitter: fabricioflores Skype: fabriciofloresgallardo Blog Personal <http://fabricioflores.wordpress.com/>

4 9

Windows 7 prompting several times
by Morris, Andi 11 Apr '12

11 Apr '12

Hi all, Apologies for being slightly off topic. Does anyone else get a problem with Windows 7 clients prompting for the radius credentials 2 or 3 times before finally accepting them? No errors are shown on the radius side, and I've read that this is a problem with the operating system, but wondered whether anyone in this knowledgeable community had overcome this? Cheers, Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

10 38

Automatic ppp ip address assignment
by Timmy 10 Apr '12

10 Apr '12

Dear All FreeRadius 2.1 users, I can run successfully with pptpd and freeradius 2.1 authentication very well. I need to assign ip address to each pptp user manually. However, I can't set up mysql ip pool for pptp user. I have tried this way: http://wiki.freeradius.org/Rlm_sqlippool but it doesn't work. ppp user cannot get ip address automatically. I also comment out main_pool inside the /site-available/default file. This doesn't work neither. I have also tried any possible combinations of other settings but they don't work. Any user would like to post the main setting of a successful automatic ppp ip address assignment through mysql ip pool? Your help is highly appreciated. Your Faithfully, Timmy

2 3

checking ad membership
by Heinrich, Sebastian 10 Apr '12

10 Apr '12

Hello, my aim is that only one group of the active directory gets access the others are rejected. I have read in this thread: http://freeradius.1045715.n5.nabble.com/Conditional-attributes-with-AD-td55… that you can use the ldap module to check group membership and check the output of the checking. I use this filter in the groupmembership checking: groupname_attribute = cn groupmembership_filter = "(objectClass=group)(member=%{<where the group in the ad is>}))" groupmembership_attribute = memberOf I get this output of the debug of freeRADIUS: [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=domain,dc=de, with filter (sAMAccountName=heinrich) [ldap] rebind to URL ldap://domain.de/CN=Configuration,DC=domain,DC=de [ldap] ldap_release_conn: Release Id: 0 expand: (&(objectClass=group)(member=%{control:cn=group,cn=users,dc=domain,dc=de})) -> (&(objectClass=group)(member=)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=group,cn=users,dc=aos-stade,dc=de, with filter (&(objectClass=group)(member=)) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=Heinrich\, Sebastian,CN=Users,DC=aos-stade,DC=de, with filter (objectclass=*) [ldap] performing search in CN=group1,CN=Users,DC=aos-stade,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group2,CN=group4,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group3,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group,CN=Users,DC=domain,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found [ldap] performing search in CN=group,CN=group4,CN=Users,DC=aos-stade,DC=de, with filter (cn=cn=group,cn=users,dc=domain,dc=de) [ldap] object not found rlm_ldap::groupcmp: Group cn=group,cn=users,dc=aos-stade,dc=de not found or user not a member [ldap] ldap_release_conn: Release Id: 0 I have written this in my inner-tunnel: If(!(Ldap-group == 'cn=group,cn=users,dc=domain,dc=de)) { update config { Auth-Type := Reject } } Can anybody help me? As I understand the debug the group is checked but the user isn't member of it. I totally sure that I am a member of the group. Best Regards Sebastian Heinrich Techn. DV Aluminium Oxid Stade GmbH Johann-Rathje-Köser-Straße 21683 Stade email S.Heinrich(a)aos-stade.de web http://www.aos-stade.de <http://www.aos-stade.de/>

2 1

optimize questions for unlang code
by Tobias Hachmer 10 Apr '12

10 Apr '12

Hello listmembers, In my testing environment I set up a virtual freeradius 2.1.12 server, which is configured to do ntlm_auth for authentication and ldap authorization against Microsoft AD. These are my ldap groups: - cn=radius.users,ou=Groups,dc=test,dc=local (only users within this group are allowed to authenticate against AD) - cn=alu.rw,ou=Groups,dc=test,dc=local (read-write group for alcatel-lucent devices) - cn=alu.ro,ou=Groups,dc=test,dc=local (read-only group for alcatel-lucent devices) - cn=netscreen.rw,ou=Groups,dc=test,dc=local (read-write group for juniper netscreen devices) - cn=netscreen.ro,ou=Groups,dc=test,dc=local (read-only group for juniper netscreen devices) - cn=nsm.rw,ou=Groups,dc=test,dc=local (read-write group for juniper nsm) - cn=nsm.ro,ou=Groups,dc=test,dc=local (read-only group for juniper nsm) - cn=aruba.rw,ou=Groups,dc=test,dc=local (read-write group for aruba devices) - cn=aruba.ro,ou=Groups,dc=test,dc=local (read-only group for aruba devices) I wrote unlang code in the authorize section of virtual server "default" (will post this later) - if a AD user is member of the radius.user I set Auth-Type to "ntlm_auth" - if a AD user is member of a device group above freeradius will add the appropriate return attributes to the access-accept packet. - if a AD user ist member of a read-write and a read-only group at once the user will be rejected because I assume this will be a configuration mistake. This is working so far very well but there is another advantage: Here are several devices which only support telnet access (yes, I know I have to get rid of them as soon as possible). In my point of view it would be fatal to logon to those devices with the active directory account. What I have done for now to authenticate non AD users only for these devices: - define these users in users file - create a huntgroup telnet with all the NAS-IP-Addresses of these devices - create unlang code to set Auth-Type to PAP if a radius request is received with one NAS-IP-Address defined in the huntgroup unlang code below "preprocess" (authorize section of virtual server "default): if(Huntgroup-Name == xos) { update control { Auth-Type = pap } } unlang code below "ldap" (authorize section of virtual server "default): # reject users which are member of a read-only and a read-write group if(Ldap-Group == "cn=alu.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=alu.ro,ou=Groups,dc=test,dc=local") { reject } elsif(Ldap-Group == "cn=netscreen.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=netscreen.ro,ou=Groups,dc=test,dc=local") { reject } elsif(Ldap-Group == "cn=nsm.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=nsm.ro,ou=Groups,dc=test,dc=local") { reject } elsif(Ldap-Group == "cn=aruba.rw,ou=Groups,dc=test,dc=local" && Ldap-Group == "cn=aruba.ro,ou=Groups,dc=test,dc=local") { reject } # Allow only members of AD-Group "cn=radius.users,ou=Groups,dc=test,dc=local" to authenticate against AD! if(Ldap-Group == "cn=radius.users,ou=Groups,dc=test,dc=local") { update control { Auth-Type = ntlm_auth } # # Return-Attribute Section # # Return appropriate return attributes to members of "cn=alu.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=alu.rw,ou=Groups,dc=test,dc=local") { update reply { Alcatel-Access-Priv = Alcatel-Read-Priv Alcatel-Access-Priv += Alcatel-Write-Priv Alcatel-Access-Priv += Alcatel-Admin-Priv Alcatel-Acce-Priv-F-W1 := 0xffffffff Alcatel-Acce-Priv-F-W2 := 0xffffffff Alcatel-Asa-Access := All Service-Type := 6 } } # Return appropriate return attributes to members of "cn=alu.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=alu.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=alu.rw,ou=Groups,dc=test,dc=local") { update reply { Alcatel-Access-Priv := Alcatel-Read-Priv Alcatel-Acce-Priv-F-R1 := 0xFFFFFFFF Alcatel-Acce-Priv-F-R2 := 0xFFFFFFFF Alcatel-Acce-Priv-F-W1 := 0x0000000A Alcatel-Acce-Priv-F-W2 := 0x00000000 Alcatel-Asa-Access := all } } # Return appropriate return attributes to members of "cn=netscreen.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=netscreen.rw,ou=Groups,dc=test,dc=local") { update reply { NS-Admin-Privilege := Root-Admin } } # Return appropriate return attributes to members of "cn=netscreen.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=netscreen.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=netscreen.rw,ou=Groups,dc=test,dc=local") { update reply { NS-Admin-Privilege := Read-Only-Admin } } # Return appropriate return attributes to members of "cn=nsm.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=nsm.rw,ou=Groups,dc=test,dc=local") { update reply { NS-NSM-User-Domain-Name := global NS-NSM-User-Role-Mapping := "global:System Administrator" } } # Return appropriate return attributes to members of "cn=nsm.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=nsm.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=nsm.rw,ou=Groups,dc=test,dc=local") { update reply { NS-NSM-User-Domain-Name := global NS-NSM-User-Role-Mapping := "global:Read-Only System Administrator" } } # Return appropriate return attributes to members of "cn=aruba.rw,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=aruba.rw,ou=Groups,dc=test,dc=local") { update reply { Aruba-Admin-Role := root Aruba-Priv-Admin-User := 1 } } # Return appropriate return attributes to members of "cn=aruba.ro,ou=Groups,dc=test,dc=local" if(Ldap-Group == "cn=aruba.ro,ou=Groups,dc=test,dc=local" && !Ldap-Group == "cn=aruba.rw,ou=Groups,dc=test,dc=local") { update reply { Aruba-Admin-Role := read-only } } } This is working quite well. An AD user can't logon to a telnet device because the Auth-Type is set to PAP. A local user defined in users file can't logon to any other device than the telnet ones cause of the Huntgroup restriction: xosadmin Huntgroup-Name == xos, Cleartext-Password := "testpw" Now I'm coming closer to my questions. When a local user logon to a telnet device freeradius does all the ldap membership queries. When an AD user will logon to a telnet device freeradius also does all the ldap membership queries. Q1: Can I abbreviate this process that when a local user wants access to a telnet device the ldap queries will be skipped? Q2: Is there a smarter way to reject a local user immediately when he wants to logon to a non telnet device? Q3: Is there a smarter way to reject an AD user immediately when he wants to logon to a telnet device? Q4: Are there any tweaking capabilities to my unlang code to make it smarter or more hardened? Q5: Can I abbreviate any code snippets like using a switch/case block or use variables or anything I don't know? Q6: Are the positions of the unlang code in the authorize section correct? Thanks in advance for any help and hints. Regards, Tobias Hachmer

2 2

pam_radius not using /etc/raddb/server
by g17jimmy 09 Apr '12

09 Apr '12

I have a client system that seems to be ignoring changes in the pam_radius config file, /etc/raddb/server. I initially configured the system with a simple shared secret and had it pointed to a test server and now when I change the file /etc/raddb/server the client still talks to the test server instead of the new freeradius server. I even added the test server IP address to the new freeradius server and verified that the client is even still using the old simple shared secret. I've gone as far as completely removing the /etc/raddb/server file and the client continues to use the previous config. What am I missing? The system has been rebooted numerous times. -- View this message in context: http://freeradius.1045715.n5.nabble.com/pam-radius-not-using-etc-raddb-serv… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Failure to Process radgroupreply
by Andrew Long 08 Apr '12

08 Apr '12

Platfrom: CentOS 5.8 FreeRADIUS: 2.1.8 Backend: MySQL I am unable to get FreeRadius to reply with attributes assigned in the radgroupreply table for some groups. When the same attributes are assigned in radreply, the server sends them as expected. Adding a Fall-Through entry for the user in radreply makes no difference (the server defaults to Fall-Through from the config). I can see no difference in the structure of the user/groups between working and non-working accounts. I've spent most of the night combing the web, wiki, and other resources, but I find nothing quite like this. For instance: # radcheck testuser1 Cleartext-Password := password # radreply (WORKS) testuser1 Nomadix-Bw-Down := 768 # radusergroup testuser1 test-group 1 # radgroupreply (DOES NOT WORK) testuser1 Nomadix-Bw-Down := 768 Here is debug output from an auth request for this account (when the pairs are only in radgroupreply). You'll notice there is no processing of the radgroupreply table. rad_recv: Access-Request packet from host xx.xx.xx.xx port 29817, id=170, length=49 User-Name = "testuser1" User-Password = "password" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> testuser1 [sql] sql_set_user escaped user --> 'testuser1' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser1' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser1' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testuser1' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test-group' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[monthlycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[daypasscounter] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "password" [pap] Using clear text password "password" [pap] User authenticated successfully ++[pap] returns ok Login OK: [testuser1] (from client wolfchase-gateway port 0) +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser1 [sql] sql_set_user escaped user --> 'testuser1' [sql] expand: %{User-Password} -> password [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser1', 'password', 'Access-Accept', '2012-04-05 06:58:06') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser1', 'password', 'Access-Accept', '2012-04-05 06:58:06') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 170 to xx.xx.xx.xx port 29817 Finished request 166. Going to the next request Waking up in 3.0 seconds. Thank you for any help.

2 11

Re: EAP-PEAP + Windows 7 with SSO and Password change
by CD DD 08 Apr '12

08 Apr '12

Hi Alan, hmm, it seems not working by me. In the Debug Log you can see, that the radius Server send the CHAP-Error to the Supplicant. And on Windows 7 side, i got an Invalid Login but NOT a Password Change window. But this should Pop up with enabled passchange feature, right ? I enabled the passchange config in mschap module without success. What is wrong there ? DEBUG LOG: ########## (8) Found Auth-Type = EAP (8) # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) group authenticate { (8) - entering group authenticate {...} (8) eap : Request found, released from the list (8) eap : EAP/mschapv2 (8) eap : processing type mschapv2 (8) mschapv2 : # Executing group from file /usr/local/etc/raddb/sites-enabled/inner-tunnel (8) mschapv2 : group MS-CHAP { (8) mschapv2 : - entering group MS-CHAP {...} (8) mschap : NT Domain delimeter found, should we have enabled with_ntdomain_hack? (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 (8) mschap : Told to do MS-CHAPv2 for DOMAIN\test-user3 with NT-Password (8) mschap : expand: %{Stripped-User-Name} -> (8) mschap : ... expanding second conditional (8) mschap : expand: %{User-Name} -> DOMAIN\test-user3 (8) mschap : expand: %{%{User-Name}:-None} -> DOMAIN\test-user3 (8) mschap : expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=DOMAIN\test-user3 (8) mschap : NT Domain delimeter found, should we have enabled with_ntdomain_hack? (8) mschap : Creating challenge hash with username: DOMAIN\test-user3 (8) mschap : expand: %{mschap:Challenge} -> 4b4be3875649ba1a (8) mschap : expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=4b4be3875649ba1a (8) mschap : expand: %{mschap:NT-Response} -> a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 (8) mschap : expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=a900f8c9381beb68f33a91cc2f1c87bb72970bdd62ece3a2 Exec-Program output: Password expired (0xc0000648) Exec-Program-Wait: plaintext: Password expired (0xc0000648) Exec-Program: returned: 1 (8) mschap : ntlm_auth says password has expired (8) [mschap] = reject rlm_eap_mschapv2: No MS-CHAPv2-Success or MS-CHAP-Error was found. (8) eap : Handler failed in EAP/mschapv2 (8) eap : Failed in EAP select (8) [eap] = invalid (8) Failed to authenticate the user. (8) Login incorrect: [DOMAIN\\test-user3/<via Auth-Type = EAP>] (from client switches port 0 via TLS tunnel) } # server inner-tunnel (8) peap : Got tunneled reply code 3 MS-CHAP-Error = "\013E=648 R=0 C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\013E=648 R=0 C=62fa0aad52c662d5b02fcda34542d074 V=3 M=Password Expired" EAP-Message = 0x040b0004 Message-Authenticator = 0x00000000000000000000000000000000 (8) peap : Tunneled authentication was rejected. (8) peap : FAILURE (8) [eap] = handled Sending Access-Challenge of id 128 to 192.168.15.52 port 2686 EAP-Message = 0x010c002b190017030100202f2f3b44177589096e8dbced7004dd801b1a777dd1a966acf5dcbde958537403 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7cb2ed6374bef496dfd35c4e86820391 (8) Finished request 8. Waking up in 0.1 seconds. rad_recv: Access-Request packet from host zzz.aaa.xxx.yyy port 2686, id=129, length=262 Framed-MTU = 1480 NAS-IP-Address = zzz.aaa.xxx.yyy NAS-Identifier = "SWITCHxxx" User-Name = "DOMAIN\\test-user3" Service-Type = Framed-User Thanks a lot, C. >CD DD wrote: >> and how do i get this working ? > > read raddb/mods-available/mschap > > Alan DeKok. -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

1 0