April 2012 - Freeradius-Users - lists.freeradius.org

Nomadix VSA
by Andrew Long 05 Apr '12

05 Apr '12

I am trying to implement two of the Nomadix VSA's, Nomadix-BW-Up and Nomadix-BW-Down. They are included in the dictionary.nomadix that shipped with my installed version, 2.1.8 running on CentOS. I am using a MySQL backend and have tried adding the attributes in radgroupreply (for user group) and radreply (for user), both without success. I have tried +=, ==, and := as operators, also without success. raddiusd -X does not complain about any of these, and the user authenticates but has a full pipe for BW, rather than the designated 768/256 Down/Up. Any help would be hugely appreciated as I'm working under a deadline. Thank you, Andrew Long EscapeWire Solutions

2 4

MAC-Auth issues with rlm_perl
by Glen Harris 05 Apr '12

05 Apr '12

Server: Debian 6 (Squeeze) 2.6.32-5-amd64 FreeRadius: 2.1.10 (Debian package) Client: HP E-MSM460 AP (MSCHAPv2, Use message authenticator) Authentication methods for the MSM460 are: MSCHAPv2, MSCHAP, CHAP, EAP MD5 and PAP. I'm trying to set up a simple MAC-Auth based network using HP 2610 switches and MSM640 wireless APs as radius clients. I've added the AP to the clients.conf and configured the AP to use MAC-based authentication and it appears to be talking to FreeRadius using MSCHAPv2 correctly. We only have a few dozen clients, so I'm using the perl module to read and cache a text file of MAC addresses. My script watches the file's mtime and re-loads it as necessary. I've followed the instructions on http://wiki.freeradius.org/Rlm_perl, but I get the following error: /etc/freeradius/users[204]: Parse error (check) for entry DEFAULT: Unknown value Perl for attribute Auth-Type After some trial and error, I found that adding perl to the authorize and authenticate sections of sites-available/inner-tunnel would get rid of the error, but I have no idea if that solved the problem or merely masked it and caused he next one. There appears to be something seriously wrong with the way this config is working, because rlm_perl is calling the AUTHORIZE function but not AUTHENTICATE. I've pasted the debug of an authentication attempt below. It appears to be taking the CLIENT mschap authentication and somehow applying those attributes to mangle USER authentication. rad_recv: Access-Request packet from host 192.168.0.29 port 35063, id=48, length =275 Acct-Session-Id = "1ca83cd8-00013b2c" NAS-Port = 0 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "CN18D332BD" NAS-IP-Address = 192.168.0.29 User-Name = "984b4af5bf40" Calling-Station-Id = "98:4b:4a:f5:bf:40" Called-Station-Id = "2c:41:38:f4:f5:c0" Service-Type = Login-User MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc6800000000000000 00fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba Colubris-AVPair = "ssid=TSV-UC" Colubris-AVPair = "phytype=IEEE802dot11n" Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "984b4af5bf40", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 204 ++[files] returns ok rlm_perl: AUTHORIZE rlm_perl: RAD_REQUEST: NAS-Port-Type = Wireless-802.11 rlm_perl: RAD_REQUEST: Acct-Session-Id = 1ca83cd8-00013b2c rlm_perl: RAD_REQUEST: Service-Type = Login-User rlm_perl: RAD_REQUEST: Called-Station-Id = 2c:41:38:f4:f5:c0 rlm_perl: RAD_REQUEST: Calling-Station-Id = 98:4b:4a:f5:bf:40 rlm_perl: RAD_REQUEST: Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e rlm_perl: RAD_REQUEST: MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 rlm_perl: RAD_REQUEST: User-Name = 984b4af5bf40 rlm_perl: RAD_REQUEST: NAS-Identifier = CN18D332BD rlm_perl: RAD_REQUEST: MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba rlm_perl: RAD_REQUEST: Colubris-AVPair = ARRAY(0x127d4d8) rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 192.168.0.29 rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair Acct-Session-Id = 1ca83cd8-00013b2c rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Called-Station-Id = 2c:41:38:f4:f5:c0 rlm_perl: Added pair Calling-Station-Id = 98:4b:4a:f5:bf:40 rlm_perl: Added pair Message-Authenticator = 0xf6affdfe1901c35141d3128eed2c515e rlm_perl: Added pair MS-CHAP-Challenge = 0x5ec43b8666ef945c1db7a14cc42da516 rlm_perl: Added pair User-Name = 984b4af5bf40 rlm_perl: Added pair NAS-Identifier = CN18D332BD rlm_perl: Added pair MS-CHAP2-Response = 0x3000f12947d93103bfe476001a4f8d6fcc680000000000000000fe6dae7fbe3907cbb43186ffcc0ed0f6f16a31b47731bdba rlm_perl: Added pair Colubris-AVPair = ssid=TSV-UC rlm_perl: Added pair Colubris-AVPair = phytype=IEEE802dot11n rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 192.168.0.29 rlm_perl: Added pair Auth-Type = MSCHAP ++[perl] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: 984b4af5bf40 [mschap] Told to do MS-CHAPv2 for 984b4af5bf40 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 984b4af5bf40 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 48 to 192.168.0.29 port 35063 Regards, Glen.

5 11

MSCHAP Auth fails
by Weber, Felix 05 Apr '12

05 Apr '12

Hello out there, I'm testing the FreeRADIUS Version 2.1.12 Modul with AD Integration following the deployingradius.com Guide. Installed winbind and samba Version 3.6.3 and ntlm_auth tests are fine. Now i'm testing with radtest while running radius in Debug mod. The following line has been added to users: DEFAULT Auth-Type = mschap This is the output from radtest: radtest -t mschap User001 USERPW localhost 0 s3cr3t Sending Access-Request of id 61 to 127.0.0.1 port 1812 User-Name = "User001" NAS-IP-Address = 172.16.28.168 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0x7e9462ca7fbf5d20 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000a42d3b5b243dede8b6 dc20fc78f0fdad458a494f649cca2b rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=61, length=38 MS-CHAP-Error = "\000E=691 R=1" And this from radiusd -X: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 48471, id=105, length=133 User-Name = "User001" NAS-IP-Address = 172.16.28.168 NAS-Port = 0 Message-Authenticator = 0x5d1a20d2d2c7897d376d003f73153552 MS-CHAP-Challenge = 0x28d302e62ccf7399 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000f7b8cd66af90b5791f b4b09421dbbf2cbed180e7e72304b5 server packetfence { # Executing section authorize from file /etc/raddb/sites-enabled/packetfence +- entering group authorize {...} [suffix] No '@' in User-Name = "User001", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair User-Name = User001 rlm_perl: Added pair MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000f7b8cd66af90b5791f b4b09421dbbf2cbed180e7e72304b5 rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 172.16.28.168 rlm_perl: Added pair MS-CHAP-Challenge = 0x28d302e62ccf7399 rlm_perl: Added pair Message-Authenticator = 0x5d1a20d2d2c7897d376d003f73153552 rlm_perl: Added pair Auth-Type = MSCHAP ++[packetfence] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/packetfence +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{mschap:User-Name:-None} -> User001 [mschap] expand: --username=%{%{Stripped-User-Name}:-%{mschap:User-Name:-None}} -> --username=User001 [mschap] mschap1: 28 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=28d302e62ccf7399 [mschap] expand: #ntresponse=%{mschap:NT-Response:-00} -> #ntresponse=f7b8cd66af90b5791fb4b09421dbbf2cbed180e7e72304b5 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Login incorrect (mschap: External script says Logon failure (0xc000006d)): [User001] (from client 127.0.0.1 port 0) The ntlm_auth is well configured in mschap module (--ntresponse)! Thanks for helping.

3 5

Can't get accounting radacct to work?
by Tim Tyler 04 Apr '12

04 Apr '12

Freeradius experts, I am running Freeradius 2.1.10 on two different Redhat 6.2 systems. Both of them work fine. We are using ldap back end and we have no problem with client connections on either server. The problem I have is that one of my servers (64 bit on vmware) won’t give me accounting records for client connections in the radacct directory. The log directory is /var/log/radius/radacct. Nothing gets written in it. On my 32 bit system, I see plenty of ip address directories getting written in the radacct directory with every client connection and disconnection. I just can’t get it to work on my 64 bit system. The /var/log/radius/radius.log file works fine on both servers. They both share very similar setups and configurations. I have compared both systems and I can’t seem to find a meaningful difference. Does anyone know where I might look to see why accounting is not occurring in the radacct directory? I should see ip address directories with content but it remains completely empty in spite of all the connections. Also note that I have configured default and inner-tunnel for ldap support which does appear to be working fine. The client.conf files are identical from both systems. Thoughts? Tim Tyler Network Engineer Beloit College

2 1

Create a counter for Max-Single-Session
by Lorenzo Milesi 04 Apr '12

04 Apr '12

Hi. Is it possible to create a counter which limits the single session of a user? I'd like to create a generic temporary access, and a session should last for few minutes max. thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

3 2

rlm_expiration access
by papariga 04 Apr '12

04 Apr '12

Hi, i need to configure a freeradius server to : 1. check expiration date 1.1 if account is expired - change back to auth-type = accept and assign some private ip address. is it possible , i could not find anything :( -- View this message in context: http://freeradius.1045715.n5.nabble.com/rlm-expiration-access-tp5618349p561… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

windows 7 eap-tls authentication
by Christian Bösch 04 Apr '12

04 Apr '12

hi list, i want to authenticate windows 7 computers with tls certificates. the certs have the special windows OIDs, but i still get the error from below. on the website http://wiki.freeradius.org/Certificate_Compatibility there is only winxp mentioned. is there maybe any difference with windows 7? has anyone done this or a hint whats going wrong? thanks in advance, chris --- rad_recv: Access-Request packet from host 172.16.64.240 port 1645, id=133, length=153 User-Name = "host/cb-nb" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-12-01-1B-2A-40" Calling-Station-Id = "00-24-7E-6B-E4-BE" EAP-Message = 0x0202000f01686f73742f63622d6e62 Message-Authenticator = 0xdfa853b693abac5cede3b893dac561ba NAS-Port-Type = Ethernet NAS-Port = 50217 NAS-Port-Id = "FastEthernet2/17" NAS-IP-Address = 172.16.64.240 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} [eap] EAP packet type response id 2 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 133 to 172.16.64.240 port 1645 EAP-Message = 0x010300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xebeac82aebe9c52b6c542d897c25837b Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 133 with timestamp +15 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xebeac82aebe9c52b did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. ---

2 1

Disconnect a Mikrotik NAS client from Daloradius
by Javier Ruiz Escalante 04 Apr '12

04 Apr '12

Hello all, I would like to disconnect a client which is connected through a Mikrotik Hotspot and the command used normally via Chillispot does not work, I know that I have to use several attributes like session id and so on, but no clue how to use them. Can somebody give me a clue? Thank you very much in advance. Regards

3 2

adding custom attribute with ldap_xlat
by mimir 04 Apr '12

04 Apr '12

Hello, I am trying to add custom attribute to accounting packet and proxy to them to different servers by using ldap_xlat. But, although I query the ldap successfully and see the correct value in debug logs, attributes values are wrong, and changed. What is the cause? Do you have any comment. debug output: ------------------- [ldap] - ldap_xlat end [preprocess] expand: %{ldap:ldap:///dc=test,dc=com?userid1?sub?msisdn=1234567891} -> 1234567890987654321 [ldap] - ldap_xlat [preprocess] expand: ldap:///dc=test,dc=com?userid2?sub?msisdn=1234567891 -> ldap:///dc=test,dc=com?userid2?sub?msisdn=1234567891 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=test,dc=com, with filter msisdn=1234567891 [ldap] Adding attribute userid2, value: *123454321123454321* [ldap] ldap_release_conn: Release Id: 0 [ldap] - ldap_xlat end [preprocess] expand: %{ldap:ldap:///dc=test,dc=com?userid2?sub?msisdn=1234567891} -> *123454321123454321* hints file: ---------------- DEFAULT Acct-Status-Type == Start userid1 = "%{ldap:ldap:///dc=test,dc=com?userid1?sub?msisdn=1234567891}", userid2 = "%{ldap:ldap:///dc=test,dc=com?userid2?sub?msisdn=1234567891}" NAS-Port = 1 Framed-IP-Address = 2.2.2.17 NAS-IP-Address = 135.243.90.68 Called-Station-Id = "internet1" Service-Type = Framed-User * userid1 = 2976652465 userid2 = 210562417* Proxy-State = 0x3531 Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/adding-custom-attribute-with-ldap-x… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1

xlat errors & filter logs
by mimir 04 Apr '12

04 Apr '12

Hello, I am adding custom attributes and replicate or proxy them to other radius servers. But I also want to log this operation. I test it via sql xlat. ( I will also use ldap xlat, I think they will be same like "%ldap: ....." ) For example, I am waiting 20 digit number from my queries. But, if I get NULL or sth different from 20 digit number, I want to log it to somewhere. Is it possible? DEFAULT Acct-Status-Type == Start Test-ID-1 = "%{sql:SELECT id from deneme limit 1}", Test-ID-2 = "%{sql:SELECT id from deneme limit 1}" DEFAULT Acct-Status-Type == Stop Test-ID-1 = "%{sql:SELECT id from deneme limit 1}", Test-ID-2 = "%{sql:SELECT id from deneme limit 1}" Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/xlat-errors-filter-logs-tp5614816p5… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 1