April 2012 - Freeradius-Users - lists.freeradius.org

ntlm_auth & ldap authorize questions
by Tobias Hachmer 04 Apr '12

04 Apr '12

Hello list, I set up a testing environment with an virtual Windows Server 2008 R2 server with Active Directory Role and a virtual freeradius server (v2.1.12). For the authentication I use ntlm_auth (followed instructions on http://deployingradius.com/documents/configuration/active_directory.html) which works great. I understand that I cannot authorize using ntlm_auth so I want to set up the ldap module for authorization, e.g. perform checks on group memberships. The ldap bind with the builtin Administrator and also the ldap search in the basedn for the builtin account Administrator is successful: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 42796, id=160, length=83 User-Name = "Administrator" User-Password = "abc123!" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x2f21233db6232800e133f6891b78309d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Administrator", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for Administrator [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> Administrator [ldap] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=Administrator) [ldap] expand: cn=Users,dc=test,dc=local -> cn=Users,dc=test,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=Users,dc=test,dc=local, with filter (cn=Administrator) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user Administrator authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=Administrator [ntlm_auth] expand: --password=%{User-Password} -> --password=abc123! Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 160 to 127.0.0.1 port 42796 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 160 with timestamp +380 Ready to process requests. My first problem is that I cannot do the ldap bind with any other user as the builtin Administrator. I created a new user freeradius in cn=Users,dc=test,dc=local where the builtin Administrator also is located but the bind fails: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 44706, id=162, length=83 User-Name = "Administrator" User-Password = "abc123!" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x6b50ad7469b14cd74c9fcb7c41d93cc1 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "Administrator", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for Administrator [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> Administrator [ldap] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=Administrator) [ldap] expand: cn=Users,dc=test,dc=local -> cn=Users,dc=test,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to testwdc.test.local:389, authentication 0 [ldap] bind as cn=freeradius,cn=Users,dc=test,dc=local/abc234! to testwdc.test.local:389 [ldap] waiting for bind result ... [ldap] LDAP login failed: check identity, password settings in ldap section of radiusd.conf [ldap] (re)connection attempt failed [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> Administrator attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 162 to 127.0.0.1 port 44706 Waking up in 4.9 seconds. Cleaning up request 0 ID 162 with timestamp +6 Ready to process requests Question: Are there any permission requirements for binddn user or has anyone a hint why the ldap bind with any other user as builtin Administrator fails? Also the ldap search for any other user as the builtin Administrator fails: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 54411, id=98, length=80 User-Name = "freeradius" User-Password = "abc234!" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x5158c0c680156b9feda64a7ac17c880e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "freeradius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 205 ++[files] returns ok [ldap] performing user authorization for freeradius [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> freeradius [ldap] expand: (cn=%{%{Stripped-User-Name}:-%{User-Name}}) -> (cn=freeradius) [ldap] expand: cn=Users,dc=test,dc=local -> cn=Users,dc=test,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in cn=Users,dc=test,dc=local, with filter (cn=freeradius) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=freeradius [ntlm_auth] expand: --password=%{User-Password} -> --password=abc234! Exec-Program output: NT_STATUS_OK: Success (0x0) Exec-Program-Wait: plaintext: NT_STATUS_OK: Success (0x0) Exec-Program: returned: 0 ++[ntlm_auth] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 98 to 127.0.0.1 port 54411 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 98 with timestamp +32 Ready to process requests. Thanks in advance for pointing me to the right direction. Regards, Tobias Hachmer

2 2

Re: MSSCHAP auth + LDAP authorizaton (Working. Sort Of)
by Alan Buxey 04 Apr '12

04 Apr '12

Stick unlang wrapper around the call to ldap ie if(request from VPN){ ldap } alan

1 0

RE: MSSCHAP auth + LDAP authorizaton
by Andres Septer 04 Apr '12

04 Apr '12

----- Original Message ----- From: "Matthew Newton" <mcn4(a)leicester.ac.uk> Sent: Tue, 3.4.2012 13:01 To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: Re: MSSCHAP auth + LDAP authorizaton [SNIP] The LDAP module can be configured for group lookups - look about half way down modules/ldap, you'll find the group settings. Check radiusd -X to see what it's doing, as usual. Use unlang in your inner-tunnel authorize section to check the ldap group, something along the lines of (very untested): if (!(Ldap-group == 'cn=group,dc=example,dc=com')) { reject } OK, thats an interesting idea. This should go to inner tunnel, and inner tunnel only??? I found some example on lists archives (fortunately, they work again) and follwed this one. It only used "filter" statement. I have read docs/rlm_ldap but still dont't quite get, whats "filter" and "group" filter are for. I tried this configuration: Ldap module conf ldap { <------>server = "local.track.ee" <------>identity = "CN=ldapbind,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee" <------>password = "XXXXXXXXXXXXXXX" <------>basedn = "DC=local,DC=track,DC=ee" <------>filter = "(&(SAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=CN=VPNUsers,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee))" <------>#base_filter = "(objectclass=radiusprofile)" #debugging purposes ldap_debug = 0x0028 LDAP bind and queries tested in JExplorer, they work ok commented ldap in on authorization stanzas of innter-tunnel and tested. Here's output rad_recv: Access-Request packet from host 127.0.0.1 port 34775, id=2, length=141 User-Name = "freeradius.test" NAS-IP-Address = 10.128.160.4 NAS-Port = 0 Message-Authenticator = 0x530dad2e80d15ff25193eb9ff5834f96 MS-CHAP-Challenge = 0x043031fc454d971c MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000093e05fd8f5df4a2ae229f031aa0f4290ea1debe45039c363 Wed Apr 4 12:50:29 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Apr 4 12:50:29 2012 : Info: +- entering group authorize {...} Wed Apr 4 12:50:29 2012 : Info: ++[preprocess] returns ok Wed Apr 4 12:50:29 2012 : Info: ++[chap] returns noop Wed Apr 4 12:50:29 2012 : Info: [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' Wed Apr 4 12:50:29 2012 : Info: ++[mschap] returns ok Wed Apr 4 12:50:29 2012 : Info: ++[digest] returns noop Wed Apr 4 12:50:29 2012 : Info: [suffix] No '@' in User-Name = "freeradius.test", looking up realm NULL Wed Apr 4 12:50:29 2012 : Info: [suffix] No such realm "NULL" Wed Apr 4 12:50:29 2012 : Info: ++[suffix] returns noop Wed Apr 4 12:50:29 2012 : Info: [eap] No EAP-Message, not doing EAP Wed Apr 4 12:50:29 2012 : Info: ++[eap] returns noop Wed Apr 4 12:50:29 2012 : Info: ++[files] returns noop Wed Apr 4 12:50:29 2012 : Info: [ldap] performing user authorization for freeradius.test Wed Apr 4 12:50:29 2012 : Info: [ldap] expand: %{Stripped-User-Name} -> Wed Apr 4 12:50:29 2012 : Info: [ldap] ... expanding second conditional Wed Apr 4 12:50:29 2012 : Info: [ldap] expand: %{User-Name} -> freeradius.test Wed Apr 4 12:50:29 2012 : Info: [ldap] expand: (&(SAMAccountName=%{%{Stripped-User-Name}:-%{User-Name}})(memberOf=CN=VPNUsers,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee)) -> (&(SAMAccountName=freeradius.test)(memberOf=CN=VPNUsers,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee)) Wed Apr 4 12:50:29 2012 : Info: [ldap] expand: DC=local,DC=track,DC=ee -> DC=local,DC=track,DC=ee Wed Apr 4 12:50:29 2012 : Debug: [ldap] ldap_get_conn: Checking Id: 0 Wed Apr 4 12:50:29 2012 : Debug: [ldap] ldap_get_conn: Got Id: 0 Wed Apr 4 12:50:29 2012 : Debug: [ldap] attempting LDAP reconnection Wed Apr 4 12:50:29 2012 : Debug: [ldap] (re)connect to local.track.ee:389, authentication 0 Wed Apr 4 12:50:29 2012 : Debug: [ldap] bind as CN=ldapbind,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee/XXXXXXXXXX to local.track.ee:389 Wed Apr 4 12:50:29 2012 : Debug: [ldap] waiting for bind result ... Wed Apr 4 12:50:29 2012 : Debug: [ldap] Bind was successful Wed Apr 4 12:50:29 2012 : Debug: [ldap] performing search in DC=local,DC=track,DC=ee, with filter (&(SAMAccountName=freeradius.test)(memberOf=CN=VPNUsers,OU=SBSUsers,OU=Users,OU=Navirec,DC=local,DC=track,DC=ee)) Wed Apr 4 12:50:29 2012 : Error: [ldap] ldap_search() failed: Operations error Wed Apr 4 12:50:29 2012 : Info: [ldap] search failed Wed Apr 4 12:50:29 2012 : Debug: [ldap] ldap_release_conn: Release Id: 0 Wed Apr 4 12:50:29 2012 : Info: ++[ldap] returns fail Wed Apr 4 12:50:29 2012 : Info: Using Post-Auth-Type Reject Wed Apr 4 12:50:29 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Wed Apr 4 12:50:29 2012 : Info: +- entering group REJECT {...} Wed Apr 4 12:50:29 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> freeradius.test Wed Apr 4 12:50:29 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Apr 4 12:50:29 2012 : Info: ++[attr_filter.access_reject] returns updated Wed Apr 4 12:50:29 2012 : Info: Delaying reject of request 0 for 1 seconds Wed Apr 4 12:50:29 2012 : Debug: Going to the next request Wed Apr 4 12:50:29 2012 : Debug: Waking up in 0.9 seconds. Wed Apr 4 12:50:30 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 2 to 127.0.0.1 port 34775 Why it fails on freeradius, though the query is correct. Am I following a wrong example afterall and Matthew's version is the way to go? Where goes initial LDAP configuration in Matthews suggestion? A.

1 1

configuration overview
by Alan Batie 04 Apr '12

04 Apr '12

I've been using freeradius for quite a while now, but never really grokked the config file. There is lots of documentation that gives you a narrow peep hole into the specific section it's concerned with and how to do common basic things, but there's nothing I've found that really talks about the structure of it and how everything interacts, which makes it hard to even know where to start to do something new, much less anything even slightly out of the ordinary. I don't suppose there's something out there that I've missed by chance?

2 1

How secure is the radius encryption
by Thomas Glanzmann 04 Apr '12

04 Apr '12

Hello, I wonder if the radius encryption between radius client and radius is secure enough if you choose a decent password like the following: 'O([G6krj\9[9FN#GVn(/|9+8h5vq2!W*J:OrA;2Uvk1G&*z~-6'emgQV 2X5iD>a(' Or if someone should always protect the connection between radius client to radius server using ipsec or some other VPN software like for example openvpn? I don't want to do radius over the internet but in a coporate intranet. However I want also to absolutly sure that noone is reading my pap passwords on the wire between radius client and radius server. Cheers, Thomas

3 4

PacketFence's Google Summer of Code (GSoC)
by Olivier Bilodeau 03 Apr '12

03 Apr '12

Note: Since PacketFence relies so much on FreeRADIUS and our integration is growing with time, we would welcome applications from students willing to work on FreeRADIUS or FreeRADIUS / PacketFence integration! Work all summer long on a hard-core Network Security project written in Perl! Students: You can make 5000 $USD contributing to our open source project and learn a lot along the way! What is PacketFence? PacketFence is a Free and Open Source network access control (NAC) system. Boasting an impressive feature set including a captive-portal for registration and remediation, guest management, centralized wired and wireless management, 802.1X support, layer-2 and 3 isolation of problematic devices, integration with the Snort IDS, Nessus or OpenVAS vulnerability scanners; PacketFence can be used to effectively secure networks. Mainly developed in Perl with some PHP, Web (HTML/CSS/Javascript) and SQL, PacketFence leverages components from famous open source projects like Snort, Apache's HTTPD, Net-SNMP, FreeRADIUS, mod_perl, MySQL, DHCPd, Bind (named), OpenVAS and more. Why choose PacketFence? Because the project is awesome! But also because we are doing our development on modern collaboration tools like git/github and using a pragmatic development strategy focused on delivering value. Iterative code reviews and mentor availability is guaranteed. We have delivered several major releases over the year and promise that your code will not languish in a 3rd party repository for years before being included. Your code might even be released during the summer! Lastly, you will be working on enterprise-level network access control technologies exactly as if you are part of the team! Imagine your resume after the summer! Here's a quick overview of our Ideas: * Create a multi-platform agent that would perform client-side security checks * Android-based application for Wireless security auto-configuration * Web administration interface rewrite * Initial configuration Web-based instead of through command line * nmap integration as a scanning engine * IF-MAP integration * Active - Active clustering support * Experiments in data visualization * New authentication schemes * Stealth mode - PacketFence in gather-only operation (just added!) * Your own idea! Ideas page and GSoC info: http://goo.gl/lgcp6 Apply: http://www.google-melange.com/gsoc/org/google/gsoc2012/packetfence (Hurry up! Application ends: April 06 at 19:00 UTC http://everytimezone.com/#2012-4-6,1860,6be) Source code: https://github.com/inverse-inc/packetfence Get in touch with us now! irc://irc.freenode.net/packetfence @packetfence on twitter obilodeau(a)inverse.ca Please help us get the word out by forwarding this email to your students, friends or favorite social site. -- Olivier Bilodeau obilodeau(a)inverse.ca :: +1.514.447.4918 *115 :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

1 0

Blackberry disabled server certificates query
by lmgo5991 03 Apr '12

03 Apr '12

Hi We are testing various deivces with our new eduroam wirelss and so far so good. However, an issue cropped up with blackberrys where during the setup, if you leave the box unchecked "disable server certificate validation" then the blackberry connects fine if you uncheck connection fails "failed to connect". I have checked other institutions and they have conflicting guides some say leave it checked others say uncheck. Can anyone advise the status - to check or uncheck? Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Blackberry-disabled-server-certific… Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 6

Proxy + copy accounting to passive home server
by mimir 03 Apr '12

03 Apr '12

Hello, I am trying to deploy proxy configuration to my radius server. I added home_server_pool with two home_servers. I can successfully send accounting packets (with load-balance) to other two radius servers. I also can use attribute filtering for proxy via acct_users as below. acct_users: DEFAULT Called-Station-Id = "internet1", Proxy-To-Realm := TEST1 But, I want to send same packet to both servers when proxying. If I proxied the accounting packet to server A successfully, then I want to also copy to it to the other radius server. (means that passive one for each packet while load-balancing) I read some forums and see that it can be done via "copy-acct-to-home-server". But, I could not configure it. (I also could not understand where I should edit it? on proxy ? or home_servers? Can you please help me on this issue? Thanks... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Proxy-copy-accounting-to-passive-ho… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 25

set and use internal comment variable
by PENZ Robert 03 Apr '12

03 Apr '12

Hi! I've a setup where it is possible to deny a request at various places for different reasons. I use sql_log in post-auth to log the replies. It would now be nice to add a comment variable which I fill at the various stations, that can deny a request, so I know why a request was denied. How should I try to solve this? Or is there an even better way without a comment variable to do something like this? Thx for your help. Mit freundlichen Grüßen Robert Penz ---------------------------------------------------- Dipl. Inf. Robert Penz DVT-Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 512 508 3334 / Fax: +43 512 508 3355 eMail: robert.penz(a)tirol.gv.at

2 1

Plain text shared secrets problematic?
by Heilz 02 Apr '12

02 Apr '12

Hi, I'm fairly new to the topic but I got the assignment to find out if the fact that the shared secrets for user logins are in plain-text could be a problem security-wise. Isn't there a way do encrypt them or make the password encryption more secure? I've been researching for some hours now and fould several articles about RADIUS' vulnerabilities, but noone seems to be concerned about this subject. I hope you might be able to clear things up for me. Regards Mathias -- View this message in context: http://freeradius.1045715.n5.nabble.com/Plain-text-shared-secrets-problemat… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 4