July 2012 - Freeradius-Users - lists.freeradius.org

RADIUS Client/ supplicant or captive portal / mschapv2 pw change support
by Tobias Hachmer 01 Aug '12

01 Aug '12

Hello list, I know it isn't an directly FR issue but I hope that anybody on this list have had the questions I have now. Is there a RADIUS Client or a captive portal/ hotspot software which supports changing password via mschapv2? I know FRv3 will support this, but that's only the server side. Is there any software which supports password changes via mschapv2 like a Windows OS does with PEAP/MSCHAPv2? For example a captive portal which tells the user via web frontend if his password is expired and allows him to change it also via web frontend? google doesn't have any good answers for me. Maybe on this list is anyone who has done this before or have experience with this. Thanks in advance, Tobias Hachmer

2 4

radiusd -X SQL suggests "not found" however user attributes are in the radcheck table?
by Kaya Saman 01 Aug '12

01 Aug '12

Hi, I have configured FR to connect to a backend MySQL DB which authenticates the NAS fine.... I removed the /etc/raddb/clients.conf file from the relevant places within the FR configuration. The setup I am trying to get working will use the DaloRADIUS web-ui frontend to setup users for MAB. Currently I have DaloRADIUS installed and setup to what I believe is properly as I can connect to the MySQL DB and create users in DR which appear in the MySQL DB. Additionally I have configured the NAS within DR which also works fine as radiusd -X doesn't suggest any type of NAS authentication error. My issue is that I am getting a "user not found" error with regards to the SQL DB backend. I have followed ever step of this guide: http://wiki.freeradius.org/SQL-HOWTO and configured appropriately to the instructions. This is the output of the MySQL radcheck table: mysql> select * from radcheck; +----+--------------+-------------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+-------------------------+----+----------+ | 1 | 0015c5537baa | Auth-Type | := | Accept | | 2 | 0015c5537baa | Tunnel-Type | = | VLAN | | 3 | 0015c5537baa | Tunnel-Medium-Type | = | IEEE-802 | | 4 | 0015c5537baa | Tunnel-Private-Group-Id | = | 20 | | 5 | 0015c5537baa | Tunnel-Preference | = | 0x000000 | +----+--------------+-------------------------+----+----------+ 5 rows in set (0.00 sec) The only difference between this and the wiki guide I can see is that examples on the wiki use capital lettering for the table headers.... (this might be my issue)?? Wiki example output: mysql> select * from radcheck; +----+----------------+--------------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+--------------------+------------------+------+ Using radiusd -X I am getting this response: Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=120, length=159 User-Name = "0015c5537baa" User-Password = "0015c5537baa" Service-Type = Call-Check Framed-MTU = 1500 Called-Station-Id = "00-1B-8F-60-AB-8D" Calling-Station-Id = "00-15-C5-53-7B-AA" Message-Authenticator = 0x367e5a0d693f65b22391b00913162cc7 NAS-Port-Type = Ethernet NAS-Port = 50013 NAS-Port-Id = "GigabitEthernet0/13" NAS-IP-Address = 10.0.0.1 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [sql] expand: %{User-Name} -> 0015c5537baa [sql] sql_set_user escaped user --> '0015c5537baa' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0015c5537baa' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0015c5537baa' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User 0015c5537baa not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. I have attached the full file as an extra: >From the information above, the User-Name attribute is being passed to FR and being checked on the MySQL backend, however "Not Found" meaning that from the MySQL radcheck output - that either it isn't connecting to the DB in regards to the User-Name portion or that somehow there is malformed information in there. As per the attached file the FreeRADIUS version is 2.1.10 running on CentOS 6.2 x64 build. The rlm_sql driver seems to be connecting to the DB (as stated the NAS is recognized after it has been provisioned within DaloRADIUS): rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=10.0.0.1,shortname=Switch,secret=pass rlm_sql (sql): Adding client 10.0.0.1 (Switch, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Would anybody be able to help me understand where the issue lies and perhaps how to correct it? Many thanks! Regards, Kaya

2 6

Using unlang for authentication
by Andrei Petru Mura 01 Aug '12

01 Aug '12

I declared a new attribute on FR dictionary, called CarboSolutions-NotBefore. This attribute should contain the data time as a string before what the user should not be able to authenticate. That attribute is placed in radcheck table (like: CarboSolutions-NotBefore >= 20120801). I tried to deal with that following some threads from that forum on similar issues, that sooner or later leads to unlang procedures. I also read the unlang's man page. But I can't understand how to deal with unlang. Can anyone help me to obtain what I need? What I need: I need that every authentication request, should contain an CarboSolutions-NotBefore field with current date. If you have other better approaces for what I need, feel free to suggest me. N.B. I get inspired especially from that<http://freeradius.1045715.n5.nabble.com/Temporary-Accounts-td2756199.html#m…> post.

2 2

Abwesenheit (was: radiusd -X SQL suggests "not found" however user attributes are in the radcheck table?)
by tietjen 31 Jul '12

31 Jul '12

Vom 21. Juli bis einschl. 12. August bin ich nicht erreichbar (Urlaub). Bitte beachten Sie, daß von mir keine eingehenden E-Mails bearbeitet werden können. Vertretung: Hr. Brinkmann, Tel. 040-7410-56129, brinkmann(a)uke.de Hr. Werner, Tel. 040-7410-59630, k.werner(a)uke.de Vielen Dank für Ihr Verständnis. Diese Mail wird nicht weitergeleitet. Jan Tietjen

1 0

Re: radiusd -X SQL suggests "not found" however user attributes are in the radcheck table?
by Alan Buxey 31 Jul '12

31 Jul '12

Look at the SQL output carefully. It's talking about radusergroup. Have you got such a user in there? Do you need to perform that check? alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

2 2

Abwesenheit (was: radiusd -X SQL suggests "not found" however user attributes are in the radcheck table?)
by tietjen 31 Jul '12

31 Jul '12

Vom 21. Juli bis einschl. 12. August bin ich nicht erreichbar (Urlaub). Bitte beachten Sie, daß von mir keine eingehenden E-Mails bearbeitet werden können. Vertretung: Hr. Brinkmann, Tel. 040-7410-56129, brinkmann(a)uke.de Hr. Werner, Tel. 040-7410-59630, k.werner(a)uke.de Vielen Dank für Ihr Verständnis. Diese Mail wird nicht weitergeleitet. Jan Tietjen

1 0

Global User Blacklist
by David Aldwinckle 31 Jul '12

31 Jul '12

Hello folks, I am trying to devise the best way to configure a global blacklist in freeradius. In the current configuration, I am handling a number of different authentication types with various virtual servers. For PEAP, I have integrated active directory, and for the other services, I use LDAP. Since LDAP makes group checking very easy, I was hoping that I could leverage that for my blacklisting needs. So, my question is: Is it possible to do LDAP group checking in post-auth of the default server even if the request is EAP? Cheers, Dave

3 7

Re: Prompt for new password on mac 10.7 after change with 2.1.12 ?
by Jonathan Paul 31 Jul '12

31 Jul '12

I have allow_retry = yes in /etc/raddb/modules/mschap and send_error = yes in the mschapv2 section of /etc/raddb/eap.conf I am not seeing any change in behavior from the mac, it doesn't even prompt for a new username/password so I must be missing something else Jonathan >>> alan buxey 07/30/12 5:14 PM >>> Hi, > Allow EAP-MSCHAPv2 to send error message to client. This change allows > some clients to prompt the user for a new password. See raddb/eap.conf, > mschapv2 section, "send_error". you need to enable the function in the mschap module AND in the eap.conf I'm not sure whether there was another little bugette in that code that slipped by which recently got fixed in the 3.0 pre-release? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Acct-Status-Type
by Khapare Joshi 31 Jul '12

31 Jul '12

hi all, I see Acct-Status-Type = Interim-Update in my detail log. does it mean Acct-Status-Type = Alive ? K

3 4

OCSP
by Maja Wolniewicz 31 Jul '12

31 Jul '12

Hi, I'm getting a segmentation fault when a user certificate is verified, OCSP is switched on and OCSP responder does not set the next update. Then in src/modules/rlm_eap/types/rlm_eap_tls/rlm_eap_tls.c the OCSP_resp_find_status returns null for nextupd and ASN1_GENERALIZEDTIME_print(bio_out, nextupd) call fails causing this segmentation fault. Embedding this call with if (nextupd) {} helps. I checked that the same issue occurs with the git version. Maja -- Maja Gorecka-Wolniewicz mgw(a)umk.pl Uczelniane Centrum Information & Communication Informatyczne Technology Centre Uniwersytet Mikolaja Kopernika Nicolaus Copernicus University Coll. Maximum, pl. Rapackiego 1, 87-100 Torun, Poland tel.: +48 56-611-27-40 fax: +48 56-622-18-50 tel. kom.: +48-693032574

2 1