August 2012 - Freeradius-Users - lists.freeradius.org

Re: FreeRADIUS, 802.1x, and multiple user stores
by Jonathan L Ocab 01 Aug '12

01 Aug '12

I believe you shed light onto the AD situation, but one item of note is that my campus' primary user store is OpenLDAP and is what is used by our production FreeRADIUS services. What I need to do is so our primary AD forest's domain controllers can be used. An Active Directory domain authenticated host/workstation would need to use AD for the user store and anything else would go against OpenLDAP. But we also have the issue where there are separate AD forests in our campus environment. I will do some testing in my development environment to leverage ntlm_auth against our main campus AD store. -j > > > Date: Wed, 01 Aug 2012 10:19:25 -0700 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRADIUS, 802.1x, and multiple user stores > Message-ID: <5019651D.8060004(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Jonathan L Ocab wrote: >> My next step is getting 802.1x working such that FreeRADIUS can authenticate users to different Active Directory user stores based on the domain provided. > > That's not really how Active Directory works. The various domains > should all be accessible from one local AD server. Then, you > authenticate to that AD server, using the domain. The AD server figures > out how to authenticate the user. > > This is a fundamental limitation in AD. As a result, it's a > fundamental limitation in Samba, which is AD compatible. As a result, > it's a fundamental limitation in FreeRADIUS, which uses Samba for AD > authentication. > >> What would be the best way to implement FreeRADIUS such that authorization/authentication requests are confirmed against different Active Directory domains based on the domain information provided with the username? > > Use the "--domain" parameter to ntlm_auth. > >> Should I light up a new FreeRADIUS instance to correspond to each AD domain (or OpenLDAP) and proxy from the primary FreeRADIUS server handling 802.1x requests? > > That shouldn't be necessary. > >> Or should I handle it at the site configuration level and load a different 'ldap' module based on the domain provided with the username? > > No. > > Alan DeKok. >

2 1

problem with User-Name & Stripped-User-Name
by Tony Peña 01 Aug '12

01 Aug '12

hi, i'm trying to migrate freeradius 1.3.1 to 2.1.12. 1.3.1 works very fine but I need upgrades and my freeradius server auth in ldap and accounting on mysql.. and the new file configuration have a little change for me.. all fine but not work for me.. the stripped-user-name properly. if i use user-name. i can see in freeradiusd -X the username to can do account into mysql... but in my system i use hints too.. so when i auth with user@domain.. in mysql insert user@domain.. if i use stripped-user-name.. in mysql just insert username as i need.... BUT not happend.. username stay in blank :| i change something in somewhere because before works.. but right now don't know what i change in .confs :S any idea? check some lines in debug mode: User-Name = "emperor" radius packet, .. in radiusd -X using just username without Hints [radutmp] expand: %{User-Name} -> emperor [radutmp] expand: %{Stripped-User-Name:-%{User-Name}} -> emperor, and sql module -> [sql] Improperly nested variable; %{User-Name}} [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}}:-DEFAULT} -> '' Using Hints(a)my.domain.com User-Name = "emperor(a)my.domain.com" [suffix] No '@' in User-Name = "emperor", looking up realm NULL why not see the @ realm for check hint? my hints conf DEFAULT Suffix == "@my.domain.com", Strip-User-Name = Yes Hint = "userdefault", Service-Type = Framed-User, Framed-Protocol = PPP, in my auth seccion i type suffix to can check it. with just emperor, at sql not insert emperor just blank and with realm @ my.domain.com insert emperor into sql... should be works.. in both case ...... insert emperor. to can checkval mountlycounter for both case the acct-session-time. if need more conf files to can help please i can send more info.. thanxs for all -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001 -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001

3 8

FreeRADIUS, 802.1x, and multiple user stores
by Jonathan L Ocab 01 Aug '12

01 Aug '12

I'm playing around with 802.1x over the wire in a development environment at work and it's pretty much functional with the Windows and OS X hosts I've been testing with (OpenLDAP as backend userstore). My next step is getting 802.1x working such that FreeRADIUS can authenticate users to different Active Directory user stores based on the domain provided. What would be the best way to implement FreeRADIUS such that authorization/authentication requests are confirmed against different Active Directory domains based on the domain information provided with the username? Should I light up a new FreeRADIUS instance to correspond to each AD domain (or OpenLDAP) and proxy from the primary FreeRADIUS server handling 802.1x requests? Or should I handle it at the site configuration level and load a different 'ldap' module based on the domain provided with the username? Or is there another best practice? --- Jonathan Ocab | jocab(a)ucr.edu Infrastructure Security Analyst Computing and Communications University of California, Riverside

2 1

RADIUS Client/ supplicant or captive portal / mschapv2 pw change support
by Tobias Hachmer 01 Aug '12

01 Aug '12

Hello list, I know it isn't an directly FR issue but I hope that anybody on this list have had the questions I have now. Is there a RADIUS Client or a captive portal/ hotspot software which supports changing password via mschapv2? I know FRv3 will support this, but that's only the server side. Is there any software which supports password changes via mschapv2 like a Windows OS does with PEAP/MSCHAPv2? For example a captive portal which tells the user via web frontend if his password is expired and allows him to change it also via web frontend? google doesn't have any good answers for me. Maybe on this list is anyone who has done this before or have experience with this. Thanks in advance, Tobias Hachmer

2 4

Stopping database files from being deleted
by jobhunts02＠aol.com 01 Aug '12

01 Aug '12

I have two database files (db.*) that correspond to two counters set up using the rlm_counter module. I put these files into a directory whose contents will persist across reboots. Each time I reboot, the files are deleted and new files are created with the initial values I have defined. Could FreeRadius be deleting these files on reboots and is there any way to prevent this?

2 1

Re: radiusd -X SQL suggests "not found" however user attributes are in the radcheck table?
by Alan Buxey 01 Aug '12

01 Aug '12

Wait. You said you were trying to do dot1x.... but now you say MAB. The Auth-Type := accept construct would work with MAB... but better to put the matching cleartext-password instead. Your ideas ate almost online...no reason to make things complex , use SQL with radreply items for setting the VLAN. perhaps look at something like packetfence though alan

4 11

radiusd -X SQL suggests "not found" however user attributes are in the radcheck table?
by Kaya Saman 01 Aug '12

01 Aug '12

Hi, I have configured FR to connect to a backend MySQL DB which authenticates the NAS fine.... I removed the /etc/raddb/clients.conf file from the relevant places within the FR configuration. The setup I am trying to get working will use the DaloRADIUS web-ui frontend to setup users for MAB. Currently I have DaloRADIUS installed and setup to what I believe is properly as I can connect to the MySQL DB and create users in DR which appear in the MySQL DB. Additionally I have configured the NAS within DR which also works fine as radiusd -X doesn't suggest any type of NAS authentication error. My issue is that I am getting a "user not found" error with regards to the SQL DB backend. I have followed ever step of this guide: http://wiki.freeradius.org/SQL-HOWTO and configured appropriately to the instructions. This is the output of the MySQL radcheck table: mysql> select * from radcheck; +----+--------------+-------------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+-------------------------+----+----------+ | 1 | 0015c5537baa | Auth-Type | := | Accept | | 2 | 0015c5537baa | Tunnel-Type | = | VLAN | | 3 | 0015c5537baa | Tunnel-Medium-Type | = | IEEE-802 | | 4 | 0015c5537baa | Tunnel-Private-Group-Id | = | 20 | | 5 | 0015c5537baa | Tunnel-Preference | = | 0x000000 | +----+--------------+-------------------------+----+----------+ 5 rows in set (0.00 sec) The only difference between this and the wiki guide I can see is that examples on the wiki use capital lettering for the table headers.... (this might be my issue)?? Wiki example output: mysql> select * from radcheck; +----+----------------+--------------------+------------------+------+ | id | UserName | Attribute | Value | Op | +----+----------------+--------------------+------------------+------+ Using radiusd -X I am getting this response: Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1645, id=120, length=159 User-Name = "0015c5537baa" User-Password = "0015c5537baa" Service-Type = Call-Check Framed-MTU = 1500 Called-Station-Id = "00-1B-8F-60-AB-8D" Calling-Station-Id = "00-15-C5-53-7B-AA" Message-Authenticator = 0x367e5a0d693f65b22391b00913162cc7 NAS-Port-Type = Ethernet NAS-Port = 50013 NAS-Port-Id = "GigabitEthernet0/13" NAS-IP-Address = 10.0.0.1 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} [sql] expand: %{User-Name} -> 0015c5537baa [sql] sql_set_user escaped user --> '0015c5537baa' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0015c5537baa' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0015c5537baa' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 [sql] User 0015c5537baa not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. I have attached the full file as an extra: >From the information above, the User-Name attribute is being passed to FR and being checked on the MySQL backend, however "Not Found" meaning that from the MySQL radcheck output - that either it isn't connecting to the DB in regards to the User-Name portion or that somehow there is malformed information in there. As per the attached file the FreeRADIUS version is 2.1.10 running on CentOS 6.2 x64 build. The rlm_sql driver seems to be connecting to the DB (as stated the NAS is recognized after it has been provisioned within DaloRADIUS): rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:3306/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 rlm_sql (sql): Processing generate_sql_clients rlm_sql (sql) in generate_sql_clients: query is SELECT id, nasname, shortname, type, secret, server FROM nas rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Read entry nasname=10.0.0.1,shortname=Switch,secret=pass rlm_sql (sql): Adding client 10.0.0.1 (Switch, server=<none>) to clients list rlm_sql (sql): Released sql socket id: 4 Would anybody be able to help me understand where the issue lies and perhaps how to correct it? Many thanks! Regards, Kaya

2 6

Using unlang for authentication
by Andrei Petru Mura 01 Aug '12

01 Aug '12

I declared a new attribute on FR dictionary, called CarboSolutions-NotBefore. This attribute should contain the data time as a string before what the user should not be able to authenticate. That attribute is placed in radcheck table (like: CarboSolutions-NotBefore >= 20120801). I tried to deal with that following some threads from that forum on similar issues, that sooner or later leads to unlang procedures. I also read the unlang's man page. But I can't understand how to deal with unlang. Can anyone help me to obtain what I need? What I need: I need that every authentication request, should contain an CarboSolutions-NotBefore field with current date. If you have other better approaces for what I need, feel free to suggest me. N.B. I get inspired especially from that<http://freeradius.1045715.n5.nabble.com/Temporary-Accounts-td2756199.html#m…> post.

2 2