September 2012 - Freeradius-Users - lists.freeradius.org

How to Authenticate Users from Multiple IP Adresses Using the MySQL Tables
by Scott Meyer 11 Sep '12

11 Sep '12

Using freeradius 2.1.8 The environment I am working in requires some users to be able to authenticate from multiple ip address and others from only one. How is this accomplished using the MySQL tables?

1 0

LDAP module file using localhost instead of external?
by Jennifer Mehl 10 Sep '12

10 Sep '12

Hello, I have an existing FreeRADIUS setup that is working quite well to authenticate/authorize users for WPA2 wireless to our smbpasswd file. This is 2.1.10+dfsg-2 on Debian Squeeze. I've recently acquired a "captive portal" network device that we are going to use for our guest wireless users. I'm in the process of setting FreeRADIUS for authentication to our campus' LDAP server. I've verified connectivity to the server using the OpenLDAP ldapsearch tools from the same host. However, when I define the server in the /etc/freeradius/modules/ldap files, it doesn't appear to be read properly by FreeRADIUS, which is defaulting instead to 'localhost' instead of our directory server, directory.ucsb.edu, which is defined in the module file. Here is the output of freeradius -X showing part of the file being read but then ignored?: Module: Linked to module rlm_ldap Module: Instantiating module "ucsbnetid" from file /etc/freeradius/modules/ldap ldap ucsbnetid { server = "localhost" port = 389 password = "" identity = "" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "o=notexist" filter = "(uid=%u)" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/freeradius/ldap.attrmap" ldap_debug = 40 ldap_connections_number = 5 compare_check_items = no do_xlat = yes edir_account_policy_check = no set_auth_type = yes } Here is my /etc/freeradius/modules/ldap file (password obfuscated): ldap ucsbnetid { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "directory.ucsb.edu" identity = "uid=chemrad,o=ucsb" password = ******** basedn = "o=ucsb" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=ucsbperson)" #base_filter = "(objectclass=radiusprofile)" # How many connections to keep open to the LDAP server. # This saves time over opening a new LDAP socket for # every authentication request. ldap_connections_number = 5 # seconds to wait for LDAP query to finish. default: 20 timeout = 4 # seconds LDAP server has to process the query (server-side # time limit). default: 20 # # LDAP_OPT_TIMELIMIT is set to this value. timelimit = 3 # # This subsection configures the tls related items # that control how FreeRADIUS connects to an LDAP # server. It contains all of the "tls_*" configuration # entries used in older versions of FreeRADIUS. Those # configuration entries can still be used, but we recommend # using these. # tls { # Set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # # The StartTLS operation is supposed to be # used with normal ldap connections instead of # using ldaps (port 689) connections start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # Certificate Verification requirements. Can be: # "never" (don't even bother trying) # "allow" (try, but don't fail if the cerificate # can't be verified) # "demand" (fail if the certificate doesn't verify.) # # The default is "allow" # require_cert = "demand" # # seconds to wait for response of the server. (network # failures) default: 10 # # LDAP_OPT_NETWORK_TIMEOUT is set to this value. net_timeout = 1 # } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap # Set password_attribute = nspmPassword to get the # user's password from a Novell eDirectory # backend. This will work ONLY IF FreeRADIUS has been # built with the --with-edir configure option. # # See also the following links: # # http://www.novell.com/coolsolutions/appnote/16745.html #https://secure-support.novell.com/KanisaPlatform/Publishing/558/3009668_f.SAL_Public.html # # Novell may require TLS encrypted sessions before returning # the user's password. # # password_attribute = userPassword # Un-comment the following to disable Novell # eDirectory account policy check and intruder # detection. This will work *only if* FreeRADIUS is # configured to build with --with-edir option. # edir_account_policy_check = no # # Group membership checking. Disabled by default. # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames}(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueName s)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # The following two configuration items are for Active Directory # compatibility. If you see the helpful "operations error" # being returned to the LDAP module, uncomment the next # two lines. # # chase_referrals = yes # rebind = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # THIS WILL ONLY WORK FOR PAP AUTHENTICATION. # # THIS WILL NOT WORK FOR CHAP, MS-CHAP, or 802.1x (EAP). # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} # set_auth_type = yes # ldap_debug: debug flag for LDAP SDK # (see OpenLDAP documentation). Set this to enable # huge amounts of LDAP debugging on the screen. # You should only use this if you are an LDAP expert. # # default: 0x0000 (no debugging messages) # Example:(LDAP_DEBUG_FILTER+LDAP_DEBUG_CONNS) ldap_debug = 0x0028 } Thank you for any assistance in troubleshooting this issue… --Jennifer ================================== Jennifer L. Mehl Director of Information Technology Dept. of Chemistry and Biochemistry 2618 PSBN University of California, Santa Barbara Santa Barbara, CA 93106-9510 mailto: mehl -at - chem.ucsb.edu 805-893-4392 (office) 805-451-7486 (cell) ==================================

2 1

Version 2.2.0 is released: upgrade NOW
by Alan DeKok 10 Sep '12

10 Sep '12

We're happy (and sad) to announce 2.2.0. It's been a year since the last release, so it's needed. However, this release announces an issue with unknown certificates in EAP-TLS, PEAP, and EAP-TTLS. Some certificates can overflow a field in the server, causing a crash. See: http://freeradius.org/security.html Everyone should upgrade to 2.2.0 immediately, or obtain a patched version from their vendor. Sorry for the issue. We'll take care to run Coverity more often in the future. FreeRADIUS 2.2.0 Mon 10 Sep 2012 12:00:00 CEST, urgency=medium Feature improvements * 100% configuration file compatible with 2.1.x. The only fix needed is to disallow "hashsize=0" for rlm_passwd * Update Aruba, Alcatel Lucent, APC, BT, PaloAlto, Pureware, Redback, and Mikrotik dictionaries * Switch to using SHA1 for certificate digests instead of MD5. See raddb/certs/*.cnf * Added copyright statements to the dictionaries, so that we know when people are using them. * Better documentation for radrelay and detail file writer. See raddb/modules/radrelay and raddb/radrelay.conf * Added TLS-Cert-Subject-Alt-Name-Email from patch by Luke Howard * Added -F <file> to radwho * Added query timeouts to MySQL driver. Patch from Brian De Wolf. * Add /etc/default/freeradius to debian package. Patch from Matthew Newton * Finalize DHCP and DHCP relay code. It should now work everywhere. See raddb/sites-available/dhcp, src_ipaddr and src_interface. * DHCP capabilitiies are now compiled in by default. It runs as a DHCP server ONLY when manually enabled. * Added one letter expansions: %G - request minute and %I request ID. * Added script to convert ISC DHCP lease files to SQL pools. See scripts/isc2ippool.pl * Added rlm_cache to cache arbitrary attributes. * Added max_use to rlm_ldap to force connection to be re-established after a given number of queries. * Added configtest option to Debian init scripts, and automatic config test on restart. * Added cache config item to rlm_krb5. When set to "no" ticket caching is disabled which may increase performance. Bug fixes * Fix CVE-2012-3547. All users of 2.1.10, 2.1.11, 2.1.12, and 802.1X should upgrade immediately. * Fix typo in detail file writer, to skip writing if the packet was read from this detail file. * Free cached replies when closing resumed SSL sessions. * Fix a number of issues found by Coverity. * Fix memory leak and race condition in the EAP-TLS session cache. Thanks to Phil Mayers for tracking down OpenSSL APIs. * Restrict ATTRIBUTE names to character sets that make sense. * Fix EAP-TLS session Id length so that OpenSSL doesn't get excited. * Fix SQL IPPool logic for non-timer attributes. Closes bug #181 * Change some informational messages to DEBUG rather than error. * Portability fixes for FreeBSD. Closes bug #177 * A much better fix for the _lt__PROGRAM__LTX_preloaded_symbols nonsense. * Safely handle extremely long lines in conf file variable expansion * Fix for Debian bug #606450 * Mutex lock around rlm_perl Clone routines. Patch from Eike Dehling * The passwd module no longer permits "hashsize = 0". Setting that is pointless for a host of reasons. It will also break the server. * Fix proxied inner-tunnel packets sometimes having zero authentication vector. Found by Brian Julin. * Added $(EXEEXT) to Makefiles for portability. Closes bug #188. * Fix minor build issue which would cause rlm_eap to be built twice. * When using "status_check=request" for a home server, the username and password must be specified, or the server will not start. * EAP-SIM now calculates keys from the SIM identity, not from the EAP-Identity. Changing the EAP type via NAK may result in identities changing. Bug reported by Microsoft EAP team. * Use home server src_ipaddr when sending Status-Server packets * Decrypt encrypted ERX attributes in CoA packets. * Fix registration of internal xlat's so %{mschap:...} doesn't disappear after a HUP. * Can now reference tagged attributes in expansions. e.g. %{Tunnel-Type:1} and %{Tunnel-Type:1[0]} now work. * Correct calculation of Message-Authenticator for CoA and Disconnect replies. Patch from Jouni Malinen * Install rad_counter, for managing rlm_counter files. * Add unique index constraint to all SQL flavours so that alternate queries work correctly. * The TTLS diameter decoder is now more lenient. It ignores unknown attributes, instead of rejecting the TTLS session. * Use "globfree" in detail file reader. Prevents very slow leak. Closes bug #207. * Operator =~ shouldn't copy the attribute, like :=. It should instead behave more like ==. * Build main Debian package without SQL dependencies * Use max_queue_size in threading code * Update permissions in raddb/sql/postgresql/admin.sql * Added OpenSSL_add_all_algorithms() to fix issues where OpenSSL wouldn't use methods it knew about. * Add more sanity checks in dynamic_clients code so the server won't crash if it attempts to load a badly formated client definition. <

1 0

using gmail as openid for wiki access ?
by Fred 10 Sep '12

10 Sep '12

Hi freeradius-user, Is it possible to use my gmail account to authenticate on the wiki using openid ? If yes, howto do it ? Best regards, Fred MAISON

2 1

Disconnect Request is not working
by ranjan kumar 10 Sep '12

10 Sep '12

Hi, I am trying to send the disconnect request from radius server to NAS, for that I have returned the RLM_MODULE_UPDATED from my module and in radiusd.conf accounting section edited like this ========================================================= if(updated){ update disconnect { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" Framed-IP-Address = "%{Framed-IP-Address}" Packet-Dst-Port = 1700 } } ========================================================== When I am sending my accounting interim request, got the below message and disconnect request is also not visible in wireshark. ========================================================== entering if (updated) {...} expand: %{User-Name} -> ******** expand: %{Acct-Session-Id} -> 50D6F0C014369761 expand: %{Framed-IP-Address} -> 10.5.127.115 +++[disconnect] returns updated ++- if (updated) returns updated [main_pool] This is not an Accounting-Stop. Return NOOP. ++[main_pool] returns noop } # server Access_Gateway Sending Accounting-Response of id 193 to 10.203.226.70 port 33544 WARNING: Unknown destination 10.203.226.70:1700 for CoA request. Do CoA Fail handler here ========================================================== Please give some guidelines, how to configure the disconnect request and which files has to modify. Thanks, Regards Ranjan

2 1

RADGROUPREPLY QUERY NOT EXECUTED
by Mada 09 Sep '12

09 Sep '12

Have tried several version builds on Centos 5.x - currently using FR 2.1.12 rlm_mysql stops after the group check query and does not execute the group reply query. 19:00:43 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply Sun Sep 9 19:00:43 2012 : Info: [sql] expand: SELECT groupname FROM usergroup Sun Sep 9 19:00:43 2012 : Info: [sql] expand: SELECT id, groupname, attribute,Value, op FROM radgroupcheck Sun Sep 9 19:00:43 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Queries are listed during module instantiation and queries work when run manually. Have seen similar unresolved thread. Greatly appreciate any help. Thanks ________________________________________________________________ Message sent using DataCom.MW 1.2.0

4 4

TLS / SSL negotiation fails when behind Cisco IP phone
by Dan Lundström 09 Sep '12

09 Sep '12

Hi! We are using EAP/TLS for wired authentication on our networks, in one of our sites the SSL negotiation fails when the client is connected behind a Cisco 7962 IP phone. We have this same setup working on other sites. The phone model varies between the sites, but I cannot find any information about incompatibilities for the particular phone model saying it should be the phone that is causing the problem. I figured that the problem was caused by fragmentation but after adjusting the fragment_size parameter in eap.conf, according to the comments..; # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. ..without any result, i am not sure anymore. When I connect the client directly to a switch port, without the IP phone in-between, everything works perfect. Here comes the relevant part of RADIUS debug output, first session - Without IP phone, directly connected to the switch [ client -> switch ]; ------------------------------------------------------------------------------ Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0b2e], Certificate [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Root CA [tls] --> subject = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Sub CA [tls] --> subject = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=0, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = US-LAPJAMIESON.us.xxxx.yyy [tls] --> subject = /CN=US-LAPJAMIESON.us.xxxx.yyy [tls] --> issuer = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> verify return:1 [tls] TLS_accept: SSLv3 read client certificate A [tls] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [tls] TLS_accept: SSLv3 read client key exchange A [tls] <<< TLS 1.0 Handshake [length 0106], CertificateVerify [tls] TLS_accept: SSLv3 read certificate verify A [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] [tls] <<< TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 read finished A [tls] >>> TLS 1.0 ChangeCipherSpec [length 0001] [tls] TLS_accept: SSLv3 write change cipher spec A [tls] >>> TLS 1.0 Handshake [length 0010], Finished [tls] TLS_accept: SSLv3 write finished A [tls] TLS_accept: SSLv3 flush data [tls] (other): SSL negotiation finished successfully SSL Connection Established ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ Second part - With IP phone in-between [ client -> ipphone -> switch ]; ------------------------------------------------------------------------------ Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Handshake [length 0b2e], Certificate [tls] chain-depth=2, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Root CA [tls] --> subject = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 [tls] chain-depth=1, [tls] error=0 [tls] --> User-Name = host/US-LAPJAMIESON.us.xxxx.yyy [tls] --> BUF-Name = Xxxx Sub CA [tls] --> subject = /DC=com/DC=xxxx/CN=Xxxx Sub CA [tls] --> issuer = /C=SE/O=Xxxx Communications AB/OU=IT-group/CN=Xxxx Root CA [tls] --> verify return:1 --> verify error:num=7:certificate signature failure [tls] >>> TLS 1.0 Alert [length 0002], fatal decrypt_error TLS Alert write:fatal:decrypt error TLS_accept: error in SSLv3 read client certificate B rlm_eap: SSL error error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block type is not 01 SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/US-LAPJAMIESON.us.xxxx.yyy attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 11 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 11 Sending Access-Reject of id 50 to 192.168.207.202 port 1812 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 ------------------------------------------------------------------------------ ------------------------------------------------------------------------------ I am stuck, any suggestions would be much appreciated. Brgds, //Dan

2 4

Re: smsotpd
by Thomas Glanzmann 08 Sep '12

08 Sep '12

Hello Franks, * Franks Andy (RLZ) IT Systems Engineer <Andy.Franks(a)sath.nhs.uk> [2012-09-09 01:19]: > The first thing I'm not clear on is the function of the "users" file > that's related to the Berkeley_db script. I'm not sure I understand why > it's needed. Is this a database of acceptable users that have access to > the OTP function? exactly that function has two purposes: - The list of persons that can authenticate via Kerberos for the first stage of the authentication if you exchange it with somewthing else - The Number lookup > Could this be set during an ldap group lookup perhaps, using an > inbuilt freeradius attribute? Exactly. You could do a ldap lookup in FreeRadius and pass that as variable to the module, so that it could use that. > The module seems to implement its own Kerberos authentication lookup - > is this correct? It's not implementing it's own but using a perl Kerberos library, but you're correct that it does it's own Kerberos authentication and not in FreeRadius. The only reason it does so, is that I can account how many logins went wrong and than block authentication requests to the active directory, because in my case the active directory would lock the account which would make a deny of service attack possible if you know a username. > Would an ntlm lookup also be possible by messing with the perl code > and using the ntlm include instead of authen-krb5? Yes, that is possible, you can exchange it basically with everything you want, you can also do the first stage of the authentication in FreeRadius and use the perl module soley for smsotp. > Do you have any plans to write something more "generic", i.e. without > the hard coded users file or file paths for other functions? At the moment I do not have the intention, however I probably will release a much more generic version without the password locking and that does the first stage of the authentication in FreeRadius > Or is it just a proof of concept? I actually run it in pre production environment for 1500 users. > Also do you plan some in-depth documentation? I also started in the wiki for the C-Implementation, but for anyone who understands PAP and PAP access challenge and Radius it is basically self explenatory, however this process took me almost 5 workdays myself. My FreeRadius knowlegde is limited, I used FreeRadius with eap-tls, 802.1q, 802.1x, Cisco ASA, Cisco 3560G, Cisco 2910, VMware View, Linux embedded devices and Citrix Netscaler. > This module tied to freeradius could be extremely useful to our > organisation but I'm not sure if at this point I understand it well > enough or whether it will be robust in use. In production I had no problems and approx. 285 authentication requests already. I also ran an automated self test against it, both for the C and perl implementation for 24 hours and saw no problems. However in your case I would first to try to make it work, than develop an automated self test and if you feel comfortably enough to use, use it. > I'd like ideally to use freeradius to do an ldap lookup, cross > reference a group of users with access to OTP, bring back an > email/phone number attribute through the ldap module and then use this > in the OTP processing, whilst also doing some mysql / other sql > storage of users' authentication details using OTP to fault find/audit > from. I'll not implement it, but if I would do that, it would take me less than 4 hours. Basically what you need is to modify the rlm_perl implementation to only handle the pap access challenge and pass the information it needs using the already existing interface of rlm_perl (which is super powerful). > Is this the kind of thing you might look at in the future or should I > go and get linotp / rcdevs product? I'm quite busy for the next 5 days, if you want to wait 5 days, I could make something generic available and also document it. Of course, if you don't feel comfortable with it at the moment, go for another solution. Cheers, Thomas

1 0

Recommendations for a GUI front end for FreeRadius
by Ken Morley 07 Sep '12

07 Sep '12

FreeRadius is a great product that works very well, but is difficult for novices to maintain. I don't have any problems using the Linux shell and vi to configure, but I need something more user friendly for others. Can anyone recommend an open-source GUI for FreeRadius - preferably something that runs as an Apache web site under Linux? Thanks for any suggestions! Ken Morley

3 2

Transform reject to accept response with specific attributes
by Kostas Zorbadelos 07 Sep '12

07 Sep '12

Greetings to all, I would like to achieve the following functionality: in case a user's AUTHENTICATION fails, the user should not be rejected but be given an accept response with specific attributes. The reason behind this is to provide a captive portal functionality for users having wrong credentials in their CPEs. Could you provide a few hints for how the config would look like (I am thinking of something in terms of unlang and utilizing virtual servers but I am not sure how it would look like. Regards, Kostas -- Kostas Zorbadelos twitter:@kzorbadelos http://gr.linkedin.com/in/kzorba ---------------------------------------------------------------------------- () www.asciiribbon.org - against HTML e-mail & proprietary attachments /\

3 3