January 2013 - Freeradius-Users - lists.freeradius.org

rlm_perl changing User-Name and proxy requests
by Ti Leggett 11 Jan '13

11 Jan '13

I have an issue with rlm_perl changing the request User-Name attribute but the proxy request not honoring it. First I'll describe what I'm trying to accomplish and why and then what I'm doing. I'm running a branch of 2.2.1 that has some krb5 realm fixes in it. I have multiple realms that users can authenticate against: our division has replayable password (handled by kerberos) and one time passwords (handled by both YubiKeys and Crypto Card), our lab has replayable passwords (handled by AD) and a separate one time password system (handled by Crypto Card). For services that we want to allow replayable passwords (like IMAP access for instance), we want to allow the user to choose which service to use (division or lab). For services requiring OTP we want the user to choose which OTP token they want to use (some people have multiple because of external requirements). We want users to be able to change these auth preferences on their own and not have this require changing the RADIUS configuration (a.k.a., the users file) to do this. Our account information is kept in LDAP. This is all well and good except that usernames between the division and the lab aren't guaranteed to match - User A might have lastname as their division name, but lastnamefirst as their lab username. For the kerberos and AD request the RADIUS server can handle the request directly using rlm_krb5, but for all the OTP requests the server must proxy to the correct OTP server to handle the request. Here's my plan for accomplishing this. During authorization, rlm_ldap is used to make sure if the user is in LDAP. If not the request is rejected outright (this should help with brute force attempts bogging down all the servers for bogus attempts). Next an rlm_perl module is called to get the user's preferred realm and what username to use in that realm from LDAP. An example would be leggett@ yubi.division.example.com (signifying that I want to use YubiKey from my division). The rlm_perl module updates the request User-Name to be this preference and Auth-Type to be System (see http://pastie.org/5670077) Lastly rlm_realm checks the request to determine if it should be proxied or not. The problem is this: Everything works if the username doesn't change. For instance, if I'm leggett(a)yubi.division.example.com and leggett(a)crypto.example.com, things work. The User-Name change being done by rlm_perl is being recognized by rlm_realm and rlm_realm is routing to the proper realm; however, rlm_realm seems to want to clobber User-Name in its own way, so that by the time proxying happens User-Name is set to whatever the initial username was - if I started the process as leggett and wanted my username to eventually be ti.leggett(a)crypto.example.com, by the time it reaches the proxy phase my User-Name attribute has been reset back to leggett even if I rerun the rlm_perl module after rlm_realm (see http://pastie.org/5670076) I notice that rlm_suffix doesn't overwrite the Stripped-User-Name rlm_perl adds, but appends another entry. This is fine for my purposes since the rlm_perl one is added first subsequent calls use that value. I'm afraid the same is happening with User-Name in that rlm_perl is appending another entry instead of overwriting the ones there. So is there any way around this or am I completely insane with this approach?

4 10

Different IP addresses from home radius server
by Greg Rutz 11 Jan '13

11 Jan '13

We are using FreeRadius 2.1.12 as a proxy to a remote radius server. The remote server (not under our direct control) receives RADIUS request messages on one IP address, but sends the response out a different interface (and thus has a diffferent IP). FreeRadius is rejecting the response since the IP does not match that of the request. Is there a way to configure FreeRadius to allow this? Greg

2 2

Re: LDAP Reply Attributes
by Alan Buxey 11 Jan '13

11 Jan '13

Switch config issue? Ensure your switch is configured to authorize over RADIUS as well as to authenticate over RADIUS. (sounds like its doing the latter but not the former) alan

2 1

LDAP Reply Attributes
by Tyler Brady 11 Jan '13

11 Jan '13

I'm sure this is an easy issue to solve, but my simple brain can't seem to put the pieces together. Any help would be greatly appreciated. I'm trying to authorize a login into a Cisco switch with admin privileges. Users: DEFAULT = LDAP-Group == Radius-Users" Reply-Message = "Welcome Message Test", Cisco-AVPair = "shell:priv-lvl=15" Note: I've tried many different combinations of attributes with no luck. (Service-Type = Administrative-User, Service-Type = NAS-Prompt-User) Output: Sending Access-Accept of id 61 to 172.28.64.3 port 1645 Reply-Message = "Welcome Message Test" Cisco-AVPair = "shell:priv-lvl=15" The switch login successfully shows "Welcome Message Test," but still kicks into user exec mode without applying the Cisco-AVPair = "shell:priv-lvl=15" I noticed that there is a mapping for the Reply-Message found in ldap.attrmap, but none for Cisco-AVPair. Is this why it's not working? If so, I have not been able to find the correct syntax for adding it to ldap.attrmap. Thanks in advance, T. Brady

1 0

Trying other authentication methods when the first is invalid
by Meyers, Dan 11 Jan '13

11 Jan '13

Sorry for the wall of tet, I'd rather give too much info than not enough. Our FreeRADIUS server (version 2.1.8 running on Ubuntu 10.04 LTS x64, installed from packages) currently does mac-based authentication of hosts onto edge switches using perl scripts (rlm_perl) talking to the API for our network access control system. I would like to extend this to also be able to support 802.1x based authentication, but only for certain specific networks (ones with access to more important servers or similar. For example the finance network should need 802.1x to auth, but our student residence network shouldn't as then no games consoles and the like would work). The initial method I had set up was to look for the presence of an EAP-Message in the request in the authorize section, and call the eap module if EAP-Message was present to set Auth-Type to EAP and then do authentication using eap (tls or peap) (and then expect to hand off to perl in post_auth just for the VLAN assignment) or to call the perl module to set Auth-Type as Perl if there was no EAP-Message, and handle it in authenticate as a simple MAC auth using perl. (The reason for not just calling eap then perl all the time is that the rlm_perl module, despite my authorize subroutine containing simply "$RAD_CHECK{'Auth-Type'} = 'Perl'; return RLM_MODULE_OK;", seems to alter the value of User-Name such that calling eap in authenticate *always* fails with the error "Identity does not match User-Name, setting from EAP Identity." and rejects the user if perl has been called in authorize, even if it is called after eap and the eap stanza reads "eap { ok = return }"). This worked fine on our HP Procurve switches. Anyway, we have got some Juniper EX2200 switches. The problem with these is that they do mac-auth as a 'fake' 802.1x auth. The request has the User-Name attribute set to the MAC address correctly, but also has an EAP-Message present, it just doesn't contain anything we want to have to care about (It actually contains, once the eap header has been decoded, the md5 of the mac-address). This causes the eap module, if called in authorize, to think the request should be handled by itself and set Auth-Type to EAP and expect to do eap-md5 (even if the default-auth-type in eap.conf is set to something else, like peap). However, as we do not actually want to do an eap-md5 auth we have no Cleartext-Password anywhere for the tens of thousands of MAC addresses (with new ones every day, which we auth onto a special 'unregistered' network with limited access instead of rejecting) on our network. The eap module in this case returns 'invalid' in authentication, rather than 'reject'. I was hoping I could detect this and tell it to move on to perl if this happened. I can't seem to make that work. As soon as eap returns invalid, all further processing is halted for that request and FreeRADIUS jumps straight to the Post-Auth REJECT section. Can anyone suggest a way around this? I was originally thinking that I could use the perl module after eap in authorize to check if the decoded eap data was simply an md5 hash of the MAC, and set Auth-Type to Perl even though there was an EAP-Message in that case, but of course if I ever then do that check on a valid 802.1x auth EAP breaks (as I mentioned above). Thanks for any help anyone can offer -- Dan Meyers Lancaster University

3 2

Compilling error
by Черкендов Александр Арма исович 11 Jan '13

11 Jan '13

Cann’t compile for CYGWIN version 2.2.1 & 2.2.0(stable) gcc -I/cygdrive/d/fr/freeradius-server-2.2.1 -I/cygdrive/d/fr/freeradius-server-2.2.1/src -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/cygdrive/d/fr/freeradius-server-2.2.1/libltdl -I/cygdrive/d/fr/freeradius-server-2.2.1/src -I/cygdrive/d/fr/freeradius-server-2.2.1/libltdl radeapclient.c -o radeapclient radeapclient.c:40:23: фатальная ошибка: eap_types.h: No such file or directory Компиляция прервана. <builtin>: recipe for target `radeapclient' failed make[6]: *** [radeapclient] Error 1 File eap_types.h is situated in src/modules/rlm_eap/lib_eap dir. If I launch gcc -I lib_eap, I get: ... /tmp/ccD7XqGk.o: In function `debug_packet': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:182: undefined reference to `_fr_packet_codes' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:195: undefined reference to `_vp_prints' /tmp/ccD7XqGk.o: In function `send_packet': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:212: undefined reference to `_rad_send' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:268: undefined reference to `_rad_verify' /tmp/ccD7XqGk.o: In function `process_eap_challenge': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:502: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:503: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:521: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:522: undefined reference to `_pairfind' ... As I found_pairfind is defined in xlat.c. How can I compile it?

1 0

Multithreaded krb5
by Arran Cudbard-Bell 11 Jan '13

11 Jan '13

A while back there was some discussion about the current krb5 module in FreeRADIUS being single threaded, and that it may no longer be necessary for it to be single threaded. It transpires that both MIT and Heimdal libraries are now thread safe, MIT since either 1.4.x or 1.4.4 (unsure) and Heimdal since around 0.7 (documentation is fuzzy). I can't test beyond compiling the code against the kerberos library, and maybe setting up a test KDC/TGS. But for this to be put into the stable branch it really needs to be tested under load, against a range of keberos implementations. Were looking for volunteers, preferably a mix of deployments using either MIT or Heimdal. The new module should just drop in for any v2.1.x deployment once compiled, as it doesn't use any new core API functions. Change list: * Both - Check that krb5 library was compiled with threading support on startup. * Both - Clone context on each request to ensure thread safety. * Both - Move service principal parsing so it's done at intialisation only (instead of on every request). * Both - Improved return codes, will now reflect revoked access/password expiry (USERLOCK), Uknown client principal (NOTFOUND), as well as bad password (REJECT), and other errors (FAIL). Before the module returned REJECT for almost everything. * Both - Mark module as thread safe, config check safe (will be validated on -C), and hup safe (config will be reloaded on SIGHUP) * Both - Switch more messages to use RDEBUG so they'll be printed in conditional debug (useful for production servers with radmin enabled). * MIT - Move service principal string to service principal conversion so that it's done at initialisation only (instead of on every request). * MIT - Move options configuration so they're done at initialisation only (instead of on every request). * MIT - Switch to using krb5_get_init_creds_password and krb5_verify_init_creds to validate TGT instead of old twisty logic. * MIT - Cache option removed as krb5_verify_init_creds disables the replay cache on its own. For those wanting to test: git clone git@github.com:arr2036/freeradius-server.git cd freeradius-server git checkout threaded_krb5 Report issues on: http://bugs.freeradius.org, and send feedback to either the list or me directly. -Arran

1 0

AD Authentication Permissions
by Tyler Brady 10 Jan '13

10 Jan '13

Hello, I apologize if these questions have already been answered. I have scoured the internet for help, but have been unable to find what I'm looking for. Keep in mind this was the first time I have ever used linux so at the beginning of this project I was beyond newb. I am setting up a freeRADIUS (2.1.10) server for my network. I have everything working how I want it to except for some of the permission settings. For example, when users log in to Motorola radios in my network via freeRADIUS they only receive read-only permissions. Or when a Cisco user logs in I would like for them to receive automatic #privilege level 15. I need for users to receive admin privileges. How do I accomplish this? NOTE: I'm authenticating against active directory. So where can I configure things like "cisco-avpair = shell:priv-lvl=15, or Motorola-WIBB-Auth-Role = system-admin-role?" I understand how to configure permissions when you have individual users configured in users.conf. file. How do you configure permissions when you don't have any local users configured, but are using Active Directory? Right now I use only one Active Directory group "Radius-Users" for authentication. If a user is part of the Radius-Users group on the AD server, then they get access. This is fine for now, but in the future I would like to set up more granular access control. I have seen a lot of talk about LDAP groups, but have not been able to find decent information on it. Ideally I would like for there to be several different user groups set up with different permissions for each. How do you accomplish this with freeRADIUS + Active Directory? Any help would be much appreciated. Thank you, TBrady

5 11

FreeRadius (version 2.1.12) + ntlm_auth (AD) authentication + LDAP authorization
by Matthew Ceroni 10 Jan '13

10 Jan '13

Hi: I am running FreeRadius version 2.1.12 on a CentOS 6 machine. For authentication I am using AD (ntlm_auth) and this works create. In the the request the username is sent as just the plain username (ie: mceroni) and the NT-domain (ie: DOMAIN1). And it authenticates fine. My problem is on the authorization side in which I am using LDAP to grab the groups a user is in. In order to authentication against ldap my bind DN has to be DOMAIN\username (ie: DOMAIN1\mceroni). I am wondering how I modify the User-Name or Stripped user name just for the LDAP authorization part so make it DOMAIN\username but keep it as is for the authentication part. Everything I have done so far ends up changing it for both authentication and authorization. (In /etc/raddb/sites-enabled/inner and default in the authorize section I have a update request Stripped-User-Name section. Since authorize runs before authenticate it modifies the user name for the authentications) Thanks

2 4

Active Directory + LDAP + groups for dynamic VLAN assignment
by Matthew Ceroni 10 Jan '13

10 Jan '13

Hi: I am using FreeRadius version 2.1.12 on CentOS6. I am authenticating against Active Directory (that works). And authorizing against LDAP (that works as well). I am trying to return attributes, used for VLAN assignment, based on the usersDN. In my /etc/raddb/sites-enabled/default (and inner-tunnel) I have the following # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap if (control:Ldap-UserDn =~ /OU=QA/) { update reply { Tunnel-Type:1 := 13 Tunnel-Medium-Type:1 := 6 Tunnel-Private-Group-Id:1 := 7 } } elsif (control:Ldap-UserDn =~ /OU=IT/) { update reply { Tunnel-Type:1 := 13 Tunnel-Medium-Type:1 := 6 Tunnel-Private-Group-Id:1 := 2 } } else { update reply { Tunnel-Type:1 := 13 Tunnel-Medium-Type:1 := 6 Tunnel-Private-Group-Id:1 := 21 } } In the authorize section. That works, when authorize is done it queries LDAP successfully. Looking through the radius debug I see the IF statements processing: rad_recv: Access-Request packet from host 127.0.0.1 port 48400, id=0, length=122 User-Name = "mceroni" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c016d6365726f6e69 Message-Authenticator = 0xc429bf6a61dfc3cf27f1b6dc84f4e558 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "mceroni", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "mceroni", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop [ldap] performing user authorization for mceroni [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> mceroni [ldap] expand: (samAccountName=%{%{Stripped-User-Name}:-%{User-Name}}) -> (samAccountName=mceroni) [ldap] expand: ou=Clairmail OU,dc=clairmail,dc=local -> ou=Clairmail OU,dc=clairmail,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to cmad01.clairmail.local:389, authentication 0 [ldap] bind as svnadmin(a)clairmail.local/iBis93sLit+ to cmad01.clairmail.local:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in ou=Clairmail OU,dc=clairmail,dc=local, with filter (samAccountName=mceroni) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user mceroni authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++? if (control:Ldap-UserDn =~ /OU=QA/) ? Evaluating (control:Ldap-UserDn =~ /OU=QA/) -> FALSE ++? if (control:Ldap-UserDn =~ /OU=QA/) -> FALSE ++? elsif (control:Ldap-UserDn =~ /OU=IT/) ? Evaluating (control:Ldap-UserDn =~ /OU=IT/) -> TRUE ++? elsif (control:Ldap-UserDn =~ /OU=IT/) -> TRUE ++- entering elsif (control:Ldap-UserDn =~ /OU=IT/) {...} +++[reply] returns ok And it appears to set the attributes: +[pap] returns noop ++? if ("%{request:User-Name}" =~ /^host\/(.*).clairmail.local$/) expand: %{request:User-Name} -> mceroni ? Evaluating ("%{request:User-Name}" =~ /^host\/(.*).clairmail.local$/) -> FALSE ++? if ("%{request:User-Name}" =~ /^host\/(.*).clairmail.local$/) -> FALSE Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 48400 Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "2" EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2a1689d42a17904c9b87561fac99b7b3 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 48400, id=1, length=250 User-Name = "mceroni" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201007a198000000070160301006b01000067030150ee101279602ec4eddc8d6cfc926da85eee0e034a2c20ea6abd4fd75e1ea55500003a00390038008800870035008400160013000a00330032009a009900450044002f00960041000500040015001200090014001100080006000300ff0100000400230000 State = 0x2a1689d42a17904c9b87561fac99b7b3 Message-Authenticator = 0x0a3e365c6cd7a8ae795def8cb962360e But in the final response those attributes are not there. Sending Access-Accept of id 9 to 127.0.0.1 port 48400 MS-MPPE-Recv-Key = 0xf318d3dd21910be1544fd848af03baebe4f23ae85b786100b02b967d4cc1761e MS-MPPE-Send-Key = 0xa01a409bf3f54388c69613c576e657605022285909917ddbee9e52e776c3b0e1 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "mceroni" Any help would be appreciated. Thanks

2 1