October 2013 - Freeradius-Users - lists.freeradius.org

Cache for machine authentication
by Garber, Neal 04 Oct '13

04 Oct '13

Can someone tell me if it is possible in FR to cache in memory (for a short amount of time) Calling-Station-Id from successful machine authentications so that subsequent user authentications can test whether the user is connecting from an authorized device? This is a feature that is available with Cisco ACS version 5 (using attribute Was-Machine-Authenticated) that I am trying to emulate in FR. If it's possible and anyone can share ideas, I would appreciate it. I thought about using a database, but it seems horribly inneficient compared to caching something in memory. I know I could write a custom module or use perl and maintain the cache in a file, but I don't want to reinvent the wheel and I'm hoping there's an easier and more efficient way to accomplish this.. Thanks for your time..

4 3

Problem with Cisco WLC probes in FR 2.2.1
by Jonathan Gazeley 04 Oct '13

04 Oct '13

We've recently upgraded our radius servers from 2.1.12 (CentOS 6 packaged default) to 2.2.1 (latest stable from FR, built by hand). A config that used to work under 2.1.12 no longer appears to work the same way under 2.2.1. Our Cisco WLCs send periodic probes in the form of a test authentication. There is a snippet of config that intercepts these authentication requests: # /etc/raddb/conf.d/wism-checks.conf if (Service-Type == "NAS-Prompt-User") { if (NAS-IP-Address =~ /^172\.17\.107\./) { if (User-Name =~ /^wisms\-testing/) { update control { Auth-Type := Accept } updated } else { reject } } updated = return } This config is included in every virtual server's outer config: # /etc/raddb/sites-enabled/eduroamlocal authorize { $INCLUDE conf.d/wism-checks.conf } Looking at the output from radiusd -XC the wism-checks.conf file is being included in multiple places, yet when the server is running there is no record of these test probe packets being processed. This means the WLCs think the radius server is dead, and stop using it. I've had to roll back to 2.1.12 to restore stable wireless service for our users. I can only assume this code block is being skipped over for some reason. At present I'm unable to drop production radius servers into debug mode since they can't handle the load while debugging, and while I do have some development radius servers, our WLCs won't sent it these probe packets unless it is an active production radius server. Does anyone have any tips for debugging this in a minimally disruptive way? At the moment we don't have any development WLCs but we might have to get some so we can have a separate environment for testing. In the meantime I'm trying to get this code block to work so we can use the newer version of FR. Thanks, and happy Friday Jonathan

2 1

Freeradius issue : Active Directory Integration
by Shameek Bhattacharya 04 Oct '13

04 Oct '13

Hello, I am facing issue with MS CHAP authentication in Ubuntu 13.04 . Also NTLM Authentication takes place when putting 'wait = no' in /etc/freeradius/modules/ntlm_auth ie exec ntlm_auth { wait = no program = “/usr/bin/ntlm_auth -request-nt-key -username=%{mschap:User-Name} -password=%{User-Password}” } But MS CHAP fails completely . Tried all options but not working at all . I have another Freeradius Server with same configuration which is working perfectly. The only difference is that the faulty Radius Server was joined to Domain with a backup administrator account , not with the default Domain Administrator account . Is this creating the issue ? Please suggest . I have attached the debug output. Regards, Shameek

4 3

assign vlan per group or per user
by Jean Carlos Coelho 03 Oct '13

03 Oct '13

Hi, My first post! I need to configure one radius server with ldap integration and dynamic vlan assign per user or group, didn't find any documentation about this procedures, someone knows any url about this? Thank You! []s

2 1

Re: How to deny access to Switch Cisco by Group
by Usuário do Sistema 03 Oct '13

03 Oct '13

Thanks. I have done your tip but I'm get the follow error rlm_ldap::ldap_groupcmp: Group cisco not found or user is not a member. [ldap] performing search in o=dohler, with filter (&(cn=cisco)(|(&(objectClass=GroupOfNames)(member=))(&(objectClass=GroupOfUniqueNames (uniquemember=)))) [ldap] object not found I have created the group "cisco" in the Ldap and put the user inside it but the logs from freeradius shows that group not found. maybe there is mismatch at the searching ldap from freeradius that I have fit it. any tip about ? Thanks 2013/10/3 <freeradius-users-request(a)lists.freeradius.org>: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Running RADIUS in permanent debug mode with rotating log > (Arran Cudbard-Bell) > 2. Re: Wifi APs Models compatible with by username dynamic vlan > assignment (Arran Cudbard-Bell) > 3. How to deny access to Switch Cisco by Group (Usu?rio do Sistema) > 4. Re: How to deny access to Switch Cisco by Group (Alan DeKok) > 5. Re: Running RADIUS in permanent debug mode with rotating log > (A.L.M.Buxey(a)lboro.ac.uk) > 6. RE: radwho not working (Clint Petty) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 3 Oct 2013 11:04:42 +0100 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Running RADIUS in permanent debug mode with rotating log > Message-ID: <414C50CC-A53F-4480-B111-14FB8A774FBC(a)freeradius.org> > Content-Type: text/plain; charset=us-ascii > > > On 3 Oct 2013, at 10:14, <stefan.paetow(a)diamond.ac.uk> wrote: > >>> How can we run radiusd -x > "logname" such that we have different >>> logname for each day? >> >> Clement, may I suggest a cron job? >> >> At midnight, move the log, kill and restart the radius server with a new log in the name? Of course you run the risk of possibly killing any authentication attempts that happen at that point in time, but... that's something you need to take into account? > > Please don't. Use a crontab by all means but just use the main log file and enable additional debugging (-xx). > > As of 2.2.1 you can use the radmin control socket to reopen the log file handle without restarting the server, or sending a -HUP. > > It's not just the fact you'll kill any EAP auth sessions in progress, but you'll will clear out any cached entries (rlm_cache), > and where proxying is being performed upstream server state will be lost. > > It's also dangerous in that if someone has messed with the configurations, or overwritten the radiusd/freeradius(debian) binary > you'll experience an unexpected migration to the new binary/config on next restart. > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > > > > ------------------------------ > > Message: 2 > Date: Thu, 3 Oct 2013 11:08:34 +0100 > From: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Wifi APs Models compatible with by username dynamic vlan > assignment > Message-ID: <F7069EC1-C670-405B-9FC0-B962BE10E07A(a)freeradius.org> > Content-Type: text/plain; charset=us-ascii > > > On 3 Oct 2013, at 10:57, matthew pideil <matthew.pideil(a)teledetection.fr> wrote: > >> Hello, >> >> I want to perform dynamic VLAN assignment by username through wifi >> access. I set up this configuration few time ago but didn't works. >> >> I want to know which WiFi APs are compatible and/or what is the term to >> search for in devices specifications ... > > > Look for claimed compliance with RFC3580/RFC4675 in the specifications of your > Access-Point. > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > > > > ------------------------------ > > Message: 3 > Date: Thu, 3 Oct 2013 09:37:57 -0300 > From: Usu?rio do Sistema <maiconlp(a)ig.com.br> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: How to deny access to Switch Cisco by Group > Message-ID: > <CAMTjHrxN6PQ-7Dc8BXF8LggbeyUYY4OSVO2ThN0V3SO+vdK4Fw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Hello, > I have just installed a FreeRADIUS Version 2.1.12. it's integrate > with OpenLdap and I'm able to use it that way. > my issue is how to deny users aren't member of the any group. > For exemple, I should like authorize users do login in the my devices > Cisco from a group of the my data base LDAP. if user doesn't inside in > that group the freeradius must DENY it. currently my freeradius is > allow any user from LDAP. if the user is created on LDAP it's able > login in my Cisco devices. > how to deny access by group ? if user is member of the group it's able > login in otherwise the user is deny > > thanks > > > ------------------------------ > > Message: 4 > Date: Thu, 03 Oct 2013 08:57:06 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: How to deny access to Switch Cisco by Group > Message-ID: <524D69A2.2040302(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Usu?rio do Sistema wrote: >> how to deny access by group ? if user is member of the group it's able >> login in otherwise the user is deny > > See the FAQ. Put this at the top of the "users" file: > > DEFAULT LDAP-Group != "allowed", Auth-Type := Reject > > > Alan DeKok. > > > ------------------------------ > > Message: 5 > Date: Thu, 3 Oct 2013 16:29:41 +0100 > From: A.L.M.Buxey(a)lboro.ac.uk > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Running RADIUS in permanent debug mode with rotating log > Message-ID: <20131003152941.GA4711(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > Hi, > > this is FreeRADIUS list, not general Linux lsit - I'd suggest looking at some guides for > the EXACT thing you need eg > > http://www.cyberciti.biz/faq/linux-unix-formatting-dates-for-display/ > > (and ensure your escape quotes are the right way around) > > alan > > > ------------------------------ > > Message: 6 > Date: Thu, 3 Oct 2013 17:10:17 +0000 > From: Clint Petty <cpetty(a)luthresearch.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: RE: radwho not working > Message-ID: > <64d95a19c8744c0ca70e1343e2118371(a)DM2PR04MB334.namprd04.prod.outlook.com> > > Content-Type: text/plain; charset="us-ascii" > > Hi Alan, > > Below is the results from radiusd -X (debug mode), while logging in: > > rad_recv: Access-Request packet from host xx.xx.xx.79 port 40379, id=79, length=138 > User-Name = "test" > NAS-Port-Type = Virtual > Service-Type = Framed-User > NAS-Port = 53 > NAS-Port-Id = "ios" > NAS-IP-Address = xx.xx.xx.79 > Called-Station-Id = "xx.xx.xx.79[4500]" > Calling-Station-Id = "xx.xx.xx.150[32055]" > EAP-Message = 0x02000009016a646f65 > NAS-Identifier = "strongSwan" > Message-Authenticator = 0x13a0846c40f521e3c009161546f6f3fb > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "test", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 0 length 9 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > [ldap] performing user authorization for test > [ldap] expand: (&(uid=%u)) -> (&(uid=test)) > [ldap] expand: ou=People,dc=company,dc=com -> ou=People,dc=company,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] attempting LDAP reconnection > [ldap] (re)connect to xx.xx.xx.126:389, authentication 0 > [ldap] bind as cn=Admin,dc=company,dc=com/xxxx to xx.xx.xx.126:389 > [ldap] waiting for bind result ... > [ldap] Bind was successful > [ldap] performing search in ou=People,dc=company,dc=com, with filter (&(uid=test)) > [ldap] looking for check items in directory... > [ldap] userPassword -> User-Password == "password" > [ldap] userPassword -> Password-With-Header == "password" > [ldap] sambaNtPassword -> NT-Password == 0x38424235443 > [ldap] looking for reply items in directory... > [ldap] user test authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] Config already contains "known good" password. Ignoring Password-With-Header > [pap] Normalizing NT-Password from hex encoding > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] returns noop > Found Auth-Type = EAP > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > !!! Replacing User-Password in config items with Cleartext-Password. !!! > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > !!! Please update your configuration so that the "known good" !!! > !!! clear text password is in Cleartext-Password, and not in User-Password. !!! > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] EAP Identity > [eap] processing type md5 > rlm_eap_md5: Issuing Challenge > ++[eap] returns handled > Sending Access-Challenge of id 79 to xx.xx.xx.79 port 40379 > EAP-Message = 0x010100160410c73f50e02103b6473c8f5ed51995e29f > Message-Authenticator = 0x00000000000000000000000000000000 > State = 0x2310bb7d2311bf963fc3fbc63c331669 > Finished request 0. > Going to the next request > Waking up in 4.9 seconds. > rad_recv: Access-Request packet from host xx.xx.xx.79 port 40379, id=80, length=169 > User-Name = "test" > NAS-Port-Type = Virtual > Service-Type = Framed-User > NAS-Port = 53 > NAS-Port-Id = "ios" > NAS-IP-Address = xx.xx.xx.79 > Called-Station-Id = "xx.xx.xx.79[4500]" > Calling-Station-Id = "xx.xx.xx.150[32055]" > EAP-Message = 0x020100160410958ab4a6a9b38188febc74cc0c573b96 > NAS-Identifier = "strongSwan" > State = 0x2310bb7d2311bf963fc3fbc63c331669 > Message-Authenticator = 0xdb77c116ca06726a60a2d3a224bc2e22 > # Executing section authorize from file /etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > ++[mschap] returns noop > ++[digest] returns noop > [suffix] No '@' in User-Name = "test", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] EAP packet type response id 1 length 22 > [eap] No EAP Start, assuming it's an on-going EAP conversation > ++[eap] returns updated > ++[files] returns noop > [ldap] performing user authorization for test > [ldap] expand: (&(uid=%u)) -> (&(uid=test)) > [ldap] expand: ou=People,dc=company,dc=com -> ou=People,dc=company,dc=com > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in ou=People,dc=company,dc=com, with filter (&(uid=test)) > [ldap] looking for check items in directory... > [ldap] userPassword -> User-Password == "password" > [ldap] userPassword -> Password-With-Header == "password" > [ldap] sambaNtPassword -> NT-Password == 0x38424235443 > [ldap] looking for reply items in directory... > [ldap] user test authorized to use remote access > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop > [pap] Config already contains "known good" password. Ignoring Password-With-Header > [pap] Normalizing NT-Password from hex encoding > [pap] WARNING: Auth-Type already set. Not setting to PAP > ++[pap] returns noop > Found Auth-Type = EAP > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > !!! Replacing User-Password in config items with Cleartext-Password. !!! > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > !!! Please update your configuration so that the "known good" !!! > !!! clear text password is in Cleartext-Password, and not in User-Password. !!! > !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! > # Executing group from file /etc/raddb/sites-enabled/default > +- entering group authenticate {...} > [eap] Request found, released from the list > [eap] EAP/md5 > [eap] processing type md5 > [eap] Freeing handler > ++[eap] returns ok > Login OK: [test] (from client localhost port 53 cli xx.xx.xx.150[32055]) > # Executing section post-auth from file /etc/raddb/sites-enabled/default > +- entering group post-auth {...} > ++[exec] returns noop > Sending Access-Accept of id 80 to xx.xx.xx.79 port 40379 > EAP-Message = 0x03010004 > Message-Authenticator = 0x00000000000000000000000000000000 > User-Name = "test" > Finished request 1. > Going to the next request > Waking up in 4.9 seconds. > Cleaning up request 0 ID 79 with timestamp +20 > Cleaning up request 1 ID 80 with timestamp +20 > Ready to process requests. > > > > -----Original Message----- > From: freeradius-users-bounces+me=company.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=company.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk > Sent: Thursday, October 03, 2013 1:32 AM > To: FreeRadius users mailing list > Subject: Re: radwho not working > > Hi, >> I would like to display the active Radius connections. When I run radwho I get the following results (showing nothing but the titles) even though I know I have an active connection: > > using the utmp/wtmp modules? what does your FreeRADIUS debug show when > someone logging in? > > alan > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > End of Freeradius-Users Digest, Vol 102, Issue 11 > *************************************************

1 0

Version 2.2.2
by Alan DeKok 03 Oct '13

03 Oct '13

I've pushed a fix for the proxy issue into the v2.x.x branch. If people can test it, that would be appreciated. We'll then release 2.2.2 and 3.0.0 on Monday. Alan DeKok.

1 0

How to deny access to Switch Cisco by Group
by Usuário do Sistema 03 Oct '13

03 Oct '13

Hello, I have just installed a FreeRADIUS Version 2.1.12. it's integrate with OpenLdap and I'm able to use it that way. my issue is how to deny users aren't member of the any group. For exemple, I should like authorize users do login in the my devices Cisco from a group of the my data base LDAP. if user doesn't inside in that group the freeradius must DENY it. currently my freeradius is allow any user from LDAP. if the user is created on LDAP it's able login in my Cisco devices. how to deny access by group ? if user is member of the group it's able login in otherwise the user is deny thanks

2 1

Wifi APs Models compatible with by username dynamic vlan assignment
by matthew pideil 03 Oct '13

03 Oct '13

Hello, I want to perform dynamic VLAN assignment by username through wifi access. I set up this configuration few time ago but didn't works. I want to know which WiFi APs are compatible and/or what is the term to search for in devices specifications ... Regards, -- Matthew Pideil

2 1

control flow in FreeRADIUS authorize section
by Bruce Bauman 02 Oct '13

02 Oct '13

We are getting unexpected behavior from FreeRADIUS 2.2.x (built from current git). We want to check if a user is BLOCKED first, and only then do we want to perform some other checks. Our current config looks like this: authorize { #auth_log # uncomment for debugging # try to rewrite calling station ID to be sane rewrite_calling_station_id rewrite_username_lowercase # set VLANs for infected or tempsuspension roles IPSblocks_SQL { # handle failures notfound = 999 reject = 999 } switch reply:RU-block-description { case "infected" { if(Airespace-Wlan-Id){ update reply { Cisco-AVPair += "url-redirect=http://ruwireless.rutgers.edu/index.php?page=infected" Airespace-ACL-Name = "Cisco_infected" } } else { update reply { # try VLAN assignment Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 1666 } } # force accept regardless of password update control { Auth-Type := "Accept" } ok } case "tempsus" { update reply { # try VLAN assignment Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 1666 } # force accept regardless of password update control { Auth-Type := "Accept" } ok } # default is to do nothing } <BUNCH OF OTHER UNLANG CODE> The IPSblocks_SQL does set RU-block description correctly, and the case statement behaves as expected. We want to stop executing the <BUNCH OF UNLANG CODE> in the first two cases ("infected" and "tempsus"), effectively doing something like a return. I've read the documentation a hundred times and can't figure out how to do what I want - everything I've tried doesn't work. If someone could give me a simple hint to point me in the right direction it would be greatly appreciated. -- Bruce Bruce Bauman - Systems Administrator Rutgers University Office of Information Technology Campus Computing Services - Central Systems and Services Office ~ (848) 445-6363

4 4

lifetime of dynamic clients
by steve＠comitcon.be 02 Oct '13

02 Oct '13

Dear all, I have rebuild freeradius on debian 7.0. I have added rlm_raw and have a working dynamic client configuration where I use Called_Station_ID to authenticate / validate that a NAS is allowed to use this radius server. I test using the following command on client A echo "NAS-IP-Address=10.1.2.236, Called-Station-Id=00:40:96:aa:bb:ee,User-Name='testradius',User-Password='test'," | radclient -c '1' -n '3' -r '3' -t '3' -x '46.18.36.232:1812' 'auth' 'mysecret' I can see in the logs that is is checking the first time I log on and it is properly giving the message adding client xxx.xxx.xxx.xxx with shared secret. Now, when I executed the same command on a different machine Client B, it runs through it again. (Same command, I only had 1 nas added to it ) It adds the new 'client' to the dynamic clients. I wait for a couple of minutes and I executed the following command of client A: echo "NAS-IP-Address=10.1.2.236, Called-Station-Id=00:40:96:aa:bb:cc,User-Name='testradius',User-Password='test'," | radclient -c '1' -n '3' -r '3' -t '3' -x '46.18.36.232:1812' 'auth' 'mysecret' This has a faulty Called-Station-Id in it. I would assume that it would not allow me to connect. But this appears to still work. I am wondering - The first time the IP address of client A is added to the list of known client - So the second time , it will check first in the list if the IP is known, if so it won't go checking using the process defined in dynamic clients? But no matter how long I wait, it appears that the cache if not cleared. I have added a lifetime of 60 in the dynamic client conf, so I would assume that if I wait for a minute, the IP of client A would not be known, and it would go through checking again. Am I wrong in this? If not can I read the cache to find out why it is keeping that record? Kind regards Steve

3 11