October 2013 - Freeradius-Users - lists.freeradius.org

http://wiki.freeradius.org/Certificate_Compatibility
by Matthew Ceroni 17 Oct '13

17 Oct '13

This error pops up quite a bit in my logs. I have tried to login to that site with my OpenID but it just keeps kicking me back to the login page. Never authenticates.

2 1

How to access this attribute
by Jonathan Gazeley 17 Oct '13

17 Oct '13

This is a simple question but I can't find the answer by searching. In the following rad_recv block, which variable contains the value "137.222.7.113"? I need to access it in unlang to determine whether the packet arrived at my RADIUS server from our wireless controllers, or from another RADIUS server. Thanks, Jonathan rad_recv: Access-Request packet from host 137.222.7.113 port 53538, id=93, length=179 User-Name = "@bris.ac.uk" Calling-Station-Id = "20:10:7a:1a:89:1d" Called-Station-Id = "d0:c2:82:ae:ad:00:eduroam" NAS-IP-Address = 172.17.107.201 NAS-Identifier = "wism1(a)bristol.ac.uk" Framed-MTU = 1300 Operator-Name = "1bristol.ac.uk"

5 6

sqlippool --> ip's expiring and being allocated again
by Petre Bandac 17 Oct '13

17 Oct '13

Hallo I have the following situation: pool ip's are allocated correctly, but after the lease-duration is reached, they are deleted from the radippool table. This causes the ip to be once again assigned to another user, who in turn requires a new login, since this ip won't work I have tried to enforce a "keep-alive" with acct-interim, but it doesn't work, the ip's are deleted from radippool when the lease time is up ? how can I prevent this ? Thanks, petre root@core-router:/etc/freeradius# radtest -x petreb petreb localhost 1980 radiuspass Sending Access-Request of id 7 to 127.0.0.1 port 1812 User-Name = "petreb" User-Password = "petreb" NAS-IP-Address = 1.1.1.1 NAS-Port = 1980 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=7, length=38 Acct-Interim-Interval = 120 Session-Timeout = 1195235 Framed-IP-Address = 1.1.1.2

4 6

MAC authentication Auth Key Mgmt
by Matthew Ceroni 17 Oct '13

17 Oct '13

Hi: I have deployed a Wireless network that authenticates with WPA2 with 802.1x key mgmt. Radius is configured to validate users against Active Directory. Our company was recently bought out and we routinely have employees of the parent company come to our office and they need to use the wireless network (eventually wired as well). The integration of our domains is a few months out still. So the problem I have is that since 802.1x is tied into Windows user credentials they are not able to authenticate as their users are not in our AD domain. Therefore I wanted to authenticate them via their MAC address. So I read up on authenticating with MACS and setup my default vhost as follows: authorized_macs if (ok) { # if MAC is known ACCEPT update control { Auth-Type := Accept } } else { eap { ok = return } update reply { Tunnel-Type:1 := 13 Tunnel-Medium-Type:1 := 6 } if (Ldap-Group == "netCoreClass-IT") { update reply { Tunnel-Private-Group-Id:1 := 102 } } So authenticate if the MAC is known, else go through the normal authentication process of validating their AD credentials. This appears to work, sort of. In that it returns an Access-Accept if the MAC is known. However, and there is where my knowledge is lacking, I don't think it is then agreeing on an encryption key. When validating with credentials (and running radius in debug mode) there are many more Access Challenge and Response packets. Which I am assuming are message to generate and agree on the management key. When validation occurs just on the MAC address I don't see all those extra messages and the device never fully authenticates on the WIFI. The Access-Accept response when using credentials is: Sending Access-Accept of id 134 to 192.168.102.7 port 32769 Tunnel-Type:1 = VLAN Tunnel-Medium-Type:1 = IEEE-802 Tunnel-Private-Group-Id:1 = "102" User-Name = "mceroni" MS-MPPE-Recv-Key = 0x6118d49fe07452919f832d8cb45c721f39e693cdb05270d48c1d74c8d67e975e MS-MPPE-Send-Key = 0xcc7af786ff05d3d840ffc5752e46ea33ab3c933ab50b300a6e4f37aa47fc4293 EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 Whereas with MAC it is: Sending Access-Accept of id 135 to 192.168.102.7 port 32769 Reply-Message = "Testing Device MAC Address e8-99-c4-7c-16-b9" Tunnel-Type:1 := VLAN Tunnel-Medium-Type:1 := IEEE-802 Tunnel-Private-Group-Id:1 := "102" Missing the MS-MPPE parameters, which after googling I believe have to do with the authentication key used for encryption. Thanks in advance

3 3

Unix Crypt passwords + Windows 7
by Thomas Hewton-Waters 17 Oct '13

17 Oct '13

Have I exhausted all of my options? Is there anything I’m missing? I have an existing database of users with their passwords encrypted using Unix crypt(). A wireless AP is set for WPA/WPA2 using the RADIUS server to validate user logins. This works great using EAP-GTC for all clients except Windows. Windows doesn’t support EAP-GTC. Here are a few things I can’t do: • Install certificates on the Windows clients • Install a supplicant on the Windows clients Is there anything I can do to get the Windows clients to authenticate without changing the Windows configuration? Any help is greatly appreciated. Thanks, Thomas

3 2

MSCHAPv2 use_tunneling_reply problem
by Tekán Dávid 16 Oct '13

16 Oct '13

Hi all! I have a problem with users using the anonymous identity field during connecting. It turned out that for privacy reasons it is hidden outside of the tunnel. I found that by setting use_tunneling_reply to yes i can "transfer" the inner username outside of the tunnel, and the correct (not anonymous) username will appear in the accounting records. I've uncommented even the update outer.reply... part in the sites-enabled/inner-tunnel file. Unfortunatelly it does not work. Is there anything else, what i need to do to get it work? I use coovachilli for nas. Thanks for you help, all the best Dávid

4 5

Might have found an obscure rlm_ldap Bug?
by Andy Fleming 16 Oct '13

16 Oct '13

I'm not really a coder, so I'm posting to the users list first in hopes of some guidance on the next step. I've been looking at the rlm_ldap.c code and some from the openldap libraries it uses. I didn't want to go directly to a bug report incase this has already been fixed in the current 2.x release. Maybe I just need someone to explain how the code is expected to act in this particular case. I'm running a RHEL6 clone, Scientific Linux. freeradius-2.1.12-4.el6_3.x86_64 It looks like the RHEL package has only had a couple of patches since the 2.1.12 release. * Mon Sep 24 2012 John Dennis <jdennis(a)redhat.com> - 2.1.12-4 - resolves: bug#855316 CVE-2012-3547 freeradius: Stack-based buffer overflow by processing certain expiration date fields of a certificate during x509 certificate validation * Tue Apr 10 2012 John Dennis <jdennis(a)redhat.com> - 2.1.12-2 - resolves: bug#810605 Segfault with freeradius-perl threading * Mon Feb 27 2012 John Dennis <jdennis(a)redhat.com> - 2.1.12-1 - Upgrade to latest upstream release: 2.1.12 I stumbled upon this issue because of some brute force login attempts to a device pointed at a FreeRadius server. (This is a router using pap.) Environment: My LDAP server is the 389ds server. I run samba off of this same DS, so I did have a user with uid=root along with our typical users. The uid=root account dose not have a "user password" attribute, only a NTpassword attribute because its only there for Samba. So if FreeRadius tries to an LDAP search on uid=root in the authorize phase, it dose find a DN. Then in the authentication phase when it tries to bind at that DN, it gets the message back "failed Inappropriate authentication" rather then the typical "Bind failed with invalid credentials". It makes since that my LDAP server would send back a different error message. Thus far, things seem to be working correctly, but I think the message is confusing the rlm_ldap module and I'm getting back "returns fail" rather then "return reject". I think that return fail rather then reject might be part of what is triggering the bug. If I get 6 access-request in a row that "fail" and then send an access-request with a valid username/password, the LDAP module returns fail without even trying to do a bind. But it dose still do the search fine and get the correct DN. If a successful LDAP bind happens in the authentication phase, the count of 6 "Inappropriate authentication" logins starts resets to 0. I'm thinking maybe when the rlm_ldap returns fail rather then reject it marks that connection in the pool bad or something and it it runs out of connections? On the one hand I could see where when you get "failed Inappropriate authentication" the module should return reject rather then fail, but I could also see where you might get the same message back from the LDAP server when you have a bad radius server configuration. I guess I'm also not sure where the 6 attempts are coming from and why that causes it to not ever try a bind in the authentication stage in future requests. I can provide full debug logs and config, but here is the debug from the authentication stage. The first is with the LDAP server returning the "Inappropriate authentication" error and the second is the exact same request for the same user, but with a "Bind failed with invalid credentials" error because I set a password on the account in LDAP. Now that I've figured out what triggers the issues I can tweak some ldap search filters and add some ulang checks to help keep it from happening, but I still think there might be a bug. (User not having a password in LDAP thus getting failed Inappropriate authentication) Wed Oct 16 10:16:08 2013 : Debug: [ldap] waiting for bind result ... ldap_result ld 0x7f597847b080 msgid 1 wait4msg ld 0x7f597847b080 msgid 1 (timeout 4000000 usec) wait4msg continue ld 0x7f597847b080 msgid 1 all 1 ** ld 0x7f597847b080 Connections: * host: redacted.kanren.net port: 636 (default) refcnt: 2 status: Connected last used: Wed Oct 16 10:16:08 2013 ** ld 0x7f597847b080 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f597847b080 request count 1 (abandoned 0) ** ld 0x7f597847b080 Response Queue: Empty ld 0x7f597847b080 response count 0 ldap_chkResponseList ld 0x7f597847b080 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f597847b080 NULL ldap_int_select read1msg: ld 0x7f597847b080 msgid 1 all 1 read1msg: ld 0x7f597847b080 msgid 1 message type bind read1msg: ld 0x7f597847b080 0 new referrals read1msg: mark request completed, ld 0x7f597847b080 msgid 1 request done: ld 0x7f597847b080 msgid 1 res_errno: 48, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree ldap_err2string Wed Oct 16 10:16:08 2013 : Error: [ldap] uid=root,ou=People,dc=kanren,dc=net bind to redacted.kanren.net:636 failed Inappropriate authentication ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed Wed Oct 16 10:16:08 2013 : Info: [ldap] ldap_connect() failed Wed Oct 16 10:16:08 2013 : Info: ++[ldap] returns fail Wed Oct 16 10:16:08 2013 : Info: Failed to authenticate the user. After [ldap] returns fail 6 times in a row, it won't even try and bind, it just returns [ldap] return fail. (Same user having a password in LDAP thus getting Bind failed with invalid credentials. Thus never seeming to have the issue.) Wed Oct 16 10:32:54 2013 : Debug: [ldap] waiting for bind result ... ldap_result ld 0x7f9ca1b5fc40 msgid 1 wait4msg ld 0x7f9ca1b5fc40 msgid 1 (timeout 4000000 usec) wait4msg continue ld 0x7f9ca1b5fc40 msgid 1 all 1 ** ld 0x7f9ca1b5fc40 Connections: * host: redacted.kanren.net port: 636 (default) refcnt: 2 status: Connected last used: Wed Oct 16 10:32:54 2013 ** ld 0x7f9ca1b5fc40 Outstanding Requests: * msgid 1, origid 1, status InProgress outstanding referrals 0, parent count 0 ld 0x7f9ca1b5fc40 request count 1 (abandoned 0) ** ld 0x7f9ca1b5fc40 Response Queue: Empty ld 0x7f9ca1b5fc40 response count 0 ldap_chkResponseList ld 0x7f9ca1b5fc40 msgid 1 all 1 ldap_chkResponseList returns ld 0x7f9ca1b5fc40 NULL ldap_int_select read1msg: ld 0x7f9ca1b5fc40 msgid 1 all 1 read1msg: ld 0x7f9ca1b5fc40 msgid 1 message type bind read1msg: ld 0x7f9ca1b5fc40 0 new referrals read1msg: mark request completed, ld 0x7f9ca1b5fc40 msgid 1 request done: ld 0x7f9ca1b5fc40 msgid 1 res_errno: 49, res_error: <>, res_matched: <> ldap_free_request (origid 1, msgid 1) ldap_parse_result ldap_msgfree Wed Oct 16 10:32:54 2013 : Debug: [ldap] Bind failed with invalid credentials ldap_free_connection 1 1 ldap_send_unbind ldap_free_connection: actually freed Wed Oct 16 10:32:54 2013 : Info: ++[ldap] returns reject Wed Oct 16 10:32:54 2013 : Info: Failed to authenticate the user. Thanks again for any ideas. -- Andy

1 0

pre-2.2.2: a bug in module return code evaluation / 2013101601
by Jan Rafaj 16 Oct '13

16 Oct '13

Hello, I gave a try to current HEAD of the v2.x.x branch (commit 8925e16). In sites-enabled/default, in 'authenticate { }' I have: Auth-Type MS-CHAP { mschap { ok = return fail = 1 reject = 1 userlock = 1 invalid = 1 } if (fail || reject || userlock || invalid) { linelog.rejects.tunnelled reject } } In 2.2.0, the corresponding debug output triggered by radmin -e "debug file mydebug.log" \ -e "debug condition \"(User-Name =~ /testuser.*domain\.tld/)\"" was: ... Tue Oct 15 22:55:03 2013 : Debug: [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=e78a6a598e4b23bdb5f2feebf9ce5f6ab43851421b6387df Tue Oct 15 22:55:03 2013 : Debug: [mschap] External script failed. Tue Oct 15 22:55:03 2013 : Debug: [mschap] FAILED: MS-CHAP2-Response is incorrect Tue Oct 15 22:55:03 2013 : Debug: ++[mschap] returns reject Tue Oct 15 22:55:03 2013 : Debug: ++? if (fail || reject || userlock || invalid)Tue Oct 15 22:55:03 2013 : Debug: ? Evaluating (fail ) -> FALSE Tue Oct 15 22:55:03 2013 : Debug: ? Evaluating (reject ) -> TRUE Tue Oct 15 22:55:03 2013 : Debug: ? Skipping (userlock ) Tue Oct 15 22:55:03 2013 : Debug: ? Skipping (invalid) Tue Oct 15 22:55:03 2013 : Debug: ++? if (fail || reject || userlock || invalid) -> TRUE Tue Oct 15 22:55:03 2013 : Debug: ++- entering if (fail || reject || userlock || invalid) {...} ... while in pre-2.2.2 HEAD, the output is: ... Tue Oct 15 22:42:45 2013 : Debug: [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=8c600892bca040638bfa1145278982c141b1bf9924ce5c1f Tue Oct 15 22:42:45 2013 : Debug: [mschap] Exec: program returned: 1 Tue Oct 15 22:42:45 2013 : Debug: [mschap] External script failed. Tue Oct 15 22:42:45 2013 : Debug: [mschap] FAILED: MS-CHAP2-Response is incorrect Tue Oct 15 22:42:45 2013 : Debug: ++[mschap] = reject Tue Oct 15 22:42:45 2013 : Debug: ++? if (fail || reject || userlock || invalid)Tue Oct 15 22:42:45 2013 : Debug: ? Evaluating (fail ) -> FALSE Tue Oct 15 22:42:45 2013 : Debug: ? Evaluating (reject ) -> FALSE Tue Oct 15 22:42:45 2013 : Debug: ? Evaluating (userlock ) -> FALSE Tue Oct 15 22:42:45 2013 : Debug: ? Evaluating (invalid) -> FALSE Tue Oct 15 22:42:45 2013 : Debug: ++? if (fail || reject || userlock || invalid) -> FALSE Tue Oct 15 22:42:45 2013 : Debug: +} # group MS-CHAP = ok ... As you can see, in pre-2.2.2, although the mschap module still (correctly) returns 'reject', the condition evaluating 'reject' incorrectly yields FALSE (it yields TRUE in 2.2.0). I think this is a bug (and it has forced me to downgrade back to 2.2.0). Please could you fix this? Thanks a lot, Jan

2 1

maximum CDR file size
by Vladimir Stefanov 16 Oct '13

16 Oct '13

Hi I'm using 2 redundant freeradius-server-2.1.10 for a long time. It is compiled from source with Oracle 11.1 database support on Debian squeeze X86_64 . As our user base is growing, CDR files are growing in size. 1.1 to 1.3GB per day, and if one BRAS is down for maintenance or hardware failure over 2GB per day. Recently I receive a request from our billing department CDR files not to be bigger then 100MB, as they are having problem in processing such big files. Eg. if daily CDR file is 1.3GB to be separated on 13x100MB daily files. Is there any option for freeradius for setting maximum file size? Relevant radius.conf lines: prefix = /opt/freeradius exec_prefix = ${prefix} sysconfdir = /opt/freeradius/etc localstatedir = /var sbindir = ${exec_prefix}/sbin logdir = /home/radius/redback raddbdir = ${sysconfdir}/raddb/redback radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd libdir = /opt/freeradius/lib/ pidfile = ${run_dir}/redback.pid user = nobody group = nogroup log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = no auth = no auth_badpass = no auth_goodpass = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } preacct { preprocess acct_unique suffix files } accounting { detail sql }

2 2

Re: Generating timing stats for ntlm_auth
by Martin Ubank 16 Oct '13

16 Oct '13

As reported to Alan (at eduroam-uk-support), we are also seeing load problems at peak times with similar/identical error messages as those reported in this thread. We are running FreeRadius 2.2.0 on two CentOS 6 VMs, with Kerberos 1.8.2-3.el6 & Samba and Winbind 3.5.6-86.el6. Is there anything we can do here at UWE to help identify the general problem? Regards Martin. -----Original Message----- From: freeradius-users-bounces+martin.ubank=uwe.ac.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+martin.ubank=uwe.ac.uk@lists.freeradius.org] On Behalf Of Jonathan Gazeley Sent: 10 October 2013 23:07 To: freeradius-users(a)lists.freeradius.org Subject: Re: Generating timing stats for ntlm_auth Can confirm that we at Bristol (Cisco wireless, MS AD auth backend) are also seeing load problems at peak times (every hour, at lecture change-over time when approximately one billion iPhones start roaming the campus). We're also not seeing as much session resumption as we'd expect. We're also seeing the same messages as reported in this thread. Will be watching this thread with interest - happy to test patches etc. Cheers, Jonathan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

8 21