November 2013 - Freeradius-Users - lists.freeradius.org

FreeRADIUS & AD LAP Communication
by Russell Mike 21 Nov '13

21 Nov '13

Dear Good Peoples Greetings Version Information: FreeRADIUS 2.2.0. Question: What does the following means? Is it not authentication area in "default" virtual server? i have listed "ldap" there. 1.) rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. 2.) i have one Linux open-ldap server, FreeRADIUS Auth works from that LDAP server, with following configuration. Please note, the passport storage in destination Linux LDAP Server is cleartext. i do check using the following command. * radtest mike aabb88@ localhost 1812 HYbbunINFDR$88 * # CentOS Open-ldap Server server = "ldapserver-mydomain.net<http://ldap.digital-infotech.net/> " identity = "cn=Administrator,dc=ldap-mydomain,dc=net" password = "password" basedn = "dc=mydomain,dc=net" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" i receive, access Accept !!! - NO problem 3.) When i do user query from FreeRADIUS to Windows Domain Controller Server 2012 x64. # Windows Domain Controller Server 2012 64-Bit AD server = "ldap-mydomain.com <http://ldap-teledataict.com/>" identity = "cn=Administrator,cn=Users,dc=ldap-mydomain,dc=com" password = "password" basedn = "dc=ldap-mydomain,dc=com" # Enable One Filter Only #filter = "(SamAccountName=%u)" filter = "(cn=%{%{Stripped-User-Name}:-%{User-Name}})" 3a) Following is the out-put with REJECT access, Perhaps because password storage in AD is not clear text, is it due to that? Perhaps it cannot be tested with redtest? i am using the following to test, is it correct test * radtest mike aabb88@ localhost 1812 HYbbunINFDR$88* 4.) rad_recv: Access-Request packet from host 127.0.0.1 port 46861, id=137, length=75 User-Name = "mike" User-Password = "aabb88@" NAS-IP-Address = 14.14.14.14 NAS-Port = 1812 Message-Authenticator = 0x4a3417dcf9e80de96f2274fbfa6f5c4d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "mike", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for mike [ldap] expand: (SamAccountName=%u) -> (SamAccountName=mike) [ldap] expand: dc=ldap-teledataict,dc=com -> dc=ldap-teledataict,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to ldap-mydomain.net:389<http://ldap-teledataict.com:389/>, authentication 0 [ldap] bind as cn=Administrator,cn=Users,dc=ldap-teledataict,dc=com/rootadmin to ldap-mydomain.net:389 <http://ldap-teledataict.com:389/> [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=ldap-teledataict,dc=com, with filter (SamAccountName=mike) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user mike authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[dailycounter] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[forevertimecounter] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[gigawordcounter] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/auth_all +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> mike attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 137 to 127.0.0.1 port 46861 Waking up in 4.9 seconds. Cleaning up request 0 ID 137 with timestamp +3 Ready to process requests. Thanks / Regards

2 2

equivalent of preproxy.conf in FR3
by Alex Sharaz 21 Nov '13

21 Nov '13

Hi, In FR2 I use a preproxy.conf file in my "default" virtual server to proxy off auth requests to other radius servers based upon the contents of the realm attribute. This file doesn't seem to be part of the standard config config files in FR3. Has this functionality been moved to somewhere else in FR3, or can I just use the preproxy.conf from FR2? Rgds Alex

4 3

Question on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device.
by Milton Volz 21 Nov '13

21 Nov '13

Hi, We are looking for help or guidance on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device. Currently installed: freeradius-server-2.1.12, running on Linux Cent OS 6.4 - x64, Cisco HA 5.3 running on a Cisco SAMI blade in a 7604 Brief Background: Our application is providing a "proxy" alternative Cisco HOME AGENT and DAY PASS service for the Carriers that have subscribers that do not have roaming agreements with the Home Carrier they are attempting to register too, that are currently not served & dropped with no service, today. We have completed live production test with a Tier 2 Carrier and found out from lab testing to live testing that we would not be able to ignore the MN-AAA key and "hotline" the user with a AAA profile using a "local" config with the Cisco as stated in the Cisco HA 5.3 documentation (Typical Cisco document). We now have to use the "remote" capabilities of the Cisco HA for authentication and authorization, versus local Cisco HA config. Question: We now need to use the FreeRadius to manage both the MN-HA and MN-AAA keys and respond back to the Cisco HA properly to complete the device registration back to the Cisco HA. We have used the "3gpp2-mn-ha-shared-key" for the MN-HA attribute and response to the Cisco HA & tested this successfully, but are not able to find or determine what attribute to use for the response back to the Cisco HA for the "chap password" & "chap challenge" for the MN-AAA, which we are receiving from the Cisco HA. We are trying to determine if such an attribute exist and if so, which one will do the trick. I hope this is enough information and understandable in such a short write up. Please let me know if you have any suggestions or can point us in the right direction for the resources to resolve this. Thanks, Milton

3 2

MIgrating ACS to Freeradius
by Zafar Pravaiz 20 Nov '13

20 Nov '13

Dear Community, I am in process to replace our Cisco ACS to Freeradius for our wireless authentication and trying to achieve same functionality as ACS. Here is what i need. 1. It should authenticate against AD. 2. User should be checked in specific group in AD and have specific Called-Station-id ( If Users in AD group == Students and Called-Station-ID== *SSID then Accept-Accept). 3. There is should be multiple policy for various condition match like above. 4. Default should be Reject. 5. All user auth (pass/fail) should be logged in file/syslog with rejection reason. I have achieve only 1st point. Any one has done same ? is it possible in Freeradius? can someone point me to right direction or share config. I will really appreciate the help Thank you -- Zafar Pravaiz Senior Systems Engineer Information Technology Department Tel +971 6 515 2164 Fax +971 6 515 2112 American University of Sharjah PO Box 26666, Sharjah United Arab Emirates http://www.aus.edu zpravaiz(a)aus.edu

2 1

Everything is now fine
by Alan DeKok 20 Nov '13

20 Nov '13

The freeradius.org domain expired, sorry. The registrar hadn't notified me it was going to expire. It's all fixed now. Alan DeKok.

2 1

Cleanup of the "id" between NAS and radius server
by John Douglass 20 Nov '13

20 Nov '13

I have a question about any settings that may effect the timing of the re-use of the "Identifier" as per the RFC: *Identifier * The Identifier field is /one octet/, and aids in matching requests and replies. The RADIUS server can detect a duplicate request if it has the same client source IP address and source UDP port and Identifier within a short span of time. I am currently running radius 2.2.0 and in my radiusd.conf I have: # max_request_time: The maximum time (in seconds) to handle a request. # # Useful range of values: 5 to 120 # max_request_time = 5 # cleanup_delay: The time to wait (in seconds) before cleaning up # a reply which was sent to the NAS. # # The RADIUS request is normally cached internally for a short period # of time, after the reply is sent to the NAS. The reply packet may be # lost in the network, and the NAS will not see it. The NAS will then # re-send the request, and the server will respond quickly with the # cached reply. # # If this value is set too low, then duplicate requests from the NAS # MAY NOT be detected, and will instead be handled as seperate requests. # # If this value is set too high, then the server will cache too many # requests, and some new requests may get blocked. (See 'max_requests'.) # # Useful range of values: 2 to 10 # cleanup_delay = 2 # max_requests: The maximum number of requests which the server keeps # track of. This should be 256 multiplied by the number of clients. # e.g. With 4 clients, this number should be 1024. # # If this number is too low, then when the server becomes busy, # it will not respond to any new requests, until the 'cleanup_delay' # time has passed, and it has removed the old requests. # # If this number is set too high, then the server will use a bit more # memory for no real benefit. # # If you aren't sure what it should be set to, it's better to set it # too high than too low. Setting it to 1000 per client is probably # the highest it should be. # # Useful range of values: 256 to infinity # max_requests = 8500 I have posted my wireshark screen at: http://johnd.oit.gatech.edu/wp-content/uploads/2013/11/wireshark-discarding… When I am looking at my TCPdumps (debugging duplicate requests) I see a duplicate request come in at Frame 6963 Frame 5475 at 10:20:07 - Access-Request id 76 Frame 5482 at 10:20:07 - Access Challenge response to 5475 id 76 Frame 6963 at 10:20:13 - Duplicate Request says response to this request id 76 is in frame 5482 Now, Frame 6963 is a full 5 seconds past the Access-Challenge of Frame 5482. My question is, is it the "cleanup_delay" setting that cleans up old identifiers for re-use? Does the "max_requests" value have any effect on when the identifiers are ready for re-use? Thanks, - John Douglass, Sr. Systems IT/Architect

3 2

checking an atribute in multiple entries of default/outer tunnel
by Rui Ribeiro 19 Nov '13

19 Nov '13

Dears, If I have an outer tunnel like in freeradius 2.2.2 like the following, why should Stripped-User-Name be known in the following interactions that visit the outer tunnel, and the whole if block is executed each time? I think it was supposed to have Stripped-User-Name set on the first entry, and then have it available to the next interactions. Regards, Rui Ribeiro authorize { auth_log if (!(Stripped-User-Name)) { if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "MyDomain") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := TO_EDUROAM } } } } eap { ok = return } }

2 1

SQLIppool and multiple NAS IPs
by Victor Rodriguez 19 Nov '13

19 Nov '13

Hello, I'm trying to implement Freeradius v2.1.10 to provide a different IP Pool depending on the IP address of the NAS (Mikrotik PPPoE) the request comes from. I'm using radgroupcheck in this way and it works: '300', 'grp_test', 'Pool-Name', ':=', 'pool_Test' '301', 'grp_test', 'NAS-IP-Address', '==', '192.168.1.1' '302', 'grp_test', 'Simultaneous-Use', ':=', '1' '303', 'grp_test2', 'Pool-Name', ':=', 'pool_Test2' '304', 'grp_test2', 'NAS-IP-Address', '==', '192.168.1.2' '302', 'grp_test2', 'Simultaneous-Use', ':=', '1' (username belongs to both groups) The problem is that I would like to group some NAS and provide the same IP Pool: '310', 'grp_test3', 'Pool-Name', ':=', 'pool_Test2' '311', 'grp_test3', 'NAS-IP-Address', '==', '192.168.1.1' '312', 'grp_test3', 'NAS-IP-Address', '==', '192.168.1.2' '313', 'grp_test3', 'Simultaneous-Use', ':=', '1' This doesn't work, FR doesn't get an IP pool when checking radgroupcheck and so the client doesn't get an IP. Am I missing something? Do I a need to implement huntgroups in SQL? Thanks!

2 1

Freeradius with LDAP on embedded
by petr＠baranov.fi 19 Nov '13

19 Nov '13

Hello, I am configuring freeradius to use openldap-backend for authentication. My setup runs on an embedded system built with Yoctoproject. To test my setup I run radtest from ubuntu image. From the debuggin messages of the FR I can see that LDAP back-end is in use but it always complains about invalid credentials: ... Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "john" with password "?=K?)J��???Q$?��" [ldap] user DN: uid=john,ou=People,dc=my-domain,dc=com [ldap] (re)connect to 192.168.122.158:389, authentication 1 [ldap] bind as uid=john,ou=People,dc=my-domain,dc=com/?=K?)J��???Q$?�� to 192.168.122.158:389 [ldap] waiting for bind result ... [ldap] Bind failed with invalid credentials ++[ldap] returns reject ... (Notice, password looks wierd!) I belive that my configurations are correct, because when I setup FR on ubuntu to use LDAP from my embedded image, authentication passes successfully. The password is visible in clear text The FR in ubuntu and in my embedded image are compiled with --enable-developer flag. Can there be some limitation in my embedded environment that causes such behaviour? For example, busybox? Kind Regards, Petr

3 2

EAP Question
by Russell Mike 19 Nov '13

19 Nov '13

Dear List Please forgive me if my question is not good but i tried my best. IEEE 802.1X and EAP The IEEE 802.1X protocol provides access control in OSI Layer 2 (the MAC Layer). IEEE.802.1X supports the authentication of clients while establishing a connection to the network before the client is assigned as IP address via DHCP ( Dynamic Host Configuration Protocol) Among other things. i am using CoovaChilli with FR and i need to authenticate users before ip address & VLAN is assigned. i wish to check if Freeradius EAP would work this way. Thanks / Regards RM--

3 4