December 2013 - Freeradius-Users - lists.freeradius.org

RE: SQL MAC Authentication
by Christopher Kuhn 18 Dec '13

18 Dec '13

> It often helps to see if you can break down the problem into > independent pieces. Does EAP work elsewhere? etc. As I mentioned, it is successfully authenticating supplicants using PEAP-MSCHAP against an AD database. >>The debug output: >> >> Ready to process requests. >> rad_recv: Access-Request packet from host 10.25.22.31 port 49181, >> id=0, length=118 > > NAS-IP-Address = 10.25.22.31 > > NAS-Port-Type = Ethernet > > NAS-Port = 76 > > User-Name = "28d2441b77c9" > > Acct-Session-Id = "050004EE" > > Calling-Station-Id = "28-D2-44-1B-77-C9" > > EAP-Message = 0x0200001101323864323434316237376339 >> Message-Authenticator = 0x0c1c468757ad8814bb6dae782e1ac927 > > Which looks like EAP, not a MAC auth request. It seems that the switch simply extracts the soruce MAC from any traffic, then sends that as the username and password. This actually seems desirable, as it doesn't require an actual 802.1X supplicant on the user end, and I would think this would allow FreeRADIUS to process it like any standard EAP request. >> WARNING: !! EAP session for state 0x8246357d82472c19 did not finish! >> WARNING: !! Please read >> http://wiki.freeradius.org/Certificate_Compatibility > > That should be a hint. Did you read that page? Yes; although that warning appears in the debug logs for our current auth method, it has not interfered with authentication thus far. >> [eap] Response appears to match, but EAP type is wrong. > > The EAP supplicant is broken. FreeRADIUS sent it PEAP, and it > responded with EAP-MD5. > > Take the switch, and throw it in the garbage. It's garbage. The switch is *not* garbage. It's one of half a dozen SG500's in the network, which, general reliability aside, have a 0% chance of being replaced. Regardless, how did you know it was EAP-MD5? And is that the reason for its failure? >> 1) Why does finding the user in SQL not seem to count for authentication (is it supposed to return updated)? > > Because that's how it works. Finding the user is just ONE piece that's > required. If you put gas in your car, it might not move. It still > needs tires, and engine, etc. So are the other parts in this analogy radreply items, or something I don't quite grasp? >> 2) Why does FreeRADIUS continue on to try LDAP, even showing it as the exclusive reason for failure? > > You told it to use SQL then LDAP. And no, it does *not* show LDAP as > the exclusive reason for failure. Read the debug log. Okay, will do. I just assumed from the > Login incorrect ( [ldap] User not found): [28d2441b77c9] part of the log. >> 3) What am I missing that will cause an Access-Accept if a user is found in SQL? > > Because EAP requires a series of back & forth messages in lock-step. > The server is doing it correctly. The switch isn't. So the problem is the EAP type mismatch with the switch?

2 1

Re: Failed to Authenticate Cisco WLC 5508 to FreeRadius Server by using EAP.
by Poon Weng Chee 18 Dec '13

18 Dec '13

Dear A.L.M.Buxey, Thanks for your info, by the way today I tested using the URL below, http://deployingradius.com/documents/configuration/pap.html I tested locally, it works, "radtest bob hello localhost 0 testing123" Return, "rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, length=20" And I tested from the Windows Client to connect the WiFi AP. I successfully to authenticated the Radius server and connected the WiFi AP. But when I trying to using the LDAP user to connect the WiFi AP, it is failed. As you mentioned, "the auth failed because your LDAP stuff isnt right." Is it my configuration on LDAP stuff is incorrect? Do I need to setup the certificate (Production Certificate)? I did a research online, most of the people mentioned the cert need to be create if using EAP/PEAP. Any idea about this? But how come I can connect the test user "bob" without generating any certificate? Really appreciate for your help, hope you can help me on this. Thanks & Regards, Weng Chee DISCLAIMER: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you are not the intended recipient or the person responsible, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please immediately notify us. Thank you.

2 1

URL fix
by Alberto Martínez 18 Dec '13

18 Dec '13

In http://freeradius.org/download.html <a href="http://packages.ubuntu.com/hardy/source/freeradius">Ubuntu</a> --> <a href="http://packages.ubuntu.com/precise/source/freeradius ">Ubuntu</a> -- Alberto Martínez Setién Servicio Informático Universidad de Deusto Avda. de las Universidades, 24 48007 - Bilbao (SPAIN) Phone: +34 - 94 413 90 00 Ext 2684 Fax: +34 - 94 413 91 01

2 2

FR 3.0 with eDir
by Hubert Kupper 18 Dec '13

18 Dec '13

Hello, has anyone sucessfully istalled FR 3.0 with authentication against eDirectory and ldap? I get the following error: "WARNING: ldap : Failed to retrieve eDirectory password" The following options are set in the ldap modul: edir = yes edir_autz = yes With FR 2.x everything works fine. Best regards, Hubert

5 29

802.1x using Active Directory as Freeradius's Backed
by Andi Mappesona 18 Dec '13

18 Dec '13

Hi All, My company will implement WPA2-Enterprise as wireless user authentication method. We already use Active Directory so we want use that AD as authentication service for freeradius too. I already config the freeradius based on these link : http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… this link http://deployingradius.com/documents/configuration/active_directory.html https://www.eduroam.us/node/44 but no good so far, we always failed to authenticate users. Attached debug output. Regards Andi Mappesona

3 3

Failed to Authenticate Cisco WLC 5508 to FreeRadius Server by using EAP.
by Poon Weng Chee 18 Dec '13

18 Dec '13

Hey guys, I want to implement the Cisco WLC 5508 to FreeRadius server, basically the FreeRadius Server is integrate with LDAP. The connection will look like diagram below, WLC 5508 --------> FreeRadius (Integrated LDAP) The connection between WLC 5508 to FreeRadius is using EAP. I got an errors while doing the test, the errors are below, +- entering group authorize {...} [ldap] performing user authorization for evening [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> evening [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=evening) [ldap] expand: dc=fng,dc=fnf,dc=local -> dc=fng,dc=fnf,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=fng,dc=fnf,dc=local, with filter (uid=evening) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user evening authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [eap] EAP packet type response id 1 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation I also getting this Accept-Challenge and Accept-Request, see the errors below, ++[eap] returns handled Sending Access-Challenge of id 153 to 10.201.65.241 port 32769 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7acc1b267ace021e658dc33386efc594 Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.201.65.241 port 32769, id=154, length=347 User-Name = "evening" Calling-Station-Id = "00-23-12-11-6f-c5" Called-Station-Id = "ec-c8-82-ab-03-10:FNTest" NAS-Port = 1 Cisco-AVPair = "audit-session-id=0ac941f10001e76252a7e42a" NAS-IP-Address = 10.201.65.241 NAS-Identifier = "F&N_COM_WLC5508_2" Airespace-Wlan-Id = 3 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "10" EAP-Message = 0x0202006d198000000063160301005e0100005a030152a7e33ffc9ad76b67fac2d1ba43bfca99c29126ee731235c001ea8bfdf4bd32000018002f00350005000ac013c014c009c00a003200380013000401000019ff01000100000a0006000400170018000b0002010000230000 State = 0x7acc1b267ace021e658dc33386efc594 Message-Authenticator = 0x59835b7747b9a7654512b48586a132a5 What are the possibility that the authentication failed between Cisco WLC to FreeRadius?? Hope you guys can assist me on this particular issues. Really appreciate it for your help. Thanks & Regards, Weng Chee DISCLAIMER: This email and any files transmitted with it are confidential and are intended solely for the use of the individual or entity to which they are addressed. If you are not the intended recipient or the person responsible, be advised that you have received this e-mail in error and that any use, dissemination, forwarding, printing or copying of this e-mail is strictly prohibited. If you have received this e-mail in error, please immediately notify us. Thank you.

2 1

Regex Split on forward slash?
by Peter Lambrechtsen 17 Dec '13

17 Dec '13

I'm trying to do a global split on a forward slash in FreeRadius 2.1.12. Essentially I am trying to do a split on the ADSL Circuit ID: ADSL-Agent-Circuit-Id = "POLT01 eth 1/1/02/05/4/14/1:10" And trying to grab the value in the 6th split being "14" and check it's a 14. I would have hoped something like this regex would work: if ("%{ADSL-Agent-Circuit-Id}" =~ /(?<=\/)([\w-]*)(?=\/)/ ) { update request { Tmp-String-1 = "%{0}" Tmp-String-2 = "%{1}" Tmp-String-3 = "%{2}" Tmp-String-4 = "%{3}" Tmp-String-5 = "%{4}" Tmp-String-6 = "%{5}" Tmp-String-7 = "%{6}" } } And it would put each match into a Variable, or using /\//g too. But neither option works. Any suggestions on how to make it work, as I think taking it into Perl may be the best option.

4 7

how to install debugging symbols
by Hachmer, Tobias 16 Dec '13

16 Dec '13

Hello, I build radiusd RPM packages from the 3.0.x branch using the provided spec file. While debugging I recognized that are no debugging symbols installed by default and no package which contains them. What do I have to do in order to install the debugging symbols? Kind regards, Tobias Hachmer

6 15

SQL MAC Authentication
by Christopher Kuhn 16 Dec '13

16 Dec '13

Hello, I have a FreeRADIUS 2.1.10 server which is currently working as an authentication server on our wireless network. It is able to successfully use PEAP-MSCHAP and LDAP queries to an Active Directory database for authentication. We have now been trying to implement MAC address authentication on the wired network, using a Cisco switch and this same FreeRADIUS server. The goal is to use a MySQL database of MACs to check against. However, testing so far has failed to auth the test machines. The radius.radcheck table: +----+--------------+--------------------+----+--------------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+--------------+ | 1 | 28d2441b77c9 | Cleartext-Password | := | 28d2441b77c9 | | 2 | aabbcc112233 | Cleartext-Password | := | aabbcc112233 | +----+--------------+--------------------+----+--------------+ The debug output: Ready to process requests. rad_recv: Access-Request packet from host 10.25.22.31 port 49181, id=0, length=118 NAS-IP-Address = 10.25.22.31 NAS-Port-Type = Ethernet NAS-Port = 76 User-Name = "28d2441b77c9" Acct-Session-Id = "050004EE" Calling-Station-Id = "28-D2-44-1B-77-C9" EAP-Message = 0x0200001101323864323434316237376339 Message-Authenticator = 0x0c1c468757ad8814bb6dae782e1ac927 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "28d2441b77c9", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 17 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 189 ++[files] returns ok [sql] expand: %{User-Name} -> 28d2441b77c9 [sql] sql_set_user escaped user --> '28d2441b77c9' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '28d2441b77c9' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '28d2441b77c9' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '28d2441b77c9' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [ldap] performing user authorization for 28d2441b77c9 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=28d2441b77c9) [ldap] expand: DC=company,DC=tld -> DC=company,DC=tld [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to server.company.tld:636, authentication 0 [ldap] setting TLS mode to 1 [ldap] bind as [redacted] [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in DC=company,DC=tld, with filter (sAMAccountName=28d2441b77c9) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.25.22.31 port 49181 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8246357d82472c193c76c7709d2aae65 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.25.22.31 port 49181, id=0, length=153 Cleaning up request 1 ID 0 with timestamp +37 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x8246357d82472c19 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! NAS-IP-Address = 10.25.22.31 NAS-Port-Type = Ethernet NAS-Port = 76 User-Name = "28d2441b77c9" Acct-Session-Id = "050004EE" State = 0x8246357d82472c193c76c7709d2aae65 Calling-Station-Id = "28-D2-44-1B-77-C9" EAP-Message = 0x020100220410ab090564f0a81fef7cc5fa4ad743a959323864323434316237376339 Message-Authenticator = 0xb33f92e3651c00e500fe3b5722276082 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "28d2441b77c9", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 34 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 189 ++[files] returns ok [sql] expand: %{User-Name} -> 28d2441b77c9 [sql] sql_set_user escaped user --> '28d2441b77c9' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '28d2441b77c9' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '28d2441b77c9' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '28d2441b77c9' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok [ldap] performing user authorization for 28d2441b77c9 [ldap] expand: (sAMAccountName=%{mschap:User-Name}) -> (sAMAccountName=28d2441b77c9) [ldap] expand: DC=company,DC=tld -> DC=company,DC=tld [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in DC=company,DC=tld, with filter (sAMAccountName=28d2441b77c9) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] Response appears to match, but EAP type is wrong. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect ( [ldap] User not found): [28d2441b77c9] (from client test-switch port 76 cli 28-D2-44-1B-77-C9) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 28d2441b77c9 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.8 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 0 to 10.25.22.31 port 49181 What I do not understand: 1) Why does finding the user in SQL not seem to count for authentication (is it supposed to return updated)? 2) Why does FreeRADIUS continue on to try LDAP, even showing it as the exclusive reason for failure? 3) What am I missing that will cause an Access-Accept if a user is found in SQL? I hope you can forgive a first-timer for any relevant information I have left out.Any feedback you can give is greatly appreciated.

2 1

Freeradius+LDAP+MYSQL Simultaneous-Use
by ultaman khoo 16 Dec '13

16 Dec '13

Hi All, Appreciate someone can help on how to get Simultaneous-Use function working with Freeradius+MYSQL+LDAP, any link or website will be helpful. Regards, Alex

3 3