March 2013 - Freeradius-Users - lists.freeradius.org

PHP MD5 with appended salt
by René Klomp 07 Mar '13

07 Mar '13

Hi all, I am trying to connect my freeradius server to a mysql database containing all users. I created a new view to represent the table structure needed by freeradius, but I a problem with validating the passwords. The passwords of my users are (from a PHP application) concatenated with a salt, which is the same for all passwords, and stored using the regular php md5 function: md5($userpass . ':' . $salt) How can I make freeradius to append this salt to the password as well and validate the password in the correct way? Is there a default way to do this? Or should I create a module to do this? Regards, René

4 6

EAP-TLS testing, occasional errors
by Bertalan Voros 07 Mar '13

07 Mar '13

Hello All, I have configured a server to test EAP-TLS. Created the CA, a server and one client certificate. The same client certificate was then installed on three different devices; OSX, Windows 7 and an Android 4.2. All is well, all the devices can authenticate successfully, however, every now and again I can see similar entries in the log like the one below. A failure. Thu Mar 7 14:30:57 2013 : Error: TLS Alert write:fatal:handshake failure Thu Mar 7 14:30:57 2013 : Error: TLS_accept: error in SSLv3 read client certificate B Thu Mar 7 14:30:57 2013 : Error: rlm_eap: SSL error error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate Thu Mar 7 14:30:57 2013 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Thu Mar 7 14:30:57 2013 : Auth: Login incorrect (TLS Alert write:fatal:handshake failure): [wifiuser] (from client CiscoAP port 289 cli 10-68-3F-48-41-46) Then a success soon after from the same device (this is the Android one) Thu Mar 7 14:32:10 2013 : Auth: Login OK: [wifiuser] (from client CiscoAP port 291 cli 10-68-3F-48-41-46) Very occasionally the Android device would give up and not attempt to reauthenticate. The AP is set to reauthenticate clients every 10 minutes. (a rickety old Cisco Aironet 1200). Has anyone seen this before? Thanks in advance, Bertalan

2 1

Authentication Using "Framed-IP-Address"
by Russell Mike 07 Mar '13

07 Mar '13

Dear Alan. De. & List Greetings May i please ask your opinion, if it possible to accept & reject users base on "Framed-IP-Address". Thanks / Regards RM --

2 2

Child is hung for request … message
by Alex Sharaz 07 Mar '13

07 Mar '13

Hi, I've just downloaded,compiled and installed the latest version of 2.2 (2.2.1?) from git.freeradius.org. Installed it on an internal server and things seemed to work o.k. I then upgraded another server that deals with our external ( eduroam) connectivity and within a few mins am seeing Thu Mar 7 10:25:58 2013 : Error: WARNING: Unresponsive child for request 16, in component <core> module <thread> Thu Mar 7 10:25:59 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:00 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:03 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:06 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:11 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:16 2013 : Auth: Login OK: [lw09ea(a)leeds.ac.uk] (from client nasaaa2 port 0 cli 40-A6-D9-B9-A8-A6) Thu Mar 7 10:26:19 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:26 2013 : Auth: Login OK: [zszz5238(a)kclad.ds.kcl.ac.uk] (from client nasaaa2 port 0 cli 58-1F-AA-53-87-B4) Thu Mar 7 10:26:30 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:26:47 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:27:13 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:27:29 2013 : Auth: Login OK: [nagios(a)york.ac.uk] (from client systems0 port 0) Thu Mar 7 10:27:51 2013 : Info: WARNING: Child is hung for request 16 in component <core> module <thread>. Thu Mar 7 10:28:18 2013 : Error: Discarding duplicate request from client nasaaa2 port 1814 - ID: 255 due to unfinished request 88 Thu Mar 7 10:28:24 2013 : Error: Discarding duplicate request from client nasaaa2 port 1814 - ID: 255 due to unfinished request 88 Thu Mar 7 10:29:04 2013 : Error: WARNING: Unresponsive child for request 88, in component <core> module <thread> Thu Mar 7 10:29:05 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:06 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:08 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:12 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:17 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:25 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. Thu Mar 7 10:29:36 2013 : Info: WARNING: Child is hung for request 88 in component <core> module <thread>. The server is basically proxying off auth requests to remote RADIUS servers. Is the above just telling me that the other end is taking a while to reply or is there some underlying issue? Rgds A

4 7

Get Stop in accounting do some action
by Mehdi Ravanbakhsh 06 Mar '13

06 Mar '13

Hello everyone I need to update some check and replay attribute in database when get stop in accounting and the session is finish i need to know in which section of virtual server file ( sites-enabled/default) i need to put unlang script (and/or perl script) ? and how i can check in script if accounting get stop packet , read some radacct fild of that session to do some calculate and do some query in database in radcheck and radreplay . Best regards.

2 3

Value-pairs from exec script
by Brian Wallen 06 Mar '13

06 Mar '13

I have an exec script that returns a User-Name. FreeRADIUS passes the User-Name to my script (ie MyOldUsername) and my script changes it (ie MyNewUsername). In my logs I see Exec-Program-Wait: value-pairs: User-Name = MyNewUsername so I know my script is working and returning correctly. My problem is that FreeRADIUS doesn't take MyNewUsername from the script and MyOldUsername gets inserted into the radacct table. Below is my exec config. My script is a PHP script on a web server that gets called via wget. One thing that I'm not sure of is what input_pairs and output_pairs should be set to. I see that "config" and "reply" are valid options, but what is the difference between them? What other information is needed in order to troubleshoot this problem? exec { wait = yes program = `/usr/bin/wget -q -O - 127.0.0.1/%{Calling-Station-Id}` shell_escape = yes input_pairs = config output_pairs = config }

3 8

mschap module vs ntlm_auth module
by Óscar Remírez de Ganuza Satrústegui 06 Mar '13

06 Mar '13

Good afternoon, As I said some days ago in this list, we have configured our freeradius server to use ntlm_auth for autentication following the document: http://deployingradius.com/documents/configuration/active_directory.html Everything is working as expected. Thanks! But I have some doubts about that documentation. In section "Configuring FreeRADIUS to use ntlm_auth" is said to "to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file." I have made some tests and it seems that is not needed to add it, as freeradius is using mschap module to autenticate. +- entering group MS-CHAP {...} [mschap] Client is using MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> oscarrdg [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=oscarrdg [mschap] mschap1: b9 [mschap] expand: %{mschap:Challenge} -> b9415739df3a9c1b [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=b9415739df3a9c1b [mschap] expand: %{mschap:NT-Response} -> 2d41aa6d7e87e086dfc2920f2234b58ca1f6efe2c71505b8 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=2d41aa6d7e87e086dfc2920f2234b58ca1f6efe2c71505b8 Exec-Program output: NT_KEY: 312D5366FF0179461F1E13FA4AECD06A Exec-Program-Wait: plaintext: NT_KEY: 312D5366FF0179461F1E13FA4AECD06A Exec-Program: returned: 0 [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] returns ok Is there anything else to take into account considering adding that section to the virtual servers configuration or not? Or is it just needed when Auth-Type is set to ntlm_auth manually in order to test the system? I usually prefer to let config files as similar to the default files as posible. Thank you so much for your help. Regards, * Oscar Remírez de Ganuza Satrústegui* Servicios Informáticos (Área de Infraestructuras) Universidad de Navarra Tel. +34 948425600 x803130 http://www.unav.es/SI/

3 3

design question
by Matt Zagrabelny 06 Mar '13

06 Mar '13

Greetings, I am configuring a general purpose RADIUS server that any number of clients can connect to for authn - it uses a PostgreSQL DB as the backend datastore. I would also like to setup a secondary RADIUS server listening on a different port (ie. 1814) and use the same Pg DB as a backend, but use a "restricted" view as the "users" table, then configure devices (certain network gear) that wish to only allow users in the "restricted" view to use that secondary RADIUS server and corresponding port. I am currently using Debian 6.0 with corresponding FR 2.1.10+dfsg-2+squeeze1. My questions are these: Has anyone here setup a second instance of FR running on the same system as their primary instance, but with different configs? Do you have any suggestions for layout or keeping configs/logs straight? Or said another way, how much confusion will there be in /etc/freeradius (default Debian config dir) due to the second instance? Is it worth it, just to have a single system have all of your RADIUS servers or should I just stand up another virtual server and use that instead? Thanks for any help or hints! -matt zagrabelny

3 7

Help
by Jed Gainer 06 Mar '13

06 Mar '13

Help

3 3

Thank You freeRADIUS!
by Thomas Simmons 06 Mar '13

06 Mar '13

Hello All, I have been working on a pretty major upgrade of the "core authentication system" at my company. The original system was designed and deployed by me nearly a decade ago, and was built around Samba3, OpenLDAP and freeRADIUS 1. Until I started the upgrade, I was unaware of the new capabilities of freeRADIUS 2, namely virtual servers. To be honest, when I started a few months back it was primarily for the functionality of Samba 4 (Active Directory). That said, when I became aware of the capabilities of freeRADIUS 2, it gave me some great ideas about authentication.Until now, we had a simple internal network where people could login with their Samba3 credentials and a external (connected to our DMZ) network that just used WPA2-PSK. I never liked this setup for two reasons: 1) anyone could bring their own device and connect to our internal network (it's gotten really bad since smartphones and tablets became the new craze) and 2) we have a large number of employees that are off-site, but come on-site regularly. These employees always want to connect to our main network with non-or-other-company systems since using their domain credentials is easier. In any event, I really started digging into freeRADIUS 2 over the last week and now have an internal network that does AD auth (user or computer) w/ MAC restrictions and an external network that does both AD auth and has a "guest" account in a file (I may change this to MySQL and create a small web interface so employees can create a temporary, self-expiring account for guests). The only hiccup I ran into along the way was Microsoft's client not liking wildcard certs, so I can say it was a very smooth process from a freeRADIUS perspective. Now I'm starting to think how can we push this out to a few other sites we have across the country. Pretty easily actually! Anyhow, I just wanted to give a big thank you to Mr. DeKok and anyone else who works on freeRADIUS or helps on the lists. As a lllloooonnngggg time user, your efforts are very much appreciated here! Thanks, Thomas

1 0