May 2013 - Freeradius-Users - lists.freeradius.org

using unlang to call a stored procedure
by Alex Sharaz 20 May '13

20 May '13

Hi, I've written a mysql stored procedure that accepts 2 arguments, the nas-ip address of one of our (HP) switches and the calling station Id of a network client ( it's a MAC auth so the User-Name=Calling-Station-Id below). The procedure then queries various back end database tables to figure out which vlan to drop the client into based upon where it is on the network and the type of client it is. Once I've got the vlan back I can decide whether to use RFC 3580 or RFC 4675 when creating the attributes to pass back in the access-accept packet. Only problem is figuring out how to format the unlang statement. Elsewhere in my sites-enable/default file I've got if ( "%{sql:SELECT count(*) from banned_macs where mac_address=UPPER(TRIM('%{Calling-Station-Id}'))}" > "0" ) { update control { Auth-Type := Reject } update reply { Reply-Message := "quarantined, contact ITSO" } } which works just fine and I can block specific mac addresses from connecting to our wired network. In this case I've got Tmp-String-0 := "%{sql:call get_vlan_id('%{NAS-IP-Address}','%{User-Name}')}" get_vlan_id accepts two varchar arguments. Which, when I run radiusd -X -d /etc/freeradius gives me /etc/freeradius/sites-enabled/default[248]: Unknown action '%{sql:CALL get_vlan_id('%{NAS-IP-Address}','%{User-Name}')}'. I found a message on the list that says ………. call a stored procedure by using "%{<call the stored proc in here>}" Well, from a mysql cli I'd type call get_vlan_id(…….) to run the stored procedure. Rgds Alex

2 3

Authenticate SSH users against Freeradius
by Roberto Carna 20 May '13

20 May '13

Dear, I have: (A) One Freeradius server on Debian 6: freeradius installation and client.conf configuration (B) Another Debian 6 box with sshd:* *libpam-radius-auth installation (C) Several Windows and Linux ssh clients In (A) freeradius server, can I define the ssh users in client.conf file only ??? In (B) debian sshd box server, do I have to install a radius client in addition to libpam-radius-auth package ??? And do I have to define any ssh user here ??? Please, I need a good howto because I'm lost. Thanks a lot, Roberto

2 1

Unlang clarification
by David Peterson 20 May '13

20 May '13

I am fighting a buggy NAS and was told to add to the /sites-enabled/default file in the post-auth section this code: EAP-Message = "0x04040004" User-Name !* 0x00 Message-Authenticator = "%{Message-Authenticator}" Can someone clarify what this would actually do to the EAP response? David

4 5

RE: Help with chap
by Franks Andy (RLZ) IT Systems Engineer 20 May '13

20 May '13

Thanks Alan, It takes literary a second or so for a single client auth, but problems arise with multiple clients. I'll reset a card on the switch and capture the logs and see what's happening. Nothing as far as I remember pointed towards the ntlm_auth being the issue, it was the failure to complete the eap transaction that seemed to be the problem, but then I didn't scan each and every line to be honest. I'll post back. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 18 May 2013 13:37 To: FreeRadius users mailing list Subject: Re: Help with chap Franks Andy (RLZ) IT Systems Engineer wrote: > ... It worked brilliantly in testing, but come > production, when i reboot the switch or clear the authentication on the > ports it can take up to ten minutes for 10-15 clients to authenticate, That's bad. 10-15 clients should be done in a second or so. My guess is that the ntlm_auth process is taking a *long* time. Maybe your DNS settings are broken. Set up a test server. Run it in debugging mode and see. If the authentication takes more than a second or so (wtih debug messages), something is wrong. > - Synch the content of the AD OU I have the mac address "users" in to an > SQL database, maybe using vbscript/.net, including any state information > like whether the account is disabled or expired and test against these > custom fields during authentication. That will work for MS-CHAP. Not for CHAP. > The authorisation process I > currently have running against ldap doesn't pick up the account > information being expired, maybe I need to look into this. I want to be > able ideally to feed information back following a successful > authentication to a custom attribute in AD, which is quite possible with > an SQL database as an "intermediary", for example switch and port ID, > useful stuff to know. I can't think of any native linux apps that can > change AD attributes, excluding samba doing groups and passwords, maybe > there is one? A normal LDAP client should work. > - Use ldap as an authentication method? I know that AD will never give > me back a password, but since this is mac authentication I was wondering > if in the authorisation bit of the virtual server I could update the > cleartext-password attribute based on the username as the two details > are always identical in mac based auth, and then perform authentication > with a known password. Maybe this would pick up locked usernames > instead, again not sure about MS ldap in this area, never tried. If it's MAC authentication, then FreeRADIUS can do the CHAP checking itself. And there's no point in doing *more* authentication. The only reasonable thing to do is various checks in LDAP for the MAC address. > - use nps as a proxy for the authentication. I don't really want to do > this, but nps will (I think) allow chap / AD authentication. No, it won't. It's impossible. > Any ideas which of these / other would be the right direction to follow? > Need to do this in a hurry as the next switch is rolling out soon so > don't have time to look into all of them.. Step 1: find out what's wrong with the current system. If something is broken, fix it. Don't work around the problem. That makes it worse. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

reference to check items using unlang
by Nasser Heidari 20 May '13

20 May '13

Hi All, How can I reference to check items using unlang? When I use perl script , simply reference it by $RAD_CHECK. For example I want to check if there is a check item in sql user profile , then do some actions using unlang and if not then ignore it. By the way I know that I can do that by querying sql in unlang but I wondering if there is a better way for doing that. Could you please help me? Regards, Nasser

3 3

unlang equivalent of radlog
by Nasser Heidari 20 May '13

20 May '13

Hi, I have several Perl modules running on my Radius server, I'm going to remove them all and use unlang instead. I have two questions: 1- The reason that I'm going to change Perl modules with unlang is Performance ! I think unlang should have better performance in comparison to Perl (Note that I have some mysql queries in my perl modules), is this correct? 2- I have used &radius::radlog in my perl modules to log some cases on radius.log, is there any equivalent for it in unlang? Could you please kindly give an example? Regards, Nasser

3 3

Re: Using return-output from external script as reply-message
by S y s C o / developer 18 May '13

18 May '13

Hello Stephan, hello Alan, Have a look at the last beta version (http://www.1-2-3-4-5-6.net/multiotp/beta/) you can now set a prefix for the debug mode. for example to be able to handle response by the radius server ;-) To set this option : multiotp -config debug-prefix="Reply-Message := " Any feedback welcome Best regards, Andre Liechti Stefan Kuegler wrote: > exec multiotp { > wait = yes > input_pairs = request > output_pairs = reply > > That says the script output is a series of "Attribute = Value" lines. > > ...and activated this module in the authentication-section of the > default-configuration (and also in the inner-tunnel-configuration): > > authenticate { > [...] > Auth-Type MultiOTP { > update reply { > Reply-Message = "Hello, %{User-Name}" > } > multiotp > } Alan DeKok wrote: > Update sections should generally be in post-auth, but... whatever. > >> The external script gives me additional informations (like "OK: Token >> accepted", "INFO: Authentication failed" etc.) after authentication. > > Which isn't in "Attribute = Value" form, and is therefore ignored. > > Yes. Fix the script to send: > > Reply-Message := "... text ... "

1 0

Help with chap
by Franks Andy (RLZ) IT Systems Engineer 18 May '13

18 May '13

Hi, I seem to frequent this forum, hopefully one day I'll be answering some questions, not asking them. I've recently got into mac based auth on a procurve 5406. It does either chap or peap-mschap authentication, and i'm using ntlm_auth for the mschap2 when using peap. It worked brilliantly in testing, but come production, when i reboot the switch or clear the authentication on the ports it can take up to ten minutes for 10-15 clients to authenticate, simply because the nas (i guess) gets overwhelmed and consequently I see loads of "eap did not complete" messages. These don't happen for individual transactions - they always complete fine. I can't see a way around this - we have loads of these switches.. So the question is the best way to use chap. I can't do it with ntlm_auth - so I thought of a few, possibly ridiculous options : - Synch the content of the AD OU I have the mac address "users" in to an SQL database, maybe using vbscript/.net, including any state information like whether the account is disabled or expired and test against these custom fields during authentication. The authorisation process I currently have running against ldap doesn't pick up the account information being expired, maybe I need to look into this. I want to be able ideally to feed information back following a successful authentication to a custom attribute in AD, which is quite possible with an SQL database as an "intermediary", for example switch and port ID, useful stuff to know. I can't think of any native linux apps that can change AD attributes, excluding samba doing groups and passwords, maybe there is one? - Use ldap as an authentication method? I know that AD will never give me back a password, but since this is mac authentication I was wondering if in the authorisation bit of the virtual server I could update the cleartext-password attribute based on the username as the two details are always identical in mac based auth, and then perform authentication with a known password. Maybe this would pick up locked usernames instead, again not sure about MS ldap in this area, never tried. - use nps as a proxy for the authentication. I don't really want to do this, but nps will (I think) allow chap / AD authentication. Any ideas which of these / other would be the right direction to follow? Need to do this in a hurry as the next switch is rolling out soon so don't have time to look into all of them.. Thanks Andy

3 2

Need help: login incorrect with FR 2.2.1
by Wang, Yu 16 May '13

16 May '13

Hello, I upgraded FR from 2.1.10 to 2.2.1. Everything went well except about 25% of our wireless users cannot authenticate after the upgrade. The backend authentication server is Active Directory and we use ntlm_auth from winbind to pass MSCHAPv2 response from FR to AD. After upgrade FR, I also restart winbindd, smbd, and nmbd. For the users who cannot authenticate, I found that reset password would resolve the issue. However we have over 50,000 users. Our helpdesk would be overwhelmed to help 13k users to change their password. So I had to roll back to 2.1.10 and the users I know who cannot authenticate with 2.2.1 were able to authenticate again with 2.1.10 without changing password. Here is radiusd -X for one user's failed authentication. On AD Event Log it shows error 0xC000006A An incorrect password was supplied. And on radius side, it shows Login incorrect (mschap_ad: External script says Logon failure (0xc000006d)). What changes in the new code could affects mschap handling? Or what should I do to make 2.2.1 work without forcing users to reset their password? Thanks for your help. If you need more information, please let me know and I'll post them. Yu Wang Network Architect FSU ======================radiusd -X ===================================== rad_recv: Access-Request packet from host 192.168.255.233 port 32846, id=112, length=343 User-Name = "myusername" NAS-IP-Address = 192.168.255.200 NAS-IPv6-Address = ::1 NAS-Port = 0 NAS-Identifier = "192.168.255.233" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "8C58779F3105" Called-Station-Id = "000B860E2A80" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a006b190017030100608bfce27df6c312388e67d06a84921c88cbeb2729d13da08d98f6cd46cab227836f576e262c5543a0cfc8aaaac88dc02450477cac6b06a3c816ac01090b848190401617a0a19eb2b79a1e49f d687087b02918d5e588764ab0f07c03d9eecf9f80 State = 0x5858357f50522cd58c1225ecc15d6edb Aruba-Essid-Name = "FSUSecure" Aruba-Location-Id = "wg-a105-4012-Rm.wlan.fsu.edu" Aruba-AP-Group = "wlan" Aruba-Device-Type = "iPhone" Message-Authenticator = 0x245bb0a5f3165db6d047fb13cfb41042 server virtual.dot1x_1814 { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 10 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 server virtual.dot1x_1814 { [peap] Setting User-Name to myusername Sending tunneled request EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "myusername" State = 0x9e97c83a9e9dd2677d1fae1010f8f18d server virtual.dot1x_1814_inner_tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authorize {...} ++? if ((outer.request:EAP-Message) ) ?? Evaluating (outer.request:EAP-Message) -> TRUE ++? if ((outer.request:EAP-Message) ) -> TRUE ++- entering if ((outer.request:EAP-Message) ) {...} expand: %{request:User-Name} -> myusername +++[outer.request] returns notfound expand: %{request:User-Name} -> myusername +++[reply] returns notfound ++- if ((outer.request:EAP-Message) ) returns notfound ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) ?? Evaluating (outer.request:EAP-Message) -> TRUE expand: local.MY.realm -> local.MY.realm WARNING: No such configuration item local.MY.realm expand: %{config:local.MY.realm} -> ? Evaluating (Realm != "%{config:local.MY.realm}" ) -> TRUE ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) -> TRUE ++- entering if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) {...} expand: Realm is '%{Realm}' on Inside -> Realm is 'NULL' on Inside +++[outer.reply] returns ok ++- if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) returns ok [eap] EAP packet type response id 10 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 8 ++[files] returns ok ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++- entering else else {...} [ldap-mds] performing user authorization for myusername [ldap-mds] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap-mds] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(!(uid=lib-guest*))) -> (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] expand: dc=fsu,dc=edu -> dc=fsu,dc=edu [ldap-mds] ldap_get_conn: Checking Id: 0 [ldap-mds] ldap_get_conn: Got Id: 0 [ldap-mds] performing search in dc=fsu,dc=edu, with filter (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] looking for check items in directory... [ldap-mds] ntPassword -> NT-Password == 0x4444333431333443313741333642433142444136383333324232323239443431 [ldap-mds] looking for reply items in directory... [ldap-mds] employeeStatus -> My-Local-employeeStatus = "Active" [ldap-mds] ldap_release_conn: Release Id: 0 +++[ldap-mds] returns ok ++- else else returns ok rlm_perl: RAD_REQUEST: User-Name = myusername rlm_perl: RAD_REQUEST: EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 rlm_perl: RAD_REQUEST: Realm = NULL rlm_perl: RAD_REQUEST: EAP-Type = MS-CHAP-V2 rlm_perl: RAD_REQUEST: Stripped-User-Name = myusername rlm_perl: RAD_REQUEST: State = 0x9e97c83a9e9dd2677d1fae1010f8f18d rlm_perl: RAD_REQUEST: FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Assign myusername to VLAN employee2b. rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair EAP-Message = 0x020a00411a020a003c31c8a5f4da7f3f5fee24c0f8c2a0ad12390000000000000000d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c0100616d61313263 rlm_perl: Added pair Realm = NULL rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair Stripped-User-Name = myusername rlm_perl: Added pair State = 0x9e97c83a9e9dd2677d1fae1010f8f18d rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair My-Local-employeeStatus = Active rlm_perl: Added pair Tunnel-Private-Group-Id = employee2b rlm_perl: Added pair NT-Password = 0x4444333431333443313741333642433142444136383333324232323239443431 rlm_perl: Added pair Ldap-UserDn = uid=myusername,dc=users,dc=fsu,dc=edu rlm_perl: Added pair Auth-Type = EAP ++[perl_dot1x] returns updated expand: %{Realm} -> NULL ++- entering switch %{Realm} {...} +++- switch %{Realm} returns updated ++- group authorize returns updated ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap_ad] Found NT-Password [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] Client is using MS-CHAPv2 for myusername, we need NT-Password [mschap_ad] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap_ad] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=myusername [mschap_ad] No NT-Domain was found in the User-Name. [mschap_ad] expand: %{mschap:NT-Domain} -> [mschap_ad] ... expanding second conditional [mschap_ad] expand: --domain=%{%{mschap:NT-Domain}:-FSU} -> --domain=FSU [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=671fda289ab79035 [mschap_ad] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=d1ec3781f44920bf27bd2445d0d4db58c2f199c141667c01 Exec output: Logon failure (0xc000006d) Exec plaintext: Logon failure (0xc000006d) [mschap_ad] Exec: program returned: 1 [mschap_ad] External script failed. [mschap_ad] FAILED: MS-CHAP2-Response is incorrect ++[mschap_ad] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect (mschap_ad: External script says Logon failure (0xc000006d)): [myusername] (from client aruba233 port 0 via TLS tunnel) Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> myusername attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated } # server virtual.dot1x_1814_inner_tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server virtual.dot1x_1814 Sending Access-Challenge of id 112 to 192.168.255.233 port 32846 Reply-Message = "Realm is 'NULL' on Inside" EAP-Message = 0x010b002b19001703010020c717f8462edd4b081a4cab8c17a2a77939f2b7ed8f45477fa43ca7ae59cdded3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5858357f51532cd58c1225ecc15d6edb Finished request 91419. Going to the next request ======================================================================================== rad_recv: Access-Request packet from host 192.168.255.233 port 32846, id=185, length=343 User-Name = "myusername" NAS-IP-Address = 192.168.255.200 NAS-IPv6-Address = ::1 NAS-Port = 0 NAS-Identifier = "192.168.255.233" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "8C58779F3105" Called-Station-Id = "000B860E2A80" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a006b190017030100601fa8cfb41d8a736603cccfac039a1e796b70c551d0229a7054620a3569e504875e69eb4f348dc1db446dc778c0c797ce8df3680674d1cf083167c839473737483bbf4564cbca6a2ab0e045b dc7549f45664c3aca1497463410664e0ae91cee39 State = 0xcbac7161c3a6687448dbbe7553b6baed Aruba-Essid-Name = "FSUSecure" Aruba-Location-Id = "wg-a105-4012-Rm.wlan.fsu.edu" Aruba-AP-Group = "wlan" Aruba-Device-Type = "iPhone" Message-Authenticator = 0x5eebfb60034622676aaa614c5dec1ec8 server virtual.dot1x_1814 { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 10 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814 +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state phase2 [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 server virtual.dot1x_1814 { [peap] Setting User-Name to myusername Sending tunneled request EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "myusername" State = 0xa7e44290a7ee58094f4ed0f3925b59a6 server virtual.dot1x_1814_inner_tunnel { # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authorize {...} ++? if ((outer.request:EAP-Message) ) ?? Evaluating (outer.request:EAP-Message) -> TRUE ++? if ((outer.request:EAP-Message) ) -> TRUE ++- entering if ((outer.request:EAP-Message) ) {...} expand: %{request:User-Name} -> myusername +++[outer.request] returns notfound expand: %{request:User-Name} -> myusername +++[reply] returns notfound ++- if ((outer.request:EAP-Message) ) returns notfound ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "myusername", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "myusername" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) ?? Evaluating (outer.request:EAP-Message) -> TRUE expand: local.MY.realm -> local.MY.realm WARNING: No such configuration item local.MY.realm expand: %{config:local.MY.realm} -> ? Evaluating (Realm != "%{config:local.MY.realm}" ) -> TRUE ++? if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) -> TRUE ++- entering if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) {...} expand: Realm is '%{Realm}' on Inside -> Realm is 'NULL' on Inside +++[outer.reply] returns ok ++- if (( outer.request:EAP-Message) && Realm != "%{config:local.MY.realm}" ) returns ok [eap] EAP packet type response id 10 length 65 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 8 ++[files] returns ok ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) expand: %{request:User-Name} -> myusername ? Evaluating ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++? if ("%{request:User-Name}" =~ /(^host\/)([A-Za-z0-9]+[A-Za-z0-9-]*)(\.fsu\.edu)*$/i) -> FALSE ++- entering else else {...} [ldap-mds] performing user authorization for myusername [ldap-mds] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap-mds] expand: (&(uid=%{Stripped-User-Name:-%{User-Name}})(!(uid=lib-guest*))) -> (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] expand: dc=fsu,dc=edu -> dc=fsu,dc=edu [ldap-mds] ldap_get_conn: Checking Id: 0 [ldap-mds] ldap_get_conn: Got Id: 0 [ldap-mds] performing search in dc=fsu,dc=edu, with filter (&(uid=myusername)(!(uid=lib-guest*))) [ldap-mds] looking for check items in directory... [ldap-mds] ntPassword -> NT-Password == 0x4444333431333443313741333642433142444136383333324232323239443431 [ldap-mds] looking for reply items in directory... [ldap-mds] employeeStatus -> My-Local-employeeStatus = "Active" [ldap-mds] ldap_release_conn: Release Id: 0 +++[ldap-mds] returns ok ++- else else returns ok rlm_perl: RAD_REQUEST: User-Name = myusername rlm_perl: RAD_REQUEST: EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 rlm_perl: RAD_REQUEST: Realm = NULL rlm_perl: RAD_REQUEST: EAP-Type = MS-CHAP-V2 rlm_perl: RAD_REQUEST: Stripped-User-Name = myusername rlm_perl: RAD_REQUEST: State = 0xa7e44290a7ee58094f4ed0f3925b59a6 rlm_perl: RAD_REQUEST: FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Assign myusername to VLAN employee2b. rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair EAP-Message = 0x020a00411a020a003c3167b550c58cc6458a22569f9b3d545f240000000000000000b27cc6b8b53cd52cefd00805875b297ede8772635050987500616d61313263 rlm_perl: Added pair Realm = NULL rlm_perl: Added pair EAP-Type = MS-CHAP-V2 rlm_perl: Added pair Stripped-User-Name = myusername rlm_perl: Added pair State = 0xa7e44290a7ee58094f4ed0f3925b59a6 rlm_perl: Added pair FreeRADIUS-Proxied-To = 127.0.0.1 rlm_perl: Added pair User-Name = myusername rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Tunnel-Medium-Type = IEEE-802 rlm_perl: Added pair Tunnel-Type = VLAN rlm_perl: Added pair My-Local-employeeStatus = Active rlm_perl: Added pair Tunnel-Private-Group-Id = employee2b rlm_perl: Added pair NT-Password = 0x4444333431333443313741333642433142444136383333324232323239443431 rlm_perl: Added pair Ldap-UserDn = uid=myusername,dc=users,dc=fsu,dc=edu rlm_perl: Added pair Auth-Type = EAP ++[perl_dot1x] returns updated expand: %{Realm} -> NULL ++- entering switch %{Realm} {...} +++- switch %{Realm} returns updated ++- group authorize returns updated ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap_ad] Found NT-Password [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] Client is using MS-CHAPv2 for myusername, we need NT-Password [mschap_ad] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap_ad] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=myusername [mschap_ad] No NT-Domain was found in the User-Name. [mschap_ad] expand: %{mschap:NT-Domain} -> [mschap_ad] ... expanding second conditional [mschap_ad] expand: --domain=%{%{mschap:NT-Domain}:-FSU} -> --domain=FSU [mschap_ad] Creating challenge hash with username: myusername [mschap_ad] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=c8b28e6460a5a132 [mschap_ad] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=b27cc6b8b53cd52cefd00805875b297ede87726350509875 Exec output: Logon failure (0xc000006d) Exec plaintext: Logon failure (0xc000006d) [mschap_ad] Exec: program returned: 1 [mschap_ad] External script failed. [mschap_ad] FAILED: MS-CHAP2-Response is incorrect ++[mschap_ad] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect (mschap_ad: External script says Logon failure (0xc000006d)): [myusername] (from client aruba233 port 0 via TLS tunnel) Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/virtual.dot1x_1814_inner_tunnel +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> myusername attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated } # server virtual.dot1x_1814_inner_tunnel [peap] Got tunneled reply code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE ++[eap] returns handled } # server virtual.dot1x_1814 Sending Access-Challenge of id 185 to 192.168.255.233 port 32846 Reply-Message = "Realm is 'NULL' on Inside" EAP-Message = 0x010b002b19001703010020e64116a3874fb2f1731c248a0424a0ea316a859f4831ed7585f3ac3fe11ed5e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcbac7161c2a7687448dbbe7553b6baed Finished request 91531. Going to the next request ====================end of radiusd -X =======================================

2 1

Any One-Time password system.
by Sergii Bieliaievskyi 16 May '13

16 May '13

Hello. I am new here. And my first message concerns One-Time password authentication. I have a problem with installing rlm_smsotp + http://wiki.freeradius.org/modules/Rlm_smsotp. I am always getting an error "/var/run/smsotp_socket No such file or directory". I am sure that smsotp_socket exists and has appropiate permission (i even tryed to run freeradius with root privileges). After some researches i conclude that the problem is in rlm_smsotp module. I cann`t find any other couse of the problem. Breaf information about my system and soft versions. FreeBSD 9.1 FreeRADIUS 2.2.0 log============================================================ rad_recv: Access-Request packet from host 172.16.17.0 port 1645, id=79, length=64 Framed-Protocol = PPP User-Name = "test_user" User-Password = "test_pass" Service-Type = Framed-User NAS-IP-Address = 172.16.17.0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: %{Packet-Src-IP-Address} -> 172.16.17.0 [auth_log] expand: /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d -> /var/log/radacct/172.16.17.0/auth-detail-20130513 [auth_log] /var/log/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d expands to /var/log/radacct/172.16.17.0/auth-detail-20130513 [auth_log] expand: %t -> Mon May 13 16:51:36 2013 ++[auth_log] returns ok ++[smsotp] returns ok [suffix] No '@' in User-Name = "test_user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [sql] expand: %{User-Name} -> test_user [sql] sql_set_user escaped user --> 'test_user' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test_user' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test_user' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'test_user' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'Everyone' ORDER BY id [sql] User found in group Everyone [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'Everyone' ORDER BY id rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_checkval: Could not find item named Calling-Station-Id in request rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop Found Auth-Type = smsotp # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group smsotp {...} [pap] login attempt with password "test_pass" [pap] Using clear text password "test_pass" [pap] User authenticated successfully ++[pap] returns ok rlm_smsotp: smsotp_connect: connect(/var/run/smsotp_socket): No such file or directory ++[smsotp] returns fail Failed to authenticate the user. Login incorrect: [test_user/test_pass] (from client DMcore port 0) Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test_user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 79 to 172.16.17.0 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 79 with timestamp +11 Ready to process requests. Can anybody advise me simple way of implementation OTP with freeradius2 and daloradius as a frontend? Or maybe there is a solution for rlm_smsotp/ Thank you. -- ------------------------------ PRIVILEGED AND CONFIDENTIAL COMMUNICATION This e-mail transmission, and any documents, files or previous e-mail messages attached to it, may contain confidential information that is legally privileged. If you are not the intended recipient or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is strictly prohibited. If you have received this transmission in error, please: (1) immediately notify me by reply e-mail, or by collect telephone call; and (2) destroy the original transmission and its attachments without reading or saving in any manner.

10 31