June 2013 - Freeradius-Users - lists.freeradius.org

FreeRADIUS 3.0 : mschap module fails to execute ntlm_auth
by Bjarni Hardarson 08 Jun '13

08 Jun '13

Hi list, I just tried to upgrade FreeRADIUS to the latest version from git. My goal is to get the passchange feature working in the mschap module. I am unable to get ntlm_auth to work in mschap. debug output, --- Debug: (0) mschap : expand: '--nt-response=%{%{mschap:NT-Response}:-00}' -> '--nt-response=4dc04bcfba6029f88cf3131d47ca2587132782979dcb7dc7' Debug: (0) mschap : executing cmd /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} Debug: (0) mschap : [0] /usr/bin/ntlm_auth Debug: (0) mschap : [1] --request-nt-key Debug: (0) mschap : [2] --username=vpntest Debug: (0) mschap : [3] --challenge=2546448021444870 Debug: (0) mschap : [4] --nt-response=4dc04bcfba6029f88cf3131d47ca2587132782979dcb7dc7 Debug: (0) mschap : Program output is ERROR: (0) ERROR: mschap : Abnormal child exit: No such file or directory Debug: (0) mschap : External script failed. ERROR: (0) ERROR: mschap : External script says: Debug: (0) mschap : FAILED: MS-CHAP2-Response is incorrect Debug: (0) modsingle[authenticate]: returned from mschap (rlm_mschap) for request 0 Debug: (0) [mschap] = reject Debug: (0) Failed to authenticate the user. Debug: (0) Using Post-Auth-Type Reject --- If i try a second time i get this, --- Debug: (1) mschap : expand: '--nt-response=%{%{mschap:NT-Response}:-00}' -> '--nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd' Debug: (1) mschap : executing cmd /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} Debug: (1) mschap : [0] /usr/bin/ntlm_auth Debug: (1) mschap : [1] --request-nt-key Debug: (1) mschap : [2] --username=vpntest Debug: (1) mschap : [3] --challenge=d9a8b4d1c188ae1b Debug: (1) mschap : [4] --nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd Debug: (1) mschap : Program output is ERROR: (1) ERROR: mschap : Abnormal child exit: No child processes Debug: (1) mschap : External script failed. ERROR: (1) ERROR: mschap : External script says: Debug: (1) mschap : FAILED: MS-CHAP2-Response is incorrect Debug: (1) modsingle[authenticate]: returned from mschap (rlm_mschap) for request 1 Debug: (1) [mschap] = reject Debug: (1) Failed to authenticate the user. Debug: (1) Using Post-Auth-Type Reject --- I am sure that the ntlm_auth file is at /usr/bin/ntlm_auth and if i run it manually with the expanded attributes i get the NT_KEY. root@freelab:/#/usr/bin/ntlm_auth --request-nt-key --username=vpntest --challenge=d9a8b4d1c188ae1b --nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd NT_KEY: 2066656E05C22F3A995AD9ECFED913D6 Any ideas? Kind Regards Bjarni

4 4

stripped-username for eap sim
by martin robertino 08 Jun '13

08 Jun '13

Hi all, i'm using freeradius 2.1.9 for eap sim testing i have simtriplets.dat with format : imsi.RAND,SRES,Kc and i'm having message probleme: rlm_sim_files : insufficient number of challenges for imsi 151008xxxxxxxxx(a)wlan.mnc008.mcc310.3gppnetwork.org [sim_files] : returnnot found i read that we should strip that full username : 151008xxxxxxxxx(a)wlan.mnc008.mcc310.3gppnetwork.org into strip username: 131008xxxxxxxxx and realm wlan.mnc008.mcc310.3gppnetwork.org am i correct? so how do i configure that strip username for authorizing into rlm_sim_files and to simtriplets.dat? thanx best regards, martin

3 2

Problem after upgrade from 2.1 to 2.2
by Nadir Aliyev 08 Jun '13

08 Jun '13

Dear All i have problem after upgrade from 2.1 to 2.2! I use postgresql module. After upgrade to 2.2 i get sql errors of accounting updates! I checked logs and i see that Acct-Input-Gigawords Acct-Output-Gigawords values are NULL. [sql] expand: UPDATE radacct SET AcctStopTime = ('%S'::timestamp - '%{Acct-Delay-Time:-0}'::interval), AcctSessionTime = NULLIF('%{Acct-Session-Time}', '')::bigint, AcctInputOctets = (('%{Acct-Input-Gigawords:-0}'::bigint << 32) + '%{Acct-Input-Octets:-0}'::bigint), AcctOutputOctets = (('%{Acct-Output-Gigawords:-0}'::bigint << 32) + '%{Acct-Output-Octets:-0}'::bigint), AcctTerminateCause = '%{Acct-Terminate-Cause}', AcctStopDelay = 0, FramedIPAddress = NULLIF('%{Framed-IP-Address}', '')::inet, ConnectInfo_stop = '%{Connect-Info}' WHERE AcctSessionId = '%{Acct-Session-Id}' AND UserName = '%{SQL-User-Name}' AND NASIPAddress = '%{NAS-IP-Address}' AND AcctStopTime IS NULL -> UPDATE radacct SET AcctStopTime = ('2013-06-09 02:01:40'::timestamp - '73'::interval), AcctSessionTime = NULLIF('5819', '')::bigint, AcctInputOctets = ((''::bigint << 32) + '5359232'::bigint), AcctOutputOctets = ((''::bigint << 32) + '39447747'::bigint), I cant get values for Acct-Input-Gigawords and Acct-Output-Gigawords

2 2

Problem with Freeradius2 - Start and Stop connections isn't inserted in BD
by Rodrigo Yoshioka 08 Jun '13

08 Jun '13

Hi, I updated my freeradius to version 2, but now, It isn't inserting in database start and stop connections. Free radius is updating radacct table when it update sessions. So when client connect I'll just have this information in radacct when account update the download/upload data. Do you have any idea about what is happening? Thanks

2 1

Re: Free Radius not sending reject message when using "max_request_time"
by Alan DeKok 08 Jun '13

08 Jun '13

manjunath uthappa ponnachana wrote: > But my concern why free radius is not sending access-reject response. I answered your question. Did you bother to read my message? Fix your database. Nothing else will solve the problem. If your car is out of gas, pushing on the gas pedal won't work. Alan DeKok.

1 0

Re: Free Radius not sending reject message when using "max_request_time"
by manjunath uthappa ponnachana 08 Jun '13

08 Jun '13

Hi Alan, But my concern why free radius is not sending access-reject response. Thanks & Regards ManjunathFrom: Alan DeKok <aland(a)deployingradius.com>Sent: Fri, 07 Jun 2013 19:12:02 To: pu_manjunath(a)rediffmail.com, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>Subject: Re: Free Radius not sending reject message when using "max_request_time"manjunath uthappa ponnachana wrote:> I am trying to test this and trying to execute SQL query from free> radius which will take more time than max_request_time. But free radius> is not sending reject message instead it comes out with an error "no> response from the server". That's how it works. The problem is that the call to SQL is blocking at the OS layer.  i.e.FreeRADIUS isn't running any more for that thread.  So it's pretty muchimpossible *forcibly* stop that SQL query. The solution to a slow database is to fix the database.  PokingFreeRADIUS won't work.  Any changes you make to FreeRADIUS will make theproblem worse. There is NO reason why an S! QL database takes more than .1s to returnfrom a query.  If it does, your database is horribly broken. Alan DeKok.

1 0

FreeRADIUS 3-0 : mschap problem.
by Bjarni Hardarson 07 Jun '13

07 Jun '13

Hi list, I just tried to upgrade FreeRADIUS to the latest version from git. My goal is to get the passchange feature working in the mschap module. I am unable to get ntlm_auth to work in mschap. debug output, --- Debug: (0) mschap : expand: '--nt-response=%{%{mschap:NT-Response}:-00}' -> '--nt-response=4dc04bcfba6029f88cf3131d47ca2587132782979dcb7dc7' Debug: (0) mschap : executing cmd /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} Debug: (0) mschap : [0] /usr/bin/ntlm_auth Debug: (0) mschap : [1] --request-nt-key Debug: (0) mschap : [2] --username=vpntest Debug: (0) mschap : [3] --challenge=2546448021444870 Debug: (0) mschap : [4] --nt-response=4dc04bcfba6029f88cf3131d47ca2587132782979dcb7dc7 Debug: (0) mschap : Program output is ERROR: (0) ERROR: mschap : Abnormal child exit: No such file or directory Debug: (0) mschap : External script failed. ERROR: (0) ERROR: mschap : External script says: Debug: (0) mschap : FAILED: MS-CHAP2-Response is incorrect Debug: (0) modsingle[authenticate]: returned from mschap (rlm_mschap) for request 0 Debug: (0) [mschap] = reject Debug: (0) Failed to authenticate the user. Debug: (0) Using Post-Auth-Type Reject --- If i try a second time i get this, --- Debug: (1) mschap : expand: '--nt-response=%{%{mschap:NT-Response}:-00}' -> '--nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd' Debug: (1) mschap : executing cmd /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00} Debug: (1) mschap : [0] /usr/bin/ntlm_auth Debug: (1) mschap : [1] --request-nt-key Debug: (1) mschap : [2] --username=vpntest Debug: (1) mschap : [3] --challenge=d9a8b4d1c188ae1b Debug: (1) mschap : [4] --nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd Debug: (1) mschap : Program output is ERROR: (1) ERROR: mschap : Abnormal child exit: No child processes Debug: (1) mschap : External script failed. ERROR: (1) ERROR: mschap : External script says: Debug: (1) mschap : FAILED: MS-CHAP2-Response is incorrect Debug: (1) modsingle[authenticate]: returned from mschap (rlm_mschap) for request 1 Debug: (1) [mschap] = reject Debug: (1) Failed to authenticate the user. Debug: (1) Using Post-Auth-Type Reject --- I am sure that the ntlm_auth file is at /usr/bin/ntlm_auth and if i run it manually with the expanded attributes i get the NT_KEY. root@freelab:/#/usr/bin/ntlm_auth --request-nt-key --username=vpntest --challenge=d9a8b4d1c188ae1b --nt-response=090bacad01a113dd74007ed5845d5b0c7c8017bac80821dd NT_KEY: 2066656E05C22F3A995AD9ECFED913D6 Any ideas? Kind Regards Bjarni

1 0

Free Radius not sending reject message when using "max_request_time"
by manjunath uthappa ponnachana 07 Jun '13

07 Jun '13

Hi, There is a parameter "max_request_time" defined in file radiusd.conf which indicates the maximum time free Radius takes to handle a request. Request which take more time than this will be killed and reject message is sent by Free radius. This problem is most often seen when using an SQL database. Possible range for this parameter is 5 to 120 (in secs) I am trying to test this and trying to execute SQL query from free radius which will take more time than max_request_time. But free radius is not sending reject message instead it comes out with an error "no response from the server". Could anybody please help? Is anything else to be configured in free radius to use this parameter. Thanks & Regards Manjunath

2 1

RE: module-failure-message in exec module
by Franks Andy (RLZ) IT Systems Engineer 07 Jun '13

07 Jun '13

Ok, so the other questions stand, but an update to say the problem is the variable is not coming back to the default VS from the inner tunnel which I didn't at first spot. I had this problem recently and couldn't work it out : how do we copy control attributes from the inner tunnel to the outer in PEAP or is it not possible..? Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 07 June 2013 13:15 To: FreeRadius users mailing list Subject: RE: module-failure-message in exec module Hi, Ok so I've played about and can get a decent failure reply from a script based solution. Moving on to those NAS clients that actually do PEAP/MSCHAP .. I would like to get a response when a failure occurs from them, but it seems that Failure-Response-Message from the mschap isn't filled out. I've done a test like : Authenticate { .. Auth-Type MS-CHAP { mschap if (ok) { # } else { if (Module-Failure-Message) { update reply { reply-message += "Failed NTLM auth" } reject } } But the section never gets parsed - it goes straight to Post_auth reject based on the mschap module itself returning code 1. So I put this in the post_auth reject section : if (Module-Failure-Message) { update reply { reply-message := "%{Module-Failure-Message}" } } But Module-Failure-Message is empty; ++? if (Module-Failure-Message) ? Evaluating (Module-Failure-Message) -> FALSE ++? if (Module-Failure-Message) -> FALSE Am I doing something wrong? I also wondered if I could do something like use the mschap module with a custom script, returning NT_KEY or a failure string, but then I've no way to return the failure string because I assume the mschap module doesn't let you populate variables based on the output like exec does - there's no way of specifying output or input pairs for example. I could ditch the mschap module completely, but then am not sure how I would get all the mschap variables into a script and translate the NT_KEY back. It seems a bit OTT just to get a failure response written to the linelog/sql. Any ideas? Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 06 June 2013 17:48 To: freeradius-users(a)lists.freeradius.org Subject: Re: module-failure-message in exec module On 06/06/13 16:48, Franks Andy (RLZ) IT Systems Engineer wrote: > Questions are - does the exec module return to the > Module-Failure-Message variable or another I can use, and why doesn't No, sorry. "mschap" does when it does the internal "exec", but the "exec" module does not. You might be able to emulate this by wrapping your script and echoing the VPs on stdout. > it process the subsection of the auth-type section on failure? > That's the default return codes - see doc/configurable_failover{,.rst} - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

RE: module-failure-message in exec module
by Franks Andy (RLZ) IT Systems Engineer 07 Jun '13

07 Jun '13

Hi, Ok so I've played about and can get a decent failure reply from a script based solution. Moving on to those NAS clients that actually do PEAP/MSCHAP .. I would like to get a response when a failure occurs from them, but it seems that Failure-Response-Message from the mschap isn't filled out. I've done a test like : Authenticate { .. Auth-Type MS-CHAP { mschap if (ok) { # } else { if (Module-Failure-Message) { update reply { reply-message += "Failed NTLM auth" } reject } } But the section never gets parsed - it goes straight to Post_auth reject based on the mschap module itself returning code 1. So I put this in the post_auth reject section : if (Module-Failure-Message) { update reply { reply-message := "%{Module-Failure-Message}" } } But Module-Failure-Message is empty; ++? if (Module-Failure-Message) ? Evaluating (Module-Failure-Message) -> FALSE ++? if (Module-Failure-Message) -> FALSE Am I doing something wrong? I also wondered if I could do something like use the mschap module with a custom script, returning NT_KEY or a failure string, but then I've no way to return the failure string because I assume the mschap module doesn't let you populate variables based on the output like exec does - there's no way of specifying output or input pairs for example. I could ditch the mschap module completely, but then am not sure how I would get all the mschap variables into a script and translate the NT_KEY back. It seems a bit OTT just to get a failure response written to the linelog/sql. Any ideas? Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 06 June 2013 17:48 To: freeradius-users(a)lists.freeradius.org Subject: Re: module-failure-message in exec module On 06/06/13 16:48, Franks Andy (RLZ) IT Systems Engineer wrote: > Questions are - does the exec module return to the > Module-Failure-Message variable or another I can use, and why doesn't No, sorry. "mschap" does when it does the internal "exec", but the "exec" module does not. You might be able to emulate this by wrapping your script and echoing the VPs on stdout. > it process the subsection of the auth-type section on failure? > That's the default return codes - see doc/configurable_failover{,.rst} - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1