August 2013 - Freeradius-Users - lists.freeradius.org

RE: returning a HEX String as a HEX String (bit string) instead ofthe decimal equivalent - FreeRADIUS 2.1.10
by Franks Andy (RLZ) IT Systems Engineer 07 Aug '13

07 Aug '13

Hi, Just agreeing with Arran really, we've got 5406 procurve switches, which I believe are similar in software terms to the 2910s and we do the unlang string Arran has presented here : update reply { Egress-VLANID += "%{expr:822083584 + %{Tagged-VID}}" } It works fine, although that may not help you too much. I had some 2910s around here somewhere, maybe I'll test one.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 07 August 2013 14:06 To: FreeRadius users mailing list Subject: Re: returning a HEX String as a HEX String (bit string) instead ofthe decimal equivalent - FreeRADIUS 2.1.10 On 7 Aug 2013, at 13:46, Alan DeKok <aland(a)deployingradius.com> wrote: > Arran Cudbard-Bell wrote: >> I'm honestly not entirely sure why the freeradius dictionary has the >> attribute as an unsigned int > > That's what the RFCs say. And the server doesn't really have a way > of packing arbitrary structures from attributes. It says the value is 4 octets. That's not quite saying it's an integer, was there a later one? I think it's arguably more useful as an integer though, for the reasons listed previously, and because you can use expr to build the bit string easily. For example: update reply { Egress-VLANID += "%{expr:822083584 + %{Tagged-VID}}" } With hex you need to manually pad the VID out to 12 bits. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Response-Packet-Type == Access-Challenge
by Dominique Frise 07 Aug '13

07 Aug '13

Hi, I have no luck with testing the Reponse-Packet-Type in the post-proxy section, after "rad_recv: Access-Challenge packet..." Something like : post-proxy { ... if (Response-Packet-Type == Access-Challenge) { ... } ... } What am I doing wrong? Dominique

5 13

I don't want to see clear text password in debug mode
by Roberto Carna 06 Aug '13

06 Aug '13

Dear, when I execute "freeradius -X" the daemon starts in debug mode. After that when a any user authenticate againts freradisu service, I can see in the screen something like this: [sql] expand: %{User-Name} -> roberto [sql] sql_set_user escaped user --> 'roberto' [sql] expand: %{User-Password} -> 123456 My password is encrypted with MD5 but it can be seen in the debug screen. Is there any way to disallow or masquerade the use's password in debug mode ??? Really thanks, Roberto

3 2

pptpd mschap auth fails
by Horatiu Nimigean 06 Aug '13

06 Aug '13

i have pptpd on a centos 6 box configured to use radius for auth. radius in turn checks credentials in ldap. the user in ldap has a samba extension and a configured password (i used ldap account manager to set it up) it also has a sambaNTPassword field and it's populated. rpm -q freeradius gives freeradius-2.1.12-4.el6_3.x86_64 the auth fails however when i try conencting from my windows8 client. i need to mention that i am sure i'm inputting correct passwords. this is the log from radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 49338, id=12, length=152 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser1" MS-CHAP-Challenge = 0x09235ac983790fedc6ccf93af69b67bf MS-CHAP2-Response = 0x5e004a81f91bcf75cd6452c64bd587a74f210000000000000000ff5eaa8a5df6639683423ed294074ceb705105d5d762932d Calling-Station-Id = "***.***.***.***" - edited out NAS-IP-Address = 127.0.0.1 NAS-Port = 0 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "testuser1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [ldap] performing user authorization for testuser1 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> testuser1 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser1) [ldap] expand: dc=my-domain,dc=com -> dc=my-domain,dc=com - edited out [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=my-domain,dc=com, with filter (uid=testuser1) [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}YQwkujoqTZAKF1Jl1e1JRxKKvDVVRGYv" [ldap] sambaNtPassword -> NT-Password == 0x3331443643464530443136414539333142373343353944374530433038394330 [ldap] looking for reply items in directory... [ldap] user testuser1 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Creating challenge hash with username: testuser1 [mschap] Told to do MS-CHAPv2 for testuser1 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 12 to 127.0.0.1 port 49338 MS-CHAP-Error = "^E=691 R=1 C=50685502b0ea6334450d0cd8077ac242 V=3 M=Re-enter (or reset) the password" Waking up in 4.9 seconds. Cleaning up request 4 ID 12 with timestamp +801 Ready to process requests.

3 4

SQL-Relay log - radacctdir - High Disk usage
by Alisson 06 Aug '13

06 Aug '13

Hi, I have a high disk utilization because the SQL-RELAY Log. I have this var: radacctdir whats the objetive to keep this log? can I disable it? radacctdir = /var/log/radius/radacct thank you

2 6

Re: Auth by NAS-Identifier using unlang
by Alan Buxey 06 Aug '13

06 Aug '13

I assume that's the freeradius2 package rather than freeradius as 1.x doesn't have unlang alan

2 1

Re: Diffrent authentication based by SSID
by Marcin 06 Aug '13

06 Aug '13

Thank You for reply Alan. I have working eap-tls for my staff and Dnia 5 sierpnia 2013 21:52 A.L.M.Buxey(a)lboro.ac.uk napisał(a): Hi, > In that situation i need to have active, both sql and ldap, authorization > modules in inner-tunnel. So users, who should identify by login/pass in > guest SSID, can be authenticate via inner-tunnel ldap module. I don't want > this. use whatever you want to use. what do you use now? all you need to do is distinguish between the two types of requests. and handle them how you want. will the guest SSID be 802.1X if so, inner-tunnel is available by default (as thats used for EAP) - if not, then you wont configure anything in there. each SSID will be presented to your RADIUS server with particular attributes...you will be able to use those to decide what to do.... eg if (%{whatever-attribute} =~ /sometext/ ) { ldap } else { sql } that sort of thing. and to be honest. you WILL need some decent data source for advancing your RADIUS into something scalable and usable...ie SQL or LDAP - sticking with a flat users file will end up with tears in most systems. alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Auth by NAS-Identifier using unlang
by Joseph Perrin 06 Aug '13

06 Aug '13

I was thinking this should be easy, but it's been two weeks and I give up... This is what I want to do: My NAS, (a WiFi AP), has two SSIDs: "staff" and "guests". I want mutual exclusivity. My /etc/raddb/users file contains something like this: abc Cleartext-Password:="xyz" Local-Group="staff" I've created an attribute in my /etc/raddb/dictionary file: ATTRIBUTE Local-Group 3000 string In my /etc/raddb/sites-enabled/default file, in the authorize section, I've got this: if ( Local-Group != NAS-Identifier ) { update reply { Reply-Message := "You may not connect to %{NAS-Identifier} AP.\r\n" } reject } My access request looks something like this: (edited for brevity.) User-Name = "abc" NAS-IP-Address = 192.168.8.253 NAS-Port = 0 NAS-Identifier = "guests" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "..." Called-Station-Id = "..." Service-Type = Login-User Framed-MTU = 1100 EAP-Message =... State = ... Aruba-Essid-Name = "test" Aruba-Location-Id = "wifi" Aruba-AP-Group = "Our WiFi" Running radiusd -X I get: : ++? if (Local-Group != NAS-Identifier ) (Attribute Local-Group was not found) ? Evaluating (Local-Group != NAS-Identifier ) -> FALSE ++? if (Local-Group != NAS-Identifier ) -> FALSE : And it's clear Local-Group is always empty. :-( Some things I've tried: -Moved code to post-auth section instead of authorize. -Different attributes instead of private dictionary. (i.e. Group-Name) -Running an executable, (actually works, but selinux appears to be a problem?) -Changing the test from != to == makes things work as expected, so if the comparison will actually work, I'm good. I'm clearly not understanding something.... -Joseph

4 8

Diffrent authentication based by SSID
by Marcin 05 Aug '13

05 Aug '13

Hi. I'm new with FreeRadius. I would like to use FreeRadius to authenticate two groups of users. One group for local staff based on eap-tls, second group to others based on OpenLdap authentication. My AP's have 2 SSID's broadcasting. One for the staff, second for others. Is there a possibility, to use one radius server to handle this scenario? Regards Marcin

3 4

Limit internet bandwidth but not local
by Fabrizio 05 Aug '13

05 Aug '13

2 1