September 2013 - Freeradius-Users - lists.freeradius.org

LDAP password in log files
by Matthew Ceroni 30 Sep '13

30 Sep '13

Is there any way to prevent FreeRadius from showing the password in logs (debug logs) when authentication is done via LDAP? Current I see : rad_recv: Access-Request packet from host 192.168.100.2 port 31011, id=13, length=129 User-Name = "username" User-Password = "XXXXXX" NAS-IP-Address = 192.168.100.2 NAS-Port = 268 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=192.168.21.145" Calling-Station-Id = "ip:source-ip=192.168.21.145" Plus it will show it in other spots as well (accounting section, etc). Thanks

3 2

Access Request from HA rejected
by Suryalakshmi Annadurai 30 Sep '13

30 Sep '13

Hi all, I am using FreeRadius 2.1.12 for WIMAX authentication. My initial authentication between ASN-GW and AAA is successful. Keys are generated and received in Access-Accept. But when HA sends Access-Request to AAA, the Request is rejected.The SPI values are all correct. All the AVP values are valid (because I checked with a workaround and it was successful). There looks like a problem in the authorize section when username is checked for in the 'Users' file. Can you please tell me if I am missing something in the configuration? I have added the inner identity in the 'users' file. Clients are defined in the 'clients.conf'. Below is a portion from log file. rad_recv: Access-Request packet from host 172.16.10.10 port 52511, id=1, length=165 User-Name = "01-01-01-03-01-01(a)abc.com" NAS-IP-Address = 172.16.10.10 NAS-Identifier = "HA1" Message-Authenticator = 0x930277dfe340d323eb58e3ecf7588f30 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = No-Accounting WiMAX-hHA-IP-MIP4 = 172.16.10.10 WiMAX-MN-hHA-MIP4-SPI = 1185754294 WiMAX-HA-RK-SPI = 123123 Thu Jan 1 05:53:35 1970 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Jan 1 05:53:35 1970 : Info: +- entering group authorize {...} Thu Jan 1 05:53:35 1970 : Info: ++[preprocess] returns ok Thu Jan 1 05:53:35 1970 : Info: ++[chap] returns noop Thu Jan 1 05:53:35 1970 : Info: ++[mschap] returns noop Thu Jan 1 05:53:35 1970 : Info: [suffix] Looking up realm "abc.com" for User-Name = "01-01-01-03-01-01(a)abc.com" Thu Jan 1 05:53:35 1970 : Info: [suffix] Found realm "abc.com" Thu Jan 1 05:53:35 1970 : Info: [suffix] Adding Stripped-User-Name = "01-01-01-03-01-01" Thu Jan 1 05:53:35 1970 : Info: [suffix] Adding Realm = "abc.com" Thu Jan 1 05:53:35 1970 : Info: [suffix] Authentication realm is LOCAL. Thu Jan 1 05:53:35 1970 : Info: ++[suffix] returns ok Thu Jan 1 05:53:35 1970 : Info: [eap] No EAP-Message, not doing EAP Thu Jan 1 05:53:35 1970 : Info: ++[eap] returns noop Thu Jan 1 05:53:35 1970 : Info: ++[files] returns noop Thu Jan 1 05:53:35 1970 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Thu Jan 1 05:53:35 1970 : Info: Failed to authenticate the user. Thu Jan 1 05:53:35 1970 : Info: Using Post-Auth-Type Thu Jan 1 05:53:35 1970 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Jan 1 05:53:35 1970 : Info: +- entering group REJECT {...} Thu Jan 1 05:53:35 1970 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 01-01-01-03-01-01(a)abc.com Thu Jan 1 05:53:35 1970 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jan 1 05:53:35 1970 : Info: ++[attr_filter.access_reject] returns updated Thu Jan 1 05:53:35 1970 : Info: Delaying reject of request 5 for 1 seconds Thu Jan 1 05:53:35 1970 : Debug: Going to the next request Thu Jan 1 05:53:35 1970 : Debug: Waking up in 0.9 seconds. Thu Jan 1 05:53:36 1970 : Info: Sending delayed reject for request 5 Sending Access-Reject of id 1 to 172.16.10.10 port 52511 -Thanks

3 2

Post a question on freeradius
by Suryalakshmi Annadurai 30 Sep '13

30 Sep '13

Email id: <suryalakshmi.annadurai(a)carc.co.in<mailto:suryalakshmi.annadurai@carc.co.in>> Or ritu.glaces(a)gmail.com<mailto:ritu.glaces@gmail.com>

1 0

Comp128-1,2,3 support in EAP-SIM
by Arran Cudbard-Bell 29 Sep '13

29 Sep '13

Looking for someone to test some new code (in master branch). Someone [1] has claimed to of decompiled a SIM validation program to figure out the algorithms for Comp128-2 and Comp128-3. The reason why this is particularly useful, is because Comp128-1 is horribly broken, and versions 2 and 3 which are meant to be more secure were not released to the public domain. The only way you could properly (with a randomly generated challenge) authenticate SIMs using Comp128-2 and Comp128-3 was with a commercial AuC (Authentication centre) which cost $$$$$/$$$$$$. To try out the code, you need to know the Ki of a SIM. You can then set attributes: control:EAP-Sim-Ki to the 64bit Ki value and control:EAP-Sim-Algo-Version (to 1, 2 or 3). which rlm_eap_sim will then use in preference to the normal triplets. As part of these changes, the other SIM triplets will now be looked for in the control list, whereas they were previously looked for in the reply list. update control { EAP-Sim-RAND1 := &reply:EAP-Sim-RAND1 EAP-Sim-RAND2 := &reply:EAP-Sim-RAND2 EAP-Sim-RAND3 := &reply:EAP-Sim-RAND3 EAP-Sim-SRES1 := &reply:EAP-Sim-SRES1 EAP-Sim-SRES2 := &reply:EAP-Sim-SRES2 EAP-Sim-SRES3 := &reply:EAP-Sim-SRES3 EAP-Sim-Kc1 := &reply:EAP-Sim-Kc1 EAP-Sim-Kc2 := &reply:EAP-Sim-Kc2 EAP-Sim-Kc3 := &reply:EAP-Sim-Kc3 } Will fix up any existing configurations if you want to use the code from the master branch (which will become 3.1). If no one comes forward for testing, then i'll buy the hardware and do it myself, just if someone works at a telecoms provider, id imagine it'd be pretty easy to get hold of a test SIM, and Ki. Note: Comp128-4 (milenage) is still unknown (please contact one of the developers if you have access to it's specification), but just algorithms 1-3 are still useful. [1] http://www.hackingprojects.net/2013/04/secrets-of-sim.html Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

2 3

EAP-PEAP GTC vs MSCHAPv2
by Don 27 Sep '13

27 Sep '13

All, I have successfully configured freeRadius using EAP-PEAP with: 1. GTC to authenticate user against local password 2. MSCHAPv2 to authenticate user against Active Directory via ntlm_auth following instructions on this link: http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… I also understand from reading this link that EAP-GTC can be used (compatible) with ntlm_auth: http://deployingradius.com/documents/protocols/compatibility.html That said, if EAP-GTC can be used along with ntlm_auth how do I configure it to make that work? I tried to execute ntlm_auth passing --password=%{User-Password}, but that didn't work as User-Password is empty. It says in eap.conf that GTC challenges the user with text and the response from the user is taken to be the User-Password. Perhaps I am executing ntlm_auth too early before GTC Password challenge is sent out and received the response. My questions are: 1. How can I configure freeRadius so GTC will work with ntlm_auth? 2. Is it possible to send subsequent GTC challenge in addition to default Password challenge? If possible, how do I configure the subsequent GTC challenge? Thank you.

2 6

Freeradius - DeadLock
by Alisson 25 Sep '13

25 Sep '13

Hi, I have a lot of logs with deadlocks.... ed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: [sql] Couldn't update SQL accounting ALIVE record - Deadlock found when trying to get lock; try restarting transaction Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: Cannot store result Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction' Wed Sep 25 15:05:44 2013 : Error: rlm_sql_mysql: MySQL error 'Deadlock found when trying to get lock; try restarting transaction'

3 5

Re: empty preacct and accounting section
by Alan Buxey 25 Sep '13

25 Sep '13

As the msg says. Your preacct {} and accounting {} sections in your server are not configured to do anything. Add active modules to them eg a database call and things will be different. alan

3 2

empty preacct and accounting section
by WorkingMan 25 Sep '13

25 Sep '13

I have been seen this weird message for two days now. I setup PPTP and IPSec (ikev1) with freeradius + mysql. In both cases I see Access-Acccept and in Accounting-Request I see these two message: WARNING: Empty preacct section. Using default return values. WARNING: Empty accounting section. Using default return values. I have no clue where it's wrong. PPTP can connect but IPSec connection would just keep sending Accounting-Request and never connects (it looks like connection depends on this step). The obvious consequence of this is that there is no accounting info in the DB (due to above warning). I did have success when configuring both separately before. When I combine both together it seems to always cause issue. I am sure it's a configuration issue but I just can't see where the problem is. I saw a post related to this before but it had no resolution other than telling OP that his configuration was wrong. One hint I have is the following log but I don't know what's the cause of it. ignoring request with ID <id>, already processing retransmitting RADIUS message ... #goes on for a while for IPSec, only twice for PPTP RADIUS is not responding Thanks

3 3

Help with sqlcounter for data transferred
by Fabrizio Fiore Donati 25 Sep '13

25 Sep '13

Hi, i'm configuring a server with a sql counter to check the total byte in a week for the users. But the server will reply a wrong count. Here's the counter: sqlcounter weeklybytecounter { counter-name = Weekly-Total-Max-Octets check-name = Max-Weekly-Octets reply-name = Mikrotik-Total-Limit sqlmod-inst = sql key = User-Name reset = weekly query = "SELECT (SUM(acctinputoctets)+SUM(acctoutputoctets)) FROM radacct WHERE UserName='%{%k}' AND UNIX_TIMESTAMP(acctstarttime) + acctsessiontime > '%b'" But the reply doesn't is the operation between (check-name value) - (query value) for example: rlm_sqlcounter: Authorized user fabrizio, check_item=3000000000, counter=38101894 I expect a reply of 3000000000 - 38101894 = 2961898106 but i receive different value also bigger..... Any idea ? -- Fabrizio Fiore Donati Mobile: +39 3289872420 E-mail: fabrizio.fioredonati(a)2bite.net 2bite s.r.l. Via Saragat snc 67100 L'Aquila (AQ) - Italy Tel.: +39 0862441583

1 0

Re: Active Directory authentication question
by Alan Buxey 25 Sep '13

25 Sep '13

Well. There's no such thing as EAP-TLS/MSCHAPv2 . So I'd guess that your Android device is just doing PEAPv0/EAP-MSCHAPv2 or such and your config allows it to. If you ran in full debug mode when connecting with the Android device you'd see exactly what's happening alan

1 0