February 2014 - Freeradius-Users - lists.freeradius.org

SQL statements for CUI with sqlite
by Stefan Winter 04 Feb '14

04 Feb '14

Hello, in 3.0.x, the queries.conf for the cuisql module / post-auth / dialect sqlite state: INSERT IGNORE INTO ${..cui_table} \ This breaks (gracefully) for me, and I'm told it's a syntax error. This page here: https://www.sqlite.org/lang_insert.html says it should be INSERT OR IGNORE Might be worth fixing for 3.0.2. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 3

Issue for mailing list
by 亚坤李 04 Feb '14

04 Feb '14

This mailing list help me so much for my project, but now, I have finished all of them. There are too many email everyday that I can not handle, so I want to quit this mailing list. Could anyone tell me how to quit this mailing list, thank you so much.

4 3

Problem configuring freeradius with mschap / winbind
by Brian C. Huffman 03 Feb '14

03 Feb '14

All, I'm trying to configure freeradius to work with Samba winbind. Winbind seems to be working, but I'm having issues when I try to integrate freeradius. I've got the following versions installed: [root@auth01 raddb]# more /etc/redhat-release CentOS release 6.5 (Final) [root@auth01 raddb]# rpm -qa |grep winbind samba-winbind-clients-3.6.9-167.el6_5.x86_64 samba-winbind-3.6.9-167.el6_5.x86_64 [root@auth01 raddb]# rpm -qa |grep freeradius freeradius-2.1.12-4.el6_3.x86_64 freeradius-utils-2.1.12-4.el6_3.x86_64 wbinfo -u works. This works as well: [root@auth01 raddb]# ntlm_auth --request-nt-key --domain=ETI --username=bhuffman --password=<pass_removed> NT_STATUS_OK: Success (0x0) I've followed this guide for configuring freeradius: http://deployingradius.com/documents/configuration/active_directory.html Running the test with basic ntlm_auth also works. But when I try to use mschap, it fails: rad_recv: Access-Request packet from host 127.0.0.1 port 36958, id=54, length=134 User-Name = "bhuffman" NAS-IP-Address = 192.168.12.13 NAS-Port = 0 Message-Authenticator = 0x5218e5194bf4c321ed41c29cd6d10690 MS-CHAP-Challenge = 0x1491f6269d04d59a MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "bhuffman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{User-Name} -> bhuffman [mschap] expand: %{%{User-Name}:-None} -> bhuffman [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=bhuffman [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] ... expanding second conditional [mschap] expand: --domain=%{%{mschap:NT-Domain}:-ETI} -> --domain=ETI [mschap] mschap1: 14 [mschap] expand: %{mschap:Challenge} -> 1491f6269d04d59a [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=1491f6269d04d59a [mschap] expand: %{mschap:NT-Response} -> bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bhuffman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 54 to 127.0.0.1 port 36958 MS-CHAP-Error = "\000E=691 R=1" Can anyone help me to troubleshoot this? Thanks, Brian

2 2

Re: blockage in my Freeradius configuration [First SOLVED]self signed certificate in certificate chain [NOK]
by Yves Deuscher 02 Feb '14

02 Feb '14

I change rule and this is solved My file users _______________________________________ DEFAULT Huntgroup-Name == "cisco" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes DEFAULT Group == "Central" DEFAULT Group == "DEP25", Client-Shortname == "25" DEFAULT Group == "DEP29", Client-Shortname == "29" DEFAULT Group == "DEP57", Client-Shortname == "57" DEFAULT Auth-Type := Reject ______________________________________ For my second problem ,It isn't resolve. debug : Error: TLS Alert read:fatal:unknown CA Sun Feb 2 22:03:14 2014 : Error: TLS_accept: failed in SSLv3 read client certificate A Sun Feb 2 22:03:14 2014 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Sun Feb 2 22:03:14 2014 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. and trace user: ./eapol_test -c eapol-config -a xen-squeeze-freeradius -p 1812 -s testing123 -r1 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=4 method=21 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=509) - Flags 0x80 SSL: TLS Message Length: 2527 SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server hello A TLS: Certificate verification failed, error 19 (self signed certificate in certificate chain) depth 1 for '/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=xen-squeeze-freeradius' CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=1 subject='/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress= admin(a)example.com/CN=xen-squeeze-freeradius' err='self signed certificate in certificate chain' SSL: (where=0x4008 ret=0x230) SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server certificate B OpenSSL: openssl_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed SSL: 7 bytes pending from ssl_out SSL: Failed - tls_out available to report error SSL: 7 bytes left to be sent out (of total 7 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE My ca.cnf ... [ req ] prompt = no distinguished_name = certificate_authority default_bits = 2048 input_password = whatever output_password = whatever x509_extensions = v3_ca [certificate_authority] countryName = FR stateOrProvinceName = Radius localityName = Somewhere organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "xen-squeeze-freeradius" [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always basicConstraints = CA:true ... My server.cnf ... [ req ] prompt = no distinguished_name = server default_bits = 2048 input_password = whatever output_password = whatever [server] countryName = FR stateOrProvinceName = Radius localityName = Somewhere organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "xen-squeeze-freeradius" err='self signed certificate in certificate chain' I followed the guide http://deployingradius.com/documents/configuration/certificates.html but Freeradius error is "self-signed certificate." How to remove this error? thank you!!!! 2014-01-31 Alan DeKok <aland(a)deployingradius.com>: > Yves Deuscher wrote: > > For DEP commissioned the first connection goes well > > > > > > Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop > > Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated > > Thu Jan 30 23:48:28 2014 : Info: [files] expand: > > %{Client-Shortname} -> DEP25 > > Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at > > line 208 > > Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok > > You'll have to look at the rest of the debug log to see what's going on. > > If the packets are being processed differently, it's because the > packets are different. You'll have to look at the packets to see what's > different. Then, re-write the rules to match both packets. > > > I miss something for the dynamic substitution takes place at each > > connection or I can not be the problem taken in the right direction have? > > Each packet is completely independent. FreeRADIUS doesn't change it's > behavior from one packet to the next. > > > More I try to configure a secure WPA / TTLS working with all key > > calculated installing Freeradius. by cons with mine I have a CA_unknown > > error do you have a clue? > > Follow the EAP guide on http://deployingradius.com/ . It *will* work. > > If you have unknown CA errors, it's because the certificate > configuration is wrong. Follow the guide. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Help Accounting packet forwarding
by battossai 02 Feb '14

02 Feb '14

hi, i'm just a newbie in freeradiu. can i get help about how to do a accounting packet forwarding. i need to setup netsweeper application, it says that this need accounting packet forwarding, and also about add avp at that accounting data. any tutorial can be shared ? thanks. Regards, Franky Yustanto

5 27

FreeRadius unauthorized access
by Mike Diggins 01 Feb '14

01 Feb '14

I'm running a FreeRadius server which authenticates to a Microsoft Windows 8 Active Directory via winbind and NTLM_AUTH. The service is used by a Cisco wireless network which uses WPA2 for user authentication (MS PEAP). My software versions are: Red Hat Enterprise Linux (v. 5 for 64-bit x86_64) freeradius2-2.1.12-4.el5_8 (RedHat) samba3x-winbind-3.5.10-0.110.el5_8 (RedHat) It came to my attention recently that some users may be gaining unauthorized access. An account was seen to be granted access (according to the FreeRadius log) even though the account does not exist within the AD, nor is it a local FreeRadius account (not that I can see anyway). What I see in my logs is: Jan 15 12:23:34 xxxxx radiusd[20330]: Login OK: [whoiswho] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx) Jan 18 08:07:58 xxxxx radiusd[22212]: Login OK: [hi] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx) The same accounts also appear on the wireless controller. To the best of my knowledge those accounts do not exist anywhere but somehow they are being authenticated. Blocking the account with an Auth-Type := Reject prevents it from authenticating. I've tested with the same account names using no password and various random passwords but I'm correctly denied access each time. I'm attempting to capture some more extensive logging during one of these logins but until I do, does anyone recognize a scenario where this might happen? -Mike

5 10