April 2014 - Freeradius-Users - lists.freeradius.org

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

On 09/04/14 13:38, Phil Mayers wrote: > 1. Use MSCHAP which needs NTLMv1 http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… in the picture here, is the NTLM traffic from the FreeRADIUS server to the Active Directory server encrypted? if not, can it be? > 2. Use TTLS/PAP, and check passwords via Kerberos/LDAP bind. Is this way recommended? the part about using PAP scares me. (Clear-text password in local configuration file (PAP)) - http://wiki.freeradius.org/glossary/Authentication

3 3

NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

Thanks for your guys work on the FreeRADIUS project. It works really well and was easy to setup and understand. I have a FreeRADIUS version 3.0.2 server that is used to with a Ubiquiti UAP-PRO access point using WPA2-Enterprise to authenticate Active Directory using PEAP. Everything works great and it authenticates users correctly. But for PCI compliance, they require that we not use NTLMv1, they require us to use NTLMv2. Is there any way to get FreeRADIUS to work with NTLMv2 (or a more secure protocol for PCI compliance's sake)? I have found the post below that basically says it isn't possible. Maybe you can use a flag to tell the Active Directory Domain Controller that the traffic is NTLMv2...but that sounded pretty sketchy to me. Does anyone else have any ideas? Thanks for your help! http://freeradius.1045715.n5.nabble.com/definitive-info-on-authenticating-t…

6 8

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

We will primarily be authenticating Windows 7 machines (and a handful of WIndows 8 machines). Other than that, there may be some iPhones, iPads and Android phones that will connected to this wireless AP. I was just wondering if there was a way to bypass having to use ntlm and use something more secure. I don't mind using certificates as long as it will bypass having to use ntlm. >From my understanding, using EAP-TLS, I can achieve not having to use ntlm, right?

2 2

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

Is there any other ways to authenticate against Active Directory with FreeRADIUS? is it possible to authenticate using Kerberos instead of ntlm or ms-chap. Maybe EAP-TLS.

3 2

OpenSSL build options
by Alex Sharaz 09 Apr '14

09 Apr '14

Hi Ok just downloaded fr 3.0.3 from git and OpenSSL 1.0.1g source Ran ./config threads shared To build OpenSSL Pointed fr at /usr/local/.... for includes and lib details At make time get error saying version info not avail for built openssl shared library . This is on Ubuntu 10.4 VM Any other options I should be using when building OpenSSL Rgds A Sent from my iPhone

3 5

Re: Freeradius-Users Digest, Vol 108, Issue 39
by Rui Ribeiro 09 Apr '14

09 Apr '14

Hi Rado, Dont waste your time fighting with 2.1.12. Believe me, I tried. Better to compile a version, at least 2.2.4, into rpm or deb and install it. (Alan, using 2.2.5, has the 2.2.4 already the ssl bug fixed?) 2.1.12 has too many bugs, slowish and crashes several times a day in some setups. Be warned. Regards Message: 4 > Date: Tue, 08 Apr 2014 16:25:04 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius + OpenLDAP server > Message-ID: <53445B20.30808(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Rado Matisko wrote: > > Im trying to get freeradius v2.1.12 to work with my LDAP server in > > school with peap. > > Read http://deployingradius.com/ It gives detailed instructions on > configuring EAP. > > > radtest is working, but connecting my android phone via Access Point > > with SSID eduroam1 to freeradius and to LDAP server - now so much > > radtest working doesn't mean anything. EAP is different. > > > Its just sending Acess-Challenge and then > > Sending Access-Reject of id 0 to 192.168.1.1 port 3072 > > If you were running a recent version of the server, you would get > pointed to this web page: > > http://wiki.freeradius.org/guide/Certificate%20Compatibility > > Alan DeKok. > > >

2 1

linelog and internal variables
by Eugene Grosbein 09 Apr '14

09 Apr '14

Hi! Where can I get a list of the freeradius core variables supported by the linelog module similar to %{User-Name} ? Specifically, I need a variable name for the freeradius internal request id that is written as 14280311 in the following example in freeradius log: > Discarding duplicate request from client dhcp port 67 - ID: 1381353109 due to unfinished request 14280311 Eugene Grosbein

2 4

freeradius 0.8.1 db migration to 2.x or 3.x
by Stacy Trippe 08 Apr '14

08 Apr '14

Is there a script to migrate a mysql database under 1.x (0.8.1) to a freeradius 2.x mysql database schema? Thanks, Stacy

2 1

OpenSSL Security issues
by Alan DeKok 08 Apr '14

08 Apr '14

This is a bad one: http://heartbleed.com/ ... The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. ... * OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable * OpenSSL 1.0.1g is NOT vulnerable * OpenSSL 0.9.8 branch is NOT vulnerable Everyone using TLS methods with EAP are likely vulnerable. Anyone using RadSec is likely vulnerable. Please check which version of OpenSSL you are using. Alan DeKok.

9 28

FreeRadius + OpenLDAP server
by Rado Matisko 08 Apr '14

08 Apr '14

Im trying to get freeradius v2.1.12 to work with my LDAP server in school with peap. radtest is working, but connecting my android phone via Access Point with SSID eduroam1 to freeradius and to LDAP server - now so much *radtest works : * root@notebook:/home/uniza-sk# radtest skuska skuska localhost 0 testing123 Sending Access-Request of id 228 to 127.0.0.1 port 1812 User-Name = "skuska" User-Password = "skuska" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=228, length=20 *debug : * rad_recv: Access-Request packet from host 127.0.0.1 port 58878, id=228, length=76 User-Name = "skuska" User-Password = "skuska" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x2a5dcc7deb1dbac6d6abbb04e9b7f311 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20140408 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20140408 [auth_log] expand: %t -> Tue Apr 8 13:35:45 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "skuska", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for skuska [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> skuska [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=skuska) [ldap] expand: dc=fri,dc=uniza,dc=sk -> dc=fri,dc=uniza,dc=sk [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=fri,dc=uniza,dc=sk, with filter (uid=skuska) [ldap] Added User-Password = {SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3 in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3" [ldap] looking for reply items in directory... [ldap] user skuska authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "skuska" [pap] Using SSHA encryption. [pap] Normalizing SSHA1-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Login OK: [skuska] (from client localhost port 0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/reply-detail-20140408 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/reply-detail-20140408 [reply_log] expand: %t -> Tue Apr 8 13:35:45 2014 ++[reply_log] returns ok ++[exec] returns noop Sending Access-Accept of id 228 to 127.0.0.1 port 58878 *but if i connect from android phone via Access point :* rad_recv: Access-Request packet from host 192.168.1.1 port 3072, id=0, length=138 Cleaning up request 12 ID 0 with timestamp +37 User-Name = "skuska" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00904c910003" Calling-Station-Id = "1cb094111188" NAS-Identifier = "00904c910003" NAS-Port = 8 Framed-MTU = 1400 State = 0xfd4902fefe4d1bbe3a2596e3bf6ac7bb NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xc52506a949478fe4d20b63da335ebdee server eduroam1 { # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam1 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.1.1/auth-detail-20140408 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.1.1/auth-detail-20140408 [auth_log] expand: %t -> Tue Apr 8 13:37:40 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "skuska", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [ldap] performing user authorization for skuska [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> skuska [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=skuska) [ldap] expand: dc=fri,dc=uniza,dc=sk -> dc=fri,dc=uniza,dc=sk [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=fri,dc=uniza,dc=sk, with filter (uid=skuska) [ldap] Added User-Password = {SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3 in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3" [ldap] looking for reply items in directory... [ldap] user skuska authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/eduroam1 +- entering group EAP {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled } # server eduroam1 Sending Access-Challenge of id 0 to 192.168.1.1 port 3072 EAP-Message = 0x0105002b190017030100206fb4433047881387cf9d3a1297cdfacfa5fa56da9e3cac8319000142f92d35cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd4902fef94c1bbe3a2596e3bf6ac7bb Finished request 13. Going to the next request Waking up in 4.9 seconds. Its just sending Acess-Challenge and then Sending Access-Reject of id 0 to 192.168.1.1 port 3072

2 1