January 2015 - Freeradius-Users - lists.freeradius.org

Re: CHAP authentication fails when radtest communicates with freeradius 3.0.4 server through radsecproxy 1.6.2
by Linus Nordberg 16 Jan '15

16 Jan '15

Alan DeKok <aland(a)deployingradius.com> wrote Wed, 22 Oct 2014 10:43:04 -0400: | When radsecproxy sends a CHAP-Password, it should check for the | existence of a CHAP-Challenge attribute. If that attribute doesn't | exist, it should create a CHAP-Challenge attribute, and copy the | Authenticator field from the input packet into the attribute. This has been fixed in upcoming radsecproxy-1.6.6. Thank you Alan for the analysis and for making me aware of the issue. Thank you anoop for testing radsecproxy.

1 0

post-proxy and detecting dead upstream realms
by Phil Mayers 15 Jan '15

15 Jan '15

I'd like to do something like this: pre-proxy { update control { Tmp-Integer-0 := "%{some_scoring_thing:%{Realm}}" } if (Tmp-Integer-0 > 10) { reject } } post-proxy { Post-Proxy-Type Timeout { some_scoring_thing } } The idea is that I have an upstream proxy (eduroam) with potentially hundreds of realms behind it. Some realms just don't respond, and when that happens above a certain threshold, I'd like to locally blacklist the realm and avoid sending them to the upstream proxy for some time period. I'm not willing to maintain a manual blacklist. The question: what method can I use to run a module/expansion when a proxy request isn't replied to. "Post-Proxy-Type Fail" doesn't seem to do it (in fact, I can't make it trigger at all in my tests). Looking at the source this might be impossible?

5 6

TLS error
by marcos 15 Jan '15

15 Jan '15

Hi In other threat I commented about problems connecting and I discovered now this error TLS Alert read:fatal:unknown CA TLS_accept: failed in SSLv3 read client certificate A rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca SSL: SSL_read failed inside of TLS (-1), TLS session fails. TLS receive handshake failed during operation Im changing COMODO certificate, but I don't know where checks to find this CA. Suggestions? Thanks! -- For private content :-) Public key 0x0C05942A895BD10E FIngerprint 45B9 EC0B 58D5 B17C 8C37 95C3 0C05 942A 895B D10E

1 0

Re: Freeradius + Cisco WLC + Authorisation
by Sander Eerdekens 14 Jan '15

14 Jan '15

Hello, > > What settings to I need to include in /etc/raddb/users to allow the > > correct Authorisation level? > > ... > > we looked at using RADIUS but found that cisco still have more bias towards TACACS+ > so we use that for multi-grained access control to the WCS system (different tasks > available for different people on the web interface...not just a 'all admin' switch) We actually use radius for this. The Cisco-AVPairs we are using are: Cisco-AVPair += "Wireless-WCS:virtual-domain0=root", Cisco-AVPair += "Wireless-WCS:role0=Admin", Cisco-AVPair += "Wireless-WCS:task0=Users and Groups", Cisco-AVPair += "Wireless-WCS:task1=Audit Trails", Cisco-AVPair += "Wireless-WCS:task2=TACACS+ Servers", Cisco-AVPair += "Wireless-WCS:task3=RADIUS Servers", Cisco-AVPair += "Wireless-WCS:task4=Logging", Cisco-AVPair += "Wireless-WCS:task5=License Center", Cisco-AVPair += "Wireless-WCS:task6=Scheduled Tasks and Data Collection", Cisco-AVPair += "Wireless-WCS:task7=User Preferences", Cisco-AVPair += "Wireless-WCS:task8=System Settings", Cisco-AVPair += "Wireless-WCS:task9=View Alerts and Events", Cisco-AVPair += "Wireless-WCS:task10=Email Notification", Cisco-AVPair += "Wireless-WCS:task11=Delete and Clear Alerts", Cisco-AVPair += "Wireless-WCS:task12=Pick and Unpick Alerts", Cisco-AVPair += "Wireless-WCS:task13=Configure Controllers", Cisco-AVPair += "Wireless-WCS:task14=Configure Templates", Cisco-AVPair += "Wireless-WCS:task15=Configure Config Groups", Cisco-AVPair += "Wireless-WCS:task16=Configure Access Points", Cisco-AVPair += "Wireless-WCS:task17=Configure Access Point Templates", Cisco-AVPair += "Wireless-WCS:task18=Configure Choke Points", Cisco-AVPair += "Wireless-WCS:task19=Monitor Controllers", Cisco-AVPair += "Wireless-WCS:task20=Monitor Access Points", Cisco-AVPair += "Wireless-WCS:task21=Monitor Clients", Cisco-AVPair += "Wireless-WCS:task22=Monitor Tags", Cisco-AVPair += "Wireless-WCS:task23=Monitor Security", Cisco-AVPair += "Wireless-WCS:task24=Monitor Chokepoints", Cisco-AVPair += "Wireless-WCS:task25=Mesh Reports", Cisco-AVPair += "Wireless-WCS:task26=Client Reports", Cisco-AVPair += "Wireless-WCS:task27=Performance Reports", Cisco-AVPair += "Wireless-WCS:task28=Security Reports", Cisco-AVPair += "Wireless-WCS:task29=Location Server Management", Cisco-AVPair += "Wireless-WCS:task30=View Location Notifications", Cisco-AVPair += "Wireless-WCS:task31=Maps Read Only", Cisco-AVPair += "Wireless-WCS:task32=Maps Read Write", Cisco-AVPair += "Wireless-WCS:task33=Client Location", Cisco-AVPair += "Wireless-WCS:task34=Rogue Location", Cisco-AVPair += "Wireless-WCS:task35=Planning Mode", Cisco-AVPair += "Wireless-WCS:task36=Ack and Unack Alerts", Cisco-AVPair += "Wireless-WCS:task37=Migration Templates", Cisco-AVPair += "Wireless-WCS:task38=Configure Spectrum Experts", Cisco-AVPair += "Wireless-WCS:task39=Monitor Spectrum Experts", Cisco-AVPair += "Wireless-WCS:task40=Auto Provisioning", Cisco-AVPair += "Wireless-WCS:task41=Voice Audit Report", Cisco-AVPair += "Wireless-WCS:task42=Virtual Domain Management", Cisco-AVPair += "Wireless-WCS:task43=Scheduled Configuration Tasks", Cisco-AVPair += "Wireless-WCS:task44=Configure WiFi TDOA Receivers", Cisco-AVPair += "Wireless-WCS:task45=Configure ACS View Servers", Cisco-AVPair += "Wireless-WCS:task46=Monitor WiFi TDOA Receivers", Cisco-AVPair += "Wireless-WCS:task47=RRM Dashboard", Cisco-AVPair += "Wireless-WCS:task48=Config Audit Dashboard", Cisco-AVPair += "Wireless-WCS:task49=High Availability Configuration", Cisco-AVPair += "Wireless-WCS:task50=Health Monitor Details", Cisco-AVPair += "Wireless-WCS:task51=Configure WIPS Profiles", Cisco-AVPair += "Wireless-WCS:task52=Global SSID Groups", Cisco-AVPair += "Wireless-WCS:task53=Configure Lightweight Access Point Templates", Cisco-AVPair += "Wireless-WCS:task54=Configure Autonomous Access Point Templates", Cisco-AVPair += "Wireless-WCS:task55=Configure Ethernet Switch Ports", Cisco-AVPair += "Wireless-WCS:task56=Configure Ethernet Switches", Cisco-AVPair += "Wireless-WCS:task57=Device Reports", Cisco-AVPair += "Wireless-WCS:task58=Network Summary Reports", Cisco-AVPair += "Wireless-WCS:task59=Compliance Reports", Cisco-AVPair += "Wireless-WCS:task60=Report Launch Pad", Cisco-AVPair += "Wireless-WCS:task61=Run Reports List", Cisco-AVPair += "Wireless-WCS:task62=Saved Reports List", Cisco-AVPair += "Wireless-WCS:task63=Report Run History", Cisco-AVPair += "Wireless-WCS:task64=Ack and Unack Security Index Issues", Cisco-AVPair += "Wireless-WCS:task65=View Security Index Issues", Cisco-AVPair += "Wireless-WCS:task66=Monitor Media Streams", Cisco-AVPair += "Wireless-WCS:task67=Monitor Interferers", Cisco-AVPair += "Wireless-WCS:task68=Voice Diagnostics", Cisco-AVPair += "Wireless-WCS:task69=CleanAir Reports", Cisco-AVPair += "Wireless-WCS:task70=ContextAware Reports", Cisco-AVPair += "Wireless-WCS:task71=Automated Feedback", Cisco-AVPair += "Wireless-WCS:task72=TAC Case Attachment Tool", The role can be Admin or System Monitoring. Not sure where this came from as a collogue of mine wrote this config. Kind regards Sander Eerdekens

2 1

Authentication Problem
by Robert Graham 14 Jan '15

14 Jan '15

Im just about at the end of my rope... I have been searching and reading and reading, but cannot get this to work. I have a external ms sql database that has three columns only. member_id, HashedPassword, and Salt. I am trying to authenticate against this database. 1st question is: Do I have to use the schema that is inside freeradius, and if I do not, how do I get FR to auth without using all the tables that are preinstalled in the schema? Unfortunately I am not a sql database guy, im a network guy, and writing db is not my forte.. This is what I have but yet I know it is incorrect. I dont want to use any groups, it is strictly for someone to logon to our vpn and wireless connections. The passwords are stored in SHA-512 with Salt and unicoding. Is it even possible or am I wasting my time? I am running 3.0.6 of FR. These are the only columns in the database. recreating the database isnt likely to happen, having almost 19,000 rows in the table. authorize_check_query = "\ SELECT member_id, HashedPassword, Salt \ FROM ${dbo.vw_Main_table} \ WHERE UserName = '%{SQL-User-Name}'" Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

4 4

Accounting response with attributes
by Chandan Kumar 14 Jan '15

14 Jan '15

Hello All, I am using FreeRADIUS Version 3.0.4 on Linux (CentOS 6). I have a question regarding how can I force radius server to add all attribute information into accounting response message. The accounting section of my site-available/default if as below. accounting { detail unix -sql exec } I have customized the pam_radius_auth.so module to send Accounting request messages to include more attributes such as Acct-Terminate-Cause,Acct-Link-Count,Acc-authentic etc and expecting response from server with attribute [with reason code] at the end of the accounting [at the STOP message]. However, in all cases I am only getting response message with code,identifier,length=20 and response-authenticator. I am wondering is there any configuration parameter that I missing or it is not supported at all in this version of FreeRADIUS as RFC does not make it mandatory. Quoting RFC "A RADIUS Accounting-Response is not required to have any attributes in it." Thanks Chandan

3 10

EAP-TLS - TLS 1.0 Alert [length 0002], fatal internal_error
by PENZ Robert 14 Jan '15

14 Jan '15

Hi! We're running openssl-1.0.1e-30.el6_6.4.x86_64 and freeradius-2.1.12-6.el6.x86_64 on a RHEL6. We're using EAP-TLS with Windows clients and IP phones with no problems. Now we want to add MFD systems from Canon also as clients and we get following openssl error, while running free radius in debug mode. The error happens already on the second packet the radius server gets from the MFD. First Packet: Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=212, length=143 User-Name = "jwf68365.mfp.tirol.local" EAP-Message = 0x0212001d016a776636383336352e6d66702e7469726f6c2e6c6f63616c NAS-IP-Address = 10.15.132.2 Service-Type = Login-User Calling-Station-Id = "F4-81-39-C8-00-CE" NAS-Port-Id = "1:3" NAS-Port = 1003 NAS-Port-Type = Ethernet Message-Authenticator = 0x46be9f4cbce0fb5c68c67280b8ff5784 .... Tue Jan 13 16:19:31 2015 : Info: [eap] EAP Identity Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls Tue Jan 13 16:19:31 2015 : Info: [tls] Requiring client certificate Tue Jan 13 16:19:31 2015 : Info: [tls] Initiate Tue Jan 13 16:19:31 2015 : Info: [tls] Start returned 1 .... Sending Access-Challenge of id 212 to 10.15.132.2 port 39460 EAP-Message = 0x011300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xea9fd73aea8cdaa07914c31bfc979134 Second Packet: Tue Jan 13 16:19:31 2015 : Debug: Going to the next request Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=213, length=239 User-Name = "jwf68365.mfp.tirol.local" EAP-Message = 0x0213006b0d8000000061160301005c01000058030154b537821306fa9c57603eb40ab2f22a9b3cdcc496fa91589413aa835503a4d400001e002f0035000400050009000a00030008c013c014c009c00a00330039001601000011000a00080006001700180019000b000100 NAS-IP-Address = 10.15.132.2 Service-Type = Login-User Calling-Station-Id = "F4-81-39-C8-00-CE" NAS-Port-Id = "1:3" NAS-Port = 1003 NAS-Port-Type = Ethernet State = 0xea9fd73aea8cdaa07914c31bfc979134 Message-Authenticator = 0x2482cae69f6e75122c8a7fd7bbbf72a2 ....... Tue Jan 13 16:19:31 2015 : Info: [eap] EAP packet type response id 19 length 107 Tue Jan 13 16:19:31 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Jan 13 16:19:31 2015 : Info: +++[eap] returns updated Tue Jan 13 16:19:31 2015 : Info: ++- else else returns updated Tue Jan 13 16:19:31 2015 : Info: Found Auth-Type = EAP Tue Jan 13 16:19:31 2015 : Info: # Executing group from file /etc/raddb//sites-enabled/default Tue Jan 13 16:19:31 2015 : Info: +- entering group EAP {...} Tue Jan 13 16:19:31 2015 : Info: [eap] Request found, released from the list Tue Jan 13 16:19:31 2015 : Info: [eap] EAP/tls Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls Tue Jan 13 16:19:31 2015 : Info: [tls] Authenticate Tue Jan 13 16:19:31 2015 : Info: [tls] processing EAP-TLS Tue Jan 13 16:19:31 2015 : Debug: TLS Length 97 Tue Jan 13 16:19:31 2015 : Info: [tls] Length Included Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_verify returned 11 Tue Jan 13 16:19:31 2015 : Info: [tls] (other): before/accept initialization Tue Jan 13 16:19:31 2015 : Info: [tls] TLS_accept: before/accept initialization Tue Jan 13 16:19:31 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 005c], ClientHello Tue Jan 13 16:19:31 2015 : Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal internal_error Tue Jan 13 16:19:31 2015 : Error: TLS Alert write:fatal:internal error Tue Jan 13 16:19:31 2015 : Error: TLS_accept: error in SSLv3 read client hello C Tue Jan 13 16:19:31 2015 : Error: rlm_eap: SSL error error:1408A0E3:SSL routines:SSL3_GET_CLIENT_HELLO:parse tlsext Tue Jan 13 16:19:31 2015 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Jan 13 16:19:31 2015 : Debug: TLS receive handshake failed during operation Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_process returned 4 Tue Jan 13 16:19:31 2015 : Info: [eap] Handler failed in EAP/tls Tue Jan 13 16:19:31 2015 : Info: [eap] Failed in EAP select .... Sending Access-Reject of id 213 to 10.15.132.2 port 39460 EAP-Message = 0x04130004 Message-Authenticator = 0x00000000000000000000000000000000 Regards, Robert Penz

3 3

Freeradius + Cisco WLC + Authorisation
by mail＠moult.com.au 14 Jan '15

14 Jan '15

Hi there, Hoping someone might be able to help, with what should be a simple problem.. I have a Cisco vWLC that is set up to autheticate against a freeradius server.. At this stage I am just wanting to use it to authenticate & authorise administrative users, so that they can use the GUI.. The users can succesfully log on, however they are not getting the correct authorisation.. What settings to I need to include in /etc/raddb/users to allow the correct Authorisation level? I am guessing it is some sort of "cisco-avpair = ???" command.. just not sure which one.. Any help is greatly appreciated!! Thanks!

2 1

Help with Cisco-AVPairs
by Arran Cudbard-Bell 13 Jan '15

13 Jan '15

Changes in master mean that we can now represent them in the Cisco vendor dictionary, and convert all Cisco-AVPair attributes to internal, correctly typed ones. This makes proper comparisons, and access much easier. So if anyone has a complete or semi-complete list of all the Cisco-AVPair attributes please send them over so the Cisco dictionary can be updated. Next step is to modify foreach to work correctly, providing references to actual attributes, instead of stringifying them. This will allow automatic re-encoding of attributes for proxying and replies. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 4

3.0.6 rlm_eap_gtc: Unknown Auth-Type perl
by Nick Rogers 13 Jan '15

13 Jan '15

Hello, In previous freeradius 2.2.x versions, I've been able to change the Auth-Type to perl within the gtc module. For example... eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no gtc { challenge = "Password: " auth_type = perl } This allowed rlm_eap_gtc to pass the password to rlm_perl via the User-Password attribute. Now when trying to upgrade to 3.0.x, it seems that an auth_type of perl is no longer allowed. I am wondering if this is a bug or intentional change? Should I be changing Auth-Type within eap_gtc via some other means? For example... gtc { challenge = "Password: " auth_type = perl update control { Auth-Type := Perl } } Thank you. -Nick

2 3