November 2015 - Freeradius-Users - lists.freeradius.org

Logging the home server in post_proxy logs
by Chris Taylor (chtaylo2) 01 Dec '15

01 Dec '15

Hi, I have have 4 home servers configured which radius request are proxied to using type = fail-over and would like to log which home server handle a request at any given time. In the Post proxy logs: detail post_proxy_log { detailfile = ${radacctdir}/%d/post-proxy-detail-%H:00 header = "%{NAS-IP-Address} - %t" detailperm = 0600 } Is there a way to log which server handled the proxy in this log or even the main radiusd.conf log? Thanks

3 3

How to configure Radius to provide Linux user permissions and rights
by Michael Martinez 30 Nov '15

30 Nov '15

A radius 2.2.9 server authenticates Linux users via the pam module. Is it possible for Radius to not only very password, but also provide the users with their Linux permissions - their group memberships and other such things? If so, how to configure this? Other traditional ways of doing this, such as ldap or NIS, work by interacting with PAM or nsswitch, and can be cached in nscd. But I'm not seeing a way to integrate radius into this. Different sources online mention that radius can pass group membership back to the client but they don't explain how to configure it. Any help appreciated, Michael -- ---

2 2

RE: UPN and mschap issues
by Franks Andy (IT Technical Architecture Manager) 29 Nov '15

29 Nov '15

Thanks all for your contributions on this, REALLY appreciate this list! I'll keep coming here, until the management replace it all with clearpass or something equally non-fun, looming sadly.. Andy ________________________________________ From: Freeradius-Users [freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org] on behalf of A.L.M.Buxey(a)lboro.ac.uk [A.L.M.Buxey(a)lboro.ac.uk] Sent: 28 November 2015 12:12 To: FreeRadius users mailing list Subject: Re: UPN and mschap issues Hi, dont use User-Name - you cant play with that..instead either work on the stripped-user-name or create your own attribute locally and use that on the ntlm_auth line what you need to do is some regex to turn the current User-Name, or stripped-user-name that has already dealt with the realm part giving you just the stripped name.... into the format you need for it to match the saMAccountname perhaps some people should have been made aware of all this in some form of change management process before the AD was messed around with? FreeRADIUS will let you do what you want using regex and recombining the results of the regex into the format you want..... but external systems like Office365...well, they will probably be a big headache if you migrate to them alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

UPN and mschap issues
by Franks Andy (IT Technical Architecture Manager) 28 Nov '15

28 Nov '15

Hi all, I'm a bit stuck again. FR 3.1.0. For various reasons, we've had to start changing our AD samaccountname and upn values to be slightly different. We can't get around this. When they were the same, the various canonicalization routines stripped off the domain and the result was the same, username == samaccountname == stripped upn. This worked fine with ntlm and mschap based auth, even if the user was logged into the machine with their UPN (the default for PEAP-EAP-MSCHAP is that it uses the logged in credentials with Windows). Now, since the UPN format is "firstname.surname@domain<mailto:firstname.surname@domain>" and samaccountname is "surnameinitial" we have issues. The LDAP lookup is fine with an "OR" operator on the filter so PEAP-EAP-TLS and EAP-TLS work, and I can do a (nasty) UPN -> Samaccountname lookup via an LDAP xlat when matching the UPN format so NTLM auth is fine for PAP, as long as we tell it to use the new user name (I update Stripped-User-Name and tell ntlm_auth to use that, not sure if that's a horrible thing to do). Anything inside the EAP tunnel doesn't like you playing with the username though, so we can't do UPN based MSCHAPv2 lookup - UPN format doesn't work, as far as I can tell, with the ntlm_auth program and I can't update the username. I can force the mschap auth process to use an alternative user name, but the hash then doesn't work, and I can't work out how to update the mschap:user-name. All this is nasty. Has anyone ever done anything better? I can't really find many people being successful with ntlm_auth and upn format, I can't do ldap - mschapv2 auth afaik, so maybe I just state that we can't do upn -> mschapv2 and stick to certs? Maybe there's something really obviously simple that I'm missing.. Sorry for the disjointed ramble. Thanks Andy

4 3

RE: UPN and mschap issues
by Franks Andy (IT Technical Architecture Manager) 28 Nov '15

28 Nov '15

Thanks Phil, Suspected as much, I've checked the previous Samba mailing lists but can't see much, I'll give it a go anyway, posted here as it may have been a common issue, or someone may have jumped up and said "highly experimental feature X/ *libwbclient?* fixes that".. Thanks again Andy > Anything inside the EAP tunnel doesn't like you playing with the > username though, so we can't do UPN based MSCHAPv2 lookup - UPN format > doesn't work, as far as I can tell, with the ntlm_auth program and I > can't update the username. I can force the mschap auth process to use > an alternative user name, but the hash then doesn't work, and I can't > work out how to update the mschap:user-name. All this is Altering the in-packet username or the username on the ntlm_auth command line is futile; as you've indicated, the client does the crypto on the basis of the UPN, and that's what you need to pass to ntlm_auth so that it can be in turn passed to the DC and mixed into the chal/resp verification/calculation correctly. I was under the impression that ntlm_auth should work with a UPN where LHS != samaccountname, but it's really a Samba question - I'd suggest asking on the Samba list. I don't have any easy way to test locally I'm afraid. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

3.0.10: crash seemingly related to EAP-pwd
by Stefan Winter 27 Nov '15

27 Nov '15

Hi, I finally was able to catch thecrash which I see very intermittently with 3.0.10. Today, it happened in a sequence every some 30 seconds; apparently a continued authentication attempt by one user always triggered the fatal code path. After switching runtime perms to root/root, gdb actually worked and provided a backtrace. I'm attaching the gdb session log. I see EAP sub-module failed, and EAP-pwd, so I think it's got to be in that area. I also configured the system to dump a core. As soon as I find it on the filesystem, I can send it off-list to a developer who cares about it :-) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 2, avenue de l'Université L-4365 Esch-sur-Alzette Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

3 3

checking errcode in the sql_snprint_error function of rlm_sql_oracle.c
by Kyuyoung Kim 27 Nov '15

27 Nov '15

Hello, First, I want to say that I don't know well OCI programming. I'm trying to make interface between FreeRADIUS and Oracle. I found this code in the rlm_sql_oracle module. This part seems a bit strange. If there are errors, errcode variable is larger than 0. but, the function returns -1. I think if errcode is large than 0, function should return 0 not -1. Can you tell me what is correct? static int sql_snprint_error(char *out, size_t outlen, rlm_sql_handle_t *handle, UNUSED rlm_sql_config_t *config) { sb4 errcode = 0; rlm_sql_oracle_conn_t *conn = handle->conn; rad_assert(conn); out[0] = ''; OCIErrorGet((dvoid *) conn->error, 1, (OraText *) NULL, &errcode, (OraText *) out, outlen, OCI_HTYPE_ERROR); if (!errcode) return -1; return 0; }

2 1

doubts about the best way to collect and handle the Status-*
by Jorge Pereira 26 Nov '15

26 Nov '15

Hi, has someone used the Status packets to generate graphics? if 'yes', what has used to collect and plot the graphs? e.g: $ cat ../pack-stats.txt Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = All Response-Packet-Type = Access-Accept $ $ radclient -x localhost:18121 status adminsecret -f ../pack-stats.txt Sent Status-Server Id 203 from 0.0.0.0:52687 to 127.0.0.1:18121 length 50 Message-Authenticator = 0x00 FreeRADIUS-Statistics-Type = All Response-Packet-Type = Access-Accept Received Access-Accept Id 203 from 127.0.0.1:18121 to 0.0.0.0:0 length 536 FreeRADIUS-Total-Access-Requests = 10 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Access-Requests = 0 FreeRADIUS-Total-Proxy-Access-Accepts = 0 FreeRADIUS-Total-Proxy-Access-Rejects = 0 FreeRADIUS-Total-Proxy-Access-Challenges = 0 FreeRADIUS-Total-Proxy-Auth-Responses = 0 FreeRADIUS-Total-Proxy-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Auth-Unknown-Types = 0 FreeRADIUS-Total-Proxy-Accounting-Requests = 0 FreeRADIUS-Total-Proxy-Accounting-Responses = 0 FreeRADIUS-Total-Proxy-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Proxy-Acct-Unknown-Types = 0 FreeRADIUS-Stats-Start-Time = "Nov 26 2015 18:16:07 BRST" FreeRADIUS-Stats-HUP-Time = "Nov 26 2015 18:16:07 BRST" FreeRADIUS-Queue-Len-Internal = 0 FreeRADIUS-Queue-Len-Proxy = 0 FreeRADIUS-Queue-Len-Auth = 0 FreeRADIUS-Queue-Len-Acct = 0 FreeRADIUS-Queue-Len-Detail = 0 FreeRADIUS-Queue-PPS-In = 0 FreeRADIUS-Queue-PPS-Out = 0 $ -- Jorge Pereira

1 0

Failed binding to authentication address
by Federico Olivieri 26 Nov '15

26 Nov '15

Hi All, I know that this topics has been discussed many times but all solution/answers found on the mailing list didn't work for me (sure that is my fault!) When I stop the service and I run freeradius -xxx the message is: Thu Nov 26 15:14:25 2015 : Info: ... adding new socket proxy address * port 47256 Thu Nov 26 15:14:25 2015 : Debug: Listening on authentication address * port 1812 Thu Nov 26 15:14:25 2015 : Debug: Listening on accounting address * port 1813 Thu Nov 26 15:14:25 2015 : Debug: Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Thu Nov 26 15:14:25 2015 : Debug: Listening on proxy address * port 1814 Thu Nov 26 15:14:25 2015 : Info: Ready to process requests. then, I start radius and when I try to do radtest I get this error: root@raspberrypi:~# /etc/init.d/freeradius start [ ok ] Starting FreeRADIUS daemon: freeradius. root@raspberrypi:~# radtest "John Doe" hello 127.0.0.1 0 testing123 Sending Access-Request of id 126 to 127.0.0.1 port 1812 User-Name = "John Doe" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=126, length=20 Looking into a second debug I can see: Thu Nov 26 15:15:06 2015 : Debug: radiusd: #### Opening IP addresses and Ports #### Thu Nov 26 15:15:06 2015 : Debug: listen { Thu Nov 26 15:15:06 2015 : Debug: type = "auth" Thu Nov 26 15:15:06 2015 : Debug: ipaddr = * Thu Nov 26 15:15:06 2015 : Debug: port = 0 Thu Nov 26 15:15:06 2015 : Error: Failed binding to authentication address * port 1812: Address already in use Thu Nov 26 15:15:06 2015 : Error: /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 What I'm doing wrong? For me is normal that the port is 1812 is busy because freeradius is using it! Thanks!

4 12

Freeradius and LDAP/AD integration
by Antoine JOUBERT 26 Nov '15

26 Nov '15

Hi, I've been reading through Freeradius' documentation, various howtos and this mailing-list archives for the past few days, and I'm still not sure if the architecture I'm trying to set up can be achieved, so I figured I'd ask here. My company currently uses a Windows Server running Active Directory for user account management. We would like to setup 802.1x for both wired and WLAN access on Windows, Linux, Mac, iOS and Android devices (using PEAP/MS-CHAPv2). We have three offices where VLANs are configured. Many of our users frequently move between offices. A user who uses VLAN 10 when he is in the office A would use VLAN 20 when he is in the office B and VLAN 30 when he is in the office C. Hence, unless I've missed something, I don't believe we can fully centralize our RADIUS configuration. I'm thinking of setting up a Freeradius server in each office that communicates with our Active Directory to check if the user's credentials are valid, and then checks a local MySQL database for the "Tunnel-Type", "Tunnel-Medium-Type" and "Tunnel-Private-Group-Id" parameters for that user. Can this be achieved ? We'll also need to configure Mac Authentication Bypass for devices that do not handle 802.1x (VOIP phones, printers, etc.). Can those be configured locally in the same MySQL database as well ? Thanks, Antoine

3 2