November 2015 - Freeradius-Users - lists.freeradius.org

3com user level no applied
by Alessandro Daudt 14 Nov '15

14 Nov '15

Hello I am setting the radius to authenticate switches 3com 4500 when I put User and Password logo perfectly however the level of User is not applied Sending Access-Accept id of 20 to xxxx port 5001 3Com-User-Access-Level = 3Com Administrator [cid:image002.png@01D0D386.33E023B0] ALESSANDRO DAUDT Engenheiro Eletricista CREA RS213418 Infraestrutura & Engenharia Rua Saldanha Marinho, 383 - Novo Hamburgo - RS alessandro(a)i360.net.br<mailto:alessandro@i360.net.br>| www.i360tecnologia.com.br Tel. +55 51 3065-2207 | Cel. +55 51 9865-2359 [cid:image003.png@01D11E36.073C13A0] alessandro.daudt

4 3

ENC: 3com user level no applied
by Alessandro Daudt 13 Nov '15

13 Nov '15

Hello I am setting the radius to authenticate switches 3com 4500 when I put User and Password logo perfectly however the level of User is not applied Sending Access-Accept id of 20 to xxxx port 5001 3Com-User-Access-Level = 3Com Administrator

1 0

rlm_sql_oracle: Oracle logon failed: 'unknown'
by Kyuyoung Kim 13 Nov '15

13 Nov '15

Hello, I have a issue to use FreeRADIUS with Oracle DB(rlm_sql_oracle). I can see errors on log files. I don't know what is problem. I tried to find how can I fix it. but, I couldn't why. How can I fix this issue? Help me, please!! Thank you. I'm using CentOS 7, FreeRADIUS is 3.0.10. Env Variables are NLS_LANG=.AL32UTF8 ORACLE_HOME=/usr/lib/oracle/11.2/client64 TNS_ADMIN=/usr/lib/oracle/11.2/client64/network/admin LD_LIBRARY_PATH=/usr/lib/oracle/11.2/client64/lib:/usr/local/lib64 This is log Fri Nov 13 16:04:58 2015 : Info: Found debugger attached Fri Nov 13 16:04:58 2015 : Info: rlm_sql (oracle): Driver rlm_sql_oracle (module rlm_sql_oracle) loaded and linked Fri Nov 13 16:04:58 2015 : Info: rlm_sql (oracle): Attempting to connect to database "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=xx.xx.xx.xx)(PORT=1521))(CONNECT_DATA=(SID=XXXXDB)))" Fri Nov 13 16:04:58 2015 : Info: rlm_sql (oracle): Opening additional connection (0), 1 of 128 pending slots used Fri Nov 13 16:04:58 2015 : Error: rlm_sql_oracle: Oracle logon failed: 'unknown' Fri Nov 13 16:04:58 2015 : Error: rlm_sql (oracle): Opening connection failed (0) Fri Nov 13 16:04:58 2015 : Error: /etc/raddb/mods-enabled/sql.oracle[20]: Instantiation failed for module "oracle"

2 1

rlm_passwd fails Stripped-User-Name check when in inner-tunnel mode (PEAP)
by Tim Chen 13 Nov '15

13 Nov '15

Hello friends, I am using Freeradius version 2.2.9. I doubt that module rlm_passwd have some problem handle Stripped-User-Name check when in inner-tunnel mode (PEAP). I tried to use a password file to store my user/pass data. And some config snippet is here: 1. modules/passwd passwd passwdf1 { filename = /home/radius/passwd1 format = "*User-Name:NT-Password:" 2. /home/radius/passwd1 john:************D463009BE761BB******: 3. both sites-enabled/default,inner-tunnel have passwdf1 in authorize { block 4. proxy.conf realm NULL { } realm eduroam.example.edu { auth_pool = my_auth_failover } realm DEFAULT { pool = upperlevel } Test results: 1. PAP with/without domain(realm) PASSED radtest john password radhost 1812 testing123 radtest john(a)eduroam.example.edu password radhost 1812 testing123 2. MSCHAP with/without domain(realm) PASSED radtest -t mschap john password radhost 1812 testing123 radtest -t mschap john(a)eduroam.example.edu password radhost 1812 testing123 3. EAP(PEAP) I use eapol_test to test identity="john" PASS identity="john(a)eduroam.example.edu" FAIL!! log from debug shows: [mschapv2] +group MS-CHAP { [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: john(a)eduroam.example.edu [mschap] Client is using MS-CHAPv2 for jsc(a)eduroam.ntu.edu.tw, we need NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect However, I did more tests: 1. if I put both john:************D463009BE761BB******: john@eduroam.example.edu:************D463009BE761BB******: in /home/radius/passwd1 PEAP with domain(realm) PASSED 2. if I change modules/passwd into passwd passwdf1 { filename = /home/radius/passwd1 format = "*Stripped-User-Name:NT-Password:" Then ALL authentication tests FAILED 3. if I put the user/pass info in users file john NT-Password := "************D463009BE761BB******" Then all the tests including PEAP with/without domain(realm) PASSED. I doubt if there is some problem in the rlm_passwd module? Either it didn't handle Stripped-User-Name well when been authenticated, or it didn't accept the "format = "*Stripped-User-Name:NT-Password:" syntax? Thanks in advance for your help. I have been used freeradius for more than 15 years since version 1.x. I do appreciate your effort to freeradius. Eric Chang

4 10

Freeradius crashes after "Module rlm_sqlippool became unblocked for request"
by Rod Elias 12 Nov '15

12 Nov '15

Hello everyone! Could someone please help me about the warning message "Module rlm_sqlippool became unblocked for request" ? When this error happens, my freeradius server 'crashes' and then I need to start it again. I'm using version 2.2.2 with MySQL support. All radius tables are using InnoDB as engine of MySQL. Why this happens and why freeradius stop working? In the meantime, thanks for your attention and participation!

2 1

Radius server requirements
by Ja Ja 12 Nov '15

12 Nov '15

Hi. I must install freeradius for about 100 users. I must use GUI daloradius so SQL and apache are required. How effective server I need have ? I think about something Energy-saving like intel atom DELL FX160 for example. It will be ok for me or I must look around for something more effective.

2 1

RE: Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Thanks Arran, I can certainly test it. Quite happy to do extended testing if you want me to also. Andy -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Arran Cudbard-Bell Sent: 12 November 2015 16:10 To: FreeRadius users mailing list Subject: Re: Attributes not being copied to inner tunnel > On 12 Nov 2015, at 09:49, Franks Andy (IT Technical Architecture Manager) <Andy.Franks(a)sath.nhs.uk> wrote: > > Thanks Alan! I'll try any updating to see what happens. > Most of the Siemens attributes are copied, just not these two, it's odd. That's really weird... It's just a string. In the new attribute tree it looks correct... VENDOR "Siemens" vendor: 0 (0), num: 10e9 (4329), type: vendor, flags: ATTRIBUTE "Siemens-URL-Redirection" vendor: 10e9 (4329), num: 1 (1), type: string, flags: is_pointer ATTRIBUTE "Siemens-AP-Name" vendor: 10e9 (4329), num: 2 (2), type: string, flags: is_pointer ATTRIBUTE "Siemens-AP-Serial" vendor: 10e9 (4329), num: 3 (3), type: string, flags: is_pointer The dictionary code is about to get a large update to allow deeply nested TLVs, so that may fix it. Probably push the changes later today. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

1 0

chap authenticatin fail
by Yukou Katori 12 Nov '15

12 Nov '15

Hi, Sorry for my basic question though, I'm setting up chap-md5 authentication FreeRadius3 with traffic tester (Spirent). But authentication failed. [topo] tester ----- (pppoe) --- authenticator --- (radius) --- FR3 [issue] <-pppoe, lcp -> OK <------------------- challenge -------------------> response ------------------> radius rewuest <------ radius reject!!! I tried local test with "radtest -x -4 -t chap user1@yk testing! 127.0.0.1 1812 testing123", and it worked (authenticaton success). On the tester, I configured "user@yk" as ID and "testing!" as PW and "chap md5 authenticaton" as method. Then I saw chap failure as follows (summary by wireshark): Sending challenge : Challenge (NAME='R3', VALUE=0x457e20c349a6c2bd) Response challenge : Response (NAME='user1@yk', VALUE=0x9e913a644c3c15e78d31a540f5d8e90b) Sending Radius-Req : Access-Request(1) (id=58, l=77) Responding Radius-Rej : Access-Reject(3) (id=58, l=20) >From debug: Fri Nov 13 00:08:28 2015 : Debug: (0) Found Auth-Type = CHAP Fri Nov 13 00:08:28 2015 : Debug: (0) # Executing group from file /usr/local/etc/raddb/sites-enabled/default Fri Nov 13 00:08:28 2015 : Debug: (0) Auth-Type CHAP { Fri Nov 13 00:08:28 2015 : Debug: (0) modsingle[authenticate]: calling chap (rlm_chap) for request 0 Fri Nov 13 00:08:28 2015 : ERROR: (0) chap: &control:Cleartext-Password is required for authentication Fri Nov 13 00:08:28 2015 : Debug: (0) modsingle[authenticate]: returned from chap (rlm_chap) for request 0 Fri Nov 13 00:08:28 2015 : Debug: (0) [chap] = fail Fri Nov 13 00:08:28 2015 : Debug: (0) } # Auth-Type CHAP = fail Fri Nov 13 00:08:28 2015 : Debug: (0) Failed to authenticate the user Fri Nov 13 00:08:28 2015 : Auth: (0) Login incorrect (chap: &control:Cleartext-Password is required for authentication): [user1@yk] (from client R3 port 0) Of course, I set "Cleartext-Password" Home$raddb/users too. I tried lots of combination on it, so I omit the configuraton of it. What does "ERROR: (0) chap: &control:Cleartext-Password is required for authentication" mean first of all... I made sure to configure "Cleartext-Password". I just thought if each PW between pppoe client and server is identical, that works successfully as chap authentication. Is there any parameter I should care about when configuring chap authentication? Regards, yk

2 1

RE: Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Thanks Alan! I'll try any updating to see what happens. Most of the Siemens attributes are copied, just not these two, it's odd. > I'd try the v3.1.x head. But the code copies everything... it doesn't care which attributes are being copied. So it's a little weird that only Siemens attributes aren't copied. > I'll take a look later today and see if I can reproduce it. > Alan DeKok.

2 1

Attributes not being copied to inner tunnel
by Franks Andy (IT Technical Architecture Manager) 12 Nov '15

12 Nov '15

Hi all, This is probably obvious but I can't understand it! FR 3.1 from git, although not updated for a little while.. When the inner tunnel is called in PEAP/mschapv2, some of the attrs from our request aren't making their way through. Extreme wireless (siemens), the Siemens-AP-Name and Siemens-AP-Serial attributes seem to be missing, unfortunately we use/record some of these otherwise it wouldn't be a problem. My pre-proxy section has the attr_filter.pre-proxy commented out.. PEAP module tunnel copy is enabled (see bottom) Sorry for the regular "help me!" posts, still learning! Thanks Andy Starting request: (10) Received Access-Request Id 187 from 192.168.116.10:52330 to 192.168.176.123:1812 length 421 (10) User-Name = 'SATH\\franksa' (10) NAS-IP-Address = 0.0.0.0 (10) NAS-Port = 106 (10) Framed-MTU = 1400 (10) Called-Station-Id = '20:b3:99:ea:a8:5a' (10) Acct-Session-Id = '5644626401a5' (10) Calling-Station-Id = '00:18:39:0e:77:a2' (10) NAS-Port-Type = Wireless-802.11 (10) NAS-Identifier = 'RSH_WiFi_2_VNS' (10) Service-Type = Framed-User (10) Siemens-AP-Serial = '14351087085D0000' (10) Siemens-AP-Name = 'RSH-AP1125' (10) Siemens-VNS-Name = 'RSH_WiFi_2_VNS' (10) Siemens-SSID = 'RSH_WiFi_2' (10) Siemens-BSS-MAC = '20:b3:99:ea:a8:5a' (10) Siemens-Policy-Name = 'No_Access' (10) Siemens-Topology-Name = 'VLAN200_AP_T' Proxy: (10) EAP-Message = 0x020900471a020900423151ad822a193537467947d21c25db073300000000000000001f4ec99cdb09ee5c7421b6264c4f5cc10e5c0c2db2c039bf00534154485c4652414e4b5341 (10) FreeRADIUS-Proxied-To = 127.0.0.1 (10) User-Name = 'SATH\\franksa' (10) State = 0xd86926bed9603cd4e2325db6a06e5230 (10) NAS-IP-Address = 0.0.0.0 (10) NAS-Port = 106 (10) Framed-MTU = 1400 (10) Called-Station-Id = '20:b3:99:ea:a8:5a' (10) Acct-Session-Id = '5644626401a5' (10) NAS-Port-Type = Wireless-802.11 (10) NAS-Identifier = 'RSH_WiFi_2_VNS' (10) Service-Type = Framed-User (10) Siemens-VNS-Name = 'RSH_WiFi_2_VNS' (10) Siemens-SSID = 'RSH_WiFi_2' (10) Siemens-BSS-MAC = '20:b3:99:ea:a8:5a' (10) Siemens-Policy-Name = 'No_Access' (10) Siemens-Topology-Name = 'VLAN200_AP_T' (10) Calling-Station-Id := '00-18-39-0e-77-a2' PEAP section of relevant EAP mod: peap { tls = tls-common default_eap_type = tls copy_request_to_tunnel = yes use_tunnelled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "inner-tunnel" # EAP-TLS-Require-Client-Cert = Yes # require_client_cert = yes }

3 2