September 2015 - Freeradius-Users - lists.freeradius.org

Re: Freeradius with LNS & Provider BRAS
by Neil Morris 14 Sep '15

14 Sep '15

Thanks Alan. Here¹s the thing.. My SP tell me I am sending the the correct details, its just that the info for the specific user that they tell me is whats causing the issue.. I have take some of my config from the following link¹ https://supportforums.cisco.com/discussion/11294066/session-vrf-mpls-vpn-usi ng-radius-attribute Using the users file how to I separate the radcheck / radreply sections as this to appears to be part if not all of my issue Kind Regards, Neil From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> Date: Friday, 11 September 2015 15:27 To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>, Neil Morris <nmorris(a)tibus.com> Subject: Re: Freeradius-Users Digest, Vol 125, Issue 34 You aren't sending them what they request. Read your email and see the differences eg service-type Alan From: Neil Morris <nmorris(a)tibus.com> Date: Friday, 11 September 2015 15:02 To: <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius with LNS & Provider BRAS Alan, Firstly thanks for you responses to date! I do appreciate it.. Apologies for the lack of detail here is more info FreeRADIUS Version 2.1.12 I have deployed using just the local users file with x3 test accounts including the information that the provider has requested I respond with to complete the auth between our LNS and their BRAS. I had x1 connection up and stable for 3weeks. I shipped out x2 more routers and I start to see some strange behaviour. FR authenticates the session fine but on the router console the interface is reset straight away and so the loop of authentication continues. Running FR in debug/verbose I can see the sessions being authenticated as I would expect with all of the relevant user attributes being passed. The below is what the SP has requested I return to their BRAS; mydom.net.uk Cleartext-Password := ³password" Service-Type = Outbound-User, Tunnel-Type = L2TP, Tunnel-Medium-Type = IP, Tunnel-Password = password, Tunnel-Server-Endpoint = 89.x.y.134, Tunnel-Client-Auth-ID = ³MY-LNS" The following is an example of a user account and the Cisco AVP that I am sending; test(a)mydom.net.uk Cleartext-Password := ³test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1440, Framed-IP-Address = 10.31.253.253, Framed-IP-Netmask = 255.255.255.255, Framed-Route = "0.0.0.0 0.0.0.0 89.x.y.134", Cisco-AVPair = "ip:vrf-id=VRF_417858", Cisco-Avpair += "ip:route#1=vrf VRF_417858 10.31.249.0 255.255.255.0 10.31.253.253 tag 417858", Cisco-AVPair += "ip:ip-unnumbered=Loopback417858" The SP is advising me that from their debugs I am sending them everything after the username & password as listed above.. They mention that I should have 2 instances for RADIUS or that I change the radius system I use.. Regards Neil Message: 5 Date: Fri, 11 Sep 2015 08:19:56 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius with LNS & Provider BRAS Message-ID: <D70545FB-75A6-41F2-8E25-4E3FE3E06CC0(a)deployingradius.com> Content-Type: text/plain; charset=iso-8859-1 On Sep 11, 2015, at 7:09 AM, Neil Morris <nmorris(a)tibus.com> wrote: > I am looking for some guidance. I am using the users file which contains x3 > user accounts aswell as the domain suffix & the necessary authentication > details for the providers RADIUS server. Under the user accounts I have a > number of cisco avp with VRF & static address etc for the LNS That's a bit vague, but OK. > Whoever The provider is telling me that I am passing all the LNS relate > info to their RADIUS which is causing the tunnel build to fail. That's even more vague. > Is there > something major that I am missing here in relation to my config? A good description of the problem? Alan DeKok. ------------------------------

3 4

https Radius authentication problem
by Timmy 13 Sep '15

13 Sep '15

Dear All Radius Developers, I am doing a web Radius authentication. I am also reading Mr. Alan DeKok's article about its security issue. https://github.com/FreeRADIUS/mod_auth_radius For http connection to the website, we know that the password is not encrypted. Now I set up a SSL certificate for the website in question. How do you rate the security of this https Radius authentication? Is the password, being sent over the internet, also encrypted by the usual SSL layer? Hope to receive your helpful response. Yours Faithfully, Timmy

3 4

rlm_detail header not expanding \t
by Matthew Newton 12 Sep '15

12 Sep '15

In v2 I do: detail { ... header = "%t\t%{Client-IP-Address}" ... } which gives e.g. Wed Sep 9 16:55:16 2015 127.0.0.1 ... in the detail file. Building a config for v3, the same gives: Wed Sep 9 16:55:16 2015127.0.0.1 i.e. the \t is silently discarded and expands to nothing. I can get around it by putting a physical tab char in the config, but is this intended? Have stared at the radius_xlat code for too many minutes and figured it'd be quicker to ask... :) Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

3 10

FreeRadius and AD authentication
by Dennis Xu 11 Sep '15

11 Sep '15

I have installed FreeRadius 3.04 on RHEL7 and configured FreeRadius and Samba according to the following docs: http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… http://deployingradius.com/documents/configuration/active_directory.html Both wbinfo and ntlm_auth tests worked fine: [root@rotator mods-available]# wbinfo -a dxu001%xxxxxxx plaintext password authentication failed Could not authenticate user dxu001%xxxxxxxx with plaintext password challenge/response password authentication succeeded [root@rotator mods-available]# ntlm_auth --request-nt-key --domain=cfs.uoguelph.ca --username=dxu001 Password: NT_STATUS_OK: Success (0x0) [root@rotator mods-available]# When I tried to authenticate using username dxu001, the authentication failed. Below is the debug outputs: server inner-tunnel { (15) server inner-tunnel { (15) Request: EAP-Message = 0x020700411a0207003c31ea301dc50a02a3039d53ef8da042028d0000000000000000416ca750de3cd86e2f16a1533433d62264a5a1946f17c6c400647875303031 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = 'dxu001' State = 0x20b8045120bf1e31a648ded5aa0c1cba Chargeable-User-Identity = 0x00 Location-Capable = Civix-Location Calling-Station-Id = '90-18-7c-17-97-6c' Called-Station-Id = '04-fe-7f-93-7c-a0:test-secure' NAS-Port = 1 Acct-Session-Id = '55f2fb67/90:18:7c:17:97:6c/97' NAS-IP-Address = 131.104.45.66 NAS-Identifier = 'WLC_TEST' Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Event-Timestamp = 'Sep 11 2015 12:05:06 EDT' (15) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel (15) authorize { (15) [chap] = noop (15) [mschap] = noop (15) suffix : Checking for suffix after "@" (15) suffix : No '@' in User-Name = "dxu001", looking up realm NULL (15) suffix : No such realm "NULL" (15) [suffix] = noop (15) update control { (15) Proxy-To-Realm := 'LOCAL' (15) } # update control = noop (15) eap : Peer sent code Response (2) ID 7 length 65 (15) eap : No EAP Start, assuming it's an on-going EAP conversation (15) [eap] = updated (15) [files] = noop (15) [expiration] = noop (15) [logintime] = noop (15) [pap] = noop (15) } # authorize = updated (15) Found Auth-Type = EAP (15) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (15) authenticate { (15) eap : Expiring EAP session with state 0x20b8045120bf1e31 (15) eap : Finished EAP session with state 0x20b8045120bf1e31 (15) eap : Previous EAP request found for state 0x20b8045120bf1e31, released from the list (15) eap : Peer sent method MSCHAPv2 (26) (15) eap : EAP MSCHAPv2 (26) (15) eap : Calling eap_mschapv2 to process EAP data (15) eap_mschapv2 : # Executing group from file /etc/raddb/sites-enabled/inner-tunnel (15) eap_mschapv2 : Auth-Type MS-CHAP { (15) mschap : Creating challenge hash with username: dxu001 (15) mschap : Client is using MS-CHAPv2 Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} --challenge=%{%{mschap:Challenge}:-00} --nt-response=%{%{mschap:NT-Response}:-00}: (15) mschap : EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (15) mschap : --> --username=dxu001 (15) ERROR: mschap : No NT-Domain was found in the User-Name (15) mschap : EXPAND --domain=%{%{mschap:NT-Domain}:-CFS.UOGUELPH.CA} (15) mschap : --> --domain=CFS.UOGUELPH.CA (15) mschap : Creating challenge hash with username: dxu001 (15) mschap : EXPAND --challenge=%{%{mschap:Challenge}:-00} (15) mschap : --> --challenge=43f96f7805c5bb5a (15) mschap : EXPAND --nt-response=%{%{mschap:NT-Response}:-00} (15) mschap : --> --nt-response=416ca750de3cd86e2f16a1533433d62264a5a1946f17c6c4 Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' (15) mschap : External script failed (15) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) (15) ERROR: mschap : MS-CHAP2-Response is incorrect (15) [mschap] = reject Any ideas? Thanks!

1 1

Proxied Access-Challenge requests are missing AVPs
by Leonardo Arena 11 Sep '15

11 Sep '15

Hi list, I have a FreeRADIUS 3.0.3 proxy which forward all Cisco WAPs Wireless-802.11 authentication requests to a Windows NPS server. Clients use PEAP to authenticate. What I'm seeing is that the Access-Challenge from the NPS is forwarded without any AVPs, and of course the WAP silently drops it. Please find below the debug output and the relevant configuration files attached. Couldn't find really anything helpful in the ML archive. Could you please give me any suggestion of what could be wrong? Please let me know if further information is needed. Thank you in advance for your kind assistance. - leonardo Received Access-Request Id 111 from 10.97.6.140:1645 to 10.97.63.5:1812 length 216 User-Name = 'mbianchi' Framed-MTU = 1400 Called-Station-Id = 'DC-A5-F4-FE-BE-71:WRES-DEV' Calling-Station-Id = 'ac22.0ba5.9688' Cisco-AVPair = 'ssid=WRES-DEV' Service-Type = Login-User Cisco-AVPair = 'service-type=Login' Message-Authenticator = 0x98e4b1c896994939e0de6e25c17b96a0 EAP-Message = 0x0201000b016c6172656e61 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = '374' NAS-Port = 374 NAS-Port-Id = '374' NAS-IP-Address = 10.97.6.140 NAS-Identifier = 'dev-rto004-r1-ap-1' (1) # Executing section authorize from file /etc/raddb/sites-enabled/default-bsn (1) authorize { (1) [preprocess] = ok (1) linelog_auth : EXPAND /var/log/radius/linelog_auth.log (1) linelog_auth : --> /var/log/radius/linelog_auth.log (1) linelog_auth : EXPAND %S, %{User-Name}, %{NAS-Identifier}(%{NAS-IP-Address}):%{NAS-Port-Id}, Calling-Station-Id: %{Calling-Station-Id}, Packet-Type: %{Packet-Type}, Service-Type: %{Service-Type} (1) linelog_auth : --> 2015-09-10 13:44:55, mbianchi, dev-rto004-r1-ap-1(10.97.6.140):374, Calling-Station-Id: ac22.0ba5.9688, Packet-Type: Access-Request, Service-Type: Login-User (1) [linelog_auth] = ok (1) suffix : No '@' in User-Name = "mbianchi", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) if (!updated) (1) if (!updated) -> TRUE (1) if (!updated) { (1) if (NAS-Port-Type == Wireless-802.11) (1) if (NAS-Port-Type == Wireless-802.11) -> TRUE (1) if (NAS-Port-Type == Wireless-802.11) { (1) update control { (1) &Proxy-To-Realm := 'my.domain.org' (1) } # update control = noop (1) } # if (NAS-Port-Type == Wireless-802.11) = noop (1) ... skipping else for request 1: Preceding "if" was taken (1) } # if (!updated) = noop (1) } # authorize = ok (1) Proxying request to home server 10.44.16.110 port 1812 Sending Access-Request Id 226 from 0.0.0.0:46821 to 10.44.16.110:1812 User-Name = 'mbianchi' Framed-MTU = 1400 Called-Station-Id = 'DC-A5-F4-FE-BE-71:WRES-DEV' Calling-Station-Id = 'ac22.0ba5.9688' Cisco-AVPair = 'ssid=WRES-DEV' Service-Type = Login-User Cisco-AVPair = 'service-type=Login' Message-Authenticator = 0x98e4b1c896994939e0de6e25c17b96a0 EAP-Message = 0x0201000b016c6172656e61 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = '374' NAS-Port = 374 NAS-Port-Id = '374' NAS-IP-Address = 10.97.6.140 NAS-Identifier = 'dev-rto004-r1-ap-1' Proxy-State = 0x313131 Waking up in 0.3 seconds. Waking up in 0.4 seconds. Received Access-Challenge Id 226 from 10.44.16.110:1812 to 10.97.63.5:46821 length 95 Proxy-State = 0x313131 Session-Timeout = 30 EAP-Message = 0x010200061920 State = 0x1c5503ba00000137000102000a2c106e0000000000000000000000000000000c6d95d8e4 Message-Authenticator = 0xe5ba33c9fca2c5534a4e1302650ae8ca Sending Access-Challenge Id 111 from 10.97.63.5:1812 to 10.97.6.140:1645 (1) Finished request Waking up in 0.3 seconds. Waking up in 3.0 seconds. (0) Cleaning up request packet ID 110 with timestamp +12 Waking up in 1.6 seconds.

4 15

Re: Freeradius-Users Digest, Vol 125, Issue 34
by Neil Morris 11 Sep '15

11 Sep '15

Alan, Firstly thanks for you responses to date! I do appreciate it.. Apologies for the lack of detail… here is more info FreeRADIUS Version 2.1.12 I have deployed using just the local users file with x3 test accounts including the information that the provider has requested I respond with to complete the auth between our LNS and their BRAS. I had x1 connection up and stable for 3weeks. I shipped out x2 more routers and I start to see some strange behaviour. FR authenticates the session fine but on the router console the interface is reset straight away and so the loop of authentication continues. Running FR in debug/verbose I can see the sessions being authenticated as I would expect with all of the relevant user attributes being passed. The below is what the SP has requested I return to their BRAS; mydom.net.uk Cleartext-Password := “password" Service-Type = Outbound-User, Tunnel-Type = L2TP, Tunnel-Medium-Type = IP, Tunnel-Password = password, Tunnel-Server-Endpoint = 89.x.y.134, Tunnel-Client-Auth-ID = “MY-LNS" The following is an example of a user account and the Cisco AVP that I am sending; test(a)mydom.net.uk Cleartext-Password := “test" Service-Type = Framed-User, Framed-Protocol = PPP, Framed-MTU = 1440, Framed-IP-Address = 10.31.253.253, Framed-IP-Netmask = 255.255.255.255, Framed-Route = "0.0.0.0 0.0.0.0 89.x.y.134", Cisco-AVPair = "ip:vrf-id=VRF_417858", Cisco-Avpair += "ip:route#1=vrf VRF_417858 10.31.249.0 255.255.255.0 10.31.253.253 tag 417858", Cisco-AVPair += "ip:ip-unnumbered=Loopback417858" The SP is advising me that from their debugs I am sending them everything after the username & password as listed above.. They mention that I should have 2 instances for RADIUS or that I change the radius system I use.. Regards Neil Message: 5 Date: Fri, 11 Sep 2015 08:19:56 -0400 From: Alan DeKok <aland(a)deployingradius.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius with LNS & Provider BRAS Message-ID: <D70545FB-75A6-41F2-8E25-4E3FE3E06CC0(a)deployingradius.com> Content-Type: text/plain; charset=iso-8859-1 On Sep 11, 2015, at 7:09 AM, Neil Morris <nmorris(a)tibus.com> wrote: > I am looking for some guidance. I am using the users file which contains x3 > user accounts aswell as the domain suffix & the necessary authentication > details for the providers RADIUS server. Under the user accounts I have a > number of cisco avp with VRF & static address etc for the LNS That's a bit vague, but OK. > Whoever The provider is telling me that I am passing all the LNS relate > info to their RADIUS which is causing the tunnel build to fail. That's even more vague. > Is there > something major that I am missing here in relation to my config? A good description of the problem? Alan DeKok. ------------------------------

2 1

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Sure, here you go: # Loading post-auth {...} Program received signal SIGSEGV, Segmentation fault. 0x0000000000422471 in do_compile_modgroup (parent=0xabf680, component=MOD_POST_AUTH, cs=0x8acd70, grouptype=0, parentgrouptype=0, mod_type=<value optimized out>) at src/main/modcall.c:2827 2827 if (f->cond->type == COND_TYPE_TRUE) goto skip_true; Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.166.el6_7.1.x86_64 keyutils-libs-1.4-5.el6.x86_64 krb5-libs-1.10.3-42.el6.x86_64 libcom_err-1.41.12-22.el6.x86_64 libselinux-2.0.94-5.8.el6.x86_64 nss-softokn-freebl-3.14.3-23.el6_7.x86_64 openssl-1.0.1e-42.el6.x86_64 zlib-1.2.3-29.el6.x86_64 (gdb) bt #0 0x0000000000422471 in do_compile_modgroup (parent=0xabf680, component=MOD_POST_AUTH, cs=0x8acd70, grouptype=0, parentgrouptype=0, mod_type=<value optimized out>) at src/main/modcall.c:2827 #1 0x000000000042271e in do_compile_modsingle (parent=0xabf680, component=MOD_POST_AUTH, ci=0x8acd70, grouptype=0, modname=0x7fffffffe1d8) at src/main/modcall.c:2193 #2 0x00000000004222ca in do_compile_modgroup (parent=0xabefc0, component=MOD_POST_AUTH, cs=0x8ab7b0, grouptype=0, parentgrouptype=0, mod_type=<value optimized out>) at src/main/modcall.c:2852 #3 0x00000000004227b4 in do_compile_modsingle (parent=0xabefc0, component=MOD_POST_AUTH, ci=0x8ab7b0, grouptype=0, modname=0x7fffffffe408) at src/main/modcall.c:2227 #4 0x000000000041e76a in load_component_section (cs=0x8aad80, components=0xab8b30, comp=MOD_POST_AUTH) at src/main/modules.c:1131 #5 0x000000000041eace in load_byserver (cs=0x8a1e40) at src/main/modules.c:1260 #6 0x000000000041f037 in virtual_servers_load (config=0x685620) at src/main/modules.c:1447 #7 0x0000000000420858 in modules_init (config=0x685620) at src/main/modules.c:2031 #8 0x0000000000425e07 in main (argc=2, argv=<value optimized out>) at src/main/radiusd.c:463 Regards, Mohamed -----Original Message----- From: Mohamed Imran (NBI) Sent: 11 September 2015 13:58 To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: FW: sql query in post-auth - segmentation fault Thanks Arran but Alan's just pointed out the issue. Thanks again for you're your time. Regards, Mohamed -----Original Message----- From: Mohamed Imran (NBI) Sent: 11 September 2015 13:41 To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: sql query in post-auth - segmentation fault Hi Arran, # gdb --args /usr/local/sbin/radiusd -X GNU gdb (GDB) Red Hat Enterprise Linux (7.2-83.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/sbin/radiusd...done. (gdb) bt No stack. (gdb) backtrace full No stack. Regards, Mohamed

1 0

FW: sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Thanks Arran but Alan's just pointed out the issue. Thanks again for you're your time. Regards, Mohamed -----Original Message----- From: Mohamed Imran (NBI) Sent: 11 September 2015 13:41 To: 'freeradius-users(a)lists.freeradius.org' <freeradius-users(a)lists.freeradius.org> Subject: sql query in post-auth - segmentation fault Hi Arran, # gdb --args /usr/local/sbin/radiusd -X GNU gdb (GDB) Red Hat Enterprise Linux (7.2-83.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/sbin/radiusd...done. (gdb) bt No stack. (gdb) backtrace full No stack. Regards, Mohamed

2 1

RE: sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

DOH! Thanks Alan....works now (facepalm!) Regards, Mohamed

1 0

sql query in post-auth - segmentation fault
by Mohamed Imran (NBI) 11 Sep '15

11 Sep '15

Hi Arran, # gdb --args /usr/local/sbin/radiusd -X GNU gdb (GDB) Red Hat Enterprise Linux (7.2-83.el6) Copyright (C) 2010 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html> This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: <http://www.gnu.org/software/gdb/bugs/>... Reading symbols from /usr/local/sbin/radiusd...done. (gdb) bt No stack. (gdb) backtrace full No stack. Regards, Mohamed

2 1