November 2016 - Freeradius-Users - lists.freeradius.org

Strange behaviour combining windows, single-sign-on and peap inner-tunnel
by Herwin Weststrate 03 Nov '16

03 Nov '16

Recently we've seen an extreme corner case with Freeradius, and I'm a bit puzzled on what the best way would be to fix this. The scenario uses Windows clients on Wifi with single-sign-on, PEAP, Freeradius as the Radius server where the inner-tunnel is used, and an Active Directory as backend (this could be either NPS/Radius or Winbind/NTLM authentication, both show this behaviour). The problem does not occur when acting as a real Radius proxy and let the NPS handle the authentication completely. The problem arises when the user is in the AD backend with a certain casing (e.g. "john_doe") but is logging in with a different casing ("John_Doe"). The first authentication succeeds and John Doe's laptop is connected to the wifi. Then, the session expires and the client tries to reauthenticate. Both the inner and outer Radius packets still show "John_Doe" as User-Name attribute, but the authentication fails. I tried recalculating the MS-CHAP2-Response value, and it looks like this has been calculated using the "john_doe" value as username. I'm not exactly sure if it normalizes the username to lowercase here, or if it uses the value as given in the AD backend (in this testcase, both were lowercased, but it sounds more logical to me that the user-name with casing was found via the AD domain). First thing I tried was switching to using the ntlmauth executable instead of a Radius tunnel or Winbind-libs (it was on a system without a build environment, so making changes to the source was not really an option here) and build a wrapper around it: Try an authentication, and if that fails: lowercase the username, recalculate the value that is given as the --challenge-parameter with the new username and try a new authentication. If that fails too, the password is probably incorrect. I switched to ntlm_auth because I didn't exactly see an option to try another authentication with Radius. The authentication succeeded, but the MS-CHAP2-Response attribute in the reply was still based on the username with the incorrect casing, so that failed too. After adding a script in the post-auth to calculate the correct value (which didn't have access to the username used for the authentication, so it just had to blindly try an authentication again, if that failed: lowercase the username and use that), recalculate and everything worked. Well, it worked as far as the proof of concept was concerned, of course this is not exactly a setup you would use in a real environment. The only sensible setup I could think of was to include this within the winbind library user (which would be rlm_mschap here because it's a 3.0 setup): add a boolean config option to retry authentication with a normalized username and use that for further hash calculations. This allows the option to save the user-name used for the authentication hash to be saved in the "session", so we could use it again without have to attempt more authentications. Normalizing to lowercase is probably a bad idea, the `wbinfo` tool allows us to search for the user, we could probably use that too in the winbind libs (and it gives an extra reason why putting this in the winbind code would be a good idea) -- Herwin Weststrate

1 0

How could I manage Multiple IP Address for only one User?
by Jose Quezada 02 Nov '16

02 Nov '16

Hi Everybody, FreeRADIUSv3 If I have a user authenticated to my radius and the user has 5 IP, Public for special services, the user can use all of them over the NAS without problem? or I have to do something special to my FreeRADIUS. Please be as specific as possible. Sorry for my Misspelling... Thanks So Much!

2 1

radtest passes test, phone connects to WiFi, but laptop does not
by Daniel Wruck 02 Nov '16

02 Nov '16

I am a FreeRADIUS newbie but have read a lot (maybe too much - One gripe is that much of the forums on the internet does not clearly list a FreeRADIUS version). I set FreeRADIUS 3 times (test network - FR 2.1 on Ubuntu 14.04, test network - FR 3.0.12 on upgraded Ubuntu 16.04, and prod network - FR 3.0.12 on Ubuntu 16.04) but still could have missed some little important step. I have FreeRADIUS 3.0.12 set up on an Ubuntu 16.04 box. I believe that I have most everything working (except maybe sql). I have an AD forest with 1 domain (fbcexample.com) and 3 child domains (hac.fbcexample.com, cbs.fbcexample.com, and hac.fbcexample.com) I created 4 named mschap modules so that I could hard code the --domain property in each one. I can successfully rad test from each of my 4 domains against it including group membership. Then I setup a test SSID on my aruba controller. I can connect via my android phone (with just username & pass), but connecting a laptop to is not working (it appears that it is sending domain as a part of username). It seems that there is more security stuff going on when the laptop connects; maybe I don't have MSCHAPv2 configured right? Something broken in realms? When the Win 10 x64 laptop connects, radius -X first shows that it is trying to connect via computer name. Then a box pops up asking for username and password with a checkmark for 'Use my Windows user account", I choose and continue. Radius -X shows that several more requests are made and then windows sows 'Can't connect to this network'. Any suggestions on where my problem is? I created the CA and server certs and have believe them to be correctly installed. But not sure that this has anything to do with the problem descripted above. Examples of the code that I am running. I included a pastebin for the 3000 lines of radius -X output. WORKING RADTEST LINE radtest -t mschap daniel.radius passw0rd 127.0.0.1 0 testing123 ABBREVIATED MSCHAP MODULE mschap mschap_fbc { ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=fbcexample --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap_fbc:Challenge}:-00} --nt-response=%{%{mschap_fbc:NT-Response}:-00} --require-membership-of='fbcexample\\LDAP_WiFi'" . . . } DEFAULT SITE AUTHENICATE SECTION authenticate { . . . # MSCHAP authentication. Auth-Type MS-CHAP { mschap_fbc { reject = 2 } if (reject){ mschap_hac reject = 2 } if (reject){ mschap_hbs reject = 2 } if (reject){ mschap_cbs reject = 2 } } . . . } Small part of the Radius -X WHEN CONNECTING WITH LAPTOP, all 3000+ lines are in pastebin below (16) mschap_fbc: Creating challenge hash with username: daniel.radius (16) mschap_fbc: Client is using MS-CHAPv2 (16) mschap_fbc: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=fbcexample --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap_fbc:Challenge}:-00} --nt-response=%{%{mschap_fbc:NT-Response}:-00} --require-membership-of='fbcexample\\LDAP_WiFi': (16) mschap_fbc: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (16) mschap_fbc: --> --username=FBCEXAMPLE\\daniel.radius (16) mschap_fbc: Creating challenge hash with username: daniel.radius (16) mschap_fbc: EXPAND --challenge=%{%{mschap_fbc:Challenge}:-00} (16) mschap_fbc: --> --challenge=63abafd041820bf2 (16) mschap_fbc: EXPAND --nt-response=%{%{mschap_fbc:NT-Response}:-00} (16) mschap_fbc: --> --nt-response=6bdebf5ac39680b7070c457fefacbdc1596103429c14eb64 (16) mschap_fbc: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (16) mschap_fbc: External script failed (16) mschap_fbc: ERROR: External script says: Logon failure (0xc000006d) (16) mschap_fbc: ERROR: MS-CHAP2-Response is incorrect Full output of Radius -X output when laptop trys to connect http://pastebin.com/TJpYVYnK Daniel W

3 2

Proxy accounting packets
by Anuruddha Premalal 01 Nov '16

01 Nov '16

Hi All, I'm trying to proxy all the accounting packets to a different AAA. (Original packets doesn't have a realm) 1. I have added a new realm in proxy.conf realm vamps{ nostrip type = acct ipaddr = 34.161.1.41 port = 1813 secret = abc#16 } 2. Added followig at the top of sites-enabled/default accounting section update control { Proxy-To-Realm := vamps } However whe I sedn a accounting request to home AAA it discards proxying saying *rad_accounting: Cancelling proxy to realm vamps, as it is a LOCAL realm.* Am I doing something wrong with configurations. Appreciate your assistance on this. Thanks, -- *Anuruddha Premalala (MIEEE)Mobile : +94717213122E-mail : anuruddhapremalal(a)gmail.com <anuruddhapremalal(a)gmail.com>web : www.anuruddha.org <http://www.anuruddha.org>*

2 2

Installing python librarries for use within rlm_python
by Shabda Raaj 01 Nov '16

01 Nov '16

> Your python environment is broken. Most likely, your python home is in a non-standard location I don't think so. "which python" gives me /usr/bin/python on the shell. I think I have figured out the problem, and I think it is a bug in the rlm_python code. I put a "import sys; print sys.path" in my python file. This gives me a ['/usr/local/etc/raddb/mods-config/python'] Which is wrong, because it should have also contained the default path: ['', '/usr/lib/python2.7', '/usr/lib/python2.7/plat-x86_64-linux-gnu', '/usr/lib/python2.7/lib-tk', '/usr/lib/python2.7/lib-old', '/usr/lib/python2.7/lib-dynload', '/home/ubuntu/.local/lib/python2.7/site-packages', '/usr/local/lib/python2.7/dist-packages', '/usr/lib/python2.7/dist-packages'] This behaviour is being caused by PySys_SetPath(path); https://github.com/FreeRADIUS/freeradius-server/blob/ce92146386b30bd7f9f576… Which sets the pythonpath to that hardcoded path, rather than appending to it. I think the correct code would be along these lines char *path, *newpath; path=Py_GetPath(); newpath=new char[strlen(path)+4]; strcpy(newpath, path); strcat(newpath, ":."); // ":." for unix, or ";." for windows PySys_SetPath(newpath); free(newpath); >From http://markmail.org/message/qwex6rhhqd43jg2o Which gets the old path from Py_GetPath, and then appends to it.

1 0