April 2016 - Freeradius-Users - lists.freeradius.org

MSCHAP2 PEAP +Win2012AD _ LDAP + FR
by Agent Smith 14 Apr '16

14 Apr '16

Before I spend time researching/configuring this (like I did several years ago, failed and joined the FR box to AD), I would love it if someone can tell me if this is doable now, some pointers on HOW would be great too if it is. I have a need to put together a freeradius box that can authenticate wireless users using MSCHAPv2 PEAP. I do not want to join the Linux box running FR to AD domain, I simply want to use LDAP and authenticate wireless users, the LDAP is really windows AD runing on server 2012. so is this a support config or must I join the FR Linux box to MS AD environment for this to work? Thanks,

3 2

Error parsing VSA
by D C 14 Apr '16

14 Apr '16

Trying to get freeradius 2.1.12 to work with a citrix netscaler. my setup works will a pile of other vendors, so i figured it would also be just as simple as adding a new reply-item to my ldap profile. >From the output below you can see my other vsa's are being sent back to the nas no problem. But I can't figure out it can't parse my latest one. [ldap] extracted attribute Juniper-Local-User-Name from generic item Juniper-Local-User-Name := "super-users" [ldap] extracted attribute Cisco-AVPair from generic item Cisco-AVPair+= "shell:priv-lvl=15" [ldap] extracted attribute Fortinet-Group-Name from generic item Fortinet-Group-Name = "SUPER_ADMIN" [ldap] parsing radiusReplyItem failed: Citrix-User-Groups = "SUPER_ADMIN_CTX" Not sure if it's supposed to be Citrix-User-Groups, or CTXUserGroups, but i'll figure that out once I can get freeradius to even send the reply-item. I tried adding a dictionary that I googled. attached below: # -*- text -*- # Copyright (C) 2015 The FreeRADIUS Server project and contributors ############################################################################## # # Citrix VSAs # # $Id: 868b203ab45b47533d9b53862cfc271251aa7f17 $ # ############################################################################## VENDOR Citrix 66 BEGIN-VENDOR Citrix ATTRIBUTE Citrix-UID 10 integer ATTRIBUTE Citrix-GID 11 integer ATTRIBUTE Citrix-Home 12 string ATTRIBUTE Citrix-Shell 13 string ATTRIBUTE Citrix-Group-Names 14 string ATTRIBUTE Citrix-Group-Ids 15 string ATTRIBUTE Citrix-User-Groups 16 string END-VENDOR Citrix Thanks, Dan

2 1

openwrt, freeradius
by Mildok 14 Apr '16

14 Apr '16

Ok. Now I do not understand anything. At logs I see so: Mon Apr 11 20:15:00 2016 : Debug: including configuration file /etc/freeradius2/policy.conf Mon Apr 11 20:15:00 2016 : Debug: including files in directory /etc/freeradius2/sites/ Mon Apr 11 20:15:00 2016 : Debug: including configuration file /etc/freeradius2/sites/default Mon Apr 11 20:15:00 2016 : Debug: main { Mon Apr 11 20:15:00 2016 : Debug: allow_core_dumps = no Mon Apr 11 20:15:00 2016 : Debug: } Mon Apr 11 20:15:00 2016 : Debug: including dictionary file /etc/freeradius2/dictionary This mean, as I understand: First load /etc/freeradius2/sites/default Next load /etc/freeradius2/dictionary But if "updated" declare in dictionary - ofcourse it will be know anything about "updated" in "/etc/freeradius2/sites/default". In the instructions http://wiki.freeradius.org/guide/Mac-Auth , "rewrite.calling_station_id" must be added to the file "/etc/freeradius2/sites/default". I newbie... -- ilya Gafarov

2 1

Session resumptions importance.
by Anirudh Malhotra 13 Apr '16

13 Apr '16

Hi, I wanted to ask how much effect would disabling the session resumption would make on the server? If any? Would it reduce number of simultaneous eap sessions server can handle in any manner? BR, Anirudh Malhotra 8zero2 Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

3 6

Tweaking LDAP parameters
by David Hartburn 13 Apr '16

13 Apr '16

Hi, Yesterday, I moved a fair chunk of our on-site wireless to FreeRADIUS as we migrate from our NPS servers. I have had a number of complaints of users being forced to reauthenticate (prompted for their password again) on odd occasions throughout the day. Logs show a login incorrect: Tue Apr 12 15:06:47 2016 : Auth: (264236) Login OK: [xxx(a)kent.ac.uk] (from client cwlc-tlb port 2 cli a8:66:7f:12:a9:b9) .....output cut...... Tue Apr 12 15:14:48 2016 : Warning: rlm_ldap (ldap): 2 of 2 connections in use. You probably need to increase "spare" Tue Apr 12 15:14:48 2016 : Error: rlm_ldap (ldap): Cannot open new connection, connection spawning already in progress Tue Apr 12 15:14:48 2016 : Auth: (281194) Invalid user: [xxx(a)kent.ac.uk] (from client cwlc-tlb port 2 cli a8:66:7f:12:a9:b9 via TLS tunnel) Tue Apr 12 15:14:48 2016 : Auth: (281195) Login incorrect (eap: Failed continuing EAP PEAP (25) session. EAP sub-module failed): [xxx(a)kent.ac.uk] (from client cwlc-tlb port 2 cli a8:66:7f:12:a9:b9) Tue Apr 12 15:14:48 2016 : Info: rlm_ldap (ldap): Deleting connection (40122) Tue Apr 12 15:14:48 2016 : Info: rlm_ldap (ldap): 2 of 2 connections in use. Need more spares It looks like it is rejecting the auth because it can not make the LDAP connection to validate the user. Two questions on this. First, is it possible to allow clients a couple of attempts to retry their authentication before completely rejecting and forcing them to enter their password again? Second, are there any rules of thumb regarding setting min, max and spare for LDAP connections? At the moment I have: pool { start = 16 min = 8 max = ${thread[pool].max_servers} spare = 16 uses = 0 lifetime = 0 idle_timeout = 0 } When starting with radiusd -x, that gives: rlm_ldap (ldap): Initialising connection pool pool { start = 16 min = 8 max = 32 spare = 16 uses = 0 lifetime = 0 cleanup_interval = 30 idle_timeout = 0 retry_delay = 1 spread = no } Comments in the file suggests it is not sensible to push max any higher. Is it sensible to set spare to 32, or is that setting it the wrong way round? Thanks Dave Hartburn

6 15

problem fetching ldap attribute in inner tunnel
by Anirudh Malhotra 12 Apr '16

12 Apr '16

Hi everyone, I am doing PEAP with GTC authenticate my LDAP clients, I fetch some attribute in LDAP module and is store it in session-state and later check them in outer post-auth. I am facing this problem in which when client is re-authenticating and the Phase2 is skipped with 'Skipping Phase2 because of session resumption', for expediting the process. The LDAP attribute value is not fetched and hence post-auth doesn't get that value which then fails the authentication(configured like that by me, Set of rules which check value of the attribute and fails by default if none condition is matched or attribute is not fetched) Though I am able to fetch the attribute from elsewhere(running xlat) but I don't want to run it for every user, As I am running EAP-TLS, PAP also in my setup. BR, Anirudh Malhotra Mail: 8zero2.in(a)gmail.com Facebook: www.facebook.com/8zero2 Twitter: @8zero2_in Blog: blog.8zero2.in

2 3

rfc6929 "tlv" type question
by Vereecke, Katrien (Nokia - BE) 12 Apr '16

12 Apr '16

Hello, The RFC6929 states that "tagged" attributes must not be used in the extended-space, in stead "tlv" data types should be used. ( 6.4 Design Guidelines for the New Types ... "tagged" attributes MUST NOT be defined in the Extended-Type space. The "tlv" data type should be used instead to group attributes.) With the extended format, can we indicate in the dictionary that certain attributes belong to different tlv attributes, similar as the tagged functionality before? e.g BEGIN-VENDOR Alcatel-IPD format=Extended-Vendor-Specific-3 ATTRIBUTE Alcatel-IPD-Ext-3-TestAttr-40 40 tlv ATTRIBUTE Alcatel-IPD-Ext-3-TestAttr-50 50 tlv ATTRIBUTE Alcatel-IPD-Ext-3-TestAttr-1 1 integer => I want to indicate that this attribute Alcatel-IPD-Ext-3-TestAttr-1 is aswell part of Alcatel-IPD-Ext-3-TestAttr-40 and Alcatel-IPD-Ext-3-TestAttr-50 without having to duplicate and give another attribute name?? END-VENDOR Alcatel-IPD Similar as with the "tags" we want to be able to indicate that the same attribute can be received in the access-accept but with different tag. How can we achieve this behavior with the tlv extended attribute type without having to define different attribute-names for 40.1 and 50.1? Thanks, kind regards, Katrien.

2 2

Constant Authentication error
by Yusuf Siddiqui 12 Apr '16

12 Apr '16

Hi All After fixing several errors now i see my Radius up and running but i am unable to debug the error which i am getting . I tried all combinations and inserted proper cleartext password,please help. Tue Apr 12 03:30:53 2016 : Debug: (2) } # authorize (ok) Tue Apr 12 03:30:53 2016 : Debug: (2) Using 'Auth-Type = CHAP' for authenticate {...} Tue Apr 12 03:30:53 2016 : Debug: (2) Running Auth-Type CHAP from file /usr/local/etc/raddb/sites-enabled/default Tue Apr 12 03:30:53 2016 : Debug: (2) Auth-Type CHAP { Tue Apr 12 03:30:53 2016 : Debug: (2) modsingle[authenticate]: calling chap (chap) for request 2 Tue Apr 12 03:30:53 2016 : ERROR: (2) chap - &control:Cleartext-Password is required for authentication Tue Apr 12 03:30:53 2016 : Debug: (2) modsingle[authenticate]: returned from chap (chap) for request 2 Tue Apr 12 03:30:53 2016 : Debug: (2) chap (fail) Tue Apr 12 03:30:53 2016 : Debug: (2) } # Auth-Type CHAP (fail) Tue Apr 12 03:30:53 2016 : Debug: (2) Failed to authenticate the user Tue Apr 12 03:30:53 2016 : Debug: (2) Using Post-Auth-Type Reject Tue Apr 12 03:30:53 2016 : Debug: (2) Post-Auth-Type sub-section not found. Ignoring. Tue Apr 12 03:30:53 2016 : Debug: (2) Delaying response for 1.000000 seconds Tue Apr 12 03:30:53 2016 : Debug: Waking up in 0.3 seconds. Tue Apr 12 03:30:54 2016 : Debug: Waking up in 0.6 seconds. Tue Apr 12 03:30:54 2016 : Debug: (2) - Sending delayed response Tue Apr 12 03:30:54 2016 : Debug: (2) - Sent Access-Reject Id 7 from 10.112.0.150:1812 to 122.177.189.189:2919 via enp2s0 length 20 Tue Apr 12 03:30:54 2016 : Debug: Waking up in 3.9 seconds. Tue Apr 12 03:30:58 2016 : Debug: (2) Cleaning up request packet ID 7 with timestamp +164 Tue Apr 12 03:30:58 2016 : Info: Ready to process requests Regards Yusuf Siddiqui *__________________________________________________________________________________________________________________________________________________________________* This communication & accompanying documents ("this e-mail") contains confidential and/or privileged information for exclusive use of the individual to whom it is addressed. If you are not the intended recipient, please immediately notify the company & delete this e-mail. Any unauthorized use or disclosure of this e-mail is strictly prohibited. Representations in this e-mail are subject to contract. As an e-mail user please be cautious of the technical & other vulnerabilities of the internet which may result in malicious and/or unauthorized access to / use / alteration of e-mails/e-mail IDs. Thank you. *_______________________________________________________________________________________________________________________________________________________________*

1 1

freeradius 3.0.4 CentOS 7.2 AD
by Hubert Kupper 11 Apr '16

11 Apr '16

Hello, we have freeradius 3.0.4 on a centos 7.2 machine with ldap authentication against edirectory running for a long time. Now we want to authenticate against AD. We followed the intructions on http://deployingradius.com/documents/configuration/active_directory.html ntlm_auth returns: NT_STATUS_OK: Success (0x0). Radiusd -X returns the following error: /etc/raddb/mods-config/files/authorize[1]: Parse error (check) for entry DEFAULT: Unknown value 'ntlm_auth' for attribute 'Auth-Type' What is the reason? Regards, Hubert

3 5

Re: Forward Accounting Packets to Fortiage - need help
by Eby Mani 11 Apr '16

11 Apr '16

it started working after "use_tunneled_reply = yes". Thank you very much. -------------------------------------------- On Fri, 8/4/16, Alan DeKok <aland(a)deployingradius.com> wrote: Subject: Re: Forward Accounting Packets to Fortiage - need help To: "Eby Mani" <eby_km(a)yahoo.com> Cc: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Date: Friday, 8 April, 2016, 11:31 PM >That is a common problem, and typically because you're running rules in the first few packets that aren't run for the last one. >e.g. you may have use_tunneled_reply = no. > > Alan DeKok.

1 0