September 2016 - Freeradius-Users - lists.freeradius.org

Freeradius with Windbind and Google authenticator issues with Cisco Anyconnect VPN
by Nawaz Hosany 23 Sep '16

23 Sep '16

Hi Guys I am trying to configure Google Authenticator to work with Windbind for VPN using Cisco Anyconnect on Ubuntu . Windbind works fine without Google Authenticator., but combined it does not work. I would need some help from the community. Here below are my configs and debugs/errors i am seeing: # /etc/pam.d/radiusd - PAM configuration for FreeRADIUS # # We fall back to the system default in /etc/pam.d/common-* # @include common-auth @include common-account @include common-password @include common-session auth requisite pam_google_authenticator.so forward_pass auth required pam_winbind.so use_first_pass account required pam_permit.so # # /etc/pam.d/common-auth - authentication settings common to all services # # This file is included from other service-specific PAM config files, # and should contain a list of the authentication modules that define # the central authentication scheme for use on the system # (e.g., /etc/shadow, LDAP, Kerberos, etc.). The default is to use the # traditional Unix authentication mechanisms. # # As of pam 1.0.1-6, this file is managed by pam-auth-update by default. # To take advantage of this, it is recommended that you configure any # local modules either before or after the default block, and use # pam-auth-update to manage selection of other modules. See # pam-auth-update(8) for details. # here are the per-package modules (the "Primary" block) auth [success=1 default=ignore] pam_winbind.so krb5_auth krb5_ccache_type=FILE cached_login # here's the fallback if no module succeeds # prime the stack with a positive return value if there isn't one already; # this avoids us returning an error just because nothing sets a success code # since the modules above will each just jump around auth required pam_google_authenticator.so auth required pam_winbind.so auth required pam_permit.so auth requisite pam_deny.so # and here are more per-package modules (the "Additional" block) # end of pam-auth-update config Below is the error message i am getting when trying to authenticate, i am using <AD password><google-authenticator-token>: User-Name = "testuser" User-Password = "4c330e@3O7K5401206" NAS-Port = 577536 Called-Station-Id = "10.33.3.100" Calling-Station-Id = "10.1.3.10" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "10.1.3.10" Cisco-AVPair = "mdm-tlv=device-platform=win" Cisco-AVPair = "mdm-tlv=device-mac=02-00-4c-4f-4f-50" Cisco-AVPair = "mdm-tlv=device-mac=f0-1f-af-3c-1d-b0" Cisco-AVPair = "mdm-tlv=device-type=Dell Inc. XPS L421X" Cisco-AVPair = "mdm-tlv=ac-user-agent=AnyConnect Windows 4.2.03013" Cisco-AVPair = "mdm-tlv=device-platform-version=6.1.7601 Service Pack 1" Cisco-AVPair = "mdm-tlv=device-uid=26CC5FF8D17E0CF5A9DDDBA2E53009E17488F0B66E780F33A635AA1A7ABC26B9" NAS-IP-Address = 10.33.4.100 Cisco-AVPair = "audit-session-id=0a2103640008d00057bdf75b" Cisco-AVPair = "ip:source-ip=10.1.3.10" Vendor-3076-Attr-146 = 0x4f414e444174657374 Vendor-3076-Attr-150 = 0x00000002 Cisco-AVPair = "coa-push=true" Wed Aug 24 15:43:43 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:43:43 2016 : Info: +- entering group authorize {...} Wed Aug 24 15:43:43 2016 : Info: ++[preprocess] returns ok Wed Aug 24 15:43:43 2016 : Info: ++[chap] returns noop Wed Aug 24 15:43:43 2016 : Info: ++[mschap] returns noop Wed Aug 24 15:43:43 2016 : Info: ++[digest] returns noop Wed Aug 24 15:43:43 2016 : Info: [suffix] No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 24 15:43:43 2016 : Info: [suffix] No such realm "NULL" Wed Aug 24 15:43:43 2016 : Info: ++[suffix] returns noop Wed Aug 24 15:43:43 2016 : Info: [eap] No EAP-Message, not doing EAP Wed Aug 24 15:43:43 2016 : Info: ++[eap] returns noop Wed Aug 24 15:43:43 2016 : Info: [files] users: Matched entry DEFAULT at line 58 Wed Aug 24 15:43:43 2016 : Info: ++[files] returns ok Wed Aug 24 15:43:43 2016 : Info: ++[expiration] returns noop Wed Aug 24 15:43:43 2016 : Info: ++[logintime] returns noop Wed Aug 24 15:43:43 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Aug 24 15:43:43 2016 : Info: ++[pap] returns noop Wed Aug 24 15:43:43 2016 : Info: Found Auth-Type = PAM Wed Aug 24 15:43:43 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:43:43 2016 : Info: +- entering group authenticate {...} Wed Aug 24 15:43:43 2016 : Debug: pam_pass: using pamauth string <radiusd> for pam.conf lookup Wed Aug 24 15:43:44 2016 : Debug: pam_pass: function pam_authenticate FAILED for <testuser>. Reason: Cannot make/remove an entry for the specified session Wed Aug 24 15:43:44 2016 : Info: ++[pam] returns reject Wed Aug 24 15:43:44 2016 : Info: Failed to authenticate the user. Wed Aug 24 15:43:44 2016 : Info: Using Post-Auth-Type Reject Wed Aug 24 15:43:44 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:43:44 2016 : Info: +- entering group REJECT {...} Wed Aug 24 15:43:44 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testuser Wed Aug 24 15:43:44 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Aug 24 15:43:44 2016 : Info: ++[attr_filter.access_reject] returns updated Wed Aug 24 15:43:44 2016 : Info: Delaying reject of request 0 for 1 seconds Wed Aug 24 15:43:44 2016 : Debug: Going to the next request Wed Aug 24 15:43:44 2016 : Debug: Waking up in 0.8 seconds. Wed Aug 24 15:43:44 2016 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 180 to 10.33.4.100 port 29288 Wed Aug 24 15:43:44 2016 : Debug: Waking up in 4.9 seconds. Wed Aug 24 15:43:49 2016 : Info: Cleaning up request 0 ID 180 with timestamp +23 Wed Aug 24 15:43:49 2016 : Info: Ready to process requests. Below is the log from var/log/auth.log: Aug 24 15:43:43 oatr2radius01 freeradius: pam_winbind(radiusd:auth): getting password (0x00000380) Aug 24 15:43:44 oatr2radius01 freeradius: pam_winbind(radiusd:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS: NT_STATUS_LOGON_FAILURE, Error message was: Logon failure Aug 24 15:43:44 oatr2radius01 freeradius: pam_winbind(radiusd:auth): user 'testuser' denied access (incorrect password or invalid membership) Aug 24 15:43:44 oatr2radius01 radiusd(pam_google_authenticator)[10570]: Invalid verification code Aug 24 15:43:44 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): getting password (0x00000000) Aug 24 15:43:44 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS: NT_STATUS_WRONG_PASSWORD, Error message was: Wrong Password Aug 24 15:43:44 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): user 'testuser' denied access (incorrect password or invalid membership) However, i noticed when I only enter the AD password instead of AD Password+token, i get the following output: rad_recv: Access-Request packet from host 10.33.4.100 port 29288, id=181, length=612 User-Name = "testuser" User-Password = "4c330e@3O7K5" NAS-Port = 581632 Called-Station-Id = "10.33.3.100" Calling-Station-Id = "10.1.3.10" NAS-Port-Type = Virtual Tunnel-Client-Endpoint:0 = "10.1.3.10" Cisco-AVPair = "mdm-tlv=device-platform=win" Cisco-AVPair = "mdm-tlv=device-mac=02-00-4c-4f-4f-50" Cisco-AVPair = "mdm-tlv=device-mac=f0-1f-af-3c-1d-b0" Cisco-AVPair = "mdm-tlv=device-type=Dell Inc. XPS L421X" Cisco-AVPair = "mdm-tlv=ac-user-agent=AnyConnect Windows 4.2.03013" Cisco-AVPair = "mdm-tlv=device-platform-version=6.1.7601 Service Pack 1" Cisco-AVPair = "mdm-tlv=device-uid=26CC5FF8D17E0CF5A9DDDBA2E53009E17488F0B66E780F33A635AA1A7ABC26B9" NAS-IP-Address = 10.33.4.100 Cisco-AVPair = "audit-session-id=0a2103640008e00057bdf9bc" Cisco-AVPair = "ip:source-ip=10.1.3.10" Vendor-3076-Attr-146 = 0x4f414e444174657374 Vendor-3076-Attr-150 = 0x00000002 Cisco-AVPair = "coa-push=true" Wed Aug 24 15:53:53 2016 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:53:53 2016 : Info: +- entering group authorize {...} Wed Aug 24 15:53:53 2016 : Info: ++[preprocess] returns ok Wed Aug 24 15:53:53 2016 : Info: ++[chap] returns noop Wed Aug 24 15:53:53 2016 : Info: ++[mschap] returns noop Wed Aug 24 15:53:53 2016 : Info: ++[digest] returns noop Wed Aug 24 15:53:53 2016 : Info: [suffix] No '@' in User-Name = "testuser", looking up realm NULL Wed Aug 24 15:53:53 2016 : Info: [suffix] No such realm "NULL" Wed Aug 24 15:53:53 2016 : Info: ++[suffix] returns noop Wed Aug 24 15:53:53 2016 : Info: [eap] No EAP-Message, not doing EAP Wed Aug 24 15:53:53 2016 : Info: ++[eap] returns noop Wed Aug 24 15:53:53 2016 : Info: [files] users: Matched entry DEFAULT at line 58 Wed Aug 24 15:53:53 2016 : Info: ++[files] returns ok Wed Aug 24 15:53:53 2016 : Info: ++[expiration] returns noop Wed Aug 24 15:53:53 2016 : Info: ++[logintime] returns noop Wed Aug 24 15:53:53 2016 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Aug 24 15:53:53 2016 : Info: ++[pap] returns noop Wed Aug 24 15:53:53 2016 : Info: Found Auth-Type = PAM Wed Aug 24 15:53:53 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:53:53 2016 : Info: +- entering group authenticate {...} Wed Aug 24 15:53:53 2016 : Debug: pam_pass: using pamauth string <radiusd> for pam.conf lookup Wed Aug 24 15:53:53 2016 : Debug: pam_pass: function pam_authenticate FAILED for <testuser>. Reason: Authentication failure Wed Aug 24 15:53:53 2016 : Info: ++[pam] returns reject Wed Aug 24 15:53:53 2016 : Info: Failed to authenticate the user. Wed Aug 24 15:53:53 2016 : Info: Using Post-Auth-Type Reject Wed Aug 24 15:53:53 2016 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Wed Aug 24 15:53:53 2016 : Info: +- entering group REJECT {...} Wed Aug 24 15:53:53 2016 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testuser Wed Aug 24 15:53:53 2016 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Aug 24 15:53:53 2016 : Info: ++[attr_filter.access_reject] returns updated Wed Aug 24 15:53:53 2016 : Info: Delaying reject of request 1 for 1 seconds Wed Aug 24 15:53:53 2016 : Debug: Going to the next request Wed Aug 24 15:53:53 2016 : Debug: Waking up in 0.6 seconds. Wed Aug 24 15:53:54 2016 : Info: Sending delayed reject for request 1 Sending Access-Reject of id 181 to 10.33.4.100 port 29288 Wed Aug 24 15:53:54 2016 : Debug: Waking up in 4.9 seconds. Wed Aug 24 15:53:59 2016 : Info: Cleaning up request 1 ID 181 with timestamp +633 Wed Aug 24 15:53:59 2016 : Info: Ready to process requests. And /var/log/auth.log shows: Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): getting password (0x00000380) Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): user 'testuser' granted access Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): getting password (0x00000000) Aug 24 15:53:53 oatr2radius01 freeradius[10570]: pam_winbind(radiusd:auth): user 'testuser' granted access I sincerely hope that someone can help me out Thanks Guys!

3 2

FR 3.0.11, RadSec, validation via an external command
by Martin Stanislav 23 Sep '16

23 Sep '16

Hi, May I ask for your comment on how to fix/deal with two issues I've experienced with FR 3.0.11? Required funcionality: RadSec TLS peer/client certificate to be validated by an external command. AFAIU certificate validation by external command (i.e. tls configuration stanza verify) requires ocsp to be enabled, accordig to FR 3.0.11 documentation. Issue 1 (OCSP checks fail for a RadSec client): FR 3.0.11 is passing a null-valued cert. store pointer over to openssl's function OCSP_basic_verify() resulting in segfault within openssl's libcrypto. Prior FR code attempt to fill ocsp_store pointer via SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_STORE) call is of no help as FR 3.0.11 code path doesn't seem to invoke a corresponding SSL_set_ex_data() function call for a RadSec client TLS connection. I'm not sure what a correct fix should look like. I've replaced the function call: ocsp_store = (X509_STORE *)SSL_get_ex_data(ssl, FR_TLS_EX_INDEX_STORE); by a reference: ocsp_store = conf->ocsp_store; for purpose of a local test as conf->ocsp_store is already initialized at that point in code. Issue 2 (validation via external command blocked by if clause): Even if ocsp check is enabled, there seems to be little chance for external validation to kick in. Contrary to FR 3.0.11 documentation, the code requires two contending conditions to be satisfied at once. These conditions prevent external validation command from beeing called in case prior ocsp check returns OK. Local interim/test fix for both issues is attached. Thanks for your comments. Kind regards, Martin

2 3

HOW TO CHANGE PUBLIC IP RANDOMLY EVERY TIME USER CONNECT.
by Zubair Ayub 23 Sep '16

23 Sep '16

my user get every time same public ip i want to do that my user should get new public ip every time he connect.. i am not using ippool file . my ips are stored in radgroupreply. my table content id,groupname,attribute,op,value 39 1024 Service-Type == Framed-User 40 1024 Mikrotik-Address-List = 1024 43 1024 Framed-Pool == all-ips 42 1024 Framed-Protocol == PPP thanks regards zubairayub

4 18

rlm_acct_unique missing in current version of Freeradius
by Mike Ely 22 Sep '16

22 Sep '16

At least, the Centos7 package is. I'm trying to port an install over from a Centos5 box and see acct_unique all over the configs, with a corresponding log error: Failed to link to module 'rlm_acct_unique': rlm_acct_unique.so: cannot open shared object file: No such file or directory RPM tells me that rlm_acct_unique.so came with the freeradius2 package on Centos5. So I guess my question is: has this module been deprecated/removed, or is it just missing from the vendor package for some reason? Thanks, Mike

2 2

More OpenSSL badness
by Alan DeKok 22 Sep '16

22 Sep '16

Yet another list of vulnerabilities has been released for OpenSSL. The big one is this: > A malicious client can send an excessively large OCSP Status Request extension. > If that client continually requests renegotiation, sending a large OCSP Status > Request extension each time, then there will be unbounded memory growth on the > server. This will eventually lead to a Denial Of Service attack through memory > exhaustion. Servers with a default configuration are vulnerable even if they do > not support OCSP. https://www.openssl.org/news/secadv/20160922.txt <sigh> Time for everyone to upgrade OpenSSL. Again. Alan DeKok.

1 0

Re: return statement failure
by John Kristoff 22 Sep '16

22 Sep '16

On Thu, 22 Sep 2016 14:53:27 +0000 Alan DeKok <aland(a)deployingradius.com> wrote: > Upgrade to a recent version of the server. Fair enough thanks, I'll advocate for using a recent stable tarball instead of a packaged version. > Features which are undocumented are ones which probably don't work. Hah, apparently. Legacy installs are confusing, especially when they did things they shouldn't have done. There is another place in the config that has this and doesn't result in any noticeable errors: authorized { eap { ok = return } *shrug* Time to go through the config and validate everything else that might be a little wonky. Thanks for your help, John

2 1

Re: return statement failure
by John Kristoff 22 Sep '16

22 Sep '16

On Thu, 22 Sep 2016 14:23:36 +0000 Alan DeKok <aland(a)deployingradius.com> wrote: > There's a "return" statement. > > if (ok) { > return > } Thanks Alan, but I'm still a little confused. If I have this: post-auth { if (ok) { return } That results in this: # Loading post-auth {...} /etc/raddb/sites-enabled/default[...]: Failed to find "return" in the "modules" section. /etc/raddb/sites-enabled/default[...]: Failed to parse "return" entry. /etc/raddb/sites-enabled/default[...]: Errors parsing post-auth section. If I replace the return with a noop, no errors. What am I missing now? John

2 1

return statement failure
by John Kristoff 22 Sep '16

22 Sep '16

Hello freeradius-users@, Using a packaged version 3.0.4 on a RedHat box I have in a sites-enabled/default config something that looks like this: post-auth { if (foo == barr { # do something ok = return } which results in this output with -X: # Loading post-auth {...} /etc/raddb/sites-enabled/default[...] Invalid return code assigment inside of a if section /etc/raddb/sites-enabled/default[...]: Errors parsing post-auth section. If I change 'ok = return' to just return this is the result: # Loading post-auth {...} /etc/raddb/sites-enabled/default[...]: Failed to find "return" in the "modules" section. /etc/raddb/sites-enabled/default[...]: Failed to parse "return" entry. /etc/raddb/sites-enabled/default[...]: Errors parsing post-auth section. If I remove the line with the 'return' in it, radiusd starts up just fine. I must be missing something obvious? This is adapted from a prior installation with 2.x, which apparently used to work. I'm a bit new to using FreeRADIUS and hopefully only a gentle whack with the clue bat is needed. Thanks for the clue in advance. John

3 3

Substrings with unlang
by Mikhail Sutormin 22 Sep '16

22 Sep '16

Greetings, We are running a VM with FR3 in Azure which authenticates users with their O365 credentials against Azure ADDS. The problem is a legacy 20 characters limitation of SamAccountName attribute. I strip "@domain.com" part off O365 username before passing it to ntlm_auth but some users have very long names so "sampleverylongusername" is truncated to "sampleverylonguserna" in DC. How do I right a simple check to truncate it in FR? I'm not skilled in regular expressions. So I've tried if (Stripped-User-Name =~ /(.{0,19})$/) { update request { Stripped-User-Name := "%{1}" } } but that cuts off first 20 characters and leaves the rest.

2 1

freeradius 3 ntln_auth
by Anderson Gomes 21 Sep '16

21 Sep '16

Hello, I have implemented in my centos7 freeradius 3 so far succeeded, authenticate users through Active Directory using ntlm_auth however I'm having trouble implementing rules at the level of user groups to determine which user can authenticate each SSID i tryed implement what it says on the link bellow, but I did not succeed. https://lists.freeradius.org/pipermail/freeradius-users/2014-August/073474.… if (NAS-Port-Type == Wireless-802.11) { # If User-Name doesn't contain our domain then add it. # It's needed for the Group check to use the correct # username. if (User-Name !~ /DOMAIN\\\\/i) { update request { User-Name := "DOMAIN\\\\%{User-Name}" } } if (Called-Station-Id =~ /.*:SSID-A/i) { # Can't do 'if (Group != "xxxxx")' because != # operator doesn't work for group checking. Careful # with the number of backslashes. if (!(Group == "DOMAIN\\\\group A") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } elsif (Called-Station-Id =~ /.*:SSID-B/i) { if (!(Group == "DOMAIN\\\\group B") ) { update reply { Reply-Message = "User not allowed to join this wireless network" } reject } } }

2 1