- Freeradius-Users - lists.freeradius.org

Escaped backslash in User-Name when sending Access-Accept
by Roberto Franceschetti 22 May '12

22 May '12

Hi, I'm having some issues authenticating iOS clients (with FreeRADIUS v2.1.10 installed on a Ubuntu server) with EAP-TLS when the username contains a domain name in the form of Domain\Username (the account is in Active Directory). I think the issue is caused by the fact that the final Access-Accept reply has the backslash after the domain name escaped, so that the output looks like this: Sending Access-Accept of id 171 to 172.27.28.84 port 32769 User-Name = "ocg\\cmctrf3" instead of containing the original, un-escaped domain\username: Sending Access-Accept of id 171 to 172.27.28.84 port 32769 User-Name = "ocg\cmctrf3" Mine is just a theory, but I cannot verify it until I figure out how to have the un-escaped ocg\cmctrf3 string being sent in the output instead of the current escaped one. So my question is "how do I cause the User-Name to be send un-escaped? Do I make a change in the clients.con file...? The eap.conf file...? If so, under which section and where..? Sorry for what may look like a dumb question, but I could not find this mentioned anywhere else. As a side-note, if I omit the domain name in the iOS device and just login with the username "cmctrf3" for example, the iPhones/iPads are able to login without problems. The issue only occurs when the domain name appears before escaped. All other devices (Windows and Mac desktops) seem to be able to get past that escaped sequence without problems. Below is a blurb showing the debug output. I do see the un-escaped ocg\cmctrf3 being logged, but the escaped one at the end is what is porbably biting me. Thanks, Roberto Franceschetti # Executing section authorize from file /etc/freeradius/clients.conf +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "ocg\cmctrf3", skipping NULL due to config. ++[suffix] returns noop [ntdomain] Looking up realm "ocgov" for User-Name = "ocg\cmctrf3" [ntdomain] No such realm "ocgov" ++[ntdomain] returns noop ++[mschap] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/clients.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [ocg\\cmctrf3] (from client 172.27.28.84 port 29 cli f0-cb-a1-2b-61-4d) # Executing section post-auth from file /etc/freeradius/clients.conf +- entering group post-auth {...} ++[exec] returns noop } # server lwap-clients Sending Access-Accept of id 171 to 172.27.28.84 port 32769 MS-MPPE-Recv-Key = 0x15c9ba070e3579e43c54314c24e7e09f4753c779e4e013b4bbd080a2cab4bbb2 MS-MPPE-Send-Key = 0x4f27c90c8fdf27be122e70c2c4d82bebd65797dafebe2ebb4ca91bedfd244cb5 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ocg\\cmctrf3" PLEASE NOTE: Florida has a very broad public records law (F. S. 119). All e-mails to and from County Officials are kept as a public record. Your e-mail communications, including your e-mail address may be disclosed to the public and media at any time.

3 2

Test Client which supports PAP Access-Challenge
by Thomas Glanzmann 21 May '12

21 May '12

Hello, I'm interested in a radius test client which supports pap ACCESS-Challenge. Can anyone point me to one or to a library which allows me to easily write on preferrably in perl? Cheers, Thomas

2 6

2 Certs for 2 SSID (802.1x)
by C.F. Yeung 21 May '12

21 May '12

We have 2 SSL Certs for two SSID (802.1x). How can my freeradius server present wifi clients the cert based on SSID? Should I have two eap.conf? Thanks, CF

4 10

Using attibutes
by Emmanuel BILLOT 21 May '12

21 May '12

Hi, Our WIFI access is managed by EAP-TTLS/EAP-PEAP with radius authentication based on LDAP. So users can connect and use Internet, however is possible to limit access (bandwith, connecting time) with Freeradius ? In other words, it seems (maybe i'm wrong) that Freeradius can send attribut with values when answering with Access Accept packet. I guess that clients have to understand it for being effective right ? So when using access point with EAP protocol, i guess native EAP client have to be compatibe with an attribut list ? This behaviour seems to be implemented in captive portal, and attributes can be managed in portal configuration. Is it possible with EAP access (native client or secure w2 like ?) BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 4

Re: PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
by Bruce Nunn 19 May '12

19 May '12

For my installations I've disabled the EAP cache to make things work better. Only a few users noticed. Does anyone know if the same thing happens In the 3.0 branch? I was planning to put one of my production servers on the 3.0 code this Summer. Alan DeKok <aland(a)deployingradius.com> wrote: >Phil Mayers wrote: >> Am I being dumb / getting something wrong or does the post-auth session >> not get called if PEAP/MSCHAP returns a reject? >> >> It seems to run for successful auths, but not failures. > > That is the case. > >> This is in the context of us not seeing log messages for EAP auth >> failures; I suspect that the client may just "hang up" and let the EAP >> session expire, and since the inner post-auth doesn't run, and the outer >> session expires, I have no logs. > > There was talk about getting it to do Post-Auth-Type Reject in the >inner tunnel. No code yet, tho. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

FreeRadius proxy to MS-NPS for MSCHAPv2 authentication.
by Jan Hugo Prins 19 May '12

19 May '12

Hi, This last week I have been setting up my Aruba environment authenticating users that are in OpenLDAP and all have a Windows Password etc. This installation worked straight out of the box and the part that took most of the time was making a clean setup that I can copy paste to other installations etc and getting to know unlang. So far so good. Now the next question is our partner that is a full M$ shop. They have a Windows ADS environment and all windows users. My first idea was to use proxy.conf to proxy all users with a username of user(a)domain.com to the MS-NPS server on the Windows ADS. Is this going to work with MSCHAPv2 authentication? I would expect so. If this is going to work my next problem is adding some things to access-accept replies. I need to add: Aruba-User-Vlan = <vlanid> Aruba-User-Role = <authenticated-role> The first one is to set the proper VLAN and the second one is to move the user to an authenticated role of this M$-Shop. Can this be done somewhere in the proxy.conf on the proxy-reply? I really don't want to install Samba on the FreeRadius server and make it authenticate to the ADS, this is because it doesn't scale on the long run if you need to authenticate to more then one ADS environment. I also read that their are some issues with the radius packets that are accepted by the MS-NPS server, with the risk that the packets are dropped at the MS-NPS side. Does someone have a overview of what should be in the radius packets and what should not be in them? Thanks a lot, Jan Hugo Prins

3 5

PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
by Phil Mayers 19 May '12

19 May '12

Am I being dumb / getting something wrong or does the post-auth session not get called if PEAP/MSCHAP returns a reject? It seems to run for successful auths, but not failures. This is in the context of us not seeing log messages for EAP auth failures; I suspect that the client may just "hang up" and let the EAP session expire, and since the inner post-auth doesn't run, and the outer session expires, I have no logs. This is in 2.1.12

3 3

Online Users
by Shawky Skaff 18 May '12

18 May '12

Hi, When viewing the online users and I wish to drop or clear the connection, nothing actually happens. Is there anything that I need to do to get this working? Maybe linking this to my NAS somehow, as if I clear the connection from my NAS, it seems to do the job Kind Regards, Shawky Skaf ____________________________ [Description: Description: cid:710305523@08062009-0910] iVox Communications www.ivox.com.au<http://www.ivox.com.au/> P: +61 2 8252 0205 F: +61 2 8252 0202 The contents of this document may be privileged and confidential, any unauthorised use of the contents is expressly prohibited. If you are not the intended recipient, any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. iVox Communications is not liable for the proper and complete transmission of the information contained in this communication, nor for any delay in its receipt.

2 1

Quota in DCCA
by yagizozen 18 May '12

18 May '12

Hello everyone, I am using DCCA in one of the systems. And I know that DCCA grant a quata when a request comes from GGSN. For Example, when a access request come from GGSN, DCCA rejects it depending on the AVPs OR accept the request and sends a predefined QUOTA to the GGSN so that after the user finish that quota, it returns and asks for more quota. When I take a snoop between GGSN and DCCA, I see a grouped AVP called "Multiple Services Credit Control" and inside this grouped AVP, it contains the quota and other information that is send to GGSN with the accept packet. If I implement this grouped AVP to the radius Access-ACCEPT packet, does it work? The GGSN is the same. Also can you help me about creating a GROUPED AVP?? sending a user-defined AVP is easy but how can I group more than one AVPs? Thank you very much. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Quota-in-DCCA-tp5711335.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

FreeRadius unable to read password from LDAP query to win2008 AD
by sonyisda1 17 May '12

17 May '12

Using FreeRadius on Ubuntu 12.04 FreeRadius is communicating with Windows 2008 R2 Active Directory server. I have MS-CHAP authentication working fine. This is used for VPN. I am setting up LDAP authorization and CHAP authentication. This will be used for router login. The router has the radius configuration pointing to FreeRadius box. >From the logs, the LDAP authorization appears to bind correctly but is unable to retrieve a clear password for the user account and thus user cannot be authenticated with CHAP. [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? I believe above indicates that no data is received from LDAP query and no password is retrieved. I have attached relevant debug log output and config files. http://freeradius.1045715.n5.nabble.com/file/n5711532/freeradius_-_x.txt freeradius_-_x.txt output from running freeradius server in debug mode http://freeradius.1045715.n5.nabble.com/file/n5711532/router_connection_att… router_connection_attempt.txt output from connection attempt for router http://freeradius.1045715.n5.nabble.com/file/n5711532/default.txt default.txt /etc/freeradius/sites-available/default http://freeradius.1045715.n5.nabble.com/file/n5711532/inner-tunnel.txt inner-tunnel.txt /etc/freeradius/sites-available/inner-tunnel http://freeradius.1045715.n5.nabble.com/file/n5711532/ldap.txt ldap.txt /etc/freeradius/modules/ldap -- View this message in context: http://freeradius.1045715.n5.nabble.com/FreeRadius-unable-to-read-password-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3