- Freeradius-Users - lists.freeradius.org

Help - ASN-GW throwing error - Validation of attributes failed
by Rathod Subhashchandra 19 Mar '12

19 Mar '12

Dear All, I am trying to setup EAP-TLS authentication mechanism for my WiMAX testing and following are the details. 1. TATA ELXSI - WIMAX MS 2. TATA ELXSI - WIMAX BS 3. ARICENT ASN-GW version 4.2 4. Free Radius AAA server version 2.1.3 Certificates exchange is through. When AAA server responds with Access-Accept, ASN-GW throws error saying "Validation of the Attributes in the Received packet failed" Wireshark logs @ ASN-GW I could not attach wireshark pcap logs due to size constraint. I have took print screen of only ACCESS-ACCEPT message copied to MS word. What are the mandatory fields in Access-Accept and their valid values? Service-Type attribute value is 2. ASN-GW is adding this attribute. Is this valid for EAP-TLS? I am guessing this should be 8. I don't have control over ASN-GW parameters modification. Please let me know what fields are invalid in above ACCESS-ACCEPT. Thanks ! Rathod.

6 10

Re:Inserting NT-Passwords in MySQL database
by pamela pomary 18 Mar '12

18 Mar '12

Thank you Alan and Alan, it worked. :) # radtest -t mschap viola password localhost 0 key Sending Access-Request of id 67 to 127.0.0.1 port 1812 User-Name = "viola" NAS-IP-Address = x.x.x.x NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 MS-CHAP-Challenge = 0xb8aa006ef4040d71 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000037cfefe932713bd369dc9bbaa3e35b25d2316e83ae73db95 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=67, length=84 MS-CHAP-MPPE-Keys = 0x0000000000000000493adff9cf9839a289e3c19d21c8a4310000000000000000 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000006

1 0

Inserting NT-Passwords in MySQL database
by pamela pomary 18 Mar '12

18 Mar '12

Hello once again, Please how can I insert into MySQL database, encrypted passwords for radius users. In an earlier mail I posted to the list, Phil suggested NT hash (MD4 of little-endian UTF-16 form password) since it was *not possible to do* *MD5 with mschap. * I have tried to do: insert into radcheck(userName,Attribute,op,value) values ('test','NT-Password',':=',NT-hash( 'password' )); but it failed because I guess it doesn't exist. I edited ntlm_auth module to specify the path for ntlm_auth like this #######/ etc/raddb/modules/ntlm_auth ###### exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=MYDOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } I dont know how to apply ntlm_auth to cleartext passwords to insert into MySQl database. How can I achieve encrypting password for radius users in MySQL using NT-Password. Thank You.

3 2

Two-Factor Auth using FreeRADIUS
by Ryon Day 17 Mar '12

17 Mar '12

Hello all, long-time reader, first time poster to this list. I've watched many posters go down in flames on this list, so I'm going to try to learn from their mistakes and be as precise as possible; I'm also going to make it known at the outset that I have read all the documentation that I can get my hands on and I am running FreeRADIUS -X to start it in debug mode! I am attempting to implement two-factor authentication with LDAP combined with FreeRADIUS. As you probably know at this point, many SSL-VPN and network control devices only offer both LDAP/AD and RADIUS authentication for their devices (some have native SecurID support as well). The client is authenticating users with Active Directory as the first-level auth. It is on the second-level auth that I have questions. The authentication mechanism that we are using for the second-factor authentication is a one-time password sent to the user via an out-of-band mechanism. Therefore, this requires two different interactions with the RADIUS server: 1: Access-Request: SSL-VPN -> FreeRADIUS. This sends the username (and another piece of data that I am currently putting in the password field) to the RADIUS server. *At this point, I have written a JRadius component: * On the SSL-VPN side I have PAP authentication selected. That is because as above, I am using the password field to transfer another piece of data (the delivery method) to RADIUS. * It resides in the "authorize" stage of the "default" site in FreeRADIUS * It looks the user up in LDAP (again) to obtain his/her E-Mail address to send. It then sends the OTP to the e-mail address. This part works perfectly! * Then, I construct a new Access-Challenge packet in JRadius, creating a new State and copying the initial Access-Request packet's identifier, and return from the JRadius handler. This part also works perfectly. 2: Access-Challenge: FreeRADIUS -> SSL-VPN device This step is where the wheels are falling off the bus. FreeRADIUS does not seem to want to send out my Access-Challenge packet; it automatically changes it to an Access-Reject. I have even put another handler in the post-auth reject handler to change it BACK to a Access-Challenge. At that point if I do that, FreeRADIUS' debug mode reports that it is sending an Access-Request packet to the IP address of the NAS (or my RADIUS test program)! 3: Access-Request (original Using state and Packet ID so I can identify the request on the back-end JRadius component) * Compare passed OTP to stored OTP for that "session". Act accordingly. * Obviously this step does not yet work! I have tried many permutations of Auth-Methods. Since I am using PAP authentication on the SSL-VPN side, I initially chose that module, however it really does not like my sending that Access-Challenge packet out. I have tried commenting lots of things out, even using jradius in the 'PAP' handler of the authentication section. At that point, even though the PAP module is not running, FreeRADIUS puts the kibosh on my Access-Challenge packet. This leads me to believe that FreeRADIUS has a very rigid idea of what these packets should be depending on auth method. Is there really no use case at all for PAP where you would ever send an access challenge? Are there any "dummy" auth methods that just, well, let me do whatever the hell I want? Is it possible to implement a new Auth method like this? Questions: * Is there any way with current functionality, I can Implement a custom challenge flow like the one I am describing? * Are there examples of this kind of functionality out there "in the wild" that I can look at and use as a model? * I greatly enjoy working with JRadius in spite of its occasional wonkiness, but I can dust off my C if necessary. Is some sort of JRadius handler combined with C FreeRADIUS mods possible? I do not mind writing code if it is necessary, but of course I'd prefer not to if it's at all avoidable! (Is this a question better posed to the dev list?) Thank you for any help or guidance you can give me in this matter!

3 5

Re: Add Users in MySQL database
by Fabricio Flores 17 Mar '12

17 Mar '12

Mmm I have a web service so I have users and password... So If somebody wants to login in the captive portal first i want to see in the web service if ther is this user, and if the user exists i add the user in the mysql database and freeradius athenticate thes user from the mysql database... El 16/03/2012 19:37, "Alan Buxey" <A.L.M.Buxey(a)lboro.ac.uk> escribió:

3 5

IF-MAP Support
by Francois Gaudreault 17 Mar '12

17 Mar '12

Hello, I believe some work have been done on this topic lately with external log modules to populate an IF-MAP database, correct? I am wandering if there is a "working -as-PoC" piece of code available somewhere? We are interested in testing and add the support for IF-MAP in PacketFence (long term project). Thanks! -- Francois Gaudreault, ing. jr fgaudreault(a)inverse.ca :: +1.514.447.4918 (x130) :: www.inverse.ca Inverse inc. :: Leaders behind SOGo (www.sogo.nu) and PacketFence (www.packetfence.org)

3 3

Re: Add Users in MySQL database
by Alan Buxey 16 Mar '12

16 Mar '12

This isn't a freeradius question, thus is a mysql question. There are many many tools, webfront ends and scripts that you can use. One simple one actually comes with freeradius, others are eg Daloradius or php_mysqladmin alan

3 4

proxy server goes deaf after "Client has closed connection" (RadSec to home server)
by Brian Julin 16 Mar '12

16 Mar '12

It appears there was another layer to my latest issue. Sometimes a server using RadSec to proxy to a home server ends up just waiting around unable to see any more incoming requests, and not having completed the current request. In this case the server is 3.0, and is sandwiched between our internal instance and our federation server (doing radsecproxy-ish stuff.) This may only happen in a corner case when the federation server is taking a while to reply, perhaps in this case where it exceeds our internal instance's response_window. I'm testing now whether using an immense response_window on the internal instance works as a workaround (assuming the federation server doesn't have any prolonged issues, of course) which would help support that theory. Info: (32) Proxying request to home server XXX.XXX.XXX.XXX port 2083 Tue Mar 6 13:59:08 2012 : Debug: Proxy is writing 122 bytes to SSL Tue Mar 6 13:59:08 2012 : Debug: Thread 3 waiting to be assigned a request Tue Mar 6 13:59:08 2012 : Debug: Proxy SSL socket has data to read Tue Mar 6 13:59:08 2012 : Debug: Client has closed connection (though, the client is UDP which has no transport layer connection, so... maybe that's talking about the home server, not a client? Not sure if that's coming from listen.c or tls_listen.c) (at this point the server does not see any additional requests sent to it, so we kill it to see if it is hanging out anywhere interesting... really should do this several times more to verify... maybe try a kill -9 next time...) Program received signal SIGINT, Interrupt. 0x0000003c7520dff4 in __lll_lock_wait () from /lib64/libpthread.so.0 #0 0x0000003c7520dff4 in __lll_lock_wait () from /lib64/libpthread.so.0 #1 0x0000003c75209328 in _L_lock_854 () from /lib64/libpthread.so.0 #2 0x0000003c752091f7 in pthread_mutex_lock () from /lib64/libpthread.so.0 #3 0x000000000042bb54 in remove_from_proxy_hash (request=0x805170) at process.c:1579 #4 0x000000000042d4f5 in request_done (request=<value optimized out>, action=<value optimized out>) at process.c:532 #5 0x000000000042f42d in remove_all_proxied_requests ( ctx=<value optimized out>, data=<value optimized out>) at process.c:1540 #6 0x00007ffff7de7822 in WalkNodeInOrder (X=<value optimized out>, callback=0x42f400 <remove_all_proxied_requests>, context=0x7fffec003710) at rbtree.c:551 #7 0x0000000000431354 in event_new_fd (this=0x7fffec003710) at process.c:3553 #8 0x000000000043c648 in proxy_tls_recv (listener=0x7fffec003710) at tls_listen.c:499 #9 0x0000000000430a8a in event_socket_handler (xel=<value optimized out>, fd=<value optimized out>, ctx=0x7fffec003710) at process.c:3309 #10 0x00007ffff7deddfb in fr_event_loop (el=0x7d0b10) at event.c:415 #11 0x0000000000422534 in main (argc=<value optimized out>, argv=<value optimized out>) at radiusd.c:413 Just one of those occasions where the grass looks greener on the SEGV side of the fence :-)

2 6

md5 passwords in mysql database
by pamela pomary 16 Mar '12

16 Mar '12

Hello Please I have a challenge encrypting passwords using md5 in MySQL database for radius users. When I do a radtest like this: radtest test password localhost 0 key for user test with md5(password) in MySQL database it is successful. However when do this : radtest -t mschap testmd5 password localhost 0 key, I get MS-CHAP Error Sending delayed reject for request 0 Sending Access-Reject of id 143 to 127.0.0.1 port 55008 MS-CHAP-Error = "\000E=691 R=1" I read online,it is not possible to do md5 with MS-CHAP. I don't want to save users passwords in clear text. How can I achieve encrypting user's passwords in MySQL database. I have Freeradius2.1.12 installed. Please I will be grateful for suggestions. I have the following in modules #### /etc/raddb/modules/pap ### pap { auto_header = yes encryption_scheme = md5 } #### /etc/raddb/modules/mschap ### mschap { use_mppe = yes require_encryption = yes } Any help will be very much appreciated Thank You ---- Pamela Pomary ICTD, University of Ghana.

2 1

LDAP Search Questions
by ryuukuu 16 Mar '12

16 Mar '12

Hello All, I've got a question about the settings for limiting access/authenticating to a specific LDAP group. I have setup a group on my OpenLDAP called "RADIUS" and I want the users in there to be the only ones that have access. The problem I am having is with the filters. Below is my /etc/raddb/modules/ldap (given I cleaned up alot of the comments just for posting reasons) server = "example.com" port = "389" identity = "cn=example,dc=company,dc=local" password = xxxxx basedn = "ou=People,dc=company,dc=local" # access_attr = ? # filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" # filter = "(objectclass=ogranizationalPerson)(de" # base_filter = "(objectclass=organizationalPerson)" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no # cacertfile = /path/to/cacert.pem # cacertdir = /path/to/ca/dir/ # certfile = /path/to/radius.crt # keyfile = /path/to/radius.key # randfile = /path/to/rnd # require_cert = "demand" } # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" # access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap password_attribute = userPassword auto_header = yes # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName # compare_check_items = yes # do_xlat = yes # chase_referrals = yes # set_auth_type = yes } -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-Search-Questions-tp5565845p556… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3