- Freeradius-Users - lists.freeradius.org

LDAP/MSCHAP
by Whitlow, Michael 15 Nov '11

15 Nov '11

All, I am really close to a successful Freeradius implementation for 802.1X wireless using LDAP authentication on the back end. Here is what I have: - RADTEST / clear text Freeradius password from "users" file / WORKS GREAT - Windows XP 802.1X PEAP/MS-CHAPv2 wireless client / clear text Freeradius password from "users" file / WORKS GREAT - RADTEST / LDAP credentials / WORKS GREAT - Windows XP 802.1X PEAP/MS-CHAPv2 wireless client / LDAP credentials / NO GO Here is the debug output. I have read others online with these symptoms but nothing I have found yet will help me. [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Creating challenge hash with username: mwhitlow [mschap] Told to do MS-CHAPv2 for mwhitlow with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect Thanks much in advance for the help! Mike

10 20

Issues with EAP-TLS and OpenSSL
by Houston-III, Lester L 15 Nov '11

15 Nov '11

I'm trying to configure my FreeRADIUS server to support EAP-TLS but it keeps reporting that there is no OpenSSL support. I'm currently using FreeRADIUS version 2.1.12 on Centos 6. I built the server from source because I needed to include the JRADIUS plugin. I have been able to get things working with the JRADIUS and PAP, but now I'm trying to use EAP-TLS. I have already installed OpenSSL core, static and development packages using yum. Issuing the configure commands always results in a statement that OpenSSL is not supported, (Checking for OpenSSL support .. no) What I'm I missing? Does another package needs to be installed? Lester Houston 111 Boeing Research & Technology Electronics Prototyping and Integration Center (EPIC) lester.l.houston-iii(a)boeing.com 314-234-0621

2 6

Re:ldap error
by Harshavardhan Ch 15 Nov '11

15 Nov '11

Hello, i am new to radius server,i made more changes in *user*s configuration file ("/usr/local/etc/raddb/:vi users") ,after configuring (radiusd -X) radius server was not configured ,output doesn't generate any *errors* or *warnings*, i attached the output file . please help me

2 1

PEAP/mschapv2 - opendirectory
by Kemal YILDIRIM 15 Nov '11

15 Nov '11

Hello all, I've just able to implemented Wired 802.1x system with PEAP/mschapv2 authentication against opendirectory which is running on MacOSX server 10.6.8 Leopard. At the end I have a "working" setup, but I like to learn more to fix my faults. below you can find my study steps and config changes And these are my question regarding to the following outputs. Q1- Is it possible to get radius attributes with opendirectory module ( not well documented)? if yes, please share your experience. Q2- I am not sure what is happining during below mschap challenge/response. [mschapv2] +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] No NT-Password configured. Trying OpenDirectory Authentication. [mschap] OD username_string = onex, OD shortUserName=onex (length = 4) [mschap] dsDoDirNodeAuth returns stepbuff: S=D134BC291881FAF31275724FE84FEA40648F64C6 (len=40) ++[mschap] returns ok MSCHAP Success 　 1. Testbed: Auth Server : FreeRadius 2.1.3 running on MacOSX 10.6.8 Leopard, other services: opendirectory (openLDAP), Kerberos, DNS, DHCP Authenticator : HP Networking 2910 switchSupplicants : WindowsXPsp3, Windows7, MacOSX (PEAP/mschapv2)Directory Admin : diradmin Test User : onex authentication : opendirectory (mschap module is calling opendirectory module for challenge response) authorization : by ldap search in post-auth section inside of inner-tunnel server. authorization : settings are Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-Id (by ldap search) sql client db : Mac OSX serveradmin GUI have an access to configure radius clients (max count is 64), I am not using clients.conf as I understood Mac OSX server actually using openLDAP, but Apple named it as "opendirectory" by restricting and changing of access medhods. There was no radius schema file in Apple's distribution of FreeRadius, or at least I could not find it where it normally would be. So, downloaded the schema file and extended it manually. 　 2. LDAP schema extention and creating radius attributes for 802.1x /etc/openldap/slapd.conf include /etc/openldap/schema/radius.schema slaptest -f slapd.conf -F slapd.d /etc/openldap/slapd.d/cn=config/cn=schema/cn={10}radius.ldif dn: cn={10}radius 　 restart host or restart slapd dscl cd LDAPv3 auth diradmin abc123 cd 127.0.0.1/Groups/vlan10 create . radiusTunnelPrivateGroupId 10 cd .. cd vlan20 create . radiusTunnelPrivateGroupId 20 ... I will set Tunnel-Type and Tunnel-Medium-Type statically in post-auth section, radiusTunnelPrivateGroupId attribute is sufficiant in LDAP. 　 3. Radius config Non-default or changed parameters are written here. LDAP module will not be used for authentication, will be used only to set radiusTunnelPrivateGroupId Authentication would be done through opendirectory module by mschap call. MacOSX issue : without Apple base stations Radius service could not be started from serveradmin GUI need to be fixed by deleting some lines regarding BaseStation check in the following file. /Applications/Server/Server\ Admin.app/Contents/Resources/RoleBasedSetup.bundle/Contents/PlugIns/RadiusPlugin.plugin/Contents/Resources/RadiusSteps.plist 　 /private/etc/raddb/modules/ldap ldap { server = "radsrv.lab.com" identity = "uid=diradmin,cn=users,dc=radsrv,dc=lab,dc=com" password = abc123 basedn = "dc=radsrv,dc=lab,dc=com" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" // In my test only User-Name is used base_filter = "(objectclass=radiusprofile)" set_auth_type = no // As I know LDAP only working with pap authentication } 　 /private/etc/raddb/attrs DEFAULT Tunnel-Type == VLAN, Tunnel-Medium-Type == IEEE-802, Tunnel-Private-Group-Id =* ANY, 　 /Private/etc/raddb/ldap.attrmap checkItem User-Name uid // I am not able to check ntlm or other hashes, only uid check for "return noop" replyItem Tunnel-Type radiusTunnelType replyItem Tunnel-Medium-Type radiusTunnelMediumType replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId 　 /private/etc/raddb/radiusd.conf max_request = 16384 proxy_requests = no #$INCLUDE clients.conf // MAX Client count is 64 in sql db ( if I run out of space, will use clients.conf in addition) 　 /private/etc/raddb/proxy.conf realm LAB.COM { // doing nothing, but like to use it } /private/etc/raddb/eap.conf default_eap_type = peap #gtc #leap #md5 tls { private_key_password = Apple:UseCertAdmin private_key_file = "/etc/certificates/radsrv.lab.com.23C900DA0044BDB9E24ACE1BCFAFFB0747756C25.key.pem" certificate_file = "/etc/certificates/radsrv.lab.com.23C900DA0044BDB9E24ACE1BCFAFFB0747756C25.cert.pem" CA_file = "/etc/certificates/radsrv.lab.com.23C900DA0044BDB9E24ACE1BCFAFFB0747756C25.chain.pem" dh_file = /etc/raddb/certs/dh random_file = /etc/raddb/certs/random } peap { use_tunneled_reply = yes } /private/etc/raddb/sites-enabled/default authorize { #chap #unix #files #pap } authenticate { # Auth-Type PAP { # pap # } # Auth-Type CHAP { # chap # } # Auth-Type opendirectory { # opendirectory # } #unix # Auth-Type LDAP { # ldap # } ... } 　 /private/etc/raddb/sites-enabled/inner-tunnel authorize { #chap #mschap #unix #files #LDAP is checking uid only, enabled for post-auth section ldap #pap } authenticate { # Auth-Type PAP { # pap # } # Auth-Type CHAP { # chap # } } #unix #suffix # in ldap search radiusTunnelPrivateGroupId attribute is reached if cn=vl* AND memberUid=%{User-Name} # all group names need to start with "vl" # attribute value "10" returns in this case post-auth { update reply { Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-Id = "%{ldap:ldap:///dc=radsrv,dc=lab,dc=com?radiusTunnelPrivateGroupId?sub?(&(cn=vl*)(memberUid=%{User-Name}))}" } } 　 4. Switch Config, HP Networking 2910 switch is used in this testbed interface 1 name Supplicant interface 3 name RadiusServervlan 10 name CorporateVLAN ip add 10.10.10.1/24 ip helper 10.10.100.100 exit vlan 40 name UnauthVLAN ip add 10.10.40.1/24 ip helper 10.10.100.100 exit vlan 100 ip add 10.10.100.1/24 untag 3exit radius-server host 10.10.100.100 key 123 aaa authentication port-access eap-radius aaa accounting network start-stop radius aaa port-access authenticator 1 aaa port-access authenticator 1 unauth-vid 40 aaa port-access authenticator 1 client-limit 2 aaa port-access authenticator 1 control auto aaa port-access authenticator active

2 1

Help: FreeRadius Users with multiple passwords
by Duong Manh Truong 15 Nov '11

15 Nov '11

Hi all, I have encounter with an issue and can not find the solution after several days of thinking :( I set up FreeRadius & Mysql successfully, testing with some account ok, but my real case: Lot of my users *have more than 1 passwords*, Example: User: "truongdm" comes with the password "abc123" or the password "123abc" is both ok Please help me: How can i set it up? - I try to insert serveral records with the same "username" and difference "value" - password- in the "radcheck" table but at one time, the server accept 1 pair of "username/value" only :( - I try to edit the file "users" manually but no help ..... Anyone has had this matter, please help me find the direction! Thanks & Best Regards!

2 1

EAP-TLS CRL checking when multiple CAs used
by Martin Čmelík 15 Nov '11

15 Nov '11

Hi, I downloaded current stable freeradius version 2.1.12 and import configuration from old server (rewrite etc/raddb). Everything seems to be OK, but I must now add another two trusted CAs into ca.pem and also enable checking against CRL files as for other. Lets say that eap.conf is setup by default: tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random check_crl = yes CA_path = ${cadir} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" ecdh_curve = "prime256v1" cache { enable = no max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } One of our script downloading CRL files every 20 minutes, move them to certs directory and c_rehash them. It works for old certificates (4x CAs) but doesn't work for two which I add now. When somebody with certificate issued by new CA try to login I see this error in log: Thu Nov 10 12:56:51 2011 : Error: --> verify error:num=3:unable to get certificate CRL Thu Nov 10 12:56:51 2011 : Auth: Login incorrect (unable to get certificate CRL): [John Smith] (from client some-device port 29 cli AA-BB-CC-DD-EE-FF) Hash are generated well: lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 21e0d39d.r0 -> crl3.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 3cc8c9a0.r0 -> crl6.pem lrwxrwxrwx 1 radius radius 20 Nov 10 16:19 5a64316f.0 -> radius.crt lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 5be750ed.r0 -> crl2.pem lrwxrwxrwx 1 radius radius 20 Nov 10 16:19 68db0f86.0 -> radius.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 92b2a332.r0 -> crl5.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 b0f3e76e.r0 -> crl4.pem lrwxrwxrwx 1 radius radius 8 Nov 10 16:19 f31b716b.r0 -> crl1.pem lrwxrwxrwx 1 radius radius 6 Nov 10 16:19 f6efabfa.0 -> ca.pem ... My question is: How freeradius find correct CRL list and check if user certificate is still valid? This radius server has been setup by colleague many years ago and he cant remember how he do this :] Thank you very much because there is lack of any information about it on Internet — Martin Čmelík

3 7

Freeradius process crash receiving answers from Microsoft NPS Server
by IT Support 14 Nov '11

14 Nov '11

Good afternoon I'm a newbie with freeradius and I'm trying to configure a radius proxy server that makes to a server microsoft radius nps. I have a Enterasys C3 switch that sends auth requests to my Freeradius. If the request is for auth a MAC the FR auth locally, but if the request is for auth a windows user (EAP) the FR resend the request to the Microsoft NPS radius server. I use Debian 6.0 and the debian package of FR (version is 2.1.10). The problem is that when the Microsoft RADIUS server returns an accept packet, the freeradius server process dies. But if the answer is reject, the process works properly. When the process dies, only appears in the syslog the following line: "November 11 16:20:35 debian-radius kernel: [2380.591594] freeradius [1749]: segfault at 3934c708 b76fd497 ip sp error 4 in libfreeradius b5ae4970-radius-2.1.10.so [+1 b76ec000 E000]" Can anyone help me? Sorry for my poor English. Best greetings Toni

6 10

Removing domain prefix from login
by Alejandro Gandara 14 Nov '11

14 Nov '11

I'm authenticating users in RADIUS against LDAP, if I login from computer with 802.1x configured and users and password taken from domain automatic. Im getting wrong authenticated because the login has the following chain. DOMAIN\\Users How can i avoid that radius read the prefix? I've tried to introduce the option prefix in /etc/sites-enable/default , but its getting me back errors because of wrong way to introduce that line. Can any help me? Thanks very much

4 19

radius sql quastione
by Miha Zoubek 14 Nov '11

14 Nov '11

Hi, our freeradius is working with our softswitch perfect. All my columns in radacct are populating. Now I have set freeswitch and I also got it work with freeradius. This are two different softswitchs and I would like that bouth will populate same base. Problem appears as freeswitch is sending different attributes, so I make differences in dialup.conf (than the other softswitch will not populate right radacct table). Can I populate same base? But how to configure dialup.conf than? How can I set up in on radius to different base with to different dialup.conf (I must edit this file due to different attribute representation). Below you will find freeswitch attributes: rad_recv: Accounting-Request packet from host xxx.xxx.xxx.xxx port 33534, id=134, length=402 Acct-Status-Type = Stop Acct-Session-Id = "1d83c61f-3167-4c15-9da3-871cd76f3d7c" Freeswitch-Hangupcause = Normal-Clearing User-Name = "018108500" Freeswitch-Src = "018108500" Freeswitch-CLID = "018108500" Freeswitch-Dst = "051357952" Freeswitch-Dialplan = "XML" Framed-IP-Address = xxx.xxx.xxx.xxx Freeswitch-Context = "default" Freeswitch-Ani = "018108500" Freeswitch-Source = "mod_sofia" Freeswitch-Lastapp = "bridge" Freeswitch-Billusec = 2427061 Freeswitch-Callstartdate = "2011-11-09T14:30:45.095287+0100" Freeswitch-Callanswerdate = "2011-11-09T14:30:52.965479+0100" Freeswitch-Callenddate = "2011-11-09T14:30:55.392540+0100" Acct-Session-Time = 2 Freeswitch-Signalbond = "inbound" NAS-Port = 0 Acct-Delay-Time = 0 NAS-IP-Address = xxx.xxx.xxx.xxx # Executing section preacct from file /usr/local/etc/raddb/sites-enabled/default P.s.: I am getting all inputs in radacct table duplicate. Can you help me out how can I deal with this issue? I have put radius log on http://pastebin.freeswitch.org/17730 BR, Miha

2 2

Patch: Support for {BASE64_MD5} LDAP passwords in rlm_ldap and rlm_pap
by Peter Lambrechtsen 13 Nov '11

13 Nov '11

Attached is a minor patch to include support for BASE64_MD5 encoded passwords in a LDAP directory (or anywhere else it may be, as the pap module does the authenticate). In ldap the record would look like: userPassword: {BASE64_MD5}/F4DjTilcDIIVEHn/nAQsA== If the password was helloworld Thankfully the pap module is clever enough to normalize the password from Base64 encoding automatically so the BASE64_MD5 tag just needed to be added under header_names array, and then do the MD5. So no code change was really required. The debug trace shows: [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{BASE64_MD5}/F4DjTilcDIIVEHn/nAQsA==" [ldap] looking for reply items in directory... [ldap] user peterltest authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "helloworld" [pap] Using MD5 encryption. [pap] Normalizing MD5-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Cheers Peter

1 0