- Freeradius-Users - lists.freeradius.org

freeradius
by Roldanis Pozo Disotuar 11 Jul '11

11 Jul '11

regards I wish I could use the freeradius that I have to determine the phone number originating the call and if this does not match the number on the database access denied Roldanis ==================================================== "La calidad depende de EICMA, la decisi�n de usted"

3 3

TTLS OSX Airport Connection Dropping
by Matt Hopkins 11 Jul '11

11 Jul '11

I have a setup with four Linksys E4200 wireless routers all sharing the same SSID. All are configured to authenticate against the same freeradius server via WPA 2 enterprise. I have freeradius (2.1.7) setup to authenticate against activedirectory using ntlm_auth via TTLS and mschap. Android and iOS connect correctly with this setup. Windows connects correctly as well, but is using PEAP instead of TTLS. The problem occurs with OSX (running latest build - 10.6.8). When connecting via Airport, it connects, then the text "Authenticated via TTLS" briefly appears, then it switches back to saying "Authenticating..." During this time the wireless will remain connected for 2-3 hours, until it disconnects. After that, Airport prompts for the wireless username / password again (even though these are supposed to be automatically remembered). Turning off / on airport always resolves the issue and gives another 2-3 hours of connectivity. The error occurs in four macbook pro's tested. Thanks so much for any help! If someone could point me in some direction, that would be great. The log containing the conversation between an OSX machine and freeradius is available at: http://nofouls.com/images/radlog.txt

3 2

MS-CHAP Auth fail, password cache ?
by Bastien Semene 11 Jul '11

11 Jul '11

Hi list, I'm currently - trying to - set up a radius server. The backend used is MySQL. I'm using FreeRADIUS 2.1.11 on FreeBSD 8 During my tests, for the same user I used "test" password, then "blabla" password. Now, I use "blabla" and it's not working. instead "test" is still working ... I tested with a third string ("ahaha") , there's a third error output... I tried restarting radiusd and the jail it's running into, this does changes nothing. All this commands/outputs are from the same running server (I mean no reboot). How can this happen ? radtest commands : # radtest -t mschap bsemene test 10.1.8.4 0 testing123 Sending Access-Request of id 166 to 10.1.8.4 port 1812 User-Name = "bsemene" NAS-IP-Address = 10.1.8.4 NAS-Port = 0 MS-CHAP-Challenge = 0x244e451f6d9cec8a MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000048485d333f46de4d66241b5be289340fd16f37838c63c542 rad_recv: Access-Accept packet from host 10.1.8.4 port 1812, id=166, length=90 Framed-MTU = 1400 MS-CHAP-MPPE-Keys = 0x01fc5a6be7bc69292066656e05c22f3a995ad9ecfed913d60000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 /usr/local/etc/raddb# radtest -t mschap bsemene blabla 10.1.8.4 0 testing123 Sending Access-Request of id 87 to 10.1.8.4 port 1812 User-Name = "bsemene" NAS-IP-Address = 10.1.8.4 NAS-Port = 0 MS-CHAP-Challenge = 0xfabeb87636c4a8d1 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000091fbe9a51db58f3684cd91ebde311aedfcbe19271848ee45 rad_recv: Access-Reject packet from host 10.1.8.4 port 1812, id=87, length=38 MS-CHAP-Error = "\000E=691 R=1" /usr/local/etc/raddb# radtest -t mschap bsemene ahaha 10.1.8.4 0 testing123 Sending Access-Request of id 222 to 10.1.8.4 port 1812 User-Name = "bsemene" NAS-IP-Address = 10.1.8.4 NAS-Port = 0 MS-CHAP-Challenge = 0xc0d0a9ded19cb497 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000058d55aa0e11a251eee1a70f03438ff09fd872fc81b27c614 rad_recv: Access-Reject packet from host 10.1.8.4 port 1812, id=222, length=38 MS-CHAP-Error = "\000E=691 R=1" debug mode outputs : password "test" : [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bsemene [sql] expand: %{%{User-Name}:-DEFAULT} -> bsemene [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> bsemene [sql] sql_set_user escaped user --> 'bsemene' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bsemene' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'bsemene' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'bsemene' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id [sql] User found in group dynamic [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] returns ok password blabla: [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bsemene [sql] expand: %{%{User-Name}:-DEFAULT} -> bsemene [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> bsemene [sql] sql_set_user escaped user --> 'bsemene' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bsemene' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'bsemene' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'bsemene' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id [sql] User found in group dynamic [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. password ahaha : [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> ahaha [sql] expand: %{%{User-Name}:-DEFAULT} -> ahaha [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> ahaha [sql] sql_set_user escaped user --> 'ahaha' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ahaha' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ahaha' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User ahaha not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. SQL=>radcheck table : mysql> SELECT * FROM radcheck\G *************************** 1. row *************************** id: 2525 username: bsemene attribute: dynamic op: := value: blabla 1 row in set (0.00 sec) Users file : # cat users | grep -v "^[[:space:]]*#" | grep -v "^$" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP default server : # cat sites-available/default | grep -v "^[[:space:]]*#" | grep -v "^$" authorize { preprocess chap mschap digest suffix eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp sql exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } inner-tunnel server : # cat sites-available/inner-tunnel | grep -v "^[[:space:]]*#" | grep -v "^$" server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } # inner-tunnel server block -- If you think experts are expensive, wait to see what amateurs will cost you -- Bastien Semene Administrateur Réseau& Système Cyanide Studio - FRANCE

2 4

MySQL Collation and Multiple Login Possibility Help
by Deepak 11 Jul '11

11 Jul '11

Hi all, This is a chilli+FR implementation and running well. Today by accident, I found out that multiple login is possible for the same account. Although Attribute (User-Password) is treated case-sensitive, 'username' is not during authentication. To further clarify: ============= Original Account created username = ABCDE User-Password := 123456 Simultaneous-Use := 1 but found out that ============== ABCDE 123456 Abcde 123456 ABcde 123456 ABCde 123456 ABCDe 123456 aBcde 123456 etc. are all valid login. OS: CentOS 5.5 DB: MySQL 5.5 FR: 2.1.17 (pacakged with CentOS) It seems like it has more to do with MySQL query. Quick googling revealed that query needs explicit COLLATE command to make the search case-sensitive for non-binary text. http://dev.mysql.com/doc/refman/5.0/en/case-sensitivity.html But I don't know where in FR i can modify this query. Can somebody show me the right direction? I am not sure if this has been fixed for newer FR versions. Thanks Deepak

2 2

Re: MS-CHAP Auth fail, password cache ?
by Alexey Shildyakov 11 Jul '11

11 Jul '11

11.07.2011 15:18 пользователь "Alan DeKok" <aland(a)deployingradius.com> написал: > > Users have one password. You can't authenticate with any one of three > passwords. The authentication protocols just don't work that way. > Think Bastien means this: 1. Start server, user has password "password123". 2. Authentication successfull 3. Change password in MySQL to "blabla" without restarting the server. 4. Authentication failed.

1 0

Re: MS-CHAP Auth fail, password cache ?
by Alexey Shildyakov 11 Jul '11

11 Jul '11

11.07.2011 15:06 пользователь "Alan DeKok" <aland(a)deployingradius.com> написал: > > Bastien Semene wrote: > > I'm currently - trying to - set up a radius server. > > The backend used is MySQL. I'm using FreeRADIUS 2.1.11 on FreeBSD 8 > > > > During my tests, for the same user I used "test" password, then "blabla" > > password. > > Now, I use "blabla" and it's not working. instead "test" is still > > working ... > > I tested with a third string ("ahaha") , there's a third error output... > > I have no idea what that means. I think he mean that only first password is worked. The second and third version of tye password for the same user aren't worked. > > > I tried restarting radiusd and the jail it's running into, this does > > changes nothing. > > All this commands/outputs are from the same running server (I mean no > > reboot). > > > > How can this happen > > The server reads it's configuration files only when it starts. If you > edit the configuration files, you will need to restart the server. But is it apply for MYSQL too? Think I don't need to restart the server in case MYSQL because each time tye server does SELECT from MySQL, doesn't it? > > Alan DeKok. > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

freeradius-client lib documentation
by Kevin Lemonnier 11 Jul '11

11 Jul '11

Hello, I have to make an application using a RADIUS lib. I want to use the freeradius-client lib, but I can't find the documentation. I downloaded the bz2 archive as said on the wiki, and installed it, but I don't have any help with it, neither ad in the wiki. Is there a doc somewhere ? A example program at least ? I've looked at the .h in the include folder, but there is too much funcs for me to understand how to use it just with that. Thanks.

2 1

Freeradius 2.1.10: authentication (uid and password) or (macaddress) in LDAP
by Maciej Łukasz Wojszkun 11 Jul '11

11 Jul '11

Hello, somebody can tell me how I should configure freeradius to authenticate in order (all is in openldap): check mac-address in ldap if exist authenticate computer else authenticate with uid/password or try authenticate using macaddress if rejected - try authenticate via uid/password -- Regards Maciej Łukasz Wojszkun [MWO]

2 2

auth fails
by Paulo Maia 08 Jul '11

08 Jul '11

Hello everyone, Im trying to use plain mac auth ( http://wiki.freeradius.org/Mac%20Auth#Plain+Mac-Auth) and at the radius server says Login Ok , Acceptin user , but at the client says auth fails (w7) here is the output of it : Does any1 knows what might be the problem ? Thanks , *rad_recv: Access-Request packet from host 172.20.0.11 port 1645, id=28, length=139 User-Name = "host/Bala-PC" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-22-56-05-0C-8F" Calling-Station-Id = "00-1F-16-AD-16-0A" EAP-Message = 0x0202001101686f73742f42616c612d5043 Message-Authenticator = 0x082125c878f325cb3b54c88dbc6e2e82 NAS-Port-Type = Ethernet NAS-Port = 50015 NAS-IP-Address = 172.20.0.11 +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++- entering if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...} expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-1F-16-AD-16-0A ++++[request] returns ok +++- if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok +++ ... skipping else for request 2: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok [authorized_macs] expand: %{Calling-Station-ID} -> 00-1F-16-AD-16-0A [authorized_macs] users: Matched entry 00-1F-16-AD-16-0A at line 3 ++[authorized_macs] returns ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++- entering else else {...} +++[control] returns ok ++- else else returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [host/Bala-PC/<via Auth-Type = Accept>] (from client 4500 port 50015 cli 00-1F-16-AD-16-0A) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 28 to 172.20.0.11 port 1645 Reply-Message = "OK" Finished request 2.*

3 3

Re: Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

/ > Phil Mayers wrote: > > The (untested) patch below might help on 2.1.x: > > > > https://github.com/philmayers/freeradius-server/commit/3c1ed71cde100268dba5… > > > > > > ...or for 3.x: > > > > https://github.com/philmayers/freeradius-server/commit/6877b70f442536c93ed0… > > Added, thanks. > > Alan DeKok. /Alan, Just did git pull (master branch), and tried - it failed - as described by Phil in an earlier post, since mschapv2 callback is not called --------------------<snip-3.x log>----------------------------------------- (19) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (19) group authenticate { (19) - entering group authenticate {...} (19) eap : Request found, released from the list (19) eap : EAP/peap (19) eap : processing type peap (19) peap : processing EAP-TLS (19) peap : eaptls_verify returned 7 (19) peap : Done initial handshake (19) peap : eaptls_process returned 7 (19) peap : FR_TLS_OK (19) peap : Session established. Decoding tunneled attributes. (19) peap : Peap state send tlv success (19) peap : Received EAP-TLV response. (19) peap : Client rejected our response. The password is probably incorrect. (19) peap : We sent a success, but received something weird in return. (19) eap : Handler failed in EAP/peap (19) eap : Failed in EAP select (19) [eap] = invalid (19) Failed to authenticate the user. (19) Using Post-Auth-Type Reject ------------------------------------------------------------- Then tried with removing this patch: https://lists.freeradius.org/pipermail/freeradius-users/2011-April/msg00295… and it is working properly like in 2.x branch. Hence I think, also you need to remove this patch. -- Nitin.

1 0