- Freeradius-Users - lists.freeradius.org

Error with AD/freeradius config
by Edge 14 Jul '11

14 Jul '11

Im following the AD config guide over at deployingradius.com and think I have an error in one of the config files, I suspect Im not using the right syntax, or another really simple error . Fresh install of the latest freeradius version on ubuntu - not the packaged version, built from source PAP is working I have configured and tested samba and ntlm_auth - both working fine The deployingradius guide then states <You will also have to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file:> This is where I have hit problems..... ERROR: No authenticate method (Auth-Type) found for the request: The above error makes me think I have amended the config files incorrectly. I have copied the /usr/local/etc/raddb/sites-enabled/default and /usr/local/etc/raddb/sites-enabled/inner-tunnel files below and at the end the radius debug information Can someone have a look at them and tell me where I have gone wrong? I just didn't understand what format the entry had to take, so copied the existing entries in both files. If you search for ntlm_auth it will take you straight to the areas I have changed.. Many thanks My /sites-enabled/default file - I have just copied the authentication section as everything else in the file is at default settings # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user (Auth-Type := Reject), # or to or forcibly accept the user (Auth-Type := Accept). # # Note that Auth-Type := Accept will NOT work with EAP. # # Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # ntlm authentication. Auth-Type ntlm_auth { ntlm_auth } # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # # For normal "crypt" authentication, the "pap" module should # be used instead of the "unix" module. The "unix" module should # be used for authentication ONLY for compatibility with legacy # FreeRADIUS configurations. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } } My / sites-enabled/inner-tunnel file - again, I have just copied the section I have added to... # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user, or forcibly accept him. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # NTLM authentication. Auth-Type ntlm_auth { ntlm_auth } # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap } My debug output is as follows rad_recv: Access-Request packet from host 127.0.0.1 port 44992, id=218, length=60 User-Name = "xxxxxxxx" User-Password = "xxxxxxxxx" NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port = 0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> xxxxxxxxxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 16 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 16 Sending Access-Reject of id 218 to 127.0.0.1 port 44992 Waking up in 4.9 seconds. Cleaning up request 16 ID 218 with timestamp +84526 Ready to process requests. Many thanks

4 8

Re: Error with AD/freeradius config
by Edge 14 Jul '11

14 Jul '11

Thanks for the quick reply Gary I changed the /usr/local/etc/raddb/sites-enabled/default file to # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # ntlm authentication. ntlm_auth # I also changed the /usr/local/etc/raddb/sites-enabled/inner-tunnel file to # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # NTLM authentication. ntlm_auth # Pluggable Authentication Modules. I can confirm that the top of my users file has the following entry.. DEFAULT Auth-Type = ntlm_auth The debug file is still giving the same output.. rad_recv: Access-Request packet from host 127.0.0.1 port 46984, id=103, length=60 User-Name = "xxxxxxxx" User-Password = "xxxxxxx" NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port = 0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> xxxxxxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 17 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 17 Sending Access-Reject of id 103 to 127.0.0.1 port 46984 Waking up in 4.9 seconds. Cleaning up request 17 ID 103 with timestamp +95119 Ready to process requests. -----Original Message----- From: freeradius-users-bounces+edgedemon=hotmail.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+edgedemon=hotmail.com@lists.freeradius.org] On Behalf Of freeradius-users-request(a)lists.freeradius.org Sent: 14 July 2011 16:19 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius-Users Digest, Vol 75, Issue 49 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: Error with AD/freeradius config (Phil Mayers) 2. Re: SoH - FR 2.1.11 (Phil Mayers) 3. RE: Error with AD/freeradius config (Gary Gatten) ---------------------------------------------------------------------- Message: 1 Date: Thu, 14 Jul 2011 16:13:28 +0100 From: Phil Mayers <p.mayers(a)imperial.ac.uk> Subject: Re: Error with AD/freeradius config To: freeradius-users(a)lists.freeradius.org Message-ID: <4E1F0798.3000608(a)imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 14/07/11 16:04, Edge wrote: > My /sites-enabled/default file - I have just copied the authentication > section as everything else in the file is at default settings Not necessary or helpful. Full debug (which you didn't provide; you trimmed the start) is what's needed. > > rad_recv: Access-Request packet from host 127.0.0.1 port 44992, > id=218, > length=60 > > User-Name = "xxxxxxxx" > > User-Password = "xxxxxxxxx" > > NAS-IP-Address = xxx.xxx.xxx.xxx > > NAS-Port = 0 This is not an MSCHAP request. It's a PAP request, probably from radtest or radclient. You need to test with EAP. Either use "eapol_test" from the wpa_supplicant source, or use "radtest -t mschap" and direct the request to the "testing" port of the inner-tunnel virtual server. ------------------------------ Message: 2 Date: Thu, 14 Jul 2011 16:14:48 +0100 From: Phil Mayers <p.mayers(a)imperial.ac.uk> Subject: Re: SoH - FR 2.1.11 To: freeradius-users(a)lists.freeradius.org Message-ID: <4E1F07E8.6060004(a)imperial.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed On 14/07/11 15:59, Palmer J.D.F. wrote: > Thanks Phil& Arran, > > I keep starting reply emails and another arrives before I get to send > them. Hehe. > > I've tried array hack, that fails even with 'firewall' as the condition. > if ("%{SoH-MS-Windows-Health-Status[*]}" =~ /firewall/), where as if > (SoH-MS-Windows-Health-Status =~ /firewall/) is satisfied. Really? Hmm, that's odd. I'll take a look. ------------------------------ Message: 3 Date: Thu, 14 Jul 2011 10:18:56 -0500 From: Gary Gatten <Ggatten(a)waddell.com> Subject: RE: Error with AD/freeradius config To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <23289_1310656737_4E1F08E1_23289_66_1_D9B37353831173459FDAA836D3B43499C52186 02(a)WADPMBXV0.waddell.com> Content-Type: text/plain; charset="us-ascii" I don't think you need braces and such, this is not as much an auth type as a method Try just a single line that reads: ntlm_auth Also, I actually had to set my default auth-type to ntlm_auth. You know the part where it says "...for testing only..". in the users file? But, I had to leave it in or it would never call ntlm_auth and hence to logins would work. G ________________________________ From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of Edge Sent: Thursday, July 14, 2011 10:05 AM To: freeradius-users(a)lists.freeradius.org Subject: Error with AD/freeradius config Im following the AD config guide over at deployingradius.com and think I have an error in one of the config files, I suspect Im not using the right syntax, or another really simple error . Fresh install of the latest freeradius version on ubuntu - not the packaged version, built from source PAP is working I have configured and tested samba and ntlm_auth - both working fine The deployingradius guide then states <You will also have to list ntlm_auth in the authenticate sections of each the raddb/sites-enabled/default file, and of the raddb/sites-enabled/inner-tunnel file:> This is where I have hit problems..... ERROR: No authenticate method (Auth-Type) found for the request: The above error makes me think I have amended the config files incorrectly. I have copied the /usr/local/etc/raddb/sites-enabled/default and /usr/local/etc/raddb/sites-enabled/inner-tunnel files below and at the end the radius debug information Can someone have a look at them and tell me where I have gone wrong? I just didn't understand what format the entry had to take, so copied the existing entries in both files. If you search for ntlm_auth it will take you straight to the areas I have changed.. Many thanks My /sites-enabled/default file - I have just copied the authentication section as everything else in the file is at default settings # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user (Auth-Type := Reject), # or to or forcibly accept the user (Auth-Type := Accept). # # Note that Auth-Type := Accept will NOT work with EAP. # # Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # ntlm authentication. Auth-Type ntlm_auth { ntlm_auth } # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # # For normal "crypt" authentication, the "pap" module should # be used instead of the "unix" module. The "unix" module should # be used for authentication ONLY for compatibility with legacy # FreeRADIUS configurations. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } } My / sites-enabled/inner-tunnel file - again, I have just copied the section I have added to... # Authentication. # # # This section lists which modules are available for authentication. # Note that it does NOT mean 'try each module in order'. It means # that a module from the 'authorize' section adds a configuration # attribute 'Auth-Type := FOO'. That authentication type is then # used to pick the apropriate module from the list below. # # In general, you SHOULD NOT set the Auth-Type attribute. The server # will figure it out on its own, and will do the right thing. The # most common side effect of erroneously setting the Auth-Type # attribute is that one authentication method will work, but the # others will not. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user, or forcibly accept him. # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # NTLM authentication. Auth-Type ntlm_auth { ntlm_auth } # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap } My debug output is as follows rad_recv: Access-Request packet from host 127.0.0.1 port 44992, id=218, length=60 User-Name = "xxxxxxxx" User-Password = "xxxxxxxxx" NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port = 0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "xxxxxxxx", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> xxxxxxxxxx attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 16 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 16 Sending Access-Reject of id 218 to 127.0.0.1 port 44992 Waking up in 4.9 seconds. Cleaning up request 16 ID 218 with timestamp +84526 Ready to process requests. Many thanks <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 1

SoH - FR 2.1.11
by Palmer J.D.F. 14 Jul '11

14 Jul '11

Hi, We've started to look at SoH with the intention to implement it for the new academic session in September, but are having an issue. The server is setup using the example soh-server, but find that the condition in the example (below) isn't being satisfied when a client with no AV returns it's SoH status. (SoH Reply below) It appears after some trial that only the first of the "SoH-MS-Windows-Health-Status =" attributes is considered, if I manipulate the condition to check the firewall status which is returned first it works. Is this a bug or something I've done wrong? Example condition... if (SoH-MS-Windows-Health-Status =~ /antivirus (warn|error) /) { SoH Status Reply... SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=1 up2date=1 enabled=0" SoH-MS-Windows-Health-Status = "antivirus error not-installed" SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=1 up2date=1 enabled=1" SoH-MS-Windows-Health-Status = "auto-updates ok action=download" SoH-MS-Windows-Health-Status = "security-updates ok all-installed" Separate to this, an observation from the SoH reply after I'd installed Microsoft Security Essentials; the two hashed lines below show that Microsoft Security Essentials is classed as being non-Microsoft. I presume this the NAP service on the client making this decision, not FreeRADIUS? SoH-MS-Windows-Health-Status = "firewall ok snoozed=0 microsoft=1 up2date=1 enabled=1" ## SoH-MS-Windows-Health-Status = "antivirus ok snoozed=0 microsoft=0 up2date=1 enabled=1" (MSE) ## SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=0 up2date=1 enabled=1" (MSE) SoH-MS-Windows-Health-Status = "antispyware ok snoozed=0 microsoft=1 up2date=1 enabled=0" (Windows Defender) SoH-MS-Windows-Health-Status = "auto-updates ok action=download" SoH-MS-Windows-Health-Status = "security-updates warn some-missing" Thanks, Jezz. Jezz Palmer Information Services and Systems Swansea University Singleton Park Swansea SA2 8PP J.D.F.Palmer(a)swan.ac.uk

3 9

returning Vendor specific attributes to aruba
by Phil Brown 14 Jul '11

14 Jul '11

We are trying to use vendor specific attributes to provide different services to users authenticating to our local radius system, rather than users authenticating via proxy'd eduraom systems. we are using freeradius version 2.1.10 and have added the below to the users file DEFAULT Suffix == "@port.ac.uk" Aruba-User-Role = ROLE-EDUROAM-INT, Aruba-User-Vlan = 128, Class = ROLE-EDUROAM-INT, Fall-Through = Yes As far as I can tell, from the reply-detail log below & wirehark, Radius is returning the values. But the support guy is not seeing them on his wireless server. The first packets he sees are the MS-MPPE- packets. Can anyone advise as to to get this working. Packet-Type = Access-Accept Aruba-User-Role = "ROLE-EDUROAM-INT" Aruba-User-Vlan = 128 Class = 0x524f4c452d454455524f414d2d494e54 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0xd1b37a684ca34b56aac068907f687067 MS-MPPE-Recv-Key = 0x0bb8b13849577453ba36e4de9dd7aafc EAP-Message = 0x030c0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "knighta" Thu Jul 14 10:30:31 2011 Packet-Type = Access-Accept MS-MPPE-Recv-Key = 0xf83b0cc1823377adaf6a4439054fd198eb9fb762b47dd4eaea5c8a90383af353 MS-MPPE-Send-Key = 0x98085e780f78ef5837581667c796ddbf3d8c317cdcd1c7b4b5b9742091b84253 EAP-MSK = 0xf83b0cc1823377adaf6a4439054fd198eb9fb762b47dd4eaea5c8a90383af35398085e780f78ef5837581667c796ddbf3d8c317cdcd1c7b4b5b9742091b84253 EAP-EMSK = 0x4268b7d02ec96bd566a0bb48ae21733f55f1da5ec296f959c84a83bd67a2cc45ce19f0c69924b9e9ed034f74eac19c8d904efbd4279b31499df4366ab6bbcf11 EAP-Message = 0x030d0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "monkey"

2 1

How to setup Freeradius
by Gilmour, Scott 14 Jul '11

14 Jul '11

I have been able to install freeradius using the Synaptic Package Manager. I installed these two packages openssl and the freeradius. I have also installed certificates. I have been able to get everything to work with freeradius except PEAP and TLS. Do I need to install other packages or do anything else in order to get PEAP and TLS to work? Thanks Scott

9 23

User Problem with Cisco Nexus 4.x
by Jan.Gnepper＠t-systems.com 13 Jul '11

13 Jul '11

Hi, I have a little problem. I have two devices within the same huntgroup, but i get in trouble with one of them. Both are Cisco Nexus, but there is one difference: The working one has NXOS 5.x, the one that is not working as expected NXOS 4.x Why is the right line in the users file found for the working device (line 67), but not found for the other device (line 136)? While both devices are in the same huntgroup and both requests look identically? Any ideas? Am i just blind? The interesting part is, that both requests look identical (even in tcpdump!). But the answer paket always shows a "bad udp checksum" when i´m not able to log in. 17:33:57.201238 IP (tos 0x0, ttl 64, id 1280, offset 0, flags [none], proto: UDP (17), length: 48) radius-server.datametrics > 10.48.137.62 .40077: [bad udp cksum 2dde!] RADIUS, length: 20 Access Reject (3), id: 0x17, Authenticator: 436530c99d29615e3a35aa878275a97d Is it possible that this causes my problem? Jan Huntgroups: ================================ nexus NAS-IP-Address == 10.48.141.157 nexus NAS-IP-Address == 10.48.137.62 Users: ================================ Line 67 ff: test Auth-Type := Pap, Huntgroup-Name == "nexus", MD5-Password := "098f6bcd4621d373cade4e832627b4f6 " Login-Service = Telnet, Vendor-Specific = 9, Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\"" Line 136: DEFAULT Auth-Type := Reject Not Working: ================================ rad_recv: Access-Request packet from host 10.48.137.62 port 7032, id=63, length=62 User-Name = "test" User-Password = "test" NAS-Port-Type = Virtual NAS-Port = 3002 NAS-IP-Address = 10.48.137.62 +- entering group authorize {...} ++[preprocess] returns ok rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry DEFAULT at line 136 ++[files] returns ok [ldap] performing user authorization for test [ldap] expand: (uid=%u) -> (uid=test) [ldap] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. Login incorrect (rlm_ldap: User not found): [test] (from client RZ-XXX port 3002) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 63 to 10.48.137.62 port 7032 Finished request 20. Going to the next request Waking up in 4.9 seconds. Working: ================================ rad_recv: Access-Request packet from host 10.48.141.157 port 48132, id=229, length=62 User-Name = "test" User-Password = "test" NAS-Port-Type = Virtual NAS-Port = 3019 NAS-IP-Address = 10.48.141.157 +- entering group authorize {...} ++[preprocess] returns ok rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: Entering ldap_groupcmp() [files] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW [files] expand: (uid=%u) -> (uid=test) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 [files] users: Matched entry test at line 67 ++[files] returns ok [ldap] performing user authorization for test [ldap] expand: (uid=%u) -> (uid=test) [ldap] expand: o=IAN,o=AD,o=WiW -> o=IAN,o=AD,o=WiW rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=IAN,o=AD,o=WiW, with filter (uid=test) rlm_ldap: object not found [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound [pap] Normalizing MD5-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using MD5 encryption. [pap] User authenticated successfully ++[pap] returns ok Login OK: [test] (from client RZ-XXX port 3019) WARNING: Empty section. Using default return values. Sending Access-Accept of id 229 to 10.48.141.157 port 48132 Login-Service = Telnet Vendor-Specific = 0x39 Cisco-AVPair = "shell:roles*\"network-operator\" \"vdc-operator\"" Finished request 17. Going to the next request Waking up in 4.9 seconds.

2 1

PAP authentication to Active Directory
by Axford M.F. 13 Jul '11

13 Jul '11

Hi I'm currently setting up a radius server to authenticate EAP based requests against Active Directory. Using Alan Dekok's guide I've got this authenticating mschap based EAP requests successfully. I also want to authenticate ttls/pap requests and I've found two ways to do this that seem to work. Method 1 is based on whats in http://freeradius.1045715.n5.nabble.com/EAP-TTLS-w-PAP-using-ntlm-auth-td27… Method 2 is to use LDAP for pap authentications. All things being equal my preference is to use Method 1 as it keeps all authentications the same, however the: if (!control:Auth-Type) { update control { Auth-Type = ntlm_auth_pap } } In the inner-tunnel/authorize section seems a bit like a hack. Is there a better way to do this ? Is either method particularly better than the other ? Regards Mike Axford -- Mike Axford Enterprise Systems iSolutions University of Southampton Southampton SO17 1BJ Email: M.F.Axford(a)soton.ac.uk Phone: 023 8059 5337

2 1

Different Attributes based on NAS-IP
by Waqas Toor 13 Jul '11

13 Jul '11

Dear Community, I want to use SQL to send different Attributes of the same groupname based on NAS-IP-Address. for example 1024DL_512UL is the name of my group in sql. I want to send different Attributes based on NAS IP 2.2.2.2 and Different attributes for same group when NAS IP is 6.6.6.6 Any pointers. Thanks Waqas.

3 2

NAS re-uses the same port and ID
by Konstantin Chekushin 13 Jul '11

13 Jul '11

Hi all! I've found, that our NAS-server sometimes (when it restarts and there are many auth. packets comes to the radius-server) re-uses port and ID in a < 1 second period. (information from tcpdump) That causes " conflicting packet from client". I think, that the NAS works wrong (it must wait a little bit more, then 1 sec. to re-use the port+ID), that's why I wont to find some documentation about it for a bug-report. Thanks a lot.

3 4

rlm_sql and read_groups
by Jacob Dawson 12 Jul '11

12 Jul '11

We're trying to get FreeRADIUS to get at the user info in our Oracle DB, and it does not appear to be respecting the read_groups = yes setting in sql.conf. Forex: [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql] ... expanding second conditional [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql] expand: %{User-Name:-DEFAULT} -> dawson(a)vt.edu [sql] expand: %{Stripped-User-Name:-%{User-Name:-DEFAULT}} -> dawson(a)vt.edu [sql] sql_set_user escaped user --> 'dawson(a)vt.edu' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = 'dawson(a)vt.edu' ORDER BY id SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = 'dawson(a)vt.edu' ORDER BY id [sql] User found in radcheck table rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok That's all well and good, and I understand that this is normal behavior if you don't set read_groups to yes, but that's decidedly unhelpful behavior when you also want to confirm group memberships. Here's the related output from when FR loads the sql module: Module: Linked to module rlm_sql Module: Instantiating module "sql" from file /usr/local/freeradius-2.1.11/etc/raddb/sql.conf sql { driver = "rlm_sql_oracle" server = "<redacted>" port = "<redacted>" login = "<redacted>" password = "<redacted>" radius_db = "(DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=<redacted>)(PORT=<redacted>))(CONNECT_DATA=(SID=<redacted>)))" read_groups = yes sqltrace = yes sqltracefile = "/usr/local/freeradius-2.1.11/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{Stripped-User-Name:-%{User-Name:-DEFAULT}}" default_user_profile = "" nas_query = "SELECT id,nasname,shortname,type,secret FROM nas" authorize_check_query = "SELECT id, username, Attribute, Value, op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id" authorize_group_check_query = "SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,radusergroup WHERE radusergroup.Username = '%{SQL-User-Name}' AND radusergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id" authorize_group_reply_query = "" accounting_onoff_query = "" accounting_update_query = "" accounting_update_query_alt = "" accounting_start_query = "" accounting_start_query_alt = "" accounting_stop_query = "" accounting_stop_query_alt = "" connect_failure_retry_delay = 60 simul_count_query = "" simul_verify_query = "" postauth_query = "" safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" } Did I miss something, or is this misbehaving? Thanks much, - Jacob M. Dawson

4 13