- Freeradius-Users - lists.freeradius.org

MS-CHAP Auth fail, password cache ?
by Bastien Semene 11 Jul '11

11 Jul '11

Hi list, I'm currently - trying to - set up a radius server. The backend used is MySQL. I'm using FreeRADIUS 2.1.11 on FreeBSD 8 During my tests, for the same user I used "test" password, then "blabla" password. Now, I use "blabla" and it's not working. instead "test" is still working ... I tested with a third string ("ahaha") , there's a third error output... I tried restarting radiusd and the jail it's running into, this does changes nothing. All this commands/outputs are from the same running server (I mean no reboot). How can this happen ? radtest commands : # radtest -t mschap bsemene test 10.1.8.4 0 testing123 Sending Access-Request of id 166 to 10.1.8.4 port 1812 User-Name = "bsemene" NAS-IP-Address = 10.1.8.4 NAS-Port = 0 MS-CHAP-Challenge = 0x244e451f6d9cec8a MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000048485d333f46de4d66241b5be289340fd16f37838c63c542 rad_recv: Access-Accept packet from host 10.1.8.4 port 1812, id=166, length=90 Framed-MTU = 1400 MS-CHAP-MPPE-Keys = 0x01fc5a6be7bc69292066656e05c22f3a995ad9ecfed913d60000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 /usr/local/etc/raddb# radtest -t mschap bsemene blabla 10.1.8.4 0 testing123 Sending Access-Request of id 87 to 10.1.8.4 port 1812 User-Name = "bsemene" NAS-IP-Address = 10.1.8.4 NAS-Port = 0 MS-CHAP-Challenge = 0xfabeb87636c4a8d1 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000091fbe9a51db58f3684cd91ebde311aedfcbe19271848ee45 rad_recv: Access-Reject packet from host 10.1.8.4 port 1812, id=87, length=38 MS-CHAP-Error = "\000E=691 R=1" /usr/local/etc/raddb# radtest -t mschap bsemene ahaha 10.1.8.4 0 testing123 Sending Access-Request of id 222 to 10.1.8.4 port 1812 User-Name = "bsemene" NAS-IP-Address = 10.1.8.4 NAS-Port = 0 MS-CHAP-Challenge = 0xc0d0a9ded19cb497 MS-CHAP-Response = 0x000100000000000000000000000000000000000000000000000058d55aa0e11a251eee1a70f03438ff09fd872fc81b27c614 rad_recv: Access-Reject packet from host 10.1.8.4 port 1812, id=222, length=38 MS-CHAP-Error = "\000E=691 R=1" debug mode outputs : password "test" : [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bsemene [sql] expand: %{%{User-Name}:-DEFAULT} -> bsemene [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> bsemene [sql] sql_set_user escaped user --> 'bsemene' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bsemene' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'bsemene' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'bsemene' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id [sql] User found in group dynamic [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] adding MS-CHAPv1 MPPE keys ++[mschap] returns ok password blabla: [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> bsemene [sql] expand: %{%{User-Name}:-DEFAULT} -> bsemene [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> bsemene [sql] sql_set_user escaped user --> 'bsemene' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bsemene' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'bsemene' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'bsemene' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'dynamic' ORDER BY id [sql] User found in group dynamic [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'dynamic' ORDER BY id rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. password ahaha : [sql] expand: %{Stripped-User-Name} -> [sql] ... expanding second conditional [sql] expand: %{User-Name} -> ahaha [sql] expand: %{%{User-Name}:-DEFAULT} -> ahaha [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> ahaha [sql] sql_set_user escaped user --> 'ahaha' rlm_sql (sql): Reserving sql socket id: 2 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ahaha' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ahaha' ORDER BY priority rlm_sql (sql): Released sql socket id: 2 [sql] User ahaha not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. SQL=>radcheck table : mysql> SELECT * FROM radcheck\G *************************** 1. row *************************** id: 2525 username: bsemene attribute: dynamic op: := value: blabla 1 row in set (0.00 sec) Users file : # cat users | grep -v "^[[:space:]]*#" | grep -v "^$" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP default server : # cat sites-available/default | grep -v "^[[:space:]]*#" | grep -v "^$" authorize { preprocess chap mschap digest suffix eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } digest unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp sql exec attr_filter.accounting_response } session { radutmp } post-auth { exec Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } inner-tunnel server : # cat sites-available/inner-tunnel | grep -v "^[[:space:]]*#" | grep -v "^$" server inner-tunnel { listen { ipaddr = 127.0.0.1 port = 18120 type = auth } authorize { chap mschap suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files sql expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } session { radutmp } post-auth { Post-Auth-Type REJECT { attr_filter.access_reject } } pre-proxy { } post-proxy { eap } } # inner-tunnel server block -- If you think experts are expensive, wait to see what amateurs will cost you -- Bastien Semene Administrateur Réseau& Système Cyanide Studio - FRANCE

2 4

MySQL Collation and Multiple Login Possibility Help
by Deepak 11 Jul '11

11 Jul '11

Hi all, This is a chilli+FR implementation and running well. Today by accident, I found out that multiple login is possible for the same account. Although Attribute (User-Password) is treated case-sensitive, 'username' is not during authentication. To further clarify: ============= Original Account created username = ABCDE User-Password := 123456 Simultaneous-Use := 1 but found out that ============== ABCDE 123456 Abcde 123456 ABcde 123456 ABCde 123456 ABCDe 123456 aBcde 123456 etc. are all valid login. OS: CentOS 5.5 DB: MySQL 5.5 FR: 2.1.17 (pacakged with CentOS) It seems like it has more to do with MySQL query. Quick googling revealed that query needs explicit COLLATE command to make the search case-sensitive for non-binary text. http://dev.mysql.com/doc/refman/5.0/en/case-sensitivity.html But I don't know where in FR i can modify this query. Can somebody show me the right direction? I am not sure if this has been fixed for newer FR versions. Thanks Deepak

2 2

Re: MS-CHAP Auth fail, password cache ?
by Alexey Shildyakov 11 Jul '11

11 Jul '11

11.07.2011 15:18 пользователь "Alan DeKok" <aland(a)deployingradius.com> написал: > > Users have one password. You can't authenticate with any one of three > passwords. The authentication protocols just don't work that way. > Think Bastien means this: 1. Start server, user has password "password123". 2. Authentication successfull 3. Change password in MySQL to "blabla" without restarting the server. 4. Authentication failed.

1 0

Re: MS-CHAP Auth fail, password cache ?
by Alexey Shildyakov 11 Jul '11

11 Jul '11

11.07.2011 15:06 пользователь "Alan DeKok" <aland(a)deployingradius.com> написал: > > Bastien Semene wrote: > > I'm currently - trying to - set up a radius server. > > The backend used is MySQL. I'm using FreeRADIUS 2.1.11 on FreeBSD 8 > > > > During my tests, for the same user I used "test" password, then "blabla" > > password. > > Now, I use "blabla" and it's not working. instead "test" is still > > working ... > > I tested with a third string ("ahaha") , there's a third error output... > > I have no idea what that means. I think he mean that only first password is worked. The second and third version of tye password for the same user aren't worked. > > > I tried restarting radiusd and the jail it's running into, this does > > changes nothing. > > All this commands/outputs are from the same running server (I mean no > > reboot). > > > > How can this happen > > The server reads it's configuration files only when it starts. If you > edit the configuration files, you will need to restart the server. But is it apply for MYSQL too? Think I don't need to restart the server in case MYSQL because each time tye server does SELECT from MySQL, doesn't it? > > Alan DeKok. > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

freeradius-client lib documentation
by Kevin Lemonnier 11 Jul '11

11 Jul '11

Hello, I have to make an application using a RADIUS lib. I want to use the freeradius-client lib, but I can't find the documentation. I downloaded the bz2 archive as said on the wiki, and installed it, but I don't have any help with it, neither ad in the wiki. Is there a doc somewhere ? A example program at least ? I've looked at the .h in the include folder, but there is too much funcs for me to understand how to use it just with that. Thanks.

2 1

Freeradius 2.1.10: authentication (uid and password) or (macaddress) in LDAP
by Maciej Łukasz Wojszkun 11 Jul '11

11 Jul '11

Hello, somebody can tell me how I should configure freeradius to authenticate in order (all is in openldap): check mac-address in ldap if exist authenticate computer else authenticate with uid/password or try authenticate using macaddress if rejected - try authenticate via uid/password -- Regards Maciej Łukasz Wojszkun [MWO]

2 2

auth fails
by Paulo Maia 08 Jul '11

08 Jul '11

Hello everyone, Im trying to use plain mac auth ( http://wiki.freeradius.org/Mac%20Auth#Plain+Mac-Auth) and at the radius server says Login Ok , Acceptin user , but at the client says auth fails (w7) here is the output of it : Does any1 knows what might be the problem ? Thanks , *rad_recv: Access-Request packet from host 172.20.0.11 port 1645, id=28, length=139 User-Name = "host/Bala-PC" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-22-56-05-0C-8F" Calling-Station-Id = "00-1F-16-AD-16-0A" EAP-Message = 0x0202001101686f73742f42616c612d5043 Message-Authenticator = 0x082125c878f325cb3b54c88dbc6e2e82 NAS-Port-Type = Ethernet NAS-Port = 50015 NAS-IP-Address = 172.20.0.11 +- entering group authorize {...} ++[preprocess] returns ok ++- entering policy rewrite_calling_station_id {...} +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++- entering if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) {...} expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-1F-16-AD-16-0A ++++[request] returns ok +++- if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) returns ok +++ ... skipping else for request 2: Preceding "if" was taken ++- policy rewrite_calling_station_id returns ok [authorized_macs] expand: %{Calling-Station-ID} -> 00-1F-16-AD-16-0A [authorized_macs] users: Matched entry 00-1F-16-AD-16-0A at line 3 ++[authorized_macs] returns ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++- entering else else {...} +++[control] returns ok ++- else else returns ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [host/Bala-PC/<via Auth-Type = Accept>] (from client 4500 port 50015 cli 00-1F-16-AD-16-0A) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 28 to 172.20.0.11 port 1645 Reply-Message = "OK" Finished request 2.*

3 3

Re: Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

/ > Phil Mayers wrote: > > The (untested) patch below might help on 2.1.x: > > > > https://github.com/philmayers/freeradius-server/commit/3c1ed71cde100268dba5… > > > > > > ...or for 3.x: > > > > https://github.com/philmayers/freeradius-server/commit/6877b70f442536c93ed0… > > Added, thanks. > > Alan DeKok. /Alan, Just did git pull (master branch), and tried - it failed - as described by Phil in an earlier post, since mschapv2 callback is not called --------------------<snip-3.x log>----------------------------------------- (19) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (19) group authenticate { (19) - entering group authenticate {...} (19) eap : Request found, released from the list (19) eap : EAP/peap (19) eap : processing type peap (19) peap : processing EAP-TLS (19) peap : eaptls_verify returned 7 (19) peap : Done initial handshake (19) peap : eaptls_process returned 7 (19) peap : FR_TLS_OK (19) peap : Session established. Decoding tunneled attributes. (19) peap : Peap state send tlv success (19) peap : Received EAP-TLV response. (19) peap : Client rejected our response. The password is probably incorrect. (19) peap : We sent a success, but received something weird in return. (19) eap : Handler failed in EAP/peap (19) eap : Failed in EAP select (19) [eap] = invalid (19) Failed to authenticate the user. (19) Using Post-Auth-Type Reject ------------------------------------------------------------- Then tried with removing this patch: https://lists.freeradius.org/pipermail/freeradius-users/2011-April/msg00295… and it is working properly like in 2.x branch. Hence I think, also you need to remove this patch. -- Nitin.

1 0

Question about Access-Challenge
by Jamshid Abedi 08 Jul '11

08 Jul '11

Hello, I've got Mobile OTP to work with FreeRadius, I'd like to take this one step further and turn this into a two phase process. The objective is to first take the pin, authenticate that and then communicate to the NAS with a challenge to receive the OTP from the user. I think this can be done via an access-challenge reply to the NAS. My question is how do I get FreeNAS to send an Access-Challenge once it has verified the PIN is correct? If anyone can kindly give me some hints or point me in the right direction. Thank you, JJ Abdi

3 2

Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

> On 08/07/11 11:20, Nitin Bhardwaj wrote: > > However, one doubt: Shouldn't this code be conditional based on whether > "use_tunneled_reply" is yes/no. Presently the outer PEAP > does take care of it, is this taken care of in this callback > (mschap_postproxy) ? > > No. The code doesn't need to be conditional, because copying of the > attributes to the final, outer, access-accept is already conditional > on "use_tunneled_reply" - that's what it does. Ok. So do you think this patch is fit to be brought into mainline-2.x ? I will try the 3.x patch too, and let you know soon. -- Nitin.

1 0