- Freeradius-Users - lists.freeradius.org

PAP password check
by mic night 10 May '11

10 May '11

Hello, I have a freeradius server that i use to authenticate users before they access network switches. user passwords reside in an ldap directory with the following attributes and formats: userPassword: (CRYPT password) sambaNTPassword: (NT Hash) sambaLMPassword: (LM hash) PAP is choosing automaticaly the NT encryption to validate the password. Is there a way to force PAP to use the userPassword with the CRYPT encryption? PS: i have to keep sambaNTPassword and sambaLMPassword along with userPassword as check items for other use scenarii. i'll post the relevant part of my radius log file in case it helps, thank you. [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$$xkbzS/dF4YU/JKyjA5.36." [ldap] sambaNtPassword -> NT-Password == 0x4539463933393235373938463136464345394639333932353739384631364642 [ldap] sambaLmPassword -> LM-Password == 0x4243333041323738464338383546424538393735438383546424538393735456 [ldap] userPassword -> User-Password == "{CRYPT}$1$$xkbzS/dF4YU/JKyjA5.36." [ldap] looking for reply items in directory... [ldap] user theUser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "thepassword" [pap] Using NT encryption. [pap] expand: %{User-Password} -> thepassword [pap] NT-Hash of thepassword = e9f93925798f16fc4c9f93925798f1 [pap] expand: %{mschap:NT-Hash %{User-Password}} -> e9f93925798f16fc4c9f93925798f1 [pap] User authenticated successfully

2 3

Error: User-Name is not the same as MS-CHAP name
by Robert Mc Cready 10 May '11

10 May '11

The "MS-CHAP-Use-NTLM-Auth := no" did the job but I still have one problem with Windows XP clients, I get a " [mschap] ERROR: User-Name (CAD08862\ldapuser) is not the same as MS-CHAP Name (ldapuser) from EAP-MSCHAPv2". Users log on locally, the host name is not a domain name. Windows 7 clients work fine because they send only the username. I do some rewrites so I can get the username for the LDAP authentication and the computers name for computer account authentication (I'm not familiar with unlang yet). We use FR 2.1.10. Any idea how to fix this ? Windows XP debug: http://www.cspi.qc.ca/sinfrmc/windowsxp.htm Windows 7 debug: http://www.cspi.qc.ca/sinfrmc/windows7.htm On 05/05/11 15:17, Robert Mc Cready wrote: > We use Novell eDirectory and DSFW (Directory Services for Windows) > which is kind of a Windows domain inside an OU in eDirectory. I want > to authenticate users using LDAP and Windows computers account using > ntlm_auth. There is only computers accounts in the Windows domain. > > The computer authentication is working fine but the users > authentication with LDAP fails if ntlm_auth is configured. If I don't > use ntlm_auth the users authentication works. Is there a way to have > both of them working together? Yes. Something like this: authorize { ... if (User-Name !~ /^host\//) { update control { MS-CHAP-Use-NTLM-Auth := no } } ... } - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html We use Novell eDirectory and DSFW (Directory Services for Windows) which is kind of a Windows domain inside an OU in eDirectory. I want to authenticate users using LDAP and Windows computers account using ntlm_auth. There is only computers accounts in the Windows domain. The computer authentication is working fine but the users authentication with LDAP fails if ntlm_auth is configured. If I don't use ntlm_auth the users authentication works. Is there a way to have both of them working together? We use PEAP. Working user authentication with LDAP debug (ntlm_auth not configured): http://www.cspi.qc.ca/sinfrmc/ldap_only.htm Working Windows computer account authentication: http://www.cspi.qc.ca/sinfrmc/mschap_only.htm User account getting rejected debug (with ntlm_auth configured): http://www.cspi.qc.ca/sinfrmc/mschap_and_ldap.htm Thanks, Robert.

4 10

PEAP/MSCHAPv2 failing with Windows 7
by Gary Gatten 10 May '11

10 May '11

Hello, We use Aruba Wireless gear. We're using 802.1x PEAP, MSCHAPv2, use windows credentials. Everything is working great with this setup until we started testing / trying Windows 7 clients. They fail with: Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. The same exact username / password works great on XP. What really weird is this: In the PEAP properties, EAP-MSCHAP v2, if you DISABLE "automatically use my windows logon name and password" and instead enter the credentials manually it works. It appears to me this is some sort of bug in the Windows7 PEAP/EAPcode that grabs the credentials from "windows" that was previously entered and passes them to the EAP/PEAP process. Somewhere along the way they're getting mashed or something? I should note, it appears the Aruba gear is terminating the PEAP - FR only sees an MSCHAP request. Anyone else having a similar issue? TIA G <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

5 14

Restrict user only to a NAS
by Marcos TP 10 May '11

10 May '11

Hello everyone. I have a doubt regarding the restriction of a user by the NAS. I am 40 and NAS connected to freeradius requires each user to connect only to a specific NAS, denying access to the user when the other NAS What parameter do I need to activate this feature? Thanks All .

1 0

Config for proxying based on auth-protocol
by Nitin Bhardwaj 10 May '11

10 May '11

Hello , I want to configure FreeRADIUS to do the following two things: (1) Handle tunnel for PEAP authentication requested by any supplicant(s), and do mschapv2 auth with another RADIUS server. (Irrespective of the realm in the user-name) (2) Transparently proxy all other non-PEAP requests to another RADIUS server (like LEAP, EAP-FAST etc etc). ( Again, Irrespective of the realm in the user-name). My config for (1) is already working (eap.conf below) and FreeRADIUS is properly doing ms-chapv2 auth with another RADIUS server. However, I tried many changes in config, but could not configure it to do (2). FreeRADIUS itself tries to handle LEAP and EAP-FAST requests. Please guide me in configuring FreeRADIUS for (2) above. My eap.conf: eap { default_eap_type = mschapv2 timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 2048 tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } leap { } mschapv2 { } } -- //Nitin Bhardwaj////|//**//**

2 2

acct segfault in git v2.1.x
by Alexander Clouter 09 May '11

09 May '11

Updating to git's v2.1.x to go on a post-Easter bughunt and found the following accounting packet[1] seems to segfault freeradius: ---- tcpdump: listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes 11:30:34.398885 IP6 (hlim 51, next-header UDP (17) payload length: 258) 2001:630:1:128::185.42390 > 2001:630:1b:6003:90c0:802a:d873:c284.1813: [bad udp cksum 51b1!] RADIUS, length: 250 Accounting Request (4), id: 0x1b, Authenticator: 44b81fb81af404cb48816ad0c2afc497 NAS IP Address Attribute (4), length: 6, Value: 128.86.129.105 Accounting Status Attribute (40), length: 6, Value: Stop Username Attribute (1), length: 19, Value: 223313(a)soas.ac.uk NAS Port Attribute (5), length: 6, Value: 0 NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 Accounting Session ID Attribute (44), length: 27, Value: 223313@s7CC5376FE7E3-C189 Accounting Input Octets Attribute (42), length: 6, Value: 42426 Accounting Output Octets Attribute (43), length: 6, Value: 351596 Accounting Input Packets Attribute (47), length: 6, Value: 301 Accounting Output Packets Attribute (48), length: 6, Value: 379 Accounting Termination Cause Attribute (49), length: 6, Value: Idle Timeout Framed IP Address Attribute (8), length: 6, Value: 128.86.184.37 Calling Station Attribute (31), length: 14, Value: 7CC5376FE7E3 Called Station Attribute (30), length: 14, Value: 000B860E5100 Accounting Session Time Attribute (46), length: 6, Value: 06:40 min Accounting Delay Attribute (41), length: 6, Value: 00 secs Vendor Specific Attribute (26), length: 15, Value: Vendor: Unknown (14823) Vendor Attribute: 5, Length: 7, Value: eduroam Vendor Specific Attribute (26), length: 11, Value: Vendor: Unknown (14823) Vendor Attribute: 6, Length: 3, Value: N/A Vendor Specific Attribute (26), length: 20, Value: Vendor: Unknown (14823) Vendor Attribute: 1, Length: 12, Value: pre-employee Vendor Specific Attribute (26), length: 12, Value: Vendor: Unknown (14823) Vendor Attribute: 2, Length: 4, Value: .... Unknown Attribute (103), length: 6, Value: Proxy State Attribute (33), length: 20, Value: OSC-Extended-Id=27 ---- The gdb backtrace is: ---- Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x42b7b470 (LWP 9963)] 0x402dc2bc in strnlen () from /lib/libc.so.6 (gdb) where #0 0x402dc2bc in strnlen () from /lib/libc.so.6 #1 0x403075d8 in fnmatch () from /lib/libc.so.6 #2 0x409da598 in do_detail (instance=0x114e50, request=0x43443240, packet=0x43446dd8, compat=<value optimized out>) at rlm_detail.c:301 #3 0x00022110 in call_modsingle (component=3, c=<value optimized out>, request=0x43443240) at modcall.c:297 #4 modcall (component=3, c=<value optimized out>, request=0x43443240) at modcall.c:670 #5 0x0001ec94 in indexed_modcall (comp=3, idx=0, request=0x43443240) at modules.c:737 #6 0x0000eefc in rad_accounting (request=0x43443240) at acct.c:93 #7 0x0002f16c in radius_handle_request (request=0x43443240, fun=0xee60 <rad_accounting>) at event.c:3780 #8 0x00026a4c in request_handler_thread (arg=<value optimized out>) at threads.c:525 #9 0x400818cc in start_thread () from /lib/libpthread.so.0 #10 0x40330bdc in clone () from /lib/libc.so.6 #11 0x40330bdc in clone () from /lib/libc.so.6 Backtrace stopped: previous frame identical to this frame (corrupt stack?) ---- If you need the FreeRADIUS -X malarkey, then do ask, it is just tricker to get on a production box... :) Cheers [1] http://stuff.digriz.org.uk/freeradius-acct-segfault.pcap -- Alexander Clouter .sigmonster says: Preserve the old, but know the new.

4 5

Simultaneous logins
by Franz 09 May '11

09 May '11

Hi, I am trying to prevent simultaneous logins on my freeradius server, I need to do it with MYSQL, I have enabled simul_count query, and enabled sql for session and accounting. Now, the tricky part is that my server is also my firewall and all requests are comming to the same nick which is listed on my clients.conf file, the nas type is other and therefore the check is ignored. When I setup as type cisco it get no response from SNMP session, and the wiki suggest that SNMP is not working with version 2.1.10 unless some modification is done. Can I keep sql accounting and radutmp for session? will this work ok? Thanks Franz

3 5

Nexus Configurations
by Darren Shaw 09 May '11

09 May '11

Good Morning I am new to this forum and to the workings of FreeRadius and I have a query around the Cisco Nexus family. Currently we have all our switches and routers authentication to FreeRadius and all seems to be working. The problem comes when I want to authenticate my Nexus 7K and 5K's. The 7Ks and 5Ks will authenticated me but the Nexus puts me in an operator role and not in an administrator's role. According to Cisco I have to place the following into /usr/local/etc/raddb/sites-available/default Cisco-AVPair = "shell:roles=\"network-operator vdc-admin\"" Cisco-AVPair = "shell:roles*\"network-operator vdc-admin\"" Cisco-AVPair = "shell:roles=\"network-admin vdc-admin\"" Cisco-AVPair = "shell:roles*\"network-admin\"" The current service type is = Administrative -User I have tried each AVPair and nothing works. Has anyone else had this issue? If anyone has any advice I would be really grateful. Thanks Rgds Darren Shaw The Network Team Computing Services University of Huddersfield Queensgate Huddersfield HD1 3DH TEL: 01484 471317 MOBILE: 07792 773807 ________________________________ --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 6

Radius Database
by SC＠ 09 May '11

09 May '11

Hello, I have created a website which manages a database, this one put itself automatically in " / opt / lampp / var / mysql ". But my final goal is to manage, through this website, a database FreeRadius (Add, Modify, Look for, delete data by the way of the address MAC) and radius uses databases and very specific tables that's why I have imported them and they are in " / var / lib / mysql ". I can modify those tables by way of " mysql -uroot -p " in my terminal but if I modify the code of my website to put the name of these database radius it does not work. I think that it comes from the way which is different. I would like to know what I have to write in the code of my pages (or maybe in a configuration file of mysql or xampp or raddb) so that my website manages my radius database. Thank you very much:) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-Database-tp4375341p4375341.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

8 14

(no subject)
by arpitha arpitha 08 May '11

08 May '11

hi, 'm very new to freeradius, i want to setup radius server to authenticate another system connected through an access point. i'l b grateful if any1 can tell d steps 2 do this r give links 2 d related materials. Thnks in advance :-)

3 2