- Freeradius-Users - lists.freeradius.org

PEAP/MSCHAPv2 failing with Windows 7
by Gary Gatten 10 May '11

10 May '11

Hello, We use Aruba Wireless gear. We're using 802.1x PEAP, MSCHAPv2, use windows credentials. Everything is working great with this setup until we started testing / trying Windows 7 clients. They fail with: Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. The same exact username / password works great on XP. What really weird is this: In the PEAP properties, EAP-MSCHAP v2, if you DISABLE "automatically use my windows logon name and password" and instead enter the credentials manually it works. It appears to me this is some sort of bug in the Windows7 PEAP/EAPcode that grabs the credentials from "windows" that was previously entered and passes them to the EAP/PEAP process. Somewhere along the way they're getting mashed or something? I should note, it appears the Aruba gear is terminating the PEAP - FR only sees an MSCHAP request. Anyone else having a similar issue? TIA G <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

5 14

Restrict user only to a NAS
by Marcos TP 10 May '11

10 May '11

Hello everyone. I have a doubt regarding the restriction of a user by the NAS. I am 40 and NAS connected to freeradius requires each user to connect only to a specific NAS, denying access to the user when the other NAS What parameter do I need to activate this feature? Thanks All .

1 0

Config for proxying based on auth-protocol
by Nitin Bhardwaj 10 May '11

10 May '11

Hello , I want to configure FreeRADIUS to do the following two things: (1) Handle tunnel for PEAP authentication requested by any supplicant(s), and do mschapv2 auth with another RADIUS server. (Irrespective of the realm in the user-name) (2) Transparently proxy all other non-PEAP requests to another RADIUS server (like LEAP, EAP-FAST etc etc). ( Again, Irrespective of the realm in the user-name). My config for (1) is already working (eap.conf below) and FreeRADIUS is properly doing ms-chapv2 auth with another RADIUS server. However, I tried many changes in config, but could not configure it to do (2). FreeRADIUS itself tries to handle LEAP and EAP-FAST requests. Please guide me in configuring FreeRADIUS for (2) above. My eap.conf: eap { default_eap_type = mschapv2 timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 2048 tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/server.key certificate_file = ${certdir}/server.pem CA_file = ${certdir}/ca.pem dh_file = ${certdir}/dh random_file = ${certdir}/random cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } leap { } mschapv2 { } } -- //Nitin Bhardwaj////|//**//**

2 2

acct segfault in git v2.1.x
by Alexander Clouter 09 May '11

09 May '11

Updating to git's v2.1.x to go on a post-Easter bughunt and found the following accounting packet[1] seems to segfault freeradius: ---- tcpdump: listening on bond0, link-type EN10MB (Ethernet), capture size 65535 bytes 11:30:34.398885 IP6 (hlim 51, next-header UDP (17) payload length: 258) 2001:630:1:128::185.42390 > 2001:630:1b:6003:90c0:802a:d873:c284.1813: [bad udp cksum 51b1!] RADIUS, length: 250 Accounting Request (4), id: 0x1b, Authenticator: 44b81fb81af404cb48816ad0c2afc497 NAS IP Address Attribute (4), length: 6, Value: 128.86.129.105 Accounting Status Attribute (40), length: 6, Value: Stop Username Attribute (1), length: 19, Value: 223313(a)soas.ac.uk NAS Port Attribute (5), length: 6, Value: 0 NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 Accounting Session ID Attribute (44), length: 27, Value: 223313@s7CC5376FE7E3-C189 Accounting Input Octets Attribute (42), length: 6, Value: 42426 Accounting Output Octets Attribute (43), length: 6, Value: 351596 Accounting Input Packets Attribute (47), length: 6, Value: 301 Accounting Output Packets Attribute (48), length: 6, Value: 379 Accounting Termination Cause Attribute (49), length: 6, Value: Idle Timeout Framed IP Address Attribute (8), length: 6, Value: 128.86.184.37 Calling Station Attribute (31), length: 14, Value: 7CC5376FE7E3 Called Station Attribute (30), length: 14, Value: 000B860E5100 Accounting Session Time Attribute (46), length: 6, Value: 06:40 min Accounting Delay Attribute (41), length: 6, Value: 00 secs Vendor Specific Attribute (26), length: 15, Value: Vendor: Unknown (14823) Vendor Attribute: 5, Length: 7, Value: eduroam Vendor Specific Attribute (26), length: 11, Value: Vendor: Unknown (14823) Vendor Attribute: 6, Length: 3, Value: N/A Vendor Specific Attribute (26), length: 20, Value: Vendor: Unknown (14823) Vendor Attribute: 1, Length: 12, Value: pre-employee Vendor Specific Attribute (26), length: 12, Value: Vendor: Unknown (14823) Vendor Attribute: 2, Length: 4, Value: .... Unknown Attribute (103), length: 6, Value: Proxy State Attribute (33), length: 20, Value: OSC-Extended-Id=27 ---- The gdb backtrace is: ---- Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 0x42b7b470 (LWP 9963)] 0x402dc2bc in strnlen () from /lib/libc.so.6 (gdb) where #0 0x402dc2bc in strnlen () from /lib/libc.so.6 #1 0x403075d8 in fnmatch () from /lib/libc.so.6 #2 0x409da598 in do_detail (instance=0x114e50, request=0x43443240, packet=0x43446dd8, compat=<value optimized out>) at rlm_detail.c:301 #3 0x00022110 in call_modsingle (component=3, c=<value optimized out>, request=0x43443240) at modcall.c:297 #4 modcall (component=3, c=<value optimized out>, request=0x43443240) at modcall.c:670 #5 0x0001ec94 in indexed_modcall (comp=3, idx=0, request=0x43443240) at modules.c:737 #6 0x0000eefc in rad_accounting (request=0x43443240) at acct.c:93 #7 0x0002f16c in radius_handle_request (request=0x43443240, fun=0xee60 <rad_accounting>) at event.c:3780 #8 0x00026a4c in request_handler_thread (arg=<value optimized out>) at threads.c:525 #9 0x400818cc in start_thread () from /lib/libpthread.so.0 #10 0x40330bdc in clone () from /lib/libc.so.6 #11 0x40330bdc in clone () from /lib/libc.so.6 Backtrace stopped: previous frame identical to this frame (corrupt stack?) ---- If you need the FreeRADIUS -X malarkey, then do ask, it is just tricker to get on a production box... :) Cheers [1] http://stuff.digriz.org.uk/freeradius-acct-segfault.pcap -- Alexander Clouter .sigmonster says: Preserve the old, but know the new.

4 5

Simultaneous logins
by Franz 09 May '11

09 May '11

Hi, I am trying to prevent simultaneous logins on my freeradius server, I need to do it with MYSQL, I have enabled simul_count query, and enabled sql for session and accounting. Now, the tricky part is that my server is also my firewall and all requests are comming to the same nick which is listed on my clients.conf file, the nas type is other and therefore the check is ignored. When I setup as type cisco it get no response from SNMP session, and the wiki suggest that SNMP is not working with version 2.1.10 unless some modification is done. Can I keep sql accounting and radutmp for session? will this work ok? Thanks Franz

3 5

Nexus Configurations
by Darren Shaw 09 May '11

09 May '11

Good Morning I am new to this forum and to the workings of FreeRadius and I have a query around the Cisco Nexus family. Currently we have all our switches and routers authentication to FreeRadius and all seems to be working. The problem comes when I want to authenticate my Nexus 7K and 5K's. The 7Ks and 5Ks will authenticated me but the Nexus puts me in an operator role and not in an administrator's role. According to Cisco I have to place the following into /usr/local/etc/raddb/sites-available/default Cisco-AVPair = "shell:roles=\"network-operator vdc-admin\"" Cisco-AVPair = "shell:roles*\"network-operator vdc-admin\"" Cisco-AVPair = "shell:roles=\"network-admin vdc-admin\"" Cisco-AVPair = "shell:roles*\"network-admin\"" The current service type is = Administrative -User I have tried each AVPair and nothing works. Has anyone else had this issue? If anyone has any advice I would be really grateful. Thanks Rgds Darren Shaw The Network Team Computing Services University of Huddersfield Queensgate Huddersfield HD1 3DH TEL: 01484 471317 MOBILE: 07792 773807 ________________________________ --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

2 6

Radius Database
by SC＠ 09 May '11

09 May '11

Hello, I have created a website which manages a database, this one put itself automatically in " / opt / lampp / var / mysql ". But my final goal is to manage, through this website, a database FreeRadius (Add, Modify, Look for, delete data by the way of the address MAC) and radius uses databases and very specific tables that's why I have imported them and they are in " / var / lib / mysql ". I can modify those tables by way of " mysql -uroot -p " in my terminal but if I modify the code of my website to put the name of these database radius it does not work. I think that it comes from the way which is different. I would like to know what I have to write in the code of my pages (or maybe in a configuration file of mysql or xampp or raddb) so that my website manages my radius database. Thank you very much:) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-Database-tp4375341p4375341.h… Sent from the FreeRadius - User mailing list archive at Nabble.com.

8 14

(no subject)
by arpitha arpitha 08 May '11

08 May '11

hi, 'm very new to freeradius, i want to setup radius server to authenticate another system connected through an access point. i'l b grateful if any1 can tell d steps 2 do this r give links 2 d related materials. Thnks in advance :-)

3 2

ldap group filter
by crzrobot 08 May '11

08 May '11

Hi, Recently I implemented an radius authentication using the ldap module. Next step is do control the users by groups and I want to ask how could i setup the group filter if i have this kind of configuration for the groups on the LDAP servers. I tried to google it but no luck with useful results. Thank You for your help dn: cn=group1, ou=group,dc=home,dc=net objectclass: groupOfUniqueNames gidNumber: 30000 cn: group1 uniquemember: uidNumber=30001, ou=people,dc=home,dc=net uniquemember: uidNumber=30002, ou=people,dc=home,dc=net uniquemember: uidNumber=30003, ou=people,dc=home,dc=net ------------------------ dn: uid=test01,ou=people,dc=home,dc=net uid: test01 uidNumber: 30001 gidNumber: 30000 cn: test01 sn: test01 wiwid: 253 objectClass: top objectClass: person objectClass: posixAccount objectClass: shadowAccount loginShell: /bin/bash homeDirectory: /home/test01 -- View this message in context: http://freeradius.1045715.n5.nabble.com/ldap-group-filter-tp4379112p4379112… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

radius authentication fallback from ldap to local
by Chowdhury Satish-NVF476 07 May '11

07 May '11

Hi, I am trying to configure fallback of radius server form ldap to local file based authentication when the ldap server is not reachable. I have a wireless client which needs to be authenticated by the radius server on association. The wireless client uses EAP-PEAP authentication and PEAP-GTC as inner protocol. The authentication works fine with LDAP and Local files with separate configuration setting. However, I am unable to configure for the fallback mechanism. My freeradius version is 2.1.7. I did following modification for fallback. Radiusd.conf ------------- authorize { preprocessor ..... passwd ldap { fail = 1 } if(fail) { files } } eap.conf --------- eap { .... gtc { Challange = "Password" auth_type = ldap } .... } users -------- DEFAULT Auth-Type = Local Fall-Through = Yes With above settings the LDAP authentication works fine. Then ldap is disconnected the radius server fails to find ladp and fallback to file. However in fail in eap with following error.. ----->> [eap] Request found, released from the list [eap] EAP/gtc [eap] processing type gtc [gtc] +- entering group LDAP {...} [ldap] login attempt by "user1" with password "symbol123" [ldap] expand: (sAMAccountName=%{Stripped-User-Name}) -> (sAMAccountName=user1) [ldap] expand: DC=wlan,DC=com -> DC=wlan,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail [eap] Handler failed in EAP/gtc [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. auth: Failed to validate the user.: [user1] (from client localhost port 1 cli 00-13-CE-F0-6E-32 via TLS tunnel) Login incorrect: [user1] (from client localhost port 1 cli 00-13-CE-F0-6E-32 via TLS tunnel) } # server [peap] Got tunneled reply code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 EAP-Message = 0x04080004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE <<<--------- Complete log pasted here http://pastebin.com/PjDuvAvy. Packets 1-8 is when ldap is connected. Ldap is diconnected from Packet 9 onwards. The error is in Packet 17. The wireless client waits for Access-Accept. Latter, I changed the eap.conf as below eap { .... gtc { Challange = "Password" auth_type = Local } .... } With this configuration local fallback authentication works. However, when ldap is connected the ldap authentication successful only if the user credential is present in the password file. How to solve it?. I am newbie to radius, please guide if I miss some thing obvious. Regards, Satish

3 4