- Freeradius-Users - lists.freeradius.org

MS-CHAP-V2 with no retry
by John Hayward 27 Apr '11

27 Apr '11

According to RFC2759 section 9.1.3 - 9.1.5 an authentication failure can return (E=691 R=0) --- failure no retry or (E=691 R=1) failure, disable short timeout and allow a retry with ++ID. freeradius apparently only returns (E=691 R=1) in three different places in src/modules/rlm_mschap/rlm_mschap.c apple wireless clients have a known bug Bug ID# 8112557 which fails to increment the ID in the response to the challenge failure message. The Microsoft NPS logs this failure and silently discards the retry attempt. The effect is that the user of the apple device never sees a message that tells them the need to change their password. I am unsure if free radius checks the ID of a retry packet from a device but the effect is similar - users are left in the dark as to why they cannot connect when their password has been changed. It has been reported that if the Microsoft NPS server is configured for no retries (E=691 R=0) that mac/iphones/ipads then act like windows xp machines in that they report to the user that the password needs attention. Would it be possible to modify rlm_mschap.c to be conigured as to how many retries were allowed before returning authentication failure with no retry? johnh...

6 59

Help with machine authentication
by Eldred, Bob 26 Apr '11

26 Apr '11

Hello there, I've spent the last couple days combing the interwebs, hoping to find the (probably stupid and minor) config issue with a FreeRADIUS server I've been asked to implement. I've successfully enabled and tested user authentication as a first step, but the next step is to move from that to machine authentication. I'll tackle proxying after I can make this work (hopefully without having to bother the list). Environment: CentOS (dmesg gives: Linux version 2.6.18-194.el5 (mockbuild(a)builder16.centos.org) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-48)) #1 SMP Fri Apr 2 14:58:35 EDT 2010) Samba v 3.0.33-3.29.el5_5.1 FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Problem: After configuring a Windows XP SP3 supplicant for machine authentication (which is stupidly complex, given the required registry hacks to make it work), I get this in the debug output: ++[mschap] returns noop [ntdomain] No '\' in User-Name = "host/C776669.ppmenergy.us", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop Now, I can clearly see that there *is* no '\' in the hostname there, nor should there be. But everything I've found on the web indicates that with the version of FreeRADIUS and Samba I have, %{mschap:User-Name} should be rewritten as C776669$. Getting the domain of the thing will be another challenge of its own, I imagine. Thank you in advance, for any help you can offer. -Bob Following is the complete output of the server startup, and then the output of a request: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = <secret> response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm PPMENERGY.US { } realm PPMENERGY { } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = <secret> nastype = "other" } client 10.56.160.5/32 { require_message_authenticator = no secret = <secret> shortname = "coloPrimary" nastype = "cisco" } client 10.56.160.6/32 { require_message_authenticator = no secret = <secret> shortname = "coloBackup" nastype = "cisco" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain:-00}" input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --domain=%{mschap:NT-Domain:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = yes virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating ntdomain realm ntdomain { format = "prefix" delimiter = "\" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. -------------------------------------------- Request output: rad_recv: Access-Request packet from host 10.56.160.5 port 32768, id=219, length=214 User-Name = "host/C776669.ppmenergy.us" Calling-Station-Id = "00-1b-77-88-ae-3e" Called-Station-Id = "8c-b6-4f-a6-36-80:IBD-Global" NAS-Port = 13 NAS-IP-Address = 10.56.160.5 NAS-Identifier = "POR-WAPCTL-01" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "209" EAP-Message = 0x020600061900 State = 0x1c7725f51f713c6d6a5dce719626f316 Message-Authenticator = 0xf118377d72bb899a7ff3fa3525355301 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [ntdomain] No '\' in User-Name = "host/C776669.ppmenergy.us", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 219 to 10.56.160.5 port 32768 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1c7725f518703c6d6a5dce719626f316 Finished request 14. Going to the next request Waking up in 4.9 seconds. Please be advised that email addresses for Iberdrola Renewables personnel have changed to first.last(a)iberdrolaREN.com effective Aug. 16, 2010. Please make a note. Thank you. This message is intended for the exclusive attention of the recipient(s) indicated. Any information contained herein is strictly confidential and privileged. If you are not the intended recipient, please notify us by return e-mail and delete this message from your computer system. Any unauthorized use, reproduction, alteration, filing or sending of this message and/or any attached files may lead to legal action being taken against the party(ies) responsible for said unauthorized use. Any opinion expressed herein is solely that of the author(s) and does not necessarily represent the opinion of the Company. The sender does not guarantee the integrity, speed or safety of this message, and does not accept responsibility for any possible damage arising from the interception, incorporation of viruses, or any other damage as a result of manipulation.

2 2

FreeRadius not working!!
by Amrita Mandpe 26 Apr '11

26 Apr '11

Hi Alan, I tried to implement FreeRadius Server for authentication against wireless laptop users, using TLS authentication(Self Signed Certificate) and it worked perfectly fine. But, when i tried to implement the same on a virtual machine,its giving me the error- Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Im using the latest version i.e. 2.1.10 of freeradius.Please let me know what is the exact issue?? Is it because i'm running the server on Virtual machine instead of Physical server?? Also, i have installed the openssl development headers ( openssl 0.9.8 version). Regards, Amrita

3 2

Condition-Based Accounting Proxy
by eitarad 26 Apr '11

26 Apr '11

Hi, Sorry for being such a newbie (; I would like to achieve the following situation: I`ve installed a FreeRadius server which will act as a proxy accounting server, Meaning that the server is forwarding the Accounting-Requests to another server. Now, I would like that once the FreeRadius server receives the Accounting-Request packet, he will check in a MySQL DB if the "User-Name" exists, if so - he will forward the Accounting-Request to the proxy server; If it does not exists, he will do nothing (halt). Please advice on how can I move forward. Thanks in advance! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Condition-Based-Accounting-Proxy-tp… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

can attr_filter.accounting_response be used in post-proxy section ?
by 魏景鹏 26 Apr '11

26 Apr '11

Dear All, In post-proxy section, I wrote lines as follows: post-proxy { if(cond) { attr_filter.accounting_response } } But it seems not work as expected. Any Ideas? Best Regards WeiJingPeng

2 2

"EAP session ... did not finish!" with VPN connections
by Zeus V Panchenko 26 Apr '11

26 Apr '11

Hi, it is my another attempt to know, how to cope with `EAP session ... did not finish' warning ... i have: OS: FreeBSD-8.x amd64 FreeRADIUS v.2.1.10 core freeradius configured with eap-tls, devices in my lan Symbian (Nokia E51,E52,E71,E72,E90) Android (HTC DesireS) Maemo (Nokia N900) xNIX (ASUS EeePC900) WindowsXP (various hardware) receiving authorization and ip address via dhcp without any problem but remote symbian devices behind vpn sometimes experience troubles ... in `radiusd -X' output, the problem looks this way: Going to the next request Waking up in 4.9 seconds. Cleaning up request 44 ID 6 with timestamp +3088 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x3866e92b3b62e4aa did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. the same remote symbian device which experienced problems via vpn, is experiencing no problem if i try to get authorization for it from lan or if i install clone (the same version with the same configuration) of core freeradius locally at the remote vpn side, than i can get authorization for the device which was unable to get it with core freeradius remotely so, what can be the cause of this weird behaviour? -- Zeus V. Panchenko IT Dpt., IBS ltd GMT+2 (EET)

2 2

Re: Freeradius-Users Digest, Vol 72, Issue 78
by arpitha arpitha 26 Apr '11

26 Apr '11

've actually installed freeradius n 've been successful 2 authenticate from same system using radtest. Sql integration 2 is successfully working. I wanna use EAP to connect to another system. On 4/26/11, freeradius-users-request(a)lists.freeradius.org <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Authenticating against Win2k8r2 without ntlm_auth (schilling) > 2. Re: Authenticating against Win2k8r2 without ntlm_auth > (Thomas Smith) > 3. Re: Authenticating against Win2k8r2 without ntlm_auth > (Phil Mayers) > 4. Re: Authenticating against Win2k8r2 without ntlm_auth > (Phil Mayers) > 5. (arpitha arpitha) > 6. Re: (Suman Dash) > 7. Problem with EAP-TLS authentication in Freeradius (senthil kumar) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 25 Apr 2011 09:44:33 -0400 > From: schilling <schilling2006(a)gmail.com> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <BANLkTik2ML94FHiB_0HGtTvC=CAyv-szZw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Could we extend the AD schema with another accessible ntPassword hash, > and thus use LDAP against AD for PEAP/MSCHAP? > > Schilling > > On Sun, Apr 24, 2011 at 4:33 AM, Phil Mayers <p.mayers(a)imperial.ac.uk> > wrote: >> On 04/24/2011 12:48 AM, Thomas Smith wrote: >> >>> While Samba 3.5 and Likewise 6 fixed the problems authenticating >>> against Win2k8r2, Likewise removed support for Samba/Winbind in their >>> 6.x series product (they included full support for Samba/Winbind in >>> their 5.x series product)--they now use their own libraries to provide >>> "winbind" functionality. The result of this is that the Samba-included >>> ntlm_auth no longer works (and Likewise doesn't provide a comparable >>> replacement)--since my FreeRADIUS install was using ntlm_auth for AD >>> authentication and authorization, it is no longer working. >> >> If you're using Samba/ntlm_auth, you're probably doing PEAP/MSCHAP, in >> which >> case you have precisely one option - continuing to use Samba/ntlm_auth. >> >> Neither kerberos nor LDAP against AD (nor any other method) can be used to >> process MSCHAP authentications. >> >> If Likewise are going to replace bits of the Samba stack, they should >> provide compatible bits. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > ------------------------------ > > Message: 2 > Date: Mon, 25 Apr 2011 11:33:56 -0700 > From: Thomas Smith <theitsmith(a)gmail.com> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <BANLkTimfyMS_qobO1bxE4Q8xgKDz0zA6yQ(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On Sun, Apr 24, 2011 at 1:33 AM, Phil Mayers <p.mayers(a)imperial.ac.uk> > wrote: >> On 04/24/2011 12:48 AM, Thomas Smith wrote: >> >>> While Samba 3.5 and Likewise 6 fixed the problems authenticating >>> against Win2k8r2, Likewise removed support for Samba/Winbind in their >>> 6.x series product (they included full support for Samba/Winbind in >>> their 5.x series product)--they now use their own libraries to provide >>> "winbind" functionality. The result of this is that the Samba-included >>> ntlm_auth no longer works (and Likewise doesn't provide a comparable >>> replacement)--since my FreeRADIUS install was using ntlm_auth for AD >>> authentication and authorization, it is no longer working. >> >> If you're using Samba/ntlm_auth, you're probably doing PEAP/MSCHAP, in >> which >> case you have precisely one option - continuing to use Samba/ntlm_auth. >> >> Neither kerberos nor LDAP against AD (nor any other method) can be used to >> process MSCHAP authentications. >> >> If Likewise are going to replace bits of the Samba stack, they should >> provide compatible bits. > > Yeah, that's exactly what I've been doing. I was hoping to find > another method, but that doesn't sound promising. > > I brought this to Likewise' attention as soon as I noticed the issue. > They are looking into it but haven't given me a time frame for a > "fix", or even if there will provide one. > > > ------------------------------ > > Message: 3 > Date: Mon, 25 Apr 2011 21:30:14 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4DB5D9D6.7060706(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 04/25/2011 02:44 PM, schilling wrote: >> Could we extend the AD schema with another accessible ntPassword hash, >> and thus use LDAP against AD for PEAP/MSCHAP? > > Yes, if you know everyones plaintext password. But if you do, you don't > have this problem at all; you can just store Cleartext-Password in some > secured SQL database and use that. > > In short: it's usually impractical. > > > ------------------------------ > > Message: 4 > Date: Mon, 25 Apr 2011 21:39:10 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Authenticating against Win2k8r2 without ntlm_auth > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4DB5DBEE.4040606(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 04/25/2011 07:33 PM, Thomas Smith wrote: >> >> I brought this to Likewise' attention as soon as I noticed the issue. >> They are looking into it but haven't given me a time frame for a >> "fix", or even if there will provide one. > > I'm not familiar with Likewise (nor do I have any desire to become so). > But if they provide any development libraries or infrastructure, you may > be able to implement the feature yourself. > > All "ntlm_auth" ends up doing is SamNetworkLogon RPC against the > netlogon pipe of a domain controller. Minimally, they just need to > provide you a binary (or you code one up) that calls that RPC using the > challenge and ntresponse values (along with username/domain) and returns > the NT key value. > > The other alternative would be to compile Samba into a separate > directory tree, and configure it carefully - then join it to the domain > as a separate "virtual" domain member, which is only used for running > winbind and ntlm_auth. You might have problems with nmbd and binding to > port 13x. > > But honestly: it would probably be easier to just run Samba on your > FreeRadius servers, and forgo Likewise. > > > ------------------------------ > > Message: 5 > Date: Tue, 26 Apr 2011 10:16:22 +0530 > From: arpitha arpitha <arpithaarp(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Message-ID: <BANLkTikd7_UuLhduJUhcRacJf43+coJThw(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > hi, 'm very new to freeradius, i want to setup radius server to > authenticate another system connected through an access point. i'l b > grateful if any1 can tell d steps 2 do this r give links 2 d related > materials. Thnks in advance :-) > > > ------------------------------ > > Message: 6 > Date: Tue, 26 Apr 2011 10:40:31 +0530 > From: Suman Dash <suman(a)clydontech.com> > Subject: Re: > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4DB653C7.3080203(a)clydontech.com> > Content-Type: text/plain; charset="iso-8859-1"; Format="flowed" > > Please read the documentation on how to setup freeradius. From your post > it is unclear as what type of auth you need. There are official docs at > freeradius.org which you might want to see. > > On 4/26/2011 10:16 AM, arpitha arpitha wrote: >> hi, 'm very new to freeradius, i want to setup radius server to >> authenticate another system connected through an access point. i'l b >> grateful if any1 can tell d steps 2 do this r give links 2 d related >> materials. Thnks in advance :-) >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> >> >> __________ Information from ESET NOD32 Antivirus, version of virus >> signature database 6042 (20110414) __________ >> >> The message was checked by ESET NOD32 Antivirus. >> >> http://www.eset.com >> >> >> >> >

1 0

Problem with EAP-TLS authentication in Freeradius
by senthil kumar 26 Apr '11

26 Apr '11

Hi All, I am using Freeradius 2.1.0 PEAP/TTLS is working fine and I am facing problem in TLS authentication. I am able to generate certificate but while connecting it throws Authentication error. Can some one send me client.cnf and server.cnf. Also let me know whether installing only client is enough or do we need to install ca.pem also in client side. Please let me know how to debug it. rad_recv: Access-Request packet from host 192.168.1.1 port 4906, id=6, length=147 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 State = 0xc0ff35f8c1fd389f4e860dc8a76c03f8 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060d00 Message-Authenticator = 0xcf453c67c6fe4f7695dbba231da2ba1e +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.1.1 port 4906 EAP-Message = 0x010304000dc00000085b310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f301e170d3131303430373038333135345a170d3132303430363038333135345a306e310b300906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f30820122300d06092a864886f70d01010105000382010f003082010a0282010100ebdf EAP-Message = 0xbd5045d1129f68d6354ecaf6d0b003ba682e0399145d83af7d3f7baeac7b70278682f26b7a6cf02cb0f70d06c27cd5666f6acd0a6e1a05f14cbca9ee2ca06038289d718635789b9378b41d5d89d98c09528e5d75a7ed1210ab639c80a82bb7f727a6641b4ead338d36c98e4910f69add0990c1838bf1dd67d3ef00190a8c50afa3d267b4721eb24c9297eac37244c2f09bf5db1e864ed3e71d7b2f1523f957d040b88bdfbb50ffa7a1fcb77fe8f692faeaf4f26539f93d4b16fefd22576b63425a3b106d4100a7e606110980202629a14f721f576e7b57e94182c695034f33cc5cf153c08074379ee285a4800d30fcc3eeb9618e95b3298852c0e050cc EAP-Message = 0x370203010001a381d33081d0301d0603551d0e041604146495968035da2071580d6554ff37f49f34a6a4fc3081a00603551d2304819830819580146495968035da2071580d6554ff37f49f34a6a4fca172a470306e310b300906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f82090088f0548531fc31df300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100c60eb4fe9642b5cf1a479ddd03 EAP-Message = 0x31954bd3c5a8c13dac220146915074390da01b0cf44950935ca2fad0bbca312ad8d1ac38a0ad88e51bc7bfc4df349d238aa9dee95ccc333e46e422da2fd67073a5fc1d6109e623efdf7be334a6746b4d3eb012ddb331600471732e961861980a4d0a146e56ee383e1717a209476a34d2ad7153a00f0729976f4d73d4979dc992ab8cc4515787e68afd1979038963882c5f55ed1d038c137689ef3e0fa52d63eabe0466ef126564ff4627776f31dba8bd91b9c486ddf6e8399c755bd29456cfed9bda7890851bfb23d3c381e5176a6b6c86ea9cefc5b7428409e35a794775d27f1664c06aeb46842f61c6145a71a7a0fdea54e316030100800d00007803 EAP-Message = 0x01024000720070306e310b30 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0ff35f8c2fc389f4e860dc8a76c03f8 Finished request 156. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 4908, id=6, length=147 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 State = 0xc0ff35f8c2fc389f4e860dc8a76c03f8 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060d00 Message-Authenticator = 0xdeea6893aacbe253ed951368cec20746 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 6 to 192.168.1.1 port 4908 EAP-Message = 0x010400790d800000085b0906035504061302494e310b3009060355040813024b413112301006035504071309536f6d657768657265310e300c060355040a13054e6f6b6961311e301c06092a864886f70d010901160f6d616d656f406e6f6b69612e636f6d310e300c060355040313054d6565676f0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc0ff35f8c3fb389f4e860dc8a76c03f8 Finished request 157. Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 4910, id=6, length=154 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 State = 0xc0ff35f8c3fb389f4e860dc8a76c03f8 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000d0d001503010002012a Message-Authenticator = 0x782f15b2fce0fe49f406f1cb224b1ccf +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] eaptls_verify returned 7 [tls] Done initial handshake [tls] <<< TLS 1.0 Alert [length 0002], warning bad_certificate TLS Alert read:warning:bad certificate [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode SSL Application Data TLS failed during operation [tls] eaptls_process returned 4 [eap] Handler failed in EAP/tls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> maemo(a)nokia.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 158 for 1 seconds Going to the next request Waking up in 0.4 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 4912, id=6, length=136 User-Name = "maemo(a)nokia.com" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0023692c6f74" Calling-Station-Id = "0025d05b72ab" NAS-Identifier = "0023692c6f74" NAS-Port = 2 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204000d0d001503010002020a Message-Authenticator = 0x542730d7c53937fe5e038692a71646ff +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "nokia.com" for User-Name = "maemo(a)nokia.com" [suffix] Found realm "DEFAULT" [suffix] Adding Stripped-User-Name = "maemo" [suffix] Adding Realm = "DEFAULT" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [eap] EAP packet type response id 4 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry maemo at line 74 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> maemo(a)nokia.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 159 for 1 seconds Going to the next request Waking up in 0.4 seconds. Cleaning up request 146 ID 6 with timestamp +2141 Cleaning up request 147 ID 6 with timestamp +2141 Waking up in 0.5 seconds. Sending delayed reject for request 158 Sending Access-Reject of id 6 to 192.168.1.1 port 4910 EAP-Message = 0x04040004 Message-Authenticator = 0x00000000000000000000000000000000 Sending delayed reject for request 159 Sending Access-Reject of id 6 to 192.168.1.1 port 4912 Waking up in 1.1 seconds. Cleaning up request 148 ID 6 with timestamp +2143 Cleaning up request 149 ID 6 with timestamp +2143 Cleaning up request 150 ID 6 with timestamp +2143 Cleaning up request 151 ID 6 with timestamp +2143 Waking up in 1.0 seconds. Cleaning up request 152 ID 6 with timestamp +2143 Cleaning up request 153 ID 6 with timestamp +2143 Waking up in 1.7 seconds. Cleaning up request 154 ID 6 with timestamp +2146 Cleaning up request 155 ID 6 with timestamp +2146 Cleaning up request 156 ID 6 with timestamp +2146 Cleaning up request 157 ID 6 with timestamp +2146 Waking up in 1.0 seconds. Cleaning up request 158 ID 6 with timestamp +2146 Cleaning up request 159 ID 6 with timestamp +2146 Regards Senthil

1 0

Authenticating against Win2k8r2 without ntlm_auth
by Thomas Smith 25 Apr '11

25 Apr '11

Hi, I'm using FreeRADIUS 2.1.7 on RHEL 5.6. My AD admins recently upgraded from Win2k3 to Win2k8r2. As a result, this broke compatibility with Samba 3.0.x--so I was forced to upgrade to Samba 3.5.x to resolve those issues. To further complicate things, I use Likewise Enterprise to provide AD integration--for compatibility with Samba 3.5.x, I had to upgrade from Likewise 5.x to 6.0. While Samba 3.5 and Likewise 6 fixed the problems authenticating against Win2k8r2, Likewise removed support for Samba/Winbind in their 6.x series product (they included full support for Samba/Winbind in their 5.x series product)--they now use their own libraries to provide "winbind" functionality. The result of this is that the Samba-included ntlm_auth no longer works (and Likewise doesn't provide a comparable replacement)--since my FreeRADIUS install was using ntlm_auth for AD authentication and authorization, it is no longer working. So I'm looking at alternate ways of authenticating against Win2k8r2. I was hoping to get some input from the list regarding this. The FreeRADIUS server is fully configured (via Likewise Enterprise) to authenticate against AD using Kerberos. Authorization is also provided by Likewise Enterprise through other libraries. Both authentication and authorization function properly at the OS level and it integrates well with PAM and anything that can use Kerberos for authentication--so you can do things like log into the server via SSH using AD credentials. I currently only use FreeRADIUS to provide access to VPN clients--the VPN server is a Cisco ASA. I am also working on a Cisco Aironet deployment that will use FreeRADIUS, though this hasn't been configured yet (I'm in the early stages of that deployment). I don't really care if authorization is local or via AD, but I would definitely like authentication to occur via AD. So barring ntlm_auth, is there a good/better/best way of connecting FreeRADIUS to AD? PAM? Kerberos? LDAP? ~ Tom

4 8

question re inner tunnel / virtual server
by Michael Arndt 25 Apr '11

25 Apr '11

Hi *, i try to get a better grip in understanding the virtual server for inner eap tunnel. Please forgive if any of the following statements represents misunderstanding of concepts from my side. Which of the following statements describe the inner tunnel virtual server for EAP wrong / correct ? EAP: -The eap module can map tunneled requests to a virtual server ( inner tunnel ) - It "knows" where to communicate by freeradius reading the virtual servers configs in sites-enabled -So the Port configured for the inner tunnel virtual server (statement valid only for this inner tunnel VS) is only relevant wrt external for testing purposes in order to test correct freeradius config wrt EAP -freeradius handles the communication to the inner tunnel with the above mentioned mapping of the eap module. So in productive use there is no need to reference the Port for the inner tunnel ( except when proxying or using the test for EAP to check for a valid config ) -the main goal of the inner tunnel virtual server is to allow completely independent policies for outer / inner tunneled sessions. hope i did not fall for to many misunderstandings TIA Micha

2 1