- Freeradius-Users - lists.freeradius.org

Re: Freeraidus 2
by Usuário do Sistema 10 Mar '11

10 Mar '11

Hello, My freeradius2 it's up and when I make a test from other linux machine with command "radtest joao.vero jango123 128.2.100.131 2 meleca" it's working as follow out Sending Access-Request of id 45 to 128.2.100.131 port 1645 User-Name = "joao.vero" User-Password = "jango123" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 128.2.100.131:1645, id=45, length=20 But, when I'm going to authenticate wireless users ( with EAP-TLS, I'm using the test certificate from /etc/raddb/certs/..) It isn't working. it's appear in log: [mschap] No Cleartext-Password configured. Cannot create LM-Password. I wish to use LDAP for authenticate my users but seems that User-Password must be Clear text. there is possible reach EAP-TLS with LDAP?? What I have do ?? any help is welcome....I'm new in freeradius. Gary Gatten, what did you mean with Content-Type: text/plain; charset="utf-8" as your comments thank everyone! 2011/3/5 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (Phil Mayers) > 2. Re: Freeraidus 2 (Gary Gatten) > 3. Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) (James J J Hooper) > 4. RE: mschap with ntlm_auth and Active Directory (McNutt, Justin M.) > 5. Re: MS-CHAP-V2 with no retry (Alan DeKok) > 6. Re: Hopefully quick question: conditional processing sneaking > in and setting Auth-Type (Alan DeKok) > 7. Re: Freeraidus 2 (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Sat, 05 Mar 2011 00:45:43 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: Caching techniques with ntlm_auth usage? > (EAP-PEAP-MSchapV2) > To: freeradius-users(a)lists.freeradius.org > Message-ID: <4D7187B7.5000402(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 03/05/2011 12:21 AM, Gary Gatten wrote: > > I kinda like your caching idea, but not sure of any security > > implications. > > It's not a workable idea. MSCHAP responses are specific to the 8-byte > random challenge, which is different every time. You can't cache them. > > > > > I have (2) FR servers (each pointing to different DC) and my NAS's > > are configured to use both. But, iirc if AD is down on the backend > > FR still replies (with something) so the NAS never rolls over to the > > other FR server. > > Yes, this is a bad idea. > > Just configure samba to autodiscover the AD controllers. Winbind will > cache connections and open new ones when the old ones go away. > > > > > So, I thought about some script that would use ntlm_auth every...n > > seconds, if it fails kill FR process (or use FR policy to act dead). > > When it starts working again, restart FR. This should make the NAS > > roll to the next FR server. > > That might work, but it seems like a sledgehammer to crack a nut. > > > > > What about OpenLDAP on the FR server that's "refreshed" / sync'd to > > the winblows/AD? I've never tried this but assume it's doable. > > It's not possible. AD controllers will only sync to other AD controllers. > > At some point in the future, Samba 4 might be able to slave the LDAP > database of an AD controller, but it's purely theoretical at the moment > I think. > > > ------------------------------ > > Message: 2 > Date: Fri, 4 Mar 2011 18:54:44 -0600 > From: Gary Gatten <Ggatten(a)waddell.com> > Subject: Re: Freeraidus 2 > To: "'freeradius-users(a)lists.freeradius.org'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > < > 27487_1299286485_4D7189D5_27487_3768_1_D9B37353831173459FDAA836D3B43499BD354A55(a)WADPMBXV0.waddell.com > > > > Content-Type: text/plain; charset="utf-8" > > Try ../sites_enabled/default; or if *eap requests it would be inner-tunnel, > - I think... > > From: Paulo Maia [mailto:phc.maia@gmail.com] > Sent: Friday, March 04, 2011 06:43 PM > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeraidus 2 > > Compilou o instalou via yum ? Geralmente fica em $RADIUSDIR/modules/ldap > > Abs, > > > 2011/3/4 Usu?rio do Sistema <maiconlp(a)ig.com.br<mailto:maiconlp@ig.com.br > >> > Hello everyone, I'm Maicon from Brazil. > > I'm in a project with Freeradius. I want to deployment authentication with > certificate from my wireless users EAP-TLS but I'm finding some difficult. > there is a good how to for version 2 ?? I've started with version 1.x but > decided to change for version 2 and I'm not finding where I set the LDAP > conection. at the older version it was inside radiusd.conf. anybody help me > ?? > > > thank! > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > <font size="1"> > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in > 0in 1.0pt 0in'> > </div> > "This email is intended to be reviewed by only the intended recipient > and may contain information that is privileged and/or confidential. > If you are not the intended recipient, you are hereby notified that > any review, use, dissemination, disclosure or copying of this email > and its attachments, if any, is strictly prohibited. If you have > received this email in error, please immediately notify the sender by > return email and delete this email from your system." > </font> > >

1 0

Multiple modules entries
by m jones 10 Mar '11

10 Mar '11

Hi I'm trying to configure radiusd.conf Module section to look at more than one module config. Can get one to work but when I add a second it dosen't work. below is a copy of my radiusd.conf file. modules { # # Each module has a configuration as follows: # # name [ instance ] { # config_item = value # ... # } # ldap ldap1 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 ... } ldap ldap 2 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 ... } # The 'name' is used to load the 'rlm_name' library # which implements the functionality of the module. # # The 'instance' is optional. To have two different instances # of a module, it first must be referred to by 'name'. # The different copies of the module are then created by # inventing two 'instance' names, e.g. 'instance1' and 'instance2' # # The instance names can then be used in later configuration # INSTEAD of the original 'name'. See the 'radutmp' configuration # below for an example. # # PAP module to authenticate users based on their stored password # # Supports multiple encryption schemes # clear: Clear text # crypt: Unix crypt # md5: MD5 ecnryption # sha1: SHA1 encryption. # DEFAULT: crypt pap { encryption_scheme = crypt } # CHAP module # # To authenticate requests containing a CHAP-Password attribute. # chap { authtype = CHAP } # Pluggable Authentication Modules # # For Linux, see: # http://www.kernel.org/pub/linux/libs/pam/index.html # # WARNING: On many systems, the system PAM libraries have # memory leaks! We STRONGLY SUGGEST that you do not # use PAM for authentication, due to those memory leaks. # pam { # # The name to use for PAM authentication. # PAM looks in /etc/pam.d/${pam_auth_name} # for it's configuration. See 'redhat/radiusd-pam' # for a sample PAM configuration file. # # Note that any Pam-Auth attribute set in the 'authorize' # section will over-ride this one. # pam_auth = radiusd } # Unix /etc/passwd style authentication # unix { # # Cache /etc/passwd, /etc/shadow, and /etc/group # # The default is to NOT cache them. # # For FreeBSD and NetBSD, you do NOT want to enable # the cache, as it's password lookups are done via a # database, so set this value to 'no'. # # Some systems (e.g. RedHat Linux with pam_pwbd) can # take *seconds* to check a password, when th passwd # file containing 1000's of entries. For those systems, # you should set the cache value to 'yes', and set # the locations of the 'passwd', 'shadow', and 'group' # files, below. # # allowed values: {no, yes} cache = no # Reload the cache every 600 seconds (10mins). 0 to disable. cache_reload = 600 # # Define the locations of the normal passwd, shadow, and # group files. # # 'shadow' is commented out by default, because not all # systems have shadow passwords. # # To force the module to use the system password functions, # instead of reading the files, leave the following entries # commented out. # # This is required for some systems, like FreeBSD, # and Mac OSX. # # passwd = /etc/passwd # shadow = /etc/shadow # group = /etc/group # # The location of the "wtmp" file. # This should be moved to it's own module soon. # # The only use for 'radlast'. If you don't use # 'radlast', then you can comment out this item. # radwtmp = ${logdir}/radwtmp } # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication (Auth-Type := LDAP) # # See doc/rlm_ldap for description of configuration options # and sample authorize{} and authenticate{} blocks ldap ldap1 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 #==== # identity = "cn=sambaProxy,o=GMC" # password = "" identity = "cn=GMET-RADIUS,ou=STUDENTS,ou=USERS,o=GMC" password = "radius" #==== basedn = "ou=BUILTENV,ou=STUDENTS,ou=USERS,o=GMC" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" #basedn = "ou=STUDENTS,ou=USERS,o=GMC" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no tls_mode = yes # tls_cacertfile = /radius_certs/gmet-tree.b64 tls_cacertfile = /etc/raddb/certs/gmet-tree.b64 # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #access_attr = "dialupAccess" access_attr_used_for_allow = no # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: password_attribute = nspmPassword access_attr_used_for_allow = no # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # edir_account_policy_check=yes # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} set_auth_type = no } ldap ldap2 { server = "gmcnhs1.glasgowmet.ac.uk" port = 636 #==== # identity = "cn=sambaProxy,o=GMC" # password = "" identity = "cn=GMET-RADIUS,ou=STUDENTS,ou=USERS,o=GMC" password = "radius" basedn = "ou=COMMSMED,ou=STUDENTS,ou=USERS,o=GMC" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" #basedn = "ou=STUDENTS,ou=USERS,o=GMC" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no tls_mode = yes # tls_cacertfile = /radius_certs/gmet-tree.b64 tls_cacertfile = /etc/raddb/certs/gmet-tree.b64 # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #access_attr = "dialupAccess" access_attr_used_for_allow = no # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # NOTICE: The password_header directive is NOT case insensitive # # password_header = "{clear}" # # Set: password_attribute = nspmPassword access_attr_used_for_allow = no # # to get the user's password from a Novell eDirectory # backend. This will work *only if* freeRADIUS is # configured to build with --with-edir option. # # # The server can usually figure this out on its own, and pull # the correct User-Password or NT-Password from the database. # # Note that NT-Passwords MUST be stored as a 32-digit hex # string, and MUST start off with "0x", such as: # # 0x000102030405060708090a0b0c0d0e0f # # Without the leading "0x", NT-Passwords will not work. # This goes for NT-Passwords stored in SQL, too. # # password_attribute = userPassword # # # Un-comment the following to disable Novell eDirectory account # policy check and intruder detection. This will work *only if* # FreeRADIUS is configured to build with --with-edir option. # edir_account_policy_check=yes # # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes # # By default, if the packet contains a User-Password, # and no other module is configured to handle the # authentication, the LDAP module sets itself to do # LDAP bind for authentication. # # You can disable this behavior by setting the following # configuration entry to "no". # # allowed values: {no, yes} set_auth_type = no } authorize { # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. # # It also adds the %{Client-IP-Address} attribute to the request. preprocess # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. # auth_log # attr_filter # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set chap # # If the users are logging in with an MS-CHAP-Challenge # attribute for authentication, the mschap module will find # the MS-CHAP-Challenge attribute, and add 'Auth-Type := MS-CHAP' # to the request, which will cause the server to then use # the mschap module for authentication. # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap1 ldap2 # authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. # digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # unix # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Auth-Type LDAP { ldap1 ldap2 } # # Allow EAP authentication. eap } I am new freeradius so any help would be appreciated. Performed a debug and received. Error: Cannot find a configuration entry for module ldap. Error: radiusd.conf [2018] unknown module ldap Error: radiuse.conf [2018] failed to parse ldap entry. version of freeradius 1.1.7 Miles -- View this message in context: http://freeradius.1045715.n5.nabble.com/Multiple-modules-entries-tp3405254p… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Lastest using git
by David Peterson 10 Mar '11

10 Mar '11

I am trying to recompile any new changes but cannot for the life of me remember how to check out the latest version. I believe it's called "Stable" David

3 3

different perl module in different virtual server result different w/ or w/o -X
by schilling 10 Mar '11

10 Mar '11

Hi All, I am running 2.1.6. I have modules/perl_resnet like perl perl_resnet {...} for virtual server resnet, which will put mac-address in sandbox vlan if not in database. and I have modules/perl_foosecure perl perl_foosecure{...} for virtual server auth used as inner-tunnel for eap, which will put user(a)foo.edu in one of student0[1234] vlan if ldap returns status as student. When I run radiusd -X, user(a)foo.edu will be put in one of student0[1234] every time. But if I run normal radiusd w/o -X flag, user(a)foo.edu will sometimes be put in sandbox vlan, and sometimes be put in one of student0[1234] vlan. [root@auth1 raddb]# perl -V | grep -i multip usethreads=define use5005threads=undef useithreads=define usemultiplicity=define Compile-time options: MULTIPLICITY PERL_IMPLICIT_CONTEXT Any insight? Schilling

1 0

CHAP problem with PPPoE server
by Paul Thornton 09 Mar '11

09 Mar '11

Hi List, I've got a problem which I now know isn't FreeRADIUS misbehaving but seems to be some CHAP-related issue, but I can't see what. With advanced apologies for being somewhat off-topic, I'm wondering if anyone has any ideas? I've been building a test PPPoE server on Linux, specifically CentOS 5.5 with pppd 2.4.4 (also tried 2.4.5) and freeradius-client 1.1.6. PPPoE provided by rp-pppoe-3.10. The server is FreeRADIUS 1.1.7 which I know is a bit old, but this is in use as a production machine and authenticates a lot of PPP and interactive login requests without any trouble so hasn't been upgraded for a while. In my test setup, all attempts to use CHAP or MSCHAP-v2 for authentication fail, basically because there is no CHAP challenge or password sent with the Access-Request. Not unreasonably, the radius server rejects the request: rad_recv: Access-Request packet from host 217.65.165.176:43606, id=160, length=54 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "paultest" NAS-IP-Address = 217.65.165.176 NAS-Port = 0 ... auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [paultest/<no User-Password attribute>] (from client vttest02 port 0) I've also set up a FreeBSD PPPoE server to check that this wasn't a client-side problem; currently I'm using a Mac OS X client but it also fails using Windows or a Cisco client. It works OK with the FreeBSD server - hence the statement about knowing it isn't a FreeRADIUS issue: rad_recv: Access-Request packet from host 217.65.165.171:50582, id=224, length=180 User-Name = "paultest" Service-Type = Framed-User Framed-Protocol = PPP MS-CHAP-Challenge = 0x33323733383637393730323730333033 MS-CHAP2-Response = 0x0100b2a9c9bdfa3458c17851fd4170fb83ad0000000000000000967b707a1f73c2fa39c936a671ed4e01beb4c9744466c88e NAS-IP-Address = 217.65.165.171 NAS-Identifier = "build1" Calling-Station-Id = "7c:6d:62:90:36:55" NAS-Port-Type = Ethernet NAS-Port = 12 ... Login OK: [paultest] (from client vttest01 port 12 cli 7c:6d:62:90:36:55) Clearly the difference is in the challenge - but I'm at a loss to understand why this wouldn't "just work" with RADIUS. The pppd logs suggest that it is using CHAP, but it doesn't think that letting the RADIUS server have the challenge is important... Has anyone had a similar problem or can suggest anything? I've been going around in circles here all day and ended up going nowhere. Many thanks, Paul.

3 4

How to stop at pre-proxy python module with Access-Request
by Ranjith T 09 Mar '11

09 Mar '11

Hi, I am using freeradius 2.1.10 and python modules at different stages(pre-proxy, post-proxy) of my RADIUS server which is running in proxy mode. >From the python pre-proxy module I am able to return "radiusd.RLM_MODULE_HANDLED" which is handled at pre-proxy section of the file "sites-available/default". I want the server to stop at "HANDLED" and send back "Access-Accept" back to the requested client from pre-proxy once the return is HANDLED. Can anyone point to me how to achieve this? The following is what I have tried. My problem is that: if I configure "ok" from "if (handled) {" part of the pre-proxy, the server proceeds with sending this request to external RADIUS server for Authentication(looks like normal behavior with module returning OK ) and if I return "handled" from "if(handled) {" part, then the server gives the following, (Same behavior is observed with setting "handled = return" inside "python{}" module.) Ready to process requests. rad_recv: Access-Request packet from host 72.163.210.89 port 2051, id=96, length=104 User-Name = "ranjith" User-Password = "test123" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "ranjith", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Stripped-User-Name = "ranjith" [suffix] Adding Realm = "NULL" [suffix] Proxying request from user ranjith to realm NULL [suffix] Preparing to proxy authentication request to realm "NULL" ++[suffix] returns updated [eap] No EAP-Message, not doing EAP ++[eap] returns noop *** I am in authorize!!!!!!!!!!!!!!!!!! *** *** radlog call in authorize *** ++[python] returns ok ++? if (handled) ? Evaluating (handled) -> FALSE ++? if (handled) -> FALSE ++[files] returns noop [sql] expand: %{User-Name} -> ranjith [sql] sql_set_user escaped user --> 'ranjith' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'ranjith' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'ranjith' ORDER BY priority rlm_sql (sql): Released sql socket id: 1 [sql] User ranjith not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop # Executing section pre-proxy from file /etc/raddb/sites-enabled/default +- entering group pre-proxy {...} *** radlog call in pre_proxy_ranjith !!!!!!!!!!!!!!!*** *** pre_proxy_ranjith Found Session !!!!!!!!!!!!! *** ++[python] returns handled ++? if (handled) ? Evaluating (handled) -> TRUE ++? if (handled) -> TRUE ++- entering if (handled) {...} +++[handled] returns handled ++- if (handled) returns handled There was no response configured: rejecting request 1 Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> ranjith attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 94 to 72.163.210.89 port 2010 Waking up in 4.9 seconds. Cleaning up request 1 ID 94 with timestamp +19 Ready to process requests. The following is the snippet of the "sites-available/default" pre-proxy section. pre-proxy { # attr_rewrite # Uncomment the following line if you want to change attributes # as defined in the preproxy_users file. # files # Uncomment the following line if you want to filter requests # sent to remote servers based on the rules defined in the # 'attrs.pre-proxy' file. # attr_filter.pre-proxy # If you want to have a log of packets proxied to a home # server, un-comment the following line, and the # 'detail pre_proxy_log' section, above. # pre_proxy_log #python python { notfound = 1 noop = 2 ok = 3 updated = 4 fail = return reject = return userlock = return invalid = return handled = 3 #handled = return #ok = return } if (handled) { #Post-Auth-Type = Access-Accept #Response-Packet-Type = Access-Accept #handled ok } } The following is the snippet of the "sites-available/default" authenticate section(added python module). authenticate { # # PAP authentication, when a back-end database listed # in the 'authorize' section supplies a password. The # password can be clear-text, or encrypted. Auth-Type PAP { pap } # # Most people want CHAP authentication # A back-end database listed in the 'authorize' section # MUST supply a CLEAR TEXT password. Encrypted passwords # won't work. Auth-Type CHAP { chap } # # MSCHAP authentication. Auth-Type MS-CHAP { mschap } # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authorize' section. digest # # Pluggable Authentication Modules. # pam # # See 'man getpwent' for information on how the 'unix' # module checks the users password. Note that packets # containing CHAP-Password attributes CANNOT be authenticated # against /etc/passwd! See the FAQ for details. # # For normal "crypt" authentication, the "pap" module should # be used instead of the "unix" module. The "unix" module should # be used for authentication ONLY for compatibility with legacy # FreeRADIUS configurations. # unix python #python { #This doesn't work #ok = handled #} # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. # Auth-Type LDAP { # ldap # } # # Allow EAP authentication. eap # # The older configurations sent a number of attributes in # Access-Challenge packets, which wasn't strictly correct. # If you want to filter out these attributes, uncomment # the following lines. # # Auth-Type eap { # eap { # handled = 1 # } # if (handled && (Response-Packet-Type == Access-Challenge)) { # attr_filter.access_challenge.post-auth # handled # override the "updated" code from attr_filter # } # } } Thanks Ranjith T

2 1

Freeradius dies...
by Etienne Pretorius 09 Mar '11

09 Mar '11

Hello All, Can anyone make sense of this for me? ASSERT FAILED event.c[1181]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL I have 3 detail instances and 3 detail listeners proxying the detail file to 3 servers. I have at the same time the COA server sample modified for packets-of-disconnects The COA server is suppose to fail since this server is not production yet, and after its 3rd attempt the above error message appears. Detail listener /var/log/freeradius/radacct/server0/detail-* state running signalled 0 waiting 1.139005 sec Waking up in 0.3 seconds. Detail listener /var/log/freeradius/radacct/server1/detail-* state running signalled 0 waiting 0.940611 sec Waking up in 0.2 seconds. Detail listener /var/log/freeradius/radacct/server2/detail-* state running signalled 0 waiting 0.822329 sec Waking up in 0.5 seconds. Detail listener /var/log/freeradius/radacct/server0/detail-* state running signalled 0 waiting 0.864066 sec Waking up in 0.1 seconds. Detail listener /var/log/freeradius/radacct/server1/detail-* state running signalled 0 waiting 1.007105 sec Detail listener /var/log/freeradius/radacct/server2/detail-* state running signalled 0 waiting 1.219968 sec Waking up in 0.3 seconds. Sending Disconnect-Request of id 246 to 196.43.3.86 port 1700 User-Name = "protected@address" NAS-IP-Address = 196.43.27.72 Framed-IP-Address = 41.240.31.186 X-Ascend-Session-Svr-Key = "D9144C7B" Waking up in 0.2 seconds. Detail listener /var/log/freeradius/radacct/server0/detail-* state running signalled 0 waiting 1.214130 sec Waking up in 0.2 seconds. ASSERT FAILED event.c[1181]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL Aborted ;========== freeradius: FreeRADIUS Version 2.1.10, for host i486-pc-linux-gnu, built on Nov 14 2010 at 20:41:03 Copyright (C) 1999-2010 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. ;========= Using Debian Linux. Kind Regards, Etienne Pretorius

2 2

Secondary LDAP server
by McNutt, Justin M. 09 Mar '11

09 Mar '11

One of my virtual servers uses LDAP auth. However, it isn't clear to me if modules/ldap can be configured with a secondary LDAP server, should the primary fail to respond. The group that provides the LDAP server can't set up multiple servers behind a load balancer due to cert issues, so I'm looking for a way to add a failover LDAP server to the RADIUS configuration. What's the easiest/best/recommended way to do something like this? Can modules/ldap be configured this way, or should I create a modules/ldap2 (or similar) and call it somehow? Suggestions welcome. Thanks! Justin McNutt Network Systems Analyst - Ninja DNPS, Mizzou Telecom (573) 882-5183 "Do you have a concussion?" Ping is NOT a service. You don't need it. Use a real test.

4 4

RE: Hopefully quick question: conditional processing sneaking in and setting Auth-Type
by Gary Gatten 08 Mar '11

08 Mar '11

So.... Still not sure what file is tweaking this. I ended up copying the entire /raddb dir from ServerB to ServerA to get the same exact behavior. Prior to that I tried. Replicating (copying the file via ftp): radiusd.conf, users, default, inner-tunnel, radiusd, ... maybe more. I also manually diff'd: chap, mschap, pap, hints, huntgroups, ...maybe more.... Is there additional radiusd args I can use to see what module/file/etc is executing the conditional processing? ... [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop # Begin output of goofy processing ++? if (!control:Auth-Type) ? Evaluating !(control:Auth-Type) -> FALSE ++? if (!control:Auth-Type) -> FALSE # End output of goofy processing Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} ... I'll be more than happy to sanitize numerous pages of radiusd -X output from both servers, but I captured and diff'd those and accounted for all diffs from the startup process. As noted, I also replicated the most common conf files that I probably tweaked. Weird... Thanks! Gary -----Original Message----- From: Gary Gatten Sent: Saturday, March 05, 2011 9:17 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: Re: Hopefully quick question: conditional processing sneaking in and setting Auth-Type Yeah, when I wrote the email I figured I'd get at least one reply like that. I was hoping the position/sequence of the event would be enough to point me in he right direction. I'll capture the startups and auth requests / replies from both servers. In the mean time I'm thinking the mschap module on the failing server isn't quite right. Both have changes that are commented out, but who knows, maybe I missed something. I think it (failing) might be a slightly older version than the other as well. ----- Original Message ----- From: Alan DeKok [mailto:aland@deployingradius.com] Sent: Saturday, March 05, 2011 12:38 AM To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Hopefully quick question: conditional processing sneaking in and setting Auth-Type Gary Gatten wrote: > I can't find where this conditional processing is happing. I have two > FR servers with "nearly" the same config. Auth works on one, but not > the other: Posting 2-3 lines of debug output doesn't help. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html <font size="1"> <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> </div> "This email is intended to be reviewed by only the intended recipient and may contain information that is privileged and/or confidential. If you are not the intended recipient, you are hereby notified that any review, use, dissemination, disclosure or copying of this email and its attachments, if any, is strictly prohibited. If you have received this email in error, please immediately notify the sender by return email and delete this email from your system." </font>

2 3

EAP-TLS with Windows CA and CRL for Wireless Auth
by Rudolph Bott 08 Mar '11

08 Mar '11

Hi List, I've successfully setup the following scenario: - Windows CA (Root-CA and Sub-CA) - Cisco WLAN Controller + APs - Windows 7 Domain Clients (+ Computer Certificates) - EAP-TLS Auth with certificates I created a small script to fetch the CRL from the CA and have it converted to PEM format: -- snip -- #!/bin/bash ID=$$ wget http://ca.host.name/CA.crl -O /tmp/CA.$ID.crl -q if [ $? -eq 0 ] then openssl crl -in /tmp/CA.$ID.crl -inform DER -out /etc/raddb/certs/crl.pem -outform PEM rm /tmp/CA.$ID.crl c_rehash /etc/raddb/certs/ > /dev/null fi -- snip -- c_reheash seems to work since I have the Symlinks in /etc/raddb/certs/. The relevant parameters in eap.conf are set: check_crl = yes CA_path = ${certdir}/ However, as long as check_crl is set to 'yes', the following happens when a client tries to connect: Tue Mar 8 13:09:48 2011 : Info: Found Auth-Type = EAP Tue Mar 8 13:09:48 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Mar 8 13:09:48 2011 : Info: +- entering group authenticate {...} Tue Mar 8 13:09:48 2011 : Info: [eap] Request found, released from the list Tue Mar 8 13:09:48 2011 : Info: [eap] EAP/tls Tue Mar 8 13:09:48 2011 : Info: [eap] processing type tls Tue Mar 8 13:09:48 2011 : Info: [tls] Authenticate Tue Mar 8 13:09:48 2011 : Info: [tls] processing EAP-TLS Tue Mar 8 13:09:48 2011 : Info: [tls] eaptls_verify returned 7 Tue Mar 8 13:09:48 2011 : Info: [tls] Done initial handshake Tue Mar 8 13:09:48 2011 : Info: [tls] <<< TLS 1.0 Handshake [length 0a35], Certificate Tue Mar 8 13:09:48 2011 : Error: --> verify error:num=36:unhandled critical CRL extension Tue Mar 8 13:09:48 2011 : Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal certificate_unknown Tue Mar 8 13:09:48 2011 : Error: TLS Alert write:fatal:certificate unknown Tue Mar 8 13:09:48 2011 : Error: TLS_accept: error in SSLv3 read client certificate B Tue Mar 8 13:09:48 2011 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Tue Mar 8 13:09:48 2011 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Mar 8 13:09:48 2011 : Debug: TLS receive handshake failed during operation Tue Mar 8 13:09:48 2011 : Info: [tls] eaptls_process returned 4 Tue Mar 8 13:09:48 2011 : Info: [eap] Handler failed in EAP/tls Tue Mar 8 13:09:48 2011 : Info: [eap] Failed in EAP select Tue Mar 8 13:09:48 2011 : Info: ++[eap] returns invalid Tue Mar 8 13:09:48 2011 : Info: Failed to authenticate the user. Tue Mar 8 13:09:48 2011 : Auth: Login incorrect (unhandled critical CRL extension): [host/CLIENT123.domain/<via Auth-Type = EAP>] (from client WLAN-TEST port 1 cli 00-24-d7-8a-53-cc) Tue Mar 8 13:09:48 2011 : Info: Using Post-Auth-Type Reject Tue Mar 8 13:09:48 2011 : Info: # Executing group from file /etc/raddb/sites-enabled/default Tue Mar 8 13:09:48 2011 : Info: +- entering group REJECT {...} Tue Mar 8 13:09:48 2011 : Info: [attr_filter.access_reject] expand: %{User-Name} -> host/CLIENT123.domain Tue Mar 8 13:09:48 2011 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Mar 8 13:09:48 2011 : Info: ++[attr_filter.access_reject] returns updated Tue Mar 8 13:09:48 2011 : Info: Delaying reject of request 15 for 1 seconds Tue Mar 8 13:09:48 2011 : Debug: Going to the next request Tue Mar 8 13:09:48 2011 : Debug: Waking up in 0.9 seconds. Tue Mar 8 13:09:49 2011 : Info: Sending delayed reject for request 15 Sending Access-Reject of id 228 to 10.70.11.15 port 32768 EAP-Message = 0x04090004 Message-Authenticator = 0x00000000000000000000000000000000 When I disable CRL checks, everything works fine again. Does anybody have any experience with implementing Windows based CRLs in Freeradius? Radius Version is: radiusd: FreeRADIUS Version 2.1.10, for host i686-suse-linux-gnu, built on Mar 5 2011 at 17:06:42 running on SLES 11 (compiled from source as RPM package) Any kind of advice would be appreciated! -- Mit freundlichen Grüßen/With Kind Regards Rudolph Bott

2 2