- Freeradius-Users - lists.freeradius.org

Send Attribute Using Script
by christian＠wanxp.com 22 Feb '11

22 Feb '11

Dear, i am just planning to upgrade Freeradius to v2 , but i got my perl didnt send any atrribute , it worked fine in v1, is there any idea what wrong with my script in freeradius2 ? #!/usr/bin/perl # if ($lefttime <= 0) { print "Reply-Message=\"Your account has expired\""; exit 1; } else { print "Session-Timeout=" . $lefttime . ", "; }

3 5

Interim update accounting and Acct-Status-Type flag
by Waqas Toor 22 Feb '11

22 Feb '11

Hi Community, I want to save interim update accounting packet to the DB and I can't seem to find how. also in the radacct table I want to save the flag of those packets as well i.e. Start, Alive( Interim-Update), Stop Thank you Waqas Toor

2 1

Proxy AAA behavior
by mansi jain 22 Feb '11

22 Feb '11

Hi, this is a general question on the AAA proxy behavior Support I have following network NAS <---------shared secret A -------> AAA proxy <---------shared secret B---------> AAA server <--------------------------------shared secret C ------------------------------> I want to know when the AAA server responds to an access request received from NAS via AAA proxy, it shall encrypt the MSK, EMSK and other keys using the shared secret B(between proxy and sever) or it shall use secret C (between NAS and server). As I know that the message authenticator is changed by AAA proxy in the radius messages so that messages between NAS and proxy are authenticated using secret A while messages between proxy and server uses secret B. But does this hold true for the keys also since then the proxy will have to decrypt and encrypt all the keys in Access accept again. Can anyone please clear my doubt regarding this. TIA, mansi -- View this message in context: http://freeradius.1045715.n5.nabble.com/Proxy-AAA-behavior-tp3394232p339423… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

udpfromto in distribution packages
by Koopmann, Tobias 21 Feb '11

21 Feb '11

Hello there, i have a question about freeradius implementation in several distribution packages. What Linux Distributions compile their freeradius package with "--with-udpfromto" directive? I did not found any information on the distributions pages... Maybe someone here knows this.... Greetz, Tobias

2 3

Inner-tunnel user name in interim-update
by 1839＠uniurb.it 19 Feb '11

19 Feb '11

Hello. I'm puzzled about eap ttls accounting, namely with interim-updates. My setup: freeradius 2.1.10 on debian squeeze, mikrotik RouterOs version 3.13 as NAS. On the NAS I enabled eap accounting; on the freeradius I set copy_request_to_tunnel = yes use_tunneled_reply = yes update outer.reply { User-Name = "%{request:User-Name}" } If I look at replay-detail I found Fri Feb 18 09:46:53 2011 Packet-Type = Access-Accept User-Name = "cecchinip@esf" MS-MPPE-Recv-Key = 0x86 etc etc But when inspecting interim-updates .. Fri Feb 18 10:03:53 2011 Service-Type = Framed-User NAS-Port-Id = "wlan2" User-Name = "anonymous" Acct-Session-Id = "82b00004" Acct-Multi-Session-Id = "bla bla ... " Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update Acct-Session-Time = 1020 Acct-Input-Octets = 4117 Acct-Input-Gigawords = 0 Acct-Input-Packets = 27 Acct-Output-Octets = 2515 Acct-Output-Gigawords = 0 Acct-Output-Packets = 63 NAS-Identifier = "EduroamTest" NAS-IP-Address = ************* Acct-Delay-Time = 0 Acct-Unique-Session-Id = "bed886a60e348ed6" Timestamp = 1298019833 Request-Authenticator = Verified Looks like the radius honours the request to send out the inner identity, but the nas get rid of and continue to use 'anonymous'. It's that, is a NAS's problem or maybe could be something I misconfigured on freeradius ? Any hint? And thanks in advance. Paolo.

3 2

FR/AD integration
by E Rossiter 19 Feb '11

19 Feb '11

Trying to use FR to query AD as an authentication oracle and set up per the docs at http://deployingradius.com/documents/configuration/active_directory.html and several others pertaining to setting up Kerberos and winbind. smb/krb/winbind all run. The usual testing commands all produce the proper output. wbinfo, kbinit, kblist, net join, etc. FreeRADIUS Version 2.1.7, CentOS 5.5 2.6.18-194.32.1.el5 #1 SMP Samba Version 3.3.8-0.52.el5_5.2 KRB5 I have been able to authenticate and authorize accounts using PAP via a Juniper device and a Dell PC 3448. Am now trying to expand beyond PAP and use ntlm_auth and eventually MSCHAP. Upon issuing the command: ntlm_auth --request-nt-key --domain=ADMIN.CYTEWORKS.LOCAL --username=eric.rossiter --password=Cyt3w0rk5 I receive : NT_STATUS_OK: Success (0x0) but I do not see any reference to an NT_KEY: I believe that's why the radtest command is failing: radtest sambatest somepass localhost 0 somesecret Sending Access-Request of id 225 to 127.0.0.1 port 1812 User-Name = "sambatest" User-Password = "somepass" NAS-IP-Address = 64.126.127.208 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=225, length=20 Been reading and researching and testing for 3 weeks, but I'm stuck now. radius -X output: rad_recv: Access-Request packet from host 127.0.0.1 port 39195, id=4, length=61 User-Name = "sambatest" User-Password = "somepass" NAS-IP-Address = 64.126.127.208 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20110218 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20110218 [auth_log] expand: %t -> Fri Feb 18 17:19:10 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sambatest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 17 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=sambatest [ntlm_auth] expand: --password=%{User-Password} -> --password=somepass username must be specified! *# don't understand this... username is two lines up* If I shut down winbind, a winbind error preceeds "username must be specified! " don't understand # why samba is puking a help screen? Usage: [OPTION...] --helper-protocol=helper protocol to use operate as a stdio-based helper --username=STRING username --domain=STRING domain name --workstation=STRING workstation --challenge=STRING challenge (HEX encoded) --lm-response=STRING LM Response to the challenge (HEX encoded) --nt-response=STRING NT or NTLMv2 Response to the challenge (HEX encoded) --password=STRING User's plaintext password --request-lm-key Retrieve LM session key --request-nt-key Retrieve User (NT) session key --use-cached-creds Use cached credentials if no password is given --diagnostics Perform diagnostics on the authentictaion chain --require-membership-of=STRING Require that a user be a member of this group (either name or SID) for authentication to succeed Help options: -?, --help Show this help message --usage Display brief usage message Common samba config: --configfile=CONFIGFILE Use alternate configuration file Common samba options: -V, --version Print version Exec-Program output: Exec-Program: returned: 1 ++[ntlm_auth] returns reject Failed to authenticate the user. Login incorrect: [sambatest/somepass] (from client 127.0.0.1 port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sambatest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 2 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 4 to 127.0.0.1 port 39195 Waking up in 4.9 seconds. Cleaning up request 2 ID 4 with timestamp +349 Ready to process requests. wbin^H^H^Hrad_recv: Access-Request packet from host 127.0.0.1 port 57210, id=225, length=61 User-Name = "sambatest" User-Password = "somepass" NAS-IP-Address = 64.126.127.208 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/127.0.0.1/auth-detail-20110218 [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/auth-detail-20110218 [auth_log] expand: %t -> Fri Feb 18 17:32:09 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "sambatest", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 17 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = ntlm_auth +- entering group authenticate {...} [ntlm_auth] expand: --username=%{mschap:User-Name} -> --username=sambatest [ntlm_auth] expand: --password=%{User-Password} -> --password=Thursday77 username must be specified! Usage: [OPTION...] --helper-protocol=helper protocol to use operate as a stdio-based helper --username=STRING username --domain=STRING domain name --workstation=STRING workstation --challenge=STRING challenge (HEX encoded) --lm-response=STRING LM Response to the challenge (HEX encoded) --nt-response=STRING NT or NTLMv2 Response to the challenge (HEX encoded) --password=STRING User's plaintext password --request-lm-key Retrieve LM session key --request-nt-key Retrieve User (NT) session key --use-cached-creds Use cached credentials if no password is given --diagnostics Perform diagnostics on the authentictaion chain --require-membership-of=STRING Require that a user be a member of this group (either name or SID) for authentication to succeed Help options: -?, --help Show this help message --usage Display brief usage message Common samba config: --configfile=CONFIGFILE Use alternate configuration file Common samba options: -V, --version Print version Exec-Program output: Exec-Program: returned: 1 ++[ntlm_auth] returns reject Failed to authenticate the user. Login incorrect: [sambatest/Thursday77] (from client 127.0.0.1 port 0) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> sambatest attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 2 seconds Going to the next request Waking up in 0.9 seconds. Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 225 to 127.0.0.1 port 57210 Waking up in 4.9 seconds. Cleaning up request 3 ID 225 with timestamp +1128 Ready to process requests. /etc/krb.conf: [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = ADMIN.CYTEWORKS.LOCAL # dns_lookup_realm = false # all of these entries have been used for testing and are commented out now # dns_lookup_kdc = true # ticket_lifetime = 24h # forwardable = yes # default_tgs_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC # default_tkt_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC # preferred_enctypes = DES-CBC-CRC DES-CBC-MD5 RC4-HMAC [realms] ADMIN.CYTEWORKS.LOCAL = { kdc = cyteworks.admin.cyteworks.local admin_server = cyteworks.admin.cyteworks.local default_domain = ADMIN.CYTEWORKS.LOCAL } [domain_realm] .cyteworks.local = ADMIN.CYTEWORKS.LOCAL cyteworks.local = ADMIN.CYTEWORKS.LOCAL [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } /etc/samba/smb.conf #======================= Global Settings ===================================== [global] idmap uid = 200000 - 300000 idmap gid = 200000 - 300000 workgroup = ADMIN ; netbios name = cyteworks realm = ADMIN.CYTEWORKS.LOCAL server string = Samba Server Version %v security = ads local master = no domain master = no preferred master = no winbind separator = + winbind uid = 10000-20000 winbind gid = 10000-20000 winbind enum users = yes winbind enum groups = yes winbind use default domain = yes ; interfaces = lo eth0 192.168.12.2/24 192.168.13.2/24 hosts allow = 127. 192.168.5. 192.168.6. 10.12.1. 10.12.2. 10.12.3. 10.12.4 10.88.8 # --------------------------- Logging Options ----------------------------- # # Log File let you specify where to put logs and how to split them up. # # Max Log Size let you specify the max size log files should reach # logs split per machine log file = /var/log/samba/log.%m # max 50KB per log file, then rotate max log size = 50 # ----------------------- Domain Members Options ------------------------ ; password server = * security = ads ; passdb backend = tdbsam realm = ADMIN.CYTEWORKS.LOCAL ; password server = 10.12.1.40 Everything else is commented out in smb.conf. Don't need any printers, no shares, etc. /etc/raddb/radius.conf: # -*- text -*- ## # prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct name = radiusd confdir = ${raddbdir} run_dir = ${localstatedir}/run/${name} db_dir = ${raddbdir} libdir = /usr/lib/freeradius pidfile = ${run_dir}/${name}.pid user = radiusd group = radiusd max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = * port = 0 clients = per_socket_clients } listen { ipaddr = * port = 0 type = acct clients = per_socket_clients } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = yes auth_goodpass = yes } checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 2 status_server = yes } proxy_requests = no $INCLUDE clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/modules/ $INCLUDE eap.conf } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ /etc/raddb/clients.conf: # -*- text -*- ## ## clients.conf -- client configuration directives ## client localhost { ipaddr = 127.0.0.1 secret = somesecret require_message_authenticator = yes shortname = localhost nastype = other # localhost isn't usually a NAS... } clients per_socket_clients { client 127.0.0.1 { secret = somesecret } # Juniper - ESR - 01.24.11 client 192.168.20.254 { secret = somesecret shortname = juniper nastype = netscreen } # Dell PowerConnect 3448 - ESR - 02.01.11 client 10.12.1.11 { secret = somesecret shortname = dpc3448 nastype = other } } /etc/raddb/users # -*- text -*- # # Copyright (C) 2009 Deploying RADIUS Partnerships # All rights reserved. # # Save this file as "raddb/users", after first backing up # the copy that you have there. # # http://deployingradius.com/documents/configuration/pap.html # # Window 1: radiusd -X # Window 2: radtest bob hello localhost 0 testing123 # # ntlm_auth testing ESR 02.17.11 DEFAULT Auth-Type = ntlm_auth #************************ Juniper conf # - ESR - 01.24.11 #some.user Cleartext-Password := "somepass" # NS-Admin-Privilege := 4, # NS-VSYS-Name := "Read-Only-Admin" #some.user Cleartext-Password := "somepass # NS-Admin-Privilege := 2, # NS-VSYS-Name := "ROOT" # End of the file I commented out the PAP entries in the users file because one of the users has the same user.name in AD but a different password, and that was causing me some conflict. So, can anyone tell me why I'm not getting an *NT_KEY* reply when I issue the *ntml_auth* command? Is the missing key the reason the *radtest* command is failing? See any other glaring errors? Thanks for your time. E Rossiter

3 3

Proxying CoA & Disconnect in freeRADIUS 2.1.10
by Charles Price 18 Feb '11

18 Feb '11

Dear All, I'm having some trouble asking my freeRADIUS-2.1.10 server (Linux, x86_64) to correctly proxy CoA and Disconnect-Request packets. I am generating Disconnect-Request packets from my "network_control" machine (172.16.3.2) to the freeRADIUS server at 172.16.3.11 using: cat packet.txt |radclient -x -d /etc/raddb 172.16.3.11:3799 disconnect secret1 where packet.txt contains the following AV pairs: Acct-Session-ID = '819026ec' NAS-IP-Address = '172.16.3.60' User-Name='testuser(a)test.com' I was hoping that the requests would be proxied to "pppoe_one" at 172.16.3.60. The "network_control" machine receives a Disconnect-Ack from the freeRADIUS machine but the packet is not being retransmitted to "pppoe_one". Output from 'radiusd -X' is: rad_recv: Disconnect-Request packet from host 172.16.3.2 port 34463, id=100, length=66 Acct-Session-Id = "819026ec" NAS-IP-Address = 172.16.3.60 User-Name = "testuser(a)test.com" server coa { # Executing section recv-coa from file /etc/raddb/sites-enabled/coa +- entering group recv-coa {...} ++[control] returns noop ++[ok] returns ok # Executing section send-coa from file /etc/raddb/sites-enabled/coa +- entering group send-coa {...} ++[ok] returns ok } # server coa Sending Disconnect-ACK of id 100 to 172.16.3.2 port 34463 Finished request 0. As far as I know, I have followed instructions documented in sites-available/coa as well as reading a few other relevant posts on this list. I wonder if anyone has any advice? Relevant extracts from my configs are listed below. Many thanks, Charlie ** radiusd.conf ** proxy_requests = yes $INCLUDE proxy.conf $INCLUDE sites-enabled/ ** clients.conf ** client pppoe_one { ipaddr = 172.16.3.60 secret = secret1 nastype = other coa_server = access_concentrators } client network_control { ipaddr = 172.16.3.2 secret = secret1 nastype = other coa_server = access_concentrators } ** proxy.conf ** home_server home_pppoe_one { type = coa ipaddr = 172.16.3.60 port = 1700 secret = secret1 require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = none check_interval = 30 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool access_concentrators { home_server = home_pppoe_one } ** sites-enabled/coa ** listen { type = coa ipaddr = * port = 3799 server = coa } server coa { recv-coa { update control { Home-Server-Pool := access-concentrators } ok } send-coa { # Sample module. ok } }

2 4

mschap help
by Raymond Norton 18 Feb '11

18 Feb '11

I followed the tutorial (http://deployingradius.com/documents/configuration/active_directory.html) and seemed to have mschap working. I had configured freeradius to use eap prior to setting up to work with AD, so not sure if anything I already configured is conflicting. Wanting to verify mschap was indeed working, I disabled the domain user account, and verified I could no longer authenticate via freeradius. I enabled the account again and can login from a LAN PC, but have not been able to authenticate through wireless via freeradius. Wbinfo, ntlm_auth, and radtest all work fine from the command line. and I have added "DEFAULT Auth-Type = ntlm_auth " to the user file Not sure how much to include from debug, but this seems to be the issue. Have read up on other posts about this and have seen a variety of reasons from a samba bug to running freeradius on 64bit. Hoping it is just a config option I missed. [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for raymond with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect

3 6

Eduroam with a Local Radius Config?
by Nathan McDavit-Van Fleet 18 Feb '11

18 Feb '11

I'm trying to get Eduroam working on our existing Freeradius service. There are myriad instructions for getting Eduroam working. Unfortunately a majority of them assume you are configuring it to only do Eduroam and nothing else. Currently I am proxying Successfully to Eduroam with the following setup: realm concordia.ca { } realm LOCAL { nostrip } realm NULL { nostrip } realm DEFAULT { pool = EDUROAM-FTLR nostrip } I won't show the pool config for the "DEFAULT" realm. But suffice to say that's working. Also, our legacy users who are authenticating with no realm are working as well. What isn't working are local connections using our local real (user(a)concordia.ca) and distant AAA requests from Eduroam. The Eduroam cookbook provides some configs that appear to be helpful. But unfortunately they're so broken I can't even put them in my configuration. What the below configs appear to do is check if they are of realm domain.tld and then switch the Proxy-Realm. But the configs are too broken to work. >From what I understand at the first "if" is missing a double quote, and the second one isn't even evaluating and I can't fix it enough to get the server to restart. I have included my fixes, but as I said the preacct if statement still does not allow the server to restart after the config is included. ORIGINAL authorize { auth_log suffix if (("%{control:Proxy-To-Realm} == "DEFAULT") && (User-Name =~ /.*@.*.domain.tld$/)) { update control { Proxy-To-Realm := NULL } } preacct { detail suffix if ((Proxy-To-Realm = DEFAULT) && (User-Name =~ /.*@.*.domain.tld$/)) update control { Proxy-To-Realm := NULL } } FIXED (???) authorize { auth_log suffix if (("%{control:Proxy-To-Realm}" == "DEFAULT") && (User-Name =~ /.*@.*.domain.tld$/)) { update control { Proxy-To-Realm := NULL } } preacct { detail suffix if ((Proxy-To-Realm == "DEFAULT") && (User-Name =~ /.*@.*.domain.tld$/)) update control { Proxy-To-Realm := NULL } } Nathan Van Fleet Telecommunications Analyst Network Assessment and Integration IITS Concordia University (514) 848-2424 Extension:5434

5 6

Corrupted Secret with squid_radius_auth
by Robert Dunkley 18 Feb '11

18 Feb '11

I was wondering if anyone knew of a fix for the corrupted secret issue with squid_radius_auth under 64bit OS? I have the exact same issue as the user in the link below but am using Radiator (Works fine with other Radius clients): http://freeradius.1045715.n5.nabble.com/Issues-with-squid-radius-auth-td 2788947.html TIA Rob The SAQ Group Registered Office: 18 Chapel Street, Petersfield, Hampshire GU32 3DZ SAQ is the trading name of SEMTEC Limited. Registered in England & Wales Company Number: 06481952 http://www.saqnet.co.uk AS29219 SAQ Group Delivers high quality, honestly priced communication and I.T. services to UK Business. Broadband : Domains : Email : Hosting : CoLo : Servers : Racks : Transit : Backups : Managed Networks : Remote Support. ISPA Member

2 5