- Freeradius-Users - lists.freeradius.org

Proxying authentication from FreeRadius to Cisco ACS
by Erisan Nyamutenha 19 Jan '11

19 Jan '11

Hello All, I am setting up an Eduroam authentication server using FreeRadius 2.1.1 on Suse Linux 12. I am proxying authentication requests to a Cisco ACS. When testing using radtest from the FreeRadius box authentication is proxyed to ACS fine and i get an access-accept back. However when i try from a wireless client the proxy response from the ACS is an Access-Reject. In the failed attempts logs on the ACS it says bad username or password. i'm pretty sure im using the correct password. Is there any reason why this should not work? I've posted my logs below:- rad_recv: Access-Request packet from host 1.1.1.1 port 32768, id=210, length=255 User-Name = "username ( mailto:01420893@uct.ac.za )(a)xyz.ac.za" Calling-Station-Id = "00-1e-64-8f-f1-2a" Called-Station-Id = "08-17-35-32-f2-90:Eduroam" NAS-Port = 29 NAS-IP-Address = 1.1.1.1 NAS-Identifier = "uc-wism-2" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "63" EAP-Message = 0x02a0002b190017030100204673d48ae9e9d21afa7fe1fd6cae4d95841ae136e4fe85ad44acd3a4d0228a69 State = 0x4541503d302e66666666666666662e63666337302e373b5356433d302e31363139623b Message-Authenticator = 0xaab2e06ffb5753411ad8d42b71cafbdd +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "xyz.ac.za" for User-Name = "username(a)xyz.ac.za" [suffix] Found realm "xyz.ac.za" [suffix] Adding Stripped-User-Name = "username" [suffix] Adding Realm = "xyz.ac.za" [suffix] Proxying request from user username to realm xyz.ac.za [suffix] Preparing to proxy authentication request to realm "xyz.ac.za" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm xyz.ac.za. Not doing EAP. ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Sending Access-Request of id 81 to 2.2.2.2 port 1812 User-Name = "username" Calling-Station-Id = "00-1e-64-8f-f1-2a" Called-Station-Id = "08-17-35-32-f2-90:Eduroam" NAS-Port = 29 NAS-IP-Address = 1.1.1.1 NAS-Identifier = "uc-wism-2" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "63" EAP-Message = 0x02a0002b190017030100204673d48ae9e9d21afa7fe1fd6cae4d95841ae136e4fe85ad44acd3a4d0228a69 State = 0x4541503d302e66666666666666662e63666337302e373b5356433d302e31363139623b Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323130 Proxying request 8 to home server 2.2.2.2 port 1812 Sending Access-Request of id 81 to 2.2.2.2 port 1812 User-Name = "username" Calling-Station-Id = "00-1e-64-8f-f1-2a" Called-Station-Id = "08-17-35-32-f2-90:Eduroam" NAS-Port = 29 NAS-IP-Address = 1.1.1.1 NAS-Identifier = "uc-wism-2" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "63" EAP-Message = 0x02a0002b190017030100204673d48ae9e9d21afa7fe1fd6cae4d95841ae136e4fe85ad44acd3a4d0228a69 State = 0x4541503d302e66666666666666662e63666337302e373b5356433d302e31363139623b Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323130 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Reject packet from host 2.2.2.2 port 1812, id=81, length=61 Proxy-State = 0x323130 EAP-Message = 0x04a00004 Reply-Message = "Rejected\n\r" Message-Authenticator = 0xbcede120e168d2d92558e5f4ab8e03d5 Thanks Erisan ### UNIVERSITY OF CAPE TOWN This e-mail is subject to the UCT ICT policies and e-mail disclaimer published on our website at http://www.uct.ac.za/about/policies/emaildisclaimer/ or obtainable from +27 21 650 9111. This e-mail is intended only for the person(s) to whom it is addressed. If the e-mail has reached you in error, please notify the author. If you are not the intended recipient of the e-mail you may not use, disclose, copy, redirect or print the content. If this e-mail is not related to the business of UCT it is sent by the sender in the sender's individual capacity. ###

4 3

Re: Storing of salt in freeradius
by Mark 19 Jan '11

19 Jan '11

Hi folks, Been trying to look for information on this but haven't been able to find anything, prompting me to turn to the mailing list for help. In the event of using salted md5 hashes for passwords, where exactly does one store the salt? There doesn't seem to be a place within the FR config to do that. Any advice would be much appreciated. Thanks in advance! Kind regards, Mark

4 7

Freeradius 2.1.10
by Samuel Isaias Barriga Perez 19 Jan '11

19 Jan '11

Hi to all freeradius users: I'm working on setting it up to authenticate users (windows XP) to our wireless network which I succesfully completed, when I run radiusd -X (debug) my output is as follow: rad_recv: Access-Request packet from host 172.16.x.x port 1029, id=13, length=229 Message-Authenticator = 0x8fc8a30cc4c74e50a1bab260971c63d1 Service-Type = Framed-User User-Name = "CAMINOSCA\\samuel.barriga" Framed-MTU = 1488 State = 0x37f6879135fb9ef39d433a1d3d148b7b Called-Station-Id = "00-1E-58-A3-C9-1C:FREERADIUS" Calling-Station-Id = "00-11-95-DF-71-29" NAS-Identifier = "D-Link Access Point" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020d00061900 NAS-IP-Address = 172.16.x.x NAS-Port = 1 NAS-Port-Id = "STA port # 1" # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default.original +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "CAMINOSCA\samuel.barriga", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 13 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default.original +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 13 to 172.16.3.8 port 1029 EAP-Message = 0x010e00061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x37f6879134f89ef39d433a1d3d148b7b Finished request 19. Going to the next request Waking up in 4.9 seconds. Cleaning up request 16 ID 10 with timestamp +252 Cleaning up request 17 ID 11 with timestamp +252 Cleaning up request 18 ID 12 with timestamp +252 Cleaning up request 19 ID 13 with timestamp +252 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x37f6879134f89ef3 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. I tried everything and according to the debug output this is what I am getting, and the wiki page said that I should check into the certificates, I erase the the clients certificates reinstalled and I have the same output, plese can some one give me a hand. Thank you Saludos cordiales, Samuel I. Barriga Dpto. Sistemas EMAIL: samuel.barriga(a)caminosca-sa.com Mariana de Jesús E7 -248 y La Pradera PBX:+ 593 2 2236759 Ext. 215 Fax: + 593 2 2564193 www.caminosca.com

2 1

Call for 2.1.11
by Alan DeKok 19 Jan '11

19 Jan '11

Anything else for 2.1.11? It's been 5 months since 2.1.10. I think the updfromto fixes should go in, if I can figure out how to make it work on Linux *and* other systems. Alan DeKok.

3 3

Machine Authentication and Active Directory group lookups
by Graham, Robert 18 Jan '11

18 Jan '11

Hello all, I have FreeRadius v 2.1.10 installed and configured to authenticate users against Active Directory using PEAP/MSChapV2 and perform Group membership lookups via the ldap module so that I can configure radius reply attributes to provide VLAN assignment and Dymanic ACL's. All is working extremely well, but one item that I would also like to get working is the Machine Authentication. Machine Authentication is working with the exception of the ldap group lookup. From what I can tell, when the machine authenticates, the ntlm_auth knows that the request is a Machine Authentication and appends the $ to the end of the username for the sAMAccountName: # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel +- entering group authenticate {...} [inner-eap] Request found, released from the list [inner-eap] EAP/mschapv2 [inner-eap] processing type mschapv2 [mschapv2] # Executing group from file /usr//etc/raddb/sites-enabled/inner-tunnel [mschapv2] +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: host/lab.XXXX.com [mschap] Told to do MS-CHAPv2 for host/lab.XXXX.XXX with NT-Password [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=lab$ [mschap] mschap2: 78 [mschap] Creating challenge hash with username: host/lab.XXXX.XXX [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=a9c34f78fae78fd0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=961d047adaedc84346d00fcd2a0a67139ff4a95c9e13ae61 Exec-Program output: NT_KEY: 65891DD9BE6290D3EEB54D8EB6612EFF Exec-Program-Wait: plaintext: NT_KEY: 65891DD9BE6290D3EEB54D8EB6612EFF Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success Since I am using: filter = "(&(sAMAccountName=%{mschap:User-Name}))" in the ldap module, FreeRadius is trying to do a group lookup on: lab$ which is not found in any Active Directory groups: # Executing section post-auth from file /usr//etc/raddb/sites-enabled/default +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=XXXX,dc=XXXX,dc=XXX -> ou=XXXX,dc=XXXX,dc=XXX [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=lab$)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=XXXX,dc=XXXX,dc=XXX, with filter (&(sAMAccountName=lab$)) [ldap] object not found Is it possible to remove the "$" from the sAMAccountName in the LDAP module without breaking the User Authentication? Thanks Robert Graham

1 0

FreeRadius + Sql Server
by Maiquel Consalter 18 Jan '11

18 Jan '11

Hello I wonder if I have to implement freeradius + sql server. I tried to find on google but not found. Could someone help me.? Thanks. -- Att, Maiquel

2 4

modules directory
by Christ Schlacta 18 Jan '11

18 Jan '11

I've found something odd in regard to the modules directory. I ended up needing to use checkval module for ldap authentication to work properly for me. the documentation I found said to place the following in config files: checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string notfound-reject = no } at the location I wanted the check to occur, but instead I ended up needing to use just: checkval because the above code was located in modules/checkval . The question is at this point, how could I, for example, have two different checkval checks? suppose I want to check an additional attribute? I recon I need a new file, but I'm not sure if it matters what I call the new file, or, for that matter, I'm not sure what to put inside the new file, except that I'm sure it must look very similar to that above. if someone could explain the specifics of this, or tell me where to find them explained, I would much appreciate the help. one more question: can there be multiples of ANY module specified? for example, can I use two different ldap or sql modules if I were to need to (just as a bad example, I propose: 1 radius server, 2 wlans with different user bases that can't be merged into one directory for whatever reasons).

4 4

Sub-TLV's
by David Peterson 18 Jan '11

18 Jan '11

Is there support for Sub-TLV attributes currently and if so, can someone point me to documentation on how to format a reply for them? David

4 18

freeradius 2.1.10 with oracle instantclient11.2
by Waqas Toor 18 Jan '11

18 Jan '11

Dear Community, I am trying to compile freeradius2.1.10 with oracle instantclient11.2 and having problems where it is not detecting oracle libraries and header files. where the oracle home is /opt/instantclient_11_2 there are two steps that I am trying and both are failing. a: standard compile # ./configure --with-experimental-modules --with-oracle-include-dir=/opt/instantclient_11_2/sdk/include --with-oracle-lib-dir=/opt/instantclient_11_2 --with-oracle-home-dir=/opt/instantclient_11_2 and getting this error === configuring in ./drivers/rlm_sql_oracle (/opt/freeradius-server-2.1.10/src/modules/rlm_sql/./drivers/rlm_sql_oracle) configure: running /bin/sh ./configure '--prefix=/usr/local' '--with-experimental-modules' '--with-oracle-include-dir=/opt/instantclient_11_2/sdk/include' '--with-oracle-lib-dir=/opt/instantclient_11_2' '--with-oracle-home-dir=/opt/instantclient_11_2' '--enable-ltdl-install' --cache-file=/dev/null --srcdir=. checking for oci.h... checking for gcc... gcc checking for C compiler default output file name... a.out checking whether the C compiler works... yes checking whether we are cross compiling... no checking for suffix of executables... checking for suffix of object files... o checking whether we are using the GNU C compiler... yes checking whether gcc accepts -g... yes checking for gcc option to accept ISO C89... none needed yes configure: WARNING: oracle libraries not found. Use --with-oracle-lib-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: libclntsh libnnz10. configure: creating ./config.status config.status: creating Makefile b: in freeradius-server-2.1.10/src/modules/rlm_sql/drivers/rlm_sql_oracle changed the Makefile.in and setting RLM_SQL_CFLAGS = -I/opt/instantclient_11_2/sdk/include $(INCLTDL) RLM_SQL_LIBS = -L/opt/instantclient_11_2 and then make. but still getting the error. any pointers . Thanks Waqas

3 12

cleaning house on radius server?
by Christ Schlacta 18 Jan '11

18 Jan '11

I've got a radius server up and running, and I want to clean up my configuration as much as possible. is it a safe assumption that if I remove a file (actually move it out of the way) and attempt to authenticate a client that if the client can successfully authenticate that everything is working? is it also safe to assume that any file with no uncommented lines is also safe to remove? I'm most interrested in removing the SQL directories and all the unused modules in the modules directory.

6 6