- Freeradius-Users - lists.freeradius.org

FR proxy to ACS and NPS with MS CHAP v2
by SagiBarOr 05 Dec '10

05 Dec '10

We are developing a security scheme in which we use EAP TTLS MS CHAP v2 with Proxy. The TTLS phase is done with the first AAA server, and the second step, with MS CHAP v2, is proxied to another AAA (which is an LDAP server). When the first AAA server is FR and the second one is also FV, then authentication is OK. When the second AAA server is ACS (Cisco) or NPS (MS), the MS CHAP v2 authentication fails. We preformed troubleshooting and elimination testing which indicate the issue is with the pwd. Not with the user name. For example it also fails with the local DB of the 2nd AAA server. Also the verbose error log shows the user account is found. Looks like something is wrong with the pwd hash. will most appreciate your expert opinion. Thnks Sagi -- View this message in context: http://old.nabble.com/FR-proxy-to-ACS-and-NPS-with-MS-CHAP-v2-tp29132664p29… Sent from the FreeRadius - User mailing list archive at Nabble.com.

7 31

Meraki Access Points Login incorrect for SHA-Password
by danodemano 04 Dec '10

04 Dec '10

Alright, I'm going to try my best to explain what's going on here. I have a Meraki wireless access point I am trying to get configured to work with RADIUS. I have my freeradius server up and running with two other access points just fine. However, I cannot get it to work right with the Meraki one. It's set up to us MySQL for all the authentication and such and as I mentioned it works fine with the other two access points. However, when the Meraki access point tries to authenticate using SHA-Password credentials in the MySQL database I get a Login incorrect. Here is a bit from the radius log file: Sat Dec 4 09:21:54 2010 : Auth: Login OK: [testing] (from client Meraki port 0 via TLS tunnel) Sat Dec 4 09:21:54 2010 : Auth: Login OK: [testing] (from client Meraki port 0 cli 00-00-00-00-00-02) Sat Dec 4 09:22:24 2010 : Auth: Login incorrect: [test2] (from client Meraki port 0 via TLS tunnel) Sat Dec 4 09:22:24 2010 : Auth: Login incorrect: [test2] (from client Meraki port 0 cli 00-00-00-00-00-02) Both users are in the MySQL database, the only difference is the 'testing' has a 'Cleartext-Password' while the 'test2' user has an 'SHA-Password' If I try to use the 'test2' user from command line with a radtest it works fine: Sat Dec 4 09:23:28 2010 : Auth: Login OK: [test2] (from client localhost port 10) It also works correctly with my Untangle box: Sat Dec 4 09:29:23 2010 : Auth: Login OK: [test2] (from client Untangle port 0) I contacted Meraki about it and among other things they said: "It may be failing because your RADIUS server policy is configured to use the EAP-TLS authentication method and our test simulates a supplicant using PEAP-MSCHAPv2." Honestly I know very little about freeradius. I have set it up using some how-to guides on the Internet and it seems to be functioning correctly for the other two access points. The record in the 'nas' table for the Meraki access point is identical to the records for the other access points other than the IP/shortname. I have made copies of (I think) all the used config files if that's helpful. You can find them all here: http://dbunyard.homeip.net/stuff/raddb/ http://dbunyard.homeip.net/stuff/raddb/ Any help in configuring this would be greatly appreciated! If you need any additional information or logs let me know. Thanks! -- Dan -- View this message in context: http://freeradius.1045715.n5.nabble.com/Meraki-Access-Points-Login-incorrec… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

PEAP/TTLS and Client certificates
by rdeboer 04 Dec '10

04 Dec '10

Hello, I want to set up a radius server which authenticates users only once they provide their username, password AND client certificate. Now, I've managed to get this to work, my only problem is that as TTLS and PEAP use TLS, the TLS module must be enabled and configured. By doing so, users can also log in with just a client certificate. My real question here is: Is it possible to somehow force everyone to use PEAP or TTLS with a client certificate, while rejecting users trying to connect purely through TLS with only a client certificate? Kind regards, Remy -- View this message in context: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

Again: clients.conf storage in ldap
by Michal Bruncko 04 Dec '10

04 Dec '10

Hello list, I have found one old discussion in freeradius maillist about storing RADIUS clients definitions in LDAP. That discussion is from date 23 Nov 2004 and is in following link: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg11425.… I want to ask what is the status of integrating clients.conf in LDAP storage now, four years later from that discussion? This integration is interesting and makes the configuration more centralized. thanks michal -- Ing. Michal Bruncko, CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic

5 4

radclient: no response
by Jorge L. Herrera 04 Dec '10

04 Dec '10

Hello! In the file users add the user jorge Auth-Type := Local , User-Password == "jorge" place the following command :~$ radtest jorge jorge localhost 1812 testing123 and the result is Sending Access-Request of id 19 to 127.0.0.1 port 1812 User-Name = "jorge" User-Password = "jorge" NAS-IP-Address = 255.255.255.255 NAS-Port = 1812 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=19, length=2 ------------------------------------------------------------------------------------------------------------- After add the user 00- 07 -E9- C7 -51- 89 Auth-Type := Local , User-Password == "mac" note this is a mac address 00- 07 -E9- C7 -51- 89 :~$ radtest 00- 07 -E9- C7 -51- 89 mac localhost 1812 testing123 and the result is Sending Acces-Request of id 208 to 127.0.0.1 port 1812 User-Name = " 00- 07 -E9- C7 -51- 89" User-Password = "mac" Nas-IP-Address = 127.0.1.1 Nas-Port = 1812 Framed-Protocol = PPP radclient: no response from server for ID 208 socket 3 help to solve the problem

1 0

RE: Freeradius-Users Digest, Vol 68, Issue 22
by Nancy Flores Arevalo 04 Dec '10

04 Dec '10

Hello Nesite help I am working with a FreeRADIUS server 2.10.1 Ubuntun in an operating system 10 and I need to know syntax or command as I use to incorporate customer a Linksys WAP54G Access Point Model Thanks !!!!!!!!!!!!! I await your reply !!!!!!!!!!!!!!!!!!

1 0

Ayuda
by Horacio Andrade Zepeda FELIZZZZZZ 04 Dec '10

04 Dec '10

Hello friend first of all I send you greetings know I am a good novice at this I need your help because I see you are very advanced in this case I desarrolladon a practice school in Freeradius-Server Server at Vercion 2.10.1 I have to make only the MAC authentication for users but my questions is the MAC addresses are enlisted in the Users file that is located in the directory / usr / local / etc / raddb / users if ay where you register the MAC address? with which to command or syntax or only modified the file with the via Appreciate your support Thank your server My mail in which I am at your command is Horacio-21(a)hotmail.com Thanks !!!!!!!!!!!!

1 0

LDAP_OPT_X_TLS_REQUIRE_CERT error on 1.1.7-3.1
by Joe Friedeggs 03 Dec '10

03 Dec '10

I am seeing the following error messages in the radius.log: Fri Dec 3 19:29:48 2010 : Error: rlm_ldap: could not set LDAP_OPT_X_TLS_REQUIRE_CERT option to demand Everything seems to be working. I am running freeradius.i386 1.1.7-3.1.fc6 that I downloading from rpm.pbone.net. I find some old Red Hat posts where this was an issue in 1.1.3 (Bug 287381 ). Any ideas? Is this a real issue, or just a bogus log? Thanks, John

2 1

too long Calling Station Ids
by Josip Rodin 03 Dec '10

03 Dec '10

Hi, Just ran across this IRL: Calling-Station-Id: GigabitEthernet 1/0/3.2045:2045#587202578###pppoe c0:d0:44:e4:cf:3b# But: Mon Nov 29 16:54:16 2010 : Error: [our_sql] Couldn't insert SQL accounting START record - ERROR: value too long for type character varying(50) The situation is actually a bit inconsistent: raddb/sql/mssql/schema.sql: [CallingStationId] [varchar] (30) DEFAULT ('') FOR [CallingStationId], raddb/sql/mysql/schema.sql: callingstationid varchar(50) NOT NULL default '', raddb/sql/postgresql/schema.sql: CallingStationId VARCHAR(50), raddb/sql/postgresql/schema.sql: CallingStationId VARCHAR(50), Is there really much point in limiting this? The specification seems to say it's a string of an arbitrary length... -- 2. That which causes joy or happiness.

5 9

freeradius + ldap
by Ana Gallardo 03 Dec '10

03 Dec '10

Hello, I'm using freeradius 2.1.10 and I want to use ldap like a backend in authorize section to take userPassword attribute (unix crypt) to authenticate the user. My problem is: the ldap server don't have public key that an admin user (who bind) can take. So I have to bind in the authorize section with the user and password (clear text) in the request. Is this posible? What are my posibilities? Here is my actual configuration in my test: LDAP MODULE ldap ldapPerson{ server = "ldap.xxxx" basedn = "ou=people,dc=unex,dc=es" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${confdir}/ldapPerson.attrmap edir_account_policy_check = no set_auth_type = yes } SERVER server test{ authorize { suffix files ldapPerson expiration pap } authenticate { Auth-Type PAP { pap } } } DEBUG rad_recv: Access-Request packet from host X.X.X.X port 38152, id=201, length=58 User-Name = "aigallardo(a)unex.es" User-Password = "pass" server test { # Executing section authorize from file /etc/freeradius/sites-enabled/test +- entering group authorize {...} [suffix] Looking up realm "unex.es" for User-Name = "aigallardo(a)unex.es" [suffix] Found realm "unex.es" [suffix] Adding Stripped-User-Name = "aigallardo" [suffix] Adding Realm = "unex.es" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry DEFAULT at line 33 ++[files] returns ok [ldapPerson] performing user authorization for aigallardo [ldapPerson] expand: %{Stripped-User-Name} -> aigallardo [ldapPerson] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=aigallardo) [ldapPerson] expand: ou=people,dc=unex,dc=es -> ou=people,dc=unex,dc=es [ldapPerson] ldap_get_conn: Checking Id: 0 [ldapPerson] ldap_get_conn: Got Id: 0 [ldapPerson] attempting LDAP reconnection [ldapPerson] (re)connect to XXXXX :389, authentication 0 [ldapPerson] bind as / to XXXX :389 [ldapPerson] waiting for bind result ... [ldapPerson] Bind was successful [ldapPerson] performing search in ou=people,dc=unex,dc=es, with filter (uid=aigallardo) [ldapPerson] No default NMAS login sequence [ldapPerson] looking for check items in directory... [ldapPerson] looking for reply items in directory... [ldapPerson] gecos -> Nombre-Completo = "Ana-Isabel Gallardo Gomez" WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldapPerson] user aigallardo authorized to use remote access [ldapPerson] ldap_release_conn: Release Id: 0 ++[ldapPerson] returns ok ++[expiration] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. } # server test Thank you very much and sorry for my eglish. ++ Ana Gallardo Gómez ++

2 7