- Freeradius-Users - lists.freeradius.org

Re: Re: LDAP auth success / User reject
by Michael Arndt 19 Nov '10

19 Nov '10

Hello *, Problem solved thx to Alans help -Find out what part of the configuration is setting "Auth-Type := Reject" -Look in the "files" configuration, and in the data in LDAP. The reject was the last default statement in the users file My problem was, that the patterns for both entries before failed. I resolved the reason, It was a Bug in the LDAP Tree of customer for this site, not noticed by me before. Michael

1 0

Dynamic VLAN assignment on NAS
by Attou eric 19 Nov '10

19 Nov '10

Hi the list I'm sure this is NAS question, not Freeradius' question. But perhaps somebody on the list had experienced this issue. Here is my problem. I setup : - A Freeradius configuration EAP/PEAP with user credentials stored in LDAP directory. - A NAS zcomax ag3621 wireless access point with VLAN 802.1q support. on this access point, i have one SSID associated by default with guest VLAN 30. meaning if a user failed authentication, he will still connected but on this VLAN with reduced privileges. However radius return the following Access-accept packet to my NAS, Sending Access-Accept of id 81 to 192.168.32.88 port 1032 Tunnel-Private-Group-Id:0 = "60" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN User-Name = "user1" The access point just put user1 on VLAN 30. My NAS ignore the VLAN ID 60 (Tunnel-Private-Group-Id:0 = "60") contained in the Access-Accept. I try with two different models of Access point (zcomax and cisco) My question: Is there a particular config to do to ask the NAS to consider the VLAN ID contained in the Access-Accept packet ? Thanks for your answers

2 1

Accounting data and NULL sessions
by Natr Brazell 19 Nov '10

19 Nov '10

I have two questions if I may. One I think I've asked before but just getting around to trying to tackle it again. 1. I am using mysql for radacct data to keep track of sessions. The accounting data is going into flat files on each radius server. Is there a way to get the accounting data to go directly to into a mysql table? I don't want the accounting data in radacct. 2. I have multiple NULL sessions in my radacct file??? What causes these and how do folks deal with them? Thanks, N

2 1

Crypt Passwords in SQL
by William 18 Nov '10

18 Nov '10

Greetings, First, Thanks Alan DeKok. That was exactly what I needed for NAS_Showt_Name. Second, I just discovered a new issue. Not sure if this is a radius or a MySQL issue. When I crypt a password (MySQL CRYPT command) the password matches anything and everything that matches the first 8 characters of the password. Is this a limitation of Radius crypt or is it a Mysql crypt ? I need 16+ character password that match. Wm

2 4

Re: Re: LDAP auth success / User reject
by Michael Arndt 18 Nov '10

18 Nov '10

Alan, >Use "-X". You've added an additional "-x", which makes the output harder to read. ok, understood, attached below > Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Found Auth-Type Reject > Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Auth-Type = Reject, rejecting user Well... something is setting that. Go find out what, and fix it. any hints, how to proceed to debug from where the "Reject" for rad_check_passwd is caused ? I checked ldap atributes and verified correctness of user passwd for simple bind with ldapsearch So i at last have exluded trivial errors like testing with a dn or wrong user password But now i d not see how to trace why the radius request comes back with reject lm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in l=Stadt,dc=de,o=Organisation, with filter (uid=test1) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user test11 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 4 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [test1/testpass] (from client wlanhsp port 0 cli 00:1e:c2:a3:4d:b3) TIA Micha

2 1

LDAP auth success / User reject
by Michael Arndt 18 Nov '10

18 Nov '10

hello * Szenario: freeradius auth via LDAP simple bind with user passwd / user name for a hot spot Used config works with two other setups of same environment Problem: simple bind returns ok then another module rejects the user Any hints where i should look ? Used Freeradius Version: FreeRADIUS Version 1.1.6 below debug output hu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: - authorize Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: performing user authorization for test1 Thu Nov 18 11:20:52 2010 : Debug: radius_xlat: '(uid=test1)' Thu Nov 18 11:20:52 2010 : Debug: radius_xlat: 'l=Stadt,dc=de,o=Organisationr' Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: attempting LDAP reconnection Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: bind as cn=LDAPADMIN,o=Customer/sharedsecret to 127.0.0.1:389 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: waiting for bind result ... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: Bind was successful Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: performing search in l=Stadt,dc=de,o=Organisation, with filter (uid=test1) Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: looking for check items in directory... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: looking for reply items in directory... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: Setting Auth-Type = ldap Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: user test1 authorized to use remote access Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "ldap" returns ok for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_eap: No EAP-Message, not doing EAP Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Thu Nov 18 11:20:52 2010 : Debug: users: Matched entry DEFAULT at line 3 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "files" returns ok for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "pap" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall: leaving group authorize (returns ok) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Found Auth-Type Reject Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Auth-Type = Reject, rejecting user Thu Nov 18 11:20:52 2010 : Debug: auth: Failed to validate the user. Thu Nov 18 11:20:52 2010 : Auth: Login incorrect: [test1/testpasswd] (from client wlanhsp port 0 cli 00:1e:c2:a3:4d:b line from users DEFAULT Called-Station-Id =~ ".*:LIBRARY" , Ldap-group == "cn=city,cn=Groups,l=Stadt,dc=de,o=Organisation" thx for any hints :-) I have anonymized the ldap Attributes Michael

2 1

Help: 802.1x with freeRadius and mySql database
by Xuan Sun 18 Nov '10

18 Nov '10

Hi Everyone I have set up a freeRadius in Ubuntu server 10.0.4. I also set up a Cisco switch as a NAS and enable 802.1x in the switch port. I used the configuration first (clients.conf, users). The 802.1x authentication just works fine. Then I start to use mySql database, instead of clients.conf and users. I followed the instructions from this link http://wiki.freeradius.org/SQL_HOWTO. I use the "radtest" command to test the username/password. It works fine. Then I use the Cisco switch to test the username/password and NAS, it also works fine. But the 802.1x authentication does not work. Here is the output from "freeradius -X" Ready to process requests. rad_recv: Access-Request packet from host 10.5.84.14 port 1645, id=213, length=265 User-Name = "anonymous" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-6C-79-7F-89" Calling-Station-Id = "00-18-8B-B2-74-CE" EAP-Message = 0x0207006b190017030100603436ac7bdf2130158ce653dea69c9c5c155d4a677f8bf6a3330838e2ca749c29c00d7fef558443728826479cb9dbd75b4e3fc4e62b27ecc64a942b06784ae85df1499325a9c927f9e0de86a9989d7349874019e3a286ebb4ab95347d704aaf79 Message-Authenticator = 0x8a020beb0674cb778f3feb2400792a88 NAS-Port-Type = Ethernet NAS-Port = 50107 NAS-Port-Id = "FastEthernet1/0/7" State = 0xc7b0e155c2nt (0018.8bb2.74ce) on Interface Fa1/0/7 AuditSessionID 0A05540E0000005E17970995b7f81cdb855c0280b00b4a NAS-IP-Address = 10.5.84.14 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700401a0207003b31c49dddfb7a41c1b1af6d0248706af94e0000000000000000d2f582ba4490575f7f0c78eb1e81b3dc81c41b0cb19cfc81003833303038 server { PEAP: Setting User-Name to 83008 Sending tunneled r 020358: Nov 17 11:41:28.199 PST: %AUTHMGR-5-FAIL: Authorization failed for client (0018.8bb2.74ce) on Interface Fa1/0/7 AuditSessionID 0equest EAP-Message = 0x020700401a0207003b31c49dddfb7a41c1b1af6d0248706af94e0000000000000000d2f582ba4490575f7f0c78eb1e81b3dc81c41b0cb19cfc81003833303038 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "83008" State = 0xe741fb76e746e148ba5c58c22edbac30 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "83008", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- enA05540E0000005E17970995tering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for 83008 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. 83008 is my user id. Why it tries to use MSCHAP module and use NT-Password ? Here is the fradius database information in mySql. mysql> show tables; +-------------------+ | Tables_in_fradius | +-------------------+ | nas | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | radusergroup | +-------------------+ 8 rows in set (0.00 sec) mysql> select * from nas; +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ | 2 | 10.5.84.14 | lab-3750b | cisco | NULL | spl00t | NULL | RADIUS Client | +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ 1 row in set (0.00 sec) mysql> select * from radcheck; +----+----------+--------------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------+ | 1 | sqltest | Password | == | testpwd | | 2 | 83008 | Cleartext-Password | := | testing123 | +----+----------+--------------------+----+------------+ 2 rows in set (0.00 sec) mysql> select * from radreply; +----+----------+--------------+----+-------------------+ | id | username | attribute | op | value | +----+----------+--------------+----+-------------------+ | 2 | 83008 | cisco-avpair | = | shell:priv-lvl=15 | +----+----------+--------------+----+-------------------+ 1 row in set (0.00 sec) The other tables is empty. Thank to take a lootk

2 1

freeradius on ubuntu
by Jia Fang (Matthew) 17 Nov '10

17 Nov '10

Hello I am lost in Freeradius on Ubuntu.... I want to use peap authentication in ubuntu platform, but it seems that the rlm_eap_tls.so has license problem and not built in the ubuntu freeradius, then I try to build the source code and find that in hardy 8.04, it need the debhelper version >=6.04. Then i donwload the debhelpler 8.00 and try to make it a deb package by using: matt@radius:~/debhelper$ dpkg-buildpackage -rfakeroot dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set LDFLAGS to default value: -Wl,-Bsymbolic-functions dpkg-buildpackage: source package debhelper dpkg-buildpackage: source version 8.0.0 dpkg-buildpackage: source changed by Joey Hess <joeyh(a)debian.org> dpkg-buildpackage: host architecture i386 fakeroot debian/rules clean ./run dh clean Undefined subroutine &Getopt::Long::GetOptionsFromArray called at /home/matt/debhelper/Debian/Debhelper/Dh_Getopt.pm line 156. make: *** [clean] Error 255 dpkg-buildpackage: failure: fakeroot debian/rules clean gave error exit status 2 How can I have rlm_eap_tls.so on Ubuntu platform? thanks!!!!! ------------------ Best Regards Matthew (方嘉)

2 1

postproxy breaks eap authentication
by hans.bornemann＠tu-dortmund.de 17 Nov '10

17 Nov '10

Hi, I have 2 freeradius server: 1 as proxy server, 1 as authentication server. Everything is working fine (Auth. for WPA2, MSCHAPv2 ) until I implement the postproxy function: Then the authentication process did not finished. Putting the vlanid etc into radreply on the authentication radius, everything is working also. Is there something wrong in my config? Version: freeradius/lucid uptodate 2.1.8+dfsg-1ubuntu1 /etc/freeradius/sites-enabled/default: .... post-proxy { post_proxy_log #attr_rewrite attr_filter.post-proxy eap # Post-Proxy-Type Fail { # detail # } /etc/freeradius/attrs: tu-dortmund.de Tunnel-Private-Group-ID :=8, Fall-Through = Yes DEFAULT Tunnel-Type := VLAN, Tunnel-Medium-Type := IEEE-802 Regards hans -- Hans Bornemann IT & Medien Centrum - TU Dortmund Tel. 0049 231 7552132

4 6

rlm_exec and 'No such file or directory' error
by mark.leese＠stfc.ac.uk 17 Nov '10

17 Nov '10

Hi, I'm using FreeRADIUS 2.1.3. At the end of the authorize section I need to call a Perl script to do some LDAP checking and either set the Auth-Type to Reject (to forcibly reject a user) or leave it set to whatever value FreeRADIUS has previously set (always LDAP). I used to do this with rlm_perl but it looks like backslashes in the plaintext User-Password attribute causes things to break, and I need a quick fix while I look at what to do about the rlm_perl problem. I have the exec module enabled in the instantiate section of radiusd.conf and I have the following at the end of the authorize section in the sites-enabled/default file: if (control:Auth-Type == LDAP) { update control { Auth-Type = `%{exec:/etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type}}` } } When I run the basic test with debug (-X) turned on I see the following trace: [snip] radiusd: #### Instantiating modules #### Wed Nov 17 17:36:20 2010 : Debug: instantiate { Wed Nov 17 17:36:20 2010 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Nov 17 17:36:20 2010 : Debug: Module: Linked to module rlm_exec Wed Nov 17 17:36:20 2010 : Debug: Module: Instantiating exec Wed Nov 17 17:36:20 2010 : Debug: exec { Wed Nov 17 17:36:20 2010 : Debug: wait = yes Wed Nov 17 17:36:20 2010 : Debug: input_pairs = "request" Wed Nov 17 17:36:20 2010 : Debug: shell_escape = no Wed Nov 17 17:36:20 2010 : Debug: } [snip] Wed Nov 17 17:49:21 2010 : Info: ++? if (control:Auth-Type == LDAP) Wed Nov 17 17:49:21 2010 : Info: ? Evaluating (control:Auth-Type == LDAP) -> TRUE Wed Nov 17 17:49:21 2010 : Info: ++? if (control:Auth-Type == LDAP) -> TRUE Wed Nov 17 17:49:21 2010 : Info: ++- entering if (control:Auth-Type == LDAP) {...} Wed Nov 17 17:49:21 2010 : Info: Executing /etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type} Wed Nov 17 17:49:21 2010 : Info: expand: %{control:Ldap-UserDn} -> CN=bill,OU=Facility Users,DC=foo,DC=ac,DC=uk Wed Nov 17 17:49:21 2010 : Info: expand: %{control:Auth-Type} -> LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program output: LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program-Wait: plaintext: LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program: returned: 0 Wed Nov 17 17:49:21 2010 : Info: result 0 Wed Nov 17 17:49:21 2010 : Info: expand: %{exec:/etc/raddb/facilityUsers.pl %{control:Ldap-UserDn} %{control:Auth-Type}} -> LDAP Wed Nov 17 17:49:21 2010 : Debug: Exec-Program output: Wed Nov 17 17:49:21 2010 : Error: Exec-Program: FAILED to execute LDAP: No such file or directory Wed Nov 17 17:49:21 2010 : Debug: Exec-Program-Wait: plaintext: Wed Nov 17 17:49:21 2010 : Error: Exec-Program: FAILED to execute LDAP: No such file or directory Wed Nov 17 17:49:21 2010 : Debug: Exec-Program: returned: 1 Wed Nov 17 17:49:21 2010 : Info: +++[control] returns invalid Wed Nov 17 17:49:21 2010 : Info: ++- if (control:Auth-Type == LDAP) returns invalid Wed Nov 17 17:49:21 2010 : Auth: Invalid user: [bill] (from client localNas port 52340 cli AB-CD-EF-00-00-00) In this case the call to the Perl script (facilityUsers.pl) returns LDAP, but it looks like rlm_exec then tries to execute this result as a command, which fails and then the whole Access-Request message is rejected. I'm clearly doing something wrong, but I can't see what. Can anyone offer any suggestions? Thanks in advance, Mark. -- Scanned by iCritical.

2 1