- Freeradius-Users - lists.freeradius.org

Can't get LEAP working [beginner]
by David Jea 30 Oct '10

30 Oct '10

Hi, I installed freeradius and have radtest passed. Playing with it with Cisco gears. The system includes freeRadius (ip: 60.60.0.9 on vlan 660) and Cisco controller(ip: 60.62.0.11)/AP (on vlan 662). Using a Windows 7 laptop + Intel 6200 wifi chipset as the client. I understand LEAP is not secure, but it is simple, so this is just hope see if they can all work together. However, client was unable to connect. Here are the debug outputs from 'radiusd -X'. Please let me know if you have some clues on what might go wrong. Thank you, David ================================ root@djea-ubuntu:/usr/local/etc/raddb# root@djea-ubuntu:/usr/local/etc/raddb# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Oct 27 2010 at 00:44:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/ntlm_auth including configuration file /usr/local/etc/raddb/modules/opendirectory including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/dynamic_clients including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default main { allow_core_dumps = no } including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 60.62.0.11 { require_message_authenticator = no secret = "abcd" shortname = "TalwarDjea" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /usr/local/etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /usr/local/etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /usr/local/etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /usr/local/etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /usr/local/etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /usr/local/etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /usr/local/etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /usr/local/etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /usr/local/etc/raddb/modules/unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /usr/local/etc/raddb/modules/files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /usr/local/etc/raddb/modules/radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /usr/local/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /usr/local/etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /usr/local/etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /usr/local/etc/raddb/modules/detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /usr/local/etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/usr/local/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 60.62.0.11 port 32768, id=64, length=171 User-Name = "test" Calling-Station-Id = "00-23-14-52-b6-48" Called-Station-Id = "00-22-90-96-74-d0:roam1x" NAS-Port = 13 NAS-IP-Address = 60.62.0.11 NAS-Identifier = "TalwarDjea" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "662" EAP-Message = 0x020200090174657374 Message-Authenticator = 0x43b27fa1904d094c72f283b626235ede # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry test at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 64 to 60.62.0.11 port 32768 EAP-Message = 0x010300160410a79c9f15ab9b61db3cbbea86ccff0cdc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde34e188de37e54e1627fcd7f780c535 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 60.62.0.11 port 32768, id=65, length=186 User-Name = "test" Calling-Station-Id = "00-23-14-52-b6-48" Called-Station-Id = "00-22-90-96-74-d0:roam1x" NAS-Port = 13 NAS-IP-Address = 60.62.0.11 NAS-Identifier = "TalwarDjea" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "662" EAP-Message = 0x020300060311 State = 0xde34e188de37e54e1627fcd7f780c535 Message-Authenticator = 0x86143f5b448d061ce4685385e73a01b4 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry test at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/leap [eap] processing type leap rlm_eap_leap: Stage 2 rlm_eap_leap: Issuing AP Challenge rlm_eap_leap: Successfully initiated ++[eap] returns handled Sending Access-Challenge of id 65 to 60.62.0.11 port 32768 EAP-Message = 0x01040014110100085a49dd53258088a974657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde34e188df30f04e1627fcd7f780c535 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 60.62.0.11 port 32768, id=66, length=216 User-Name = "test" Calling-Station-Id = "00-23-14-52-b6-48" Called-Station-Id = "00-22-90-96-74-d0:roam1x" NAS-Port = 13 NAS-IP-Address = 60.62.0.11 NAS-Identifier = "TalwarDjea" Airespace-Wlan-Id = 2 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "662" EAP-Message = 0x0204002411010018f84b7c6e4beaad41a5f1c179c35507c688576b2d4431d8b574657374 State = 0xde34e188df30f04e1627fcd7f780c535 Message-Authenticator = 0xdab956d032f1cdc8b7519647c512e4ef # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 36 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry test at line 206 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/leap [eap] processing type leap rlm_eap_leap: Stage 4 rlm_eap_leap: NtChallengeResponse from AP is valid [eap] Underlying EAP-Type set EAP ID to 5 ++[eap] returns ok # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Challenge of id 66 to 60.62.0.11 port 32768 EAP-Message = 0x03050004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xde34e188dc31f04e1627fcd7f780c535 Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 64 with timestamp +306 Cleaning up request 1 ID 65 with timestamp +306 Cleaning up request 2 ID 66 with timestamp +306 Ready to process requests.

4 6

help
by balaram velega 29 Oct '10

29 Oct '10

I am using free-radius version 2.10 I am trying to get the server statistics to be displayed for number of access-requests, responses etc: echo "Message-Authenticator = 0x00,FreeRADIUS-Statistics-Type = 1" | radclient localhost:18120 status testing5 but its only printing the “access accept” I have seen the following example but somehow it doesn’t work on my setup, is this some bug or some configuration issue? Can you please help? *Asking with radclient*** The next step is to ask the status server questions about the state of the server. There are some hints in the manual page of the radclient program and the configuration file of the status server itself. Combining both information you can ask i.e. about all authentication packet to and from the server: # echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 1" | \ radclient localhost:18120 status adminsecret Received response ID 180, code 2, length = 140 FreeRADIUS-Total-Access-Requests = 3 FreeRADIUS-Total-Access-Accepts = 1 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 1 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 3 FreeRADIUS-Total-Auth-Unknown-Types = 0 http://wiki.freeradius.org/Status Thanks Balaram Velega

2 2

rlm_ldap and (automagic) xlat
by Sven Hartge 29 Oct '10

29 Oct '10

Hi all! I am using freeradius 2.1.10 (from backports) on a Debian Lenny server to authenticate wireless users using EAP and normal users (from Ascend NAS and ASA5510) with CHAP and PAP and so on. My backend is a LDAP directory (OpenLDAP). So far, everything is fine and working great. My question is more about fine tuning some aspects and some understanding issues with the way rlm_ldap adds (or doesn't add) attributes to the query/reply. I need to explain a bit about my environment: I have two LDAP attributes, which control the state of the account of a user: a) gifb-Status ("1" means enabled) b) gifb-NetzAccStatus ("1" again means enabled) - gifb-status gets set to "0" if the password expires or the account gets disabled because of other reasons. - gifb-NetzAccStatus gets set to "0" if the networking account has to be disabled If any of the two attributes is != 1, then the user has to be rejected. To achieve this, until recently I had a filter like the following for the ldap module: filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=gifb-NetzAccount)((gifb-status=1)(gifb-NetzAccStatus=1))" This worked OK, ie. the user was rejected if his account was disabled, because he wasn't even found by the ldap module. But this also resulted in somewhat ugly log entries: Sun Oct 3 20:38:18 2010 : Auth: Login incorrect ( [ldap] User not found): [XXXX123] (from client alb13 port 5 cli 00236CDEADBF via TLS tunnel) Sun Oct 3 20:38:18 2010 : Auth: Login incorrect: [XXXX123] (from client alb13 port 5 cli 00236CDEADBF) So, using unlang I created the following, adjusting my filter first ... filter = "(&(uid=%{%{Stripped-User-Name}:-%{User-Name}})(objectclass=gifb-NetzAccount))" ... adding to the dictionary ... ATTRIBUTE GIFB-NetzAccStatus 3000 integer ATTRIBUTE GIFB-Status 3001 integer and then in the inner-tunnel: ,----[sites-enabled/inner-tunnel | ldap | | if ( !notfound ) { | update request { | GIFB-NetzAccStatus := "%{ldap:ldap:///dc=fh-giessen-friedberg,dc=de?GIFB-NetzAccStatus?sub?uid=%u}" | GIFB-Status := "%{ldap:ldap:///dc=fh-giessen-friedberg,dc=de?GIFB-Status?sub?uid=%u}" | } | if ( GIFB-NetzAccStatus != 1 ) { | update reply { | Reply-Message = "User denied by GIFB-NetzAccStatus" | } | reject | } | if ( GIFB-Status != 1 ) { | update reply { | Reply-Message = "User denied by GIFB-Status" | } | reject | } | } `---- This also works great, I get meaningful log-entries and everything is OK. Now, for my rather simple question: Why can't I just add the following to ldap.attrmap and have the ldap module add those two attributes automagically. Why do I have to use two separate ldap_xlat queries: checkItem GIFB-NetzAccStatus GIFB-NetzAccStatus checkItem GIFB-Status GIFB-Status I also tried this with "replyItem" instead of checkItem and also tried adding ":=" as the operator, but without the separate ldap_xlat queries both RADIUS-Attributes are not available after the normal ldap module ran. It seems I am missing some crucial part of information here or just lack the understanding of this part of Freeradius. Please enlighten me. Grüße, Sven. -- Sig lost. Core dumped.

2 5

Re: EAP-SIM authentication / Supplicant
by tmuehlhoff 29 Oct '10

29 Oct '10

Any more activities in this context ? I'm trying to set up soemthing in this area. T. -- View this message in context: http://freeradius.1045715.n5.nabble.com/EAP-SIM-authentication-Supplicant-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

duplicate users + Free Radius
by Tyler Nally 29 Oct '10

29 Oct '10

Curious... assuming FreeRadius is configured to allow people to use the NAS via a username/password combination... would that allow johndoe to use both laptop computer and iPhone (and other wifi enabled devices) concurrently? or does FreeRadius boot the oldest authenticated login off of duplicate uses? Thanks -- Tyler Nally tnally(a)technally.com

3 2

FreeRadius + MySQL + Multiple Dynamic Clients
by Tyler Nally 29 Oct '10

29 Oct '10

Hello, I'm the IT fellow for a bus company that is about to implement WiFi on a fleet of a couple dozen buses (or so), so that passengers can pull out their laptops, iPhones, iPads, iWhatevers and connect thru the wandering networks from inside the comfort of the bus while traveling to their various destinations. We'll be using a Wireless Broadband device that will provide the broadband signal to a router. The router will be configured to use a Radius server so that as people connect they'll go through the Radius authentication protocols to get their wifi connection to the network. I'm assuming that whenever these power on, they'll be getting a new dynamically assigned IP address. Not to mention that potentially, as the bus roams aruond and as it loses and gains service between the different cell sites, I guess it's possible that each time it loses/gains a cell site, it might even get a new IP address. So, what I want to avoid is having set each router's access password (which would be 1 or 2 at first) each week .. manually. Up to a maximum of 20 or 30 of these .. manually. I figure that I can capture the the users email address (or username) and a password, and make just THAT combination of authentication available WHILE their scheduled route is running. Sooo.. just prior to the dispatch of the bus, I add that list of good authentications to the records of FreeRADIUS server setup. When the route is over, I remove the records (or somehow toggle them off). The idea being that they'll only be allowed one login per user while on the bus. And if they don't check/select that they want wifi access, they won't get access from a previous user/password combination. What I've got working is FreeRADIUS with MySQL. But not with a dynamic client. It's refusing the authentication connection with the client. Do I define 1 dynamic client that maybe 20-30 of these will be using? Or should they be numbered from 01 thru whatever. Either way, they'll all have different IP's as they are traveling down the road. The error message I see in the logs is: Thu Oct 28 16:10:26 2010 : Error: Ignoring request to authentication address * port 1812 from unknown client 98.212.198.111 port 2048 So.. I know the network is open to get the request, it's just not processing it. I've looked through the WIKI and can't find any specific dynamic client setup parameters/settings. I'm running freeradius v 2.1.8 on a Ubuntu 10.04 machine. With a test connection via a Netgear WNR834v2 that's been reflashed as a DD-WRT mini hotspot to give me the router configuration. Any help would be appreciated. -- Tyler Nally tnally(a)technally.com

2 3

RE: Wireless WPA2 enterprise Radius authentication
by Maurice James 29 Oct '10

29 Oct '10

Working settings I will be stating the changes from the default settings that I made to get it to work. All file names are followed by a colon : <<<<< = notes changes ****First you must have your ldap server store password in clear text. They CANNOT be hashed in any way**** eap.conf: default_eap_type = peap <<<<< ldap.attrmap: checkItem Cleartext-Password userPassword <<<<< (this entire line was added to the top of the list) inner-tunnel: # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap <<<<<(this must be uncommented) ldap: ldap { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "xxx.xxx.xxx" <<<<<(your ldap server) identity = "uid=xxx,ou=xxx,ou=TopologyManagement,o=xxx" <<<<<(your ldap admin user) password = xxxxx <<<<<(your ldap admin password) basedn = "dc=xxx,dc=xxx" <<<<<(your base dn) filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" mschap: use_mppe = yes<<<<<(not sure if this is needed but I changed it from no to yes) with_ntdomain_hack = yes<<<<<(not sure if this is needed but I changed it from no to yes) default: # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap<<<<<(uncomment) These are all of the setting that I changed to get Windows 7/Vista x64 > WPA2 > freeradius > 389-DS(Fedora Directory Server) to work -----Original Message----- From: freeradius-users-bounces+midnightsteel=msn.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] On Behalf Of Maurice James Sent: Thursday, October 28, 2010 4:37 PM To: 'FreeRadius users mailing list' Subject: RE: Wireless WPA2 enterprise Radius authentication OK gentlemen, After many sleepless nights I finally got it working. I was almost in tears (lol) but its done. Full authentication and authorization for a mix of Windows7 x64/Vista x64 clients using WPA2 Enterprise, Freeradius, 389-DS(Fedora Directory Services). I will post the configs in a follow-up email. Special thanks to the following John Dennis Sven Hartge Phil Mayers Thanks guys MCITP Enterprise + Server GIAC Security Leadership Certification (GSLC) -----Original Message----- From: freeradius-users-bounces+midnightsteel=msn.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+midnightsteel=msn.com@lists.freeradius.org] On Behalf Of John Dennis Sent: Wednesday, October 27, 2010 8:54 PM To: FreeRadius users mailing list Subject: Re: Wireless WPA2 enterprise Radius authentication On 10/27/2010 07:56 PM, Maurice James wrote: > I will give it another try. I've been trying to the last hour to get > the clear text password policy to stick to a user. Every time I run > the radius debug I see hashed value passed from LDAP. I have to search > online for the instructions on how to get 389-ds server to use clear > text. Thanks for all the help and advice all. This is one of the most > responsive lists that I have ever been a member of 389-ds has most all the features I mentioned. The Administrators Guide is your friend. 389-ds doc can be found here: http://directory.fedoraproject.org/wiki/Documentation#389_Documentation The Administrators Guide can be found here: http://www.redhat.com/docs/manuals/dir-server -- John Dennis <jdennis(a)redhat.com> Looking to carve out IT costs? www.redhat.com/carveoutcosts/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Problems getting a linux server to join a AD domain
by Rowley, Mathew 28 Oct '10

28 Oct '10

In an attempt to integrate Radius with AD, and following the tutorial (http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO) I have set up an AD server in our lab, and having trouble adding my linux box to the domain. Can anyone see what im doing wrong? The error I keep getting is: $ sudo net join -w SECLAB -I 10.252.159.137 -U Administrator [sudo] password for wuntee: Enter Administrator's password: [2010/10/28 12:23:36.656829, 0] utils/net_rpc_join.c:406(net_rpc_join_newstyle) Error in domain join verification (credential setup failed): NT_STATUS_INVALID_COMPUTER_NAME Unable to join domain SECLAB. Kerberos seems to work fine: $ kinit mrowle000 Password for mrowle000(a)SECLAB.SECURITY.LAB.NET: $ klist Ticket cache: FILE:/tmp/krb5cc_1000 Default principal: mrowle000(a)SECLAB.SECURITY.LAB.NET Valid starting Expires Service principal 10/28/10 12:27:29 10/28/10 22:27:23 krbtgt/SECLAB.SECURITY.LAB.NET(a)SECLAB.SECURITY.LAB.NET renew until 10/29/10 12:27:29 CONFIGS: krb5.conf [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log kdc = SYSLOG:INFO:AUTH admin_server = FILE:/var/log/kadmind.log admin_server = SYSLOG:INFO:AUTH [libdefaults] default_realm = SECLAB.SECURITY.LAB.NET dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [realms] SECLAB.SECURITY.LAB.NET = { kdc = seclab.security.lab.net:88 default_domain = seclab.secuitry.lab.net } [domain_realm] .seclab.security.lab.net = SECLAB.SECURITY.LAB.NET seclab.security.lab.net = SECLAB.SECURITY.LAB.NET Samba.conf [global] workgroup = SECLAB.SECURITY.LAB.NET server string = %h server (Samba, Ubuntu) dns proxy = no log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d security = ads encrypt passwords = true passdb backend = tdbsam obey pam restrictions = yes unix password sync = yes passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* . pam password change = yes map to guest = bad user idmap uid = 16777216-33554431 idmap gid = 16777216-33554431 template shell = /bin/bash winbind use default domain = no password server = seclab.security.lab.net //your AD-server realm = SECLAB.SECURITY.LAB.NET //your real usershare allow guests = yes [homes] comment = Home Directories browseable = no writable = yes [printers] comment = All Printers browseable = no path = /var/spool/samba printable = yes guest ok = no read only = yes create mask = 0700 [print$] comment = Printer Drivers path = /var/lib/samba/printers browseable = yes read only = yes guest ok = no

5 9

Assign VLANS based on AD groups.
by Johnson, Neil M 28 Oct '10

28 Oct '10

Now that I have authentication working. I would like to assign users to VLANS based on AD group membership. Google searches haven't produced any examples, but I'm assuming that I need to do something with LDAP ? Any examples would be appreciated. Thanks. -Neil -- Neil Johnson Network Engineer Information Technology Services The University of Iowa 319 384-0938 neil-johnson(a)uiowa.edu

2 1

Wireless WPA2 enterprise Radius authentication
by midnightsteel 28 Oct '10

28 Oct '10

Has anyone gotten Freeradius 2.x and LDAP (OpenLDAP, FDS, etc...) to properly authenticate users? I get the following in my radius log Auth: Login incorrect: [wii/<via Auth-Type = EAP>] (from client access port 0 via TLS tunnel) Auth: Login incorrect: [wii/<via Auth-Type = EAP>] (from client access port 14 cli 78e400881f19) This is driving me crazy. I can authenticate users from the radius serve to ldap but not from the access point to radius to ldap If anyone has gotten it to work please post the example config files that you used. Im open to answer any questions that you may have about my configs. Access point using WPA2-Enterprise >> Freeradius 2.x >> 389-DS(Fedora LDAP) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Wireless-WPA2-enterprise-Radius-aut… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 21