- Freeradius-Users - lists.freeradius.org

Cisco WLC4402 - 802.1X - Android - Tunnel-Priv-Group-ID Failure
by Thomas Donnelly 11 Aug '10

11 Aug '10

Hello All, There are quite a few components coming into play here so I'm not exactly sure whats breaking where. Let me start with explaining our setup: We use cisco 1142 agn lightweight access points connected to a 4402 Wireless Lan Controller This controller is doing radius authentication off of Freeradius 1.1.8 (with FreeBSD as the Host OS) on our primary ssid. When people authenticate it replies with Tunnel-Private-Group-ID based on their username/group. This puts them in the correct vlan for their department. This works perfectly fine with our Apple Laptops, iPhones, and iPads. However when I join with my Android phone or my n900 (maemo), I get put in the default vlan for the SSID. After some digging I found the following: When joining from the Apple devices, the User-Name comes accross as Tue Aug 10 17:13:03 2010 User-Name = "someone(a)somehwere.net" When Joining from my Android, it comes accross as: Tue Aug 10 11:26:53 2010 User-Name = "1fT6ESzC4Dbj9oIpiJjjfg==" (A few chars changed to prevent the username from being figured out) This somehow is authenticating correctly because I get an IP address (in the incorrect vlan) and can surf the net, and if I mistype the password I get an authentication failure. However when it tries to do a match for the username to determine their group/vlan it fails because we don't have any users with that user name. Has anyone seen this before or have any leads I should follow? Thanks! -=Tom Donnelly

6 8

radius cant contact ldap server
by Aqdas Muneer 11 Aug '10

11 Aug '10

hello everyone, I have asked this question before but didn't get any suggestions, so please try to help me if you can. We recently had a event during which our radius server lost connectivity to our Active Directory server. all the network gear could contact radius so none fell back to the backup authentication method (local), but because AD was down we couldn't get into our devices. is there a way to use some locally stored password in free radius if the ldap server cant be reached? below is my user file config. i have an admin account that i would like to use if ldap is down, but don't want users to be able to use it when ldap is accessible. i'm running FreeRadius version 2.1.7. admin Huntgroup-Name == "network-admin", Cleartext-Password := "xxxxxxxxx" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15" DEFAULT Huntgroup-Name == "network-admin", Ldap-Group == "networkadmins" Service-Type := NAS-Prompt-User, cisco-avpair := "shell:priv-lvl=15", Auth-Type := LDAP

1 0

Can't Contact LDAP Server
by rrperez 11 Aug '10

11 Aug '10

I have configured Freeradius2 server on a virtual machine and LDAP server on another virtual machine. I got all the configuration needed for the radius and ldap server to map at each other. Here is the debug when performing radiusd -X: FreeRADIUS Version 2.1.7, for host i686-redhat-linux-gnu, built on Mar 31 2010 at 00:25:31 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/ldap including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/inner-tunnel group = radiusd user = radiusd including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_ldap Module: Instantiating ldap ldap { server = "10.96.100.206" port = 389 password = "secret" identity = "cn=Admin,dc=testldap1,dc=test,dc=corpoff" net_timeout = 1 timeout = 4 timelimit = 3 tls_mode = no start_tls = no tls_require_cert = "allow" tls { start_tls = no require_cert = "allow" } basedn = "dc=testldap1,dc=test,dc=corpoff" filter = "(uid=%{%{Stripped-User-Name}:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" auto_header = no access_attr_used_for_allow = yes groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap_debug = 0 ldap_connections_number = 5 compare_check_items = no do_xlat = yes set_auth_type = yes } rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: Over-riding set_auth_type, as there is no module ldap listed in the "authenticate" section. rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaLmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNtPassword mapped to RADIUS NT-Password rlm_ldap: LDAP dBCSPwd mapped to RADIUS LM-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusNASIpAddress mapped to RADIUS NAS-IP-Address rlm_ldap: LDAP userPassword mapped to RADIUS User-Password rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port rlm_ldap: LDAP radiusReplyMessage mapped to RADIUS Reply-Message rlm_ldap: LDAP radiusTunnelType mapped to RADIUS Tunnel-Type rlm_ldap: LDAP radiusTunnelMediumType mapped to RADIUS Tunnel-Medium-Type rlm_ldap: LDAP radiusTunnelPrivateGroupId mapped to RADIUS Tunnel-Private-Group-Id conns: 0x8aafa78 Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. Nothing seems wrong and the radius and ldap successfully map at each other. But attempting the radtest, the radius server can't contact the ldap server. Here is the debug for the radtest: rad_recv: Access-Request packet from host 127.0.0.1 port 56655, id=48, length=61 User-Name = "test-user" User-Password = "testpass" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test-user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry test-user at line 93 ++[files] returns ok [ldap] performing user authorization for test-user [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> test-user [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=test-user) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.100.206:389, authentication 0 rlm_ldap: bind as cn=Admin,dc=testldap1,dc=test,dc=corpoff/secret to 10.96.100.206:389 rlm_ldap: cn=Admin,dc=testldap1,dc=test,dc=corpoff bind to 10.96.100.206:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test-user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 48 to 127.0.0.1 port 56655 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 48 with timestamp +2 Ready to process requests. Can anyone help with this problem? Thanks... -- View this message in context: http://old.nabble.com/Can%27t-Contact-LDAP-Server-tp29406114p29406114.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

RE: Suffix authentication
by Sallee, Stephen (Jake) 11 Aug '10

11 Aug '10

I have found a working solution for my environment and wanted to share it with the list in case it may help someone else. In my proxy.conf file I added the following ------------------ realm domainName1 { } Realm domainName2{ } ------------------ That fixed my realm problem, not sure why... We use Microsoft AD and ntlm_auth for authenticating our users through MSCHAPv2 tunneled through a peap session. I have 2 domains one is a child of the other the FreeRADIUS server is joined to the parent domain so it can authenticate users from both domains but passing the correct domain for the user request was a bugger! In the end what I got to work was modifying the ntlm_auth statement at the bottom of the mschap module to be the following: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{%{Stripped-User-Name}:-%{User-Name:-None}} --domain=%{outer.request:Realm} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" *** --domain=%{outer.request:Realm} was the key, now the realm of the request is passed to the ntlm_auth script perfectly and the user is authenticated like we all love them to be : ) This does seem to break the domain\username style of logging in though ... but due to time constraints this will have to do for now. Thanks to everyone who everyone who helped out, especially Alan. Thank you. Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221 -----Original Message----- From: freeradius-users-bounces+jake.sallee=umhb.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+jake.sallee=umhb.edu@lists.freeradius.o rg] On Behalf Of Alan DeKok Sent: Tuesday, August 10, 2010 3:42 PM To: FreeRadius users mailing list Subject: Re: Suffix authentication Sallee, Stephen (Jake) wrote: > Quickly, my problem is users cannot log in using username@domain but > can login fine with domain\username. So... what is different in the debug log between the two requests? > One person mentioned the realms module, but when I look at it the > default conf looks fine. The delimiter is correctly set to '@'. I > tried adding my domains to the realm module by copying the default > suffix config and using my domain info but that causes FR to fail its > sanity check. Because you made some random change without understanding how the server works, or reading the documentation. > I am using MSCHAPv2 with PEAP authentication and when the user fails > the logon with username@domain the ntlm_auth program reports a bad > password even though the same user will have no problem with domain\username. > > Also, the FR wiki says the realms file is depreciated ... so what am I > supposed to do? Read proxy.conf. It defines the realm names. The "realms" module just searches the User-Name in various ways (suffix, prefix, ntdomain), and then sees if there is a matching realm. > What would be really great would be a script I could use to determine > the domain of the user BEFORE they reach ntlm_auth so I can > prepopulate the command with the correct domain and just forget this suffix stuff : > ) I think the best place for this would be in the mschap module but > what is the language? Would it be unlang or regular bash scripting? The default config documents how to define realms. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Using postauth_users and Access-Reject
by Peter Lambrechtsen 11 Aug '10

11 Aug '10

Using FreeRadius 2.1.7 and trying to get the postauth_users to return an access reject however it always seems to return either a noop or ok. This is what I get in my radiusd -X trace: [files] postauth_users: Matched entry DEFAULT at line 30 ++[files] returns ok Sending Access-Accept of id 53 to 192.168.143.72 port 2503 Reply-Message = "Your account has been disabled." And this is what is in my postauth_users file: DEFAULT Auth-Type := REJECT Post-Auth-Type = Reject, Reply-Message = "Your account has been disabled." Checking the rlm_files.c it seems that either ok or noop are the two options returned: /* * See if we succeeded. */ if (!found) return RLM_MODULE_NOOP; /* on to the next module */ return RLM_MODULE_OK; Ideally I would assume if the Auth-Type := Reject then the return should be "RLM_MODULE_REJECT". Since otherwise I think I will need to lookup if the Reply-Message is set to disabled, and then do a reject. I'm no C developer hence why I am not offering up a patch, but I might try and see how difficult it would be. Cheers Peter

2 7

[OT?] Systemwide authentication on Windows
by Lukas Haase 11 Aug '10

11 Aug '10

Hi, I think I have a simple question: Today I upgraded from WPA-PSK to WPA Enterprise and use PEAP-MSCHAPv2 for users (using logins) now and I want to use EAP-TLS for machines. How can I configure a WinXP machine such that login is *not* associated to a user but to the machine? As such, WLAN connection should be established before logon! (e.g. for roaming profiles) It just works with WPA-PSK.. I tried to add the client certificate for EAP-TLS to the computer certificate store. But the certificate is only found if it is in the user's store :-( This can't be true?! there must be a way to connect the whole machine using a certificate (not just the current user) , mustn't it? Regards, Luke

2 2

LDAP group check on inner-tunnel.
by Jason Fenner 11 Aug '10

11 Aug '10

I am running FreeRadius version 2.1.7-7 I am doing clear-text password authentication against Active Directory using ntlm_auth. Then ldap is used for group checking. Finally, I have moved my policies to postauth_users in the postauth group. This clear-text functionality works fine. However, when I test PEAP using eapol_test authentication also works fine, but the ldap group checking occurs only on the outer-tunnel username. In this case, the outer tunnel is created using the username "anonymous". This user doesn't exist in AD, so a failure is the response. In inner-tunnel post-auth I have this snippet: update outer.reply { User-Name = "%{request:User-Name}" } My understanding was that this should copy the real username from the inner tunnel to the outer tunnel. This should then allow ldap groupcheck to test the correct username. I never see a ldap check on the inner tunnel at all. I see this strange output in debug in relation to the snipet above: [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} expand: %{request:User-Name} -> radius_user ++[outer.reply] returns noop } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radius_user" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "radius_user" [peap] Tunneled authentication was successful. [peap] SUCCESS [peap] Saving tunneled attributes for later I would think that outer.reply should return ok or something other then noop. Looking forward to any help with getting ldap group check working on the inner tunnel username. Jason Fenner, CCNP Network Engineer & Storage Administrator Vita-Mix Corporation 8615 Usher Road, Cleveland, Ohio 44138 +1 (440) 782-2603 | JFenner(a)Vitamix.com IT Support: +1 (440) 782-2222 eMail: Helpdesk(a)Vitamix.com CONFIDENTIALITY NOTE: This message is intended for use only by the individual or entity to which it is addressed and may contain information that is privileged, confidential, and protected from disclosure under applicable law. If the reader of this message is not the intended recipient, or the employee or agent responsible for delivering the message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please immediately notify me by telephone and permanently delete the original and any copy of this e-mail and destroy any printout thereof.

2 1

PPTP auth vs samba-ldap, 691
by Cory Johnson 11 Aug '10

11 Aug '10

Greetings, Trying to get FreeRADIUS 2.1.8 to authenticate VPN users for PfSense's PPTP server. I am having an issue similar to the one in this old list post: http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg40632.…. When I try to log into the VPN from a Windows client, I get the error message: "Error 691: Access was denied because the user name and/or password was invalid on the domain.", but radius logs show "Access-Accept". My major difference is that I am using a LDAP backend which contains NT passwords (it is also the LDAP backend for my samba server). Tried fiddling with mppe and encryption settings in the mschap module, but always get the same results. "freeradius -X" debug below, as always any reply would be great. rad_recv: Access-Request packet from host 192.168.1.55 port 43210, id=116, length=166 NAS-Identifier = "pfsense.local" NAS-Port = 0 NAS-Port-Type = Virtual Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "192.168.1.153" User-Name = "cjohnson" MS-CHAP-Challenge = 0xbc4e68fb2822b769cef9f48f6420925f MS-CHAP2-Response = 0x0100991b81f3bbq3859d8qa75ae826662d8600000000000000009584dde386742b71bc7c72fca79a678ebf1fee00b74a36e2 server vpn { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [suffix] No '@' in User-Name = "cjohnson", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] Entering ldap_groupcmp() [vpn] expand: dc=corp,dc=example,dc=com -> dc=corp,dc=example,dc=com [vpn] expand: %{Stripped-User-Name} -> [vpn] ... expanding second conditional [vpn] expand: %{User-Name} -> cjohnson [vpn] expand: (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to 192.168.1.99:389, authentication 0 [ldap] bind as cn=admin,dc=corp,dc=example,dc=com/s3cr3t to 192.168.1.99:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] ldap_release_conn: Release Id: 0 [vpn] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [vpn] ... expanding second conditional [vpn] expand: %{User-Name} -> cjohnson [vpn] expand: (&(objectClass=posixGroup)(memberUid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=posixGroup)(memberUid=cjohnson)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(cn=VPN)(&(objectClass=posixGroup)(memberUid=cjohnson))) rlm_ldap::ldap_groupcmp: User found in group VPN [ldap] ldap_release_conn: Release Id: 0 [vpn] users: Matched entry DEFAULT at line 5 ++[vpn] returns ok [ldap] performing user authorization for cjohnson [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> cjohnson [ldap] expand: (&(objectClass=posixAccount)(uid=%{%{Stripped-User-Name}:-%{User-Name}})) -> (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] expand: dc=corp,dc=example,dc=com -> dc=corp,dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=corp,dc=example,dc=com, with filter (&(objectClass=posixAccount)(uid=cjohnson)) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] sambaNtPassword -> NT-Password == 0x4039323544423042363155514544454138343541433236383039324641284532 [ldap] sambaLmPassword -> LM-Password == 0x3145314444423038343342393233433141414433423444454235313430333545 [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user cjohnson authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing LM-Password from hex encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user expand: Great Success! -> Great Success! Login OK: [cjohnson] (from client 192.168.1.55 port 0 cli 192.168.1.153) Great Success! +- entering group post-auth {...} ++[exec] returns noop } # server vpn Sending Access-Accept of id 116 to 192.168.1.55 port 43210 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 116 with timestamp +23 Ready to process requests. --CJ

2 1

EAP-TLS and "default user"?!
by Lukas Haase 11 Aug '10

11 Aug '10

Hi, I want to secure my WPA network with PEAP-MSCHAPv2 and EAP-TLS. The first one already works (including LDAP server) but the second one fails. This is the output of freeradius -X: n Ready to process requests. rad_recv: Access-Request packet from host 192.168.200.151 port 2049, id=0, length=111 NAS-IP-Address = 192.168.200.151 Called-Station-Id = "0016b6a3ee04" Calling-Station-Id = "001de0121c0d" NAS-Identifier = "0016b6a3ee04" NAS-Port = 3 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000501 Message-Authenticator = 0x31e54d9d928ba685321f40fd2d46667a +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: Proxy reply, or no User-Name. Ignoring. ++[suffix] returns noop rlm_eap: EAP packet type response id 0 length 5 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: UserIdentity Unknown rlm_eap: Identity Unknown, authentication failed rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Login incorrect: [<no User-Name attribute>/<via Auth-Type = EAP>] (from client ap port 3 cli 001de0121c0d) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> ++[attr_filter.access_reject] returns noop Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 192.168.200.151 port 2049 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +106 Ready to process requests. As client I use Windows XP SP2. I searched a lot in the net and all I found was that the supplicant should be broken because it should send a username along. Well, I can not image this because then this would be mentioned in ANY of these tutorials. Maybe I also need to add a special "default" entry to the users file? I played around but still I did not get it working. Can anybody give me a hint where to start? Regards, Luke

2 2

Suffix authentication
by Sallee, Stephen (Jake) 10 Aug '10

10 Aug '10

I hope someone can help me. I have written in about this problem before so please forgive me, but it is still plaguing me : ) Quickly, my problem is users cannot log in using username@domain but can login fine with domain\username. One person mentioned the realms module, but when I look at it the default conf looks fine. The delimiter is correctly set to '@'. I tried adding my domains to the realm module by copying the default suffix config and using my domain info but that causes FR to fail its sanity check. I am using MSCHAPv2 with PEAP authentication and when the user fails the logon with username@domain the ntlm_auth program reports a bad password even though the same user will have no problem with domain\username. Also, the FR wiki says the realms file is depreciated ... so what am I supposed to do? What would be really great would be a script I could use to determine the domain of the user BEFORE they reach ntlm_auth so I can prepopulate the command with the correct domain and just forget this suffix stuff : ) I think the best place for this would be in the mschap module but what is the language? Would it be unlang or regular bash scripting? Thanks for any assistance! Jake Sallee Godfather Of Bandwidth Network Engineer Fone: 254-295-4658 Phax: 254-295-4221

2 1