- Freeradius-Users - lists.freeradius.org

Restricting certain users access to certain NAS devices
by Whitmarsh Mark (Leeds Teaching Hospitals NHS Trust) 07 Jul '10

07 Jul '10

Hi All, We are using Freeradius to authenticate network administrators when they login to their switches and routers. The setup is working fine as follows: User telnets to switch and enters username and password. Switch passes authentication request to Freeradius. Freeradius authenticates user against AD. The users are all defined in the users file - the lines I've added or changed from default are below: superuser1 Auth-Type = ntlm_auth superuser2 Auth-Type = ntlm_auth loweruser1 Auth-Type = ntlm_auth loweruser2 Auth-Type = ntlm_auth DEFAULT Group == "disabled", Auth-Type := Reject Reply-Message = "You are not permitted to access this system" The idea is that superusers are allowed to login to any of the 200 network devices whilst users are only allowed to login to a subset of say 50 devices. It's straightforward enough for the superusers and works fine but I'm stumped on how to handle the others. I have tested the following OK in sites-enabled/default: if ("%{User-Name}" == loweruser1) { update reply { Reply-Message := "Mark Whitmarsh not allowed here" } reject } If I login as loweruser1 it rejects me as expected. I think I need to put my users and network devices into groups so I can test for variables but I'm stuck on how to do that. After reading lots of man pages and getting nowhere I've hit one of those annoying mental blocks and need some help. Thanks, Mark Whitmarsh. ******************************************************************************************************************** This message may contain confidential information. If you are not the intended recipient please inform the sender that you have received the message in error before deleting it. Please do not disclose, copy or distribute information in this e-mail or take any action in reliance on its contents: to do so is strictly prohibited and may be unlawful. Thank you for your co-operation. NHSmail is the secure email and directory service available for all NHS staff in England and Scotland NHSmail is approved for exchanging patient data and other sensitive information with NHSmail and GSI recipients NHSmail provides an email address for your career in the NHS and can be accessed anywhere For more information and to find out how you can switch, visit www.connectingforhealth.nhs.uk/nhsmail ********************************************************************************************************************

2 8

Anonymous/Guest users and WPA with EAP-TLS/TTLS
by Erik Norgaard 07 Jul '10

07 Jul '10

Hi: I want to do a WLAN setup that allows restricted anonymous access yet offers the security of encryption with WPA. I currently use EAP-TLS. Ofcourse, I could create an Anonymous or guest account, but then I'd have to tell about it. Question, is it possible to use EAP with say TLS or TTLS and if no credentials are specified, no client certificate is sent, then anonymous access is granted rather than fail authentication? Thanks, Erik -- Erik Nørgaard Ph: +34.666334818/+34.915211157 http://www.locolomo.org

2 1

post_proxy_authorize = no
by Beat Schnyder 06 Jul '10

06 Jul '10

Dear freeradius users I'm trying to migrate our current radius infrastructure, and encountered the following question: I'm using: - FreeRADIUS Version 2.0.4 (Debian Lenny, 2.0.4+dfsg-6) - A Virtual Server "preauth", that parses the Username for some strings with the users file - Some requests get proxied to another server - On return of the proxied request, the authentication is done again, but because the users file is rather large, and the parsing slow, I would like to skip it - In previous versions we put "post_proxy_authorize = no" into proxy.conf, but this seems to have stopped working Now: How can I achieve this "skipping re-authentication after proxying"? Thanks for all replies Beat Schnyder ---------

2 1

Re: "Exiting normally" on FreeBSD -- Synopsis?
by Brian A. Seklecki 06 Jul '10

06 Jul '10

> Next step must be ktrace(8)/kdump(8) or GDB [1]. > > ~BAS > So it turns out, since April, there have been two distinctive types of crashes. The unexplained SIGHUP, which we eventually tracked down to faulty logging configurations (now using SYSLOG instead of file logging), and an ongoing Sig11. We finally got around to setting up core dump archival and here's what we found: % sudo gdb ../local/sbin/radiusd /var/core/133.radiusd.core GNU gdb 6.1.1 [FreeBSD] Copyright 2004 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "amd64-marcel-freebsd"... Core was generated by `radiusd'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/local/lib/freeradius-2.1.9/libfreeradius-radius-2.1.9.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/libfreeradius-radius-2.1.9.so Reading symbols from /lib/libcrypt.so.5...done. Loaded symbols for /lib/libcrypt.so.5 Reading symbols from /usr/local/lib/libltdl.so.7...done. Loaded symbols for /usr/local/lib/libltdl.so.7 Reading symbols from /usr/lib/libssl.so.6...done. Loaded symbols for /usr/lib/libssl.so.6 Reading symbols from /lib/libcrypto.so.6...done. Loaded symbols for /lib/libcrypto.so.6 Reading symbols from /lib/libthr.so.3...done. Loaded symbols for /lib/libthr.so.3 Reading symbols from /lib/libc.so.7...done. Loaded symbols for /lib/libc.so.7 Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_exec.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_exec.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_expr.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_expr.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_chap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_chap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_mschap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_mschap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_pap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_pap.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_realm.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_realm.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_ldap.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_ldap.so Reading symbols from /usr/local/lib/libldap_r-2.4.so.7...done. Loaded symbols for /usr/local/lib/libldap_r-2.4.so.7 Reading symbols from /usr/local/lib/liblber-2.4.so.7...done. Loaded symbols for /usr/local/lib/liblber-2.4.so.7 Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_preprocess.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_preprocess.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_acct_unique.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_acct_unique.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_files.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_files.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_detail.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_detail.so Reading symbols from /usr/local/lib/freeradius-2.1.9/rlm_radutmp.so...done. Loaded symbols for /usr/local/lib/freeradius-2.1.9/rlm_radutmp.so Reading symbols from /libexec/ld-elf.so.1...done. Loaded symbols for /libexec/ld-elf.so.1 #0 0x0000000000409c49 in rad_authenticate (request=0x80138ba40) at auth.c:667 667 request->reply->code = PW_AUTHENTICATION_REJECT; [New Thread 801208740 (LWP 100229)] [New Thread 801208900 (LWP 100220)] [New Thread 801208ac0 (LWP 100135)] [New Thread 801208c80 (LWP 100132)] [New Thread 801208e40 (LWP 100108)] [New Thread 8012021c0 (LWP 100395)] And: (gdb) bt #0 0x0000000000409c49 in rad_authenticate (request=0x80138ba40) at auth.c:667 #1 0x000000000043241c in radius_handle_request (request=0x80138ba40, fun=0x409700 <rad_authenticate>) at event.c:3735 #2 0x0000000000425311 in request_handler_thread (arg=0x8013799c0) at threads.c:493 #3 0x0000000800e509ed in pthread_create () from /lib/libthr.so.3 #4 0x0000000000000000 in ?? () Cannot access memory at address 0x7fffff5fc000 This is where I normally defer to Steve/Alan for a bit of GDB/C skills I'd be happy to provide a redacted radiusd.conf(5) and and run any GDB commands, we just have to keep the contents of memory under wraps to protect passwords (We use LDAP, so.) This is: [bseklecki@blackout ~]$ radiusd -v radiusd: FreeRADIUS Version 2.1.9, for host amd64-portbld-freebsd8.0, built on Jun 30 2010 at 11:46:51 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Happy holidays, all, ~BAS

2 1

Re: FreeRadius + AD + Realms
by Matthew P 05 Jul '10

05 Jul '10

> $ man unlang > > This says "put the string %{1} as the value of Stripped-User-Name". > > See the "data types' section of the manual page, and the "strings" section. Got it ;) Thanks for your help, fixed now. btw. the "unlang-way" is quite more flexible than the "legacy-module-way" Was this problem even possible to solve without using unlang? (using freeradius 1.x for an example) _________________________________________________________________ Hotmail: Powerful Free email with security by Microsoft. https://signup.live.com/signup.aspx?id=60969

2 1

Who Talks to Who?
by Thomas Reeves 05 Jul '10

05 Jul '10

Greetings All, I'm new to FreeRADIUS and I still don't have a good sense of who talks to who. I've attached a small PDF-format diagram of what I'm trying to accomplish and my IDEA of who talks to who. Any links or feedback would be appreciated. Cheers! Thomas

2 2

NULL realm reject
by Velpi 05 Jul '10

05 Jul '10

Hi, is it possible to configure an instant reject for a certain realm (in proxy.conf)? I'd like to set this for the NULL realm to disable usernames without a suffix. (any other suggestion to accomplish this is welcomed too!) Thanks! -- /--------------------------------------------- | Jan "Velpi" Van der Velpen | Velpi(a)industria.be || +32 (0) 498 61 24 89 \---------------------------------------------

2 4

how to return attribute with more than one value in an access-accept packet?
by WWF 05 Jul '10

05 Jul '10

Hello, all! Now I use fr 2.19 for our WiMAX network. It works well now! Thanks for all who have helped us on this maillist. however, I still have an important question. Our vendor asked us to return some attributes which are listed in WiMAX Forum Standard as return 0-n or 1-n. That is, in a single access-accept packet, there may 2 or 3 value for attribute like "Packet-Flow-Descriptor", "Time-Of-Day-Time". I don't know how to achieve this? Thanks in advance for your kindly help!

2 1

mschap/peap question
by Wegener, Norbert 05 Jul '10

05 Jul '10

With 2.1.8 and the configuration from http://deployingradius.com/scripts/eapol_test/peap-mschapv2.conf I want to test a radius configuration. The linux server running radius is member of the AD domain, mschap succeeds but finally the authentication fails. freeradius sends Challenges to which eapol_test will not respond. This should not be the behaviour mentioned in eap.conf regarding windows compatibility as eapol_test says: ... EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10 EAP-MSCHAPV2: Received success EAP-MSCHAPV2: Invalid authenticator response in success request EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL and finally fails. What is going wrong when freeradius says: ++[mschap] returns ok^M MSCHAP Success while eapol_test declares: EAP-MSCHAPV2: Invalid authenticator response in success request ? Thie result is the same whether eapol_test and radius run on the same host or on different machines. Below an extract from radius debug and eapol_test output. The complete logs are at http://tinyurl.com/36wn5lz ... Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for ZZZZZ1EC-TST with NT-Password [mschap] expand: --username=%{mschap:User-Name} -> --username=ZZZZZ1EC-TST [mschap] mschap2: c9 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=8dcf3f854091b5b0 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=32025f3e02109f45a23b3468721d538944af5d633f31afe2 Exec-Program output: NT_KEY: F2203599C0AD93B00507898A198A3698 Exec-Program-Wait: plaintext: NT_KEY: F2203599C0AD93B00507898A198A3698 Exec-Program: returned: 0 [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x010b00331a030a002e533d35423746314132333037313436343646314439373138453036333834454238383541454432384246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6aef51466be44b4f70ee0c4182d406d0 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x010b00331a030a002e533d35423746314132333037313436343646314439373138453036333834454238383541454432384246 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x6aef51466be44b4f70ee0c4182d406d0 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 10 to 127.0.0.1 port 58631 EAP-Message = 0x010b005b19001703010050de110c863ab2d5e21f07b010fc9adbfcda106b35f8cee8549fde8851ad1ba75da7bd114c1481cf7d9edb8adc3b2e4d8d2b5f7e62ba0fcea0b7e8e7e6e3edf45c2a1847d9195e7a0421a854d5ce12a3cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3cecf09536e7e9bedf3400a6b087488e Finished request 10. Going to the next request Waking up in 4.5 seconds. eapol_test : ... Received RADIUS message RADIUS message: code=11 (Access-Challenge) identifier=10 length=149 Attribute 79 (EAP-Message) length=93 Value: 01 0b 00 5b 19 00 17 03 01 00 50 31 9a b2 e5 49 18 04 ab eb 62 5c cc 03 11 93 ba e9 60 5d 66 bc 6b fb 67 97 92 75 f3 cd d7 d7 1b 5b ae bc aa 12 1f c1 a2 a5 41 2a e7 10 11 c1 b9 6f 3d 39 87 04 6e f8 b8 a5 0a a7 9d f8 79 91 cd 6d 3f 32 e1 2e fc df 43 4b 4c 96 99 fc 14 07 2c Attribute 80 (Message-Authenticator) length=18 Value: b0 cf e3 2a 75 f5 18 48 50 99 4b b4 e3 c8 50 70 Attribute 24 (State) length=18 Value: 65 71 c9 7b 6f 7a d0 fc 26 6f 03 8b 5c fc f1 85 STA 02:00:00:00:00:01: Received RADIUS packet matched with a pending request, round trip time 0.09 sec RADIUS packet matching with station decapsulated EAP packet (code=1 id=11 len=91) from RADIUS server: EAP-Request-PEAP (25) EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=11 method=25 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=91) - Flags 0x00 EAP-PEAP: received 85 bytes encrypted data for Phase 2 EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=47): 1a 03 0a 00 2e 53 3d 35 33 36 46 30 44 42 30 36 42 43 45 36 42 43 37 32 31 34 33 33 37 39 46 39 38 33 35 46 33 41 31 37 38 41 43 46 44 43 39 EAP-PEAP: received Phase 2: code=1 identifier=11 length=51 EAP-PEAP: Phase 2 Request: type=26 EAP-MSCHAPV2: RX identifier 11 mschapv2_id 10 EAP-MSCHAPV2: Received success EAP-MSCHAPV2: Invalid authenticator response in success request EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: startWhen --> 0 EAPOL test timed out EAP: deinitialize previously used EAP method (25, PEAP) at EAP deinit ENGINE: engine deinit MPPE keys OK: 0 mismatch: 1 FAILURE Thanks Norbert Wegener With best regards, Norbert Wegener Siemens AG Siemens IT Solutions and Services SIS GO NW PSU SDC AS&INS Bruchstraße 5 45883 Gelsenkirchen, Germany Tel.: +49 (209) 94565716 Fax: +49 (201) 8165581284 mailto:norbert.wegener@siemens.com Siemens Aktiengesellschaft: Chairman of the Supervisory Board: Gerhard Cromme; Managing Board: Peter Loescher, Chairman, President and Chief Executive Officer; Wolfgang Dehen, Heinrich Hiesinger, Joe Kaeser, Barbara Kux, Hermann Requardt, Siegfried Russwurm, Peter Y. Solmssen; Registered offices: Berlin and Munich, Germany; Commercial registries: Berlin Charlottenburg, HRB 12300, Munich, HRB 6684; WEEE-Reg.-No. DE 23691322

3 7

ntlm_auth fails for none domain
by John 05 Jul '10

05 Jul '10

Hi, We are using freeRADIUS talk to multiple ADs integration. I updated my freeRADIUS from 1.1.6 to 2.1.9 recently. "xjtu" is our default domain, for users under this domain will only use username to authenticate to RADIUS. With 1.1.6, it will get "xjtu" as domain; But with 2.1.9, it will not, please see the debug info below. It is the related part in configuration file: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain:-xjtu} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" It is debug info: [mschap] Told to do MS-CHAPv2 for hhe with NT-Password [mschap] No NT-Domain was found in the User-Name. [mschap] expand: --domain=%{mschap:NT-Domain} -> --domain= [mschap] expand: --username=%{mschap:User-Name:-None} -> --username=hhe [mschap] mschap2: a6 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=ddca17e9bfdaf05a [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=741e305efc7bce1071682eee0b3c37142b184b9544242304 John

3 2