- Freeradius-Users - lists.freeradius.org

ldap auto header MS-CHAPv2
by omega bk 15 Mar '10

15 Mar '10

hi, how can i handle encrypted users's ldap password ? pap reckognize my ssha1 from base64 encoding => because of the auto_header to yes but it looks like MS-CHAP does not kwow how to deal with... [ldap] Added User-Password = {SSHA}2FJYOM+C3mqL2g6wOhcLfjMY2XdoQ4bi in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Cleartext-Password == "{SSHA}2FJYOM+C3mqL2g6wOhcLfjMY2XdoQ4bi" [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing SSHA1-Password from base64 encoding [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject thank u

3 4

Re: MS-CHAP2-Response is incorrect + invalid NT-Password
by omega bk 15 Mar '10

15 Mar '10

sorry for spamming, i just want to understand *OpenLDAP knows the clear text password:* [ldap] userPassword -> Cleartext-Password == "test " [ldap] userPassword -> NT-Password == 0x7465737420 *=> supposed to be the hash password* [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} *Is the inner tunnel part of the MSCHAPv2 is failing because it doesn't kwow the way of dealing with the password supplied ?* *Adding into ldap.attrmap the userPassword -> NT-Password is enough to produce a correct NT hash password? *[mschap] Invalid NT-Password * * [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. } # server inner-tunnel [peap] Got tunneled reply code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 [peap] Tunneled authentication was rejected. [peap] FAILURE

3 8

Hi,
by Axel Grimm 15 Mar '10

15 Mar '10

Hi i have little question. I use Freeradius with mysql an a dd-wrt Linksys Router as NAS. How can i setup a MAC Adress auth that user do not need login and Passwort ? THX Axel

2 1

Re: MS-CHAP2-Response is incorrect + invalid NT-Password
by omega bk 15 Mar '10

15 Mar '10

hello, i'm still stuck and don't know how to make it work i added in ldap.attrmap: checkItem Cleartext-Password userPassword checkItem NT-password userPassword but i stil have: [ldap] expand: %{User-Name} -> bernard [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=bernard) [ldap] expand: dc=example,dc=com -> dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=example,dc=com, with filter (cn=bernard) [ldap] Added User-Password = test in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> NT-Password == 0x7465737420 [ldap] userPassword -> Cleartext-Password == "test " [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} *[mschap] Invalid NT-Password [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect* ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject I don't understand why i still got an invalid NT-Password. thanks for your help

1 1

LDAP, old TCP connections, and retry
by Justin Steward 15 Mar '10

15 Mar '10

Hi Guys, A few quick questions on tweaking rlm_ldap for freeradius. Question 1: The LDAP server which the radius server attempts to connect to is located behind a firewall which kills TCP connections that have been idle for 30 minutes. FR then tries to do a lookup using a connection that has been open and idle for half an hour or more, and the firewall drops the now invalid connection. How can I force an idle timeout on LDAP connections in FR? Question 2: >From the information I have been given, it appears that if the connection times out, LDAP does not attempt to retry. Is there a way to force FR to make 1 or 2 attempts at retrying the connection before giving up on LDAP? The current situation is causing many headaches trying to log in, and the client is reluctant to relax their firewall for a number of reasons. Many Thanks, Justin Steward

2 4

Access-Reject packet from host 127.0.0.1 port 1812, id=29, length=34
by Suman Dash 14 Mar '10

14 Mar '10

Hi, I am unable to locally authenticate a user from users file. Below is the log : Server : rad_recv: Access-Request packet from host 127.0.0.1 port 37881, id=29, length=57 User-Name = "suman" User-Password = "hello" NAS-IP-Address = 20x.20x.20x.20x NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "suman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated [files] users: Matched entry suman at line 90 [files] expand: Hello, %{User-Name} -> Hello, suman ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "hello" [pap] Using CRYPT encryption. [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> suman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.10 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 29 to 127.0.0.1 port 37881 Reply-Message = "Hello, suman" Waking up in 4.9 seconds. Cleaning up request 2 ID 29 with timestamp +164 Ready to process requests. Radtest sudo radtest suman hello 127.0.0.1 0 testing123 Log Sending Access-Request of id 203 to 127.0.0.1 port 1812 User-Name = "suman" User-Password = "hello" NAS-IP-Address = 204.232.205.196 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=203, length=34 Reply-Message = "Hello, suman" Please let me know what i am doing wrong as i am a complete starter. Thanks and Regards Suman Dash

3 5

RE: fradius v2.1.7 Simultaneous-Use
by Mark 13 Mar '10

13 Mar '10

Hi list, I have been trying to find out more information regarding the use of the Simultaneous-Use option for FreeRadius. I have been checking google and most guides seem to point to /etc/raddb/sql.conf and to uncomment the appropriate lines. However, I have not been able to find the Simultaneous-Use option in on my radius server's sql.conf. Does anyone know if that may have been moved to somewhere else or did I miss something on the installation? The distro for the server in question is fedora11. Any help would be much appreciated. Kind regards, Mark

3 2

upgrade from 1.1.8 to 2.1.8 problem
by Roar Pettersen 13 Mar '10

13 Mar '10

Hi ! We have used FreeRadius 1.1.X with sucess for several years and it is time to upgrade to the vesion 2. In 1.1.8 we used "post_proxy_authorize = yes" in proxy.conf to read the users file after we got a access-accept from the home server. I know that the "post_proxy_authorize" is history in version 2.1.8. Could anybody tell me how to assign a static ip address after we get a access-accept ? I have read the example for the ippool, but I can't see how to assign static ip adress will work with ippol. This is the 1.1.8 config : proxy.conf : post_proxy_authorize = yes users : username(a)domain.com NAS-IP-Address == 10.0.0.1, Service-Type == Framed-User, User-Name := "username(a)domain.com" Framed-Protocol = PPP, Framed-IP-Address = 192.168.1.100, Framed-IP-Netmask = 255.255.255.255, Framed-MTU = 1392 -- Med vennlig hilsen / Regards; Roar Pettersen Universitetet i Bergen - The University of Bergen Nygardsgt. 5 - N-5020 BERGEN - Norway

2 1

Proxy and copy-acct-to-home-server
by Etienne Pretorius 12 Mar '10

12 Mar '10

Hello List, I am redoing our radius setup into FreeRadius 2.0.4 and I need some advise. Lets say I have 3 FreeRadius servers (A,B,C) and I would like to sync the accounting packet between them. On server A, I created copy-acct-to-home-server for B and C; On server B, I created copy-acct-to-home-server for A and C; On server C, I created copy-acct-to-home-server for A and B; Now in proxy.conf.... i need to define home_servers: On server A, created home_server B and home_server C (type=acct); On server B, created home_server A and home_server C (type=acct); On server C, created home_server A and home_server B (type=acct); But now on server_pool I seem to have an issue, I desire that A only sends copies to B and C - while B and C do not send those packets back to A or to each other respectively. Like wise with the other two servers ( ie when one of the servers I administer proxies a packet, the receiver should not proxy it any further ). How would I define this? Would I need one home_server_pool with both home_servers defined, but defined with what "type="? Mind if I use multiple pools then I need both in each of my realm statements... is that even allowed. Sorry for the vagueness... any assistance would be great Kind Regards, Etienne

2 12

MS-CHAP2-Response is incorrect
by omega bk 12 Mar '10

12 Mar '10

hello, just one question. (if you have time :-) ) my client is a windows xp wired 802.1x (native supplicant) i got user called bernard in opnldap database trying to authenticate my user through freeradius. i got this : ( my debug output il too large so i just put the error section) [ldap] performing user authorization for bernard [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> bernard [ldap] expand: (cn=%{Stripped-User-Name:-%{User-Name}}) -> (cn=bernard) [ldap] expand: dc=example,dc=com -> dc=example,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=example,dc=com, with filter (cn=bernard) [ldap] Added User-Password = test in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Cleartext-Password == "test " [ldap] looking for reply items in directory... [ldap] user bernard authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop *Found Auth-Type = EAP* +- entering group authenticate {...} *[eap] Request found, released from the list* *[eap] EAP/mschapv2 [eap] processing type mschapv2* *[mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for bernard with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect **=> what does it mean ? ++[mschap] returns reject* [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. thank u so much.

1 0