- Freeradius-Users - lists.freeradius.org

Re: Authentication with mschap
by Eric Bourkland 17 Aug '09

17 Aug '09

It looks like I might have figured it out, I had commented out the line I had added that I actually needed. I wasn't telling Radius where to look in LDAP for the password field. I can get my windows XP laptops to connect without a problem, still having a bit of a problem with the Mac laptops since they have a few more options available to them, it is trying to do authentication other than PEAP/MSChapv2. Looks like EAP which won't work with the clear-text password. So just need to figure out how to set their request up properly. Is there a way for freeRadius to check both? for instance windows machines use the MSCHAPv2 and then Mac machines use pap or something else? I would think that this would work without a problem but need to configrm. Is it smart enough to know that if the request comes in from a Mac or someone with SecureW2 that it can do PAP and from Windows the request to use MSCHAPv2, it looks like it goes through every possible configuration and checks anyway. Thanks, ----- Original Message ----- From: "Alan DeKok" <aland(a)deployingradius.com> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 17, 2009 9:17:46 AM GMT -05:00 US/Canada Eastern Subject: Re: Authentication with mschap Eric Bourkland wrote: > No Cleartext-Password configured. Cannot create LM-Password > No Cleartext-Password configured. Cannot create NT-Password > Told to do MS-CHAPv2 for test.user with NT-Password > FAILED: No NT/LM-Password. Cannot perform authentication. > FAILED: MS-CHAP2-Response is incorrect. Which is what you posted before. This doesn't help. > what it looks like to me is that Radius isn't getting the Cleartext-Password from the laptop client, I don't know if this the case or not. the laptop client is Window's XP pro build and some Vista, and whatever else a guest may bring in. I assumed that it would pass the password in the Cleartext-Password attribute when using the MS-CHAPv2, I need to confrim this. I can get it to work if I install SecureW2 but I've been told that asking everyone to install it on the laptops isn't an option. > This protocol is relatively new to me at least how all the various pieces of software handle it. > I know I'm close I just need help being pointed in the right direction on where the disconnect is occuring. right now I am pretty certain it is not between Radius and my openLDAP. The issue is that the NT password is NOT being read from LDAP, and is NOT being given to FreeRADIUS. Read the REST of the debug output to see why. Or failing that, post the debug output here, as suggested in the FAQ, README, INSTALL, "man" page, and nearly daily on this list. Posting the last 2-3 lines of "authentication failed" is nearly useless. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

NAS IPs
by Irina 17 Aug '09

17 Aug '09

Hello, I need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina ===========================

2 1

NAS IPs
by Irina 17 Aug '09

17 Aug '09

Hello, We need to allow a block of 8 IP addresses in 'nasname' column in NAS table. Can I use xx.xx.xx.112/29 Thank you for your help in advance Kindest Regards, Irina ===========================

1 0

Problem authenticating cleartext-passwords locally and proxy realms
by mikoi 17 Aug '09

17 Aug '09

Hello. I want freeradius to authenticate users with Cleartext-Password locally and proxy others with realms. I use SQL for users, groups, nas and huntgroups. The problem: When logging in with the user with Cleartext-Password all passwords are accepted. The proxied users need the correct password. What am i missing? Please help. My set up consists of: AAA Client -> Freeradius 2.1.6 with MySQL -> RADIUS-server ##sites-enabled/default authorize section # SQL query huntgroups update request { Huntgroup-Name := "%{sql:select groupname from radhuntgroup where nasipaddress=\"%{NAS-IP-Address}\"}" } # # # SQL query Proxy-To-Realm # update control { Proxy-To-Realm := "%{sql:select authserver from authmethod where username =\"%{User-Name}\"}" } radhuntgroup table: mysql> select * from radhuntgroup; +----+-------------+--------------+-----------+ | id | groupname | nasipaddress | nasportid | +----+-------------+--------------+-----------+ | 4 | VPN-service | x.x.x.x | NULL | radgroupcheck table: mysql> select * from radgroupcheck; +----+-----------+----------------+----+-------------+ | id | groupname | attribute | op | value | +----+-----------+----------------+----+-------------+ | 8 | VPN-AUTH | Huntgroup-Name | == | VPN-Service | | 9 | VPN-AUTH | Auth-Type | := | Accept | usergroup table; mysql> select * from usergroup; +--------------+-----------+----------+ | UserName | GroupName | priority | +--------------+-----------+----------+ | testuser | VPN-AUTH | 0 | | safewordtest | VPN-AUTH | 0 | +--------------+-----------+----------+ users-file # On no match, the user is denied access. DEFAULT Auth-Type := Reject Users are defined in radcheck. testuser is to be authenticated locally safewordtest is to be proxied (table authmethod). mysql> select * from radcheck; +----+--------------+--------------------+----+----------+ | id | username | attribute | op | value | +----+--------------+--------------------+----+----------+ | 33 | testuser | Cleartext-Password | := | testuser | | 39 | safewordtest | Cleartext-Password | := | testttsd | +----+--------------+--------------------+----+----------+ mysql> select * from authmethod; +--------------+------------+----------+ | username | authserver | priority | +--------------+------------+----------+ | safewordtest | Safeword | 1 | +--------------+------------+----------+ Debug: Incorrect username/password. rad_recv: Access-Request packet from host x.x.x.x port 1812, id=38, length=70 User-Name = "testuser" User-Password = "wrongpasswordibelieve" NAS-IP-Address = x.x.x.x +- entering group authorize {...} ++[preprocess] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}" -> select groupname from radhuntgroup where nasipaddress="x.x.x.x" rlm_sql (sql): Reserving sql socket id: 3 sql_xlat finished rlm_sql (sql): Released sql socket id: 3 expand: %{sql:select groupname from radhuntgroup where nasipaddress="%{NAS-IP-Address}"} -> VPN-Service ++[request] returns ok sql_xlat expand: %{User-Name} -> testuser sql_set_user escaped user --> 'testuser' expand: select authserver from authmethod where username ="%{User-Name}" -> select authserver from authmethod where username ="testuser" rlm_sql (sql): Reserving sql socket id: 2 SQL query did not return any results rlm_sql (sql): Released sql socket id: 2 expand: %{sql:select authserver from authmethod where username ="%{User-Name}"} -> ++[control] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 204 ++[files] returns ok [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' rlm_sql (sql): Reserving sql socket id: 1 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'testuser' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'testuser' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'testuser' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'VPN-AUTH' ORDER BY id [sql] User found in group VPN-AUTH [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'VPN-AUTH' ORDER BY id rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop WARNING: You set Proxy-To-Realm = , but the realm does not exist! Cancelling invalid proxy request. Found Auth-Type = Accept Auth-Type = Accept, accepting the user +- entering group post-auth {...} [sql] expand: %{User-Name} -> testuser [sql] sql_set_user escaped user --> 'testuser' [sql] expand: %{User-Password} -> wrongpasswordibelieve [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'wrongpasswordibelieve', 'Access-Accept', '2009-08-13 21:01:08') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'testuser', 'wrongpasswordibelieve', 'Access-Accept', '2009-08-13 21:01:08') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 38 to x.x.x.x port 1812 Class := 0x6f753d7672663337302c6f753d72657472726565 Finished request 0. -- View this message in context: http://www.nabble.com/Problem-authenticating-cleartext-passwords-locally-an… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

Authentication with mschap
by Eric Bourkland 17 Aug '09

17 Aug '09

Need some help pointing me in the right direction. I think I know what the problem is but I don't know where to look. I think the problem is my freeRadius server and openLDAP server are not talking perfectly. I am trying to do MS-chapv2 authentication so that windows machines can connect to out access point without having to install additional software. One of the glaring things that jumps out at me is that in the logs/debugging it says message-Authenticator = 0x000000... It looks like it is trying the correct authentication ... Told to do MS-CHAPv2 for test.user with NT-Password FAILED: No NT/LM-Password. Cannot perform authentication. FAILED: MS-CHAP2-Response is incorrect. ... and then error message peap got tunnel reply code3 MS-CHAP-Error = "\007E=691 R=1" Okay that message is pretty clear to me, but I do have an NT-Password in sambaNTPassword and is populate/stored in NT hash format and there is a maping in ldap.attrmap checkItem NT-Password sambaNtPassword I haven't done anything funky with the config files like setting Authe-Type = to anything I've read enough that it is a big no no. The only thing I've done is uncomment a few things so that it will use ldap. And everything works when I use radtest so I know my connection to my ldap server is okay but radtest is using a different protocol as I've been learning through this whole experience. If anyone can point me in the right direction I would greatly appreciate it. Thanks,

2 4

Sending DHCP message when DHCP-Message-Type = 0
by Sergey Korobkov 17 Aug '09

17 Aug '09

Using version from GIT. When DHCP-Message-Type = 0 the server must not sending reply. But in this code set DHCP-Message-Type value from 0 to 1024 and reply sending to client. src/main/dhcpd.c ... vp = pairfind(request->reply->vps, DHCP2ATTR(53)); /* DHCP-Message-Type */ if (vp) { request->reply->code = vp->vp_integer; if (request->reply->code < PW_DHCP_OFFSET) { request->reply->code += PW_DHCP_OFFSET; } } ... I think it must be something like this: if (vp) { request->reply->code = vp->vp_integer; if ((request->reply->code < PW_DHCP_OFFSET) && (request->reply->code != 0)) { request->reply->code += PW_DHCP_OFFSET; } }

2 1

Escaping things
by Stun Box 17 Aug '09

17 Aug '09

Hello everybody, I'm doing some tests with wpa_supplicant(freebsd) + aironet 1252 + freeradius2.1.6 (freebsd portage). And I have a mystery I can not explain. I test 2 user with a domain. This is my configuration files for wpa_supplicant. They have just their first user letter mismatching. USER_TEST ========== network={ ssid="test_wifi" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="DOMAIN\test" password="test" } USER_NEST ========== network={ ssid="test_wifi" scan_ssid=1 key_mgmt=WPA-EAP eap=PEAP identity="DOMAIN\nest" password="test" } And this is the access and accounting request for both of them : USER_TEST ACCESS-REQ ===================== rad_recv: Access-Request packet from host 192.168.9.30 port 1645, id=232, length=231 User-Name = "DOMAIN\\test" Framed-MTU = 1400 ... USER_TEST ACCOUNT-REQ ====================== rad_recv: Accounting-Request packet from host 192.168.9.30 port 1646, id=144, length=229 Acct-Session-Id = "000002F0" Called-Station-Id = "00-24-97-B6-86-40" Calling-Station-Id = "00-19-5B-35-D0-96" Cisco-AVPair = "ssid=test_wifi" Cisco-AVPair = "vlan-id=568" Cisco-AVPair = "nas-location=unspecified" User-Name = "DOMAIN\\test" ... USER_NEST ACCESS-REQ ===================== rad_recv: Access-Request packet from host 192.168.9.30 port 1645, id=222, length=231 User-Name = "DOMAIN\\nest" Framed-MTU = 1400 ... USER_NEST ACCOUNT-REQ ====================== rad_recv: Accounting-Request packet from host 192.168.9.30 port 1646, id=146, length=233 Acct-Session-Id = "000002F2" Called-Station-Id = "00-24-97-B6-86-40" Calling-Station-Id = "00-19-5B-35-D0-96" Cisco-AVPair = "ssid=test_wifi" Cisco-AVPair = "vlan-id=14" Cisco-AVPair = "nas-location=unspecified" User-Name = "DOMAIN\nest" ... The mystery is why there is two backslash for each "User-Name" excepted in the accounting request ? (I ask, because it does the mess in my sql base for accounting). Thanks for reading, G.

2 6

weird rlm_radutmp errors .. radiusd process sleeping
by ramesh p 17 Aug '09

17 Aug '09

Hi All, getting the following errors in the radius log: Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1239, but no Login record Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 712, but no Login record Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 659, but no Login record Mon Aug 17 05:45:38 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 3783, but no Login record Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1964, but no Login record Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2438, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 3183, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2423, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1491, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 3822, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2381, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1842, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 1064, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 214, but no Login record Mon Aug 17 05:45:39 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:39 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas xx.xx.xx.xx] Mon Aug 17 05:45:40 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2489, but no Login record Mon Aug 17 05:45:40 2009 : Error: rlm_sql (sql) in sql_accounting: stop packet with zero session length. [user '', nas xx.xx.xx.xx] Mon Aug 17 05:45:40 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2113, but no Login record Mon Aug 17 05:45:40 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:40 2009 : Error: rlm_radutmp: Logout for NAS Default NAS Entry port 2887, but no Login record Mon Aug 17 05:45:40 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Mon Aug 17 05:45:40 2009 : Info: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Radius server is flooded with the above message and after some time radiusd process sleeping. mysql db not logging records at all. What's the remedial action? Is there any problem in NAS? Please help. Thanks, Rams.

1 0

Re: String Validation
by Neville 16 Aug '09

16 Aug '09

>> If a connection that comes in with a GROUP NAME from SQL of "USUK-XX" >> or "WUK-XX" and I want to strip of the "-XX", how would I do this with >> ulang so I only validate the following? > > Using the regexp feature, you can match part of an attribute then > reference it later, like so: > if (SQL-GROUP =~ /(.*)-XX/) { > update request { > SQL-GROUP := "%{1}" > } > } > > --Mike Thx Mike, Sorry, I don't think my example help as XX could be ANYTHING. E.g. USUK-5GB ; USUK-1GB ; USUK-10GB, so looking to STRIP everying after the "-" and including the "-" to the end of the string. The reason for doing this as I only want to validate against the first part of the String, otherwise the Nested IF Statment will be Huge. If your able, would appreciate if you can update the IF statement below to reflect what I'm trying to do. if(SQL-GROUP == "USUK") { ok } elsif(NAS-IP-Address == AAA.BBB.CCC.DDD && SQL-GROUP == "WUK") { ok } else { reject } Thx in advance Nev

2 1

String Validation
by Neville 16 Aug '09

16 Aug '09

Hi, If a connection that comes in with a GROUP NAME from SQL of "USUK-XX" or "WUK-XX" and I want to strip of the "-XX", how would I do this with ulang so I only validate the following? if(SQL-GROUP == "USUK") { ok } elsif(NAS-IP-Address == AAA.BBB.CCC.DDD && SQL-GROUP == "WUK") { ok } else { reject } Thx in advance Nev

2 1