- Freeradius-Users - lists.freeradius.org

Checkval
by Vik21 04 Jun '09

04 Jun '09

Hello! I am trying to put checkval to work with radgroupcheck however without success. My problem is that in the radcheck if Calling-Station-Id is not met he rejects the user (just like I want it to do) but in the radgroupcheck if the Calling-Station-Id is not met freeradius send an Access-Accept anyway (I want it to reject). My checkval: checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } Part of my radius log: rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 00-21-00-33-B1-88 rlm_checkval: Could not find attribute named Calling-Station-Id in check pairs ++[checkval] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} expand: %{User-Name} -> vitor33 [sql] sql_set_user escaped user --> 'vitor33' expand: %{User-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 0 rlm_sql_postgresql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "vitor33" [ttls] Got tunneled Access-Accept [eap] Freeing handler rlm_eap_ttls: Freeing handler for user vitor33 ++[eap] returns ok +- entering group post-auth {...} expand: %{User-Name} -> vitor33 [sql] sql_set_user escaped user --> 'vitor33' expand: %{User-Password} -> expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{User-Name}', '%{%{User-Password}:-Chap-Password}', '%{reply:Packet-Type}', NOW()) -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) expand: /var/log/freeradius/sqltrace.sql -> /var/log/freeradius/sqltrace.sql rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 4 rlm_sql_postgresql: query: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('vitor33', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql_postgresql: Status: PGRES_COMMAND_OK rlm_sql_postgresql: query affected rows = 1 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 19 to 192.168.100.2 port 32773 MS-MPPE-Recv-Key = 0x5b81c8ead986cb6408398bc0a2e3bef7457500dd6b8504be9d63a097679ee0d8 MS-MPPE-Send-Key = 0x4da2d778e0ffa8bddaf4e989a5b34e69e29266ff830134df8c2f03ca8d21bbe7 EAP-Message = 0x03070004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "vitor33" Finished request 7. My radgroupcheck table: 4;"testgroup";"Simultaneous-Use";":=";"1" 7;"testgroup";"Calling-Station-Id";"==";"00-00-00-00-00-11" My radusergroup table: "admin";"testgroup";0 "vitor33";"testgroup";0 Can anyone help me ? Thanks in advance. edit: If I add the line "Auth-Type := Reject" for the same group in radgroupcheck, freeradius keep send Access-Acept when he should send Access-Reject, right ? -- View this message in context: http://www.nabble.com/Checkval-tp23867006p23867006.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

WiMAX Proxy Authentication with PMIP
by Kiran Kumar 04 Jun '09

04 Jun '09

Hi All, I am trying to test proxy Authentication (Auth Request proxied from Home AAA to Free Radius). Only the authentication is done at the Freeradius and the authorization of the user is done at the H-AAA and in this case I am using PMIP for the Subscriber. My question here is should the HA-RK-Key, HA-RK-SPI, MN-HA-MIP4-Key, MN-HA-MIP4-SPI be sent from the Freeradius, is so how can I include these attributes in Access-Accept? And if I send these values will the Freeradius be able to process and accept the 2nd Access-Request that comes from HA. Currently I am sending these values from the H-AAA, but when the HA Radius Access-Request is proxied to free radius it fails. And I suspect the reason is because I am generating the keys at H-AAA and not at Freeradius. Thanks and Regards, Kiran Kumar.B WiMAX Test Engineer

1 0

help HMAC-MD5
by Marco De Magistris 04 Jun '09

04 Jun '09

Hi all, Sorry, but I'm confused about HMAC-MD5 method. I'm working on Radius Proxy Implementation. The scenario is the following RADIUS Client -> Radius Proxy -> Radius Server. Radius Client sends a Radius Packet towards Radius Proxy (Message-Authenticator not used). Radius Proxy sends the Radius Packet towards Radius Server using HMAC-MD5 method. How to configure RADIUS Proxy? Should I add MD5-Password Attribute? MD5-Password is identical to Shared Secret between Radius Proxy and Radius Server? Thanks in advance Marco

3 2

ntlm_auth, universal principal name, multi-domain active directory, howto?
by freeradius＠tarac.net 04 Jun '09

04 Jun '09

New to freeradius & samba - and first post here. Rather long post so to cut to the heart of the question: Can freeradius be configured to authenticate users against an AD Forest (multi-domain) using universal principal name (UPN) and if so...how? I'm posting here because our only need for samba is freeradius integration to AD - but if I need to go to the Samba community just let me know. The ultimate goal is to have the majority of remote access users authenticate using their universal principal names (UPN) from AD. The path of that authentication however is not direct. RA Appliance --> Freeradius (Proxy) --> Freeradius --> AD There are some instances where we need users to authenticate from a repository other than AD, so Freeradius has been configured against both MySQL (primarily to hold NAS information & accounting info, but could potentially host users) and Openldap. The MySql & Openldap configs are working just fine. We don't really care if we use Samba - integration via LDAP would be fine, but it appears that their is an issue with sending the password in the clear if LDAP is used. If this is inaccurate please let me know. Everything "appears" configured correctly. In fact authentication using the "exec ntlm_auth" configuration referenced in http://deployingradius.com/documents/configuration/active_directory.html works if the username and domain are specified. Once we tried to use the UPN (without domain name) it does not. Going back to the command line for ntlm_auth tests resulted in the following. Using a user account found in DEPT1.COMPANY.NET child domain ntlm_auth --username=user WORKS ntlm_auth --username=user --domain=DEPT1 WORKS ntlm_auth --username=user(a)company.net DOES NOT WORK Using a user account found in DEPT2.COMPANY.NET child domain ntlm_auth --username=user DOES NOT WORK ntlm_auth --username=user --domain=DEPT2 WORKS ntlm_auth --username=user(a)company.net DOES NOT WORK All of the DOES NOT WORK result in the same error. NT_STATUS_NO_SUCH_USER: No such user (0xc0000064) tcpdumps of the ntlm_auth traffic validate that all requests are being sent to one of the domain controllers within DEPT1.COMPANY.NET The internal freeradius host is in the child domain DEPT1.COMPANY.NET based on policy. If moving the server to COMPANY.NET is required that could be considered, however preference is to leave it in DEPT1.COMPANY.NET. Linux Host RHEL 5.2 Freeradius 2.1.6 Samba 3.3.4 Active Directory Multi-Domain Model Native Mode Win2003 Root Domain - company.net Child Domain - dept1.company.net Child Domain - dept2.company.net .. Child Domain - dept9.company.net For the sake of testing we are currently only configured for the root, child domains dept1 and dept2. We do not have admin_server entries because all of the examples reference port 749 which is not running on any of the domain controllers or global catalogs. I am including sanitized copies of the krb5.conf and smb.conf because they seem pertinent to the question. If any of the freeradius config files, nsswitch or some other information is needed just let me know. Thanks Adam krb5.conf --------------------------------- [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = DEPT1.COMPANY.NET dns_lookup_realm = true dns_lookup_kdc = true ticket_lifetime = 24h forwardable = yes [realms] COMPANY.NET = { kdc = gc01.company.net:88 kdc = gc02.company.net:88 kdc = gc03.company.net:88 } DEPT1.COMPANY.NET = { kdc = dept1-dc01.dept1.company.net:88 kdc = dept1-dc02.dept1.company.net:88 kdc = dept1-dc03.dept1.company.net:88 } DEPT2.COMPANY.NET = { kdc = dept2-dc01.dept2.company.net:88 kdc = dept2-dc02.dept2.company.net:88 kdc = dept3-gc01.dept2.company.net:88 } [domain_realm] .company.net = COMPANY.NET .dept1.company.net = DEPT1.COMPANY.NET .dept2.company.net = DEPT2.COMPANY.NET [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } smb.conf -------------------------------------- [global] workgroup = DEPT1 netbios name = AAA-Server realm = DEPT1.COMPANY.NET security = ADS template shell = /bin/bash idmap uid = 500-10000000 idmap gid = 500-10000000 winbind nested groups = Yes winbind enum users = yes winbind enum groups = yes server string = AAA [homes] comment = Home Directories browseable = no writable = yes

3 2

chap or pap
by jon jon 04 Jun '09

04 Jun '09

Hi, I have pap authentication working just fine. I want to change auth type to chap. I am using the radius book that is very outdated. Don't really understand why can't chap to work. I looked in the default file and chap auth-type is not commented out, so I am assuming that if pap authentication didn't work then chap would be the next auth type radius would try right. that is why they put pap at the bottom of the file to let the other auth types a try first. I am using mysql backend server with username and cleartext := passwords. Can anyone point me the right direction or tell me to read more:P jon

2 1

Re-compiling modules
by Rupert Finnigan 04 Jun '09

04 Jun '09

Hi All, I'm *attempting* to recompile the rlm_mschap module with a quick mod to hopefully fix my host authentication domain extraction problems. Is this as simple as running make, and copying the resulting files to "/usr/lib" (on my system atleast)?? And if so, is it just the two files I need to copy, the .la and the .so? If this eventually works I'll rebuild my rpms, but I'm looking for a quick way of finding out if this does actually behave as expected. Sorry if this is a bit of an obvious question - I've never really done much C before. Many Thanks, Rupert

2 1

ippools and Pool-Name
by up＠3.am 03 Jun '09

03 Jun '09

Hi: I am trying to configure a server-side IP pool for select pptp users to bypass the NAS's internal pool. The documentation appears sparse, but this is what I've done so far: In raddb/radiusd.conf: ippool users_pool { range-start = 172.16.1.2 range-stop = 172.16.1.253 netmask = 255.255.255.0 cache-size = 251 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = yes } In raddb/users sometestuser Pool-Name :="users_pool" Framed-Protocol == PPP, Framed-Compression = Van-Jacobson-TCP-IP However, "sometestuser" is simply allocated an IP from the NAS's internal pool, seemingly ignoring this. I also noticed that the files db.ippool and db.ipindex are not being created. Is there something else I'm missing? TIA, James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 5

checkval module
by Amr el-Saeed 03 Jun '09

03 Jun '09

2 2

Hiding passwords
by John Doppke 03 Jun '09

03 Jun '09

Is there a way to tell freeradius not to include passwords in the log when debugging? -John

2 1

"detail" log files
by Steve Bertrand 03 Jun '09

03 Jun '09

Hi everyone, Can someone swing the clue bat at me, and provide me with information on where I should look to find out how to disable detail log files for specific NASs only? I need to keep the detail files for legacy purposes, but only for specific NASs, and I'd like to disable the rest of them from logging there. Is this possible? Steve

2 2