- Freeradius-Users - lists.freeradius.org

[How To] Freeradius 2.14 (PEAP – MSCHAP)
by LEOSI 11 Mar '09

11 Mar '09

For thoses, who are interested by setting up PEAP/MSHCAP under Freeradius 2.14, I wrote a simple how-to. I hope it could help someone. :) INSTALLATION PROCESS: FREERADIUS 2.14 (PEAP – MSCHAP) === OS : === - Ubuntu Server 8.10 ====== SWITCH: ====== - HP 2600 ========== Pre-requires : ========== - Samba installed (or sudo apt-get install samba smbfs) - Kerberos installed (or sudo apt-get install krb5-clients krb5-user) ============== Table of contents : ============== *Setting Procurve HP Switch *Installation of OpenSSL 0.9.8j *Installation of Freeradius 2.14 *Integrate the radius server to the domain *Testing to join the AD domain *Authenticate with NTLM using EAP – PEAP *Configuring Freeradius *Testing authentication process *Starting freeradius into background mode ===================== Setting Procurve HP Switch: ===================== ; J4900B Configuration Editor; Created on release #H.10.67 hostname "SWiTCH" no web-management web-management ssl no telnet-server ip ssh interface 1 no lacp ; see [1] at the bottom of the page exit [...] interface 26 no lacp exit vlan 1 name "XXXX" untagged 1-26 exit vlan 2 name "YYYYY" ip address 192.168.2.1 255.255.255.0 ip helper-address 192.168.0.2 exit aaa authentication port-access eap-radius radius-server key testing123 radius-server timeout 1 radius-server dead-time 1 radius-server host 172.28.32.16 aaa port-access authenticator 17-24 aaa port-access authenticator 17 auth-vid 2 aaa port-access authenticator 17 unauth-vid 3 [...] aaa port-access authenticator 24 auth-vid 2 aaa port-access authenticator 24 unauth-vid 3 aaa port-access authenticator active aaa port-access 17-24 ip routing gvrp ======================= Installation of OpenSSL 0.9.8j: ======================= $ wget http://www.openssl.org/source/openssl-0.9.8j.tar.gz $ tar xzf openssl-0.9.8j.tar.gz $ cd openssl-0.9.8j $ ./config --prefix=/usr/local/openssl shared $ make $ sudo make install ====================== Installation of Freeradius 2.14: ====================== $ wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.3.tar.gz $ tar xzf freeradius-server-2.1.3.tar.gz $ cd freeradius-server-2.1.3 $ ./configure --with-openssl --with-openssl-includes=/usr/local/openssl/include/ --with-openssl-libraries=/usr/local/openssl/lib/ $ make $ sudo make install PS: If needed, do a “sudo ldconfig”, and in case of error consult the file “config.log”. ==================== Configuration of Freeradius: ==================== The main configurations files are : - clients.conf (declaration of switchs and shared secrets) - radiusd.conf (listening ports) - users (create a local base of users, or select the method used for authenticate/authorization) - eap.conf (select the encoding method) * File /usr/local/etc/raddb/clients.conf : Declare your switch like that: client 192.168.1.1 { secret = testing123 } * File /usr/local/etc/raddb/users : Into the bottom of the file, just add (for purpose only) : DEFAULT Auth-Type = MS-CHAP * File /usr/local/etc/raddb/eap.conf : eap { default_eap_type = peap … } peap { default_eap_type = mschapv2 … } =============================== Integrate the radius server to the domain: =============================== * File /etc/samba/smb.conf : [global] # network name workgroup = DOMAINTEST # AD domain name (you have to create that, doesn’t exist into the config file) realm = DOMAINTEST.LOCAL # server’s name server string = Freeradius # security mode security = ADS * File /etc/krb5.conf : [libdefaults] default_realm = DOMAINTEST.LOCAL [realms] DOMAINTEST.LOCAL = { kdc = activedirectory.domaintest.local admin_server = IP_of_AD_Server default_domain = DOMAINTEST.LOCAL } [domain_realm] domaintest.local = DOMAINTEST.LOCAL * File /etc/resolv.conf : nameserver IP_of_AD_Server domain DOMAINTEST.LOCAL search DOMAINTEST.LOCAL * File /etc/nsswitch.conf : passwd: files winbind group: files winbind ====================== Testing to join the AD domain: ====================== $ sudo net ads join –U administrateur If it’s good, you will have : Joigned ‘FREERADIUS’ to realm ‘test.fr’ PS : If needed, you may syncronize time between the server running Freeradius and AD server. $ sudo ntpdate IP_of_AD_Server Authenticate with NTLM using EAP – PEAP: ============= Testing purpose : ============= $ sudo ntlm_auth --request-nt-key --domain=DOMAINTEST.LOCAL --username=existing_user password : ****** If all things are good, you must have : The command line returns NT_STATUS_OK : Success (0x0) ====================================== Configuring Freeradius to use NTLM authentication: ====================================== * File /usr/local/etc/raddb/modules/mschap : Uncomment the last line, and modify it like that: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-DOMAINTEST} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" ======================= Testing authentication process: ======================= Into a terminal do a: $ sudo radiusd –X –xx And into an another terminal: $ sudo radtest user password localhost 0 testing123 You will receive (if everything goes well): rad_recv : Access-Accept =============================== Starting freeradius into background mode: =============================== Just put this line into the /etc/rc.local file : /usr/local/sbin/rc.radiusd start [1] Link Aggregation Control Protocol (LACP) is part of an IEEE specification (802.3ad) that allows you to bundle several physical ports together to form a single logical channel. LACP allows a switch to negotiate an automatic bundle by sending LACP packets to the peer. -- View this message in context: http://www.nabble.com/-How-To--Freeradius-2.14-%28PEAP-%E2%80%93-MSCHAP%29-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 7

dictionary.rfc4818 not included by default
by Bjørn Mork 11 Mar '09

11 Mar '09

Hello, I wonder if there's any particular reason why dictionary.rfc4818 isn't included in the default dictionary? I just stumbled across this while trying to use FreeRADIUS provide a DHCPv6 server with the prefix to be delegated. The same seems to be the case for rfc4849 and rfc5090: bjorn@canardo:/usr/local/src/git/freeradius$ grep rfc share/dictionary $INCLUDE dictionary.rfc2865 $INCLUDE dictionary.rfc2866 $INCLUDE dictionary.rfc2867 $INCLUDE dictionary.rfc2868 $INCLUDE dictionary.rfc2869 $INCLUDE dictionary.rfc3162 $INCLUDE dictionary.rfc3576 $INCLUDE dictionary.rfc3580 $INCLUDE dictionary.rfc4072 $INCLUDE dictionary.rfc4372 $INCLUDE dictionary.rfc4675 $INCLUDE dictionary.rfc4679 $INCLUDE dictionary.rfc5176 bjorn@canardo:/usr/local/src/git/freeradius$ ls -l share/dictionary.rfc* -rw-r--r-- 2 bjorn src 4109 2008-09-05 15:55 share/dictionary.rfc2865 -rw-r--r-- 2 bjorn src 1891 2008-09-05 15:55 share/dictionary.rfc2866 -rw-r--r-- 2 bjorn src 461 2008-09-05 15:55 share/dictionary.rfc2867 -rw-r--r-- 2 bjorn src 1607 2008-09-05 15:55 share/dictionary.rfc2868 -rw-r--r-- 2 bjorn src 1117 2008-09-05 15:55 share/dictionary.rfc2869 -rw-r--r-- 2 bjorn src 358 2008-09-05 15:55 share/dictionary.rfc3162 -rw-r--r-- 2 bjorn src 928 2008-09-05 15:55 share/dictionary.rfc3576 -rw-r--r-- 2 bjorn src 408 2008-09-05 15:55 share/dictionary.rfc3580 -rw-r--r-- 2 bjorn src 145 2008-09-05 15:55 share/dictionary.rfc4072 -rw-r--r-- 2 bjorn src 154 2008-09-05 15:55 share/dictionary.rfc4372 -rw-r--r-- 2 bjorn src 672 2008-09-05 15:55 share/dictionary.rfc4675 -rw-r--r-- 2 bjorn src 1922 2008-09-05 15:55 share/dictionary.rfc4679 -rw-r--r-- 2 bjorn src 319 2008-09-05 15:55 share/dictionary.rfc4818 -rw-r--r-- 2 bjorn src 150 2008-09-05 15:55 share/dictionary.rfc4849 -rw-r--r-- 2 bjorn src 886 2008-09-05 15:55 share/dictionary.rfc5090 -rw-r--r-- 2 bjorn src 220 2008-09-05 15:55 share/dictionary.rfc5176 Bjørn

2 1

Multiple LDAP Configurations on a single freeradius daemon
by Nils Cant 11 Mar '09

11 Mar '09

Hi, I'm looking for the best way of configuring freeradius (either version 1.1.3 or version 2.1.1) with two separate LDAP configurations. The reason for this, is we've got two different NAS' (VPN client and WIFI) both querying freeradius with LDAP backend for authentication and authorization, but we want to be able to control access to both services with an ldap "accessTo" attribute: ldap { server = "10.0.0.2" identity = "uid=radiusadmin,ou=system,dc=test,dc=com" password = "radiustest" basedn = "dc=test,dc=com" filter="(&(|(accessTo=WIFI_FR)(accessTo=WIFI_ALL))(uid=%{Stripped-User-Name:-%{User-Name}}))" base_filter = "(objectclass=radiusprofile)" ... Anybody got any suggestions on how to have two ldap configurations (two different filters) and have those assigned to a NAS/Client? Thanks in advance, Nils

2 3

PEAP HowTo
by Alan DeKok 11 Mar '09

11 Mar '09

I've put a mini "PEAP howto" on the Wiki: http://wiki.freeradius.org/PEAP_HowTo It should cover most of the common questions. Alan DeKok.

2 1

radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol
by Peter Param 11 Mar '09

11 Mar '09

This is a new installation using openssl0.98j and freeradius 2.1.3. I get this error when running in debug mode: radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol: SSL_CTX_set_info_callback prior to running in debug mode, I ran ./bootstrap under freeradius/certs directory. The output: radius02:/etc/freeradius/certs# ./bootstrap openssl dhparam -out dh 1024 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ........................................................................................................................................................................................................................+.........................+..............+................+....+.......+................................................+.....................................................................++*++*++* openssl req -new -out server.csr -keyout server.key -config ./server.cnf Generating a 2048 bit RSA private key ..........+++ .......+++ writing new private key to 'server.key' ----- openssl req -new -x509 -keyout ca.key -out ca.pem \ -days `grep default_days ca.cnf | sed 's/.*=//;s/^ *//'` -config ./ca.cnf Generating a 2048 bit RSA private key .......+++ ..................................................................................................................................+++ writing new private key to 'ca.key' ----- openssl ca -batch -keyfile ca.key -cert ca.pem -in server.csr -key `grep output_password ca.cnf | sed 's/.*=//;s/^ *//'` -out server.crt -extensions xpserver_ext -extfile xpextensions -config ./server.cnf Using configuration from ./server.cnf Check that the request matches the signature Signature ok Certificate Details: Serial Number: 1 (0x1) Validity Not Before: Mar 11 04:59:02 2009 GMT Not After : Mar 11 04:59:02 2010 GMT Subject: countryName = FR stateOrProvinceName = Radius organizationName = Example Inc. commonName = Example Server Certificate emailAddress = admin(a)example.com X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication Certificate is to be certified until Mar 11 04:59:02 2010 GMT (365 days) Write out database with 1 new entries Data Base Updated openssl pkcs12 -export -in server.crt -inkey server.key -out server.p12 -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` openssl pkcs12 -in server.p12 -out server.pem -passin pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` -passout pass:`grep output_password server.cnf | sed 's/.*=//;s/^ *//'` MAC verified OK openssl x509 -inform PEM -outform DER -in ca.pem -out ca.der radiusd -X output: FreeRADIUS Version 2.1.3, for host i686-pc-linux-gnu, built on Mar 11 2009 at 14:14:37 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/roles_search including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/patient_search including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/people_search including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/svmhsradius02.stvincents.com.au including configuration file /etc/freeradius/sites-available/default including dictionary file /etc/freeradius/dictionary main { prefix = "/etc" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = no log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client 127.0.0.1 { require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 10.56.13.161 { require_message_authenticator = no secret = "itscadmin" shortname = "svhxvr01acs01" nastype = "cisco" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_expr Module: Instantiating expr } radiusd: #### Loading Virtual Servers #### server virtual.example.com { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.pem" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } radiusd: symbol lookup error: /usr/lib/rlm_eap_tls-2.1.3.so: undefined symbol: SSL_CTX_set_info_callback —-------------------------------------------------------------------------------------------------------------------------- ** other configuration files... eap.conf: # -*- text -*- ## ## eap.conf -- Configuration for EAP types (PEAP, TTLS, etc.) ## ## $Id$ ####################################################################### # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # leap { } # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { auth_type = PAP } ## EAP-TLS # # If OpenSSL was not found at the time the server was # built, the "tls", "ttls", and "peap" sections will # be ignored. # # tls { certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem dh_file = ${certdir}/dh # random_file = ${certdir}/random random_file = /dev/urandom # fragment_size = 1024 # include_length = yes # check_crl = yes # CA_path = /path/to/directory/with/ca_certs/and/crls/ # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # You can make TTLS require a client cert by setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } ################################################## # # !!!!! WARNINGS for Windows compatibility !!!!! # ################################################## # # If you see the server send an Access-Challenge, # and the client never sends another Access-Request, # then # # STOP! # # The server certificate has to have special OID's # in it, or else the Microsoft clients will silently # fail. See the "scripts/xpextensions" file for # details, and the following page: # # http://support.microsoft.com/kb/814394/en-us # # For additional Windows XP SP2 issues, see: # # http://support.microsoft.com/kb/885453/en-us # # Note that we do not necessarily agree with their # explanation... but the fix does appear to work. # ################################################## # You can make PEAP require a client cert by setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no # proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # mschapv2 { } } sites-enabled/default: ###################################################################### # # As of 2.0.0, FreeRADIUS supports virtual hosts using the # "server" section, and configuration directives. # # Virtual hosts should be put into the "sites-available" # directory. Soft links should be created in the "sites-enabled" # directory to these files. This is done in a normal installation. # # $Id$ # ###################################################################### # # Read "man radiusd" before editing this file. See the section # titled DEBUGGING. It outlines a method where you can quickly # obtain the configuration you want, without running into # trouble. See also "man unlang", which documents the format # of this file. # ###################################################################### authorize { preprocess # auth_log chap mschap suffix # ntdomain eap { ok = return } # unix files roles_search people_search patient_search # daily # checkval # expiration # logintime # pap # Autz-Type Status-Server { # # } } # Authentication. # authenticate { # Auth-Type PAP { # pap # } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } # Auth-Type LDAP { # ldap # } eap } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess acct_unique # IPASS suffix # ntdomain files } # # Accounting. Log the accounting data. # accounting { # preprocess detail # daily unix radutmp # sradutmp # main_pool # pgsql-voip # attr_filter.accounting_response # Acct-Type Status-Server { # # } } session { radutmp } # Post-Authentication post-auth { # main_pool # reply_log # sql # sql_log # ldap # exec # Post-Auth-Type REJECT { # attr_filter.access_reject # } } pre-proxy { # attr_rewrite # files # attr_filter.pre-proxy # pre_proxy_log } post-proxy { # post_proxy_log # attr_rewrite # attr_filter.post-proxy # eap # Post-Proxy-Type Fail { # detail # } } cheers Peter ********************************************************************** This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the system manager. This footnote also confirms that this email message has been virus scanned and although no viruses were detected by the system, St Vincents & Mater Health Sydney accepts no liability for any consequential damage resulting from email containing any computer viruses. **********************************************************************

2 1

Samba 3.2
by Casartello, Thomas 11 Mar '09

11 Mar '09

Did anyone ever find out if the samba guys fixed the problem with ntlm_auth returning the NT_KEY that was causing XP's 802.1x client to barf? Thomas E. Casartello, Jr. Staff Assistant - Wireless Technician/Linux Administrator Information Technology Wilson 105A Westfield State College (413) 572-8245 Red Hat Certified Technician (RHCT)

1 0

802.1x Auth Problem - Windows Login case sensitive?
by cn 10 Mar '09

10 Mar '09

Hi List, I have quite a interesting problem. And I don't think it's freeRADIUS-related, but I hope somebody else already had the same issue and can give me a hint. Also a hint where to dig / ask would be very nice... Okay, the setup: I'm using freeRADIUS aus 802.1x/PEAP authenticator for our WLAN-deployment and MS-AD als backend. It's the setup described in: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO And it's working quite well - for all machine accounts and most user accounts. So I assume my freeradius/samba/kerberos config is fine so far... The things I tracked: It seems all accounts migrated from the old NT or Windows2000 Domain are "Case Sensitive": For those accounts the Windows-User has to use exact the same upper/lower case for the user name used in AD's sAMAccountName - otherwise it won't work. For all new created accounts (after the migration) the case dosn't matter. Anybody heard of this or had the same issue? I already googled quite a lot, but I didn't come up with a solution. Just found some reports about similar problems. To the details: In my radius requests, I see following: For all new created accounts the windows login doesn't same to be case-sensitive. Regardless how the user name is written during login, in my radius requests I always see the username in exact the same way then it is stored in the AD. It seems the XP Client is doing some adjustments during auth. For the migrated accounts I see the user accounts in the same case then entered in the windows login - so it seems the client isn't doing these adjustments. And if the account is written in a different way, ntlm_auth is failing. Some parts of the trace for a successful request (sAMAccountName=testuser): rad_recv: Access-Request packet from host 10.1.1.5:32822, id=139, length=286 User-Name = "DOMAIN\\testuser" NAS-IP-Address = 10.1.1.254 NAS-Port = 2 NAS-Identifier = "10.1.1.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00XXXXXXXXX" Called-Station-Id = "000XXXXXXXXX" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = XXXXXXXXXXXXXX State = XXXXXXXXXXXXXX Aruba-Essid-Name = "mySSID" Aruba-Location-Id = "test-ap" Message-Authenticator = XXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: entering group authorize for request 16 modcall[authorize]: module "mschap" returns noop for request 16 rlm_eap: EAP packet type response id 18 length 98 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 16 modcall[authorize]: module "files" returns notfound for request 16 modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = XXXXXXXXXXXXX PEAP: Setting User-Name to DOMAIN\testuser PEAP: Adding old state with 97 88 PEAP: Sending tunneled request EAP-Message = XXXXXXXXXXXXXX FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\testuser" State = XXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: leaving group authorize (returns updated) for request 16 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 16 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 16 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for testuser with NT-Password Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=testuser --challenge=bba9adXXXXXXXXXX --nt-response=565bc73aa70b1fXXXXXXXXXXXX07f081266171807c68d90 Exec-Program output: NT_KEY: 8066616C0E1F32C93158XXXXXXXXX Exec-Program-Wait: plaintext: NT_KEY: 8066616C0E1F32C9315866XXXXXXXXX Exec-Program: returned: 0 rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 16 modcall: leaving group MS-CHAP (returns ok) for request 16 MSCHAP Success modcall[authenticate]: module "eap" returns handled for request 16 The same with different case (failed request): rad_recv: Access-Request packet from host 10.1.1.6:32822, id=110, length=286 User-Name = "DOMAIN\\TESTUSER" NAS-IP-Address = 10.1.1.254 NAS-Port = 1 NAS-Identifier = "10.1.1.5" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "00XXXXXXXX" Called-Station-Id = "000XXXXXXXXX" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = XXXXXXXXXXXXXXX State = 0xXXXXXXXXXXXXXXXXXXX Aruba-Essid-Name = " mySSID" Aruba-Location-Id = "test-ap" Message-Authenticator = 0xXXXXXXXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: entering group authorize for request 329 modcall[authorize]: module "auth_log" returns ok for request 329 modcall[authorize]: module "mschap" returns noop for request 329 rlm_eap: EAP packet type response id 8 length 98 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 329 modcall[authorize]: module "files" returns notfound for request 329 modcall: leaving group authorize (returns updated) for request 329 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 329 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = XXXXXXXXXXXXXXXXXXXXXXXXX PEAP: Setting User-Name to DOMAIN\TESTUSER PEAP: Adding old state with 89 3f PEAP: Sending tunneled request EAP-Message = XXXXXXXXXXXXXXXXXXXXXXXXXXX FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\TESTUSER" State = XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Processing the authorize section of radiusd.conf modcall: entering group authorize for request 329 modcall[authorize]: module "preprocess" returns ok for request 329 modcall[authorize]: module "mschap" returns noop for request 329 rlm_eap: EAP packet type response id 8 length 75 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 329 modcall[authorize]: module "files" returns notfound for request 329 modcall: leaving group authorize (returns updated) for request 329 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 329 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 329 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for TESTUSER with NT-Password Exec-Program: /usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=TESTUSER --challenge=52972ee6749XXXXXXXX --nt-response=13c2b8dd52e6591e0c568a02802fb9450cc91XXXXXXXXXXXXXX Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 329 modcall: leaving group MS-CHAP (returns reject) for request 329 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 329 modcall: leaving group authenticate (returns reject) for request 329 auth: Failed to validate the user. Login incorrect: [DOMAIN\\TESTUSER/<no User-Password attribute>] (from client localhost port 0) If you need more information just ask... I hope somebody can give me a hint where to look or what to do. I also asked my Windows-People (I'm a unix guy...) but all the idea's they had didn't help... Thanks, Chris

2 1

Variables' content as a reply
by Augusto G. Andreollo 10 Mar '09

10 Mar '09

Hello all! I've been trying unsuccessfully to get this setup to work, but unfortunately haven't been able so far. My need is to return the contents of three LDAP fields as replies on the Access-Accept package. The setup is for EAP/TTLS, mostly following eduRoam's setup guide (EduROAM Cookbook -- DJ 5.1.5,3). My config is as follows: on ldap.attrmap: > checkItem cLDAPdepartmentNumber departmentNumber > replyItem rLDAPdepartmentNumber departmentNumber > checkItem cLDAPaffiliation eduPersonPrimaryAffiliation > replyItem rLDAPaffiliation eduPersonPrimaryAffiliation > checkItem cLDAPou ou > replyItem rLDAPou ou on dictionary.university: > VENDOR Unicamp 12345 > > BEGIN-VENDOR Unicamp > ATTRIBUTE University-LDAP-departmentNumber 1 string > ATTRIBUTE University-LDAP-affiliation 2 string > ATTRIBUTE University-LDAP-organizationUnit 3 string > END-VENDOR University (the attributes, at least, are recognized correctly on the reply). on the inner-tunnel configuration file:: > post-auth { > reply_log > Post-Auth-Type REJECT { > reply_log > } > redundant { > sql-server1 > sql-server2 > } > update outer.reply { > User-Name := %{reply:User-Name} > University-LDAP-departmentNumber := %{rLDAPdepartmentNumber} > } radiusd -v is: > radiusd: FreeRADIUS Version 2.1.3, for host i386-portbld-freebsd7.0, built on Jan 9 2009 at 07:02:31 but unfortunately, something does not translate right: From that I've gathered running on radiusd -X, the relevant parts are: - first, an error on rlm_ldap: > ++- entering policy redundant {...} > [ldap1] performing user authorization for user@university > [ldap1] expand: (eduPersonPrincipalName=%{User-Name}) -> (eduPersonPrincipalName=user@university) > [ldap1] expand: dc=university -> dc=university > rlm_ldap: ldap_get_conn: Checking Id: 0 > rlm_ldap: ldap_get_conn: Got Id: 0 > rlm_ldap: attempting LDAP reconnection > rlm_ldap: (re)connect to ldap1.university:389, authentication 0 > rlm_ldap: starting TLS > rlm_ldap: bind as / to ldap1.university:389 > rlm_ldap: waiting for bind result ... > rlm_ldap: Bind was successful > rlm_ldap: performing search in dc=university, with filter (eduPersonPrincipalName=user@university) > [ldap1] checking if remote access for user@university is allowed by dialupAccess > [ldap1] looking for check items in directory... > rlm_ldap: Failed to create the pair: Invalid octet string "cc " for attribute name "cLDAPou" > rlm_ldap: Failed to create the pair: Invalid octet string "staff" for attribute name "cLDAPaffiliation" > rlm_ldap: Failed to create the pair: Invalid octet string "20.5.2.4.0.0.0" for attribute name "cLDAPdepartmentNumber" > rlm_ldap: radiusSimultaneousUse -> Simultaneous-Use == 1 > [ldap1] looking for reply items in directory... > rlm_ldap: Failed to create the pair: Invalid octet string "cc " for attribute name "rLDAPou" > rlm_ldap: Failed to create the pair: Invalid octet string "staff" for attribute name "rLDAPaffiliation" > rlm_ldap: Failed to create the pair: Invalid octet string "20.5.2.4.0.0.0" for attribute name "rLDAPdepartmentNumber" > WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? > [ldap1] Setting Auth-Type = LDAP > [ldap1] user user@university authorized to use remote access > rlm_ldap: ldap_release_conn: Release Id: 0 > +++[ldap1] returns ok - second: the reply's content is not getting translated right. Instead of sending the content's of the variables, it just sends the variable names outright: > Sending Access-Accept of id 235 to xxx.xxx.xxx.xxx port 32783 > User-Name = "%{reply:User-Name}" > University-LDAP-departmentNumber = "%{rLDAPdepartmentNumber}" > MS-MPPE-Recv-Key = blah > MS-MPPE-Send-Key = blah > EAP-Message = 0x03050004 > Message-Authenticator = 0x00000000000000000000000000000000 > Finished request 5. So, the most important question is: how do i reference the content's of the variables on the post-auth update section? Second: what's causing the check and reply items not to get translated? could this be an LDAP error or is there an error on the ldap.attrmap file? By the way, the authentication, authorization, everything is working fine already (including the TTLS/PAP part). Thanks in advance for any thoughts..

2 4

NLTM_AUTH (PAP) and MS-CHAP2 together?
by Mike Diggins 10 Mar '09

10 Mar '09

After getting NTLM_AUTH working using PAP, I decided to try the MS-CHAP2 as well and that appears to work, but I had to remove the line "DEFAULT Auth-Type := ntlm_auth" from my users file. When I do that MS-CHAP2 works, but PAP doesn't. I will have various radius clients, some of which support MS-CHAP2, but some do not. How can I use both together? My users will be connecting to both services, so defining a specific AUTH-TYPE for each user won't work. -Mike

3 6

Next release of freeradius
by Clare Scally 10 Mar '09

10 Mar '09

Hi, Can anyone tell me when the next freeradius release is due? Regards, Clare Scally.

3 2