- Freeradius-Users - lists.freeradius.org

Two factor authentication to both LDAP directory and SecurID
by Greg Vickers 04 Mar '09

04 Mar '09

Hi all, Firstly, this relates to a question asked for our project by Amy Hawke: http://lists.freeradius.org/mailman/htdig/freeradius-users/2009-January/msg… Since the above conversation, I've had an email discussion with Alan DeKok and clarified a few things - it seems that what we want to do is achievable with FreeRADIUS so I'd like to ask the list. Situation: We have an existing LDAP directory which holds username and password information. We purchased RSA's SecurID with the intention of implementing a second factor of authentication to be used in conjunction with our existing username and password. At the time, it was not realised that the intention of SecurID is to replace your existing source of authentication information - which will not be doing! Scenario: To pilot the SecurID product, we selected VPN access to a part of our network, protected by a Cisco ASA5500 series device. We are in the process of moving away from the MS IAS RADIUS solution to FreeRADIUS. We know that MS IAS cannot do what we want to do. What we want to do: When a user attempts to access the VPN, have them provide their username/password as well as (their same) username and tokencode from their SecurID fob. It is OK if they provide the password and tokencode separately or together. (I spoke to the folks at Radiator, and they have a programming ability in their RADIUS server to chop up the password field before it's authenticated, i.e. have the tokencode and password provided in the same field at the client, then take the first eight characters of the 'password' field, send that string plus the username to SecurID via RADIUS, and the rest of the characters from the 'password' field and the username to our LDAP directory.) Ideally we would prompt them for username, password and tokencode at the same time. Can FreeRADIUS do this (it seems that Access-Challenge is exactly what we want: http://en.wikipedia.org/wiki/RADIUS#AAA) or a similar thing to solve our requirement? Thanks, -- Greg Vickers Phone: +61 7 3138 6902 IT Security Engineer & Project Manager Queensland University of Technology, CRICOS No. 00213J

2 6

FR 2.1.3 compile problem
by Chris Howley 03 Mar '09

03 Mar '09

Alan, I encountered the following problem (see below) when attempting to compile the latest version of 2.1.3 (stable code) from the git tree. Your help in fixing this problem would be appreciated. Thanks, Chris Environment: SunOS XXXXXX 5.10 Generic_120012-14 i86pc i386 i86p gcc .libs/radiusdS.o -o .libs/radiusd .libs/acct.o .libs/auth.o .libs/client.o .libs/conffile.o .libs/crypt.o .libs/exec.o .libs/files.o .libs/listen.o .libs/log.o .libs/mainconfig.o .libs/modules.o .libs/modcall.o .libs/radiusd.o .libs/stats.o .libs/session.o .libs/threads.o .libs/util.o .libs/valuepair.o .libs/version.o .libs/xlat.o .libs/event.o .libs/realms.o .libs/evaluate.o .libs/vmps.o .libs/detail.o /sandbox/radiusd/src/lib/.libs/libfreeradius-radius.so -lnsl -lresolv -lsocket -lposix4 -lpthread -lcrypt /usr/local/lib/libltdl.so -lssl -lcrypto -R/usr/local/lib Undefined first referenced symbol in file lt__PROGRAM__LTX_preloaded_symbols .libs/modules.o ld: fatal: Symbol referencing errors. No output written to .libs/radiusd collect2: ld returned 1 exit status gmake[4]: *** [radiusd] Error 1 gmake[4]: Leaving directory `/sandbox/radiusd/src/main' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/sandbox/radiusd/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/sandbox/radiusd/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/sandbox/radiusd' gmake: *** [all] Error 2

3 2

Redundant Oracle instances
by Anders Holm 03 Mar '09

03 Mar '09

Hi folks. I've got FR 2.1.3 running hooked up to an Oracle instance. While testing failure scenarios I'm finding that the module never fails. I'm testing failures where the server has initially been able to connect to the database and then subsequently the database goes away. I'm testing by doing a nasty ifdown on the interface to simulate dropping network connectivity. Hence, this is for disaster type situations where something suddenly severs our connectivity. What I see when running a radtest to localhost is that FR tries the initial SELECT query we have defined and then sits doing nothing until something eventually times out about 18 minutes later and then it proceeds to process whatever else has been sent to it. I'd be curious in knowing how this timeout can be tweaked as 18 minutes is way too long for us, though I've been unable to find any documentation leading me to an answer. Seems this may be somewhere in the Oracle side of things, but I'm really not sure to be honest. I'd also be highly curious to know how one may return an Access-Accept even though we have not been able to actually authenticate the account, seeing as our DB is down which holds all the credentials. It seems the Fail-Over Wiki has a section on if-else branching which may be useful here, as I'd really only want to send Access-Accept when the DB truly has failed. though the wiki states "Documentation will be updated later..." and doesn't go into any details on how this could be achieved. Reason we'd want this "Fail-Open" as we have dubbed it, is that our end customers shouldn't unnecessarily be blocked from using our services. Relevant debug lines (yes, we have tweaked the SQL queries to suit our needs): Tue Mar 3 15:29:22 2009 : Info: [sql] expand: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = '%{SQL-User-Name}' ORDER BY id -> SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test2' ORDER BY id Tue Mar 3 15:29:22 2009 : Debug: SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test2' ORDER BY id ... time passes ... Tue Mar 3 15:46:56 2009 : Error: rlm_sql_oracle: query failed in sql_select_query: ORA-03135: connection lost contact Tue Mar 3 15:46:56 2009 : Error: rlm_sql_oracle: OCI_SERVER_NORMAL Tue Mar 3 15:46:56 2009 : Error: rlm_sql_getvpdata: database query error Tue Mar 3 15:46:56 2009 : Error: [sql] SQL query error; rejecting user Tue Mar 3 15:46:56 2009 : Debug: rlm_sql (sql): Released sql socket id: 3 Tue Mar 3 15:46:56 2009 : Info: +++[sql] returns fail Tue Mar 3 15:46:56 2009 : Info: +++[ok] returns ok Tue Mar 3 15:46:56 2009 : Info: ++- policy redundant returns ok Tue Mar 3 15:46:56 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Mar 3 15:46:56 2009 : Info: ++[pap] returns noop Tue Mar 3 15:46:56 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Mar 3 15:46:56 2009 : Info: Failed to authenticate the user. Tue Mar 3 15:46:56 2009 : Auth: Login incorrect: [test2/test2] (from client localhost port 1812) Tue Mar 3 15:46:56 2009 : Info: Using Post-Auth-Type Reject Tue Mar 3 15:46:56 2009 : Info: +- entering group REJECT {...} Tue Mar 3 15:46:56 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test2 Tue Mar 3 15:46:56 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Mar 3 15:46:56 2009 : Info: ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 253 to 127.0.0.1 port 33032 Tue Mar 3 15:46:56 2009 : Info: Finished request 0. Tue Mar 3 15:46:56 2009 : Debug: Going to the next request Tue Mar 3 15:46:56 2009 : Debug: Waking up in 4.9 seconds. Here's another interesting part. As the server continues its work, it at this stage works through the remaining requests sitting in the buffers.. rad_recv: Access-Request packet from host 127.0.0.1 port 33032, id=253, length=57 Tue Mar 3 15:46:56 2009 : Info: Sending duplicate reply to client localhost port 33032 - ID: 253 Sending Access-Reject of id 253 to 127.0.0.1 port 33032 Tue Mar 3 15:46:56 2009 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 33032, id=253, length=57 Tue Mar 3 15:46:56 2009 : Info: Sending duplicate reply to client localhost port 33032 - ID: 253 Sending Access-Reject of id 253 to 127.0.0.1 port 33032 ... and so on and so forth for all remaining in buffer requests ... Of course, tweaking this timeout value somehow to rather be in the seconds than minutes if not even sub-seconds would be preferable. Has anyone done this before and if so could I get a snippet of your configuration showing me how to achieve this? Thanks in advance. //anders

2 2

Re: User-Id and Calling-Station-Id matching
by tech.subscriptions＠shepherdhill.biz 03 Mar '09

03 Mar '09

> Put Calling-Station-Id, expression and =~ as operator for that user in > radcheck. But regex is not working well in 2.1.3. Better wait a few days > for 2.1.4. Please when would version 2.1.4 be released. Cheers, Chris.

2 1

NAS not found! message
by Bogdan Tancic 03 Mar '09

03 Mar '09

Hello all, I have freeradius server v1.1.7 and radius manager installed. After I configure mikrotik NAS as well as freeradius and radius manager I constantly get this: rad_recv: Access-Request packet from host 10.100.5.249:58662, id=82, length=201 NAS-Port-Type = Ethernet Calling-Station-Id = "00:1F:D0:6E:09:87" Called-Station-Id = "server1" NAS-Port-Id = "lan1" User-Name = "00:1F:D0:6E:09:87" NAS-Port = 2151677983 Acct-Session-Id = "8040001f" Framed-IP-Address = 10.100.7.43 Mikrotik-Host-IP = 10.100.7.43 CHAP-Challenge = 0x7618d4d358243ffa585f8686280d96c3 CHAP-Password = 0x9974f2cefb821ab9ff0736fd9a36e44320 Service-Type = Login-User WISPr-Logoff-URL = "http://0.0.0.0/logout" NAS-Identifier = "MikroTik" NAS-IP-Address = 10.100.5.249 rlm_chap: Setting 'Auth-Type := CHAP' rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 rlm_chap: login attempt by "00:1F:D0:6E:09:87" with CHAP password rlm_chap: Using clear text password "" for user 00:1F:D0:6E:09:87 authentication. rlm_chap: chap user 00:1F:D0:6E:09:87 authenticated succesfully rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 Exec-Program-Wait: value-pairs: Reply-Message="NAS not found!" Exec-Program: returned: 1 rad_recv: Access-Request packet from host 10.100.5.249:58662, id=82, length=201 Sending Access-Reject of id 82 to 10.100.5.249 port 58662 Reply-Message = "NAS not found!" User authenticated successfully but exec-program returned non zero value... What can be wrong? thank you in advance

4 6

Re: Freeradius-Users Digest, Vol 46, Issue 105 SOLVED - Why is groupname fieldblank in radacct
by ngwarai zed 03 Mar '09

03 Mar '09

Thanks Kalik, We changed the default sql to allow it to actually insert the grouname. 2009/2/26 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: SQLCounter configuration (Alan DeKok) > 2. Re: SQLCounter configuration (Alexander Solodukhin) > 3. Re: EAP-PEAP GTC auth_type (tnt(a)kalik.net) > 4. Re: Freeradius-Users Digest, Vol 46, Issue 102 Why is > groupname fieldblank in radacct (tnt(a)kalik.net) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 26 Feb 2009 11:03:22 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: SQLCounter configuration > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <49A668EA.40702(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > alt_ wrote: > > Can you show some examples please? I try to do like this: > > > > noresetBytecounter > > > > if (reject) { > > update reply { > > Reply-Message := "Traffic limit exceeded." > > } > > } > > > > but if noresetBytecounter return reject freeradius immediatly return > reject > > to user and do not process 'if' clause > > You need to put this in the "post-auth" section, "Reject" subsection. > See the example configuration files. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Thu, 26 Feb 2009 12:12:50 +0200 > From: "Alexander Solodukhin" <alt(a)softwarium.net> > Subject: Re: SQLCounter configuration > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <op.upyenokwqsf5os(a)demon.cris.net> > Content-Type: text/plain; format=flowed; delsp=yes; charset=koi8-r > > On Thu, 26 Feb 2009 12:03:22 +0200, Alan DeKok <aland(a)deployingradius.com> > wrote: > > > alt_ wrote: > >> Can you show some examples please? I try to do like this: > >> > >> noresetBytecounter > >> > >> if (reject) { > >> update reply { > >> Reply-Message := "Traffic limit exceeded." > >> } > >> } > >> > >> but if noresetBytecounter return reject freeradius immediatly return > >> reject > >> to user and do not process 'if' clause > > > > You need to put this in the "post-auth" section, "Reject" subsection. > > See the example configuration files. > > > /etc/freeradius/sites-enabled/default[412]: "SQL Counter" modules aren't > allowed in 'post-auth' sections -- they have no such method. > > -- > ISP CrIS, Softwarium > > > ------------------------------ > > Message: 3 > Date: Thu, 26 Feb 2009 11:14:37 +0100 > From: <tnt(a)kalik.net> > Subject: Re: EAP-PEAP GTC auth_type > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <FwAfhIxV.1235643277.5432590.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >Great! It works perfectly. > >Other than enabling ldap in authorize and authenticate in > >inner-tunnel, I also had to change eap.conf's gtc section to auth_type > >= LDAP. > > > >This works, but it brings up another problem. Setting auth_type to > >PAP, Local, or commented out on gtc section does not work for LDAP. On > >the other hand, If I set auth_type = LDAP, PEAP-GTC with system user > >(which works if I set auth_type = PAP on gtc section) does not work. > > > >Is there a way I can authenticate with BOTH system user and LDAP using > PEAP-GTC? > >the main radiusd.conf can have multiple authorize methods available, > >right? Why does gct have to explicitly set auth_type? > > > > Leave gtc as pap. Change set_auth_type to no in ldap module > configuration. Module will then just collect the password and pass it to > pap module for authentication. It will not do "bind as user" ldap > authentication. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 4 > Date: Thu, 26 Feb 2009 11:34:28 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Freeradius-Users Digest, Vol 46, Issue 102 Why is > groupname fieldblank in radacct > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <I1ceiOfk.1235644468.0624740.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > > >I have MySQL 5.0.67 and PostgreSQL 8.3.6 and freeRADIUS 2.17 installed on > >GNU/Linux Fedora 10 distribution. I have identical radius databases on > both > >MySQL and PostgreSQL. When I use the PostgreSQL, the groupname field in > the > >radacct table gets filled in but when I change the database to MySQL, the > >groupname filled is blank. I checked the queries in mysql/diaup.conf and > >postgresql/dialup.conf and found out that they are the same. Why is it > >working with PostgreSQL and not working with MySQL? The groupnames are > >defined in radusergroup table. > > > > Default queries that come with the source don't write to groupname > field. MySQL or PostgreSQL. You can place Class in radgroupreply and > give it the value of the group name. Then put %{Class} into groupname > field in accounting queries. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 46, Issue 105 > ************************************************* >

1 0

Re: SAML support for freeRadius
by Stefan Winter 03 Mar '09

03 Mar '09

Hi, > Scenario 2 & 3 are close to my task. > Let me explain my scenario. > User identities are loacted in a SAML-enabled id store. > User requests are directed to a proxy. Proxy should authenticate the > user against the configured freeRaduis server. freeRadius server > should validate it against the SAML-enabled server. > Depending on the response from SAML-enabled server, radius server > accepts/rejects the user. You didn't specify in your (private! - please stick to the mailing list) reply what kind of credential the user sends in the request. Is it a password? Then we're talking about scenario 2. In which case the sad answer for you is: Sorry, this is not how SAML works. SAML doesn't transport or validate credentials. It transports assertions being made about an authentication which happened out-of-band. I.e. a SAML auth request is basically the question "Do you know if this user has succesfully authenticated to you by whatever means you used for authentication?" And the SAML response is "Yes, I know that guy. He's alright.". No passwords involved in this communication. So your user's password needs to be validated *somehow* - but not inline in SAML. You can see that in popular SAML implementations where the actual credentials are stored in $WHATEVER - quite often an LDAP/ActiveDirectory store. Authentication then happens by a user visiting the IdP's web site, entering his password there (HTTP - no SAML involved) which is then validated against that LDAP store. *Then* the IdP constructs a SAML authentication assertion *about* the authentication that just happened. In short, feeding a password into FreeRADIUS and then magically doing SAML doesn't exist. All hope is not lost, however. You can tap with FreeRADIUS onto the same backend that's also used by SAML. FreeRADIUS merrily uses LDAP stores to validate user logins. If, OTOH, the user is not supposed to send a password but rather a SAML artifact to prove that it authenticated before, and FreeRADIUS should accept the user based on him presenting the assertion, then we're talking business. In that case though, the equally sad answer is that there is no defined transport to send SAML within RADIUS. What you'd need then is a means to send SAML payloads in RADIUS attributes. The most logical way of doing so would be some kind of "EAP-SAML" - but such a thing doesn't exist as an IETF standard today. So if authenticating via SAML assertions is something you want to do - please present your use case loudly to IETF people - they might listen and get going :-) Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

1 0

New FR server: CentOS 5 or Ubuntu 8
by Toledo, Luis Carlos 02 Mar '09

02 Mar '09

Hi all, Please accept my apologies for this complicate question. I need make a new FR server from sources with mysql support, and I have only two OS options: CentOS 5 or Ubuntu 8. I used only FreeBSD, but now I have only these two options. Any suggestions? Thx

4 3

EAP TTLS
by Kiran Kumar Balasubramanyam 02 Mar '09

02 Mar '09

Hi, I would like to test EAP TTLS with MS-CHAPv2 authentication. Can you please let me know the procedure and whether the radeapclient supports the same. Also any old traces or log files also will help. Thanks, Kiran.

2 1

Implementing Filter-Id's with MySQL
by Tawanda Kavayi 02 Mar '09

02 Mar '09

Hi, I am running a Freeradius server which queries a MySQL database (Vexim) for authentication of dial-up users. I would like to create two classes of dial-up users, Internet users and email-only users. The Intetrnet users have full Internet access while the email-only users can only access SMTP, POP and DNS services. I am using a Livingstone Portmaster 3 NAS, and will create a filter, emailonly.in to manipulate the IP traffic. My question is, how do I configure Freeradius/MySQL to add the Filter-Id attribute to email-only users and thus deny them full Internet access. Regards, Tawanda --

2 1