- Freeradius-Users - lists.freeradius.org

redundant-load-balance and Ldap-Group
by Elizabeth Steinke 20 Oct '08

20 Oct '08

Greetings! I'm having an odd problem trying to implement load balancing/redundancy. I have added the following lines to my radiusd.conf authorize {... # # We want redundant ldap lookups ## redundant-load-balance { ldap1 ldap2 } ## # end redundancy ## } modules (... ldap ldap1 { } ldap ldap2 { } } Scenarios: This occurs using freeradius 1.1.7 (built from source) on a centos 5 box. If they both are specified correctly everything appears to work ok . When I purposely break ldap1 it works great and uses ldap2 for the LDAP lookup. When I break ldap2 and correct the IP address ldap1 is using to do lookups I get an access-reject packet back. Here is the snippet of the log (I am posting it for brevity, I will be more than happy to post all of radiusd -X) ---log bits for when it rejects the attempt-- lm_ldap: ...some ldap server in ldap fairy land... failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap::ldap_groupcmp: search failed rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched entry DEFAULT at line 69 here is rule 68-69: DEFAULT Huntgroup-Name =="some huntgroup", Auth-Type = ntlm_auth_cleartext Fall-Through = 1 DEFAULT Huntgroup-Name == "some huntgroup",Ldap-Group != "someldapgroup", Auth-Type := Reject I can then see rlm_ldap doing the lookup successfully on ldap1 lm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1:3268, authentication 0 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=..... rlm_ldap: looking for check items in directory... rlm_ldap: Adding memberOf as Ldap-Group == "..." What I think is happening is since the LDAP lookup failed the user is indeed not a user of the group (doesn't exist etc..) so it matches on the failure, since its first match it doesn't matter that is matches on the second lookup. It still gives me a failure. Is their a way keep it from rejecting the attempt if ldap2 is down?

3 5

Machine Authentication
by Casartello, Thomas 20 Oct '08

20 Oct '08

I've tried to find something on the past posts on this list about this. I think I found what the problem is but was unable to find a solution. I'm trying to make it so I can authenticate machines using the computer name. I know I need to set the ntlm_auth command correctly but I couldn't find to what or is there another solution? Here's my output: [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for host/billlgateway.ads.wsc.ma.edu with NT-Password [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [mschap] expand: --username=%{Stripped-User-Name:-%{User-Name:-None}} -> --username=host/billlgateway.ads.wsc.ma.edu [mschap] mschap2: 72 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=c0b3cf2bed56caa9 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=ef761f39a5775d58921cf42503c587f05060638411cf8555 Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 [mschap] External script failed. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Thomas E. Casartello, Jr. Wireless Network Technician Linux Specialist Information Technology Westfield State College Westfield, MA 01086 (413) 572-8245

4 11

Re: Question on implementing Vendor-Specific Attributes
by A BlueCoder 20 Oct '08

20 Oct '08

On Mon, Oct 20, 2008 at 12:09 AM, A BlueCoder <bluecoder008(a)gmail.com>wrote: > Hi, > > I have a need to implement Vendor-Specific Attributes using a FreeRadius > approach (version 0.9.3 on Solaris). > > I understand probably rewriting a rml module would solve this problem and > probably the most effective way. However, given the shortage of time, i > would like to explore configuration options (without code writing) if > possible. > > Here are the requirements: > > 1. Access-Request Requests; > > 2. Request Attributes -- with VSA (implemented with a Vendor-specific > dictionary). > > 3. Response Attributes -- with VSA (implemented with a Vendor-specific > dictionary). > > 4. There is a map from attributes in (2) to (3), which is what i am trying > to implement. > > e.g. > > If the request NAS-IP-Address = 111.111.111.111, i would like to response > with attribute: VSA1 = 10000001, > If the request NAS-IP-Address = 111.111.111.112, i would like to > response with attribute: VSA1 = 10000002, > If the request NAS-IP-Address = 111.111.111.113, i would like to > response with attribute: VSA1 = 10000003, > If the request NAS-IP-Address = 111.111.111.114, i would like to > response with attribute: VSA1 = 10000004, > > etc.... > > What's the best way which i can configur without writing a full-fledge rlm > module? > > Thanks in advance, > > BC > > > >

2 1

cisco vpn authentication, freeradius and best practices
by Elizabeth Steinke 19 Oct '08

19 Oct '08

Greetings, I have a best practices question. I am currently building a freeradius+LVS cluster to replace an existing radius server. In the process I am trying to do things as solidly as possible. Part of this process is tidying up the users file. In the process I noticed a rule that made me a little squishy. The purpose of the rule is to handle incoming requests from a cisco pix for VPN authentication. It is supposed to validate it using ntlm_auth. There are two ntlm_auth definitions in the radiusd.conf. One handles MS-CHAP and one is for ntlm_auth_plaintext. I tested this rule with radtest (Making the necessary modifications and it worked fine. DEFAULT Huntgroup-Name = "vpn-pix",Ldap-Group = "CN=somevpn...", Auth-Type := ntlm_auth_plaintext DEFAULT Huntgroup-Name = "vpn-pix",Ldap-Group != "CN=somevpn...", Auth-Type := Reject Is it a good idea to force the auth-type in the users file? is there a cleaner way to do this? While rewriting the rules file I am pairing accept and denies as above. Is that necessary or will it turn out to be horribly inefficient?

3 3

Re: Allocate IP address
by Rasool Jalali 19 Oct '08

19 Oct '08

hi Please write a example code for my process : I have a table that have a couple of tel numbers : User->Connect->if his/her number is in called_number_table =>give to him a valid IP User->Connect->if his/her number is NOT in called_number_table => give him an invalid IP(192.168.x.y) Which section is suitable for my purpose?authentication-authorization or post-auth PLZ Thanks. ----- Original Message ---- From: "tnt(a)kalik.net" <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Saturday, October 18, 2008 9:08:30 PM Subject: Re: Allocate IP address It does work. Post the whole debug. Ivan Kalik Kalik Informatika ISP Dana 18/10/2008, "Rasool Jalali" <r_jalali(a)ymail.com> piše: >hi >it dose not work.Output : > >+++[control] returns noop > >PLZ help me > > > >----- Original Message ---- >From: "tnt(a)kalik.net" <tnt(a)kalik.net> >To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Sent: Saturday, October 18, 2008 3:36:17 PM >Subject: Re: Allocate IP address > >update control { ... > >Ivan Kalik >Kalik Informatika ISP > > >Dana 18/10/2008, "Rasool Jalali" <r_jalali(a)ymail.com> piše: > >>hi all >>i have a code like this in auth-post section : >>if (condition) { >> allocate from pool_1 >>} >>else { >> allocate from pool_2 >>} >> >>I write this code but it dose not work : >> >>if (condition) { >> update reply { >> Pool-Name : = pool_1 >> } >>} >>else { >> update reply { >> Pool-Name : = pool_2 >> } >>} >> >>PLZ help me >>tanx. >> >>__________________________________________________ >>Do You Yahoo!? >>Tired of spam? Yahoo! Mail has the best spam protection around >>http://mail.yahoo.com >> > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > >__________________________________________________ >Do You Yahoo!? >Tired of spam? Yahoo! Mail has the best spam protection around >http://mail.yahoo.com > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Re: Allocate IP address
by Rasool Jalali 18 Oct '08

18 Oct '08

hi it dose not work.Output : +++[control] returns noop PLZ help me ----- Original Message ---- From: "tnt(a)kalik.net" <tnt(a)kalik.net> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Sent: Saturday, October 18, 2008 3:36:17 PM Subject: Re: Allocate IP address update control { ... Ivan Kalik Kalik Informatika ISP Dana 18/10/2008, "Rasool Jalali" <r_jalali(a)ymail.com> piše: >hi all >i have a code like this in auth-post section : >if (condition) { > allocate from pool_1 >} >else { > allocate from pool_2 >} > >I write this code but it dose not work : > >if (condition) { > update reply { > Pool-Name : = pool_1 > } >} >else { > update reply { > Pool-Name : = pool_2 > } >} > >PLZ help me >tanx. > >__________________________________________________ >Do You Yahoo!? >Tired of spam? Yahoo! Mail has the best spam protection around >http://mail.yahoo.com > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Unlang/Perl
by rsg 18 Oct '08

18 Oct '08

Could Perl called (like any other pre-compiled module such as chap,sql...) within an unlang script? The requirement is to query an external http server during the Auth process. Thanks, rg.

2 4

Allocate IP address
by Rasool Jalali 18 Oct '08

18 Oct '08

hi all i have a code like this in auth-post section : if (condition) { allocate from pool_1 } else { allocate from pool_2 } I write this code but it dose not work : if (condition) { update reply { Pool-Name : = pool_1 } } else { update reply { Pool-Name : = pool_2 } } PLZ help me tanx. __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Error in the negotiations certificates
by Martin Silvero 17 Oct '08

17 Oct '08

and that I did when I run radiusd-X I get an error in the inicializacion modules: eap.conf: eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # #default_eap_type = md5 # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # #timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. #ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = no # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # #md5 { #} # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## EAP-TLS # # See raddb/certs/README for additional comments # on certificates. # # If OpenSSL was not found at the time the server was # built, the "tls", "ttls", and "peap" sections will # be ignored. # # Otherwise, when the server first starts in debugging # mode, test certificates will be created. See the # "make_cert_command" below for details, and the README # file in raddb/certs # # These test certificates SHOULD NOT be used in a normal # deployment. They are created only to make it easier # to install the server, and to perform some simple # tests with EAP-TLS, TTLS, or PEAP. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { # # These is used to simplify later configurations. # certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_password = testing123 private_key_file = ${certdir}/server.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. # # If CA_file (below) is not used, then the # certificate_file below MUST include not # only the server certificate, but ALSO all # of the CA certificates used to sign the # server certificate. certificate_file = ${certdir}/server.pem # Trusted Root CA list # # ALL of the CA's in this list will be trusted # to issue client certificates for authentication. # # In general, you should use self-signed # certificates for 802.1x (EAP) authentication. # In that case, this CA file should contain # *one* CA certificate. # # This parameter is used only for EAP-TLS, # when you issue client certificates. If you do # not use client certificates, and you do not want # to permit EAP-TLS authentication, then delete # this configuration item. CA_file = ${cadir}/ca.pem # # For DH cipher suites to work, you have to # run OpenSSL to create the DH file first: # # openssl dhparam -out certs/dh 1024 # dh_file = ${certdir}/dh random_file = ${certdir}/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) uncomment the line below. # 5) Restart radiusd # check_crl = yes # CA_path = /path/to/directory/with/ca_certs/and/crls/ # # If check_cert_issuer is set, the value will # be checked against the DN of the issuer in # the client certificate. If the values do not # match, the cerficate verification will fail, # rejecting the user. # # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # This check is done only if the previous # "check_cert_issuer" is not set, or if # the check succeeds. # # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "DEFAULT" # # This configuration entry should be deleted # once the server is running in a normal # configuration. It is here ONLY to make # initial deployments easier. # # make_cert_command = "${certdir}/bootstrap" } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # # You can make TTLS require a client cert by setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # #ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. # default_eap_type = md5 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} # copy_request_to_tunnel = no # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} # use_tunneled_reply = no # # The inner tunneled request can be sent # through a virtual server constructed # specifically for this purpose. # # If this entry is commented out, the inner # tunneled request will be sent through # the virtual server that processed the # outer requests. # # virtual_server = "inner-tunnel" #} ################################################## # # !!!!! WARNINGS for Windows compatibility !!!!! # ################################################## # # If you see the server send an Access-Challenge, # and the client never sends another Access-Request, # then # # STOP! # # The server certificate has to have special OID's # in it, or else the Microsoft clients will silently # fail. See the "scripts/xpextensions" file for # details, and the following page: # # http://support.microsoft.com/kb/814394/en-us # # For additional Windows XP SP2 issues, see: # # http://support.microsoft.com/kb/885453/en-us # # Note that we do not necessarily agree with their # explanation... but the fix does appear to work. # ################################################## # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # # # You can make TTLS require a client cert by setting # # EAP-TLS-Require-Client-Cert = Yes # # in the control items for a request. # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. default_eap_type = mschapv2 # the PEAP module also has these configuration # items, which are the same as for TTLS. copy_request_to_tunnel = no use_tunneled_reply = no # When the tunneled session is proxied, the # home server may not understand EAP-MSCHAP-V2. # Set this entry to "no" to proxy the tunneled # EAP-MSCHAP-V2 as normal MSCHAPv2. # proxy_tunneled_request_as_eap = yes # # The inner tunneled request can be sent # through a virtual server constructed # specifically for this purpose. # # If this entry is commented out, the inner # tunneled request will be sent through # the virtual server that processed the # outer requests. # virtual_server = "inner-tunnel" } # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } }

3 2

Error in the negotiations certificates
by Martin Silvero 17 Oct '08

17 Oct '08

In that case, disable the module md5 because I just want to use tls? Why does the error that I showed you? certificates? thanks!

2 1