- Freeradius-Users - lists.freeradius.org

LDAP backend and Password Encryption
by Phillip Heller 18 Aug '08

18 Aug '08

Hello, Relatively new to both freeradius and ldap here. I'm using the Centos Directory Server, which defaults to SSHA encryption on the userPassword attribute. I'm using freeradius to authenticate unix logins (via pam_radius_auth), VPN (cisco asa) logins, and router/switch vty logins. freeradius verifies existence of the user in various ldap groups, and based upon that logic, either proxies off to a cryptocard server for one-time-password authentication, or authenticates directly against the userPassword attribute value. It would seem that freeradius does not authenticate against SSHA. I did try a few other encryption policies (crypt, md5) and set the password_header value appropriately. This is with version 2.0.5. Any help would be greatly appreciated! Regards, Phil

2 6

LDAP group-checking - missing user-dn in filter
by Jason Long 18 Aug '08

18 Aug '08

This morning I'm attempting to upgrade my FreeRadius install from 1.1.7 to 2.0.5. I'm having an issue with LDAP group-checking. Here's my scenario: I authenticate users with LDAP (eDirectory). In addition, I do some LDAP group-checking to determine which RADIUS attributes I want to return to the network device. This happens in the "users" file, with lines like: DEFAULT Ldap-Group == students Aruba-User-Role = student DEFAULT Ldap-Group == employees Aruba-User-Role = employee This was working in 1.1.7. But now I'm on 2.0.5, and after converting the config files, this is how it is behaving: users: Matched entry DEFAULT at line 13 rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (&(objectClass=person)(uid=%{Stripped-User-Name:-%{User-Name}})) -> (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap.messiah.edu:389, authentication 0 rlm_ldap: setting TLS CACert File to /usr/local/radius2/etc/raddb/certs/messiah-ca.crt rlm_ldap: setting TLS Require Cert to demand rlm_ldap: starting TLS rlm_ldap: bind as cn=ldap-radius,o=mc/*** to ldap.messiah.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in t=mc-tree, with filter (&(objectClass=person)(uid=georget)) rlm_ldap: ldap_release_conn: Release Id: 0 expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=students)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group students not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() expand: t=mc-tree -> t=mc-tree expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in t=mc-tree, with filter (&(cn=employees)(&(objectClass=groupOfNames)(member=))) rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group employees not found or user is not a member. rlm_ldap: Entering ldap_groupcmp() ++[files] returns ok I can see the issue here... the filter is messed up. expand: (&(objectClass=groupOfNames)(member=%{Ldap-UserDn})) -> (&(objectClass=groupOfNames)(member=)) The search filter should contain something like (member=cn=georget,ou=student,o=mc), but instead it has (member=). Is %{Ldap-UserDn} not correct? I got it right out of the sample configuration... Jason

2 3

per client certificate
by Tomoki Taniguchi 18 Aug '08

18 Aug '08

Is there a way to setup freeradius with EAP so that each wifi-client has their own certificate to connect to the wifi network? i want to be able to just disable a specific certificate if one one the laptops is stolen or lost. but the howtos i have come across so seem to be a setup where all wifi-clients use the same certificate to authenticate against an access point. is what i am trying to accomplish even possible? Please help. TIA, Tomoki

3 4

Multiple accounting copies
by Alexandre Chapellon 17 Aug '08

17 Aug '08

Hello, I am planning to move from a Sun/SBR installation to Freeradius, and so have a lot of things to test before... For exemple, I need to proxy accounting request from my freeradius server (2.0.5) to several (at least) radius services to allow third party applications to be aware of services allowed for every user. I have read that directly proxying to multiple server is not allowed by freeradius and instead i have to log to a detail file and then create a virtual server that read this file and behave as a NAS. My question is: Is it possible to have multiple virtual servers, each proxying to a specific radius? If not can i achieve this with freeradius or do i have to look for something else.

2 1

Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap
by Venkata LK Mula 16 Aug '08

16 Aug '08

Hi, We are authenticating the clients via 'users' file. We are sending the required file "inner-tunnel", which we found in two locations 1. /usr/local/etc/raddb/sites-enabled 2. /usr/local/etc/raddb/sites-available we are sending the both the files, with SA as suffix for the file at location /usr/local/etc/raddb/sites-available. And also sending the 'users' file. regards, Venkat ----- Original Message ----- From: Maurizio Cimaschi <mauri(a)unixrulez.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap Date: Fri, 15 Aug 2008 09:41:03 +0200 > Venkata LK Mula wrote: > > modsingle[authenticate]: calling mschap (rlm_mschap) for > > request 6 > > rlm_mschap: No Cleartext-Password configured. Cannot > > create LM-Password. > > rlm_mschap: No Cleartext-Password configured. Cannot > > create NT-Password. > > rlm_mschap: Told to do MS-CHAPv2 for test100 with > > NT-Password > > rlm_mschap: FAILED: No NT/LM-Password. Cannot perform > > authentication. > > rlm_mschap: FAILED: MS-CHAP2-Response is incorrect > > modsingle[authenticate]: returned from mschap > > (rlm_mschap) for request 6 > > ++[mschap] returns reject > > modsingle[authenticate]: returned from eap (rlm_eap) for > > request 6 > > ++[eap] returns reject > > auth: Failed to validate the user. > > It seems that all is working OK, except that you had not > defining any valid source for the user password. > > How are you planning to authenticate users ? (file ? pam ? > ldap ? samba ? other ?) > > Could you post your "inner-tunnel" configuration file ? > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 6

Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap
by Venkata LK Mula 16 Aug '08

16 Aug '08

with the modified 'users' file also there is no luck. the problem remains the same. The 'Code: Access-challenge (11)' frame from server to the client is showing 'Checksum: 0x921e [incorrect, should be 0x206c]' error. please find the ethereal log as attached as 'eap-failure1'. regards, Venkat ----- Original Message ----- From: Maurizio Cimaschi <mauri(a)unixrulez.org> To: Venkata LK Mula <vlkmula(a)saitechnology.com> Cc: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Failing to authenticate using FreeRadius(in OpenBSD) + XP as a client +Linksys AP (WRT54v2.2) using peap Date: Fri, 15 Aug 2008 23:38:19 +0200 > Venkata LK Mula wrote: > > We are authenticating the clients via 'users' file. > > In your "users" configuration file user "test100" (the one > that log files are referring to) is > > "test100" Auth-Type := EAP > Cleartext-Password == "venkat", > Tunnel-Type = 13, > Tunnel-Medium-Type = 6, > Tunnel-Private-Group-Id = 100, > Reply-Message = "Hello 100, %u", > Fall-Through = No > > I would modify it in this way > > test100 User-Password == "venkat", > Tunnel-Type = 13, > Tunnel-Medium-Type = 6, > Tunnel-Private-Group-Id = 100, > Reply-Message = "Hello 100, %u", > Fall-Through = No > > Bye. > > > > 1. /usr/local/etc/raddb/sites-enabled > > 2. /usr/local/etc/raddb/sites-available > > Usually, in sites-enabled there shoiuld be link to > sites-available. > >

3 2

Freeradius in an AD environment on opensuse server
by Murray, Elizabeth [DNR] 16 Aug '08

16 Aug '08

I've been struggling with this for months. I found a doc HOW TO on the opensuse website. It says I have to use Samba in order to have the users authenticate. For some reason every time I get that thing configured, it works for a few days then...it's gone. I cover a large geographic area and have not been able to focus on this until today and tomorrow. SO any help would be appreciated. We've moved from a Novell eDirectory solution to . . . . Active Directory. Can I set up freeradius to authenticate with ldaps and be secure? The ldap would be Microsoft and is on my domain controller. I have websites using the ldap process but OR do I have to do that samba thing? I would really be grateful for any help you could give me. I now have the radius server back to it's original configuration....clean. So I'm ready to do your bidding. Liz M

4 19

Freeradius server and EAP-AKA/EAP-SIM
by Sri harsha 16 Aug '08

16 Aug '08

Hello Users, I need to test the EAP-SIM and EAP-AKA for some authentication procedure. As of now I am using "freeradius-server-2.0.5" for this purpose. I was able to get the EAP-SIM authentication successfully, but I can see that this version does not support EAP-AKA. Does any one know if freeradius is coming up with EAP-AKA soon?. Any pointer to other radius servers which support EAP-AKA would be helpful. --BR -Sriharsha

1 0

Freeradius server and EAP-AKA
by Sri harsha 16 Aug '08

16 Aug '08

Hello users, -- Inti Dhanyavaadagalondige -Sriharsha

1 0

what are the intended semantics of paircompare()?
by John Dennis 16 Aug '08

16 Aug '08

I'm in the process of debugging a problem and it seems to me paircompare() (in src/main/valuepair.c) is returning the wrong result. But I might be ascribing the wrong semantics to the function. Here is what I think it's supposed to do, is this correct? If any check attribute matches (according to it's operator) any attribute of the same attribute type in the request then return 0 else return ~0. Phrased another way it's a short circuit "logical or", e.g. as long as something matches it succeeds. If that is the intended semantics then I think there are couple of bugs in it and I'll provide a patch along with an explanation, otherwise could you set me straight on what it's behaviour is supposed to be? Thanks! -- John Dennis <jdennis(a)redhat.com>

2 1