- Freeradius-Users - lists.freeradius.org

Re : Re : Dynamic VLAN and FreeRadius
by Joel MBA OYONE 22 May '08

22 May '08

Thank you Joe for your answer! We all agree that assocation is made before authentication process, in order to RADIUS to be able to do its stuffs. but the fact is that it doesn't work, and i was wondering what would be the result if i set: "Tunnel-Private-Group-ID = 100" (when the SSID were i am connected is assiged to VLAN 200, according to how my device work) . I started to ask silly questions because it's true i don't understand nothing anymore with my config! Basically, i have to use freeradius for authenticate wireless users, all connected on Access points managed by that switch! i learnt freeradius stuffs and with the help of the guys here, i am now able to setup it correctly!!! Access point authentication works well, but end-users authentication doing some EAP fails but stay without no response after the access-challenge!! (saying no correct login/password find, or requiring client certificate, depending if i am doing tls or peap). please note that it deons'nt tell me that my certificates are incorrect, it is the reason why i started to think that the AP's don't relay correctly the EAP negociation! (On XP client client are blocked on "identity validation" then give up the authentication). As i am newbie with 802.1x stuffs, i asked "silly" question to fix out my doubts. it is not easy for me to do it in english! - About the limitations of the device, i posted on d-link support a week ago and i am still waiting for the answer. - about RADIUS assigning SSID... it was a silly question of me and the goal was just to be sure that RADIUS authentication events stay on the same SSID. just for confirmation, and now I KNOW. - the reason of this confusion for me is what the documentation of dws-3024 says on page 205 and 206 as follow (some parts): ############################################################## ############################################################## NOTE: You can configure D-Link Access Points to use 802.1X authentication on the RADIUS server to allow or deny specific users on client stations access to the wireless network. If you enable 802.1X authentication, the client entry on a RADIUS server can support user-based VLANs and subnet assignments for IP tunneling. Table 80 shows the attributes to set for wireless clients within the RADIUS server. Table 80. RADIUS Attributes for Wireless Clients RADIUS Server Description Range Usage Attribute User-Name (1) 1-32 characters Required User-Password (2) 1-128 characters Required Tunnel-Medium-Type (65) 802 Optional ############################################################## The following example shows the entry for a user in the users file. The username is “johndoe,” the password is “test1234.” The user is assigned to VLAN 77. johndoe Auth-Type: = EAP, User-Password == “test1234" Tunnel-Type = 13, Tunnel-Medium-Type = 6, Tunnel-Private-Group-ID = 77 Tunnel-Type and Tunnel-Medium-Type use the same values for all stations. Tunnel-Private- Group-ID is the selected VLAN ID and can be different for each user. NOTE: Do not use the management VLAN ID of the AP for the value of the Tunnel- Private-Group-ID. ############################################################## ############################################################## the documentation also says on page 201: (and i dont understand this step, even using a translator. explanation would be appreciated) ############################################################## NOTE: This appendix does not describe RADIUS configuration for AP network authentication using 802.1X. This feature is separate from a valid AP configuration entry. The edge device that connects to the AP performs the network authentication. The edge device might not be the D-Link Unified Switch. ############################################################## Any people interested in help could just read page 200 - 209 of this documents and give advices. here is the link: ftp://ftp.dlink.fr/DWS/DWS-3024/Manuel/DWS-3000_Series_User_Manual_v2.00.pdf thanks a lot! Joel -------------------------------------------------------------------------------------------------------------------- HI Joel, I think the issue here is that the D-Link AP's you have are rather limited. Radius can not ever assign an SSID because that step occurs before the user authenticated. Wireless starts with an association from the user to the AP's SSID from there the AP decides what needs to happen. Radius can affect VLAN's (generally at least in the Cisco world with 'Tunnel-Private-Group-ID', like you meantioned) but you'll never be able to force a user to switch SSID's because that is client controlled. AP's map VLAN's to SSID's internally some allow n to 1 and 1 to n relationships, others like your d-links only allow a direct mapping. Basically it sounds like you are limited by the constraints of you NAS. Joe Vieira UNIX Systems Administrator Clark University Joel MBA OYONE wrote: > Alan, > > I possess a device from D-Link (DWS-3024). it is a wireless switch > controler, and the documentation says that: > - One SSID has to be affect to one VLAN on the profile. > - An Access point could be configured with up to 8 ifferent SSIDs and > it is possible to affect each SSID on its own network (below is a link > which show you the config page) or all SSID on the same network. > maybe i didn't read it correctly, so here is the link (see page 89-90 > and maybe 91 too.): > ftp://ftp.dlink.fr/DWS/DWS-3024/Manuel/DWS-3000_Series_User_Manual_v2.00.pdf > > i asked you stuffs about SSIDs/VLAN cause all my APs (about 30) will > receive the same profile, and the profile will have 3 differents SSIDS > with diffrents security access levels and network from the wireless > switch. > > for example, in the same room, associated to the same AP, students and > teachers will connect to diffrent SSIDs coming from that same AP, and > some will have to athenticate via EAP-PEAP, other will require EAP-TLS. > > this other short file explain point to point what is my config and > waht i am trying to do: > ftp://ftp.dlink.fr/DWS/DWS-3024/QIG/QIG_DWS-3024_WPA2.pdf > read it and maybe you could understand me. > > > regards > > Joel MBA OYONE wrote: > >> No. VLAN assignment is after SSID association, and after 802.1x > >> authentication. > > > > OK, is it possible to associate in SSID_1 and be assigned to a different > > VLAN than the we are associated in ? > > That doesn't make sense. SSID's aren't tied to VLANs, unless you > configure them that way. > > > (exemple, when i am associated to > > SSID_1, which belongs to VLAN100, > > No... SSID's have nothing to do with VLAN's. > > > RADIUS sends me > > "Tunnel-Private-Group-ID = 200", which belongs to another SSID, what > > would happen and would authentication process success?) > > Read your NAS documentation to see how to do VLAN assignment, and how > it interacts with SSID's. > > > - if i am assigned to another couple of SSID/VLAN than the one i am > > connected now by RADIUS, would authentication process restart at the > > beginning? > > Stop talking about "SSID/VLAN". They are separate things. > > When you do VLAN assignment with RADIUS, you do NOT need to > re-authenticate. > > > - is it possible to do EAP-TLS, EAP-PEAP and EAP-MD5 without the use of > > 802.1x when RADIUS is the authentication Server for a supplicant? > > What does that mean? > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > __________________________________________________ > Do You Yahoo!? > En finir avec le spam? Yahoo! Mail vous offre la meilleure protection > possible contre les messages non sollicités > http://mail.yahoo.fr Yahoo! Mail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

Re : Dynamic VLAN and FreeRadius
by Joel MBA OYONE 22 May '08

22 May '08

Alan, I possess a device from D-Link (DWS-3024). it is a wireless switch controler, and the documentation says that: - One SSID has to be affect to one VLAN on the profile. - An Access point could be configured with up to 8 ifferent SSIDs and it is possible to affect each SSID on its own network (below is a link which show you the config page) or all SSID on the same network. maybe i didn't read it correctly, so here is the link (see page 89-90 and maybe 91 too.): ftp://ftp.dlink.fr/DWS/DWS-3024/Manuel/DWS-3000_Series_User_Manual_v2.00.pdf i asked you stuffs about SSIDs/VLAN cause all my APs (about 30) will receive the same profile, and the profile will have 3 differents SSIDS with diffrents security access levels and network from the wireless switch. for example, in the same room, associated to the same AP, students and teachers will connect to diffrent SSIDs coming from that same AP, and some will have to athenticate via EAP-PEAP, other will require EAP-TLS. this other short file explain point to point what is my config and waht i am trying to do: ftp://ftp.dlink.fr/DWS/DWS-3024/QIG/QIG_DWS-3024_WPA2.pdf read it and maybe you could understand me. regards Joel MBA OYONE wrote: >> No. VLAN assignment is after SSID association, and after 802.1x >> authentication. > > OK, is it possible to associate in SSID_1 and be assigned to a different > VLAN than the we are associated in ? That doesn't make sense. SSID's aren't tied to VLANs, unless you configure them that way. > (exemple, when i am associated to > SSID_1, which belongs to VLAN100, No... SSID's have nothing to do with VLAN's. > RADIUS sends me > "Tunnel-Private-Group-ID = 200", which belongs to another SSID, what > would happen and would authentication process success?) Read your NAS documentation to see how to do VLAN assignment, and how it interacts with SSID's. > - if i am assigned to another couple of SSID/VLAN than the one i am > connected now by RADIUS, would authentication process restart at the > beginning? Stop talking about "SSID/VLAN". They are separate things. When you do VLAN assignment with RADIUS, you do NOT need to re-authenticate. > - is it possible to do EAP-TLS, EAP-PEAP and EAP-MD5 without the use of > 802.1x when RADIUS is the authentication Server for a supplicant? What does that mean? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

Need to understand flow
by Tuc at T-B-O-H.NET 22 May '08

22 May '08

Hi, I'm having to write my own validation and accounting for a device, and I need to understand a little about the flow. Is there a good reference for this? I don't have to support much, basically user/pass authentication, updating accounting, timeout, logoff. I understand that I send it an "Access-Request" packet, and I get back either Access-Accept with potentially some Attributes, or an Access-Reject if it failed. I believe I next need to send an accounting_start packet. Some of the items I'm not sure where they come from (Acct-Session-Id, Acct-Unique-Session-Id) or how they might be generated. During the course of the user being on, I believe you send accounting_updates and at the end send an accounting_stop. One thing I really don't know is where does Max-All-Session come in? In my initial testing, it didn't come back as an attribute. (Maybe incorrectly). Thanks, Tuc

2 2

Re: EAP TLS testing using eapol_test
by Naunidh S Chadha 22 May '08

22 May '08

Hi All An update: I tried using OpenSSL version 9.8c, but got exact same issues. Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: Done initial handshake Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 038d], Certificate Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get local issuer certificate* Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca Wed May 21 19:31:19 2008 : Error: TLS Alert write:fatal:unknown CA Wed May 21 19:31:19 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed May 21 19:31:19 2008 : Error: rlm_eap: SS L error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Wed May 21 19:31:19 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed May 21 19:31:19 2008 : Debug: eaptls_process returned 13 On OpenSSL 9.8g, radiusd started giving segmentation fault (may be it's some conflict). I really need a breakthrough now, I don't think there is anything left that I can do now, may be use some other client or sever for my purpose :) - Naunidh ---------------------------------------------------------------------- Message: 1 Date: Wed, 21 May 2008 20:15:06 +0530 From: "Naunidh S Chadha" <naunidh(a)gmail.com> Subject: EAP TLS testing using eapol_test To: freeradius-users(a)lists.freeradius.org Message-ID: <4b1838520805210745u1a014f31s79bad2914b8602fe(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi All I am attempting to authenticate an EAP-TLS using eapol_test tool against FreeRADIUS Version 2.0.3. >From last two days I am getting stumped by certificate issues. Currently I have the following error in my Freeradius log that seems to be the problem. Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: Done initial handshake Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: <<< TLS 1.0 Handshake [length 038d], Certificate Wed May 21 19:31:19 2008 : *Error: --> verify error:num=20:unable to get local issuer certificate* Wed May 21 19:31:19 2008 : Debug: rlm_eap_tls: >>> TLS 1.0 Alert [length 0002], fatal unknown_ca Wed May 21 19:31:19 2008 : Error: TLS Alert write:fatal:unknown CA Wed May 21 19:31:19 2008 : Error: TLS_accept:error in SSLv3 read client certificate B Wed May 21 19:31:19 2008 : Error: rlm_eap: SSL error error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned Wed May 21 19:31:19 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. Wed May 21 19:31:19 2008 : Debug: eaptls_process returned 13 >From searching around the net I found that one issue could be that my SSL does not understand that server.pem is a trusted CA. To make that happen I created hashes using the following command, *ln -s client.pem `openssl x509 -hash -noout 5~-in client.pem`.0* for ca.pem/server.pem and client.pem. I then pasted the hashes and .pem files into /usr/share/ssl/certs folder too (out of desperation :) ). After this if I ran the command "openssl verify *.pem" in .../raddb/certs folder, it would return OK for all pem files. IMO this is the best to test that all certificates are in order. I also used the command "openssl verify -CApath . *.pem" (picked it up from Makefile) and it returned OK too. I must add here that my setup is totally as per the docs/config file explanations. The radiusd.conf is configured to use EAP as per the default config, and the certs are made by running the make command in raddb/certs folder. I commented out bootstrap for my exploration. I ran "make client.pem" to create client certificates. The supplicant client uses following configuration file: network={ ssid="1x-test" key_mgmt=WPA-EAP eap=TLS identity="user(a)example.com" ca_cert="/usr/local/etc/raddb/certs/ca.pem" client_cert="/usr/local/etc/raddb/certs/user(a)example.com.pem" private_key="/usr/local/etc/raddb/certs/client.key" private_key_passwd="whatever" eapol_flags=3 } Since the logs are big enough to be a torture for people reading in digest mode, I have put them at http://naunidh.googlepages.com/logs It has output of radiusd -XXX followed by logs of eapol_test tool. My OpenSSL version is 9.7a (supported by Freeradius), My next step would be to upgrade this but it does not look like an OpenSSL issue, Upgrading this would be a pain at the moment as lot of people are dependent on the setup, but this is the only recourse left from my side. Any help would be greatly appreciated. Sorry for the long mail, but I could not shorten it any more without missing something important. Thanks All - Naunidh

2 1

Freeradius and Active directory
by Tomáš Janeček 22 May '08

22 May '08

Hi. What am I trying to do: I would like to authenticate my Windows XP wireless clients against Active Directory server via Freeradius. What do I have: I'm using freeradius 1.1.6 (installed via emerge) on Gentoo, Windows XP Pro What works: [WinXP]-->[freeradius]-->[w2003server] 1.)I'm able to send requests from Windows XP to freeradius (using NTradping). (In an earlier testing phase I was able to authenticate against "radius users file") 2.)I'm able to authenticate against AD (ntlm_auth). What doesn't work: When I try to bind phase 1.) and 2.) (ie. send request from winXP to radius and let radius to authenticate against AD), it returns: ********************************************************************** rad_recv: Access-Request packet from host 1.2.3.4:1224, id=1, length=59 User-Name = "MYNTDOMAIN\\user" CHAP-Password = 0x6036fd239ead000176def7ade553072c87 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '\' in User-Name = "user", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [user/<CHAP-Password>] (from client MYNETWORK port 0) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- NTradping retunrs: Response: Access-Reject ********************************************************************* I see the problem in "No authenticate method...", but have no idea how to repair it:( Here is radiusd log: ********************************************************************* notes ~ # radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/jaesrvkey.pem" tls: certificate_file = "/etc/raddb/certs/jaesrvcert.pem" tls: CA_file = "/etc/raddb/certs/jaecacert.pem" tls: private_key_password = "(null)" tls: dh_file = "/etc/raddb/certs/dh" tls: random_file = "/dev/urandom" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel =no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = yes preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "prefix" realm: delimiter = "\" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (ntdomain) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. ********************************************************************* I know there is something rotten in my configuration files, but can't find it. Thanks for any advice -- Tomáš Janeček

7 19

Re : Re : Dynamic VLAN and FreeRadius
by Joel MBA OYONE 22 May '08

22 May '08

Alan DeKok. wrote: > No. VLAN assignment is after SSID association, and after 802.1x > authentication. OK, is it possible to associate in SSID_1 and be assigned to a different VLAN than the we are associated in ? (exemple, when i am associated to SSID_1, which belongs to VLAN100, RADIUS sends me "Tunnel-Private-Group-ID = 200", which belongs to another SSID, what would happen and would authentication process success?) - if i am assigned to another couple of SSID/VLAN than the one i am connected now by RADIUS, would authentication process restart at the beginning? - is it possible to do EAP-TLS, EAP-PEAP and EAP-MD5 without the use of 802.1x when RADIUS is the authentication Server for a supplicant? thanx! List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

EAP-TTLS w/MS-CHAPv2
by Bram Matthys (Syzop) 22 May '08

22 May '08

Hi all, I'd like to use EAP-TTLS with MS-CHAP(v2), so I can use SecureW2 with Freeradius. To be more exact, I'd be using ntlm_auth, so that wireless users will be able to get on the wireless network using their usual windows username / password. I'm using FreeRadius 2.0.3. I've seen several tutorials regarding Freeradius 1, which help, but they are a bit outdated, and are often using a different authentication method or protocol (like PEAP). I'm stuck getting it to work, and it isn't even at the point of calling ntlm_auth yet (except for the first initial test, described later). I've verified ntlm_auth works on the command line. I've been following (among others) http://deployingradius.com/documents/configuration/active_directory.html which suggested to verify ntlm_auth in radius via this: exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=%{mschap:User-Name } --password=%{User-Password}" } And adding this to the users file: Auth-Type := ntlm_auth Once this passed (i tested with radtest), I commented out both, because it was only for testing. Side note..I had set 'wait = no' previously, due to the tutorial mentioning that, but then the password was always correct even if I provided an incorrect one. I've also been reading http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO by the way, and while it did help they use PEAP (w/mschapv2) so hmm. Anyway, back on track: I've taken the default radius configuration files (as of v2.0.3), and editted them.. I hope I've pasted all relevant parts here, if not.. let me know: radiusd.conf: $INCLUDE eap.conf mschap { require_encryption = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-None}} --challe nge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } I should also note that I have with_ntdomain_hack set to 'no' in preprocess{} (but to yes in mschap as pasted above), as I'll be using the realms module for that (or at least I try to). then the eap.conf: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no ... ttls { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "inner-tunnel" } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" } mschapv2 { } } and sites-enabled/default: authorize { preprocess chap mschap ntdomain eap { ok = return } unix files expiration logintime pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } And proxy.conf entry: realm DOMAIN { } This is what I get using the 'rad_eap_test' tool.. since i'm working remotely I cannot use securew2 at the moment (if someone has another suggestion on how to check eap ttls w/mschapv2, let me know.. it seems the radclient and radtest utils won't suffice because they don't do mschapv2): ./rad_eap_test -H 127.0.0.1 -P 1812 -S xxx -u 'DOMAIN\myuser' -p xxx -m WPA-EAP -e TTLS -v access-reject; 1 Radius log was a bit too large.. uploaded to: http://www.vulnscan.org/tmp/radius_log.txt I think this is the most relevant part: Wed May 21 15:09:43 2008 : Debug: +- entering group authorize Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling preprocess (rlm_preprocess) for request 5 Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from preprocess (rlm_preprocess) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[preprocess] returns ok Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling chap (rlm_chap) for request 5 Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from chap (rlm_chap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[chap] returns noop Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling mschap (rlm_mschap) for request 5 Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from mschap (rlm_mschap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[mschap] returns noop Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling ntdomain (rlm_realm) for request 5 Wed May 21 15:09:43 2008 : Debug: rlm_realm: Looking up realm "DOMAIN" for User-Name = "DOMAIN\myuser" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Found realm "DOMAIN" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Adding Stripped-User-Name = "myuser" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Proxying request from user myuser to realm DOMAIN Wed May 21 15:09:43 2008 : Debug: rlm_realm: Adding Realm = "DOMAIN" Wed May 21 15:09:43 2008 : Debug: rlm_realm: Authentication realm is LOCAL. Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from ntdomain (rlm_realm) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[ntdomain] returns noop Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: rlm_eap: EAP packet type response id 5 length 192 Wed May 21 15:09:43 2008 : Debug: rlm_eap: Continuing tunnel setup. Wed May 21 15:09:43 2008 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[eap] returns ok Wed May 21 15:09:43 2008 : Debug: rad_check_password: Found Auth-Type EAP Wed May 21 15:09:43 2008 : Debug: auth: type "EAP" Wed May 21 15:09:43 2008 : Debug: +- entering group authenticate Wed May 21 15:09:43 2008 : Debug: modsingle[authenticate]: calling eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: rlm_eap: Request found, released from the list Wed May 21 15:09:43 2008 : Debug: rlm_eap: EAP/ttls Wed May 21 15:09:43 2008 : Debug: rlm_eap: processing type ttls Wed May 21 15:09:43 2008 : Debug: rlm_eap_ttls: Authenticate Wed May 21 15:09:43 2008 : Debug: rlm_eap_tls: processing TLS Wed May 21 15:09:43 2008 : Debug: eaptls_verify returned 7 Wed May 21 15:09:43 2008 : Debug: rlm_eap_tls: Done initial handshake Wed May 21 15:09:43 2008 : Debug: eaptls_process returned 7 Wed May 21 15:09:43 2008 : Debug: rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Wed May 21 15:09:43 2008 : Debug: auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Wed May 21 15:09:43 2008 : Debug: auth: Failed to validate the user. Wed May 21 15:09:43 2008 : Auth: Login incorrect: [DOMAIN\\myuser/<no User-Password attribute>] (from client localhost port 0 cli 70-6F-6C-69-73-68) Wed May 21 15:09:43 2008 : Debug: TTLS: Got tunneled Access-Reject Wed May 21 15:09:43 2008 : Debug: rlm_eap: Handler failed in EAP/ttls Wed May 21 15:09:43 2008 : Debug: rlm_eap: Failed in EAP select Wed May 21 15:09:43 2008 : Debug: modsingle[authenticate]: returned from eap (rlm_eap) for request 5 Wed May 21 15:09:43 2008 : Debug: ++[eap] returns invalid Wed May 21 15:09:43 2008 : Debug: auth: Failed to validate the user. Wed May 21 15:09:43 2008 : Auth: Login incorrect: [DOMAIN\\myuser/<via Auth-Type = EAP>] (from client localhost port 0 cli 70-6F-6C-69-73-68) Any help is very much welcomed :) Regards, Bram. -- Bram Matthys Software developer/IT consultant syzop(a)vulnscan.org PGP key: www.vulnscan.org/pubkey.asc PGP fp: 8DD4 437E 9BA8 09AA 0A8D 1811 E1C3 D65F E6ED 2AA2

2 2

How To Create Authentication Request Packet to pass as input to RADCLIENT
by Dana Blanaru 22 May '08

22 May '08

Hi, Does anyone know where can I find documentation about radclient? I am trying to figure out how to test EAP-MD5 using radclient. I want to use it to send Authentication Request packets to my AAA server where the authentication method is EAP-MD5. But I don't know how to create these packets (what attributes and values should be included). The EAP-Message attribute should be included but how do I emulate the correct value for it? Please help me with this. Thanks. Dana

2 3

Re: How To Create Authentication Request Packet to pass as input
by Naunidh S Chadha 22 May '08

22 May '08

Hi > I am trying to figure out how to test EAP-MD5 using radclient. I want to use > it to send Authentication Request packets to my AAA server where the > authentication method is EAP-MD5. I guess instead of changing rad-client use eapol_test by wpa_supplicant. It supports TTLS. _ Naunidh Message: 1 Date: Wed, 21 May 2008 12:11:17 +0200 From: "Dana Blanaru" <dana.blanaru(a)gmail.com> Subject: How To Create Authentication Request Packet to pass as input to RADCLIENT To: freeradius-users(a)lists.freeradius.org Message-ID: <cfffab400805210311qa6504eah37ac8c9b4235390f(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hi, Does anyone know where can I find documentation about radclient? I am trying to figure out how to test EAP-MD5 using radclient. I want to use it to send Authentication Request packets to my AAA server where the authentication method is EAP-MD5. But I don't know how to create these packets (what attributes and values should be included). The EAP-Message attribute should be included but how do I emulate the correct value for it? Please help me with this. Thanks. Dana

2 1

FR not working with AD...
by Karthik R 22 May '08

22 May '08

I'm trying to configure freeradius2.0.3 to authenticate wireless users against AD. I followed the steps as mentioned in http://deployingradius.com/ and installation document still not working. The ntlm_auth command is success and it lists the users and groups from AD using wbinfo -u and wbinfo -g. Now i see new error message after reconfiguring freeradius server, issue with SSL. Installed CA.der certificate alone on the windows xp supplicant, i didnt generate individual client certificate as i dont want the users to be have less task to configure wireless . As per my understanding and in previous freeradius it worked this way installing root.der certificate alone and without individual supplicant certificate. I'm unable to authenticate the users against AD. can someone throw some light here. Attached the log message. snip => rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization TLS_accept: SSLv3 read client hello A TLS_accept: SSLv3 write server hello A TLS_accept: SSLv3 write certificate A TLS Alert write:fatal:handshake failure TLS_accept:error in SSLv3 write key exchange A rlm_eap: SSL error error:1409B0AC:SSL routines:SSL3_SEND_SERVER_KEY_EXCHANGE:missing tmp rsa key rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED rlm_eap: Freeing handler ++[eap] returns reject auth: Failed to validate the user. Login incorrect: [DOMAIN\\kartthikr/<via Auth-Type = EAP>] (from client 10.20.0.0 port 60 cli 0014a526c319)

2 1