- Freeradius-Users - lists.freeradius.org

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 01 May '08

01 May '08

>No, there is a digest module in default radiusd.conf that should decode >the attributes. Post radiusd -X for request with Digest-Attributes. >Those attributes you want are not in the request - have you tried >$RAD_CHECK. hi Kalik, I've tried $RAD_CHECK but it doesn't work, I've found a digest module in radiusd.conf but actually don't have any idea how to handle the module. Here is the full output when the radius is run in debugging mode: [root@localhost raddb]# radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 9 2008 at 21:42:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 192.168.1.227 { require_message_authenticator = no secret = "johnson" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/etc/raddb/myperltemp.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } perl { max_clones = 32 start_clones = 32 min_spare_clones = 0 max_spare_clones = 32 cleanup_delay = 5 max_request_per_clone = 0 } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. and here is the output after when rejecting the users rad_recv: Access-Request packet from host 127.0.0.1 port 32795, id=73, length=59 User-Name = "johnson" User-Password = "johnson" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x92fa6c8 asigned new request. Handled so far: 1 found interpetator at address 0x92fa6c8 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: User-Name = johnson rlm_perl: RAD_REQUEST: User-Password = johnson rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: ############################################################### rlm_perl: Added pair User-Name = johnson rlm_perl: Added pair User-Password = johnson rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x92fa6c8 ++[perl] returns reject Invalid user: [johnson/johnson] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> johnson attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 73 to 127.0.0.1 port 32795 Reply-Message = "Incorrect Password" Waking up in 4.9 seconds. Cleaning up request 0 ID 73 with timestamp +3 Ready to process requests. Regards Elangbam Johnson

2 1

Deny AD groups
by rmp dmd 01 May '08

01 May '08

Hi, I have a security group in AD 'noremote' that I would like to deny VPN access. Reading the FAQ, I edit users to include DEFAULT Group == "noremote", Auth-Type := Reject Reply-Message = "Your account is not allowed." but this doesn't work. I also tried below which I based on my previous query to deny AD users (this is working) DEFAULT Group == "noremote", MS-CHAP-Use-NTLM-Auth := 0,Auth-Type := Reject Reply-Message = "Your account is not allowed." but still doesn't work. I'm not sure how the group should be used. So I also tested including the domain such as Group==DOMAIN\\noremote, Group==DOMAIN+noremote but still no success. Thanks in advance! Roehl

2 1

FR 1.1.7 + AD 2003 + LDAP
by Charlie B 01 May '08

01 May '08

Hello everyone, We have setup FreeRadius w/ Active Direcotry using LDAP and ntlm as per the wiki and everything is working great save one item of concern. When our users are needing to reset their password or have reset their password ntlm fails I'm pretty certain that this is not a freeradius issue and I'm sorry to post here however this would be the largest base for user whom may have experienced this issue We can correct the issue if we remove the registry key located HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters however this removes the 802.1x configuration for the machine. rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user Raduser authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 rlm_mschap: Told to do MS-CHAPv2 for Raduser with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=Raduser' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: 88 radius_xlat: '--challenge=5fb05b4d0e49743a' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=abc64919a43a42c675c516ce59001bb4a3ef65d68f8de407' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 48 modcall: leaving group MS-CHAP (returns reject) for request 48 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 48 modcall: leaving group authenticate (returns reject) for request 48 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [Raduser/<no User-Password attribute>] (from client localhost port 0) freeradius-1.1.7-3.1 samba-3.0.28-0 samba-client-3.0.28-0 samba-common-3.0.28-0 Any help much appreciated, we currently running about 1500 users with this setup and everything is great save the password issue. Thanks

5 14

Deny Users AD on Freeradius + Wireless&VPN
by rmp dmd 01 May '08

01 May '08

Hi, We have a wireless network that uses freeRadius integrated with AD for authentication. There are some test user accounts on AD that I would like to deny access on our Wireless and VPN. I have tried "How do I deny access to a specific user, or group of users" on FAQ but it is not working. I'm guessing that this is not the correct method. Please help me on how to set-up correctly. Thanks! Roehl

3 8

Re: Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 01 May '08

01 May '08

> That's a pap request. Send a request with Digest-Attributes and you will >get digest attributes. hi, As advice by Ivan Kalik, I've tried sending the request with Digest-Attributes, unfortunately i didn't get any values from these attributes: 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'. here is the piece of perl code that i have used to access the values $dUserName= $RAD_REQUEST{'Digest-User-Name'}; $dRealm= $RAD_REQUEST{'Digest-Realm'}; $dMethod = $RAD_REQUEST{'Digest-Method'}; $dUri= $RAD_REQUEST{'Digest-URI'}; $dNonce=$RAD_REQUEST{'Digest-Nonce'}; $dResponse=$RAD_REQUEST{'Digest-Response'}; I've used md5 algorithm in my perl script, is there anything to be done in the eap.conf or in radius.conf ? Regards, Elangbam Johnson

2 1

Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 01 May '08

01 May '08

hi, I am using free Radius 2.0.3. I m configured my AAA through rlm_perl. I need to do the authorization by using the following attributes. Digest-Realm Digest-Method Digest-Uri Digest-Nonce Digest-Nonce Digest-Response Unfortunately i did not get any value from these attributes when i called using $RAD_REQUEST. Please tell me any idea to get these values. Here is the piece of output when the radius is run in debugging mode: [root@localhost raddb]# radiusd -X FreeRADIUS Version 2.0.3, for host i686-pc-linux-gnu, built on Apr 9 2008 at 21:42:16 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/clients.conf including configuration file /usr/local/etc/raddb/snmp.conf including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/default including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" shortname = "localhost" nastype = "other" } client 192.168.1.227 { require_message_authenticator = no secret = "johnson" } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_perl Module: Instantiating perl perl { module = "/usr/local/etc/raddb/myperltemp.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" } perl { max_clones = 32 start_clones = 32 min_spare_clones = 0 max_spare_clones = 32 cleanup_delay = 5 max_request_per_clone = 0 } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. and here is the output after when rejecting the users rad_recv: Access-Request packet from host 127.0.0.1 port 32795, id=73, length=59 User-Name = "johnson" User-Password = "johnson" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok perl_pool: item 0x92fa6c8 asigned new request. Handled so far: 1 found interpetator at address 0x92fa6c8 rlm_perl: ############################################################### rlm_perl: RAD_REQUEST: User-Name = johnson rlm_perl: RAD_REQUEST: User-Password = johnson rlm_perl: RAD_REQUEST: NAS-Port = 0 rlm_perl: RAD_REQUEST: NAS-IP-Address = 127.0.0.1 rlm_perl: ############################################################### rlm_perl: Added pair User-Name = johnson rlm_perl: Added pair User-Password = johnson rlm_perl: Added pair NAS-Port = 0 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Reply-Message = Incorrect Password perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x92fa6c8 ++[perl] returns reject Invalid user: [johnson/johnson] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> johnson attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 73 to 127.0.0.1 port 32795 Reply-Message = "Incorrect Password" Waking up in 4.9 seconds. Cleaning up request 0 ID 73 with timestamp +3 Ready to process requests. Regards Elangbam Johnson

2 1

How to implement two possible passwords? (one for PEAP and other for TTLS)
by Sergio Belkin 30 Apr '08

30 Apr '08

Hi, I've added an new attribute called "radiusPassword" this a clear-text password exclusively for radius usage. I want that: 1) All Linux, MAC OS X, and all Windows users that want to and can install (or already have installed and configured) securew2 use their usual encrypted userPassword. (EAP-TTLS) 2) All users that don't want to install securew2 (Windows users) and want to use PEAP instead TTLS use the radiusPassword as their password for access to wireless network. How can I do that? These are my current config files: ---------- radiusd.conf ---------------- prefix = /usr/local-2.0.2 exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd db_dir = $(raddbdir) libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 cleanup_delay = 5 max_requests = 1024 listen { type = auth ipaddr = 190.69.213.5 port = 0 } listen { ipaddr = 190.69.213.5 port = 0 type = acct } hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log { destination = files file = ${logdir}/radius.log syslog_facility = daemon stripped_names = yes auth = yes auth_badpass = no auth_goodpass = no } checkrad = ${sbindir}/checkrad security { max_attributes = 190 reject_delay = 1 status_server = yes } proxy_requests = no $INCLUDE proxy.conf $INCLUDE clients.conf snmp = no $INCLUDE snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { radwtmp = ${logdir}/radwtmp } $INCLUDE eap.conf mschap { } ldap { server = "ldap.cadorna.edu identity = "cn=freeradius,ou=applications,dc=cadorna,dc=edu" port = 636 password = doyouwantocrakforgetitdude basedn = "ou=people,dc=cadorna,dc=edu" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" ldap_connections_number = 5 timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no cacertfile = /etc/raddb-2.0.2/cacert.pem randfile = /dev/urandom require_cert = "allow" } access_attr = "radiusAllowed" dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no } realm IPASS { format = prefix delimiter = "/" } realm suffix { format = suffix delimiter = "@" } realm realmpercent { format = suffix delimiter = "%" } realm ntdomain { format = prefix delimiter = "\\" } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 header = "%t" suppress { User-Password } } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d suppress { User-Password } } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter attr_filter.post-proxy { attrsfile = ${confdir}/attrs } attr_filter attr_filter.pre-proxy { attrsfile = ${confdir}/attrs.pre-proxy } attr_filter attr_filter.access_reject { key = %{User-Name} attrsfile = ${confdir}/attrs.access_reject } attr_filter attr_filter.accounting_response { key = %{User-Name} attrsfile = ${confdir}/attrs.accounting_response } counter daily { filename = ${db_dir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout allowed-servicetype = Framed-User cache-size = 5000 } $INCLUDE sql/mysql/counter.conf always fail { rcode = fail } always reject { rcode = reject } always noop { rcode = noop } always handled { rcode = handled } always updated { rcode = updated } always notfound { rcode = notfound } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } expiration { reply-message = "Password Has Expired\r\n" } logintime { reply-message = "You are calling outside your allowed timespan\r\n" minimum-timeout = 60 } exec { wait = yes input_pairs = request shell_escape = yes output = none } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply shell_escape = yes } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${db_dir}/db.ippool ip-index = ${db_dir}/db.ipindex override = no maximum-timeout = 0 } policy { filename = ${confdir}/policy.txt } } instantiate { exec expr expiration logintime } $INCLUDE policy.conf $INCLUDE sites-enabled/ EOF -------------- eap.conf ---------------- eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/pki/tls/certs/ips-spectrum-key.pem certificate_file = /etc/pki/tls/certs/ips-spectrum-crt.pem CA_file = /etc/pki/tls/certs/ips-ca-bundle.crt dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } } EOF ------------------- ldap.attrmap checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem Cleartext-Password clrtxtPassword checkItem User-Password userPassword replyItem Tunnel-Type radiusTunnelType replyItem Tunnel-Medium-Type radiusTunnelMediumType replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password lmPassword checkItem NT-Password ntPassword checkItem LM-Password sambaLmPassword checkItem NT-Password sambaNtPassword checkItem SMB-Account-CTRL-TEXT acctFlags checkItem Expiration radiusExpiration checkItem NAS-IP-Address radiusNASIpAddress replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort replyItem Reply-Message radiusReplyMessage EOF Thanks in advance!! -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 7

Version 2.0.4 has been released
by Alan DeKok 30 Apr '08

30 Apr '08

Version 2.0.4 has been released: http://freeradius.org/download.html There are a number of interesting new features, most notably DHCP support. :) Feature improvements * Allow "virtual_server" in "realm" and "home_server" sections. See raddb/proxy.conf and raddb/sites-available/virtual.example.com. * Allow "passwd" module to be listed in "accounting" and "post-auth". * Added "fallback" to "home_server_pool" configuration, to handle the case of all home servers being dead. See raddb/proxy.conf. * Added sample text to raddb/sites-available/inner-tunnel which can simplify debugging of inner tunnel configurations. * Added regular expression matching in realm names. See raddb/proxy.conf for examples. * Added simple DHCP server functionality. For comments, see raddb/sites-available/dhcp. * Added file globbing capabilities to detail file reader * Added sample raddb/sites-available/robust-proxy-accounting * Clients in SQL can now refer to a virtual server. Patch from Michael Bretterklieber. * Added some examples of creating RADIUS administrator in SQL, and assigning appropriate access rights. Bug fixes * Install all files in raddb/sites-available * Allow non-threaded builds. * Don't treat '0x' as special for known attributes that are not of type "octets". * Fix log error in rlm_pap. * Remove documentation about non-existent functionality. * Updated warning messages in debug output. * Fix handling of timeouts in rlm_ldap that affected 64-bit systems. This fix was supposed to go into 2.0.3, but did not make it. * Fix event handling in debug mode for failed proxy requests. * Fix memleak in fifos. Closes #537. * Fix memleak on blocked threads. Closes #538. * Perform additional checks on NULL realms. Closes #541. * Fix handling of "clients" in "listen" section. * When detail file cannot process a packet, sleep for longer to let the rest of the server do something. * Add missing table to raddb/sql/mssql/schema.sql. Closes #545. * Updated rlm_sql_postgresql to build with PostgreSQL 7.x. Closes #533. * Fix "postauth" of rlm_ldap to look for LDAP-UserDn in the correct place. * Update rlm_attr_filter for some corner cases. Closes #543. * Fixed memory leak in libfreeradius event handler. * In the SQL Accounting on/off queries, remove the restriction that the session time had to be zero.

1 0

dot1x specification EAPOL-Logoff clarification
by Arran Cudbard-Bell 30 Apr '08

30 Apr '08

Hi, Having some interesting issues with a HP ProCurve 2510 an Apple Mac Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same wired port. I know this isn't strictly the list for this as this isn't really RADIUS, but i'm not sure where to post... Two questions: IEE802.1x-2004 8.1.3 EAPOL-Logoff When a Supplicant wishes the Authenticator PAE to perform a logoff (i.e., to set the controlled Port state to unauthorized), the Supplicant PAE originates an EAPOL-Logoff message (see 7.5.4) to the Authenticator PAE. As a result, the Authenticator PAE immediately places the controlled Port in the unauthorized state 1) It appears in the spec that there is no requirement or indeed method of the Supplicant PAE of confirming that the EAPOL-Logoff has been honoured. So the supplicant PAE could be in the unauthorised state while the Authenticator could be in the authorised state. Is this an over site of the dot1x spec, or is this meant to be handled at a higher level with EAP ? --- 2) On the termination of an EAP session, VLAN membership is usually altered, either to a MAC-Authorised VID a default unauthorised VID, or the port is blocked. Windows clients are pretty crap in terms of DHCP when this happens, and fail to renew their leases when moving between authorised and unauthorised states. Apple Mac clients however are very good in terms of DHCP dot1x integration. Unfortunately with EAP-Based and MAC-Based authentication transistions, DHCP renewal doesn't appear to work. This is what i've seen from the traces: FRAME 6436 - TS 212.482482 - Assumed VLAN 603 - Actual VLAN 603 - EAPOL Logoff FRAME 6440 - TS 212.484947 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP REQUEST FRAME 6443 - TS 212.487252 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP ACK (Answered by server on 603) FRAME 6454 - TS 212.529774 - Assumed VLAN 134 - Actual VLAN 134 - EAP Failure (Seems to denotate MAC Authentication succeeding) So it appears after the supplicant sends the EAPOL-Logoff, the DHCP client attempts to get a lease very quickly; so quickly in fact that the switch hasn't altered the state of the port. The result being that the DHCP request is acked by the DHCP server on the dot1x authorised VLAN, the VLAN transistion *then* occurs, but as the DHCP client has satisfied itself that it has a valid lease for the PAE unauthorised state it doesn't renew the lease until it expires... Should I be shouting at HP to get their switches to register the state change faster, or shouting at Apple to make their DHCP timings less agressive ? Many Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 16

User-Name attribute being evaluated as regular expression???
by bmccorkle 30 Apr '08

30 Apr '08

Hello, I have an issue and haven't been able to find any online help. I thought I had freeradius working correctly but discovered yesterday that if a user's name starts with 'r' then they can't login. I setup an unlang if statement (in the default sites available) to handle whether the login is a computer, user, or pda request (I'm assuming this is the best way to do it). The statement copies the User-Name attribute over to a Stripped-User-Name attribute and manipulates the Stripped-User-Name as necessary. Normally when a user logs in it's in the format: DOMAIN\first.lastname. I created some attr_rewrite modules to strip the domain and period out of the username. It was working fine, but I discovered if Randy Hall logs in (User-Name = DOMAIN\randy.hall); Stripped-User-Name becomes: DOMAIN andy halll (domain is not removed, the r in his name disappears and the last letter seems to be doubled (I tried this with another user and it removed the r from his name and doubled the 's' at the end of his name as well). So what is going on exactly? I'm not an expert but it seems like the attribute is being evaluated as a regular expression??? I commented out all the attr_rewrite modules except for the one that copies the user-name over to stripped-user-name and noticed the stripped-user-name was still incorrect in my ldap search. .....attr_rewrite section in RADIUSD.CONF..... attr_rewrite copy.user-name { attribute = Stripped-User-Name new_attribute = yes searchfor = "" searchin = packet replacewith = "%{User-Name}" } attr_rewrite add-dollar-sign { attribute = Stripped-User-Name searchfor = "^(host/.*)" searchin = packet new_attribute = no replacewith = "%{1}$" } attr_rewrite strip-realm-name { attribute = Stripped-User-Name new_attribute = no searchin = packet searchfor = "^(.*[\\/]+)" replacewith = "" max_matches = 1 } attr_rewrite remove-domain { attribute = Stripped-User-Name new_attribute = no searchfor = "\.DOMAIN\.EDU" searchin = packet replacewith = "" max_matches = 1 } attr_rewrite pda-fix { attribute = Stripped-User-Name new_attribute = no searchfor = "@DOMAIN" searchin = packet replacewith = "" max_matches = 1 } attr_rewrite strip-period { attribute = Stripped-User-Name new_attribute = no searchin = packet searchfor = "[.]" replacewith = " " max_matches = 1 } .....If statement in default under sites-available..... #Host Login if (User-Name =~ /^(host\/.*)/i) { copy.user-name strip-realm-name remove-domain } #User Login elsif (User-Name =~ /^(DOMAIN\\.*)/i) { copy.user-name strip-realm-name strip-period } #PDA Login elsif (User-Name =~ /((a)DOMAIN.EDU)/i) { copy.user-name remove-domain strip-period } else { copy.user-name strip-period } .....OUTPUT..... Waking up in 3.9 seconds. User-Name = "DOMAIN\\randy.hall" Framed-MTU = 1400 Called-Station-Id = "001a.e210.7420" Calling-Station-Id = "000e.3558.6ea4" Service-Type = Login-User Message-Authenticator = 0x3ee4bc7ed916ea6dc3bdb3d527346d95 EAP-Message = 0x0202001701474148414e4e415c72616e64792e68616c6c NAS-Port-Type = Wireless-802.11 NAS-Port = 3649 NAS-IP-Address = 192.168.0.229 NAS-Identifier = "Company" +- entering group authorize ++[preprocess] returns ok expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/192.168.0.229/auth-detail-20080424 rlm_detail: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/192.168.0.229/auth-detail-20080424 expand: %t -> Thu Apr 24 10:18:40 2008 ++[auth_log] returns ok ++? if (User-Name =~ /^(host\/.*)/i) ? Evaluating (User-Name =~ /^(host\/.*)/i) -> FALSE ++? if (User-Name =~ /^(host\/.*)/i) -> FALSE ++? elsif (User-Name =~ /^(DOMAIN\\.*)/i) ? Evaluating (User-Name =~ /^(DOMAIN\\.*)/i) -> TRUE ++? elsif (User-Name =~ /^(DOMAIN\\.*)/i) -> TRUE ++- entering elsif (User-Name =~ /^(DOMAIN\\.*)/i) expand: %{User-Name} -> DOMAIN\randy.hall copy.user-name: Added attribute Stripped-User-Name with value 'DOMAIN\randy.hall' +++[copy.user-name] returns ok expand: ^(.*[\/]+) -> ^(.*[\/]+) strip-realm-name: Does not match: Stripped-User-Name = DOMAIN andy.halll +++[strip-realm-name] returns ok expand: [.] -> [.] expand: -> strip-period: Changed value for attribute Stripped-User-Name from 'DOMAIN andy.halll' to 'DOMAIN andy halll' +++[strip-period] returns ok ++- elsif (User-Name =~ /^(DOMAIN\\.*)/i) returns ok ++ ... skipping elsif for request 2: Preceding "if" was taken ++ ... skipping else for request 2: Preceding "if" was taken ++[chap] returns noop ++[mschap] returns noop -- View this message in context: http://www.nabble.com/User-Name-attribute-being-evaluated-as-regular-expres… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3