- Freeradius-Users - lists.freeradius.org

PEAP MSCHAP Problem
by Grooz, Marc (regio iT) 15 Feb '08

15 Feb '08

Hello, can some please help. Hello, we have a strange problem with the PEAP MSCHAP authentication truh WLAN. We use freeradius 1.1.7 on debian etch. 1. If we auth a ActiveDirectory User with automatic sending of username and password to our wlan everthing is OK. No lan-cabel is connected. In my case the Username is DOMAIN\\GroozMarc. 2. If we auth the same user with a lan-cabel connected. the auth fails. In this case the Username is DOMAIN\\groozmarc 3. If we auth the user without automatic sending of username and password and enter DOMAIN\\groozmarc and have lan connected everthing fine. Her is an output from case 2: rad_recv: Access-Request packet from host x , id=11, length=303 User-Name = "DOMAIN\\groozmarc" Calling-Station-Id = "x" Called-Station-Id = "x" NAS-Port = 2 NAS-IP-Address = x NAS-Identifier = "x" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "27" EAP-Message = 0x020a006a1900170301005fca5e86c4de36db061ffe1fc7f358599fa78cd53e221d2899 73525b8ed1328424653bad8e457757c9ae67d167a60b6 0585b1c37d22ed1377e9ed39b37901e7cf213d6a306ef154326ca0f6c2aad68111681c24 4b1523668e9effcfd97e1a216 State = 0xc1c18b62ee37419ada28a725693523d4 Message-Authenticator = 0x8dd2ca9d8fc2a09f7dcaef11b100f2c6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 106 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Got tunneled EAP-Message EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 PEAP: Setting User-Name to DOMAIN\groozmarc PEAP: Adding old state with 6a 6f PEAP: Sending tunneled request EAP-Message = 0x020a00531a020a004e310d11f40d775fc5fcb45ad88a7c4435830000000000000000b8 28c2bcb15e3c9ddaba50c2e6933328d1849c510dc9251 000524547494f49542d41414348454e5c47726f6f7a4d617263 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "DOMAIN\\groozmarc" State = 0x6a6f2590246560c8fdcd054d188cbb3f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 39 modcall[authorize]: module "preprocess" returns ok for request 39 modcall[authorize]: module "chap" returns noop for request 39 modcall[authorize]: module "mschap" returns noop for request 39 rlm_realm: No '@' in User-Name = "DOMAIN\groozmarc", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 39 rlm_eap: EAP packet type response id 10 length 83 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 39 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 39 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 39 modcall: leaving group authorize (returns updated) for request 39 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 39 rlm_eap: Request found, released from the list rlm_eap: EAP/mschapv2 rlm_eap: processing type mschapv2 Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 39 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for groozmarc with NT-Password radius_xlat: Running registered xlat function of module mschap for string 'NT-Domain' radius_xlat: '--domain=DOMAIN' radius_xlat: Running registered xlat function of module mschap for string 'User-Name' radius_xlat: '--username=groozmarc' radius_xlat: Running registered xlat function of module mschap for string 'Challenge' mschap2: e9 radius_xlat: '--challenge=d5ab398544877442' radius_xlat: Running registered xlat function of module mschap for string 'NT-Response' radius_xlat: '--nt-response=b828c2bcb15e3c9ddaba50c2e6933328d1849c510dc92510' Exec-Program output: Logon failure (0xc000006d) Exec-Program-Wait: plaintext: Logon failure (0xc000006d) Exec-Program: returned: 1 rlm_mschap: External script failed. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect modcall[authenticate]: module "mschap" returns reject for request 39 modcall: leaving group MS-CHAP (returns reject) for request 39 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns reject for request 39 modcall: leaving group authenticate (returns reject) for request 39 auth: Failed to validate the user. Login incorrect (rlm_mschap: Logon failure (0xc000006d)): [DOMAIN\\groozmarc/<no User-Password attribute>] (from client localhost p ort 0) PEAP: Got tunneled reply RADIUS code 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Processing from tunneled session code 0x80148570 3 MS-CHAP-Error = "\nE=691 R=1" EAP-Message = 0x040a0004 Message-Authenticator = 0x00000000000000000000000000000000 PEAP: Tunneled authentication was rejected. rlm_eap_peap: FAILURE modcall[authenticate]: module "eap" returns handled for request 39 modcall: leaving group authenticate (returns handled) for request 39 hope you can help. thanks! Kind regards Marc Grooz

2 3

Including files in from the dictionary files
by Wesley Schwengle 15 Feb '08

15 Feb '08

All, I have a question regarding including files. In the radiusd.conf I can include a file: $INCLUDE /path/to/file $INCLUDE ${prefix}/file However, in the dictionary file I cannot use ${prefix}: Errors reading dictionary: dict_init: /opt/freeradius-1.1.5/etc/raddb/dictionary[6]: Couldn't open dictionary "${prefix}/share/freeradius/dictionary.erx": No such file or directory Error: Errors reading dictionary: dict_init: /opt/freeradius-1.1.7/etc/raddb/dictionary[6]: Couldn't open dictionary "${prefix}/share/freeradius/dictionary.erx": No such file or directory I guess this is normal behaviour, but can anyone explain me why this behaviour is present? Cheers, Wesley

2 1

copy acct to home server
by Alexandre Chapellon 15 Feb '08

15 Feb '08

Hello, I want to use freeradius 2.0.1 to do accouting for my DSL users. I would like to acheive the following setup: NASes send request to the first radius (SunOS radius) which only handles authentication request and proxies accouting request to Freeradius (v2.0.1). I'd like freeradius to do several things: 1 - Do accounting to a mysql database 2 - Send accounting responses to the first radius 3 - proxy/copy accouting data to severals home server (3 servers: 1 billing server and 2 content filtering servers) To do this I setup freeradius 2.0.1 with 1 default virtual server writing accouting to mysql and to a detail file and one other virtual server which listen the detail file ( listen { type = detail....} ) and proxies request The problem is that the proxying is done for one request and stops when the response has been received.... so others request that are in the detail file are not proxied! does anybody have an idea / use this kind of setup? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

4 8

accounting & Interim-Update's on freeradius
by Joao Miguel Ferreira 15 Feb '08

15 Feb '08

Hello all, I'm a bit confuse here..... 1) -------------------------------------------- is it possible for a freeradius setup, runnging on a NAS system, via some authentication module, determine the traffic produced by a given user and autonomouslly send the Start, Interim-Update and Stop records to some _other_ Accounting Radius server ? Something like this: user1 --\ user2 ------<-->--|NAS w/ freeradius|-<------>-[Internet, www, ...] user3 --/ \ \ \ traffic records \ \ |freeradius accounting| -------------------------------------------------------------------- 2) if that is not possible, is there any kind of freeradius API for Linux (C++/Perl... ?!) that one can use in order to send such traffic accounting records ? --------------------------------------------- Cheers joao

2 1

Calling-Station-Id in pam_radius_auth
by Stefan Winter 15 Feb '08

15 Feb '08

Hi, a somewhat sophisticated problem: in a mail server, we'd like to record the IP address of the client that triggered the IMAP authentication request. The IMAP server uses PAM, specifically pam_radius_auth. Is there a way to tell pam_radius_auth to send a value in Calling-Station-Id? Is there a way at all to send variables to PAM at all, to be used for setting Calling-Station-Id within pam_radius_auth? We could also live with getting the value into PAM and then setting it into client_id= if Calling-Station-Id is not possible; string mangling on the server side would do nicely. Something like client_id=@{SOME_STRANGE_PAM_ITEM_WHICH_CONTAINS_MY_DESIRED_VALUE} as an option to pam_radius_auth? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 3

FreeRadius integration with MS Active Directory
by Rutger Beyen 15 Feb '08

15 Feb '08

Hello all, I'm following the howto http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO to integrate FreeRadius with Microsoft's AD. However, I'm experiencing some troubles. My disto is Debian 4. I had to install some packages, like krb5-kdc, krb5-user and krb5-config, to have the file /etc/krb5.conf (It wasn't there in the first place). When I want to do a net join, I get a message saying that I have errors in my krb5.conf file. I removed the lines "dns_lookup_realm = false" and "dns_lookup_kdc = false" and then it worked. At least I think it did. I got the message: joined "PROJECT" to realm "PROJECT.LOCAL". When I then wanted to test this using wbinfo, I get the error code "NT_STATUS_NO_SUCH_USER" (should be normal according to the howto) and another one: "NT_STATUS_ACCESS_DENIED" Could not authenticate user myuser with challenge/response. A try with ntlm_auth is also negative "NT_STATUS_NO_SUCH_USER". Can somebody please help me with my problem? Am I overlooking something or what am I doing wrong? Thanks a million, Rutger Here are the 2 config files: smb.conf [global] ## Browsing/Identification ### workgroup = project server string = %h server dns proxy = no #### Debugging/Accounting #### log file = /var/log/samba/log.%m max log size = 1000 syslog = 0 panic action = /usr/share/samba/panic-action %d ####### Authentication ####### # "security = user" is always a good idea. This will require a Unix account # in this server for every user accessing the server. See # /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/ServerType.html # in the samba-doc package for details. security = ads # You may wish to use password encryption. See the section on # 'encrypt passwords' in the smb.conf(5) manpage before enabling. encrypt passwords = true # If you are using encrypted passwords, Samba will need to know what # password database type you are using. passdb backend = tdbsam obey pam restrictions = yes ; guest account = nobody invalid users = root passwd program = /usr/bin/passwd %u passwd chat = *Enter\snew\sUNIX\spassword:* %n\n *Retype\snew\sUNIX\spassword:* %n\n *password\supdated\ssuccessfully* . # This boolean controls whether PAM will be used for password changes # when requested by an SMB client instead of the program listed in # 'passwd program'. The default is 'no'. ; pam password change = no ############ Misc ############ # Most people will find that this option gives better performance. # See smb.conf(5) and /usr/share/doc/samba-doc/htmldocs/Samba3-HOWTO/speed.html # for details # You may want to add the following on a Linux system: # SO_RCVBUF=8192 SO_SNDBUF=8192 socket options = TCP_NODELAY # Some defaults for winbind (make sure you're not using the ranges # for something else.) idmap uid = 10000-20000 idmap gid = 10000-20000 template shell = /bin/bash winbind use default domain = no password server = project-ad.project.local realm = project.local #======================= Share Definitions ======================= [homes] comment = Home Directories browseable = no # By default, the home directories are exported read-only. Change next # parameter to 'yes' if you want to be able to write to them. writable = yes # File creation mask is set to 0700 for security reasons. If you want to # create files with group=rw permissions, set next parameter to 0775. create mask = 0700 # Directory creation mask is set to 0700 for security reasons. If you want to # create dirs. with group=rw permissions, set next parameter to 0775. directory mask = 0700 # Restrict access to home directories # to the one of the authenticated user # This might need tweaking when using external authentication schemes valid users = %S # Un-comment the following and create the netlogon directory for Domain Logons # (you need to configure Samba to act as a domain controller too.) ;[netlogon] ; comment = Network Logon Service ; path = /home/samba/netlogon ; guest ok = yes ; writable = no ; share modes = no krb5.conf [logging] default = FILE:/war/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [libdefaults] default_realm = PROJECT.LOCAL # dns_lookup realm = false # dns_lookup_kdc = false # The following krb5.conf variables are only for MIT Kerberos. krb4_config = /etc/krb.conf krb4_realms = /etc/krb.realms kdc_timesync = 1 ccache_type = 4 forwardable = true proxiable = true # The following libdefaults parameters are only for Heimdal Kerberos. v4_instance_resolve = false v4_name_convert = { host = { rcmd = host ftp = ftp } plain = { something = something-else } } fcc-mit-ticketflags = true [realms] PROJECT.LOCAL = { kdc = project-ad.project.local:88 admin_server = project-ad.project.local default_domain = project.local } [domain_realm] .project.local = PROJECT.LOCAL project.local = PROJECT.LOCAL [kdc] profile = /var/kerberos/krb5kdc/kdc.conf [appdefaults] pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } [login] krb4_convert = true krb4_get_tickets = false

2 1

EAP session matching the State variable.
by Norbert Wegener 15 Feb '08

15 Feb '08

With 2.0.0 sometimes I get this error message, that I have not seen before: rlm_eap: No EAP session matching the State variable. rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT This does not sound good, as there is no real load on the server and the same client will be authenticated some time later without configurational changes. If neccessary, I can provide the long log. Norbert Wegener

8 32

detail file reading
by Alexandre Chapellon 14 Feb '08

14 Feb '08

I upgraded to 2.0.2 but still have a problem with reading detail (to do copy-acct-to-home-server ): It only processes the first request of the detail file and stops after receiving the accouting response. May some one help me? here follows part of freeradius -X: Polling for detail file /var/log/freeradius/radacct/detail detail_recv: Read packet from /var/log/freeradius/radacct/detail User-Name = "DFXMFhhp@XXX" Acct-Status-Type = Stop Acct-Session-Id = "0302003F28000772-47B49055" .... server copy-acct-to-home-server { +- entering group preacct rlm_realm: Looking up realm "XXX" for User-Name = "DFXMFhhp@XXX" rlm_realm: Found realm "XXX" rlm_realm: Proxying request from user DFXMFhhp to realm XXX rlm_realm: Adding Realm = "XXX" rlm_realm: Preparing to proxy accounting request to realm "XXX" ++[suffix] returns updated +- entering group accounting ++[ok] returns ok } # server copy-acct-to-home-server Sending Accounting-Request of id 21 to a.b.c.d port 1813 User-Name = "DFXMFhhp@XXX" Acct-Status-Type = Stop Acct-Session-Id = "0302003F28000772-47B49055" .... Proxying request 2 to home server a.b.c.d port 1813 Sending Accounting-Request of id 21 to a.b.c.d port 1813 User-Name = "DFXMFhhp@XXX" Acct-Status-Type = Stop Acct-Session-Id = "0302003F28000772-47B49055" .... Going to the next request Waking up in 0.5 seconds. rad_recv: Accounting-Response packet from host a.b.c.d port 1813, id=21, length=27 Proxy-State = 0x3438353131 server copy-acct-to-home-server { } # server copy-acct-to-home-server Finished request 2. Going to the next request Waking up in 0.5 seconds. Cleaning up request 0 ID 211 with timestamp +15

1 0

virtual servers
by Stefan Winter 14 Feb '08

14 Feb '08

Hi, just switching from a 1.1.7 with an incredibly sophisticated policy engine to a virtual-server based, simple 2.0 setup here. From what I see so far, virtual servers really rock. There's just one use case not entirely clear to me: I receive requests from a proxy who in turn has multiple clients behind. I want to decide stuff based on who *that other server's* clients are. It works today by tagging packets on that proxy with a VSA, upon which the home server decides the applicable policy. If I want to get that done with 2.0, I'm unsure how to proceed. If I get a tagged packet from the proxy and assign this proxy's IP address to a virtual server, I could process its VSAs in that server. But then I would ideally like to re-distribute the packets after that to their own virtual servers. Kind of like: in authorize, find out about the VSA, then set a magic variable "Handoff-to-Virtual-Server := someserver", and then the packet gets handed to that other virtual server automatically. Does that make any sense? How do I do that? Greetings, Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 2

"rlm_sql_mysql.so" where do I locate this file and its associated files for CentOS to run freeRadius and MySQL
by johnson elangbam 14 Feb '08

14 Feb '08

Hi, I am trying to build a radius with free radius 2.0.0 using MySql 4.1.2and I am getting the following errors rlm_sql (sql): Could not link driver rlm_sql_mysql: rlm_sql_mysql.so: cannot open shared object file: No such file or directory rlm_sql (sql): Make sure it (and all its dependent libraries!) are in the search path of your system's ld. /usr/local/etc/raddb/sql.conf[22]: Instantiation failed for module "sql" /usr/local/etc/raddb/sites-enabled/default[124]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/default[34]: Errors parsing authorize section. where do I locate this file With Regards Elangbam Johnson

2 1