- Freeradius-Users - lists.freeradius.org

odd user authenticated...
by Joe Vieira 19 Sep '07

19 Sep '07

Hello, Here is the run down on my set up. RHEL5 64bit - freeradius 1.1.6, samba 3.0.23c-2, using peap(ms-chapv2)/ ntlm_auth for authentication and ldap for authorization. so I have ntlm_auth configured and working correctly. everytime a specific user logs in, i see this directly after his login success. 80986-Tue Sep 18 17:10:37 2007 : Auth: Login OK: [students\\USER/<no User-Password attribute>] (from client UNKNOWN-CLIENT port 0) <- user auth line. 80987:Tue Sep 18 17:10:37 2007 : Auth: Login OK: [RUN\\\305\355\277\255/<no User-Password attribute>] (from client wism2 port 29 cli 00-1B-77-27-B2-48) <- freaky line now, that looks like extended unicode to me in the username...obviously we don't have a user named that, or even a domain named 'RUN', moreover it doesn't seem like that "username" should even have been authorized thru the ldap rules.... -- Joe Vieira UNIX Systems Administrator Clark University - ITS

2 1

Freeradius +MS Win XP (EAP) problems
by Sergio Belkin 19 Sep '07

19 Sep '07

Hi, I want to configure freeradius (Linux) in order to authenticate and authorize MS Windows XP clients (people connect to Access Point Linksys). I am using EAP-PEAP and MSCHAP fron Windows. If I perform radtest from linux clients (using wired network) I have no problem to access, but I cannot from Windows XP, this is the messages when I run usinf radiusd -X: rad_recv: Access-Request packet from host 10.30.1.151:1032, id=66, length=115 User-Name = "sbelki" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020400061900 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0xbee0745e6005b8a43128657ff16d08ea Message-Authenticator = 0xc6044fc3eb7975f75f9afd9edfcca489 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 55 modcall[authorize]: module "preprocess" returns ok for request 55 modcall[authorize]: module "chap" returns noop for request 55 modcall[authorize]: module "mschap" returns noop for request 55 rlm_realm: No '@' in User-Name = "sbelki", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 55 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 55 users: Matched entry DEFAULT at line 159 modcall[authorize]: module "files" returns ok for request 55 rlm_ldap: - authorize rlm_ldap: performing user authorization for sbelki radius_xlat: '(uid=sbelki)' radius_xlat: 'ou=people,dc=palermo,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=people,dc=palermo,dc=edu, with filter (uid=sbelki) request 57 done rlm_ldap: checking if remote access for sbelki is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value sample & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user sbelki authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 55 modcall: group authorize returns updated for request 55 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 55 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 55 modcall: group authenticate returns handled for request 55 Sending Access-Challenge of id 66 to 10.30.1.151:1032 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x06bc31779a10f85cd934953e650bc051 Finished request 55 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 52 ID 63 with timestamp 46f01fd7 Cleaning up request 53 ID 64 with timestamp 46f01fd7 Cleaning up request 54 ID 65 with timestamp 46f01fd7 Cleaning up request 55 ID 66 with timestamp 46f01fd7 ***And This is the eap.conf: ********* eap { default_eap_type = mschapv2 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { private_key_password = "" private_key_file = /etc/pki/tls/certs/radius.key certificate_file = /etc/pki/tls/certs/radius.crt CA_file = /etc/pki/CA/cacert.pem dh_file = /etc/raddb/certs/dh random_file = /dev/urandom include_length = yes } ttls { default_eap_type = md5 } peap { default_eap_type = mschapv2 } mschapv2 { } } Please tell me if something of this file is wrong. Thanks in advance!! -- -- Sergio Belkin -

2 3

Re: Controlling access to my Wireless network
by Arjuna Scagnetto 19 Sep '07

19 Sep '07

>> network, mac & xp. I wouldn't mind using plain text passwords if that could >> be forced. The only configurations that get close to working get as far as >> machapv2, then fail because of no nt/lm password. If I could use the >> password from my ldap connection which seems to be working nicely, then I >> would be thrilled. Could you give me the eap.conf that would do that? >> Thanks a million > > it wouldnt be in your eap.conf for a start - if you want to use PEAP against > your LDAP then you'll most likely need to put the NT hash of their password > into your LDAP directory and point to that instead in your LDAP checks. > a lot (a LOT) of people do this and are present on this list. if you want > to use plain test password checks then EAP-TTLS with PAP inner is one > of the only ways - but for that you'll need to install extra software > on the WinXP machines securew2 is free and enables winxp to recognize ttls-pap packets. arjuna

1 0

RE: RFC 3579 and Access-Accepts
by Josh Howlett 19 Sep '07

19 Sep '07

Hi Stefan, > Whereas RFC 3579 , chapter 2.6.5 says: > "An EAP-Message/EAP-Request/Notification SHOULD NOT be > included within an Access-Accept or Access-Reject packet." I think this is a case of mis-reading the (confusing?) notation used by the RFC. What the RFC is saying is that you are not permitted to include a Notification within an EAP-Request within an EAP-Message within an Access-Accept. It's not saying you're not allowed to include an EAP-Message attribute _per se_. FWIW, I don't think it would be possible to implement a compliant EAP method without including an EAP-Message in the Access-Acccept; you need to return an EAP-Success or EAP-Failure, and IIRC you can't do that in an Access-Challenge. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

1 0

RFC 3579 and Access-Accepts
by Stefan Winter 19 Sep '07

19 Sep '07

Hello, it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in: Packet-Type = Access-Accept Wed Sep 19 11:59:25 2007 MS-MPPE-Recv-Key = stuff MS-MPPE-Send-Key = morestuff EAP-Message = 0x03070004 Message-Authenticator = 0x593773a711f50bd8b4ce98434a7e1590 User-Name = "anonymous(a)restena.lu" Proxy-State = 0x323039 Whereas RFC 3579 , chapter 2.6.5 says: "An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet." This is now the second RADIUS implementation I see that behaves like that - is there a reason for the EAP-Message and something wrong with 3579, or is that SHOULD NOT just ignored by most? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 3

Re: Denying user from authentication
by anoop_c＠sifycorp.com 19 Sep '07

19 Sep '07

Hi Please explain brief about certificate revocation process as i am new to it.I have used openssl for creating certificates, Regards Anoop > Message: 3 > Date: Wed, 19 Sep 2007 10:36:18 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <QH9ZAN8X.1190194578.4188440.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > That won\'t work with EAP-TLS. As you found out. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 19/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> pi?e: > > >HI > > Thank you for the response.But as per users file configuration it > should deny the user if i include that user name-reject file.Do i need > to do any config for this to work. > > > >Regards > >Anoop > > > > > >> Message: 3 > >> Date: Tue, 18 Sep 2007 11:30:53 +0100 > >> From: <tnt(a)kalik.co.yu> > >> Subject: Re: Denying user from authentication > >> To: \"FreeRadius users mailing list\" > >> <freeradius-users(a)lists.freeradius.org> > >> Message-ID: <PsdtHepQ.1190111453.3996530.tnt(a)kalik.co.yu> > >> Content-Type: text/plain; charset=ISO-8859-2 > >> > >> Revoke the certificate. > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> > >> Dana 18/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> > pi?e: > >> > >> >Hi > >> > I am using EAP_TLS authentication with free radius 1.1.7 .The > >> authentication is a certificate based one. > >> > > >> > I want to reject one user .I have done config in users file > >> > > >> > anoop07 Auth-Type := Reject > >> > Reply-Message = \"Your account has been disabled.\" > >> > > >> >Stll the user autheticates.How can i prevent user like this? > >> > > >> >Regards > >> >Anoop > >> > > >> > > >> > > >> > > >> > >> > >>

2 1

Denying user from authentication
by anoop_c＠sifycorp.com 19 Sep '07

19 Sep '07

HI Thank you for the response.But as per users file configuration it should deny the user if i include that user name-reject file.Do i need to do any config for this to work. Regards Anoop > Message: 3 > Date: Tue, 18 Sep 2007 11:30:53 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <PsdtHepQ.1190111453.3996530.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Revoke the certificate. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 18/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> pi?e: > > >Hi > > I am using EAP_TLS authentication with free radius 1.1.7 .The > authentication is a certificate based one. > > > > I want to reject one user .I have done config in users file > > > > anoop07 Auth-Type := Reject > > Reply-Message = \"Your account has been disabled.\" > > > >Stll the user autheticates.How can i prevent user like this? > > > >Regards > >Anoop > > > > > > > > > > > > ------------------------------ > > Message: 4 > Date: Tue, 18 Sep 2007 14:12:50 +0200 > From: inverse <inverse(a)ngi.it> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <32deb3e30709180512k2361fb99x10f3e4693930f899(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > and make sure to use check_crl = yes in eap.conf > > On 9/18/07, tnt(a)kalik.co.yu <tnt(a)kalik.co.yu> wrote: > > Revoke the certificate. > > > ------------------------------ >

2 1

Controlling access to my Wireless network.
by Kent Thomas 19 Sep '07

19 Sep '07

Hello all, I'm looking for a simple way to protect access to my wireless network. I'm seeing a lot of old documentation on how to use EAP-TLS to protect the wireless network. I've found lots of old documentation on how to setup WPA Enterprise. I would like some updated docuentation on how to do this. I have a couple SonicWall SonicPoint devices that have the capability to do WPA Enterprise or WPA2 enterprise or both. I would like to be able to have a user attempt to join my wireless network, but be presented with the request for Username and Password. From there I would like to be able to have their connection authenticated and then allow them on. No authentication, no getting on. Securing the wireless signal is not the primary focus here. Securing the access to the network is. Is there a way to do this? I have FreeRadius 1.1.7 installed and working and currently will authenticate against my ldap server. Thank you for lending a hand to a newby here. Kent

5 8

Radrelay with multiple accounting files, radrelay via NFS
by Adam Bultman 19 Sep '07

19 Sep '07

Good morning, freeradius users. I have 2.5 questions. 1. Can radrelay be used with multiple accounting directories? I have multiple (7) directories with files I need to be watching with radrelay. I haven't been able to get radrelay to work properly when I use "-a /accounting-dir/" multiple times at the command line. 1.5: Can one use wildcards for the detailfile? I have two RADIUS servers, and each writes to it's own file (detail-radius1, detail-radius2) 2. On linux, radrelay doesn't appear to agree with NFS. I tried to host my detail files via NFS, and radrelay would 'run', but not actively process records. The radrelay debug would tell me it was "processing records", but would never send any packets. Meanwhile, the detail file it was supposed to be watching is ballooning with records. 2.5. Note: We have a solaris server where radrelay runs fine via NFS. I'm not too big a newbie to freeradius, but I'm trying to avoid running one process per NAS I need to monitor, and have my radius detail files split (some detail files via NFS, other detail files locally on the machine.) I've read man pages and googled, but haven't found answers. I *do* need to store my files via NFS, for accounting reasons, and doing copies to an NFS mount isn't really an option, either. Any help would is welcomed. Adam

2 1

Intel Proset Wireless Client does not process RFC3580 Attributes.
by Terry Pelley 18 Sep '07

18 Sep '07

FreeRADIUS Version 1.1.3-r0.1.2 (Upgrade to 1.1.7 is Pending) I am running FreeRADIUS to authenticate wireless users on a bunch of Cisco AP1231's. My wireless supplicants are running a combination of the standard Windows XP client which works fine and the Intel Proset Client which is causing problems. The Radius setup is for PEAP/MSChapv2 and each user has the following attributes assigned. Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-ID = "X" (Where X is the assigned VLAN Number) The Proset Clients do manage to eventually authenticate, but the above attributes do not appear to get processed. I think this is happening because the Proset Client sends the User-Name as "anonymous" and as there is no "anonymous" user defined, the attributes do not get applied. How do I get the User-Name to be sent correctly? Thanks in advance. Terry Pelley Network Analyst Business and Learning Technologies Ottawa-Carleton District School Board terry.pelley(a)ocdsb.ca

2 2