- Freeradius-Users - lists.freeradius.org

Denying user from authentication
by anoop_c＠sifycorp.com 18 Sep '07

18 Sep '07

Hi I am using EAP_TLS authentication with free radius 1.1.7 .The authentication is a certificate based one. I want to reject one user .I have done config in users file anoop07 Auth-Type := Reject Reply-Message = \"Your account has been disabled.\" Stll the user autheticates.How can i prevent user like this? Regards Anoop

3 2

Authentication failure via PAP
by Thomas Schmitz 18 Sep '07

18 Sep '07

Hi, I'm using Freeradius 1.1.6 inside a Solaris 10 zone and compiled it from vanilla sources. I configured rlm_ldap since the usernames and cleartext-passwords are stored in an LDAP directory and it works just fine for applications like Cisco-VPN or 802.1X EAP-TTLS. Now I wanted to set up the Captive Portal of pfsense/m0n0wall to authenticate against radius, which is using PAP for password transmission but authentication always fails even if I triple-check the entered user credentials. The freeradius log always says: Auth: Login incorrect (rlm_ldap: Bind as user failed): [my_username] (from client pfsensebox port 1 cli 00:17:f2:xx:yy:zz) Of course I also checked if the radius client is using the correct secret. I set auto_headers to "yes" as it is suggested in the rlm_pap manpage and put pap at the end of the authorize section. I also included an excerpt of my radiusd.conf ---begin radiusd.conf--- modules { pap { auto_header = yes } ldap { server = "ldapserver.mydomain.com" basedn = "ou=people,o=my organization,c=de" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } } authorize { auth_log chap mschap suffix eap ldap files daily pap } authenticate { pap chap mschap ldap eap } ---end radiusd.conf--- Here is an output of radiusd -X: ---begin radiusd -X output--- rad_recv: Access-Request packet from host 111.222.333.444:51087, id=255, length=131 NAS-IP-Address = 111.222.333.444 NAS-Identifier = "pfsense.local" User-Name = "my_username" User-Password = "\301q\202\355g\264g)N\265\315\311\374\205i" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 1 Framed-IP-Address = 192.168.23.200 Called-Station-Id = "00:01:02:xx:yy:zz" Calling-Station-Id = "00:17:f2:aa:bb:cc" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/opt/radiusd/var/log//radacct/auth-detail-200709' rlm_detail: /opt/radiusd/var/log//radacct/auth-detail-%Y%m expands to /opt/radiusd/var/log//radacct/auth-detail-200709 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "my_username", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "my_username" rlm_realm: Proxying request from user my_username to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for my_username radius_xlat: '(uid=my_username)' radius_xlat: 'ou=people,o=my organization,c=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to directory.fernuni-hagen.de:389, authentication 0 rlm_ldap: bind as / to directory.fernuni-hagen.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=my organization,c=de, with filter (uid=my_username) rlm_ldap: checking if remote access for my_username is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding uid as User-Name, value my_username & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user my_username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "my_username" with password "Áq?íg ´g)NµÍÉü?i" rlm_ldap: user DN: uid=my_username,ou=People,o=my organization,c=de rlm_ldap: (re)connect to directory.fernuni-hagen.de:389, authentication 1 rlm_ldap: bind as uid=my_username,ou=People,o=my organization,c=de/Áq?íg´g)NµÍÉü?i to directory.fernuni-hagen.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [my_username] (from client pfsensebox port 1 cli 00:17:f2:aa:bb:cc) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! ---end radiusd -X output--- What seems very curious to me is that my password, though delivered in cleartext, seems broken since the password in the following line is actually not the real password: rlm_ldap: login attempt by "my_username" with password "Áq?íg ´g)NµÍÉü?i" Is it the client that does those nasty things or is my freeradius just misconfigured? How can I get it to work? Thanks in advance, Thomas

2 1

Trouble configuring SQL data store for users (second attempt)
by Bill Shaver 18 Sep '07

18 Sep '07

Please forgive the duplicate post. I posted this a few days back and didn't see any response; thought I would give it just one more try. Thanks for any response. --Bill I have started to experiment with using mysql as the datastore for users and clients instead of the default file method for my relatively small installation. Right now my work is on a test system and all is working well, with one exception: a user that is a member of two or more groups. Based on all I have read, this last thing should be very basic. If I put the user in only groupA (in the usergroup table), the test works great. If I put user1 in only groupB, the test works great. When I put user1 in both groupA and groupB in the usergroup table it will only work against the first record of the two, the second record always returns a failure. I am sure this is probably something really stupid, but I just cannot see it. Any help would be appreciated. I have attatched table dumps, sample commands, and a debug trace. I hope it is helpful Thanks, --Bill FreeRadius version 1.0.1 MySQL version 4.1.20 vm # /usr/bin/radtest -d /etc/raddb kparr@cisi password \ localhost:1645 10 naspass will sucseed, while vm # /usr/bin/radtest -d /etc/raddb kparr@syst password \ localhost:1645 10 naspass fails, but should sucseed The following is a test data set to validate a variety of cases that we need to support in our environment. select * from radcheck into outfile '/tmp/f1'; -------------------------------------------------------- id username attribute op value -- -------- --------- -- ----- 1 bill Password == userpass 5 guest01 Auth-Type := Local 6 guest01 Password == password select * from radreply into outfile '/tmp/f4'; -------------------------------------------------------- id username attribute op value -- -------- --------- -- ----- 7 guest01 Class := OU=Wireless; 8 guest01 Fall-Through := No select * from radgroupcheck into outfile '/tmp/f2'; -------------------------------------------------------- id groupname attribute op value -- -------- --------- -- ----- 6 LocalUnix Auth-Type == System 7 LocalUnix Realm == Test 9 LdapCiscoAdm Password == password 10 LdapCiscoAdm Auth-Type == Local 11 LdapCiscoAdm Realm == cisi 12 LdapHpReho Realm == syst 13 LdapHpReho Auth-Type == Local 14 LdapHpReho Password == password 15 Rejected Auth-Type := Reject select * from radgroupreply into outfile '/tmp/f3'; -------------------------------------------------------- id groupname attribute op value -- -------- --------- -- ----- 8 LocalUnix Service-Type = Login 0 9 LdapCiscoAdm Cisco-AVPair = shell:priv-lvl=15 0 10 LdapCiscoAdm Class := OU=cis; 0 11 LdapCiscoAdm Fall-Through := Yes 0 12 LdapCiscoAdm Service-Type = 6 0 13 LdapHpReho Class := OU=Proj; 0 14 LdapHpReho Fall-Through := Yes 0 15 Rejected Fall-Through := No 0 17 Rejected Reply-Message := Account is locked out. 0 select * from usergroup into outfile '/tmp/f5'; -------------------------------------------------------- id username groupname -- -------- --------- 9 root LocalUnix 10 kparr LdapCiscoAdm 11 kchow LdapHpReho 12 jpage Rejected 13 kparr LdapHpReho 14 bshaver LdapCiscoAdm -------------------------------------------------------- vm # radiusd -x Starting - reading configuration files ... Module: Loaded exec Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32773, id=23, length=62 User-Name = "kparr@cisi" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User kparr not found in radcheck rlm_sql (sql): Released sql socket id: 4 Sending Access-Accept of id 23 to 127.0.0.1:32773 Cisco-AVPair = "shell:priv-lvl=15" Class := 0x4f553d6369733b Service-Type = Administrative-User rad_recv: Access-Request packet from host 127.0.0.1:32773, id=27, length=62 User-Name = "kparr@syst" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User kparr not found in radcheck rlm_sql (sql): No matching entry in the database for request from user [kparr] rlm_sql (sql): Released sql socket id: 3 rad_recv: Access-Request packet from host 127.0.0.1:32773, id=27, length=62 Sending Access-Reject of id 27 to 127.0.0.1:32773

2 1

Solved: Gigawords
by Guilherme Franco 18 Sep '07

18 Sep '07

Hello, Just to note that oraclesql.conf (in 1.1.7) is wrong about the gigawords. The syntax for using bitwise operators is different in oracle and for such needs, you must use the BITAND function and its variants. But instead of doing bit shifts, I did this to solve it: AcctInputOctets = '%{Acct-Input-Octets}' + ('%{Acct-Input-Gigawords}' * 4294967296), AcctOutputOctets = '%{Acct-Output-Octets}' + ('%{Acct-Output-Gigawords}' * 4294967296) Guilherme Franco On 9/14/07, Guilherme Franco <guilhermefranco(a)gmail.com> wrote: > > Hi Mr. DeKok, > > Ok, I've just asked it because of: http://wiki.freeradius.org/index.php/FAQ#Why_do_Acct-Input-Octets_and_Acct-… > (which says that it should work in older versions) > > Also, the rlm_sql_log module version is the same in 1.1.7 as in 1.1.4 (v > 1.3.2.2 2005/12/12). > > Thank you. > > Guilherme Franco > > On 9/14/07, Alan DeKok <aland(a)deployingradius.com> wrote: > > > > Guilherme Franco wrote: > > > Hello, > > > > > > I'm using rlm_sql_log in freeradius 1.1.4. > > > > > > In order to correctly work with acct-input/ output gigawords, > > > > Upgrade to 1.1.7. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > >

2 1

Re: Working MAC-auth. in 1.1.7, not working in 2.0pre2 (noob-quiz)
by Piero Giobbi 17 Sep '07

17 Sep '07

Hi again. I had to make some testing just to be sure im not doing anything really stupid. Here below you can see my two test, one with User-Password and one with Cleartext-password, i can't make neither to work. Startup debian:/usr/local/etc/raddb# /usr/local/sbin/radiusd -v radiusd: FreeRADIUS Version 2.0.0-pre2, for host powerpc-unknown- linux-gnu, built on Sep 15 2007 at 06:11:44 Copyright (C) 2000-2007 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. ------------------------------------------------------------------------ ------------- debian:/usr/local/etc/raddb# /usr/local/sbin/radiusd -X -f -d /usr/ local/etc/raddb FreeRADIUS Version 2.0.0-pre2, for host powerpc-unknown-linux-gnu, built on Sep 15 2007 at 06:11:44 Copyright (C) 2000-2007 The FreeRADIUS server project. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Config: including file: /usr/local/etc/raddb/radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf Config: including file: /usr/local/etc/raddb/sql/mysql/dialup.conf Config: including file: /usr/local/etc/raddb/sql/mysql/counter.conf Config: including files in directory: /usr/local/etc/raddb/sites- enabled/ Config: including file: /usr/local/etc/raddb/sites-enabled/default Starting - reading configuration files ... read_config_files: reading dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no log_stripped_names = no log_file = "/usr/local/var/log/radius/radius.log" log_auth = no log_auth_badpass = no log_auth_goodpass = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { syslog_facility = "daemon" } proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } home_server localhost { ipaddr = 127.0.0.1 IP address [127.0.0.1] port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } listen { type = "auth" ipaddr = * port = 0 client 127.0.0.1 { secret = "testing123" shortname = "localhost" nastype = "other" } client 10.0.5.200 { secret = "xxx" shortname = "ap4000" nastype = "other" } } listen { type = "acct" ipaddr = * port = 0 } radiusd: entering modules setup radiusd: Library search path is /usr/local/lib instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } rlm_exec: wait=yes but no output defined. Did you mean output=none? Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } server { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = yes } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no } eap: Linked to sub-module rlm_eap_md5 eap: Instantiating eap-md5 eap: Linked to sub-module rlm_eap_leap eap: Instantiating eap-leap eap: Linked to sub-module rlm_eap_gtc eap: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support. rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support. eap: Linked to sub-module rlm_eap_mschapv2 eap: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/usr/local/etc/raddb/users" acctusersfile = "/usr/local/etc/raddb/acct_users" preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP- Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP- Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/usr/local/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/usr/local/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/usr/local/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } } Initializing the thread pool... Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. Nothing to do. Sleeping until we see a request. Test with User-password rad_recv: Access-Request packet from host 10.0.5.200 port 6001, id=27, length=151 User-Name = "00-1c-a4-6e-0e-fc" User-Password = "00-1c-a4-6e-0e-fc" NAS-IP-Address = 10.0.5.200 Called-Station-Id = "00-20-a6-6f-93-bf:My Wireless Network B" Calling-Station-Id = "00-1c-a4-6e-0e-fc" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "00-1c-a4-6e-0e-fc", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop WARNING: Found User-Password == "...". WARNING: Are you sure you don't mean Cleartext-Password? WARNING: See "man rlm_pap" for more information. users: Matched entry 00-1c-a4-6e-0e-fc at line 78 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 00-1c-a4-6e-0e-fc attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Sending delayed reject for request 0 Sending Access-Reject of id 27 to 10.0.5.200 port 6001 User creds 00-1c-a4-6e-0e-fc User-Password=="00-1c-a4-6e-0e-fc" Calling-Station-Id=="00-1c-a4-6e-0e-fc", NAS-IP-Address = 82.182.120.201, Called-Station-Id = "00-20-a6-6f-93-bf:My Wireless Network B", Service-Type = Framed-User, Framed-Routing = Broadcast-Listen,a Calling-Station-Id = "00-1c-a4-6e-0e-fc", NAS-Port = 9, NAS-Port-Type = Wireless-802.11 ________________________________________________________ (exactly the same startup) Test with Cleartext-Password rad_recv: Access-Request packet from host 10.0.5.200 port 6001, id=28, length=151 User-Name = "00-1c-a4-6e-0e-fc" User-Password = "00-1c-a4-6e-0e-fc" NAS-IP-Address = 10.0.5.200 Called-Station-Id = "00-20-a6-6f-93-bf:My Wireless Network B" Calling-Station-Id = "00-1c-a4-6e-0e-fc" NAS-Port = 9 NAS-Port-Type = Wireless-802.11 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound rlm_realm: No '@' in User-Name = "00-1c-a4-6e-0e-fc", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 00-1c-a4-6e-0e-fc attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Sending delayed reject for request 0 Sending Access-Reject of id 28 to 10.0.5.200 port 6001 User creds 00-1c-a4-6e-0e-fc Cleartext-Password=="00-1c-a4-6e-0e-fc" Calling-Station-Id=="00-1c-a4-6e-0e-fc", NAS-IP-Address = 82.182.120.201, Called-Station-Id = "00-20-a6-6f-93-bf:My Wireless Network B", Service-Type = Framed-User, Framed-Routing = Broadcast-Listen, Calling-Station-Id = "00-1c-a4-6e-0e-fc", NAS-Port = 9, NAS-Port-Type = Wireless-802.11 In both cases i get something strange that i cant find anywhere in the configs: Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> 00-1c-a4-6e-0e-fc attr_filter: Matched entry DEFAULT at line 11 What does this mean? Thx and good night. p On Sep 17, 2007, at 5:56 PM, freeradius-users- request(a)lists.freeradius.org wrote: >> OMG! Im so sorry Alan - that was too easy (and im a noob). If i ever >> walk by your house you can get a free shot at me. : ) > > as a resident of nottingham , UK, my neighbours might get their shot > off first! ;-) > >> Many thx again A - you'r the man, as always. > > I'm guessing it worked then? ;-)

3 2

Re: Configuring FreeRADIUS to use ntlm_auth
by charles＠copel.com 17 Sep '07

17 Sep '07

Alan: Thanks for your atention and patience ... I start again the "Deploying Radius ..." with default configuration files "users" and "radiusd.conf" and following the instructions on the web page: 1) Configuring Authentication against Active Directory -> It´s OK ... My Samba is working correctly. I tested it with "wbinfo" and "ntlm_auth" commands. 2) Configuring FreeRADIUS to use ntlm_auth -> It´s OK ... The radtest worked well without problems. 3) Configuring FreeRADIUS to use ntlm_auth for MS-CHAP -> It didn´t work ... I don´t know what is wrong ... My output FreeRadius presents the same messages that previously: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "/usr/local/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{mschap:NT-Domain:-copel} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" Module: Instantiated mschap (mschap) exec: wait = no exec: program = "/usr/local/bin/ntlm_auth --request-nt-key --domain=COPEL --username=%{mschap:User-Name} --password=%{User-Password}" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" Module: Instantiated exec (ntlm_auth) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 10.4.3.248:32768, id=105, length=65 User-Name = "copel\\charles" User-Password = "password" Service-Type = Authenticate-Only NAS-IP-Address = 200.195.147.120 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "copel\charles", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 154 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 105 to 10.4.3.248 port 32768 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 105 with timestamp 46eec968 Nothing to do. Sleeping until we see a request. What more should I check or configure and how ? Best Regards. Charles. Alan DeKok <aland(a)deployingradius.com> Enviado Por: freeradius-users-bounces(a)lists.freeradius.org 17/09/2007 11:55 Favor responder a FreeRadius users mailing list Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> cc: cco: Charles Alcantara Borba/COPEL Assunto: Re: Configuring FreeRADIUS to use ntlm_auth charles(a)copel.com wrote: > I think that I did just some changes describes in the document with the > files: > the users file: it is original (I delete the testing entry used "user > Auth-Type := ntlm_auth"); Which is why it's not using ntlm_auth for authentication. > the radisud.conf file: it is original with following changes: ... And the server hasn't been told *how* to authenticate users. It either needs to be told what the "known good" password is, OR it needs to be told who else on the network can authenticate the user. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html Esta mensagem e seus anexos foram verificados por software anti-vírus. Recomenda-se que não sejam abertos e/ou executados anexos de mensagens de conteúdo ou remetente duvidoso.

3 2

How to combine mac and web based authentication
by pull 17 Sep '07

17 Sep '07

Hi, I've already searched for it on the net and in this forum but there was no real information. I would need a 2 step authentication. First the mac-based authentication (with a switch that supports mac based auth) and secondly the web-based authentication. But I don't know how to combine these two within the radius configuration :-/. Since it's a closed LAN the clients who were successfully authenticated with their mac address have normal access to the LAN. When for example some guests come (they come rather often) they'll fail the authentication and get into an "guest lan". There they should authenticate themselves a second time against the radius server with a username/password login (web page for example) so they only can access the internet. That would be the problem - to make this second authentication Help is greatly appreciated! pull -- View this message in context: http://www.nabble.com/How-to-combine-mac-and-web-based-authentication-tf446… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 3

PEAP/MS-CHAPv2 and the Windows XP default wireless client
by Terry Pelley 17 Sep '07

17 Sep '07

FreeRADIUS Version 1.1.3-r0.1.2 (Upgrade is Pending) I have all of my Cisco AP1231's set to do PEAP/MS_Chapv2 authentication and would like to allow users that wish to use the default windows wireless client to send their windows login and password to the RADIUS server by default. The problem I am having is that the supplicant(s) are sending their fully qualified username in the following manner. User-Name = "ComputerName\\Username" User-Password = "Password" FreeRADIUS expects the request(s) like this. User-Name = "Username" User-Password = "Password" How do I get FreeRADIUS to ignore the \\ComputerName prefix? Thanks in advance, Terry Pelley Network Analyst Business and Learning Technologies Ottawa-Carleton District School Board terry.pelley(a)ocdsb.ca

2 1

Multiple Huntgroups for one User? 2nd Try
by Alexander Papenburg 17 Sep '07

17 Sep '07

2nd Try, just in case my 1st message was not recognized ;-) Hi Freeradius-List, is it possible to give/deny access to multiple huntgroups for a single user/group? E.g.: User/group is denied to access hosts 10.0.0.1, 10.0.0.2 and 10.0.0.3 but is allowed to access all the other hosts in 10.0.0.0/24. Something like hostpools would be nice (e.g.: user/group1 can access pool1, pool2 and pool3. user2 can access pools 1+2 but is denied to access pool3). Thanks in advance, Alexander

2 3

AP bounces Access-Accept packet
by Wolfgang Burger 17 Sep '07

17 Sep '07

Hi, this is just a little test-setup I've made. I'm using a Netgear WG102 and freeRadius 1.1.7 The server is configured (I hope) to use a password-list (passwd in radiusd-conf) When I try to connect with a correct username and password from the list, this is what i see on the server: rad_recv: Access-Request packet from host 192.168.1.24:1031, id=7, length=164 Message-Authenticator = 0x320609cfc70f95aa5e480e1766fdf1d1 Service-Type = Framed-User User-Name = "isi" Framed-MTU = 1488 Called-Station-Id = "00184DFCC7B8:Gast" Calling-Station-Id = "0019E3D7B020" NAS-Identifier = "wg102" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000801697369 NAS-IP-Address = 192.168.1.24 NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "isi", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_passwd: Added User-Password: 'glock' to config_items rlm_passwd: Adding "Auth-Type = accept" modcall[authorize]: module "userlist" returns ok for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type accept rad_check_password: Auth-Type = Accept, accepting the user Sending Access-Accept of id 7 to 192.168.1.24 port 1031 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Accept packet from host 192.168.1.24:1031, id=7, length=20 Authentication reply packet code 2 sent to a non-proxy reply port from client wg102:1031 - ID 7 : IGNORED And then it starts again. Can somebody tell me what is happening here? What am I doing wrong? Thanks a lot Wolfgang Burger

2 1