- Freeradius-Users - lists.freeradius.org

Problems regarding MAC address authentication
by Shobhit Jindal 12 Feb '07

12 Feb '07

Hi, am trying to implement a WPA2 authentication system where users will be matched against the three criteria - user name - password - MAC address am using freeradius 1.0.1 with openldap 2.2.13 at its backend on CentOS 4.4 after extensively searching on google and freeradius-users mailing lists am able to do username/password authentication successfully using PEAP but am unable to get MAC authentication working and have run out of my wits myself had followed the tutorial on http://vuksan.com/linux/dot1x/802-1x-LDAP.html which worked great but am stuck on MAC address authentication. its repeatedly mentioned on mailling lists that MAC authentication is possible but i cant figure out how to do so hoping for some help thanks -- Registerd Linux User #426561 - Shobhit Jindal B.Tech. Part-III, Department Of Electronics Engineering, ITBHU INDIA

3 2

session wait time after session timeout
by Cory Robson 12 Feb '07

12 Feb '07

Not sure if anyone has done something like this as of yet with freeradius. What I'm trying to achieve (without knowing how to implement) is create a timeout period after a session timeout. IE user is allowed to login for a 4 hour session after which they cannot login again for at least say fifteen minutes, currently users can just login straight back into the system and continue on. Has anyone implemented such a solution and how would I go about achieving the same ? Cory

2 1

Forward a request to another radius service
by Sinan Ulker 10 Feb '07

10 Feb '07

Hi, How can i forward a the request of radius client to another radius service, by only one user ? Thanks..

2 1

Starting radius issue - configuration files globaly readable.
by tzieleniewski 10 Feb '07

10 Feb '07

Hi! I have just compiled the latest CVS and whenever I try to start radius I get the following info: Configuration file /home/radius/freeradius/raddb/radiusd.conf is globally readable. This is because I use the symbolic links to files. Can this restriction be somehow removed?? Bests -tomasz

4 6

Mysql - radcheck, radreply, radgroupcheck and radgroupreply
by "Fabrício F. Kammer" 09 Feb '07

09 Feb '07

Hi, I'm using Freeradius + Mysql to do the MAC Address authentication of the clients that connection on my APs (Mikrotik machines). In the mysql I've the follow: Table usergroup: UserName = MAC address GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Table radgroupcheck: GroupName = NAS-Port-ID - (the name of the AP where the client will be connected - ex. "MyAP1") Then I've four lines for each GroupName with the follow: Attribute: "Auth-Type" // op: ":=" // Value: "Local" Attribute: "NAS-IP-Address" // op: "==" // Value: "IP of the AP" Attribute: "NAS-Port-Identify" // op: "==" // Value: "Name of the AP - Ex: MyAP1" On the table radcheck I don't have anything. This table is empty. In the table radreply I've one record: UserName: "MAC Address of the client" Attribute: "Mikrotik-Rate-Limite" op: "=" Value: "64000/128000" The problem is: If the Freeradius don't find the UserName on the table radcheck it doesn't return the attributes that are on the table radreply, just the records of the table radgroupreply are returned. I need to return the reply different for each client because this parameter is the speed of upload and download and this values are different for each client. My questio is: Is it possible that the Freeradius return the values of the table radreply if I don't have any value on the radcheck? (The authentication was made in the radgroupcheck table) Thanks in advanced, Fabrício F.: Kammer

1 0

Re: VPN authentication from Windows Vista
by david＠mitton.com 09 Feb '07

09 Feb '07

MS-Chap is in RFC 2433 (Oct 1998) MS-Chap V2 is in RFC 2759 (Jan 2000) see also Microsoft Specific RADIUS attributes - RFC 2548 (Mar 1999) Dave. ----Original Message---- From: p.mayers(a)imperial.ac.uk Date: Feb 9, 2007 6:01 To: "FreeRadius users mailing list"<freeradius-users(a)lists.freeradius. org> Subj: Re: VPN authentication from Windows Vista Lai Fu Keung wrote: > Hi, > > My users said the VPN login failed with their Windows Vista. > > I enabled freeradius debug. I came across an authentication method, > md5chap in debug output that my freeradius is currently not configured Do you mean "mschap"? > to support. If the user unselects "Require Data Encryption" in VPN. It > then works fine. It uses PAP and sends the password in plaintext (bad idea). Windows has always done that, back to win95. > > Can anyone confirm the following questions for me? > > 1. Is it that Vista uses md5chap for VPN authentication with "Data > Encryption"? Windows has always done that. > 2. Can freeradius be configured to support md5chap? Yes > > I don't get a lot of information about md5chap in google. I appreciate That's because there's no such thing - as I said, I think you mean "mschap" (or "MSCHAP" or "MS-CHAP" whichever they've called it). I don't have a vista box handy, I'll fire up a VM and take a look in a bit. > any pointers on this subject and how freeradius can be made to support > it, as radiusd.conf seems no mentioning on this subject. > > Thanks. > > Lai > > - > List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius. org/list/users.html

1 0

LDAP server contacted twice?
by Fabio Spelta 09 Feb '07

09 Feb '07

Hello everybody. We got a setup which does work in authenticating 812.1x users over a wired network by using EAP-MD5, checking authorization and authentication of the supplicant over a LDAP directory. What we do find strange (and pretty annoying, indeed) is that the we feel that the LDAP server does get contacted more than necessary, read: twice. Being more specific, when the freeradius server gets an ACCESS-REQUEST from the NAS, then radiusd does contact the LDAP server three times. The first time it does check for the existance of the user authenticating. The second, it checks if the users belong to a certain group specified with the Ldap-Group option. The third time it does grab the password from the user entry in the LDAP field and add it to the check item list.. So long, so well. What happens next? Next step is about the ACCESS-CHALLENGE. When radiusd is about to send it, it first checks the LDAP again. The same three times. Check for the users in the whole directory, check the belonging to the group, check the password again to calculate the hash. That results in six LDAP queries, we suspect that those can be reduced down to half but we can't find the point out. Thank you very much in advance. Here's the radiusd debug log (radiusd -X): rad_recv: Access-Request packet from host ********:37540, id=1, length=161 Message-Authenticator = 0x******** User-Name = "********" NAS-IP-Address = ******** Called-Station-Id = "********" NAS-Port = 21001 NAS-Port-Id = "fe.2.1" NAS-Port-Type = Ethernet Service-Type = Framed-User Calling-Station-Id = "********" EAP-Message = 0x******** Framed-MTU = 1300 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/********/auth-detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/********/auth-detail-20070209 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 24 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched DEFAULT at 8 users: Matched DEFAULT at 103 users: Matched DEFAULT at 105 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=********,dc=********' radius_xlat: '(uid=********)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ********:389, authentication 0 rlm_ldap: bind as cn=********,ou=********,dc=********,dc=********/******** to ********:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (&(cn= 802.1xwired)(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))) rlm_ldap::ldap_groupcmp: User found in group 802.1xwired rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 121 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ******** radius_xlat: '(uid=********)' radius_xlat: 'dc=********,dc=********' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ******** authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group Autz-Type returns ok for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type md5 rlm_eap_md5: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 1 to ********:37540 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Filter-Id = "Enterasys:version=1:mgmt=su:policy=admin" EAP-Message = 0x******** Message-Authenticator = 0x00000000000000000000000000000000 State = 0x******** Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host ********:37540, id=2, length=196 Message-Authenticator = 0x91c3c6cfd386855dc73803c5a3670318 User-Name = "********" State = 0xb9e826259b6a63f5c103fd209ffde50b NAS-IP-Address = ******** Called-Station-Id = "********" NAS-Port = 21001 NAS-Port-Id = "fe.2.1" NAS-Port-Type = Ethernet Framed-MTU = 1300 Service-Type = Framed-User Calling-Station-Id = "********" EAP-Message = 0x******** Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 radius_xlat: '/var/log/radius/radacct/********/auth-detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/********/auth-detail-20070209 modcall[authorize]: module "auth_log" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 41 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched DEFAULT at 8 users: Matched DEFAULT at 103 users: Matched DEFAULT at 105 rlm_ldap: Entering ldap_groupcmp() radius_xlat: 'dc=********,dc=********' radius_xlat: '(uid=********)' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: ldap_release_conn: Release Id: 0 radius_xlat: '(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (&(cn= 802.1xwired)(&(objectClass=GroupOfNames)(member=uid=********, ou=users, dc=********,dc=********))) rlm_ldap::ldap_groupcmp: User found in group 802.1xwired rlm_ldap: ldap_release_conn: Release Id: 0 users: Matched DEFAULT at 121 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 Processing the authorize section of radiusd.conf modcall: entering group Autz-Type for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for ******** radius_xlat: '(uid=********)' radius_xlat: 'dc=********,dc=********' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=********,dc=********, with filter (uid=********) rlm_ldap: Added password a in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ******** authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group Autz-Type returns ok for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/md5 rlm_eap: processing type md5 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 1 modcall: group authenticate returns ok for request 1 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 radius_xlat: '/var/log/radius/radacct/********/reply-detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/********/reply-detail-20070209 modcall[post-auth]: module "reply_log" returns ok for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: '********' rlm_sql (sql): sql_set_user escaped user --> '********' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', '********', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', '********', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 modcall[post-auth]: module "sql" returns ok for request 1 modcall: group post-auth returns ok for request 1 Sending Access-Accept of id 2 to ********:37540 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Filter-Id = "Enterasys:version=1:mgmt=su:policy=admin" EAP-Message = 0x******** Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "********" Finished request 1 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 1 with timestamp 45cc6700 Waking up in 6 seconds... rad_recv: Accounting-Request packet from host ********:37541, id=1, length=100 Acct-Status-Type = Start User-Name = "********" Calling-Station-Id = "********" NAS-IP-Address = ******** NAS-Port = 21001 Acct-Delay-Time = 0 Acct-Session-Id = "1000004F" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 2 modcall[preacct]: module "preprocess" returns noop for request 2 rlm_acct_unique: Hashing 'NAS-Port = 21001,Client-IP-Address = ********,NAS-IP-Address = ********,Acct-Session-Id = "1000004F",User-Name = "********"' rlm_acct_unique: Acct-Unique-Session-ID = "3974eb0b2b9f763c". modcall[preacct]: module "acct_unique" returns ok for request 2 rlm_realm: Looking up realm "********" for User-Name = "********" rlm_realm: No such realm "********" modcall[preacct]: module "suffix" returns noop for request 2 acct_users: Matched DEFAULT at 7 modcall[preacct]: module "files" returns ok for request 2 modcall: group preacct returns ok for request 2 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 2 modcall[accounting]: module "acct_unique" returns noop for request 2 radius_xlat: '/var/log/radius/radacct/********/detail-20070209' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/********/detail-20070209 modcall[accounting]: module "detail" returns ok for request 2 modcall[accounting]: module "unix" returns ok for request 2 radius_xlat: '/var/log/radius/radutmp' radius_xlat: ********' modcall[accounting]: module "radutmp" returns ok for request 2 radius_xlat: '********' rlm_sql (sql): sql_set_user escaped user --> '********' radius_xlat: 'INSERT into radacct ***************** rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 modcall[accounting]: module "sql" returns ok for request 2 modcall: group accounting returns ok for request 2 Sending Accounting-Response of id 1 to ********:37541 Finished request 2 -- Fabio

2 1

FreeRadius + OpenLDAP (SMD5) + Windows XP
by Mercier Romain 09 Feb '07

09 Feb '07

Hi, I got a simple question but I don?t find anything to answer it. Situation: I got a database OpenLDAP which contains users info, mainly ?uid? and ?userPassword? crypt with SMD5 and I can?t modify this encryption type. I want Wireless users to have to authenticate to access the WLAN without installing anything on users' PC (mainly Windows XP PCs). Question: Does anybody know if there is a way to authenticate users using this password ? I tried using a clear-text password and that works but I cannot and don't want to change userPassword encryption. Thanks a lot for any idea/help, Romain Mercier

3 5

AW: ntlm_auth authentication against multiple ADS domains
by Habegger Lukas, ERZ-AZD-AIL 09 Feb '07

09 Feb '07

Hi I don't know exactly what you have to do. I have implemented something like this. ------- ------- | RAD |---------| AD1 | ------- ------- | ------- ------------| AD2 | ------- It's done with a perl module over rlm_perl. The perl module looks for witch domain the request is and starts the right winbind-daemon. It's not really nice. The problem is that a samba server only could be member of one domain. The samba team said that samba4 would support more then one domain or you could change the samba3-code to support multiple sockets on winbind (i think it was discussed on the samba-mailinglist). If you can build trusts between the domains it's much more easier. This way you can auth on a single point. It should look like this ------- ------- | RAD |---------| AD1 | ------- ------- | ------- | AD2 | ------- A other way is to proxy the requests to a radius on the samba server. It looks like this ------- ------------- | RAD |---------| RAD - AD1 | ------- ------------- | ------------- ------------| RAD - AD2 | ------------- If you need more infos about my implementation write again. Lukas

1 0

ntlm_auth authentication against multiple ADS domains
by Dow, Corey 09 Feb '07

09 Feb '07

Hi All, This is more of an ntlm_auth how to than a FreeRADIUS question, but I thought I would post here since others may have run across this. We're trying to use ntlm_auth and FreeRADIUS to authenticate users against an ADS back-end. I've found several excellent articles on how to set this up, and I have it working with a single ADS domain. The problem I've encountered is performing authentication against multiple ADS domains using ntlm_auth. ADS Parent domain netidm.net ADS Child domain xyz.abc.com If I join to abc.com using net ads join, I can use ntlm_auth with no problems, but how do I perform authentications against xyz.abc.com ? I've tried: Ntlm_auth --request-nt-key --DOMAIN=XYZ --username=jdoe But I get an NT_STATUS_IO_TIMEOUT. I'm assuming this is because I'm joined to the Parent domain and not the child domain, but can't this work by only joining the one domain? # Samba Config workgroup = ABC server string = Samba Server security = ads load printers = yes log file = /usr/local/samba/var/log.%m max log size = 50 realm = ABC.COM wins server = 180.44.200.53 dns proxy = no comment = Home Directories browseable = no writable = yes comment = All Printers path = /usr/spool/samba browseable = no guest ok = no writable = no printable = yes #Kerberos Config default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log default_realm = ABC.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes ABC.COM = { kdc = 180.44.200.53:88 kdc = 180.44.200.54:88 } XYZ.ABC.COM = { kdc = 180.44.200.69:88 } .abc.com = ABC.COM abc.com = ABC.COM .xyz.abc.com = XYZ.ABC.COM xyz.abc.com = XYZ.ABC.COM profile = /var/kerberos/krb5kdc/kdc.conf pam = { debug = false ticket_lifetime = 36000 renew_lifetime = 36000 forwardable = true krb4_convert = false } Any help greatly appreciated. Corey Corey Dow Network Solution's Test Center ProCurve Networking by HP

3 2