- Freeradius-Users - lists.freeradius.org

Auth Type when running exec script to authenticate
by Patric 24 Jan '07

24 Jan '07

Hi all, Up till now have been using sql to authenticate, and am trying to change to my own script and mysql db. In radiusd.conf I have : modules { exec exec-radauth { wait = yes program = "/path/to/script.php -- %{User-Name} %{Password}" input_pairs = request output_pairs = reply } authorize { exec-radauth } This all works perfectly when I include "files" in the authorize section and place the following in the users file : DEFAULT Auth-Type = Accept But if I exclude "files" from the authorize section I get : auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Can anyone point me in the right direction with this problem? radiusd: FreeRADIUS Version 1.1.3, for host i686-redhat-linux-gnu, built on Sep 20 2006 at 14:13:13 Thanks in advance Patric ---------------------------------------------------------------------- Click for free info on adult education and start making $150k/ year http://tags.bluebottle.com/fc/CAaCMPJnSlqlx5S4A8vYLM5adNYw4Lck/

1 0

The EAP Saga begins.
by Evan Vittitow 24 Jan '07

24 Jan '07

Here is the result of my first attempt. I added a Pukey-EAP entry in the LDAP tree but it didn't do much good. And I can't tell whats the matter with my CA. rad_recv: Access-Request packet from host 192.168.0.250:1110, id=8, length=159 User-Name = "Pukey-EAP" Cisco-AVPair = "ssid=Pukey-EAP" NAS-IP-Address = 192.168.0.250 Called-Station-Id = "004096285ceb" Calling-Station-Id = "00095b679ccf" NAS-Identifier = "AP340-285ceb" NAS-Port = 37 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Service-Type = Login-User EAP-Message = 0x020d000e0150756b65792d454150 Message-Authenticator = 0xebe4683da315ee95109c4736a19a37cd Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 rlm_ldap: - authorize rlm_ldap: performing user authorization for Pukey-EAP radius_xlat: '(uid=Pukey-EAP)' radius_xlat: 'dc=pukey' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=pukey, with filter (uid=Pukey-EAP) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "Pukey-EAP", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "Pukey-EAP" rlm_realm: Proxying request from user Pukey-EAP to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 13 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 8 to 192.168.0.250 port 1110 EAP-Message = 0x010e00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe5a40fabb5846577f6543672d9313801 Finished request 7 Going to the next request Here is my /etc/xsupplicant.conf network_list = all default_netname = Pukey-EAP Pukey-EAP { type = wireless allow_types = eap_peap identity = Pukey-EAP eap-peap { random_file = /dev/urandom root_cert = /etc/raddb/certs/root.pem chunk_size = 1398 allow_types = eap_mschapv2 eap-mschapv2 { username = User password = Password } } } I've created a SSID called Pukey-EAP it requires EAP.

3 6

RE: Proxying based on SSID
by Ana Gallardo Gómez 24 Jan '07

24 Jan '07

I think you have to use the attribute "Stripped-User-Name" to authenticate the user.> Date: Wed, 24 Jan 2007 14:21:59 +0800> From: LFK(a)cc.hku.hk> To: freeradius-users(a)lists.freeradius.org> Subject: Proxying based on SSID> > Hi,> > Sorry if the questions have been asked. I have done a lot of searches,> but could not find the answer.> > Normally, I proxy a PEAP request whenever the realm is unknown to us> (i.e. using the DEFAULT realm without stripping user name). However, for> some SSIDs, I want requests to be handled locally with ldap, independent> of what the realm is (and with the user name stripped). What I did is to> find those SSIDs in "Called-Station-ID" and> set proxy-to-realm to a local realm.> > But the problem (I guess) is that when freeradius processes the realm> file, the user name is not stripped. When later on processed by the> local realm, the request fails because the user name still contains the> domain.> > Any suggestions to solve it is appreciated. Thanks in advance.> > Best Regards,> Lai> > Users> =====> DEFAULT NAS-Port-Type == "Wireless-802.11", Called-Station-Id =~> "MY-SSID$", St> rip-User-Name := Yes, Autz-Type := usePlainTextPwd, Proxy-to-realm :=> "hku.hk"> > DEFAULT NAS-Port-Type == "Wireless-802.11", Autz-Type := usePlainTextPwd> > Radiusd -X> =========> rad_recv: Access-Request packet from host 17.18.28.26:20002, id=136,> length=152> NAS-Port-Id = "2098/1"> Calling-Station-Id = "00-18-DE-83-3E-1B"> Called-Station-Id = "00-16-E0-FD-47-40:VIP-peap"> Service-Type = Framed-User> EAP-Message = 0x02010012017063637732406173642e636f6d> User-Name = "pcw2(a)asd.com"> NAS-Port-Type = Wireless-802.11> NAS-Identifier = "3Com"> NAS-IP-Address = 17.18.28.26> Message-Authenticator = 0x46e6da4a3ad7d253157a9f21a110807b> Processing the authorize section of radiusd.conf> modcall: entering group authorize for request 0> modcall[authorize]: module "preprocess" returns ok for request 0> rlm_realm: Looking up realm "asd.com" for User-Name = "pcw2(a)asd.com"> rlm_realm: Found realm "DEFAULT"> rlm_realm: Proxying request from user pcw2 to realm DEFAULT> rlm_realm: Adding Realm = "DEFAULT"> rlm_realm: Preparing to proxy authentication request to realm> "DEFAULT"> modcall[authorize]: module "suffix" returns updated for request 0> modcall[authorize]: module "chap" returns noop for request 0> modcall[authorize]: module "mschap" returns noop for request 0> users: Matched entry DEFAULT at line 171> users: Matched entry DEFAULT at line 244> modcall[authorize]: module "files" returns ok for request 0> rlm_eap: EAP packet type response id 1 length 18> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> modcall[authorize]: module "eap" returns updated for request 0> modcall: leaving group authorize (returns updated) for request 0> Found Autz-Type usePlainTextPwd> Processing the authorize section of radiusd.conf> modcall: entering group usePlainTextPwd for request 0> modcall: entering group redundant for request 0> rlm_ldap: - authorize> rlm_ldap: performing user authorization for pcw2(a)asd.com> radius_xlat: '(&(uid=pcw2(a)asd.com)))'> radius_xlat: 'ou=ldap,o=hku,c=hk'> rlm_ldap: ldap_get_conn: Checking Id: 0> rlm_ldap: ldap_get_conn: Got Id: 0> rlm_ldap: attempting LDAP reconnection> rlm_ldap: (re)connect to ldap1.hku.hk:389, authentication 0> rlm_ldap: starting TLS> rlm_ldap: bind as cn=net,o=hku,c=hk/M134aNaa to ldap1.hku.hk:389> rlm_ldap: waiting for bind result ...> rlm_ldap: Bind was successful> rlm_ldap: performing search in ou=ldap,o=hku,c=hk, with filter> (&(uid=pcw2(a)asd.com))> rlm_ldap: object not found or got ambiguous search result> rlm_ldap: search failed> rlm_ldap: ldap_release_conn: Release Id: 0> modcall[authorize]: module "withNTPwd" returns notfound for request 0> modcall: leaving group redundant (returns notfound) for request 0> modcall: leaving group usePlainTextPwd (returns notfound) for request 0> WARNING: You set Proxy-To-Realm = hku.hk, but it is a LOCAL realm!> Cancelling> invalid proxy request.> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> Processing the authenticate section of radiusd.conf> modcall: entering group authenticate for request 0> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> modcall[authenticate]: module "eap" returns handled for request 0> modcall: leaving group authenticate (returns handled) for request 0> WARNING: Cancelling proxy to Realm hku.hk, as the realm is local.> Sending Access-Challenge of id 136 to 17.18.28.26 port 20002> Framed-IP-Address = 255.255.255.254> Framed-MTU = 576> Service-Type = Framed-User> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xfd7f032f1c3ed7e8e39bf1872727e771> Finished request 0> Going to the next request> > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Consigue el nuevo Windows Live Messenger http://get.live.com/messenger/overview

1 0

Mac OS X EAP-TLS with wrong usename kills freeradius when check_cert_cn is set
by Miika Räisänen 24 Jan '07

24 Jan '07

Hi, We are building freeradius server to authenticate WLAN users with EAP-TLS and EAP-PEAP. EAP-PEAP works great with all tested operating systems, but Mac OS X 802.1X client with EAP-TLS kills freeradius if check_cert_cn is set on and Mac OS X user sends user name which does not match with certificate's common name. Operating system version is 10.4.8 and it runs on Macbook. If Window XP user sets different outer identity than cert's common name freeradius works ok (user gets rejected). We have tested following freeradius server versions on following platforms Freeradius 1.1.1 / SUN Os 5.8 Freeradius 1.1.3 (FC6's rpm) / FC6 Freeradius 1.1.4 (build from source)/ FC6 Freeradius snapshot 20070118 (build from source) / FC6 Freeradius 1.1.4 (build from source) / CentOS 4.4 FC and Centos are using distros default openssl libs etc. Heres some log and debug from CentOS with freerad 1.1.4 http://cc.oulu.fi/~mraisane/tmp/radiusd.txt Any ideas, fixes or workarounds?

3 8

RE: a freeradious/wireless solution for a school
by German Kalinec 24 Jan '07

24 Jan '07

Therein lies the problem. My potential users are a lot of my students. The idea of having to install certificates in 200+ laptops is not really feasible. And showing them how to install is an exercise in futility, since most of our students are not computer savvy enough to do it. German Kalinec Systems Manager New Roads School 3131 Olympic Blvd. Santa Monica, CA 90404 (310) 828-5582 -----Original Message----- From: freeradius-users-bounces+gkalinec=newroads.org(a)lists.freeradius.org [mailto:freeradius-users-bounces+gkalinec=newroads.org@lists.freeradius. org] On Behalf Of Nazeer Khan Sent: Monday, January 22, 2007 1:44 PM To: FreeRadius users mailing list Cc: freeradius-users(a)lists.freeradius.org Subject: Re: a freeradious/wireless solution for a school Hi, Use EAP-TLS, the most secure one. It will automatically give encryption key to the clients. U have to do onething, install the client certificates in the beginning in each client machine that will use your wireless and thats it. There are other options like EAP-PEAP, LEAP etc Check out for the types of EAP and you will find out. Cheers. tml > ------------------------------------------------------------------------ -- This email and any attachments may be confidential. They may contain legally privileged information or copyright material. You should not read, copy, use or disclose them without authorisation. If you are not an intended recipient, please contact us at once by return email and then delete both messages. We do not accept liability in connection with computer virus, data corruption, delay, interruption, unauthorised access or unauthorised amendment. This notice should not be removed. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

7 10

Splitting the password field in freeRADIUS
by Drumm, Daniel 24 Jan '07

24 Jan '07

As some of you may know, RSA SecurID servers now support RADIUS. The Auth Manager comes with the Funk RADIUS sever embedded into it, and supports a number of auth types, including EAP-OTP as well as the usual types such as CHAP. Is it possible to front end this type of server with FreeRADIUS, so that NAS-Clients can send a tokencode prepended to, say, a Kerberos password - and have the FreeRADIUS server forward the first 6 digits of the field to the RSA server for tokencode validation - and the remaining charcters to another RADIUS server, one that front-ends a Kerberos system? Only when both fields return true is the authentication true. Is this possible? I was looking at the various scripting options in radius.conf, and don't know of anyone who has done this. Or if it can be done. Thank you. Dan. # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # # Look for IPASS-style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # # Accounting requests are generally proxied to the same # home server as authentication requests. # IPASS suffix # ntdomain # # Read the 'acct_users' file files }

4 3

post-proxy section and local proxy
by Markus Krause 24 Jan '07

24 Jan '07

Hi List, i am still stuck in the problem on how to overwrite replies from freeradius to a nas depending on realms (see http://marc.theaimsgroup.com/?l=freeradius-users&m=116824114228037&w=2 and http://marc.theaimsgroup.com/?l=freeradius-users&m=116903668505574&w=2) and trying different things to solve this (i got no repsonses so far which, of course, is not a complaint! maybe i am asking the wrong or a too dump question ...) i found out that if i am doing local proxying (by setting "authhost = LOCAL" in proxy.conf) the section "post-proxy", which contains "attr_filter", is _not_ processed. If i am using a "real" proxy (authhost = anotherradius:1812) "attr_filter" does what i want it to do, it replaces some reply-attributes (for VLAN in my case). Is this really the intended behaviour and if yes, can i change it (without hacking the code on myself?) Or does someone know a better solution for my problem? Thanks in advance for any help! Regards markus -- Markus Krause email: krause(a)biochem.mpg.de Mogli-Soft: Support for Mac OS X, Webmail/Horde, LDAP, RADIUS by order of the Computing Center of the Max-Planck-Institute of Biochemistry Tel.: 089 - 89 40 85 99 Fax.: 089 - 89 40 85 98 ---------------------------------------------------------------------- This message was sent using https://webmail2.biochem.mpg.de If you encounter any problems please report to rz-linux(a)biochem.mpg.de

2 4

log failed logins
by Cory Robson 24 Jan '07

24 Jan '07

I have the following sql in my sql conf file and this is working. My only gripe is if there is no info provided then what gets placed in the log. It appears in the case of User-Password that a default of Chap-Password is entered as per below. Does anyone have a list of attributes I can log on failed attempts and the structure for the SQL statement. Eg %{reply:Reply-Message} quite often gives me "=5Cr=5CnYou are already logged in - access denied=5Cr=5Cn=5Cn" whereas I obviously only need the statement you are already logged in. I assume that an attribute followed by :- means to place what follows in the event of no data provided. Looking for lots of clarification here. postauth_query = "INSERT into ${postauth_table} (id, user, pass, reply, date, callingid) values ('', '%{User-Name}', '%{User-Password:-Chap-Password}', '%{reply:Reply-Message}', NOW(), '%{Calling-Station-Id}')" Thanks Cory

3 3

RE: a freeradious/wireless solution for a school
by Josh Howlett 24 Jan '07

24 Jan '07

(I'll bite to save Alan the déjà vu) An attacker sets up a captive portal system that looks exactly the same as yours (spoof). Users can't distinguish between the two captive portals, and so some users inevitably enter their credentials into the spoof portal. These credentials can be used by the attacker to gain network access through the authorised portal, or whatever else they're authorised for. josh. > -----Original Message----- > From: > freeradius-users-bounces+j.howlett=ukerna.ac.uk(a)lists.freeradi > us.org > [mailto:freeradius-users-bounces+j.howlett=ukerna.ac.uk@lists. freeradius.org] On Behalf Of Tas Dionisakos > Sent: 23 January 2007 21:55 > To: FreeRadius users mailing list > Subject: Re: a freeradious/wireless solution for a school > > Please elaborate on how the system can be circumvented? > > Tas. > > A.L.M.Buxey(a)lboro.ac.uk wrote: > > Hi, > > > > > >> * Apache > >> * Freeradius > >> * Chillispot > >> * Mysql > >> > > > > though note that captive portals are easy to mitigate/spoof and > > circumvent > > > > alan > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > > > > -- > ************************************* > Tas Dionisakos > IT Manager > St Mary's College and Newman College > The University of Melbourne > T: 03 9342 1708 > M: 0439 655 565 > E: tas(a)newman.unimelb.edu.au > C: (0o (||||)(||||) o0) > ************************************* > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

Can't start FreeRadius after 1st installation
by Tek Bahadur Limbu 23 Jan '07

23 Jan '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Dear All, I am very new to FreeRadius. Just today, I have installed FreeRadius 1.13 from FreeBSD 6.0 (i386) ports. I am following this material from: http://www.onlamp.com/pub/a/onlamp/excerpt/radius_5/index1.html However when I try to start it using: radiusd -X, I get the following errors: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/var" main: logdir = "/var/log" main: libdir = "/usr/local/lib" main: radacctdir = "/var/log/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = no proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients Using deprecated clients file. Support for this will go away soon. read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/var/log/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Segmentation fault: 11 (core dumped) Can somebody shed some light on this issue? - -- With best regards and good wishes, Yours sincerely, Tek Bahadur Limbu (TAG/TDG Group) Jwl Systems Department Worldlink Communications Pvt. Ltd. Jawalakhel, Nepal -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2.2 (FreeBSD) iD8DBQFFoMAnVrOl+eVhOvYRAkQZAJ4mnkYZj5EzStO36Yl07vCrp+KjGwCgoY0U eptcoO+IV9DavLvJDl/LXow= =rnIv -----END PGP SIGNATURE-----

5 10