- Freeradius-Users - lists.freeradius.org

Freeradius on OS X with OD, password attribute is not checked
by Stepan Raichl 27 Oct '06

27 Oct '06

Hi all, I'm setting up a wireless network where users use login details provided by OpenDirectory + certificate. The goal is that user of the WiFi network must provide certificate and username with password. If the user is disabled in OD (via WGM - access account thick box), user must not access the network. My setup: OSX 10.4.8 Server, OpenDirectory, freeRADIUS, ZyWall 35 with WiFi AP using WPA Ent. Clients: 99.9% Mac OSX 10.4.8 I got all setup, freeRADIUS 1.1.3 running, certificates, but I can't get the freeRADIUS to check the user password from OD. Using radtest, I have no problems: ------- Sending Access-Request of id 123 to 127.0.0.1 port 1812 User-Name = "12345" User-Password = "12345" NAS-IP-Address = 255.255.255.255 NAS-Port = 2 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=123, length=20 ------- However, when a client from WiFi logs in, username and certificate are the only criteria which are checked to grant access. If you can help, please read the debug dump below. It seems that RADIUS has managed to decrypt the password and adds it to checklist: rlm_ldap: Added password ******** in check items ... but then the access is granted anyway ... doesn't matter what you write in the password :-( To achieve my goals, am I using the correct method (EAP-TLS)? When using unecrypted connection, I can clearly see the password attribute, but that defeats the whole purpose of WPA ... I hope you guys don't mind that I dumped bits of my log & conf into this forum, I'm getting very frustrated ... I have already added userPassword as User-Password ... RADIUS reply to connection using certificate: ------- rad_recv: Access-Request packet from host 192.168.1.1:1131, id=16, length=144 User-Name = "12345" NAS-IP-Address = 192.168.1.1 NAS-Identifier = "zywall" Framed-MTU = 1496 Called-Station-Id = "00-11-22-33-44-55-66-77:Test Test" Calling-Station-Id = "00-11-22-33-44-55" NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020b00060d00 State = 0xa5e4df76eacd676aa056b162e018e148 Message-Authenticator = 0x55082c87332500d61cb52cd8ca640361 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 rlm_eap: EAP packet type response id 11 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 rlm_ldap: - authorize rlm_ldap: performing user authorization for 12345 radius_xlat: '(uid=12345)' radius_xlat: 'dc=st,dc=ln' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=st,dc=ln, with filter (uid=12345) rlm_ldap: checking if remote access for 12345 is allowed by uid rlm_ldap: Added password ******** in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password, value ******** & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user 12345 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 Sending Access-Accept of id 16 to 192.168.1.1 port 1131 MS-MPPE-Recv-Key = 0x1e908975f56513420942c8e6680139f19ebf58ee76c2c13a2315873f5ca1c6cf MS-MPPE-Send-Key = 0xedddaafac5513c090db385d154acfe8d19c5b7e542b264e1c6974850faddb2a6 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "12345" Finished request 9 --------- From radiusd.conf: --------- ldap { server = "192.168.1.2" basedn = "dc=st,dc=ln" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap password_attribute = userPassword } authorize { eap ldap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } ------ I have also added "checkItem User-Password userPassword" to ldap.attrmap. Please please help, many thanks in advance!!!! Stepan

2 2

race condition?
by Kevin J 26 Oct '06

26 Oct '06

I am running freeradius 1.0.5 version. I know this is old. ldap is used in authorization and pap is usually used in authentication. We made a client tool which can send 1000 packets per second (from data file) to freeradius. What we noticed that in multi-thread, there was a race condition which makes some ldapsearch failures. We are positive in that there is no problem in our ldap because we already tested our ldaps with a similar tool and verified that our ldap can support much more load. Do you have any idea what part of things that I need to check or was there any update in ldap with this kind of issue? Kevin

1 0

freeradius against AD not working
by Karthik R 26 Oct '06

26 Oct '06

Using freeradius v1.1.1 on a RHEL 4 box trying to authenticate users against Windows 2003 Active directory. I was able to bind linux box to Windows domain successfully and able to read the active directory users and groups using wbinfo - u R1\Administrator R1\Guest and wbinfo -g. Using ntlm_auth tool am able to successfully authenticate the users too. -bash-3.00# ntlm_auth --request-nt-key --username=kartthikr password: NT_STATUS_OK: Success (0x0) But while using radtest tool with the same logon credentials as above it rejects the user and here is the log message. rad_recv: Access-Request packet from host 127.0.0.1:32927, id=243, length=61 User-Name = "<removed>" User-Password = "<removed>" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "<removed>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 156 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns notfound for request 0 modcall: leaving group authenticate (returns notfound) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Sending Access-Reject of id 243 to 127.0.0.1 port 32927 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 243 with timestamp 45413139 Nothing to do. Sleeping until we see a request. Here is nss config file: passwd: files winbind shadow: files winbind group: files winbind hosts: files winbind nis dns protocols: files winbind # nis services: files winbind # nis netgroup: files winbind # nis automount: files winbind nis Here is radiusd.conf file: modules { pap { encryption_scheme = crypt } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP #use_mppe = no require_encryption = yes #require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Thanks in advance.

2 1

Freeradius consuming a lot of memory > 1.6G
by Pshem Kowalczyk 26 Oct '06

26 Oct '06

Hi, We've built a radius-proxy using freeradius and rlm_perl (with ithreads). Currently we have the following settings: thread pool { start_servers = 20 max_servers = 100 min_spare_servers = 20 max_spare_servers = 50 max_requests_per_server = 500 } perl { module = /usr/lib/perl5/rlmPerl.pm func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_accounting = accounting func_checksimul = checksimul func_pre_proxy = pre_proxy func_post_proxy = post_proxy func_post_auth = post_auth func_xlat = xlat func_detach = detach max_clones = 100 start_clones = 20 min_spare_clones = 20 max_spare_clones = 100 cleanup_delay = 5 max_request_per_clone = 100 } The whole setup works fine (there are two machines, load-balanced). Every single request is piped to the rlm_perl. The number of threads (ps -eLf) oscillates around 45-50 on both machines. There are no dealys, or any problems, except for the huge memory consumption. Authentication request are simply proxied (with minimal changes to the packets - filtering out some attributes and setting the others, no db access), accounting is send to a session database (postgresql) on a separate machine (no load problems there). Should freeradius use that amount of memory? The amount of memory is directly linked to the number of threads - with 25 threads (in the middle of the night) the memory consumption drops to about 900M. perl useses the following modules: use DBI; use Digest::JHash qw(jhash); use IPC::Shareable (':lock'); use Storable; (all variables shared between perl threads are stored in shared memory using perl IPC). So the question is should freeradius use that amount of memory and how can I decrease that? regards pshemko

1 0

authenticating question
by Matt Ashfield 26 Oct '06

26 Oct '06

Hi all, This is probably a bit newbie-ish, but I thought I'd try anyway. We are trying to authenticate users based on the username/password given AND the vlan they are authenticating from. Is this possible? A quick overview of our scenario is as follows: - Wireless service offering an SSID/VLAN for students and SSID/VLAN for staff. - Users connect to an SSID and are in the vlan associated for it. They are redirected to a portal where they must authenticate using radius - to -ldap authentication. We have this working. However, the question came up..what if a student connects to the Staff SSID/VLAN. His username/password would still authenticate correctly and he'd be given access at this point. But if we could get Radius to check and LDAP field which say which vlan he has access to, and allow or deny access to the network if the user is not currently in that vlan, then I guess that would be the ideal solution. Any suggestions are welcome. Thanks Matt mda(a)unb.ca

2 1

RE: radiusd service hangs
by Karthik R 26 Oct '06

26 Oct '06

Hi Karthik, I used to have the same problem in 2 different cases: - When Freeradius was installed on Redhat 9, it used to hang every 3 or 4 days as well but you're on Redhat Ent3 so you should be fine - When the connection to the MySQL server was dropping Are you sure your connection to AD is reliable? David ----- Am running freeradius ver 1.1.1. My connection to AD is reliable, but today i remembered before this issue araised recently i rebooted the domain controller. Not sure if this is causing the issue.

1 0

simple question
by Mike May 26 Oct '06

26 Oct '06

How can I determine that version of freeRadius that is currently running?

2 1

WAP EAP-TLS
by Pedro Henrique Morsch Mazzoni 26 Oct '06

26 Oct '06

Hello everybody, I'm implementing a environment for secure my wireless lan with radius. For this I choose WAP with EAP-TLS. But I have some questions to do. Is there a way to Authenticate/Authorizate: - Per machine certificate AND - Per user certificate AND - Per user password mapped on a NIS-Server, or a file in radius server. Note that I need this three modes of authentication. Thanks, Pedro Mazzoni

1 0

radiusd service hang
by Karthik R 26 Oct '06

26 Oct '06

Am running freeradius on a RHEL v3 box, to authenticate 802.11users against AD. All of sudden the 802.11 users cant get authenticated against AD, unless i reboot the radius service on linux box. It looks like radius service get hangs atleast weekly once for no reason, i couldnt find anything in the log file /var/log/messages. Is anyone facing this issue ? everytime when the user complain that wireless i not working, have to restart the service manually. any help would be appreciated.

3 2

Error: ERROR: Tunnel-Password attribute in request: Cannot decrypt it.
by B Thompson 26 Oct '06

26 Oct '06

Hi We are seeing a problem with RADIUS accounting from some of our Colubris AP's. We are getting the following errors in /var/log/radius/radius.log :- Tue Oct 24 14:02:59 2006 : Error: ERROR: Tunnel-Password attribute in request: Cannot decrypt it. Could someone explain a bit more about what this means and whether it is likely to be a problem with the NAS? We are running FreeRADIUS 1.0.1. Here is the tcpdump print out of the packet which caused the above message :- 14:02:59.913634 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto 17, length: 323) nasphysap0.york.ac.uk.32770 > nasaaa2.york.ac.uk.radius-acct: [udp sum ok] RADIUS, length: 295 Accounting Request (4), id: 0xa7, Authenticator: 7f79db43885d7e9745205662885af3bc Accounting Session ID Attribute (44), length: 19, Value: 94c34058-00000007 0x0000: 3934 6333 3430 3538 2d30 3030 3030 3030 0x0010: 37 NAS Port Attribute (5), length: 6, Value: 10 0x0000: 0000 000a NAS Port Type Attribute (61), length: 6, Value: Wireless - IEEE 802.11 0x0000: 0000 0013 NAS ID Attribute (32), length: 12, Value: nasphysap0 0x0000: 6e61 7370 6879 7361 7030 NAS IP Address Attribute (4), length: 6, Value: nasphysap0.york.ac.uk 0x0000: 9020 c4b8 Framed MTU Attribute (12), length: 6, Value: 1496 0x0000: 0000 05d8 Username Attribute (1), length: 18, Value: xy506(a)york.ac.uk 0x0000: 7879 3530 3640 796f 726b 2e61 632e 756b Calling Station Attribute (31), length: 19, Value: 00:0c:f1:1b:47:7b 0x0000: 3030 3a30 633a 6631 3a31 623a 3437 3a37 0x0010: 62 Called Station Attribute (30), length: 19, Value: 00:03:52:dc:e5:31 0x0000: 3030 3a30 333a 3532 3a64 633a 6535 3a33 0x0010: 31 Accounting Status Attribute (40), length: 6, Value: Stop 0x0000: 0000 0002 Accounting Session Time Attribute (46), length: 6, Value: 18 secs 0x0000: 0000 0012 Accounting Input Packets Attribute (47), length: 6, Value: 30 0x0000: 0000 001e Accounting Output Packets Attribute (48), length: 6, Value: 34 0x0000: 0000 0022 Accounting Input Octets Attribute (42), length: 6, Value: 2181 0x0000: 0000 0885 Accounting Output Octets Attribute (43), length: 6, Value: 7541 0x0000: 0000 1d75 Accounting Termination Cause Attribute (49), length: 6, Value: Lost Carrier 0x0000: 0000 0002 Accounting Delay Attribute (41), length: 6, Value: 289:15:29 hours 0x0000: 000f e3b1 Vendor Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311) Vendor Attribute: 17, Length: 52, Value: .]......D?...D7.?}v.X.x....S.)/..7.).Z. .SiG...: 0x0000: 0000 0137 1134 945d bea2 85ee bfde 443f 0x0010: e6c6 d544 37a6 3f7d 7608 58f1 78cb cca7 0x0020: fd53 0429 2fd8 0437 c529 845a ae20 c653 0x0030: 077f 6947 e27f e8c1 Vendor Specific Attribute (26), length: 58, Value: Vendor: Microsoft (311) 0x0000: 0000 0137 1034 9f5b 63ae ecb4 7e23 af47 0x0010: 7be9 c08b 5cbd b35f 7f8d 9b11 1a08 a52f 0x0020: b52c 09c5 f5ca 5e2c 8d53 8390 0d8f 24fb 0x0030: 3e39 1668 6858 af32 0x0000: 0030 4883 9880 0003 5204 635a 0800 4500 .0H.....R.cZ..E. 0x0010: 0143 0000 4000 4011 8fb5 9020 c4b8 9020 .C..@.@......... 0x0020: c4fb 8002 0715 012f 922a 04a7 0127 7f79 ......./.*...'.y 0x0030: db43 885d 7e97 4520 5662 885a f3bc 2c13 .C.]~.E.Vb.Z..,. 0x0040: 3934 6333 3430 3538 2d30 3030 3030 3030 94c34058-0000000 0x0050: 3705 0600 0000 0a3d 0600 0000 1320 0c6e 7......=.......n 0x0060: 6173 7068 7973 6170 3004 0690 20c4 b80c asphysap0....... 0x0070: 0600 0005 d801 1278 7935 3036 4079 6f72 .......xy506@yor 0x0080: 6b2e 6163 2e75 6b1f 1330 303a 3063 3a66 k.ac.uk..00:0c:f 0x0090: 313a 3162 3a34 373a 3762 1e13 3030 3a30 1:1b:47:7b..00:0 0x00a0: 333a 3532 3a64 633a 6535 3a33 3128 0600 3:52:dc:e5:31(.. 0x00b0: 0000 022e 0600 0000 122f 0600 0000 1e30 ........./.....0 0x00c0: 0600 0000 222a 0600 0008 852b 0600 001d ...."*.....+.... 0x00d0: 7531 0600 0000 0229 0600 0fe3 b11a 3a00 u1.....)......:. 0x00e0: 0001 3711 3494 5dbe a285 eebf de44 3fe6 ..7.4.]......D?. 0x00f0: c6d5 4437 a63f 7d76 0858 f178 cbcc a7fd ..D7.?}v.X.x.... 0x0100: 5304 292f d804 37c5 2984 5aae 20c6 5307 S.)/..7.).Z...S. 0x0110: 7f69 47e2 7fe8 c11a 3a00 0001 3710 349f .iG.....:...7.4. 0x0120: 5b63 aeec b47e 23af 477b e9c0 8b5c bdb3 [c...~#.G{...\.. 0x0130: 5f7f 8d9b 111a 08a5 2fb5 2c09 c5f5 ca5e _......./.,....^ 0x0140: 2c8d 5383 900d 8f24 fb3e 3916 6868 58af ,.S....$.>9.hhX. 0x0150: 32 -- Many Thanks Ben Thompson

3 12