- Freeradius-Users - lists.freeradius.org

LEAP
by John Peebles 20 Jan '06

20 Jan '06

We are having problems getting leap to authenticate. We are using FreeRadius 0.9.3, Cisco Arionet 1200 and eDir as a back end. Here is our config file: ! version 12.3 no service pad service timestamps debug datetime msec service timestamps log datetime msec service password-encryption ! hostname TESTAP ! enable secret 5 $1$tQu6$CiVTpfiU2yIuDBoQveZtM1 ! ip subnet-zero ! ! aaa new-model ! ! aaa group server radius rad_eap ! aaa group server radius rad_mac ! aaa group server radius rad_acct ! aaa group server radius rad_admin cache expiry 1 cache authorization profile admin_cache cache authentication profile admin_cache ! aaa group server tacacs+ tac_admin cache expiry 1 cache authorization profile admin_cache cache authentication profile admin_cache ! aaa group server radius rad_pmip ! aaa group server radius dummy ! aaa group server radius rad_eap1 server 172.31.1.25 auth-port 1812 acct-port 1813 ! aaa authentication login eap_methods group rad_eap aaa authentication login mac_methods local aaa authentication login eap_methods1 group rad_eap1 aaa authorization exec default local aaa accounting network acct_methods start-stop group rad_acct aaa cache profile admin_cache all ! aaa session-id common ! dot11 ssid TESTAP authentication open eap eap_methods1 authentication network-eap eap_methods1 guest-mode ! ! ! username Cisco password 7 047802150C2E ! bridge irb ! ! interface Dot11Radio0 no ip address no ip route-cache ! encryption mode wep mandatory ! ssid TESTAP ! speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0 station-role root bridge-group 1 bridge-group 1 subscriber-loop-control bridge-group 1 block-unknown-source no bridge-group 1 source-learning no bridge-group 1 unicast-flooding bridge-group 1 spanning-disabled ! interface FastEthernet0 no ip address no ip route-cache duplex auto speed auto bridge-group 1 no bridge-group 1 source-learning bridge-group 1 spanning-disabled ! interface BVI1 ip address 172.31.1.79 255.255.255.0 no ip route-cache ! ip default-gateway 172.31.1.250 ip http server no ip http secure-server ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag ip radius source-interface BVI1 ! radius-server local no authentication eapfast no authentication mac eapfast server-key primary 7 C10D5BA1B105987DEA7DE22F1E2A3D7094 nas 172.31.1.79 key 7 040A59555B74 user testrad nthash 7 06255C771F6A5F412735372D5B560F7B720E6B657A46544F2051000B0E77005F57 ! radius-server attribute 32 include-in-access-req format %h radius-server host 172.31.1.25 auth-port 1812 acct-port 1813 key 7 101F5B4A5142 radius-server vsa send accounting ! control-plane ! bridge 1 route ip ! ! ! line con 0 transport preferred all transport output all line vty 0 4 transport preferred all transport input all transport output all line vty 5 15 transport preferred all transport input all transport output all ! end here is the error message we get: rad_recv: Access-Request packet from host 172.31.1.79:1645, id=5, length=131 User-Name = "testrad" Framed-MTU = 1400 Called-Station-Id = "0015.f947.8560" Calling-Station-Id = "0012.f0e3.7896" Service-Type = Login-User Message-Authenticator = 0xa00609077f82a3396080dcdcc8019804 EAP-Message = 0x0201000c0174657374726164 NAS-Port-Type = Wireless-802.11 NAS-Port = 466 NAS-IP-Address = 172.31.1.79 NAS-Identifier = "TESTAP" modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: No '@' in User-Name = "testrad", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 users: Matched DEFAULT at 152 modcall[authorize]: module "files" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for testrad radius_xlat: '(uid=testrad)' radius_xlat: 'o=Village' ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=Village, with filter (uid=testrad) rlm_ldap: checking if remote access for testrad is allowed by dialupAccess rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user testrad authorized to use remote access ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 modcall: group authorize returns ok for request 1 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" modcall: entering group Auth-Type for request 1 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. modcall[authenticate]: module "ldap" returns invalid for request 1 modcall: group Auth-Type returns invalid for request 1 auth: Failed to validate the user. Login incorrect: [testrad/<no User-Password attribute>] (from client testap port 466 cli 0012.f0e3.7896) Delaying request 1 for 1 seconds Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 5 to 172.31.1.79:1645 Waking up in 4 seconds... I can authenticate using a small utility called NTRadPing Test Utility from my desktop directly connecting to Freeradius. any thoughts? Thank you, John Peebles Village of Hoffman Estates IS Specialist (847) 882-9100 x2500

3 2

1.0.5 PEAP issue with Edirectory
by Anup Parkhi 19 Jan '06

19 Jan '06

Hi, Enviornment: FreeRadius version: 1.0.5 OS: Red Hat Linux ES3 Directory: Edirectory Auth-Type: EAP PEAP (EAP-MD5 worked though) I built FreeRadius 1.0.5 with (--with-edir). While sending EAP-PEAP request, the freeradius crashed. gdb backtrace indicated a problem in libssl. I was using openssl 0.9.7a. Tried with other versions of openssl with following results. . 0.9.6a & 0.9.8a -- did not compile . 0.9.6i - did not link However, i had a CVS snapshot of 12/19/05. using that, both EAP-MD5 and EAP-PEAP worked. For some reason i will have to use 1.0.5. I was wondering if anybody has success with 1.0.5/Edirectory/PEAP. If yes, which openssl i should use. I can provide logs or stack trace if needed. Thanks Anup

1 0

how to set crypted password in 'users' file?
by Min Qiu 19 Jan '06

19 Jan '06

Hi all, I'm able to make clear text password work by adding entry in 'users' file: mqiu Auth-Type := Local, User-Password == "clear-text" However, cut and past the crypted password from /etc/shadow to the entry failed: mqiu Auth-Type := Local, User-Password == "$1$CWOjXm2v$dzjrc385t1iQXMN0" Change above Auth-Type to "pam" or "unix" does not work. My question is how to set an crypted password in 'users' file? In addition, how to set different passwords for the same user in different hosts? something like: mqiu(a)10.1.1.0/24 Auth-Type := Local, User-Password == "pass1" mqiu(a)10.1.2.0/24 Auth-Type := Local, User-Password == "pass2" ... mqiu(a)10.1.N.0/24 Auth-Type := Local, User-Password == "passN" I have freeradius-1.0.4-1.FC4.1 installed. Thanks a lot, Min

2 1

Problem translating users file to Postgre DB
by Andrew Teixeira 19 Jan '06

19 Jan '06

Hello, I tried to port my users file to PostgreSQL today, but I am having a great deal of confusing trouble trying to get it to work. I am using the postgresql.conf file that came with Freeradius 1.1.0 and am having no trouble getting Freeradius to connect to Postgre. My problem comes when trying to authenticate to my firewall. First, I will explain the working "files-only" configuration: ::::::::::::::::: huntgroups ::::::::::::::::: switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 10.20.10.x switches NAS-IP-Address == 127.0.0.1 firewall NAS-IP-Address == 10.20.10.x firewall NAS-IP-Address == 10.20.10.x ::::::::: users ::::::::: DEFAULT Auth-Type = System Fall-Through = 1 admin Auth-Type := Kerberos, Huntgroup-Name == "switches" Service-Type == "Administrative-User" admin Auth-Type := Kerberos, Huntgroup-Name == "firewall" NS-Admin-Privilege = "All-VSYS-Root-Admin" When I do this with files only, it works great. I then tried to get the database setup to work. I left the huntgroups file alone and commented out the 2 'admin' entries in users. Now, this is my setup in the database that is not working: :::::::::::::::::::::: radgroupcheck :::::::::::::::::::::: id | groupname | attribute | op | value ----+-------------+----------------+----+------------- 1 | switches | Huntgroup-Name | == | switches 2 | firewall | Huntgroup-Name | == | firewall 5 | firewall | Auth-Type | := | Kerberos 6 | switches | Auth-Type | := | Kerberos ::::::::::::::::::::: radgroupreply ::::::::::::::::::::: id | groupname | attribute | op | value ----+-------------+--------------------+----+--------------------- 2 | firewall | NS-Admin-Privilege | = | All-VSYS-Root-Admin 1 | switches | Service-Type | = | Administrative-User ::::::::::::::: usergroup ::::::::::::::: id | username | groupname ----+----------+------------- 1 | admin | switches 2 | admin | firewall In this setup, I can authenticate with 'admin' using my Kerberos password for the 'switches' huntgroup, but I cannot authenticate to 'firewall'. Also, when I do radtest for an IP in the switches huntgroup, I get a reply of both 'Service-Type' and 'NS-Admin-Privilege', when I assumed that this would give me one or the other since they are in different groups. When running radiusd with the '-X' flag and trying to authenticate to firewall, I get the error: rlm_sql (sql): No matching entry in the database for request from user [admin] This shouldn't be the case since the user 'admin' is part of both groups. I am at a loss at this point what could be the problem. If anyone has any insight, I would greatly appreciate it. Thanks in advance.

1 0

RE: CIsco Pix and FreeRadius....
by Sills, Tripp 19 Jan '06

19 Jan '06

Done that fixed the issue....Now I want to use ldap with freeradius is that possible? Tripp Sills Senior Network Engineer - Information Technology tripp(a)dmenet.com Direct Mail Express 2441 Bellevue Avenue Extension Daytona Beach, FL Office # (386) 271 - 3288 Cell # (386) 566 - 4053 Fax # (386) 271 - 3289 The information in this Internet e-mail, including attachments, is confidential and may be legally privileged. It is intended solely for the addressee. Access by any other person to this Internet e-mail is not authorized. If you are not the intended recipient, please delete this Internet e-mail and notify me by return e-mail or at (386) 271-3288. Any unauthorized disclosure of the parties to this e-mail, and any unauthorized disclosure, dissemination, distribution, copying, or any action taken or omitted to be taken in reliance on this email, including attachments, is prohibited and may be unlawful. -----Original Message----- From: freeradius-users-bounces+tripp=dmenet.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+tripp=dmenet.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, January 18, 2006 11:22 AM To: FreeRadius users mailing list Subject: Re: CIsco Pix and FreeRadius.... "Sills, Tripp" <tripp(a)dmenet.com> wrote: > I am not altering the users file all I have in it is : > > I was using the same username and password for both. Below is my users > file. Perhaps I was unclear. *YOU* should read the users file and compare it's entries to what's in the debug log. If you don't understand what you configured or how it works, then you're never going to solve the problem. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Ippool and NAS
by Johansson, Daniel 19 Jan '06

19 Jan '06

Hi Freeradius users. I have compiled and installed the 1.1.0 version of Freeradius and made the basic configurations and everything works fine. Now I have 5 NAS boxes that is accessing the radius server the problem is that I want each NAS to use a set if ipadresses. So for NAS(1) the radius should return ippool(1) and so on. I have looked at the FAQ and have been searching in the mail archive for several hours and have only seen people asking about allocating ipadresses for specific user(s) or group(s) but not for a NAS. Could anyone please help me to get me started on this. Best Regards /Daniel Johansson Below is my NAS boxes in clients.conf # Client for RTP-RFTN, GGSN 1 client 192.168.9.1 { secret = xxx shortname = RTP-RFTN } # Client for S99, GGSN 249 client 192.168.15.249 { secret = xxx shortname = S99 GGSN 249 } # Client for S98, GGSN 254 client 192.168.13.254 { secret = xxx shortname = S98 GGSN 254 } # Client for GLANA, GGSN 250 client 192.168.11.250 { secret = xxx shortname = GLANA GGSN 250 } # Client for Telia GLANA, GGSN 249 client 192.168.11.249 { secret = xxx shortname = GLANA GGSN 249 }

3 2

mschap and users file
by André Lemos 19 Jan '06

19 Jan '06

Right now I'm only using mschap and the users file to authenticate a user, but I'm getting: modcall: entering group Auth-Type for request 7 rlm_mschap: No User-Password configured. Cannot create LM-Password. rlm_mschap: No User-Password configured. Cannot create NT-Password. rlm_mschap: Told to do MS-CHAPv2 for wifi with NT-Password rlm_mschap: FAILED: No NT/LM-Password. Cannot perform authentication. rlm_mschap: FAILED: MS-CHAP2-Response is incorrect although on my users file I have: "wifi" Crypt-Password == "BcFvDSx8ydTSk" "wifi" lmPassword == "02D093CE93078E8FAAD3B435B51404EE" "wifi" ntPassword == "CAF13C4F321B608B27FD75D2549BA53C" can't I have my users file only with encrypted passwords? thanks -- **_____________________** * *André Ventura Lemos** **Software Engineer** **Critical Software, SA** **MSN:** **tux(a)tuxslare.org** **GSM:** **+351916401042** **TLF:** **+351239989100** DISCLAIMER: This message may contain confidential information or privileged material and is intended only for the individual(s) named. If you are not a named addressee and mistakenly received this message you should not copy or otherwise disseminate it: please delete this e-mail from your system and notify the sender immediately. E-mail transmissions are not guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete or contain viruses. Therefore, the sender does not accept liability for any errors or omissions in the contents of this message that arise as a result of e-mail transmissions. Please request a hard copy version if verification is required. Critical Software.

3 2

Windows PPTP and Cisco VPN Concentrator
by ALMEIDA Antonio Jose 19 Jan '06

19 Jan '06

Hello, I'm trying to implement one pptp vpn between one windows xp and one vpn concentrator. I've no problems with the Cisco vpn client but I get this error when I try the windows software: In the software: The PPP link control protocol was terminated. In the vpn concentrator: User [xxxx] disconnected. Cannot resolve an IP address for remote peer. In debug mode, freeradius gives this output:; auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_mschap: Told to do MS-CHAPv2 for toze3 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 38 to AA.BB.CC.DD:1033 MS-CHAP2-Success = 0x02533d3346343545313438444234344339303636463630454141394444413134444436 4630463137343639 MS-MPPE-Recv-Key = 0x7bece896d285fa327b97e150aa13cc9d MS-MPPE-Send-Key = 0x91606621ce8a086e8a961d21bf250787 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 Finished request 0 Can someone help me with this? I've search google for some time now and I still can't solve this. Regards, Antonio

1 0

Question about dialup-admin
by Miguel Angel Quiles 19 Jan '06

19 Jan '06

I've downloaded dialup-admin. I've changed few values from the admin.conf file, such as mysql username and password, and path to the different directories. I also created the "badusers" table in the "radius" in the mysql. I opened a web browser and I can see the accounting is working ok, but I can´t see any bad users. I've already enabled the log auth in the radiusd.conf (log_auth = yes), so now I´ve got some entries in the /var/log/radius/radius.log. I've been reading the README file, and it says that the bin/log_badlogins it will constantly check the radiusd.log file. But it seems that this doesn't happen. I hope someone knows how I can resolve this problem, or another solution so I can get the badusers. Thanks.

1 0

Re: Authorization
by Stefan Adams 19 Jan '06

19 Jan '06

Dusty, Thanks for your fine input and the reminder on the index (I completely forgot about that). I'll give the ldap module filter a go with the attr_rewrite. I like keeping attributes with the user object, rather than spreading usernames around to various other objects. With this implementation, to me, the extra benefit is that I can just add a radiusGroupName attribute = X to each user object. BTW, on the attr_rewrite, can I use more advanced regex than just ................: ? It works and always will work, but it would be more clear in the config file if I could say "([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2})-([A-F0-9]{2}):" or something to that effect... I couldn't get ANY regex to work except the . Does that seem right? Stefan > Message: 4 > Date: Mon, 19 Dec 2005 14:52:10 -0500 (EST) > From: Dusty Doris <freeradius(a)mail.doris.cc> > Subject: Re: Freeradius-Users Digest, Vol 8, Issue 82 > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20051219143705.I21565(a)mail.doris.name> > Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed > > On Mon, 19 Dec 2005, Stefan Adams wrote: > > > Hey, guys! Thanks for the great replies!! I like what you suggested > > better than what I've come up with in the mean time. I think what I > > came up with will work, it just seems messy/wrong/inefficient. What > > do you think? > > > > modules { > > ldap { > > : > > filter = > > > >"(&(uid=%{Stripped-User-Name:-%{User-Name}}) > >(radiusGroupName=%{Called-Station-ID}))" > > : > > } > > attr_rewrite getssid { > > attribute = Called-Station-Id > > searchin = packet > > searchfor = ".................:" > > replacewith = "" > > ignore_case = yes > > new_attribute = no > > } > > } > > > > authorize { > > # for WinXP, 802.1x, EAP-PEAP, MS-CHAPv2 > > preprocess > > eap > > getssid > > ldap > > } > > > > This cuts off the first 17 bytes and then a colon of the > > Called-Station-ID (My AP transmits a dash separated MAC followed by a > > colon and then the SSID). Then it uses this rewritten > > Called-Station-ID and uses that as a filter in the LDAP search. > > Therefore, if the SSID a user tries to connect to is not listed as an > > attribute of the user's LDAP object, the user is denied. > > > > Does that make sense? > > That's a pretty neat idea. The benefit of that is if you had multiple > ldap instances and wanted to implement fail-over within freeradius. To do > it the traditional way, you would need this for fail-over with ldap-group > checks if say you had two ldap instances. > > DEFAULT Called-Station-Id =~ /studentregex/, ldap1-Ldap-Group == > "students" > > DEFAULT Called-Station-Id =~ /studentregex/, ldap2-Ldap-Group == > "students" > > That is so it will check with ldap1 instance first. If that fails, then > check ldap2. > > By doing it your way, you won't need to do that anymore. Instead a > redundant block in authorize would get you what you need already since the > radiusGroupname inside your search filter takes care of the Ldap-Group > check. > > I wonder if you could use regex matches of Called-Station-ID in the > huntgroups file. You'll have to test this out, I doubt it would work, but > its another interesting idea. I don't know if huntgroups excepts regex > and if it can use things like Called-Station-Id > > in huntgroups > > students Called-Station-Id =~ /studentregex/ > faculty Called-Station-Id =~ /facultyregex/ > > Then in users file. > > DEFAULT Ldap-Group == %{Huntgroup-Name} > > Or you're way. > > (&(uid=%{Stripped-User-Name:-%{User-Name}})(radiusGroupName=%{Huntgroup-Name}))" > > See doc/configurable_failover and doc/rlm_ldap to see what I'm talking > about with the failover. If you have a load balancer in front of that > ldap server, you won't need to worry about it. But if you don't and you > want to add redundancy, then its something you'll need to think about some > day. Freeradius can do the redundancy for you w/out a load balancer or > shared IP using configurable failover. Actually in the upcoming 1.1 > release it will also do load balancing for you in addition to failover > inside your ldap blocks. > > Hope I'm not too confusing. My point is I like your idea and if its > working for you, it doesn't sound like a bad one to me. You might want to > try hitting it hard to see if the rewrite slows anything down, but I would > bet it doesn't. > > I'd also make sure to add an eq index to radiusgroupname, since you'll be > using that as part of your search filter.

8 8