- Freeradius-Users - lists.freeradius.org

Freeraadius stale sessions (no SQL scenario)
by Roman 04 Nov '16

04 Nov '16

Hi, Sometimes I do some networking downtimes and during these periods I'm getting pretty much stale sessions in radwho output. I understand why it happens, but all I want to do is to clear them automatically, when user logs in. So what I've done is added this line: *exec("/usr/bin/radzap", "-u", $ARGV[3], "127.0.0.1", "secret");* to this part of checkrad code for mikrotik sub. #lets return something if ($username_seen > 0) { return 1; } else { exec("/usr/bin/radzap", "-u", $ARGV[3], "127.0.0.1", "secret"); return 0; } } If I understand it right, this code works like: if there is a username logged in on NAS, then we return 1, which means error, I guess? if there are none, we return 0, which is OK I guess? So I just want to clear (if there any) the stale session for user, if he's not logged in on NAS, but for some reason has stale session on freeradius server (visible in radwho) But.. nothing happens. If I execute the command from the shell, it works.. So as I'm not a programmer, I think, that I must be added this line to the wrong place of radcheck script. Any help? -- Best regards, Roman.

4 13

How to return out of a policy.d module
by Brian Candler 04 Nov '16

04 Nov '16

Is it possible to jump out of a policy.d function, without exiting the whole request? For example, suppose I have policy.d/foo which contains foo { if (..some complex condition..) { ... if (..another condition..) { ... ok /* I WANT TO RETURN FROM HERE */ } ... ... more logic ... reject } } At the place given, I want to finish processing the 'foo' policy and continue. However if I use "return", it terminates the whole enclosing authorize section: authorize { ... foo bar # "bar" is not executed if "foo" says "return" } I can possibly write the policy I want entirely as carefully written if ... elsif ... elsif ... sections, but it would give me some more options for writing it clearly if there were a way for the policy to return. I just haven't been able to work out how to do that. Thanks, Brian.

2 1

force exit on instanciated ldap module
by Ramon Escriba 04 Nov '16

04 Nov '16

Hi experts, I'm running a Radius 3.0.10, the config it's working fine, I just ask for advice to do one step in a faster way. I've declared multiple LDAP instances "vlan1,vlan2....vlanN" in /etc/raddb/mods-enabled/ldap . Each one queries just the ldap subtree assigned to a particular vlan. Each vlan subtree contains it's allowed mac's (uid=mac) Each mac (uid) has all needed radius attributes for the radius accept packet, that are populated from ldap. Actually, all ldap instancies are asked for every "uid=mac" in order sequence, so if there's a match, the attributes are updated from the ldap. Unfortunately , If one "mac" matches two ldap instances (ex: vlan1 & vlan2), the last matched instance(vlan2) overwrites the previous populated attributes(vlan1). My goal is somehow to stop ldap executing the next instances(vlan2,vlan3...N) if the actual one(vlan 1) got the jackpot, to avoid so many ldap queries. Right now I'm forced to use a inverse priority ( the last match got the jackpot), that is not the right solution. Any clues, or advice? /etc/raddb/sites-available/default (...) authorize { filter_username preprocess chap mschap digest suffix eap { ok = return } #ldap instance asking for mac in vlan1 vlan1 { ok = return #noop = return } #ldap instance asking for mac in vlan2 vlan2 { ok = return } (...) #ldap instance asking for mac in vlanN vlanN { ok = return } files expiration logintime } (....)

2 6

Proxy EAP-TLS
by Davide Belloni 04 Nov '16

04 Nov '16

Hi, for a SSID wireless network I'm trying, without success, to proxy EAP-TLS auth (based on certificate's CN) to specific Windows RADIUS that are members of two domain on AD. For example what I want to obtain is that: - EAP-TLS of client A, member of domain X, is proxied by Freeradius to RADIUS/AD of that domain - EAP-TLS of client B, member of domain Y, is proxied by Freeradius to RADIUS/AD of that domain - EAP-TLS of client C, member of any domain, is managed by file user I've obtained a similar setup for EAP-TTLS using this configuration in inner-tunnel authorize section: if ("%{Called-Station-Id}" =~ /:SSID_S$/ ) { if ("%{User-Name}" =~ /(a)domainx.com$/ || "%{User-Name}" =~ /\. domainx.com$/ || "%{User-Name}" =~ /^DOMAINX\\\\/ ) { update control { Proxy-To-Realm := 'AD_DOMAINX' } } } Is it possible to obtain this setup with EAP-TLS? How? Thanks -- Davide Belloni http://about.me/davidebelloni http://www.linkedin.com/in/davidebelloni

3 4

Transformation of the + symbol -- FRS 3.0.11
by Mark Williams 03 Nov '16

03 Nov '16

Any idea why the + symbol is being transformed in the ldap filter? Should I be using a different syntax for the attribute substitution? (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Checking for suffix after "@" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Looking up realm "vt.edu" for User-Name = "adp+ipad(a)vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Found realm "~vt.edu$" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Stripped-User-Name = "adp+ipad" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Adding Realm = "vt.edu" (12813372) Tue Oct 18 10:08:33 2016: Debug: suffix: Authentication realm is LOCAL (12813372) Tue Oct 18 10:08:33 2016: Debug: [suffix] = ok (12813372) Tue Oct 18 10:08:33 2016: Debug: update control { (12813372) Tue Oct 18 10:08:33 2016: Debug: } # update control = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: Peer sent EAP Response (code 2) ID 12 length 74 (12813372) Tue Oct 18 10:08:33 2016: Debug: eap: No EAP Start, assuming it's an on-going EAP conversation (12813372) Tue Oct 18 10:08:33 2016: Debug: [eap] = updated (12813372) Tue Oct 18 10:08:33 2016: Debug: [files] = noop (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: --> (uid=adp\5c2bipad) (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Performing search in "ou=People,ou=NIS,o=vt" with filter "(uid=adp\5c2bipad)", scope "sub" (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Waiting for search result... (12813372) Tue Oct 18 10:08:33 2016: Debug: ldap: Search returned no results (12813372) Tue Oct 18 10:08:33 2016: Debug: [ldap] = notfound <http://aka.ms/weboutlook>

3 9

EAP-TTLS not working
by Marlen Caemmerer 03 Nov '16

03 Nov '16

Hello, I have a new radius instance running. Unfortunatelly users with MacOS cannot be authenticated. It seems like the password does not come through. Do you have any idea? /etc/freeradius.testing# freeradius -X -d /etc/freeradius.testing freeradius: FreeRADIUS Version 2.2.5, for host x86_64-pc-linux-gnu, built on Oct 24 2014 at 02:05:28 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/freeradius.testing/radiusd.conf including configuration file /etc/freeradius.testing/proxy.conf including configuration file /etc/freeradius.testing/clients.conf including configuration file /etc/freeradius.testing/wlan_clients.conf including files in directory /etc/freeradius.testing/modules/ including configuration file /etc/freeradius.testing/modules/sql_log including configuration file /etc/freeradius.testing/modules/perl including configuration file /etc/freeradius.testing/modules/attr_filter including configuration file /etc/freeradius.testing/modules/echo including configuration file /etc/freeradius.testing/modules/rediswho including configuration file /etc/freeradius.testing/modules/digest including configuration file /etc/freeradius.testing/modules/pap including configuration file /etc/freeradius.testing/modules/etc_group including configuration file /etc/freeradius.testing/modules/policy including configuration file /etc/freeradius.testing/modules/mac2ip including configuration file /etc/freeradius.testing/modules/logintime including configuration file /etc/freeradius.testing/modules/cui including configuration file /etc/freeradius.testing/modules/dhcp_sqlippool including configuration file /etc/freeradius.testing/modules/replicate including configuration file /etc/freeradius.testing/modules/radrelay including configuration file /etc/freeradius.testing/modules/ldap including configuration file /etc/freeradius.testing/modules/expr including configuration file /etc/freeradius.testing/modules/counter including configuration file /etc/freeradius.testing/modules/ippool including configuration file /etc/freeradius.testing/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius.testing/modules/cache including configuration file /etc/freeradius.testing/modules/inner-eap including configuration file /etc/freeradius.testing/modules/soh including configuration file /etc/freeradius.testing/modules/checkval including configuration file /etc/freeradius.testing/modules/radutmp including configuration file /etc/freeradius.testing/modules/dynamic_clients including configuration file /etc/freeradius.testing/modules/files including configuration file /etc/freeradius.testing/modules/realm including configuration file /etc/freeradius.testing/modules/unix including configuration file /etc/freeradius.testing/modules/detail.log including configuration file /etc/freeradius.testing/modules/sradutmp including configuration file /etc/freeradius.testing/modules/mac2vlan including configuration file /etc/freeradius.testing/modules/passwd including configuration file /etc/freeradius.testing/modules/acct_unique including configuration file /etc/freeradius.testing/modules/detail.example.com including configuration file /etc/freeradius.testing/modules/linelog including configuration file /etc/freeradius.testing/modules/mschap including configuration file /etc/freeradius.testing/modules/expiration including configuration file /etc/freeradius.testing/modules/chap including configuration file /etc/freeradius.testing/modules/opendirectory including configuration file /etc/freeradius.testing/modules/exec including configuration file /etc/freeradius.testing/modules/pam including configuration file /etc/freeradius.testing/modules/smsotp including configuration file /etc/freeradius.testing/modules/detail including configuration file /etc/freeradius.testing/modules/krb5 including configuration file /etc/freeradius.testing/modules/attr_rewrite including configuration file /etc/freeradius.testing/modules/always including configuration file /etc/freeradius.testing/modules/redis including configuration file /etc/freeradius.testing/modules/preprocess including configuration file /etc/freeradius.testing/eap.conf including configuration file /etc/freeradius.testing/policy.conf including files in directory /etc/freeradius.testing/sites-enabled/ including configuration file /etc/freeradius.testing/sites-enabled/eduroam-inner-tunnel including configuration file /etc/freeradius.testing/sites-enabled/eduroam main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius.testing/dictionary main { name = "freeradius" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius-eduroam" run_dir = "/var/run/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius-eduroam/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes allow_vulnerable_openssl = no } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client local { ipaddr = 192.168.11.50 require_message_authenticator = no nastype = "other" } client 192.168.11.246 { require_message_authenticator = no nastype = "other" virtual_server = "eduroam" } client 172.16.1.18 { require_message_authenticator = no nastype = "other" virtual_server = "eduroam" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no nastype = "other" virtual_server = "eduroam" } client 172.16.1.30 { require_message_authenticator = no virtual_server = "eduroam" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius.testing/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius.testing/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius.testing/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius.testing/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ? modules { } # modules } # server server eduroam-inner-tunnel { # from file /etc/freeradius.testing/sites-enabled/eduroam-inner-tunnel modules { Module: Creating Auth-Type = Perl Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius.testing/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius.testing/modules/mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius.testing/eap.conf eap { default_eap_type = "ttls" timer_expire = 60 ignore_unknown_eap_types = yes cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 3 CA_path = "/etc/freeradius.testing/certs" pem_file_type = yes private_key_file = "/etc/freeradius.testing/certs/server.key" certificate_file = "/etc/freeradius.testing/certs/server.pem" CA_file = "/etc/freeradius.testing/certs/ca.pem" dh_file = "/etc/freeradius.testing/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no ecdh_curve = "prime256v1" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "eduroam-inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "eduroam-inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to module rlm_perl Module: Instantiating module "perl" from file /etc/freeradius.testing/modules/perl perl { module = "/etc/freeradius.testing/auth.pl" func_authorize = "authorize" func_authenticate = "authenticate" func_accounting = "accounting" func_preacct = "preacct" func_checksimul = "checksimul" func_detach = "detach" func_xlat = "xlat" func_pre_proxy = "pre_proxy" func_post_proxy = "post_proxy" func_post_auth = "post_auth" func_recv_coa = "recv_coa" func_send_coa = "send_coa" } "my" variable $index_path masks earlier declaration in same scope at /etc/freeradius.testing/auth.pl line 254. Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius.testing/modules/preprocess preprocess { huntgroups = "/etc/freeradius.testing/huntgroups" hints = "/etc/freeradius.testing/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/freeradius.testing/huntgroups reading pairlist file /etc/freeradius.testing/hints Module: Linked to module rlm_detail Module: Instantiating module "auth_log" from file /etc/freeradius.testing/modules/detail.log detail auth_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius.testing/modules/files files { usersfile = "/etc/freeradius.testing/users" acctusersfile = "/etc/freeradius.testing/acct_users" preproxy_usersfile = "/etc/freeradius.testing/preproxy_users" compat = "no" } reading pairlist file /etc/freeradius.testing/users reading pairlist file /etc/freeradius.testing/acct_users reading pairlist file /etc/freeradius.testing/preproxy_users Module: Checking accounting {...} for more modules to load Module: Instantiating module "detail" from file /etc/freeradius.testing/modules/detail detail { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "reply_log" from file /etc/freeradius.testing/modules/detail.log detail reply_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/reply-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } } # modules } # server server eduroam { # from file /etc/freeradius.testing/sites-enabled/eduroam modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius.testing/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.pre-proxy" from file /etc/freeradius.testing/modules/attr_filter attr_filter attr_filter.pre-proxy { attrsfile = "/etc/freeradius.testing/attrs.pre-proxy" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius.testing/attrs.pre-proxy Module: Instantiating module "pre_proxy_log" from file /etc/freeradius.testing/modules/detail.log detail pre_proxy_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/pre-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Checking post-proxy {...} for more modules to load Module: Instantiating module "post_proxy_log" from file /etc/freeradius.testing/modules/detail.log detail post_proxy_log { detailfile = "/var/log/radius-eduroam/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/post-proxy-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.post-proxy" from file /etc/freeradius.testing/modules/attr_filter attr_filter attr_filter.post-proxy { attrsfile = "/etc/freeradius.testing/attrs" key = "%{Realm}" relaxed = no } reading pairlist file /etc/freeradius.testing/attrs } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 1820 } listen { type = "acct" ipaddr = * port = 1821 } ... adding new socket proxy address * port 40565 Listening on authentication address * port 1820 Listening on accounting address * port 1821 Listening on proxy address * port 1822 Ready to process requests. With kind regards, Marlen Caemmerer -- ************************************************ Alice Salomon Hochschule Computerzentrum Marlen Caemmerer Alice-Salomon-Platz 5 12627 Berlin Email: caemmerer(a)ash-berlin.eu ************************************************

6 17

Lookup lists / arrays?
by David Hartburn 03 Nov '16

03 Nov '16

Can anyone offer some configuration advice? Our wireless deployment automatically assigns users to any one of around 20 client VLANS. We have a very small number of MAC addresses (currently 2) that for one reason or another need a static IP. We use RADIUS to make sure they are put on one specific VLAN. This is currently done with a MySQL table of MAC addresses and the following section in the post auth: # Return a static vlan for those in the static IP group if ("%{sql:SELECT COUNT(*) FROM eduroam_static WHERE mac='%{Calling-Station-Id}'}" != 0) { update reply { Tunnel-Type := VLAN Tunnel-Medium-Type := IEEE-802 Tunnel-Private-Group-ID := 641 } } While this works quite nicely, I have two concerns. One is the efficiency overhead. It is performing a SQL lookup on every auth just to make sure 2 MAC addresses are put in the correct VLAN. The other is that we do not have a resilient database server, so when that reboots for patching my FreeRADIUS servers fall over. Build a better database infrastructure is one solution, but I was wondering if there is a better way of doing this? Being such a small dataset, is it possible to maintain an array or list, then use a function to say something like 'if (%{Calling-Station-Id} is in list) {.....'? I could make that if statement a big list of 'this mac or this mac or...', but it could get messy. I would also like to keep the list of special MAC addresses in its own file. This would allow us to deploy the list via puppet. My googling has not turned up anything like what I want, apart from the mac2vlan file used by VPMS. Running a VPMS server seems like overkill too. Any suggestions appreciated. Yours Dave Hartburn

4 8

Strange behaviour combining windows, single-sign-on and peap inner-tunnel
by Herwin Weststrate 03 Nov '16

03 Nov '16

Recently we've seen an extreme corner case with Freeradius, and I'm a bit puzzled on what the best way would be to fix this. The scenario uses Windows clients on Wifi with single-sign-on, PEAP, Freeradius as the Radius server where the inner-tunnel is used, and an Active Directory as backend (this could be either NPS/Radius or Winbind/NTLM authentication, both show this behaviour). The problem does not occur when acting as a real Radius proxy and let the NPS handle the authentication completely. The problem arises when the user is in the AD backend with a certain casing (e.g. "john_doe") but is logging in with a different casing ("John_Doe"). The first authentication succeeds and John Doe's laptop is connected to the wifi. Then, the session expires and the client tries to reauthenticate. Both the inner and outer Radius packets still show "John_Doe" as User-Name attribute, but the authentication fails. I tried recalculating the MS-CHAP2-Response value, and it looks like this has been calculated using the "john_doe" value as username. I'm not exactly sure if it normalizes the username to lowercase here, or if it uses the value as given in the AD backend (in this testcase, both were lowercased, but it sounds more logical to me that the user-name with casing was found via the AD domain). First thing I tried was switching to using the ntlmauth executable instead of a Radius tunnel or Winbind-libs (it was on a system without a build environment, so making changes to the source was not really an option here) and build a wrapper around it: Try an authentication, and if that fails: lowercase the username, recalculate the value that is given as the --challenge-parameter with the new username and try a new authentication. If that fails too, the password is probably incorrect. I switched to ntlm_auth because I didn't exactly see an option to try another authentication with Radius. The authentication succeeded, but the MS-CHAP2-Response attribute in the reply was still based on the username with the incorrect casing, so that failed too. After adding a script in the post-auth to calculate the correct value (which didn't have access to the username used for the authentication, so it just had to blindly try an authentication again, if that failed: lowercase the username and use that), recalculate and everything worked. Well, it worked as far as the proof of concept was concerned, of course this is not exactly a setup you would use in a real environment. The only sensible setup I could think of was to include this within the winbind library user (which would be rlm_mschap here because it's a 3.0 setup): add a boolean config option to retry authentication with a normalized username and use that for further hash calculations. This allows the option to save the user-name used for the authentication hash to be saved in the "session", so we could use it again without have to attempt more authentications. Normalizing to lowercase is probably a bad idea, the `wbinfo` tool allows us to search for the user, we could probably use that too in the winbind libs (and it gives an extra reason why putting this in the winbind code would be a good idea) -- Herwin Weststrate

1 0

How could I manage Multiple IP Address for only one User?
by Jose Quezada 02 Nov '16

02 Nov '16

Hi Everybody, FreeRADIUSv3 If I have a user authenticated to my radius and the user has 5 IP, Public for special services, the user can use all of them over the NAS without problem? or I have to do something special to my FreeRADIUS. Please be as specific as possible. Sorry for my Misspelling... Thanks So Much!

2 1

radtest passes test, phone connects to WiFi, but laptop does not
by Daniel Wruck 02 Nov '16

02 Nov '16

I am a FreeRADIUS newbie but have read a lot (maybe too much - One gripe is that much of the forums on the internet does not clearly list a FreeRADIUS version). I set FreeRADIUS 3 times (test network - FR 2.1 on Ubuntu 14.04, test network - FR 3.0.12 on upgraded Ubuntu 16.04, and prod network - FR 3.0.12 on Ubuntu 16.04) but still could have missed some little important step. I have FreeRADIUS 3.0.12 set up on an Ubuntu 16.04 box. I believe that I have most everything working (except maybe sql). I have an AD forest with 1 domain (fbcexample.com) and 3 child domains (hac.fbcexample.com, cbs.fbcexample.com, and hac.fbcexample.com) I created 4 named mschap modules so that I could hard code the --domain property in each one. I can successfully rad test from each of my 4 domains against it including group membership. Then I setup a test SSID on my aruba controller. I can connect via my android phone (with just username & pass), but connecting a laptop to is not working (it appears that it is sending domain as a part of username). It seems that there is more security stuff going on when the laptop connects; maybe I don't have MSCHAPv2 configured right? Something broken in realms? When the Win 10 x64 laptop connects, radius -X first shows that it is trying to connect via computer name. Then a box pops up asking for username and password with a checkmark for 'Use my Windows user account", I choose and continue. Radius -X shows that several more requests are made and then windows sows 'Can't connect to this network'. Any suggestions on where my problem is? I created the CA and server certs and have believe them to be correctly installed. But not sure that this has anything to do with the problem descripted above. Examples of the code that I am running. I included a pastebin for the 3000 lines of radius -X output. WORKING RADTEST LINE radtest -t mschap daniel.radius passw0rd 127.0.0.1 0 testing123 ABBREVIATED MSCHAP MODULE mschap mschap_fbc { ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=fbcexample --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap_fbc:Challenge}:-00} --nt-response=%{%{mschap_fbc:NT-Response}:-00} --require-membership-of='fbcexample\\LDAP_WiFi'" . . . } DEFAULT SITE AUTHENICATE SECTION authenticate { . . . # MSCHAP authentication. Auth-Type MS-CHAP { mschap_fbc { reject = 2 } if (reject){ mschap_hac reject = 2 } if (reject){ mschap_hbs reject = 2 } if (reject){ mschap_cbs reject = 2 } } . . . } Small part of the Radius -X WHEN CONNECTING WITH LAPTOP, all 3000+ lines are in pastebin below (16) mschap_fbc: Creating challenge hash with username: daniel.radius (16) mschap_fbc: Client is using MS-CHAPv2 (16) mschap_fbc: Executing: /usr/bin/ntlm_auth --request-nt-key --domain=fbcexample --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} --challenge=%{%{mschap_fbc:Challenge}:-00} --nt-response=%{%{mschap_fbc:NT-Response}:-00} --require-membership-of='fbcexample\\LDAP_WiFi': (16) mschap_fbc: EXPAND --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} (16) mschap_fbc: --> --username=FBCEXAMPLE\\daniel.radius (16) mschap_fbc: Creating challenge hash with username: daniel.radius (16) mschap_fbc: EXPAND --challenge=%{%{mschap_fbc:Challenge}:-00} (16) mschap_fbc: --> --challenge=63abafd041820bf2 (16) mschap_fbc: EXPAND --nt-response=%{%{mschap_fbc:NT-Response}:-00} (16) mschap_fbc: --> --nt-response=6bdebf5ac39680b7070c457fefacbdc1596103429c14eb64 (16) mschap_fbc: ERROR: Program returned code (1) and output 'Logon failure (0xc000006d)' (16) mschap_fbc: External script failed (16) mschap_fbc: ERROR: External script says: Logon failure (0xc000006d) (16) mschap_fbc: ERROR: MS-CHAP2-Response is incorrect Full output of Radius -X output when laptop trys to connect http://pastebin.com/TJpYVYnK Daniel W

3 2