- Freeradius-Users - lists.freeradius.org

Cisco ACS and FreeRadius
by John Gill 12 Feb '15

12 Feb '15

Hi, I currently run a Cisco ASA 5510 firewall. Authentication take place via a Windows server with Cisco ACS software. Once the authentication has taken place, the ACS downloads an Access Control List (ACL) to the firewall that then restricts that user access to a single IP Address or in some cases multiple IP addresses. I only have about 20 users but this might grow to 50. I also get a few basic reports of failed and successful logins and how long the user was attached to the network. Is FreeRadius capable of doing this authentication and able to restrict access on the network and generate the basic reports? Regards John Corobrik (Pty) Ltd Reg No 2007/021571/07 P O Box 201367 Durban North KZN 4016 Tel +27 31 560 3111 Alt +27 87 359 3111 Fax +27 31 565 1532 This e-mail and all contents are subject to the following disclaimer: http://www.corobrik.co.za/disclaimer-and-legal-notices

2 1

Issues with £ character in passwords
by Mark Keyte 11 Feb '15

11 Feb '15

Hi We have been running Freeradius with 802.1x (peap-mschapv2) against edirectory authentication for a number of years. Currently running on sles 11 sp3 - freeradius-server-2.2.5-11.1 - but I have tested with older freeradius package that ships with SLES 11 SP3. Setup similar to https://www.novell.com/support/kb/doc.php?id=7009035 We have recently noticed that authentication is failing when users are using the £ sign character in their password (and also § found on macbook keyboards) - it seems to work fine with other characters - !"$%^123&*()_+-=[]{};'#:@~,./<>?\| for example. What I see in logs is Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel [mschapv2] +group MS-CHAP { [mschap] Creating challenge hash with username: lsxtestaas(a)lshtm.ac.uk [mschap] Client is using MS-CHAPv2 for lsxtestaas(a)lshtm.ac.uk, we need NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] = reject However as soon as I remove £ sign auth is working fine. Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/inner-tunnel +group authenticate { [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] = ok +} # group authenticate = ok Login OK: [lsxtestaas(a)lshtm.ac.uk] (from client aruba port 0 cli C48508CCE903 via TLS tunnel) It also works if you use Â£ rather than just the £ within the password when authing from a supplicant (tested with android & Windows)- suggesting some kind of encoding issue??. The cleartext password returned from eDirectory seems fine. [ldap] Added the eDirectory password ****£**** in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] ldap_release_conn: Release Id: 0 ++[ldap] = ok Any thoughts would be appreciated. Thanks Mark

5 4

No such home_server or home_server_pool
by Scott Reeve 11 Feb '15

11 Feb '15

Keep getting this error: Wed Feb 11 11:32:21 2015 : Error: /etc/freeradius/clients.conf[210]: No such home_server or home_server_pool "my-coa" I've tried my best to read through it all. 1) Here's my section in clients.conf: client 15.234.166.129 { secret = abc shortname = abc nastype = other coa_server = my-coa } 2) Here's my section in sites-available/originate-coa: home_server my-coa { type = coa ipaddr = 15.234.166.129 port = 3799 secret = testing1234 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool coa { type = fail-over home_server = my-coa } 3) I could not understand the directions here: # CoA packets can be originated when a normal Access-Request or # Accounting-Request packet is received. Simply update the # "coa" list: # update coa { User-Name = "%{User-Name}" Acct-Session-Id = "%{Acct-Session-Id}" NAS-IP-Address = "%{NAS-IP-Address}" } # # And the CoA packet will be sent. You can also send Disconnect # packets by using "update disconnect { ...". # # This "update coa" entry can be placed in any section (authorize, # preacct, etc.), EXCEPT for pre-proxy and post-proxy. The CoA Was I supposed to uncomment that "update coa" section? Copy and paste it somewhere else? I couldn't figure out what is meant by "can be placed in any other section" authorize/preacct, etc. It seems like it's not even looking at sites-available/originate-coa ? Thank you, Scott Reeve

2 1

Recommended version : 3.0.6 or 3.0.7 RC ?
by Osvaldo T Crispim Filho 11 Feb '15

11 Feb '15

Recommended version : 3.0.6 or 3.0.7 RC ? -- - Osvaldo T Crispim Filho -

3 2

(no subject)
by Robert Graham 10 Feb '15

10 Feb '15

Radius attribue User-password is not being passed in the authorize section. Im trying to use the attribute in an tmp-string-0 line calling sql to exec a stored proc. Its not expanding the User-Password attribute but it IS expanding the User-Name attribute... Is it just hidden or am I correct? Sent from my Android device

3 3

serial number freRADIUS 2.2.5
by Zadda Tempes 10 Feb '15

10 Feb '15

hello sir , please ,can you give me serial number of freeRADIUS 2.2.5?

3 2

Fwd: serial number freRADIUS 2.2.5
by Stefan Paetow 10 Feb '15

10 Feb '15

> On 10 Feb 2015, at 14:12, Zadda Tempes <zadda13(a)gmail.com> wrote: >> please ,can you give me serial number of freeRADIUS 2.2.5? > > FreeRADIUS is OpenSource. It does not have a serial number. Any package insisting on a serial number is *not* something you should use. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

4 4

HA scenario = failure
by Rob Walker 09 Feb '15

09 Feb '15

Hello, I'm a freerad newb, trying to get my HP Procurve 2910al working with 2 freerad servers (setup identically) and windows/linux endpoints. I've tested this setup successfully against each individual freerad server ok. As soon as I test stopping one of the free radius server hosts so that the 2910al is forced to try the other freerad server (testing a HA scenario) - authentication fails. I can only guess that it's something the switch is mishandling? If someone could advise on the below outputs it would be appreciated, it seems the packet length is much less when it doesn't work? Thanks *WORKS* # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "examiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 9 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 222 to 192.168.20.5 port 1812 MS-MPPE-Recv-Key = 0x5ed30fd859b49a49dd16e772a30e330d3573a5630212036937d8f2d MS-MPPE-Send-Key = 0x72687c7646048677b9bc3d82e25efbfeefeb6a5fad3ad0bc50a87c2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "examiner" Finished request 8. Going to the next request *FAILS* # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "examiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry examiner at line 50 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 213 to 192.168.20.5 port 1812 EAP-Message = 0x01060016041053527f160f5a194e8608d8bced20ec12 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa8a53daca8a339aa1a93d90a4cd655f7 Finished request 20. Going to the next request

3 4

CHAP Issues
by Dan Goscomb 09 Feb '15

09 Feb '15

Hi All We are getting seemingly random CHAP authentication issues. These are known good passwords configured on test routers, however we still get the same authentication failed. Has anyone else seen such things? A debug output for one such request is here. The password that the module pulls out to compare against is 100% what we are using. rad_recv: Access-Request packet from host 217.196.224.5 port 1645, id=92, length=148 Framed-Protocol = PPP User-Name = "264247.313093(a)hs.hsoworld.com" CHAP-Password = 0x022714dafa245ec52463c2afc25ea7dbe2 Calling-Station-Id = "BBEU17129208" Connect-Info = "6631000/444000" NAS-Port-Type = ISDN NAS-Port = 21378 NAS-Port-Id = "Uniq-Sess-ID1378" Service-Type = Framed-User NAS-IP-Address = 217.196.224.5 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com [preprocess] expand: %{NAS-IP-Address} -> 217.196.224.5 ++[preprocess] = ok [chap] Setting 'Auth-Type := CHAP' ++[chap] = ok ++[mschap] = noop [suffix] Looking up realm "hs.hsoworld.com" for User-Name = "264247.313093(a)hs.hsoworld.com" [suffix] Found realm "hs.hsoworld.com" [suffix] Adding Stripped-User-Name = "264247.313093" [suffix] Adding Realm = "hs.hsoworld.com" [suffix] Authentication realm is LOCAL. ++[suffix] = ok [eap] No EAP-Message, not doing EAP ++[eap] = noop ++[unix] = notfound [files] users: Matched entry DEFAULT at line 425 ++[files] = ok [sql] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [sql] expand: %{Stripped-User-Name:-%{User-Name:-none}} -> 264247.313093 [sql] sql_set_user escaped user --> '264247.313093' rlm_sql (sql): Reserving sql socket id: 5 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '264247.313093' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = '264247.313093' ORDER BY id [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = '264247.313093' ORDER BY priority [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'hsodefault' ORDER BY id [sql] User found in group hsodefault [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'hsodefault' ORDER BY id rlm_sql (sql): Released sql socket id: 5 ++[sql] = ok ++[expiration] = noop ++[logintime] = noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] = noop +} # group authorize = ok Found Auth-Type = CHAP # Executing group from file /etc/raddb/sites-enabled/default +group CHAP { [chap] login attempt by "264247.313093" with CHAP password [chap] Using clear text password "Gr03ven0r" for user 264247.313093 authentication. [chap] Password check failed ++[chap] = reject +} # group CHAP = reject Failed to authenticate the user. Login incorrect (rlm_chap: Wrong user password): [264247.313093(a)hs.hsoworld.com] (from client lns00.hex.uk port 21378 cli BBEU17129208) Using Post-Auth-Type REJECT # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [attr_filter.access_reject] expand: %{User-Name} -> 264247.313093(a)hs.hsoworld.com attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated _____________________________________________________________________ This e-mail and all attachments have been scanned by the hSo virus scanning service powered by Symantec and no known viruses were detected.

3 3

EAP-PEAP with "special" users
by Jonathan Gazeley 06 Feb '15

06 Feb '15

I've inherited a manky old RADIUS server and I'm trying to get to grips with it. In short, it is using EAP-PEAP/MSCHAPv2 to authenticate users against Active Directory. This is all working fine. I want to add some test user accounts that can be authenticated through EAP but use a flat file rather than ntlm_auth. What's the recommended way of handling this without harming the performance of the majority of the users who will not appear in the users file? Thanks, Jonathan

2 3