- Freeradius-Users - lists.freeradius.org

Freeradius Active Directory Authentication using ntlm_auth
by Shyju Kanaprath 16 Nov '14

16 Nov '14

Hi All, I'm trying to configure Freeradius Active Directory Authentication using ntlm_auth.When I run from the shell I could get the positive response. ntlm_auth --username shyju --passwordPassword:NT_STATUS_OK: Success (0x0) But when I test with the radtest authentication does not work. Please Find below the logs. Client - Sideradtest shyju password localhost 0 testing123 Sending Access-Request of id 125 to 127.0.0.1 port 1812 User-Name = "shyju" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=125, length=20 Server-Side rad_recv: Access-Request packet from host 127.0.0.1 port 60581, id=253, length=131 User-Name = "shyju" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x0156cd3b06a063bf8c9dee41dca40c37 MS-CHAP-Challenge = 0x3b41e041947f5126 MS-CHAP-Response = 0x00010000000000000000000000000000000000000000000000003d43a50a42ac1c73b4beeab62bfba628013e7764d8651047# Executing section authorize from file /etc/freeradius/sites-enabled/default+- entering group authorize {...}++[preprocess] returns ok++[chap] returns noop[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'++[mschap] returns ok++[digest] returns noop[suffix] No '@' in User-Name = "shyju", looking up realm NULL[suffix] No such realm "NULL"++[suffix] returns noop[eap] No EAP-Message, not doing EAP++[eap] returns noop++[files] returns noop++[expiration] returns noop++[logintime] returns noop[pap] WARNING! No "known good" password found for the user. Authentication may fail because of this.++[pap] returns noopFound Auth-Type = MSCHAP# Executing group from file /etc/freeradius/sites-enabled/default+- entering group MS-CHAP {...}[mschap] Told to do MS-CHAPv1 with NT-Password[mschap] expand: %{Stripped-User-Name} ->[mschap] ... expanding second conditional[mschap] expand: %{User-Name} -> shyju[mschap] expand: %{%{User-Name}:-None} -> shyju[mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=shyju[mschap] No NT-Domain was found in the User-Name.[mschap] expand: %{mschap:NT-Domain} ->[mschap] ... expanding second conditional[mschap] expand: --domain=%{%{mschap:NT-Domain}:-DOMAIN.LOCAL} -> --domain=DOMAIN.LOCAL[mschap] mschap1: 3b[mschap] expand: %{mschap:Challenge} -> 3b41e041947f5126[mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=3b41e041947f5126[mschap] expand: %{mschap:NT-Response} -> 3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047[mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=3d43a50a42ac1c73b4beeab62bfba628013e7764d8651047Exec-Program output: Reading winbind reply failed! (0xc0000001)Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001)Exec-Program: returned: 1[mschap] External script failed.[mschap] MS-CHAP-Response is incorrect.++[mschap] returns rejectFailed to authenticate the user.Using Post-Auth-Type Reject# Executing group from file /etc/freeradius/sites-enabled/default+- entering group REJECT {...}[attr_filter.access_reject] expand: %{User-Name} -> shyjuattr_filter: Matched entry DEFAULT at line 11++[attr_filter.access_reject] returns updatedDelaying reject of request 2 for 1 secondsGoing to the next requestWaking up in 0.8 seconds.Sending delayed reject for request 2Sending Access-Reject of id 253 to 127.0.0.1 port 60581 MS-CHAP-Error = "\000E=691 R=1"Waking up in 4.9 seconds.Cleaning up request 2 ID 253 with timestamp +73Ready to process requests. _______ Regards, Shyju

4 7

Redundant expansions?
by Alan DeKok 15 Nov '14

15 Nov '14

So.. should redundant expansions go into 3.0.5? They would work like this: instantiate { ... redundant-load-balance my_sql { sql1 sql2 sql3 } } You can already use "my_sql" in the "authorize" section, which is nice. This feature would allow you to use "my_sql" in expansions: update reply { Filter-Id := "%{my_sql:SELECT ...}" } The server core will automatically find *one* of the listed modules (sql1, sql2, or sql3), and call it. This feature has long been requested,and it's finally in the "master" branch. The question is whether it should go into the 3.0.5 release. Since the connection pools now support a "retry_delay" parameter, the cost of querying a "down" SQL server is essentially zero. In v2, the server would usually try to reconnect to SQL for evcery request. In v3, the "retry_delay" makes the "redundant-load-balance" blocks more useful. SQL servers which are down are effectively remove from the redundant list, until "retry_delay" seconds have passed. These changes increase the performance of the server, and make problems much less notable. Alan DeKok.

2 2

Plans for the next few releases
by Alan DeKok 14 Nov '14

14 Nov '14

We're continuing to develop the server, so I'd like to clarify the policy around releases. Version 2.2.x: Long term stable release. No new features. Minor bug fixes. The goal is long-term stability. We will maintain it 2-3 years. Version 3.0.x: Version 3 stable release Minor new features Focus on bug fixes and stability Will maintain it for 4-5 years Version 3.1: unstable new development Major new features Major re-architecture of the server core Which version should you use? That depends on what you have now, and what you need: * basic RADIUS and running 1.x: UPGRADE NOW * basic RADIUS and running version 2: should use 2.2.x * need better "unlang", error checking, SNMP triggers, RadSec: 3.0.x * experimental new work: bleeding edge 3.1. Arran and I have started announcing new features to this list, as the features are implemented. We'll keep doing that for the 3.1 branch. And probably stop doing new features in 3.0. We've had issues with 3.0 stability (sorry). A good part of that was problems with talloc. The documentation says one thing, but the code does something else. So that made life difficult for a while. The work of the last few months has made 3.0.4 very stable. The bug fixes for 3.0.5 are minor, and ensure that all of the "corner cases" are handled correctly. Now that we have a stable version of 3.0, we can start re-working the "master" branch for 3.1. We have a long list of new features, many of which require re-architecture. We don't want to break 3.0, so those features require a new version. Alan DeKok.

2 3

Re: NAP with Freeradius
by Zulzig 14 Nov '14

14 Nov '14

accept my apologies Alan i didn't see your answer. you said: > You shouldn't do that. This should be a separate policy. i didn't understand your answer. I should create two policies. isn't it ? the first, in the goal to compare the last authentication and the last to update my radusergroup. thank a lot

2 1

Re: NAP with freeradius
by Zulzig 14 Nov '14

14 Nov '14

Hello Rui, in fact i would like to assign users in different vlan, with an automatic process. If the user's last session is superior à 5 days, mysql does the update of the radusergrouptable, it will change the user's groupname (A to B). At the resultat, freeradius will have to send to the nas a different radgroupreply (B parameters). I use a trigger for it. It works, but i found an issue. Freeradius send to the NAS the old values of the radgrouprely (A parameters). I will try to update ma version of freeradius and find some information about ulang. Thank a lot for your help

1 0

module return codes
by Travis Dimmig 14 Nov '14

14 Nov '14

I can't figure out how to get modules to return with the codes I want them too. I have (what I believe to be) a very simple policy for checking if a request looks like a MAC authentication request. I would like the policy module return to be able to indicate if the request looks like it's MAC authentication or not. I have a policy defined in policy.conf as follows: check.mac_authentication { if ( (Calling-Station-Id) && (User-Name) ) { if ( "%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) { update request { Tmp-String-0 := "%{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}" } } if ( "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) { update request { Tmp-String-1 := "%{tolower:%{1}%{2}%{3}%{4}%{5}%{6}}" } } } if ( (Tmp-String-0) && (Tmp-String-1) && "%{Tmp-String-0}" == "%{Tmp-String-1}" ) { ok } else { noop } } The goal is to return "ok" if both attributes exist, look like mac addresses, and have the same value (after being normalized to lower-case and having delimiters removed). Otherwise, it should return "noop". What is happening instead: +++- entering policy check.mac_authentication {...} ++++? if ((Calling-Station-Id) && (User-Name) ) ?? Evaluating (Calling-Station-Id) -> TRUE ?? Evaluating (User-Name) -> TRUE ++++? if ((Calling-Station-Id) && (User-Name) ) -> TRUE ++++- entering if ((Calling-Station-Id) && (User-Name) ) {...} +++++? if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) expand: %{User-Name} -> 11bbccddeeff expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ ? Evaluating ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++++? if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) -> TRUE +++++- entering if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 11bbccddeeff expand: %{tolower:%{1}%{2}%{3}%{4}%{5}%{6}} -> 11bbccddeeff ++++++[request] returns ok +++++- if ("%{User-Name}" =~ /^%{config:policy.mac-addr}$/i ) returns ok +++++? if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) expand: %{Calling-Station-Id} -> AA-BB-CC-DD-EE-FF expand: policy.mac-addr -> policy.mac-addr expand: ^%{config:policy.mac-addr}$ -> ^([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})$ ? Evaluating ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) -> TRUE +++++? if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) -> TRUE +++++- entering if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) {...} expand: %{1}%{2}%{3}%{4}%{5}%{6} -> AABBCCDDEEFF expand: %{tolower:%{1}%{2}%{3}%{4}%{5}%{6}} -> aabbccddeeff ++++++[request] returns ok +++++- if ("%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i ) returns ok ++++- if ((Calling-Station-Id) && (User-Name) ) returns ok ++++? if ((Tmp-String-0) && (Tmp-String-1) && "%{Tmp-String-0}" == "%{Tmp-String-1}" ) ?? Evaluating (Tmp-String-0) -> TRUE ?? Evaluating (Tmp-String-1) -> TRUE expand: %{Tmp-String-0} -> 11bbccddeeff expand: %{Tmp-String-1} -> aabbccddeeff ? Evaluating ("%{Tmp-String-0}" == "%{Tmp-String-1}" ) -> FALSE ++++? if ((Tmp-String-0) && (Tmp-String-1) && "%{Tmp-String-0}" == "%{Tmp-String-1}" ) -> FALSE ++++- entering else else {...} +++++[noop] returns noop ++++- else else returns noop +++- policy check.mac_authentication returns ok When execution enters the final "else" with the noop, why does the module still return "ok" ? Any help will be greatly appreciated.... -Travis

2 1

Cisco Phones in users file
by Bilik.AA＠lsrgroup.ru 14 Nov '14

14 Nov '14

Hello everybody! I need to do kind of “universal transparent radius” without any external database for authentification both computers and Cisco-phones in voice vlan. I think there must be something in “users” file kind of: ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ DEFAULT attr:= “it’s a some computer” Auth-Type := Accept DEFAULT attr:= “it’s a some Cisco-phone” Auth-Type := Accept Cisco-AVPair = "device-traffic-class=voice" ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ How do you think, is there some possibility to do this? Thank you. Alex Bilik С уважением, Александр Билик Инженер по информационной безопасности Группа управления коммуникациями Группа ЛСР E-mail: Bilik.AA(a)lsrgroup.ru<mailto:Bilik.AA@lsrgroup.ru> www.lsrgroup.ru [cid:image002.png@01D00029.668E3800]

2 1

NAP with freeradius
by Zulzig 14 Nov '14

14 Nov '14

Hello everybody ! I installed freeradius-server-2.1.12 with Mysql like a network access point. it works perfectly. I would like to improve my setup. somebody can to say me, if it is possible to use a function that allow me to add a condition based on the last authorization of the computer. for an example, if the last authorization is superior at X days, the computer will be on another vlan. On the mysql server, the radusergroup of the user is modified. Thank for your answer Zulzig

2 1

Re: Freeradius-Users Digest, Vol 115, Issue 42
by Rui Ribeiro 14 Nov '14

14 Nov '14

Hi Zulgig, You do not give much details and is difficult to give a more proper answer. Nevertheless, yes, a login with more than x time usage or bandwidth can be sent to another VLAN with unlang IF you are sending the accounting to a database. Migrate also to 2.2.5 or even better 3.x, 2.1.12 is very old and has known serious bugs. Regards, Rui Ribeiro -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434 > Message: 2 > Date: Fri, 14 Nov 2014 11:44:35 +0100 > From: Zulzig <zulzig(a)gmail.com> > To: freeradius-users <freeradius-users(a)lists.freeradius.org> > Subject: NAP with freeradius > Message-ID: > < > CAKSwai+j8V4y8sVLXicudoE6dAx_deE_o47-DnaMtM6X-hH6Mw(a)mail.gmail.com> > Content-Type: text/plain; charset="utf-8" > > Hello everybody ! > > I installed freeradius-server-2.1.12 with Mysql like a network access > point. > > it works perfectly. I would like to improve my setup. > > somebody can to say me, if it is possible to use a function that allow me > to add a condition based on the last authorization of the computer. > for an example, if the last authorization is superior at X days, the > computer will be on another vlan. > > On the mysql server, the radusergroup of the user is modified. > > Thank for your answer > > Zulzig > >

1 0

Re: Dropping EAPOL frame, not key frame (Norman Elton)
by Rui Ribeiro 14 Nov '14

14 Nov '14

Hi Norman, I have witnessed systematic problems in every new major release of Apple. They only seem to get right the wifi part after minor .6 or .7 updates in some more problematic versions. The last yosemite version is no exception. I am on the beta program, and 10.10.1, the upcoming update, seems to bring again more wifi bug fixes. iOS as you know has had also bug fixes in the last two updates. At home, I had loads of this problems with 3 different MacBook Pros, often the icon was up and down 60s, and only fixed it going to 5Ghz. A lot of wifi BSSIDs seen at home, in excess of 40 at least. The Windows machine was slow, but was not that much problematic. At work, the same thing is happening. We have a large campus deployment, and the experience of OS/X iOS people with 5GHz is radically better than the old models which work only in 2GHz. We also have another big problem at the moment at work, which is the Meru firmware/controller version 6 has been laden with terrible bugs for months. When in Cisco APs the experience is so much better. Regards > > > Message: 1 > Date: Thu, 13 Nov 2014 09:37:49 -0500 > From: Norman Elton <normelton(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Dropping EAPOL frame, not key frame > Message-ID: > < > CAPCnwUeidGnwV9h3Fv8oDsCdbq7R0M3Lt2djWTOydeYWNHMcdQ(a)mail.gmail.com> > Content-Type: text/plain; charset=UTF-8 > > We have wireless clients doing MS-CHAPv2 authentication against our > access points. FreeRADIUS serves as a proxy between the APs and our > domain controllers. When a Mac laptop connects, or in some cases > roams, we see the wifi icon laddering up and down for 20-30 seconds. > During this time, I've spotted the following error in the laptop's > system.log: > > inputEAPOLFrame: Dropping EAPOL frame, not key frame > > Initial Googling hasn't turned up anything relevant, and I realize > this is likely not a FreeRADIUS issue (as it's only a proxy). But I'm > hoping that the collective wisdom of FreeRADIUS users could shed some > light on what's going on. > > I'm comfortable wiresharking this to death, but my EAP knowledge is > somewhat anemic. Can anyone shed some light on what's going on here? > > Thanks, > > Norman Elton > -- Regards, -- Rui Ribeiro Senior Sysadm ISCTE-IUL https://www.linkedin.com/pub/rui-ribeiro/16/ab8/434

1 0