- Freeradius-Users - lists.freeradius.org

EAP & MAC Auth
by Russell Mike 17 Jun '14

17 Jun '14

Hi List Members How can we do EAP authentication & MAC address look up in addition (stored in MySQL DBMS) before accepting? Thanks

2 2

I have installed the latest free radius 3.03-2, radtest command is not found
by blue phoenix 17 Jun '14

17 Jun '14

Fairly new to the Linux/Unix community and it’s CLIs… I have installed the freeradius software via terminal and not via the GUI. sudo yum install freeradius I have this version installed [root@localhost /]# rpm -qa freeradius\* freeradius-3.0.3-2.fc20.i686 I believe that I have installed it correctly since when I issued the 'radiusd -X’ command it is waiting for logs #other commands omitted } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on auth address * port 1812 as server default Listening on acct address * port 1813 as server default Listening on auth address 127.0.0.1 port 18120 as server inner-tunnel Opening new proxy socket 'proxy address * port 0' Listening on proxy address * port 34199 Ready to process requests. Now I opened another terminal window to edit the user file [root@localhost /]# vi /etc/raddb/users I have added this to the 1st line testing Cleartext-Password := “password” issued :wq! typed this command afterwards: [root@localhost /]# radtest testing password localhost 0 testing123 bash: radtest: command not found... [root@localhost /]# Please help to determine how come I was not able to run radtest and what steps do I need to do in order to successfully install freeradius. Thanks,

2 3

Sanity check on coa
by Phil Mayers 17 Jun '14

17 Jun '14

Can someone just check me here: If I want to send a CoA request from a client, via FR, to the NAS (because the NAS is dumb and will only take CoA packets from the auth/acct server IPs & secrets) then I'm stuck with defining one home server/pool per NAS, right?

2 3

HEX Stripping using attr_rewrite
by Simon Allard 17 Jun '14

17 Jun '14

Hi Freeradius list :-) I am have a bit of an issue with the stripping hex values from my ADSL-Agent-Remote-ID field in my Auth packet. I am using an Alcatel-Lucent 7750SR platform and for some reason they decided when converting a DHCPv6 packet into a radius packet it appends the Enterprise ID (which is a hex number) into the ADSL-Agent-Remote-ID. I end up with a packet looking like this: User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" User-Password = "" NAS-IP-Address = 60.xxx.xxx.xxx ADSL-Agent-Circuit-Id = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" ADSL-Agent-Remote-Id = "\000\000\000\001CHORUS1234567894" NAS-Port-Type = Ethernet NAS-Port-Id = "pw-2:1101.104" Calling-Station-Id = "\000\000\000\001CHORUS1234567894" NAS-Identifier = "bng" Acct-Session-Id = "E1F15900F37E74538D434C" The issue I seem to be running into, since \000 is a termination value, that freeradius sees the value of attribute ADSL-Agent-Remote-Id as blank. Example below. [sql] expand: %{Orcon-User-Name} -> : User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" User-Password = "" NAS-IP-Address = 60.xx.xx.xx ADSL-Agent-Circuit-Id = "MDR-POLT01 eth 1/1/01/01/4/1/1:10" ADSL-Agent-Remote-Id = "\000\000\000\001CHORUS1234567894" NAS-Port-Type = Ethernet NAS-Port-Id = "pw-2:1101.104" Calling-Station-Id = "\000\000\000\001CHORUS1234567894" NAS-Identifier = "bng1" Acct-Session-Id = "E1F15900F40272538D8D8E" +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "MDR-POLT01 eth 1/1/01/01/4/1/1:10", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] expand: %{ADSL-Agent-Circuit-Id} -> MDR-POLT01 eth 1/1/01/01/4/1/1:10 ++[files] returns noop [sane_dhcpv6_chorus] expand: \000\000\000\001 -> \000\000\000\001 sane_dhcpv6_chorus: Does not match: ADSL-Agent-Remote-Id = sane_dhcpv6_chorus: Could not find value pair for attribute ADSL-Agent-Remote-Id ++[sane_dhcpv6_chorus] returns ok My attr_rewrite code is: attr_rewrite sane_dhcpv6_chorus { attribute = ADSL-Agent-Remote-Id searchin = packet searchfor = "\\000\\000\\000\\001" replacewith = "" ignore_case = no new_attribute = no max_matches = 10 ## If set to yes then the replace string will be ## appended to the original string append = no } I have raised the issue with the vendor, but I am not holding my breath for a fix anytime soon. Are there any other options in freeradius to get around this?

5 8

LDAP Groups to Freeradius and then Ruckus Wireless?
by Enrique Sainz Baixauli 17 Jun '14

17 Jun '14

Hello there, I'm trying to deploy a FreeRadius server with OpenLDAP. To this end, both are working properly and communicate with each other successfully. I have LDAP groups set up so users belong to a group and I can check from freeradius' users file if a user belongs to a group (and, for example, deny access to all users belonging to a certain group). I must say that, if I enable group checking in users file, I can see rlm_ldap debug info about it searching for group information; but if it's not enabled it doesn't search for groups. The issue here is that the server will be used to authenticate wifi users from a Ruckus ZoneDirector device, which defines roles and assigns roles to the users depending on the groups that the users belong to. This works flawlessly when authenticating against LDAP itself, but if freeradius stands in the middle the group info gets lost somewhere. I know that freeradius can access Ldap-Group variable and know which group the user belongs to, but I'd like it to forward that info to the ZoneDirector (who is actually performing the authentication request against freeradius), so that it can assign the role properly. The LDAP database is set up with two OUs, users and groups, and users being of objectClass inetOrgPerson and groups being groupOfNames. In freeradius, ldap config is mostly default except for server, identity, etc, but with these group-related parameters: groupname_attribute = cn groupmembership_filter = (&(objectClass=groupOfNames)(member=%{control:Ldap-UserDn})) groupmembership_attribute = member # (also tried with memberOf, radiusGroup, radiusGroupName and several others) And, about the server, it is running Debian 7.5, OpenLDAP 2.4.31 and freeradius 2.1.12 (default packages from debian). I can provide any other info that you need :) Thanks everyone in advance!

8 76

Dumb all returned attributes
by Brandon Jozsa 17 Jun '14

17 Jun '14

Want to approach this differently than trying to use cache, as I don't think rlm_cache will fit what I need. At least not how I can logically wrap my head around it anyway... I'm running FR in proxy mode and can collect send user auth to an upstream radius server. Is there any way to collect, and dump, all returned attributes to a text file? If so, how can I do this...I can't find any good articles that show how to really do this. It's for a quick and dirty forklift solution to replace an old, ready to fail RSA server. I want to try dumping the output first, then possibly figure out how to use a rlm_perl to maybe put back into a mysql database for later use. I could really use some help trying to figure this out. -- Brandon

2 2

Freeradius with Active Directory
by Prashant A 16 Jun '14

16 Jun '14

Hi All, I have followed the guide for integrating freeradius with active directory which is mentioned here, http://deployingradius.com/documents/configuration/active_directory.html So finally, radtest -t mschap prashant Active@123 localhost 0 testing123 Gives me following output Sending Access-Request Id 40 from 0.0.0.0:54825 to 127.0.0.1:1812 User-Name = 'prashant' NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00 MS-CHAP-Challenge = 0x42b125cb7f6408b4 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000c82b9abb20333db96efcb1f93beb602b39ebbd007a8c0392 Received Access-Accept Id 40 from 127.0.0.1:1812 to 127.0.0.1:54825 length 84 MS-CHAP-MPPE-Keys = 0x MS-MPPE-Encryption-Policy = Encryption-Allowed MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed But when I try to login from webpage I am getting following response (0) mschap : Client is using MS-CHAPv2 (0) mschap : Executing: /usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-mycompany.local} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} (0) mschap : EXPAND --username=%{mschap:User-Name:-None} (0) mschap : --> --username=prashant (0)*ERROR: mschap : No NT-Domain was found in the User-Name* (0) mschap : EXPAND --domain=%{%{mschap:NT-Domain}:-mycompany.local} (0) mschap : --> --domain=mycompany.local (0) mschap : Creating challenge hash with username: prashant (0) mschap : EXPAND --challenge=%{mschap:Challenge:-00} (0) mschap : --> --challenge=e5d49180d36eb904 (0) mschap : EXPAND --nt-response=%{mschap:NT-Response:-00} *(0) mschap : --> --nt-response=0000000e0000000000000000000000000000000000000000** **(0) ERROR: mschap : Program returned code (1) and output 'Logon failure (0xc000006d)'* (0) mschap : External script failed. (0) ERROR: mschap : External script says: Logon failure (0xc000006d) (0) ERROR: mschap : MS-CHAP2-Response is incorrect (0) [mschap] = reject (0) } # Auth-Type MS-CHAP = reject Can somebody help me to understand what exactly the issue. I am using FreeRADIUS Version 3.0.3 and Samba version 3.6.3. Thanks & Regards, Prashant

3 6

Re: Issues with building Freeradius on CentOS 6.5: need rlm_cache
by Brandon Jozsa 16 Jun '14

16 Jun '14

Ok, so now that I have this working...rlm_cache is loading just fine, but I think I may be making an error (based on what I want to achieve anyway). I've taken information from the article http://wiki.freeradius.org/modules/Rlm_cache#Two-call-caching, and i see the cache working, but is it in the wrong place? My hope was that if the user doesn't exist in sql (which "tester" doesn't) then forward. When you get a response, cache these attributes (user account, authZ privileges, etc) back into the sql database. I don't see any updates to the radcheck table, but I'm not 100% sure if that's where it should go. Sorry for being slow here...can anyone help, or do I have this wrong? I'm probably missing something easy here or just getting the formatting wrong. output (i can give more if necessary): [sql] User tester not found +++[sql] = notfound ++} # if (notfound) = notfound ++update control { ++} # update control = noop [cache] expand: %{User-Name} -> tester [cache] expand: reply:Reply-Message -> reply:Reply-Message [cache] expand: Cache last updated at %t -> Cache last updated at Fri Jun 13 16:41:10 2014 [cache] expand: ssssssssssssssssssssssssssssssss -> ssssssssssssssssssssssssssssssss [cache] expand: %{randstr:ssssssssssssssssssssssssssssssss} -> gcEKJNqJQcCe4J4qSRlEciZ7DYDhJW7e rlm_cache: Adding entry for "tester", with TTL of 10 ++[cache] = updated +} # group authorize = updated WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Proxying request 0 to home server 192.168.1.35 port 1812 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Going to the next request Waking up in 0.9 seconds. Waking up in 19.0 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 42674, id=113, length=76 Sending duplicate proxied request to home server 192.168.1.35 port 1812 - ID: 182 Sending Access-Request of id 182 to 192.168.1.35 port 1812 User-Name = "tester" User-Password = "suckit" NAS-IP-Address = 192.168.1.136 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313133 Waking up in 14.9 seconds. rad_recv: Access-Accept packet from host 192.168.1.35 port 1812, id=182, length=25 Proxy-State = 0x313133 The config under authorize section: ############ CUSTOM AUTHORIZE STATEMENTS ############ if (!notfound) { update control { Proxy-To-Realm := "DARTH_RSA" } } ############ CUSTOM CACHING REQUIREMENTS ############ update control { Cache-Status-Only = 'yes' } cache if (notfound) { sql } update control { Cache-Status-Only := 'no' } cache ############ CUSTOM AUTHORIZE STATEMENTS ############ On Thu, Jun 12, 2014 at 11:50 PM, Brandon Jozsa <bjozsa(a)gmail.com> wrote: > Hello, > > I've been trying to work through the issues and by searching high and low > for solutions before turning to this users list. I'm sorry if this is a > stupid question (I've seen worse though, so maybe I shouldn't feel bad). > > I have a very high need to use the rlm_cache module with Freeradius on > CentOS 6.5. I'm trying to first us the statement: > > ----- snipped ----- > > authorize { > if (!notfound) { > update control { > Proxy-To-Realm := "SOME_REALM" > } > } > ----- snipped ----- > > which works GREAT alone...but I also want to use the cache function like > so: > > ----- snipped ----- > update control { > Cache-Status-Only = 'yes' > } > cache > if (notfound) { > sql > } > update control { > Cache-Status-Only := 'no' > } > cache > > ----- snipped ----- > > which doesn't work (obviously) because rlm_cache isn't included with > 2.1.12, or so it seems anyway. > > My hope is (it is a hope anyway) that I can collect authN/authZ replies > from an upstream radius server and cache them locally; thus building a > mysql database of users access/privileges and let this run on an > environment before cutting completely over to our new Freeradius setup. > Again, I'm hoping it can work like this...getting rid of RSA and using > LinOTP or MOTP would be so nice; it would be more flexible and user > friendly, but I really need to collect authN and authZ in order to rebuild > our massive user-base. > > My issue...CentOS, which is our "approved platform" (I'm rolling my eyes > and giving air quotes), doesn't have a newer version of Freeradius other > than 2.1.12. I think the rlm_cache modules are only included in 3.0.0 and > higher, is that right? > > So, I started looking on how to build from source...and I found one; great > news I thought!! Enter: > http://confluence.diamond.ac.uk/display/PAAUTH/FreeRADIUS+specs+and+sources…. > I thought this would save the day, but there are broken links for 3.0.0 and > I am running into major issues; it just doesn't seem to work at all. I also > tried to build it out, take the rlm_cache.so lib over to my 2.1.12 > installation, but Freeradius barfed all over that little trick. > > What are my options here? I could really use some help. Any ideas? > > -- > Brandon > -- Brandon

3 16

freeradius installation question
by Bryan Totten 16 Jun '14

16 Jun '14

Installed freeradius on ubuntu 12.04. I was able to start in debug mode the first time however now i am getting error message stating: /var/run/freeradius/freeradius.pid not found... any help would be greatly appreciated! tottenavl

2 1

Winbind issues in Ubuntu 14.04
by Arran Cudbard-Bell 15 Jun '14

15 Jun '14

So no one else wastes a couple of hours of their lives wondering why ntlm_auth is failing due to what appear to be permissions issue. In the version of samba4 installed with Ubuntu 14.04 (4.1.6) the default location of the winbinddd_privileged directory appears to be /var/lib/samba. The upstart script however, still has it in /var/run/samba/ (it may have changed), and does a lovely job of masking the problem by creating the winbindd_privileged directory there on start: pre-start script test -x /usr/sbin/winbindd || exit 0 mkdir -p /var/run/samba/winbindd_privileged chgrp winbindd_priv /var/run/samba/winbindd_privileged chmod 0750 /var/run/samba/winbindd_privileged end script Special shout outs go to the samba project for writing a utility with the most useless debugging output ever: Program returned code (1) and output 'Reading winbind reply failed! (0xc0000001)' (57) mschap : External script failed (57) ERROR: mschap : External script says: Reading winbind reply failed! (0xc0000001) (57) ERROR: mschap : MS-CHAP2-Response is incorrect and whoever decided to disable the init.d script on upstart enabled systems by adding: case "$1" in start) if init_is_upstart; then exit 1 fi Lovely. Bug reported here for winbindd_privileged: https://bugs.launchpad.net/ubuntu/+source/samba/+bug/1330220 Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

3 2