- Freeradius-Users - lists.freeradius.org

Re: In auth request packet, Stripped-User-Name attribute value wrongly rewritten by radius server
by Adarsha S 11 Apr '14

11 Apr '14

Hi Alan, I'm resending the mail as previously it excessed the message size limit I've attached the truncated log in this mail. Please let me know your inputs. Thanks, Adarsha On Wed, Apr 9, 2014 at 11:55 AM, Adarsha S <s.adarsha(a)gmail.com> wrote: > Hi Alan, > > I did upgrade my free radius to 2.2.4 but still the issue persist. > I've attached the log of the same. > > On looking at code flow could make out while creating the new attribute > (stripped-user-name), " '\\' 't' " is replaced as '\t'. > As a fix I've made below changes. > > *File :* src/modules/rlm_attr_rewrite/rlm_attr_rewrite.c > *Function:* do_attr_rewrite() > *RCA :* While paring attribute with value ,value is formatted and then > paired. During formation " \\t " is replaced by " \t " > *Fix:* Before paring attribute with value, convert the value to printable > formate and then send it for paring. > > > > > > > > > > > > > > > > > > *@@ -180,7 +184,17 @@ DEBUG2("%s: xlat on replace > string failed.", data->name); return ret; > }- attr_vp = > pairmake(data->attribute,replace_STR,0);++// attr_vp = > pairmake(data->attribute,replace_STR,0);+ lent = > fr_print_string(replace_STR, + 0,+ > modified_replace_STR, sizeof(modified_replace_STR));+ > modified_replace_STR[lent] = '\0';++ attr_vp = > pairmake(data->attribute,modified_replace_STR,0); + if > (attr_vp == NULL){ DEBUG2("%s: Could not add new > attribute %s with value '%s'", data->name, > data->attribute,replace_STR);* > > Pleaseguide me in understanding if this fix will create problem in any > other scenarios. > > Thanks, > Adarsha > > > > > > > On Tue, Apr 8, 2014 at 2:37 AM, Alan DeKok <aland(a)deployingradius.com>wrote: > >> Adarsha S wrote: >> > I'm having a setup where clients get authenticated by Windows AD 2003 >> server. >> > It uses stripped-user-name attribute. >> > I'm having free radius 2.1.12 as the radius server. >> > The username are provided as DomainName\Username. >> > Various combination of Domain name and user name worked but when ever >> > the username starts with "t" or "n" the authentication failed. >> >> Upgrade. IIRC this issue was fixed. >> >> The latest release is 2.2.4. You're running a version which is many >> years out of date. >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > >

2 1

Chap Challenge Failing
by Joseph Showalter 11 Apr '14

11 Apr '14

# freeradius -v freeradius: FreeRADIUS Version 2.1.12 We have a puzzling issue with CHAP Authentication: Using radtest like this works: radtest -d /etc/freeradius/ -t chap "6064191000(a)ev.myawi.com" "6D464023735E40604457225169645C69" 127.0.0.1 1812 xxxxxx But when a real live device request comes in, it fails: This should be allowed but is rejected: Using md5 hashing, we have confirmed that it is accurate: Radius Protocol Code: Access-Request (1) Packet identifier: 0x51 (81) Length: 145 Authenticator: dbad48a07b45dc16a42806283bfa3432 [The response to this request is in frame 2] Attribute Value Pairs AVP: l=25 t=User-Name(1): 6064191000(a)ev.myawi.com User-Name: 6064191000(a)ev.myawi.com AVP: l=19 t=CHAP-Password(3): a7737618eb2d4f46a3945215a989923560 CHAP-Password: a7737618eb2d4f46a3945215a989923560 CHAP Ident: 0xa7 CHAP String: 737618eb2d4f46a3945215a989923560 AVP: l=6 t=NAS-IP-Address(4): 10.xxx.2.1 NAS-IP-Address: 10.xxx.2.1 (10.xxx.2.1) AVP: l=18 t=CHAP-Challenge(60): 5072685c0183c07d006ff00c160671a0 CHAP-Challenge: 5072685c0183c07d006ff00c160671a0 AVP: l=12 t=Vendor-Specific(26) v=3rd Generation Partnership Project 2 (3GPP2)(5535) VSA: l=6 t=3GPP2-HRPD-Access/Terminal-Authentication-and-1x-Access-Authorization(60): 1 3GPP2-HRPD-Access/Terminal-Authentication-and-1x-Access-Authorization: 1 AVP: l=23 t=Vendor-Specific(26) v=3rd Generation Partnership Project 2 (3GPP2)(5535) VSA: l=17 t=3GPP2-AT-Hardware-Identifier(61): [unhandled integer length(15)] AVP: l=18 t=Message-Authenticator(80): 8ce6cfeb0d0ef6a09bd3dbbdd7495226 Message-Authenticator: 8ce6cfeb0d0ef6a09bd3dbbdd7495226 AVP: l=4 t=Proxy-State(33): 3834 Proxy-State: 3834 Here is the users file we are using for testing: 6064191000(a)ev.myawi.com Cleartext-Password := "6D464023735E40604457225169645C69" Callback-Id = "000006064191000", Fall-Through = Yes Here is the debug on freeradius -X Thu Apr 10 15:21:22 2014 : Info: Ready to process requests. rad_recv: Access-Request packet from host 10.xx.xx.32 port 1814, id=81, length=145 User-Name = "6064191000(a)ev.myawi.com" CHAP-Password = 0xa7737618eb2d4f46a3945215a989923560 NAS-IP-Address = 10.xxx.2.1 CHAP-Challenge = 0x5072685c0183c07d006ff00c160671a0 3GPP2-Attr-60 = 0x00000001 3GPP2-Attr-61 = 0x010600000001020935799505892280 Message-Authenticator = 0x8ce6cfeb0d0ef6a09bd3dbbdd7495226 Proxy-State = 0x3834 Thu Apr 10 15:24:22 2014 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Thu Apr 10 15:24:22 2014 : Info: +- entering group authorize {...} Thu Apr 10 15:24:22 2014 : Info: ++[preprocess] returns ok Thu Apr 10 15:24:22 2014 : Info: ++[auth_log] returns ok Thu Apr 10 15:24:22 2014 : Info: [chap] Setting 'Auth-Type := CHAP' Thu Apr 10 15:24:22 2014 : Info: ++[chap] returns ok Thu Apr 10 15:24:22 2014 : Info: [suffix] Looking up realm "ev.myawi.com" for User-Name = "6064191000(a)ev.myawi.com" Thu Apr 10 15:24:22 2014 : Info: [suffix] No such realm "ev.myawi.com" Thu Apr 10 15:24:22 2014 : Info: ++[suffix] returns noop Thu Apr 10 15:24:22 2014 : Info: [files] users: Matched entry 6064191000(a)ev.myawi.com at line 1 Thu Apr 10 15:24:22 2014 : Info: ++[files] returns ok Thu Apr 10 15:24:22 2014 : Info: [pap] WARNING: Auth-Type already set. Not setting to PAP Thu Apr 10 15:24:22 2014 : Info: ++[pap] returns noop Thu Apr 10 15:24:22 2014 : Info: Found Auth-Type = CHAP Thu Apr 10 15:24:22 2014 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Thu Apr 10 15:24:22 2014 : Info: +- entering group CHAP {...} Thu Apr 10 15:24:22 2014 : Info: [chap] login attempt by "6064191000(a)ev.myawi.com" with CHAP password Thu Apr 10 15:24:22 2014 : Info: [chap] Using clear text password "325C7727326B6176362A324754623247" for user 6064191000(a)ev.myawi.com authentication. Thu Apr 10 15:24:22 2014 : Info: [chap] Password check failed Thu Apr 10 15:24:22 2014 : Info: ++[chap] returns reject Thu Apr 10 15:24:22 2014 : Info: Failed to authenticate the user. Thu Apr 10 15:24:22 2014 : Auth: Login incorrect (rlm_chap: Wrong user password): [6064191000(a)ev.myawi.com/<CHAP-Password>] (from client radiusxx port 0) Thu Apr 10 15:24:22 2014 : Info: Using Post-Auth-Type Reject -- respectfully, Joseph | IT

2 3

timers
by Juan Pablo L. 11 Apr '14

11 Apr '14

Hello everybody, i have developed a module for a prepaid data service on a CDMA network, the module is 100% functional at this point but i have a little big problem. i have, as part of the module, a postgres connection pool, that takes care of all the databases queries/accesses as well as the management of the pool, but during tests i have noticed that when these connections (or some of the connections) are not used for a long period of time (some hours) because of low traffic (e.g between 2 - 4 am) the connections becomes idle and even though they are not disconnected it gives an I/O error when you try to send anything to the database (even though the underlying socket is created with the keepalive flag). Having said that, i have added timers to these connections that monitor the time of inactivity that they have and once the threshold is reached the module disconnects them, so when a next time a connection is requested the pool just check if connected or not, if not connected if connects it and gives it to the caller, very simple really. The problem is, that all the nice timers work in an epoll in a thread inside the module. After researching the lists i have found out that that is not possible to do (to run a thread inside a module) ... so i would like to ask if there is any functionality in freeradius i m not aware of that could help me with this issue ? or if any of you faced the same situation, how you fixed that ? ... even though i have read that according to the freeradius developer that is a bad design, i really do not know of any other way how to deal with this situation, so i would really appreciate any feedback on this. thank you very much!! P.S: i do not want to start an argument whether is or it isnt a bad/good design, i think that was established already in the past, but as i said, i do not know how to deal with the idle connections problem in an efficient manner (i dont want to open/close connections every time i get a radius package but i also do not want to keep connections open using database/network/server resources when they are not needed).

2 1

FR with Active Directory
by Rado Matisko 10 Apr '14

10 Apr '14

Hi I want to set up my FR to connect to AD, which is on another host. I was following this tutorial : http://deployingradius.com/documents/configuration/active_directory.html I configured smb.conf and then krb5.conf and then this works great : ntlm_auth --request-nt-key --domain=*MYDOMAIN* --username=*user* --password= *password* *root@friradius:/# ntlm_auth --request-nt-key --domain=FRI --username=hajtmanek --password=<password> NT_STATUS_OK: Success (0x0)* Then I configured FR : > commented "files" in sites-available/default and inner-tunnel and added ntlm_auth in authorize section > changed /modules/ntlm_auth After running *radtest* I get this debug : # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "eduroam", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [eduroam] (from client localhost port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> eduroam attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Apparently I'm missing something but tried to follow tutorial.

2 2

RE: NTLMv2 with FreeRADIUS
by John McCarthy 10 Apr '14

10 Apr '14

Thank you for the breakdown of what each of those do. That definitely helps me understand the process and what's going on. At the end of the day using IPsec is a great idea. We have talked about using that with other systems in the past. That is definitely worth bringing up as an option at work. The other option that is appealing is TTLS/PAP. I spun up a server at the end of the day today to start testing that out. Does it play well with active directory using Kerberos? That option sounds nice because traffic is encrypted at both ends of the FreeRADIUS server. I had been doing some research to get a better understanding on how all this worked. Alan DeKok had some great references at deployingradius.com to help me understand how all this works. I really appreciate all your guys help and feedback. I wasn't sure if FreeRADIUS had an active community or not. I've not seen a lot of talk in the freenode IRC channel. Its really nice you guys have something like this mailing list setup.

4 3

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

On 9 Apr 2014, at 15:14, arr2036 wrote: > It's not in a local configuration file if it's being sent to an AD server. Gotcha, and that is basically what makes NTLMv1 insecure- is if it is stored in a file that can be cracked (from what I understand of it). Is there a way to encrypt the NTLM traffic, just to be on the safe side (if it isn't already) On 9 Apr 2014, at 15:19, arr2036 wrote: > Hmm do you work for a *.edu? No, I work at an organization that deals with payment processing, so we have to abide by PCI's standards. That's why i have to make sure my FreeRADIUS server is setup correctly. Our sys admin scanned my server and it got flagged for using NTLMv1, which is what brought me creating this thread (I need my server to be PCI compliant).

3 2

Setting up a small test environment
by Daniel Schmalen 09 Apr '14

09 Apr '14

2 1

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

That's why i am here. So I can get it right ;)

1 0

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

On 09/04/14 13:38, Phil Mayers wrote: > 1. Use MSCHAP which needs NTLMv1 http://wiki.freeradius.org/guide/FreeRADIUS-Active-Directory-Integration-HO… in the picture here, is the NTLM traffic from the FreeRADIUS server to the Active Directory server encrypted? if not, can it be? > 2. Use TTLS/PAP, and check passwords via Kerberos/LDAP bind. Is this way recommended? the part about using PAP scares me. (Clear-text password in local configuration file (PAP)) - http://wiki.freeradius.org/glossary/Authentication

3 3

NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

Thanks for your guys work on the FreeRADIUS project. It works really well and was easy to setup and understand. I have a FreeRADIUS version 3.0.2 server that is used to with a Ubiquiti UAP-PRO access point using WPA2-Enterprise to authenticate Active Directory using PEAP. Everything works great and it authenticates users correctly. But for PCI compliance, they require that we not use NTLMv1, they require us to use NTLMv2. Is there any way to get FreeRADIUS to work with NTLMv2 (or a more secure protocol for PCI compliance's sake)? I have found the post below that basically says it isn't possible. Maybe you can use a flag to tell the Active Directory Domain Controller that the traffic is NTLMv2...but that sounded pretty sketchy to me. Does anyone else have any ideas? Thanks for your help! http://freeradius.1045715.n5.nabble.com/definitive-info-on-authenticating-t…

6 8