- Freeradius-Users - lists.freeradius.org

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

We will primarily be authenticating Windows 7 machines (and a handful of WIndows 8 machines). Other than that, there may be some iPhones, iPads and Android phones that will connected to this wireless AP. I was just wondering if there was a way to bypass having to use ntlm and use something more secure. I don't mind using certificates as long as it will bypass having to use ntlm. >From my understanding, using EAP-TLS, I can achieve not having to use ntlm, right?

2 2

Re: NTLMv2 with FreeRADIUS
by John McCarthy 09 Apr '14

09 Apr '14

Is there any other ways to authenticate against Active Directory with FreeRADIUS? is it possible to authenticate using Kerberos instead of ntlm or ms-chap. Maybe EAP-TLS.

3 2

OpenSSL build options
by Alex Sharaz 09 Apr '14

09 Apr '14

Hi Ok just downloaded fr 3.0.3 from git and OpenSSL 1.0.1g source Ran ./config threads shared To build OpenSSL Pointed fr at /usr/local/.... for includes and lib details At make time get error saying version info not avail for built openssl shared library . This is on Ubuntu 10.4 VM Any other options I should be using when building OpenSSL Rgds A Sent from my iPhone

3 5

Re: Freeradius-Users Digest, Vol 108, Issue 39
by Rui Ribeiro 09 Apr '14

09 Apr '14

Hi Rado, Dont waste your time fighting with 2.1.12. Believe me, I tried. Better to compile a version, at least 2.2.4, into rpm or deb and install it. (Alan, using 2.2.5, has the 2.2.4 already the ssl bug fixed?) 2.1.12 has too many bugs, slowish and crashes several times a day in some setups. Be warned. Regards Message: 4 > Date: Tue, 08 Apr 2014 16:25:04 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius + OpenLDAP server > Message-ID: <53445B20.30808(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Rado Matisko wrote: > > Im trying to get freeradius v2.1.12 to work with my LDAP server in > > school with peap. > > Read http://deployingradius.com/ It gives detailed instructions on > configuring EAP. > > > radtest is working, but connecting my android phone via Access Point > > with SSID eduroam1 to freeradius and to LDAP server - now so much > > radtest working doesn't mean anything. EAP is different. > > > Its just sending Acess-Challenge and then > > Sending Access-Reject of id 0 to 192.168.1.1 port 3072 > > If you were running a recent version of the server, you would get > pointed to this web page: > > http://wiki.freeradius.org/guide/Certificate%20Compatibility > > Alan DeKok. > > >

2 1

linelog and internal variables
by Eugene Grosbein 09 Apr '14

09 Apr '14

Hi! Where can I get a list of the freeradius core variables supported by the linelog module similar to %{User-Name} ? Specifically, I need a variable name for the freeradius internal request id that is written as 14280311 in the following example in freeradius log: > Discarding duplicate request from client dhcp port 67 - ID: 1381353109 due to unfinished request 14280311 Eugene Grosbein

2 4

freeradius 0.8.1 db migration to 2.x or 3.x
by Stacy Trippe 08 Apr '14

08 Apr '14

Is there a script to migrate a mysql database under 1.x (0.8.1) to a freeradius 2.x mysql database schema? Thanks, Stacy

2 1

OpenSSL Security issues
by Alan DeKok 08 Apr '14

08 Apr '14

This is a bad one: http://heartbleed.com/ ... The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. ... * OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable * OpenSSL 1.0.1g is NOT vulnerable * OpenSSL 0.9.8 branch is NOT vulnerable Everyone using TLS methods with EAP are likely vulnerable. Anyone using RadSec is likely vulnerable. Please check which version of OpenSSL you are using. Alan DeKok.

9 28

FreeRadius + OpenLDAP server
by Rado Matisko 08 Apr '14

08 Apr '14

Im trying to get freeradius v2.1.12 to work with my LDAP server in school with peap. radtest is working, but connecting my android phone via Access Point with SSID eduroam1 to freeradius and to LDAP server - now so much *radtest works : * root@notebook:/home/uniza-sk# radtest skuska skuska localhost 0 testing123 Sending Access-Request of id 228 to 127.0.0.1 port 1812 User-Name = "skuska" User-Password = "skuska" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=228, length=20 *debug : * rad_recv: Access-Request packet from host 127.0.0.1 port 58878, id=228, length=76 User-Name = "skuska" User-Password = "skuska" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x2a5dcc7deb1dbac6d6abbb04e9b7f311 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20140408 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20140408 [auth_log] expand: %t -> Tue Apr 8 13:35:45 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "skuska", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [ldap] performing user authorization for skuska [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> skuska [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=skuska) [ldap] expand: dc=fri,dc=uniza,dc=sk -> dc=fri,dc=uniza,dc=sk [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=fri,dc=uniza,dc=sk, with filter (uid=skuska) [ldap] Added User-Password = {SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3 in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3" [ldap] looking for reply items in directory... [ldap] user skuska authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "skuska" [pap] Using SSHA encryption. [pap] Normalizing SSHA1-Password from base64 encoding [pap] User authenticated successfully ++[pap] returns ok Login OK: [skuska] (from client localhost port 0) # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} [reply_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/reply-detail-20140408 [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/reply-detail-20140408 [reply_log] expand: %t -> Tue Apr 8 13:35:45 2014 ++[reply_log] returns ok ++[exec] returns noop Sending Access-Accept of id 228 to 127.0.0.1 port 58878 *but if i connect from android phone via Access point :* rad_recv: Access-Request packet from host 192.168.1.1 port 3072, id=0, length=138 Cleaning up request 12 ID 0 with timestamp +37 User-Name = "skuska" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "00904c910003" Calling-Station-Id = "1cb094111188" NAS-Identifier = "00904c910003" NAS-Port = 8 Framed-MTU = 1400 State = 0xfd4902fefe4d1bbe3a2596e3bf6ac7bb NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0xc52506a949478fe4d20b63da335ebdee server eduroam1 { # Executing section authorize from file /etc/freeradius/sites-enabled/eduroam1 +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/192.168.1.1/auth-detail-20140408 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/192.168.1.1/auth-detail-20140408 [auth_log] expand: %t -> Tue Apr 8 13:37:40 2014 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "skuska", looking up realm NULL [suffix] Found realm "NULL" [suffix] Adding Realm = "NULL" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [ntdomain] Request already proxied. Ignoring. ++[ntdomain] returns ok [ldap] performing user authorization for skuska [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> skuska [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=skuska) [ldap] expand: dc=fri,dc=uniza,dc=sk -> dc=fri,dc=uniza,dc=sk [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=fri,dc=uniza,dc=sk, with filter (uid=skuska) [ldap] Added User-Password = {SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3 in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}CA+M2KYvU3oYGtotgDtQEBta2WliH5w3" [ldap] looking for reply items in directory... [ldap] user skuska authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! # Executing group from file /etc/freeradius/sites-enabled/eduroam1 +- entering group EAP {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS [peap] Session established. Decoding tunneled attributes. [peap] Peap state TUNNEL ESTABLISHED ++[eap] returns handled } # server eduroam1 Sending Access-Challenge of id 0 to 192.168.1.1 port 3072 EAP-Message = 0x0105002b190017030100206fb4433047881387cf9d3a1297cdfacfa5fa56da9e3cac8319000142f92d35cf Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfd4902fef94c1bbe3a2596e3bf6ac7bb Finished request 13. Going to the next request Waking up in 4.9 seconds. Its just sending Acess-Challenge and then Sending Access-Reject of id 0 to 192.168.1.1 port 3072

2 1

Mikrotik Attribute problem
by Ryan De Kock 08 Apr '14

08 Apr '14

Hi. I was running freeradius v2.1.12 on Fedora and have changed over to CentOS now (also v2.1.12). All of a sudden I am having issues where my attribute Mikrotik-Total-Limit is no longer being sent to the Mikrotik with access-reply. This is the radius -X excerpt ... Found Auth-Type = PERL # Executing group from file /etc/raddb/sites-enabled/default +- entering group PERL {...} rlm_perl: Added pair NAS-Port-Type = Wireless-802.11 rlm_perl: Added pair WISPr-Logoff-URL = http://X.X.X.X/logout rlm_perl: Added pair Acct-Session-Id = 807008e4 rlm_perl: Added pair Service-Type = Login-User rlm_perl: Added pair Called-Station-Id = MYID rlm_perl: Added pair Calling-Station-Id = 94:CE:2C:87:8A:84 rlm_perl: Added pair User-Name = 94:CE:2C:87:8A:84 rlm_perl: Added pair NAS-Identifier = NASNAME rlm_perl: Added pair User-Password = password rlm_perl: Added pair Mikrotik-Host-IP = X.X.X.X rlm_perl: Added pair Framed-IP-Address = X.X.X.X rlm_perl: Added pair NAS-IP-Address = X.X.X.X rlm_perl: Added pair NAS-Port = 2154825956 rlm_perl: Added pair NAS-Port-Id = ether3 - Rooms rlm_perl: ERROR: Failed to create pair Mikrotik-Total-Limit = 209715200 rlm_perl: Added pair Cleartext-Password = password rlm_perl: Added pair databank = 209715200 rlm_perl: Added pair Auth-Type = PERL ++[perl] returns ok ... Because of that the user is no longer being limited by total data usage. It looks as if the dictionary file location has been changed BUT here is the working dictionary Working server: [root@localhost ~]# cat /usr/share/freeradius/dictionary.mikrotik # -*- text -*- # http://www.mikrotik.com # # http://www.mikrotik.com/documentation//manual_2.9/dictionary # # Do NOT follow their instructions and replace the dictionary # in /etc/raddb with the one that they supply. It is NOT necessary. # # On top of that, the sample dictionary file they provide # DOES NOT WORK. Do NOT use it. # # $Id$ # VENDOR Mikrotik 14988 BEGIN-VENDOR Mikrotik ATTRIBUTE Mikrotik-Recv-Limit 1 integer ATTRIBUTE Mikrotik-Xmit-Limit 2 integer # this attribute is unused ATTRIBUTE Mikrotik-Group 3 string ATTRIBUTE Mikrotik-Wireless-Forward 4 integer ATTRIBUTE Mikrotik-Wireless-Skip-Dot1x 5 integer ATTRIBUTE Mikrotik-Wireless-Enc-Algo 6 integer ATTRIBUTE Mikrotik-Wireless-Enc-Key 7 string ATTRIBUTE Mikrotik-Rate-Limit 8 string ATTRIBUTE Mikrotik-Realm 9 string ATTRIBUTE Mikrotik-Host-IP 10 ipaddr ATTRIBUTE Mikrotik-Mark-Id 11 string ATTRIBUTE Mikrotik-Advertise-URL 12 string ATTRIBUTE Mikrotik-Advertise-Interval 13 integer ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer ATTRIBUTE Mikrotik-Total-Limit 17 integer ATTRIBUTE Mikrotik-Total-Limit-Gigawords 18 integer # MikroTik Values VALUE Mikrotik-Wireless-Enc-Algo No-encryption 0 VALUE Mikrotik-Wireless-Enc-Algo 40-bit-WEP 1 VALUE Mikrotik-Wireless-Enc-Algo 104-bit-WEP 2 END-VENDOR Mikrotik Not working server: # cat /usr/local/share/freeradius/dictionary.mikrotik # MikroTik vendor specific dictionary # Copyright (C) MikroTikls, SIA # # You may freely redistribute and use this software or any part of it in source # and/or binary forms, with or without modification for any purposes without # limitations, provided that you respect the following statement: # # This software is provided 'AS IS' without a warranty of any kind, expressed or # implied, including, but not limited to, the implied warranty of # merchantability and fitness for a particular purpose. In no event shall # MikroTikls SIA be liable for direct or indirect, incidental, consequential or # other damages that may result from the use of this software, including, but # not limited to, loss of data, time and (or) profits. # # $Id: dictionary.mikrotik,v 1.7 2011/11/25 08:00:00 normis Exp $ # # MikroTik Attributes VENDOR Mikrotik 14988 BEGIN-VENDOR Mikrotik ATTRIBUTE Mikrotik-Recv-Limit 1 integer ATTRIBUTE Mikrotik-Xmit-Limit 2 integer ATTRIBUTE Mikrotik-Group 3 string ATTRIBUTE Mikrotik-Wireless-Forward 4 integer ATTRIBUTE Mikrotik-Wireless-Skip-Dot1x 5 integer ATTRIBUTE Mikrotik-Wireless-Enc-Algo 6 integer ATTRIBUTE Mikrotik-Wireless-Enc-Key 7 string ATTRIBUTE Mikrotik-Rate-Limit 8 string ATTRIBUTE Mikrotik-Realm 9 string ATTRIBUTE Mikrotik-Host-IP 10 ipaddr ATTRIBUTE Mikrotik-Mark-Id 11 string ATTRIBUTE Mikrotik-Advertise-URL 12 string ATTRIBUTE Mikrotik-Advertise-Interval 13 integer ATTRIBUTE Mikrotik-Recv-Limit-Gigawords 14 integer ATTRIBUTE Mikrotik-Xmit-Limit-Gigawords 15 integer ATTRIBUTE Mikrotik-Wireless-PSK 16 string ATTRIBUTE Mikrotik-Total-Limit 17 integer ATTRIBUTE Mikrotik-Total-Limit-Gigawords 18 integer ATTRIBUTE Mikrotik-Address-List 19 string ATTRIBUTE Mikrotik-Wireless-MPKey 20 string ATTRIBUTE Mikrotik-Wireless-Comment 21 string ATTRIBUTE Mikrotik-Delegated-IPv6-Pool 22 string # MikroTik Values VALUE Mikrotik-Wireless-Enc-Algo No-encryption 0 VALUE Mikrotik-Wireless-Enc-Algo 40-bit-WEP 1 VALUE Mikrotik-Wireless-Enc-Algo 104-bit-WEP 2 VALUE Mikrotik-Wireless-Enc-Algo AES-CCM 3 VALUE Mikrotik-Wireless-Enc-Algo TKIP 4 END-VENDOR Mikrotik What i have noticed is that if I add "ATTRIBUTE Mikrotik-Total-Limit 17 integer" to the /usr/local/etc/raddb/dictionary file then freeradius says that it sends the attribute however the Mikrotik complains that its incorrect. Have I missed something? I have checked that "/usr/local/share/freeradius/dictionary.mikrotik" is included in /usr/local/share/freeradius/dictionary. any advice would be great

3 6

Originate COA in Freeradius 3.0.x
by unbeliever012000 08 Apr '14

08 Apr '14

I have been using Freeradius for several years now, starting around the 1.0.0 release. Recently I have been playing with Freeradius 3.0.1 and 3.0.2. The changes which have been made have provided me many ways to clean up my code thanks to the use of talloc, and the connection pooling. While playing with originating COA, deploying the "update coa" sub section within my site's accounting section, I always get an error logged for every accounting request; WARNING: List 'coa' doesn't exist for this packet This looks like a duplicate of the situation reported Nov 2012; http://lists.freeradius.org/mailman/private/freeradius-users/2012-November/0 63633.html I did dig into the code and can see that when passing back the list you validate that not only does the list exist, but it also has the right type. Have I missed something which has to be done to set the type but was not documented in the sites-available/originate-coa ? Checking the code I see that setting Send-CoA-Request blocks the request no matter what value is set. This I checked as I see in the originate-coa file its documented that setting Send-CoA-Request to No is suppose to block requests and thought that maybe setting it to yes would be the fix to my issue, which obviously I was wrong about. The compile has been double checked and can confirm that coa is suppose to be compiled in. While proxy capabilities have been tested and can be confirmed, understand from the defines that COA is dependant on Proxy. Loading the sites-available/coa file also works, but obviously that's to consume COA's rather than originate as desired. Please advise as to if I have made a config error, or have found an issue which will be resolved in a later release. Thanks Geoff

3 2