- Freeradius-Users - lists.freeradius.org

SQL statements for CUI with sqlite
by Stefan Winter 04 Feb '14

04 Feb '14

Hello, in 3.0.x, the queries.conf for the cuisql module / post-auth / dialect sqlite state: INSERT IGNORE INTO ${..cui_table} \ This breaks (gracefully) for me, and I'm told it's a syntax error. This page here: https://www.sqlite.org/lang_insert.html says it should be INSERT OR IGNORE Might be worth fixing for 3.0.2. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473 PGP key updated to 4096 Bit RSA - I will encrypt all mails if the recipient's key is known to me http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xC0DE6A358A39DC66

2 3

Issue for mailing list
by 亚坤李 04 Feb '14

04 Feb '14

This mailing list help me so much for my project, but now, I have finished all of them. There are too many email everyday that I can not handle, so I want to quit this mailing list. Could anyone tell me how to quit this mailing list, thank you so much.

4 3

Problem configuring freeradius with mschap / winbind
by Brian C. Huffman 03 Feb '14

03 Feb '14

All, I'm trying to configure freeradius to work with Samba winbind. Winbind seems to be working, but I'm having issues when I try to integrate freeradius. I've got the following versions installed: [root@auth01 raddb]# more /etc/redhat-release CentOS release 6.5 (Final) [root@auth01 raddb]# rpm -qa |grep winbind samba-winbind-clients-3.6.9-167.el6_5.x86_64 samba-winbind-3.6.9-167.el6_5.x86_64 [root@auth01 raddb]# rpm -qa |grep freeradius freeradius-2.1.12-4.el6_3.x86_64 freeradius-utils-2.1.12-4.el6_3.x86_64 wbinfo -u works. This works as well: [root@auth01 raddb]# ntlm_auth --request-nt-key --domain=ETI --username=bhuffman --password=<pass_removed> NT_STATUS_OK: Success (0x0) I've followed this guide for configuring freeradius: http://deployingradius.com/documents/configuration/active_directory.html Running the test with basic ntlm_auth also works. But when I try to use mschap, it fails: rad_recv: Access-Request packet from host 127.0.0.1 port 36958, id=54, length=134 User-Name = "bhuffman" NAS-IP-Address = 192.168.12.13 NAS-Port = 0 Message-Authenticator = 0x5218e5194bf4c321ed41c29cd6d10690 MS-CHAP-Challenge = 0x1491f6269d04d59a MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "bhuffman", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv1 with NT-Password [mschap] expand: %{Stripped-User-Name} -> [mschap] ... expanding second conditional [mschap] expand: %{User-Name} -> bhuffman [mschap] expand: %{%{User-Name}:-None} -> bhuffman [mschap] expand: --username=%{%{Stripped-User-Name}:-%{%{User-Name}:-None}} -> --username=bhuffman [mschap] No NT-Domain was found in the User-Name. [mschap] expand: %{mschap:NT-Domain} -> [mschap] ... expanding second conditional [mschap] expand: --domain=%{%{mschap:NT-Domain}:-ETI} -> --domain=ETI [mschap] mschap1: 14 [mschap] expand: %{mschap:Challenge} -> 1491f6269d04d59a [mschap] expand: --challenge=%{%{mschap:Challenge}:-00} -> --challenge=1491f6269d04d59a [mschap] expand: %{mschap:NT-Response} -> bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 [mschap] expand: --nt-response=%{%{mschap:NT-Response}:-00} -> --nt-response=bdf10bf06b435645c7db6279bba9c4765c16c9fcd06dcd03 Exec-Program output: Reading winbind reply failed! (0xc0000001) Exec-Program-Wait: plaintext: Reading winbind reply failed! (0xc0000001) Exec-Program: returned: 1 [mschap] External script failed. [mschap] MS-CHAP-Response is incorrect. ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bhuffman attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 54 to 127.0.0.1 port 36958 MS-CHAP-Error = "\000E=691 R=1" Can anyone help me to troubleshoot this? Thanks, Brian

2 2

Re: blockage in my Freeradius configuration [First SOLVED]self signed certificate in certificate chain [NOK]
by Yves Deuscher 02 Feb '14

02 Feb '14

I change rule and this is solved My file users _______________________________________ DEFAULT Huntgroup-Name == "cisco" Service-Type = NAS-Prompt-User, Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = Yes DEFAULT Group == "Central" DEFAULT Group == "DEP25", Client-Shortname == "25" DEFAULT Group == "DEP29", Client-Shortname == "29" DEFAULT Group == "DEP57", Client-Shortname == "57" DEFAULT Auth-Type := Reject ______________________________________ For my second problem ,It isn't resolve. debug : Error: TLS Alert read:fatal:unknown CA Sun Feb 2 22:03:14 2014 : Error: TLS_accept: failed in SSLv3 read client certificate A Sun Feb 2 22:03:14 2014 : Error: rlm_eap: SSL error error:14094418:SSL routines:SSL3_READ_BYTES:tlsv1 alert unknown ca Sun Feb 2 22:03:14 2014 : Error: SSL: SSL_read failed inside of TLS (-1), TLS session fails. and trace user: ./eapol_test -c eapol-config -a xen-squeeze-freeradius -p 1812 -s testing123 -r1 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request id=4 method=21 vendor=0 vendorMethod=0 EAP: EAP entering state METHOD SSL: Received packet(len=509) - Flags 0x80 SSL: TLS Message Length: 2527 SSL: (where=0x1001 ret=0x1) SSL: SSL_connect:SSLv3 read server hello A TLS: Certificate verification failed, error 19 (self signed certificate in certificate chain) depth 1 for '/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress=admin(a)example.com/CN=xen-squeeze-freeradius' CTRL-EVENT-EAP-TLS-CERT-ERROR reason=1 depth=1 subject='/C=FR/ST=Radius/L=Somewhere/O=Example Inc./emailAddress= admin(a)example.com/CN=xen-squeeze-freeradius' err='self signed certificate in certificate chain' SSL: (where=0x4008 ret=0x230) SSL: SSL3 alert: write (local SSL3 detected an error):fatal:unknown CA SSL: (where=0x1002 ret=0xffffffff) SSL: SSL_connect:error in SSLv3 read server certificate B OpenSSL: openssl_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed SSL: 7 bytes pending from ssl_out SSL: Failed - tls_out available to report error SSL: 7 bytes left to be sent out (of total 7 bytes) EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE My ca.cnf ... [ req ] prompt = no distinguished_name = certificate_authority default_bits = 2048 input_password = whatever output_password = whatever x509_extensions = v3_ca [certificate_authority] countryName = FR stateOrProvinceName = Radius localityName = Somewhere organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "xen-squeeze-freeradius" [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always basicConstraints = CA:true ... My server.cnf ... [ req ] prompt = no distinguished_name = server default_bits = 2048 input_password = whatever output_password = whatever [server] countryName = FR stateOrProvinceName = Radius localityName = Somewhere organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "xen-squeeze-freeradius" err='self signed certificate in certificate chain' I followed the guide http://deployingradius.com/documents/configuration/certificates.html but Freeradius error is "self-signed certificate." How to remove this error? thank you!!!! 2014-01-31 Alan DeKok <aland(a)deployingradius.com>: > Yves Deuscher wrote: > > For DEP commissioned the first connection goes well > > > > > > Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop > > Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated > > Thu Jan 30 23:48:28 2014 : Info: [files] expand: > > %{Client-Shortname} -> DEP25 > > Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at > > line 208 > > Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok > > You'll have to look at the rest of the debug log to see what's going on. > > If the packets are being processed differently, it's because the > packets are different. You'll have to look at the packets to see what's > different. Then, re-write the rules to match both packets. > > > I miss something for the dynamic substitution takes place at each > > connection or I can not be the problem taken in the right direction have? > > Each packet is completely independent. FreeRADIUS doesn't change it's > behavior from one packet to the next. > > > More I try to configure a secure WPA / TTLS working with all key > > calculated installing Freeradius. by cons with mine I have a CA_unknown > > error do you have a clue? > > Follow the EAP guide on http://deployingradius.com/ . It *will* work. > > If you have unknown CA errors, it's because the certificate > configuration is wrong. Follow the guide. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

2 1

Help Accounting packet forwarding
by battossai 02 Feb '14

02 Feb '14

hi, i'm just a newbie in freeradiu. can i get help about how to do a accounting packet forwarding. i need to setup netsweeper application, it says that this need accounting packet forwarding, and also about add avp at that accounting data. any tutorial can be shared ? thanks. Regards, Franky Yustanto

5 27

FreeRadius unauthorized access
by Mike Diggins 01 Feb '14

01 Feb '14

I'm running a FreeRadius server which authenticates to a Microsoft Windows 8 Active Directory via winbind and NTLM_AUTH. The service is used by a Cisco wireless network which uses WPA2 for user authentication (MS PEAP). My software versions are: Red Hat Enterprise Linux (v. 5 for 64-bit x86_64) freeradius2-2.1.12-4.el5_8 (RedHat) samba3x-winbind-3.5.10-0.110.el5_8 (RedHat) It came to my attention recently that some users may be gaining unauthorized access. An account was seen to be granted access (according to the FreeRadius log) even though the account does not exist within the AD, nor is it a local FreeRadius account (not that I can see anyway). What I see in my logs is: Jan 15 12:23:34 xxxxx radiusd[20330]: Login OK: [whoiswho] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx) Jan 18 08:07:58 xxxxx radiusd[22212]: Login OK: [hi] (from client xxxx port 13 cli xx-xx-xx-xx-xx-xx) The same accounts also appear on the wireless controller. To the best of my knowledge those accounts do not exist anywhere but somehow they are being authenticated. Blocking the account with an Auth-Type := Reject prevents it from authenticating. I've tested with the same account names using no password and various random passwords but I'm correctly denied access each time. I'm attempting to capture some more extensive logging during one of these logins but until I do, does anyone recognize a scenario where this might happen? -Mike

5 10

PEAP and Automatically use my Windows logon name
by Michal Bruncko 31 Jan '14

31 Jan '14

Hello I am trying to authenticate end VPN users using PEAP method toward freeradius server. On client side there is built-in VPN client (PPTP) on windows 7 machines. In general everything is working - users are able to autenticate once they manually use their credentials. Also the scenario with including (manually filled) domain name is also available and users are able to authenticate as well. The problems starting if I try to use "Automatically use my Windows logon name and password (and domain if any)" checkbox within PEAP method - the user is not able to autenticate even if the logged-in windows account (login/pass) is same than on server side. From the radius debug logs the problems started with beginning of mschapv2 module: Working part (with manually filled domain): [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel-vpn [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") [mschapv2] expand: %{My-Local-Client-Type} -> user [mschapv2] ? Evaluating ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++- entering if ("%{My-Local-Client-Type}" == "user") {...} [mschap_vpn] Creating challenge hash with username: bob [mschap_vpn] Told to do MS-CHAPv2 for timeos with NT-Password [mschap_vpn] expand: --username=%{mschap:User-Name} -> --username=bob [mschap_vpn] Creating challenge hash with username: bob [mschap_vpn] expand: --challenge=%{mschap:Challenge:-00} -> --challenge=63b158798144225d [mschap_vpn] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt-response=44a58798471dc8e98dc3854e7c285246596fafb0c116cd14 Exec-Program output: NT_KEY: ABF2579A08227E23F0984101C44B8D12 Exec-Program-Wait: plaintext: NT_KEY: ABF2579A08227E23F0984101C44B8D12 Exec-Program: returned: 0 [mschap_vpn] adding MS-CHAPv2 MPPE keys +++[mschap_vpn] returns ok ++- if ("%{My-Local-Client-Type}" == "user") returns ok MSCHAP Success Not working case (using "Automatically use my Windows logon name..."): [mschapv2] # Executing group from file /etc/raddb/sites-enabled/inner-tunnel-vpn [mschapv2] +- entering group MS-CHAP {...} [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") [mschapv2] expand: %{My-Local-Client-Type} -> user [mschapv2] ? Evaluating ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++? if ("%{My-Local-Client-Type}" == "user") -> TRUE [mschapv2] ++- entering if ("%{My-Local-Client-Type}" == "user") {...} [mschap_vpn] ERROR: User-Name (abrakadabra\bob) is not the same as MS-CHAP Name (bob) from EAP-MSCHAPv2 +++[mschap_vpn] returns reject ++- if ("%{My-Local-Client-Type}" == "user") returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. Login incorrect: [abrakadabra\\bob] (from client vpn.exmaple.com port 0 via TLS tunnel) mschap module: mschap mschap_vpn { with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=S-1-5-21-248145504-287154277-2125575804-1588" } notes: - If I write the domain in login box manually, it is typed in uppercase (without ability to change) - "ABRAKADABRA\bob". If I check "Automatically use my Windows logon name...", the domain (only local-computer) name is pushed in lower case: "abrakadabra\bob". that's the main difference what I can see from comparing both debug logs. - if I write the domain manually inside the login name using "abrakadabra\bob" and keep the "Domain" field empty - the name will be pushed "abrakadabra\bob" - but in this case, I will be authenticated _successfully_. it sounds to me that this issue have nothing to do with uppercase/lowercase of domain name, but it must be something else which breaks all authentication using windows login credentials. - the client computer domain is not real domain - it's just the computer name but this does not matter as the domain name is not pushed to ntlm_auth at all. If I try to log in directly using "ntlm_auth" without providing "--domain" parameter - I will be authenticated correctly. please has anyone working PEAP authentication with ability to use "Automatically use my Windows logon name..."? What I am doing wrong. thank you michal

5 8

blockage in my Freeradius configuration
by Yves Deuscher 31 Jan '14

31 Jan '14

Hello, I can write to you because I found a wealth of important information about the list We use 2 freeradius servers for 2 different things -control access to our switches and -secure wifi Our access control switches, we have a fleet of 4000 switches allocate a hundred entity, each entity's IT department (DEP) headed by a central service, we (central) wish to have access to all switches and limit access computer services solely to their switches. "users" are in ldap and assigned to groups unix DEP25, DEP29, DEP57 ... the central unit is in all groups. in Users : we compare the shortname of the client file to unix group DEFAULT Group == "%{Client-Shortname}", Huntgroup-Name == "3com", Login-IP-Host != "127.0.0.1" Login-Service = 50, Service-Type = 7, huawei-exec-privilege = 3, 3Com-User-Access-Level = 3, Reply-Message = "Bonjour, %{User-name}" in client.conf client 192.168.25.0/22 { secret = XXXXXXXXXX description = reseau-25-Besancon shortname = DEP25 } client 192.168.29.0/22 { secret = XXXXXXXXXX description = reseau-29-Brest shortname =DEP29 } client 192.168.57.0/22 { secret = XXXXXXXXXX description = reseau-57-Metz shortname =DEP57 } For DEP commissioned the first connection goes well Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated Thu Jan 30 23:48:28 2014 : Info: [files] expand: %{Client-Shortname} -> DEP25 Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at line 208 Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok for the following connections Thu Jan 30 23:48:28 2014 : Info: ++[eap] returns noop Thu Jan 30 23:48:28 2014 : Info: ++[unix] returns updated Thu Jan 30 23:48:28 2014 : Info: [files] users: Matched entry DEFAULT at line 208 Thu Jan 30 23:48:28 2014 : Info: ++[files] returns ok so the comparison is not recalculated and if a user wants to authenticate to DEP25 switches DEP57 it is allowed then it should not I miss something for the dynamic substitution takes place at each connection or I can not be the problem taken in the right direction have? More I try to configure a secure WPA / TTLS working with all key calculated installing Freeradius. by cons with mine I have a CA_unknown error do you have a clue? Thanking you in advance for any information you provide me sincerely

2 1

PEAP/MSCHAPv2 bounded to a particular MAC Address
by Marco Gaiarin 31 Jan '14

31 Jan '14

[ Sorry, i'm not subscribed to that list, i will follow it on the web interface but if you can, put me on CC. Thanks. ] Platform: debian squeeze, freeradius 2.1.10+dfsg-2+squeeze1. Some year ago i've setup a (i think rather standard) freeradius config to handle PEAP/MSCHAPv2 authentication (also machine account one) for some portable system. I've also enabled some ''static'' account, for some guests, eg i can add in 'users' file something like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00" now i need to lock that ''static'' password to a particular MAC address. I've verified that my AP send 'Calling-Station-Id', and i've tried to (with some google help) something like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Calling-Station-Id == "c8b5b723ecd7" or like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Huntgroup-Name == "ipm1" having in 'huntgroups' a line like: ipm1 Calling-Station-Id == c8b5b723ecd7 But nothing works. I've also see: http://wiki.freeradius.org/guide/Mac-Auth/46b5f10bc41dd0d5bf3f8dda41e87dd9c… but seems to me unrelated, or at least probably could be useful the mac address normalization across different AP, but for now i'm in a testing phase. I'm doing the right thing? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

4 8

Freeradius server does not authenticate when the password is in MD5
by Cleiton Rodrigues de Souza 30 Jan '14

30 Jan '14

Hello guys, I have a freeradius server that is partially working, I can authenticate with passwords in plaintext and encrypted using the MD5 software 'NTRadPing Test Utility', both users than to the file 'users' as well as the MySQL database. When I try to authenticate from a notebook with windows 7, if the password is in plain text works, but if it is in MD5 not authentic, I believe that the settings in eap.conf files and other files are correct, does anyone know why infromar unable to authenticate when the password is encrypted in MD5? -- --------------------------------------------------------------------------------------------- Cordialmente, Cleiton R. de Souza

4 5