- Freeradius-Users - lists.freeradius.org

freeradius eam sim authorization to everyone
by Maxim Shoustin 10 Sep '13

10 Sep '13

Hello, I use freeradius 2.2.0 (runs on Ubuntu). I played enough with eap sim, (thanks for examples eapsim-02 - 06). My goal is to test client + AP but not freeradius authorization/authentication process. Ho can I configure freeradius to give success for every user, no matter what is imsi, challenge, kc or sres. Can I configure to give "OK" to any sim based on provider only, like "Orange", for example/ Thank you,

2 1

Re: my Radius goal radius and openldap.
by Swenson, Chris 10 Sep '13

10 Sep '13

Yeah, bit the goal is that it is passed to the server via a secure web page. The end goal here is getting authenticated users the right to connect to the secure ssid's. The Aruba wireless controllers are supposed to do that. If I am way over my head I have a consultant on contract. RHIP. Sent from my Verizon Wireless 4GLTE smartphone ----- Reply message ----- From: "Arran Cudbard-Bell" <a.cudbardb(a)freeradius.org> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Subject: my Radius goal radius and openldap. Date: Mon, Sep 9, 2013 7:34 pm On 10 Sep 2013, at 00:19, "Swenson, Chris" <cswenson(a)curry.edu> wrote: > No, they are encrypted in the ldap database in md5 hash. Right, but you have the plaintext version from the user? > I might be too old to do bleeding edge stuff like 3.0 RC1 > I will take a look and a poke at it though. Fair enough. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

my Radius goal radius and openldap.
by Swenson, Chris 09 Sep '13

09 Sep '13

I already have functioning openldap with SSL. (actually a neat little multi master setup.) I would like to get this radius to authenticate against the openldap. I have dug around Google and found some useful looking pages, but I wonder if anybody has any hot tips on this so I don't feel like I am completely reinventing the wheel. Thanks Chris s.

2 3

RE: problem with initial setup solved
by Swenson, Chris 09 Sep '13

09 Sep '13

I guess I need to recycle my 2002 Shell O'Reilly book. -----Original Message----- From: freeradius-users-bounces+cswenson=curry.edu(a)lists.freeradius.org [mailto:freeradius-users-bounces+cswenson=curry.edu@lists.freeradius.org] On Behalf Of Swenson, Chris Sent: Monday, September 09, 2013 1:27 PM To: FreeRadius users mailing list Subject: RE: problem with initial setup That did it, In the version 1 the radtest must have been installed with the radius, not as a separate package. I have now also successfully tested. I wonder why the in the ticket I opened with red hat support they did not suggest the upgrade. Thanks to all. Chris S. -----Original Message----- From: John Dennis [mailto:jdennis@redhat.com] Sent: Monday, September 09, 2013 1:11 PM To: FreeRadius users mailing list Cc: Swenson, Chris Subject: Re: problem with initial setup On 09/09/2013 12:52 PM, Swenson, Chris wrote: > Thanks for the replies: > Ok, uninstalled #1 and updated to freeradius2 > > radiusd started without a hitch with testing Cleartext-Password := "password" in users file. > > When I ran radtest testing password localhost 0 testing123 > > Received -bash: /usr/bin/radtest: No such file or directory It's in the freeradius2-utils package. % yum install /usr/bin/radtest or % yum install freeradius2-utils or read how to use the yum package manager. -- John - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

problem with initial setup
by Swenson, Chris 09 Sep '13

09 Sep '13

Hi all, I have not used radius in about 15 years and found a need recently. I have set up the rpm on a red hat 5.6 server and when I run radius -X the system starts fine with the expected info. When I enter the suggested as the first line in the users file testing Cleartext-Password := "password" And then rerun the radius -X it bombs and does not start. See output below. Without this running I cannot do the radtest. Thanks for any guidance. [root@ldap1 raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" /etc/raddb/users[91]: Parse error (check) for entry testing: Unknown attribute "Cleartext-Password" Errors reading /etc/raddb/users radiusd.conf[1059]: files: Module instantiation failed. radiusd.conf[1837] Unknown module "files". radiusd.conf[1773] Failed to parse authorize section. [root@ldap1 raddb]#

5 7

[ANN] Version 3.0.0-rc1
by Arran Cudbard-Bell 09 Sep '13

09 Sep '13

We are in feature freeze for 3.0. The configuration format and behaviour for 3.0 will be stable between now and the final release (as it was with release_3_0_0_rc0). If you are planning on deploying 3.0 and have an existing 2.x.x configuration you were planning to migrate when the 3.0 is released, now would be a good time to try that, and to report any issues or problematic behavior changes you notice. To provide a single point to test against, the release_3_0_0_rc1 tag has been created. Behaviour changes since release_3_0_0_rc0: * Fixed many more compiler warnings. * LDAP schemas to load dynamic clients from LDAP * the control socket is now marked "stable" * Added RFC 6929 dictionary, along with a few others * Clean up proxy ID allocation / re-allocation * pairbasicfree() has been replaced by talloc_free() * Added %{debug_attr:LIST} to print out at attributes in LIST * The PAP module can now configurably *not* normalize passwords * Remove support for %{#}, and add %{strlen:} expansion Bug fixes: * Corrected more documentation to match the new behavior and config * Corrected many minor typos and spelling mistakes in documentation and config files * If the installation directory exists, don't re-install files * add crlDistributionPoints to certificates for Windows phones. * Use documentation IP addresses everywhere (192.0.2/24) * Build fixes for clang related to the -rdynamic flag * Allow "update" sections to update outer.reply * Re-write module handler to work, the code is significantly cleaner, and priority overrides work correctly in all cases, #404, #424 * CUI SQL fixes, #412 * Don't die in RB tree re-allocation of proxy ID * Do a second pass over pre-compiled conditions, #421, #423 * Add "delete order" to rbtree, #416 Also used by the proxy ID re-allocation code * Fixed TCP socket close handlers to be simpler and more robust * Allow ${..} expansion in `strings` * moved EAP destructors to talloc, which wasn't done in -rc0 * Fix LDAP group comparisons, and other pair comparisons * NULL terminate strings copied between VALUE_PAIRs correctly * Fix !* when used with non-string attributes * Fix `` exec in update sections * Load libpython within rlm_python to ensure all required symbols are available * Don't SEGV printing IPv6 Interface ID * Don't SEGV evaluating dates in rlm_expiration * Fix ./configure --with-shared-libs=no * Fix crashes related to opaque request data and regular expressions * Fix heimdal krb5 build The tarball is available here: https://github.com/FreeRADIUS/freeradius-server/archive/release_3_0_0_rc1.t… Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

8 11

Fwd: Re: smbencrypt calculates false hash for German umlauts and other non-ASCII letters
by Matthias Nagel 07 Sep '13

07 Sep '13

Sorry, my mail program tricked me and used the wrong destination address. ---------- Weitergeleitete Nachricht ---------- Betreff: Re: smbencrypt calculates false hash for German umlauts and other non-ASCII letters Datum: Samstag 07 September 2013, 19:13:17 Von: Matthias Nagel <matthias.h.nagel(a)gmail.com> An: Alan DeKok <aland(a)deployingradius.com> Hello everybody, as it was me who came up with the issue. The password must be encoded as UTF-16 in little endian and then the MD4 is calculated. For example: Assume one uses "smbencrypt" from command line interface in order to calculate the hash. The linux console is set up to use "en-US.utf8". Then, at first a character encoding into UTF-16 little endian is necessary, and in a second step the MD4 hash can be calculated. Matthias Am Samstag 07 September 2013, 12:10:38 schrieben Sie: > Arran Cudbard-Bell wrote: > > Can't we assume src as UTF8 for NAI (RFC4282)? > > Ha, ha, ha, ha <cough>. 4282 is wrong. And no one implements any of it. > > The MS-CHAP RFCs are silent on the subject of character encoding. The > unofficial word from Microsoft is "MS-CHAP uses the local encoding". > > Ok... what's that? > > <hysterical laughter> No one knows. And there's no way to find out. > > And UTF-8 uses up to 5 octets for a character. MS-CHAP requires no > more than 2. > > There is *no* way to do the right thing. You can get close. > Sometimes. Maybe. But doing the right thing always? Impossible. > > Alan DeKok. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ---------------------------------------------------------------------- Matthias Nagel Parkstraße 27 76131 Karlsruhe Mobil: +49-151-15998774 e-Mail: matthias.h.nagel(a)gmail.com ICQ: 499797758 Skype: nagmat84 ------------------------------------------------------------- ---------------------------------------------------------------------- Matthias Nagel Parkstraße 27 76131 Karlsruhe Mobil: +49-151-15998774 e-Mail: matthias.h.nagel(a)gmail.com ICQ: 499797758 Skype: nagmat84

1 0

smbencrypt calculates false hash for German umlauts and other non-ASCII letters
by Matthias Nagel 07 Sep '13

07 Sep '13

Hello, if a do a "smbencrypt ä" then the output for the NT hash is "B5CF5E386433C7CB69E43ED774717792" but the correct hash would be "3104EAB484D59EFABCEA2C44B07F41D3". (If you do not see the letter: It is a small "a" with two dots, unicode code point 00E4.) Similar results hold for other umlauts, too. My Freeradius version is 2.2.0 running on Linux 3.8.13 with system locale set to en_US.utf8. I wrote an own utitly to calculate NT hashes to fill the Radius database. While I compared the results of my own utility with those from "smbencrypt", I found these discrepancies. In order to check which result was the correct one, I took a Windows computer, added a dummy user to it and set the passwords in concern. Then I extracted the NT hashes from the SAM database. One note of caution: If you take a web site like http://www.onlinehashcrack.com/hash-calculator.php, do not trust it. If it comes to non-ASCII letters the output is false, too. Matthias ---------------------------------------------------------------------- Matthias Nagel Parkstraße 27 76131 Karlsruhe Mobil: +49-151-15998774 e-Mail: matthias.h.nagel(a)gmail.com ICQ: 499797758 Skype: nagmat84

4 5

Segmentation Fault on "[pap] Normalizing SSHA1-Password from base64 encoding"
by Hugo Cisneiros (Eitch) 07 Sep '13

07 Sep '13

Hi, I'm getting the same errors as these messages: http://lists.freeradius.org/pipermail/freeradius-devel/2013-May/008046.html http://lists.freeradius.org/pipermail/freeradius-users/2013-May/066440.html I also did everything that Stefan Winter did - gdb live server, valgrind, look at the source, compare with 3.0 - and got the same results. In the -devel thread Alan DeKok says there won't be any patches or development on the 2.2.x branch anymore, and I tested with 3.0 with success. So I ask: is there any way to backport the fix to 2.2.x branch? I don't know C very well but if it's not so hard, I might try talking to people who knows how to code and create a unnoficial patch. I saw that the base64 is now using a brave new approach on 3.0. And also, if keeping this bug forever in the 2.2.x branch, what is, in your opinions, the best way to store the encrypted passwords? I'm using SSHA-Passwords attribute, salted with the "uuidgen" command. And I was thinking, if I use a salt with only 16 characters instead of 32+, is there any chance for this bug to happen? It'll be easier for me to fix the salts instead of the code. I can't migrate to 3.0 right now because the system is in production state. (Please, don't say Cleartext-Passwords are the solution :P) The following hash generates the crash: 42A9cqWnI8QAyQLsy7+iZDNKkrwzYzZlMjFiMC00YWFlLTQyN2QtOTdlNC0zNjIyYTZmYjhjNDk= Thanks! -- []'s Hugo www.devin.com.br

2 3

Re: Get errors with radtest on ip address
by Alan Buxey 06 Sep '13

06 Sep '13

No problem with radiusd at this point. It's not received a single packet. You've got a problem with your local network environment on the host. Care to share /etc/hosts? alan

2 1