- Freeradius-Users - lists.freeradius.org

Sending the Framed-IP-Address from a module
by Romeo Mihalcea 09 Aug '13

09 Aug '13

I got a complicated schema where my radius server needs to send the Framed-IP-Address based on the results of a redis-db query so, I would like to know if if the post-auth part of my default config I can do that. Something like (or any other solutions doing this): update reply { Framed-IP-Address := xxx.xx.xx.xx } where xxx.xx.xx.xx is an ip address returned by a module. Much appreciated.

1 0

Re: Problems setting up a freeradius server with PEAP
by Alan Buxey 08 Aug '13

08 Aug '13

Hi How are you generating the certs and what format are they in? alan

1 0

Problems setting up a freeradius server with PEAP
by Jochen Gatternig 08 Aug '13

08 Aug '13

Hello I am currently trying to setup a Freeradius server on a SUSE 12.04. I tried with the packaged version and a version compiled from source (both 2.20). What works is the basic username/password authentication. As soon as I create the certificates (CA, server & client) and try to fire up the server, I'm getting the following error messages: rlm_eap: SSL error error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt rlm_eap_tls: Error reading private key file /usr/local/etc/raddb/certs/server.pem rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/default[310]: Failed to find "eap" in the "modules" section. /usr/local/etc/raddb/sites-enabled/default[252]: Errors parsing authenticate section. The eap.conf file has been modified: default_eap_type = peap However, the error appers regardless of the default_eap_type parameter. All other settings remained standard. Does anyone know how to handle this problem? Thanks! Regards Jochen

2 1

Can't figure out Group Authentication
by Jernej 08 Aug '13

08 Aug '13

Hi! i am kindly asking for help or pointing right way to solve this problem. Right now we are using LDAP for authentication to IBM products. Last thing we try to do is use Freeradius on same LDAP schema for wireless purposes (Cisco network). We didn't have problems with basic authentication, but when we try to implement Groups in same way than we used before we hit a hard rock. Our LDAP schema looks like: ou= entries + ou= groups + ou=services + cn=wireless -> uniquemember : uid=user0001, ou=users, ou=entries uniquemember : uid=user0002, ou=users, ou=entries + ou=users + uid = user0001 mail = user1(a)firm.com pass: something + uid = user0002 mail = user2(a)firm.com pass: something We are authenticating user by mail and password attribute. Is it possible to make search to met this criterias? Thank you and have a nice day.

1 0

VLAN assignment to HP Switch with 802.1x client
by Shaw, Colin M. 08 Aug '13

08 Aug '13

Hi, I'm in the process of attempting to move our 802.1x services off of an aging freeRADIUS (v1) server onto a newly built server running freeRADIUS v2.2 Tests so far with wireless clients using 802.1x PEAP/MS-CHAPv2 are working ok. Clients can authenticate (against AD) and be assigned the different vlans that I want them to be assigned. So the authentication, AD interaction & vlan assignment are all working as should be there. However, we also use wired 802.1x on some of our HP 5406 switches. This currently works fine with the existing old freeRADIUS server, so the actual switch configs (I've tested more than one) must be ok. But I cannot get the switches to use the assigned vlan that the clients (who again use PEAP/MS-CHAPv2) are given with the new freeRADIUS server. I've not changed the vlans that are to be used, the only change is the switch now points to the new RADIUS server. Running radiusd -X shows that the correct attributes are still being supplied early on in the authenticate process: "Sending Access-Challenge of id 123 to x.x.x.x port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "resnet" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe74e7176e74c686cb9198540381901eb" Note I've also tried the vlan id number as well as the name (although the name works fine in the old server, so should be fine here). Plus I've tried using Egress-VLANID or Egress-VLAN-Name, but it made no difference. Lastly, for testing purposes, if I insert the required attributes into the default post-auth then it all works and the wired client is assigned the correct vlan, so again the switch side must be ok and I also therefore presume all the dictionary entries are there as required. But I shouldn't need (or want) to do this. i.e. in post-auth update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-ID := "resnet" } It's as though the attributes are being removed or ignored somewhere in the PEAP/inner-tunnel process (but that's just a guess). What am I just not getting here? I'm sure it must be something simple but I can't see it. Hopefully this sort of thing has been done enough times that someone out there has fallen into whatever trap I currently find myself in and can point me in the right direction I need to be looking. But if not, I can of course supply the output of radiusd -X and the switch debug if it's going to help any. Thanks in advance, Colin The University of Aberdeen is a charity registered in Scotland, No SC013683.

2 1

returning a HEX String as a HEX String (bit string) instead of the decimal equivalent - FreeRADIUS 2.1.10
by Andy 07 Aug '13

07 Aug '13

Hello, This is my first post here so please excuse any missed etiquette. I have read through the wiki's and googled a lot and not found anything. I have been trying configure our switch ports (HP 2910al) with Tagged VLANs via Egress-VLANID and Egress-VLAN-Name. The Radius backend is OpenLDAP, and I have tried setting the data type in OpenLDAP to binary, UTF-8 and IA5, but no matter what I do, the value returned by RADIUS is the decimal equivalent of the HEX bit string I enter :( For example I'm trying to store and send 0x31000012 to indicate a tagged VLAN (0x31) on VLAN 12. But looking at freeradius -X output I can see it sending the decimal number, when the switch wants the bit string as it was stored, and hence throws an error! Is this a FreeRADIUS thing or an OpenLDAP data type thing? Any help and advice would be greatly appreciated as I'm stuck. Thanks in advance, Andy.

4 11

RE: returning a HEX String as a HEX String (bit string) instead ofthe decimal equivalent - FreeRADIUS 2.1.10
by Franks Andy (RLZ) IT Systems Engineer 07 Aug '13

07 Aug '13

Hi, Just agreeing with Arran really, we've got 5406 procurve switches, which I believe are similar in software terms to the 2910s and we do the unlang string Arran has presented here : update reply { Egress-VLANID += "%{expr:822083584 + %{Tagged-VID}}" } It works fine, although that may not help you too much. I had some 2910s around here somewhere, maybe I'll test one.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Arran Cudbard-Bell Sent: 07 August 2013 14:06 To: FreeRadius users mailing list Subject: Re: returning a HEX String as a HEX String (bit string) instead ofthe decimal equivalent - FreeRADIUS 2.1.10 On 7 Aug 2013, at 13:46, Alan DeKok <aland(a)deployingradius.com> wrote: > Arran Cudbard-Bell wrote: >> I'm honestly not entirely sure why the freeradius dictionary has the >> attribute as an unsigned int > > That's what the RFCs say. And the server doesn't really have a way > of packing arbitrary structures from attributes. It says the value is 4 octets. That's not quite saying it's an integer, was there a later one? I think it's arguably more useful as an integer though, for the reasons listed previously, and because you can use expr to build the bit string easily. For example: update reply { Egress-VLANID += "%{expr:822083584 + %{Tagged-VID}}" } With hex you need to manually pad the VID out to 12 bits. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Response-Packet-Type == Access-Challenge
by Dominique Frise 07 Aug '13

07 Aug '13

Hi, I have no luck with testing the Reponse-Packet-Type in the post-proxy section, after "rad_recv: Access-Challenge packet..." Something like : post-proxy { ... if (Response-Packet-Type == Access-Challenge) { ... } ... } What am I doing wrong? Dominique

5 13

I don't want to see clear text password in debug mode
by Roberto Carna 06 Aug '13

06 Aug '13

Dear, when I execute "freeradius -X" the daemon starts in debug mode. After that when a any user authenticate againts freradisu service, I can see in the screen something like this: [sql] expand: %{User-Name} -> roberto [sql] sql_set_user escaped user --> 'roberto' [sql] expand: %{User-Password} -> 123456 My password is encrypted with MD5 but it can be seen in the debug screen. Is there any way to disallow or masquerade the use's password in debug mode ??? Really thanks, Roberto

3 2

pptpd mschap auth fails
by Horatiu Nimigean 06 Aug '13

06 Aug '13

i have pptpd on a centos 6 box configured to use radius for auth. radius in turn checks credentials in ldap. the user in ldap has a samba extension and a configured password (i used ldap account manager to set it up) it also has a sambaNTPassword field and it's populated. rpm -q freeradius gives freeradius-2.1.12-4.el6_3.x86_64 the auth fails however when i try conencting from my windows8 client. i need to mention that i am sure i'm inputting correct passwords. this is the log from radiusd -X rad_recv: Access-Request packet from host 127.0.0.1 port 49338, id=12, length=152 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "testuser1" MS-CHAP-Challenge = 0x09235ac983790fedc6ccf93af69b67bf MS-CHAP2-Response = 0x5e004a81f91bcf75cd6452c64bd587a74f210000000000000000ff5eaa8a5df6639683423ed294074ceb705105d5d762932d Calling-Station-Id = "***.***.***.***" - edited out NAS-IP-Address = 127.0.0.1 NAS-Port = 0 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "testuser1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [ldap] performing user authorization for testuser1 [ldap] expand: %{Stripped-User-Name} -> [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> testuser1 [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=testuser1) [ldap] expand: dc=my-domain,dc=com -> dc=my-domain,dc=com - edited out [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=my-domain,dc=com, with filter (uid=testuser1) [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{SSHA}YQwkujoqTZAKF1Jl1e1JRxKKvDVVRGYv" [ldap] sambaNtPassword -> NT-Password == 0x3331443643464530443136414539333142373343353944374530433038394330 [ldap] looking for reply items in directory... [ldap] user testuser1 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Normalizing NT-Password from hex encoding [pap] Normalizing SSHA1-Password from base64 encoding [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] Found NT-Password [mschap] Creating challenge hash with username: testuser1 [mschap] Told to do MS-CHAPv2 for testuser1 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 4 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 4 Sending Access-Reject of id 12 to 127.0.0.1 port 49338 MS-CHAP-Error = "^E=691 R=1 C=50685502b0ea6334450d0cd8077ac242 V=3 M=Re-enter (or reset) the password" Waking up in 4.9 seconds. Cleaning up request 4 ID 12 with timestamp +801 Ready to process requests.

3 4