- Freeradius-Users - lists.freeradius.org

multiple ldap instances, which instance is used for searching?
by Martin Kraus 03 Jul '13

03 Jul '13

Hi. I had to create 3 instances for the ldap module. One is the default ldap { } and then I got two named ldap ldap-eduroam { } ldap ldap-netdefault { } I'm using the two named for doing attribute pulling in post-proxy. Now my setup stopped working because suddenly ldap-eduroam was checking for groups when matching Ldap-Group. I was under the impression that when not specificed with ldap-eduroam-Ldap-Group the default ldap entry would be used. I had to instantiate the ldap modules in a special order instantiate { ldap-eduroam ldap-netdefault ldap } so the ldap instance would take over again. Is this an expected behaviour? Will this solution hold or should I name the ldap instance as well and use the name-Ldap-Group everywhere? thanks mk

3 3

ldap module, which objects return check and reply items
by Martin Kraus 03 Jul '13

03 Jul '13

Hi. Out of curiosity, which objects does the ldap module check for checkitems and replyitems? Only the object that identifies the user and the object pointed to by User-Profile? I mapped a seeAlso attribute in ldap.attrmap but I don't see it being pulled from a group object the user is matched against. thanks mk

3 2

something like huntgroups?
by Matt Zagrabelny 02 Jul '13

02 Jul '13

Greetings! Our Cisco VPN concentrator is sending some RADIUS attributes in the request packet and if certain values appear, then I'd like to only allow a subset of users to login. I've looked at: http://wiki.freeradius.org/SQL-Huntgroup-HOWTO/dbeef165862fe9ba7ef6f7d01188… the SQL Huntgroup howto and it seemed close, but the scenario that I am looking at is slightly different and I am getting mixed up. I am hoping for some help. Here is my scenario: We have a generic VPN profile that we'd like to allow *all* users to login to - this works well. When users login to the "secret" profile, then the following VPN attribute is included in the request: Vendor-3076-Attr-146 = 0x554d44 The attribute and value are known and constant, thus I can make decisions on them. Users who are in the "secret" group should be able to login to *both* the generic profile (which does not have the Vendor-3076-Attr-146 = 0x554d44 pair) and the "secret" profile, which does have the pair. If a user is not in the secret group, then their login should fail if the Vendor-3076-Attr-146 = 0x554d44 pair is in the request. Thanks for any advice or design input! Cheers, -mz

4 10

Re: something like huntgroups?
by Alan Buxey 02 Jul '13

02 Jul '13

Hi I'll see if I can send through some dictionary file entries later today Alan This smartphone uses eduroam which gives me free WiFi around the world. Now thats what I call smart!

1 0

multiple entries per radius_check table
by Matt Zagrabelny 01 Jul '13

01 Jul '13

Greetings, I am using a Pg datastore to hold authentication data and using the Pg module for FR to hook into it. I am using a basic view for the radius_check table: # SELECT * from radius_check_users where username = 'mzagrabe'; id | username | attribute | op | value -------+----------+----------------+----+------------------------------------ 1 | mzagrabe | Crypt-Password | := | $1$somehash I'd also like to have the option of denying users with something like: atlas-# SELECT * from radius_sanction where username = 'mzagrabe'; id | username | attribute | op | value -------+----------+-----------+----+-------- 1 | mzagrabe | Auth-Type | := | Reject (1 row) I'd like to create a UNION of these two views so that both records would be returned when FR queried for 'mzagrabe'. Is it enough to ensure that the "Reject" records appears before the "Crypt-Password" records in the resulting UNION for FR to reject the request? Any other advice or hints? Thanks! -mz

2 2

freeradius ldap auth "sort of" working ?
by Horatiu Nimigean 01 Jul '13

01 Jul '13

Greetings. I have a problem with freeradius using ldap to auth, here are my system specs: Centos 6 64bit freeradius installed from repo > rpm -qa | grep -i freeradius > freeradius-ldap-2.1.12-4.el6_3.x86_64 > freeradius-2.1.12-4.el6_3.x86_64 > freeradius-utils-2.1.12-4.el6_3.x86_64 ldap already up and running, on localhost. everything is local btw, there are no remote services and ldap is (test environment) accepting unsecured connections. > rpm -qa | grep -i openld > openldap-devel-2.4.23-32.el6_4.1.x86_64 > openldap-clients-2.4.23-32.el6_4.1.x86_64 > openldap-servers-2.4.23-32.el6_4.1.x86_64 > openldap-2.4.23-32.el6_4.1.x86_64 radtest fails > radtest testuser_1 "letmein_1" localhost 2 testing123 > Sending Access-Request of id 214 to 127.0.0.1 port 1812 > User-Name = "testuser_1" > User-Password = "letmein_1" > NAS-IP-Address = 127.0.0.1 > NAS-Port = 2 > Message-Authenticator = 0x00000000000000000000000000000000 > rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=214, > length=20 and this is the output from radius (ran as radiusd -X) http://pastebin.com/MT0txW2c i don't understand. it auths but then it doesn't.. the final result is not successful Thanks in advance, Horatiu

3 2

eap sim authentication for multiple clients
by raptor raptor 01 Jul '13

01 Jul '13

Hi, i have tried with one client and it's success to authenticate and access internet in wlan i just try one client and success but when i use another client and it fails first, i connect with one client and it's success (until "Finished request 2" in debug log) and then in next request, i try with different supplicant/client to authenticate and i have input identitiy (IMSI, RAND, SRES,KC) in to simtriplets.dat and users also my simtriplets.dat format 1510019760806391,326258E6F77C40f3866DB25DEA60AE4D,DD287535,7F743521EBabb000 1510019760806391,FD9989BD90AD4a03962E6C08C000C14B,BFf89ad2,1C7098005Fea8c00 1510019760806391,26CC8DB02C9848c7BBCC2790E3F0913B,17172cc6,BF34bf34D4ca4c00 1510080325656501,5A8F4C0677DE4930B47825B55534CC79,94d66001,AC85d79439b564c0 1510080325656501,8E29A03F8E13466fBF84D12F6A9D4734,E284e39e,13a524d040094ef4 1510080325656501,BC5D3CEB1EAC4164AA463E289222C450,AE8bdfc6,B0354bf3402e42ed my users format 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x 326258E6F77C40f3866DB25DEA60AE4D, EAP-Sim-SRES1 = 0x DD287535, EAP-Sim-KC1 = 0x 7F743521EBabb000, EAP-Sim-Rand2 = 0x FD9989BD90AD4a03962E6C08C000C14B, EAP-Sim-SRES2 = 0x BFf89ad2, EAP-Sim-KC2 = 0x 1C7098005Fea8c00, EAP-Sim-Rand3 = 0x 26CC8DB02C9848c7BBCC2790E3F0913B, EAP-Sim-SRES3 = 0x 17172cc6, EAP-Sim-KC3 = 0x BF34bf34D4ca4c00 1510080325656501(a)wlan.mnc008.mcc510.3gppnetwork.org EAP-Type := SIM EAP-Sim-Rand1 = 0x 5A8F4C0677DE4930B47825B55534CC79, EAP-Sim-SRES1 = 0x 94d66001, EAP-Sim-KC1 = 0x AC85d79439b564c0, EAP-Sim-Rand2 = 0x 8E29A03F8E13466fBF84D12F6A9D4734, EAP-Sim-SRES2 = 0x E284e39e, EAP-Sim-KC2 = 0x 13a524d040094ef4, EAP-Sim-Rand3 = 0x BC5D3CEB1EAC4164AA463E289222C450, EAP-Sim-SRES3 = 0x AE8bdfc6, EAP-Sim-KC3 = 0x B0354bf3402e42ed and also add patch as in : http://lists.freeradius.org/pipermail/freeradius-users/attachments/20120914… and this is my debug log rad_recv: Access-Request packet from host 192.168.2.1 port 2048, id=1, length=215 User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org " NAS-IP-Address = 192.168.2.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000038013135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x509abafbd92ee8417dcb22095d89059d # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 161 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.2.1 port 2048 EAP-Message = 0x01a10014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x86406e6686e17cf5f398cb77ce20781c Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.1 port 2048, id=1, length=265 Cleaning up request 0 ID 1 with timestamp +25 User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org " NAS-IP-Address = 192.168.2.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0x86406e6686e17cf5f398cb77ce20781c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02a10058120a0000070500005004b19c6e3aacce33e95d1f3c10c481100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0xc9bbe2c285ff35377724d62bb118966b # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 161 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org at line 1 ++[files] returns ok [sql] User 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org " NAS-IP-Address = 192.168.2.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0x86406e6686e17cf5f398cb77ce20781c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02a10058120a0000070500005004b19c6e3aacce33e95d1f3c10c481100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0xc9bbe2c285ff35377724d62bb118966b EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x00005004b19c6e3aacce33e95d1f3c10c481 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x3135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 [eap] Underlying EAP-Type set EAP ID to 162 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.2.1 port 2048 EAP-Message = 0x01a20050120b0000010d0000326258e6f77c40f3866db25dea60ae4dfd9989bd90ad4a03962e6c08c000c14b26cc8db02c9848c7bbcc2790e3f0913b0b050000dec6228540e79bb78b2b1a497cba928e Message-Authenticator = 0x00000000000000000000000000000000 State = 0x86406e6687e27cf5f398cb77ce20781c Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.2.1 port 2048, id=1, length=205 Cleaning up request 1 ID 1 with timestamp +25 User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org " NAS-IP-Address = 192.168.2.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0x86406e6687e27cf5f398cb77ce20781c NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02a2001c120b00000b050000f2d858a5a86f03c2be282e6cde78c7e1 Message-Authenticator = 0x2ca89c665a9f9e46895e8098aac382ee # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 162 length 28 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org at line 1 ++[files] returns ok [sql] User 1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org not found ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim MAC check succeed [eap] Underlying EAP-Type set EAP ID to 163 [eap] Freeing handler ++[eap] returns ok # Executing section post-auth from file /etc/freeradius/sites-enabled/default +- entering group post-auth {...} ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 1 to 192.168.2.1 port 2048 MS-MPPE-Recv-Key = 0x1493962f20dce781f0e363ecdac45c203fe566abf333ec6e3d6f11398159f97b MS-MPPE-Send-Key = 0x976c0332286aac5b7fabc037a7ef34de9f7879861e3412582892bc0f9f06a0f0 EAP-Message = 0x03a30004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org " Finished request 2. Going to the next request Waking up in 4.9 seconds. Cleaning up request 2 ID 1 with timestamp +26 Ready to process requests. rad_recv: Access-Request packet from host 192.168.2.1 port 2048, id=2, length=215 User-Name = "1510080325656501(a)wlan.mnc008.mcc510.3gppnetwork.org " NAS-IP-Address = 192.168.2.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "001adc019b98" NAS-Identifier = "48f8b315461a" NAS-Port = 2 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000038013135313030383033323536353635303140776c616e2e6d6e633030382e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x1e6d83334fd94f359c5fda46d916ce7e # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc008.mcc510.3gppnetwork.org" for User-Name = "1510080325656501(a)wlan.mnc008.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc008.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1510080325656501(a)wlan.mnc008.mcc510.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[sql] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1510080325656501(a)wlan.mnc008.mcc510.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 2 to 192.168.2.1 port 2048 EAP-Message = 0x04000004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 3 ID 2 with timestamp +135 Ready to process requests. thanx for your time and your advice best regards

2 1

Re: Freeradius-Users Digest, Vol 98, Issue 89
by diwakara googly 01 Jul '13

01 Jul '13

Jt Adrada Arrea Te tata art Rey sxhxgh gfffffgg the hggvvvvvvvvvbodfsx.vn it it bbjjjjb ..# te On 27 Jun 2013 15:31, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. freeradius outer identity (val john) > 2. Re: freeradius outer identity (Alan Buxey) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 27 Jun 2013 09:22:19 +0530 > From: val john <valjohn1647(a)gmail.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: freeradius outer identity > Message-ID: > < > CALUd1bOQgC9pptHYMJDYrQ2So7KsqhwNkc20XiJt4uv1QAHGLA(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi guys , > > i have freeradius server that authenticate with LDAP and set up was working > fine , > > but when the client specifies the outer identity (some dummy user name ) > Radius server taking that dummy user name as actual username , because of > that LDAP authentication fails . > > (Authentication proceeds working file if the client not specifying any > outer identity) > > Can you guys please advice , how to fix this issue > > Thank You > John >

1 0

Repurposing PW_TYPE_DEPRECATED
by Arran Cudbard-Bell 30 Jun '13

30 Jun '13

In previous versions PW_TYPE_DEPRECATED was a flag set for certain configuration items which generated a warning when the config item was used. This was to inform users that they needed to update part of their configurations, and that support for the old configuration item would be removed soon. With 3.0.0 the PW_TYPE_DEPRECATED flag has been kept, but the server will now refuse to start if the configuration contains any deprecated configuration items. This was done for a couple of reasons: Firstly with the current code it's not possible to to tell if a configuration item had already been set. So where a deprecated configuration item was used, the server would still refuse to start if PW_TYPE_REQUIRED was set on the new configuration item. Secondly it makes it a PITA for anyone who has to maintain those legacy configurations. With 2.x.x you could make minimal changes to a < 2.x.x configuration and have it start. But the resulting config would look absolutely nothing like the config shipping with 2.x.x. This isn't good, it makes it harder for other people to maintain the installation, and means that following online tutorials and documentation is difficult. The README doc in raddb is pretty comprehensive on what needs to be modified to get 2.0.0 working with 3.0.0. If you notice any other changes please open an issue on bugs.freeradius.org. https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/README.rst Although it is possible to install the 3.0 configuration over the top of an existing 2.x.x configuration. It is *NOT* recommended. You'll likely be left with a lot of cruft and references to modules which no longer exist. It's recommended to instead, work with a vanilla 3.0 configuration and do the migration manually. -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

1 0

inactive users can authenticate
by Mihajlo Joksimovic 28 Jun '13

28 Jun '13

Hi there, i have an uptodate Debian derivate with samba4. The base_filter rule in the modules/ldap file is not accepted. There i gave sambaacctflags but nothing happens. still all users get accepted. in Base_filter I can write what I want, it always like skips this point. So everyone can login, also the disabled accounts. Kind regards Mihajlo -- Adfinis SyGroup AG Mihajlo Joksimovic, System Engineer Güterstrasse 86 | CH-4053 Basel Tel. 061 333 80 33

7 13