- Freeradius-Users - lists.freeradius.org

Help Needed !!! FreeRADIUS Integration with MS AD
by pradyumna dash 03 Feb '13

03 Feb '13

Hi Team, I need a help, am new to RADIUS and i need the below to be configured. I. FreeRADIUS integration with Microsoft AD II. Cisco switches needs to be the client II. The accounting information should also contain the commands executed in the Switch as well, Example If a used called "test" login to the switch and exexuted a command "Show config" that should be captured in the accounting information. What i have done till now is configured FreeRADIUS and created some local users and getting the switch to authenticated against the local user, Its working fine and getting the value-pair but i can see the commands which are executed in the switch console. Please help how i can do so. As i never integrated Micosoft 2008 AD with FreeRADIUS i need a how-to may be a step-by-step which can help me in integrating the same. Do i need a DB like MySQL for accounting or AD LDAP DB will help in doing so? Thanks for all your help. Regards, /Neo

5 13

Proxy based on auth type?
by Bertalan Voros 01 Feb '13

01 Feb '13

Hello All, Another lame ass question. Is it possible to proxy requests based on Auth-Type? I now have a config which terminates PEAP locally and proxies through the inner-tunnel to an NPS using MSCHAP. This was my original goal. However, when I do a radtest to check what happens to an mschap request it fails locally instead of being proxied. There is a combination of peap and mschap requests coming to the server. If I uncomment suffix in sites-enabled/default then it's reversed, mschap gets proxied but PEAP requests doesn't get sent through the inner tunnel. In proxy.conf I have the DEFAULT realm set to our NPS and have nostrip set for each entry in clients.conf. The reason for this is that in the AD we have the user's email set as UPN and there are hundreds of email domains in use, the users's AD username cannot be determined based on the email address. Output of debug mode when plain mschap fails: *Ready to process requests.* *rad_recv: Access-Request packet from host 10.205.128.7 port 54292, id=242, length=154* * User-Name = "bertalan.voros(a)onedomain.com"* * NAS-IP-Address = x.x.x.x* * NAS-Port = 0* * Message-Authenticator = 0x8402c1883262ac3e5a71b538490e1082* * MS-CHAP-Challenge = 0x9580349e1047ab7c* * MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000ce764eb9fbdbfd3c66d06ecbfbf934845bfc12ed2a697dc4 * *# Executing section authorize from file /etc/raddb/sites-enabled/default* *+- entering group authorize {...}* *++[preprocess] returns ok* *[mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap'* *++[mschap] returns ok* *[eap] No EAP-Message, not doing EAP* *++[eap] returns noop* *Found Auth-Type = MSCHAP* *# Executing group from file /etc/raddb/sites-enabled/default* *+- entering group MS-CHAP {...}* *[mschap] No Cleartext-Password configured. Cannot create LM-Password.* *[mschap] No Cleartext-Password configured. Cannot create NT-Password.* *[mschap] Told to do MS-CHAPv1 with NT-Password* *[mschap] FAILED: No NT/LM-Password. Cannot perform authentication.* *[mschap] MS-CHAP-Response is incorrect.* *++[mschap] returns reject* *Failed to authenticate the user.* *Login incorrect: [bertalan.voros**(a)onedomain.com**] (from client CiscoAP port 0)* *Using Post-Auth-Type Reject* *# Executing group from file /etc/raddb/sites-enabled/default* *+- entering group REJECT {...}* *[attr_filter.access_reject] expand: %{User-Name} -> bertalan.voros**@ onedomain.com* *attr_filter: Matched entry DEFAULT at line 11* *++[attr_filter.access_reject] returns updated* *Delaying reject of request 11 for 1 seconds* *Going to the next request* *Waking up in 0.9 seconds.* *Sending delayed reject for request 11* *Sending Access-Reject of id 242 to 10.205.128.7 port 54292* * MS-CHAP-Error = "\000E=691 R=1"* *Waking up in 4.9 seconds.* *Cleaning up request 11 ID 242 with timestamp +13* *Ready to process requests.* Your help will be appreciated, -- Bertalan Voros

2 2

Re: Python access to attribute lists
by Duarte Fonseca 01 Feb '13

01 Feb '13

Hi, I've modified rlm_python.c to get access to the remaining attribute lists if anyone is interested in the patch you can get it at https://dl.dropbox.com/u/797051/freeradius-python.patch The patch was done against version 2.1.12 shipped from CentOS. Any feedback would be greatly appreciated as I'm sure you can probably tell by the code I'm not a veteran C coder. Cheers, Duarte

1 0

Fw: [mschap] No Cleartext-Password configured. Cannot createLM-Password.
by Grzegorz Cimochowski 31 Jan '13

31 Jan '13

> Waking up in 3.4 seconds. > rad_recv: Access-Request packet from host 192.168.30.15 port 46844, > id=161, length=192 > Service-Type = Framed-User > Framed-Protocol = PPP > NAS-Port = 138584 > NAS-Port-Type = Ethernet > User-Name = "chmielewska_d" > Calling-Station-Id = "54:E6:FC:E7:EA:E7" > Called-Station-Id = "witosa3" > NAS-Port-Id = "ether1" > MS-CHAP-Challenge = 0x28c98da9117ed73968677b477bfe0adf > MS-CHAP2-Response = > 0x01000de14d8d5551d54ac1898b1baffc011300000000000000003372483474e6d9ef5302fdc1e3bb081e0f47a844c8258da7 > NAS-Identifier = "witosa3" > NAS-IP-Address = 192.168.30.15 > # Executing section authorize from file > /usr/local/etc/raddb/sites-enabled/default > +- entering group authorize {...} > ++[preprocess] returns ok > ++[chap] returns noop > [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' > ++[mschap] returns ok > [suffix] No '@' in User-Name = "chmielewska_d", looking up realm NULL > [suffix] No such realm "NULL" > ++[suffix] returns noop > [eap] No EAP-Message, not doing EAP > ++[eap] returns noop > [sql] expand: %{User-Name} -> chmielewska_d > [sql] sql_set_user escaped user --> 'chmielewska_d' > rlm_sql (sql): Reserving sql socket id: 4 > [sql] expand: SELECT id, username, attribute, value, op FROM > radcheck WHERE username = '%{SQL-User-Name}' AND status = '1' > ORDER BY id -> SELECT id, username, attribute, value, op FROM > radcheck WHERE username = 'chmielewska_d' AND status = '1' ORDER > BY id > [sql] expand: SELECT groupname FROM radusergroup > WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT > groupname FROM radusergroup WHERE username = > 'chmielewska_d' ORDER BY priority > [sql] expand: SELECT id, groupname, attribute, Value, op FROM > radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> > SELECT id, groupname, attribute, Value, op FROM radgroupcheck > WHERE groupname = 'DaNET 1280' ORDER BY id > [sql] User found in group DaNET 1280 > [sql] expand: SELECT id, groupname, attribute, value, op FROM > radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> > SELECT id, groupname, attribute, value, op FROM radgroupreply > WHERE groupname = 'DaNET 1280' ORDER BY id > rlm_sql (sql): Released sql socket id: 4 > ++[sql] returns ok > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > Found Auth-Type = MSCHAP > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Creating challenge hash with username: chmielewska_d > [mschap] Client is using MS-CHAPv2 for chmielewska_d, we need NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect > ++[mschap] returns reject > Failed to authenticate the user. > Using Post-Auth-Type REJECT > # Executing group from file /usr/local/etc/raddb/sites-enabled/default > +- entering group REJECT {...} > [sql] expand: %{User-Name} -> chmielewska_d > [sql] sql_set_user escaped user --> 'chmielewska_d' > [sql] expand: %{User-Password} -> > [sql] ... expanding second conditional > [sql] expand: %{Chap-Password} -> > [sql] expand: INSERT INTO radpostauth > (username, pass, reply, authdate) VALUES > ( '%{User-Name}', > '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> > INSERT INTO radpostauth (username, pass, reply, authdate) > VALUES ( 'chmielewska_d', > '', 'Access-Reject', '2013-01-31 14:34:55') > rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, > pass, reply, authdate) VALUES > ( 'chmielewska_d', '', > 'Access-Reject', '2013-01-31 14:34:55') > rlm_sql (sql): Reserving sql socket id: 3 > rlm_sql (sql): Released > > > this log interesed me > chmielewska_d is in database add > why: > +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Creating challenge hash with username: chmielewska_d > [mschap] Client is using MS-CHAPv2 for chmielewska_d, we need NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect > ++[mschap] returns reject > ?

1 0

problem with username renamed in radacct table
by Hocine M 31 Jan '13

31 Jan '13

3 4

can't seem to authenticate only from windows 7 laptops
by 김동욱 31 Jan '13

31 Jan '13

Hi, I’m new to the list and freeRADIUS. I’ve encountered a problem while I’m trying to build a wireless network environment using freeRADIUS. I’ve setup a custom wireless router using Openwrt and freeRADIUS with Mysql. I have a couple of wireless clients - smartphones, laptops (win7, win8, mac) >From windows 8 station, mac and smartphones I can access to wireless router successfully authenticating through freeradius, while I can’t seem to authenticate from windows 7 clients. I’ve checked the error logs from radius server and windows 7 client is sending their computer-name as an username instead of the one I entered. I don’t have any domain controller nor am I using certificate right now. Any suggestion? Thanks, D Kim

2 2

Question : EAP-SIM without RANDs, SRESs, KCs ?
by bino＠indoakses-online.com 31 Jan '13

31 Jan '13

Dear All I found same problem of old topic posted back in Feb-2012 For ref : http://lists.freeradius.org/pipermail/freeradius-users/2012-February/058868… I think the faulty lines (from debug) is : ---------START--------- Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ---------STOP---------- Look like The device didn\'t send : RAND1, RAND2, RAND3 SRES1, SRES2, SRES3 KC1, KC2, KC3 Expected by FreeRadius EAP-SIM Am I right ? If so, How to fix it ? Sincerely -bino-

2 7

Best way to apply default profile
by Chris Taylor 31 Jan '13

31 Jan '13

This is the scenario that I have freeradius with LDAP for authentication and authorization and SQL for accounting. I want to try and force every user to have a default profile that will allow them to only use our local SMTP server. I also have some businesses that I will need to exclude from this profile and allow to them send SMTP traffic anywhere. What is the best way to go about this? Should I put the options in the users file and then create an entry for the select users in SQL and have it pull the separate profile from there? These are the options and profiles that I would like to apply; ### Allow local SMTP only ### acl_permit_local_smtp Cisco-AVPair += ip:inacl#100=permit tcp any 24.222.0.16 0.0.0.15 eq 25 acl_permit_local_smtp Cisco-AVPair += ip:inacl#200=deny tcp any any eq 25 acl_permit_lcoal_smtp Cisco-AVPair += ip:inacl#300=permit ip any any acl_permit_lcoal_smtp Fall-Through = Yes ### Allow any SMTP ### acl_permit_all_smtp Cisco-AVPair += ip:inacl#90=permit tcp any any eq 25 acl_permit_all_smtp Fall-Through = Yes I am just looking for the best way to do this. Thanks, Chris

2 1

None
by Agent Smith 30 Jan '13

30 Jan '13

http://www.meridamaster.es/components/com_content/contrl.php?c94720h0=3vzsow Agent Smith

1 0

output attributes in free-radius
by Lakshmi Narayana Baliah 30 Jan '13

30 Jan '13

Hi All, How can i define output attributes in free-radius? Any help would be appreciated. Thanks Lakshmi ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1