- Freeradius-Users - lists.freeradius.org

Regular expresion problem
by BALSIANOK, Peter 28 Dec '12

28 Dec '12

Hi, I want to use regular expression in acct_users file DEFAULT Called-Station-Id =~ /orangewap/i, Proxy-To-Realm := realm_orangewap Called-Station-Id = "%{Called-Station-Id}.%{3GPP-SGSN-Address}" Debug output: reading pairlist file /app/radius/raddb/ggsn//users reading pairlist file /app/radius/raddb/ggsn//acct_users /app/radius/raddb/ggsn//acct_users[25]: Parse error (check) for entry DEFAULT: No regular expression found in Called-Station-Id Errors reading /app/radius/raddb/ggsn//acct_users /app/radius/raddb/ggsn//modules/files[7]: Instantiation failed for module "files" /app/radius/raddb/ggsn//sites-enabled/default[170]: Failed to find "files" in the "modules" section. /app/radius/raddb/ggsn//sites-enabled/default[69]: Errors parsing authorize section. Peter Balšianok Data Service Operation Coordinator, Voice & Data Services Operations Orange Slovensko, a. s. Metodova 8, 821 08 Bratislava tel: +421 908 00 2405 mobil: +421 905 012 405 e-mail: peter.balsianok(a)orange.sk<mailto:peter.balsianok@orange.sk>

2 3

Kerberos - Radius does not get password
by Jörg Herzinger 28 Dec '12

28 Dec '12

Hi, Radius has been bugging me now for over a week and I just can't get it working with Kerberos over WLan. I have been trying around a lot but in the end I purged the freeradius packages and restarted from scratch with default config (on Debian squeeze). All I did was adding a client in clients.conf client 192.168.0.0/16 { secret = averysecretsecret } adding two entries in users.conf testing Cleartext-Password := "pass" DEFAULT Auth-Type = Kerberos and adding Kerberos to authenticate in default and inner-tunnel right after PAP: Auth-Type Kerberos { krb5 } and I configured the Kerberos module. Now when testing with radtest both (kerberos and testing from files) work fine root@donauauen42 ~ # radtest testing pass radius 1 averysecretsecret Sending Access-Request of id 166 to 192.168.43.118 port 1812 User-Name = "testing" User-Password = "pass" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=166, length=20 root@donauauen42 ~ # radtest pink.funk-greene XXXXX radius 1 averysecretsecret Sending Access-Request of id 60 to 192.168.43.118 port 1812 User-Name = "pink.funk-greene" User-Password = "XXXXX" NAS-IP-Address = 192.168.42.42 NAS-Port = 1 rad_recv: Access-Accept packet from host 192.168.43.118 port 1812, id=60, length=20 But when testing via WiFi just my testing user works, while my Kerberos users won't work. Not working Kerberos debug log: http://pastie.org/3890159 Vs. working plain users file log: http://pastie.org/3890167 Any help is appreceated. Thanks a lot... -- Jörg Herzinger - EDV Team GLOBAL 2000 - Friends of the Earth Austria Neustiftgasse 36, A-1070 Wien tel +43-699-14200030 Dieses Mail wurde mit Oekostrom und Opensource Software erstellt.

4 3

Re: AP> FR> LDAP authentication reject
by Alan DeKok 28 Dec '12

28 Dec '12

Thanakorn Rattanatikul wrote: > In LDAP server , for user "sun" , store password in clear-text in this test. No, it doesn't. Or, it's not available. Or the user isn't found. Read the debug log. Look for anything related to LDAP. It isn't hard: [ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter (uid=sun) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? Does that mean anything to you? For the latest release, also read raddb/sites-available/inner-tunnel. It gives DETAILED instructions for debugging PEAP. Follow those instructions. Read the debug output. Alan DeKok.

1 0

Issue with Kerberos
by Khapare Joshi 28 Dec '12

28 Dec '12

I am testing Freeradius with kerberos. seems it is returning accept accept Fri Dec 21 15:05:46 2012 : Info: [suffix] No '@' in User-Name = "test66", looking up realm NULL Fri Dec 21 15:05:46 2012 : Info: [suffix] No such realm "NULL" Fri Dec 21 15:05:46 2012 : Info: ++[suffix] returns noop Fri Dec 21 15:05:46 2012 : Info: [eap] No EAP-Message, not doing EAP Fri Dec 21 15:05:46 2012 : Info: ++[eap] returns noop Fri Dec 21 15:05:46 2012 : Info: [files] users: Matched entry DEFAULT at line 1 Fri Dec 21 15:05:46 2012 : Info: ++[files] returns ok Fri Dec 21 15:05:46 2012 : Info: ++[expiration] returns noop Fri Dec 21 15:05:46 2012 : Info: ++[logintime] returns noop Fri Dec 21 15:05:46 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Fri Dec 21 15:05:46 2012 : Info: ++[pap] returns noop Fri Dec 21 15:05:46 2012 : Info: Found Auth-Type = Kerberos Fri Dec 21 15:05:46 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Fri Dec 21 15:05:46 2012 : Info: +- entering group kerberos {...} Fri Dec 21 15:05:46 2012 : Debug: rlm_krb5: verify_krb_v5_tgt: host key not found : Permission denied Fri Dec 21 15:05:46 2012 : Info: ++[krb5] returns ok Fri Dec 21 15:05:46 2012 : Info: # Executing section post-auth from file /etc/raddb/sites-enabled/default Fri Dec 21 15:05:46 2012 : Info: +- entering group post-auth {...} Fri Dec 21 15:05:46 2012 : Info: ++[exec] returns noop Sending Access-Accept of id 219 to 192.168.1.1 port 33193 It always says permission denied then returns krb5 ok, What permission denied it is saying ? I generated service and host principal and exported keytab file in my radius server then added /etc/raddb/modules/krb5 file. But I always get permission denied debug output. another this is why PAP saying authentication may fail and then process the kerberos part - is this normal ? Thanks Merry Xmas, KH

2 3

Re: AP> FR> LDAP authentication reject
by Olivier Beytrison 28 Dec '12

28 Dec '12

On 28.12.2012 09:38, Thanakorn Rattanatikul wrote: > Still unable to connect. > Do you have any configuration files for connecting with LDAP form AP> > FR> LDAP ? I tried every way but nothing works. Send a full output of freeradius -X -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

1 0

Re: AP> FR> LDAP authentication reject
by Olivier Beytrison 28 Dec '12

28 Dec '12

On 28.12.2012 08:39, Thanakorn Rattanatikul wrote: > In LDAP server , for user "sun" , store password in clear-text in this test So if you have a clear-text password in the ldap, use the ldap attribute-map to add it in the control list. Looking at the logs I guess you are running version 2.x, then you should have a file called /etc/raddb/ldap.attrmap, add a line with checkitem Cleartext-Password <your-ldap-attribute> And reference the ldap.attrmap in the ldap module (if not already done) dictionary_mapping = ${confdir}/ldap.attrmap And finally you need to ensure that the user defined in the ldap module (identity) has sufficient rights in the LDAP to retrieve the attribute containing the clear text password. Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

1 0

Re: AP> FR> LDAP authentication reject
by Olivier Beytrison 28 Dec '12

28 Dec '12

On 28.12.2012 06:17, Thanakorn Rattanatikul wrote: > I'm trying to setup the server to authenticate using LDAP. I'm having > some problem and hope to get some help from the list. > > I'm trying to setup AP->FR->LDAP. FreeRadius is new installation on > CentOS. LDAP is Sun Java System Directory Server. > I'm trying radtest ->FR->LDAP pass but AP->FR->LDAP not pass. It works with radtest because it does pap. The password is sent in cleartext in the request. Freeradius can then bind to the LDAP with the user/password supplied to authenticate the user. With your Access Point, you're doing EAP-PEAP with MSCHAPv2, which mean you need the clear text password or a NT/LM_Password in your backend, or via NTLM_Auth. If Freeradius doesn't have them, it can't do the challenge/response. You have Plenty of warning that this will happen ... > [ldap] expand: ou=guest,dc=ku,dc=ac,dc=th -> ou=guest,dc=ku,dc=ac,dc=th > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] attempting LDAP reconnection > [ldap] (re)connect to 158.108.8.214:389, authentication 0 > [ldap] bind as uid=thanakorn,ou=guest,dc=ku,dc=ac,dc=th/testtest to > 158.108.8.214:389 > [ldap] waiting for bind result ... > [ldap] Bind was successful > [ldap] performing search in ou=guest,dc=ku,dc=ac,dc=th, with filter > (uid=sun) > [ldap] looking for check items in directory... > [ldap] looking for reply items in directory... See here ? > WARNING: No "known good" password was found in LDAP. Are you sure that > the user is configured correctly? > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns ok > ++[expiration] returns noop > ++[logintime] returns noop Or Here ? > [pap] WARNING! No "known good" password found > for the user. Authentication may fail because of this. > ++[pap] returns noop And those ? > [mschapv2] # Executing group from file /etc/raddb/sites-enabled/default > [mschapv2] +- entering group MS-CHAP {...} > [mschap] No Cleartext-Password configured. Cannot create LM-Password. > [mschap] No Cleartext-Password configured. Cannot create NT-Password. > [mschap] Creating challenge hash with username: sun > [mschap] Told to do MS-CHAPv2 for sun wit! h NT-Password > [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. > [mschap] FAILED: MS-CHAP2-Response is incorrect And here again ... > [peap] The users session was previously rejected: returning reject (again.) > [peap] *** This means you need to read the PREVIOUS messages in the > debug output > [peap] *** to find out the reason why the user was rejected. > [peap] *** Look for "reject" or "fail". Those earlier messages will > tell you. > [peap] *** what went wrong, and how to fix the problem. > [eap] Handler failed in EAP/peap > [eap] Failed in EAP select > ++[eap] returns invalid In the default LDAP configuration file, it's clearly stated that : # However, LDAP can be used for authentication ONLY when the # Access-Request packet contains a clear-text User-Password # attribute. LDAP authentication will NOT work for any other # authentication method. # This means that LDAP servers don't understand EAP. If you # force "Auth-Type = LDAP", and then send the server a # request containing EAP authentication, then authentication # WILL NOT WORK. You need either the clear-text password in your LDAP, Store the user password in the userfile, or use another way of getting the password (sql database, ntlm_auth to active directory). Read the comments in the default configuration, and look for Warning and error in the debug output. It tells you what goes wrong, and what you should do. In your case : Provide a Cleartext-Password Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

1 0

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

@Phil, Thank you very much for the code snippet - only had to make minor mods for it to work perfectly ("noop" instead of "notfound" in the reject code within the sites-enabled routine). Also I had to do an $INCLUDE in the users file that points to the tls_clients file otherwise I get unpredictable behavior - other than that working as envisioned. Next phase, a remote database for clients (LDAP or SQL....not sure which yet - thats for 2013) Again, many, many thanks for the help - Happy Holidays... On Thu, 27 Dec 2012 10:40:15 -0500 "Phil Mayers" <p.mayers(a)imperial.ac.uk> wrote: >On 12/27/2012 03:19 PM, spartan1833(a)hushmail.com wrote: > >> ...but if not then ok I was simply trying to figure out if I was >> able to control machine-only 802.1x authentication against >> FreeRADIUS in a manner similar to how "simple" user >authentication >> appears to be done (via the users file). From your response, it >> appears that the answer is "NO" and that an LDAP configuration / >> LDAP groups will be required. > >Not so - that's not what Alan said. You mentioned LDAP - he >naturally >assumed you were looking in that direction. > >You can use the "users" file; but you need to alter the config >slightly, >and due to the way EAP-TLS runs in 2.x, you need to use it in a >particular way. > >Try this: > >/etc/raddb/modules/tls_clients: > >files tls_clients { > key = "%{TLS-Client-Cert-Common-Name}" > usersfile = "/etc/raddb/tls_clients" >} > >/etc/raddb/sites-enabled/default > >post-auth { > ... > if (TLS-Client-Cert-Common-Name) { > tls_clients.authorize > if (notfound) { > # reject unknown users > reject > } > } > ... >} > >Modify as appropriate for your needs. > >> >> I'll look into that as time allows...and while I appreciate your >> quick response, I think that your comment below is a bit >> unwarranted - one of the points of user groups is to be able to >ask >> the question "I don't know how...at least this has been the case >> for the last 15 years that I have been doing this stuff." > >Unfortunately, the FreeRADIUS community does not have the depth >and >breadth to provide the level of support and documentation that >something >like Apache or Samba does. This means there is more onus on you to >be >specific. > >I have my theories about *why* this difference exists - >specifically, >that FR is a complex infrastructure daemon, which people set up >and >forget, as opposed to a framework that they constantly use. You >see >similar issues on other projects (ISC bind, for example) that have >these >attributes. But whatever the reason, most people post to this list >a few >times, then vanish - they don't answer questions to people who >follow >them, write docs or wiki articles, or contribute code. > >This leads to a relatively small pool of people who can answer, >and to >the expectation that you be specific so those people can use their >time >efficiently. Don't take it personally - it's just a function of >the >community size. > >Cheers, >Phil >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

@Phil, Thanks for the example - I'll do some work with it. Appreciate the additional information too...I imagine that there is a huge amount of variation within FR configurations so I get it that requests for assistance need to be as concise as possible....don't always know "exactly" what to ask sometimes though :) Thanks again.... On Thu, 27 Dec 2012 10:40:15 -0500 "Phil Mayers" <p.mayers(a)imperial.ac.uk> wrote: >On 12/27/2012 03:19 PM, spartan1833(a)hushmail.com wrote: > >> ...but if not then ok I was simply trying to figure out if I was >> able to control machine-only 802.1x authentication against >> FreeRADIUS in a manner similar to how "simple" user >authentication >> appears to be done (via the users file). From your response, it >> appears that the answer is "NO" and that an LDAP configuration / >> LDAP groups will be required. > >Not so - that's not what Alan said. You mentioned LDAP - he >naturally >assumed you were looking in that direction. > >You can use the "users" file; but you need to alter the config >slightly, >and due to the way EAP-TLS runs in 2.x, you need to use it in a >particular way. > >Try this: > >/etc/raddb/modules/tls_clients: > >files tls_clients { > key = "%{TLS-Client-Cert-Common-Name}" > usersfile = "/etc/raddb/tls_clients" >} > >/etc/raddb/sites-enabled/default > >post-auth { > ... > if (TLS-Client-Cert-Common-Name) { > tls_clients.authorize > if (notfound) { > # reject unknown users > reject > } > } > ... >} > >Modify as appropriate for your needs. > >> >> I'll look into that as time allows...and while I appreciate your >> quick response, I think that your comment below is a bit >> unwarranted - one of the points of user groups is to be able to >ask >> the question "I don't know how...at least this has been the case >> for the last 15 years that I have been doing this stuff." > >Unfortunately, the FreeRADIUS community does not have the depth >and >breadth to provide the level of support and documentation that >something >like Apache or Samba does. This means there is more onus on you to >be >specific. > >I have my theories about *why* this difference exists - >specifically, >that FR is a complex infrastructure daemon, which people set up >and >forget, as opposed to a framework that they constantly use. You >see >similar issues on other projects (ISC bind, for example) that have >these >attributes. But whatever the reason, most people post to this list >a few >times, then vanish - they don't answer questions to people who >follow >them, write docs or wiki articles, or contribute code. > >This leads to a relatively small pool of people who can answer, >and to >the expectation that you be specific so those people can use their >time >efficiently. Don't take it personally - it's just a function of >the >community size. > >Cheers, >Phil >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

Hi, Thanks you for the...quick reply - thought I had spelled out what I was trying to figure out in fairly clear terms: > or can guide me in how to do local (to the RADIUS server) > machine policies - I just want to be able to say "laptop1234...", > etc are part of a local group and are authorized (provided that > they are properly provisioned with certs, etc). ...but if not then ok I was simply trying to figure out if I was able to control machine-only 802.1x authentication against FreeRADIUS in a manner similar to how "simple" user authentication appears to be done (via the users file). From your response, it appears that the answer is "NO" and that an LDAP configuration / LDAP groups will be required. I'll look into that as time allows...and while I appreciate your quick response, I think that your comment below is a bit unwarranted - one of the points of user groups is to be able to ask the question "I don't know how...at least this has been the case for the last 15 years that I have been doing this stuff." Regards... On Thu, 27 Dec 2012 09:50:03 -0500 "Alan DeKok" <aland(a)deployingradius.com> wrote: >spartan1833(a)hushmail.com wrote: >> 802.1x appears to be working; any laptop with the certs/config >is >> able to access the wired and/or wireless network and any laptop >> without is denied access. However, in my previous experience >with >> RADIUS (IAS/NPS in the Windows world), I am able to control >access >> at a policy level as well; any machine not part of a specific >group >> is denied access, regardless of what certificate is installed >and >> what configuration is present on the laptop. > > You can do that in FreeRADIUS, too. You can do LDAP group >comparisons: > >http://wiki.freeradius.org/modules/Rlm_ldap > >> I played around with the users file in FreeRADIUS but it didn't >> seem to have any effect unless I put a DEFAULT Auth-Type Reject >in >> the file which blocked everyone regardless of what else I had in > >> the users file. > > Well... playing around isn't useful. You need to first define >the >problem, and then look for a solution. The problem here seems to >be >looking up groups in LDAP, right? > > So... configure the LDAP module. Read it's documentation. > >> I've Googled around a bit but haven't found any >> definitive guides on how I would do a FreeRADIUS analog to >Windows >> IAS/NPS policies other than having to include ldap servers >and/or >> other types of external authentication systems which I'm not >really >> interested (at this point) in doing. > > Are groups are stored in LDAP? If so, you need to configure >FreeRADIUS to talk to the LDAP server. > >> Guessing that I'm missing something so hoping that someone elss >has >> done this or can guide me in how to do local (to the RADIUS >server) >> machine policies - I just want to be able to say >"laptop1234...", >> etc are part of a local group and are authorized (provided that >> they are properly provisioned with certs, etc). > > Where are those groups defined? > > Right now, your question is "I want to do stuff but I don't know >how". > You need to describe what you want to do, in detail. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

3 2