- Freeradius-Users - lists.freeradius.org

Problem with freeradius + openldap for AP authentication
by Nicolas Lathiere 26 Nov '12

26 Nov '12

Hiya I need some help to configure freeradius with openldap. I have a ldap database which stores password in SSHA format, so i choose PAP for authentication. I want to use freeradius to authenticate on a netgear Wifi access point. (http://deployingradius.com/documents/protocols/compatibility.html) I've set up the AP in client freeradius in clients.conf, with a secret and shortname like in documentation. Next i've put auto_header = yes in pap.conf And uncomment the line ldap to activate module in /site-enable/default When i start server in debug mode, authorization works fine but server have problems to authentication step and i don't understand why Here is the debug comments : rad_recv: Access-Request packet from host 192.168.0.201 port 32774, id=85, length=169 User-Name = "cyril" NAS-IP-Address = 192.168.0.201 NAS-Identifier = "hello" NAS-Port = 0 Called-Station-Id = "4C-60-DE-D2-22-61:easyBridge2" Calling-Station-Id = "7C-C5-37-14-16-C9" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x0200000e016e6c61746869657265 Message-Authenticator = 0x2bf3ec3446adc97ea15c4c160ee8b0bbThu Nov 22 15:04:36 2012 : Wed Nov 21 18:39:17 2012 : Info: [ldap] looking for reply items in directory... Wed Nov 21 18:39:17 2012 : Info: [ldap] user cyril authorized to use remote access Wed Nov 21 18:39:17 2012 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Wed Nov 21 18:39:17 2012 : Info: ++[ldap] returns ok Wed Nov 21 18:39:17 2012 : Info: ++[expiration] returns noop Wed Nov 21 18:39:17 2012 : Info: ++[logintime] returns noop Wed Nov 21 18:39:17 2012 : Info: [pap] Normalizing NT-Password from hex encoding Wed Nov 21 18:39:17 2012 : Info: [pap] Normalizing SSHA1-Password from base64 encoding Wed Nov 21 18:39:17 2012 : Info: [pap] Found existing Auth-Type, not changing it. Wed Nov 21 18:39:17 2012 : Info: ++[pap] returns noop Wed Nov 21 18:39:17 2012 : Info: Found Auth-Type = PAP Wed Nov 21 18:39:17 2012 : Info: +- entering group PAP {...} Auth: [pap] Attribute "Password" is required for authentication. Thu Nov 22 15:04:36 2012 : Info: ++[pap] returns invalid Thu Nov 22 15:04:36 2012 : Info: Failed to authenticate the user. Thu Nov 22 15:04:36 2012 : Auth: Login incorrect: [cyril/<via Auth-Type = PAP>] (from client WNAP320 port 0 cli 44-A7-CF-CD-C5-C7) Thu Nov 22 15:04:36 2012 : Info: Using Post-Auth-Type Reject Thu Nov 22 15:04:36 2012 : Info: +- entering group REJECT {...} Thu Nov 22 15:04:36 2012 : Debug: expand: %{User-Name} -> cyril Thu Nov 22 15:04:36 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Nov 22 15:04:36 2012 : Info: ++[attr_filter.access_reject] returns updated Thu Nov 22 15:04:36 2012 : Info: Delaying reject of request 5 for 1 seconds Thu Nov 22 15:04:36 2012 : Debug: Going to the next request Thu Nov 22 15:04:36 2012 : Debug: Waking up in 0.9 seconds. Thu Nov 22 15:04:37 2012 : Info: Sending delayed reject for request 5

2 1

How to perform certain actions on Access Accept
by Shravan S G 26 Nov '12

26 Nov '12

Hi, I have configured FreeRadius to authenticate users based on entries in a Database. On successful authentication, an Access-Accept is returned. Now I want to send a message with some random content to another machine connected to the FreeRadius server, as soon as the user is authenticated. How can I configure some completely unrelated action like this, or say a file transfer to be performed on successful authentication of a user? Thanks in advance, Shravan

2 1

Re: Newbie question about rlm_exec usage
by Alan Buxey 24 Nov '12

24 Nov '12

What EAP type? eg if using PEAP, the client never sends a password, instead its challenge-response which works because the SQL contains a copy of the password so MSCHAP can derive an agreement. Gmhow dies your curl do this? Are you trying thus in the authenticate section and feeding an authorization method? radiusd -X is your and our friend alan

3 3

Duplicate NAS name
by Lorenzo Milesi 24 Nov '12

24 Nov '12

Hi. I'm performing some test upgrades from 1.1.x and ran into the nas table problem: in FR1 I had a list of NASes with duplicate names, maybe because we had several hotspots with different shortnames NAT'ed on the same ip. I see now FR complains at startup for duplicate name. How can I deal with such situation, where two nas share the same ip? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 2

Re: problem with test aaa-server in ciscoasa
by studyfordo 24 Nov '12

24 Nov '12

firstly, thanks Mathew Newton and alan buxey. I run freeradius -X and run test in ciso asa5520. details as follows. rad_recv: Access-Request packet from host 192.168.30.254 port 1025, id=72, length=61 User-Name = "tsb" User-Password = "123456" NAS-IP-Address = 192.168.30.254 NAS-Port = 64 NAS-Port-Type = Virtual # Executing section authorize from file /opt/freeadius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tsb", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /opt/freeadius/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tsb attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 72 to 192.168.30.254 port 1025 Waking up in 4.9 seconds. Cleaning up request 1 ID 72 with timestamp +430 Ready to process requests. I have add user such as following format cat users | sed -n '/^[^#]/p' tsb Cleartext-Password := "123456" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP So I still problem with user fomat in file users? pls give me some advice. thanks

2 1

Re: problem with test aaa-server in ciscoasa
by Alan Buxey 24 Nov '12

24 Nov '12

...oh, and make sure you are editing the CORRECT users file ;) alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Re: problem with test aaa-server in ciscoasa
by Alan Buxey 24 Nov '12

24 Nov '12

As previously mentioned, only add that user/pass to the users file... nothing else. Don't add all that stuff that you did alan

1 0

dhcp/bootp server filename
by Lev Bronshtein 24 Nov '12

24 Nov '12

FreeRadius 2.2.0 Redhat Linux 6.2 Please forgive me in advance if some of the things I say seem to be generalities and not per RFC, the firm where I work has recently decided to start using freeradius DHCP as DHCP server and I am the programmer/integrator/project lead for the entire thing. Our preliminary tests were very successful, we were able to hand out leases to various clients and also various options as well. However when it came to PXE Boot we sem to have run afoul of either my lack of knowledge or Microsoft going out of their way to "help" network admins. Here is the problem, as expected I have set option 66 -- DHCP-TFTP-Server-Name and option 67 DHCP-Boot-File-Name, however tge PXE boot process has not been completed and we get an error message PXE-E32 and according to this article http://www.bootix.com/support/problems_solutions/pxe_e32_tftp_open_timeout.… we have to set option 066 next server. However this is not what option 66 is. Looking at the tcp dump that was produced on the freeradius server I can see that "next server" field is the same as the "DHCP-Server-Identifier", and while changing this value to the one of the TFTP server also changed the next server field as expected it also broke dhcp. Also the people who have successfully booted their PXE hardware in the lab sent me a a pcap where clearly the next server and Identifier are clearly different and also the boot-file-name is set as well, where as in my pcap I only see it in the dhcp options not in boot options header (I must clarify at this point that I am using ethereal to decode and read packets). Which is why I am thinking that options 66 and 67 are not used for PXE boot, but microsoft dhcp seeing those options also takes care of backword compatibility, and so as far as everyone in windows land is concerned they need to set options 66 and 67. Can anyone help please? Regards, Lev Bronshtein P.S. I figured out that I ned to set both DHCP-Server-Identifier and DHCP-Server-IP-Address, which gave me the next-address. However I still can't figure out the boot file option

1 1

what about mac spoofing
by pideil matthew 23 Nov '12

23 Nov '12

Hello all ! Please tell me, does radius auth over wifi (wpa2) affected by mac spoofing attack ? I think not because after successfull auth, exchange key mechanism is performed and all traffic become crypted. But my wifi laptop can already be disconnected by spoofed packet ? Regards, Matt

2 1

Git master branch & Debian build
by Olivier Beytrison 23 Nov '12

23 Nov '12

Hello, Just a quick question, before I loose too much time on this. Is the debian build system on the master repository working ? I'm getting hard time to build the deb packages. git clone from yesterday, ubuntu 12.04 LTS Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

5 38