- Freeradius-Users - lists.freeradius.org

MS-CHAPv2 change password not working in master
by Carlos Velasco 16 Nov '12

16 Nov '12

Hi, I downloaded git master yesterday to test the new MS-CHAPv2 change password functionality. My setup is a Cisco router with "passwd-expiry" setup with Cisco VPN client for login, with FreeRadius to Windows AD through Winbind. MS-CHAPv2 authentication works fine. Winbind and AD setup is right. But testing the new passchange functionality by selecting "User must change password at next logon" in the Windows user, the New password windows popup in Cisco VPN client, but the change password process fails: ntlm_auth said: Password-Change: No Password-Change-Error: Wrong Password . . Winbind logs also shows: NT_STATUS_WRONG_PASSWORD Looking into code I suppose the problem is something with the old NT hash, but not an expert here. Any help would be apreciated. In these logs the user is "NIMASTELECOM\testpw". The current password is "y58R41ut8W" (expired). And the new password used was "H6eEWu7r65tw38ert1". Some radius logs: === # radiusd -X radiusd: FreeRADIUS Version 3.0.0, for host x86_64-unknown-linux-gnu, built on Nov 16 2012 at 01:46:19 Copyright (C) 1999-2012 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... ...................................... Ready to process requests. rad_recv: Access-Request packet from host 10.112.14.2 port 1645, id=127, length=202 User-Name = "NIMASTELECOM\\testpw" Calling-Station-Id = "217.126.166.195" MS-CHAP-Challenge = 0xdd2a98d3c3c69fb959df2f561d50d025 MS-CHAP2-Response = 0x01007b0896de80c7098bac5566313c61d1b200000000000000003cc2724e1d2be6d1868df97bd0607859441dc99b5ef37af0 NAS-Port-Type = Virtual Cisco-NAS-Port = "85.112.6.36" NAS-Port = 0 NAS-Port-Id = "85.112.6.36" Service-Type = Login-User NAS-IP-Address = 10.112.14.2 Event-Timestamp = "Nov 16 2012 10:39:06 CET" (0) # Executing section authorize from file /etc/raddb/sites-enabled/vpn_nimas_tk (0) group authorize { (0) - entering group authorize {...} (0) mschap-vpn_nimas_tk : Found MS-CHAP attributes. Setting 'Auth-Type = mschap-vpn_nimas_tk' (0) [mschap-vpn_nimas_tk] = ok (0) ? if (!control:Auth-Type) (0) ? Evaluating !(control:Auth-Type) -> FALSE (0) ? if (!control:Auth-Type) -> FALSE (0) detail-vpn_nimas_tk-auth : expand: /var/log/radius/radacct/vpn_nimas_tk-auth-%Y%m%d -> /var/log/radius/radacct/vpn_nimas_tk-auth-20121116 (0) detail-vpn_nimas_tk-auth : /var/log/radius/radacct/vpn_nimas_tk-auth-%Y%m%d expands to /var/log/radius/radacct/vpn_nimas_tk-auth-20121116 (0) detail-vpn_nimas_tk-auth : expand: %t -> Fri Nov 16 10:39:06 2012 (0) [detail-vpn_nimas_tk-auth] = ok (0) Found Auth-Type = MSCHAP (0) # Executing group from file /etc/raddb/sites-enabled/vpn_nimas_tk (0) group MS-CHAP { (0) - entering group MS-CHAP {...} (0) mschap-vpn_nimas_tk : Creating challenge hash with username: testpw (0) mschap-vpn_nimas_tk : Client is using MS-CHAPv2 for testpw, we need NT-Password (0) mschap-vpn_nimas_tk : expand: --username=%{mschap-vpn_nimas_tk:User-Name} -> --username=testpw (0) mschap-vpn_nimas_tk : expand: --domain=%{mschap-vpn_nimas_tk:NT-Domain} -> --domain=NIMASTELECOM (0) mschap-vpn_nimas_tk : Creating challenge hash with username: testpw (0) mschap-vpn_nimas_tk : expand: --challenge=%{mschap-vpn_nimas_tk:Challenge:-00} -> --challenge=3550f7bf5746677f (0) mschap-vpn_nimas_tk : expand: --nt-response=%{mschap-vpn_nimas_tk:NT-Response:-00} -> --nt-response=3cc2724e1d2be6d1868df97bd0607859441dc99b5ef37af0 Exec-Program output: Must change password (0xc0000224) Exec-Program-Wait: plaintext: Must change password (0xc0000224) Exec-Program: returned: 1 (0) mschap-vpn_nimas_tk : ntlm_auth says Must change password (0xc0000224) (0) [mschap-vpn_nimas_tk] = reject (0) Failed to authenticate the user. (0) Login incorrect: [NIMASTELECOM\\testpw] (from client RMADTKNIMAS01 port 0 cli 217.126.166.195) (0) Using Post-Auth-Type Reject (0) WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. (0) Finished request 0. Waking up in 0.9 seconds. (0) Sending delayed reject Sending Access-Reject of id 127 from 85.112.8.156 port 1812 to 10.112.14.2 port 1645 MS-CHAP-Error = "\001E=648 R=0 C=47763c0a72e4fb2d546c9a413245f87b V=3 M=Password Expired" Waking up in 4.9 seconds. (0) Cleaning up request packet ID 127 with timestamp +14 Ready to process requests. rad_recv: Access-Request packet from host 10.112.14.2 port 1645, id=128, length=755 User-Name = "NIMASTELECOM\\testpw" MS-CHAP-Challenge = 0xf42a98d3c3c69fb959df2f561d50d025 MS-CHAP2-CPW = 0x070100000000000000000000000000000000b79a22699ae1dedc832935c8f5c5d7880000000000000000b0bfd263d6c0bbc0b2b28e085c072676857cf1f7c6f88a300000 MS-CHAP-NT-Enc-PW = 0x0601000176116065c54f9ef590a62a9e5d90a75e906e19b76954e1ff0deeb5f3a5212f64e16adf48e0f1e3bb2cd3c3889dac2d67b6584725b87c28d1612fdedf8268e3af3096a2c596ea8efb16697a10b5e726a86e457a84669c6ec82cfc67a301ff9d329b0ef45b96084d099823105412e0779971079efc9260b6ab1805df81b10f3fa65d4aa859beeaae01f0a2311f51bfc9c84f0168b595fa80273b6a08180e83ec63f03a6face5015ccb52114017 MS-CHAP-NT-Enc-PW = 0x060100025ddd392405df3b0952a11ad2158f1c26398cdd6f2eb4be40607ff1fe81fc1e4f335e9b1a8a8a4a081f4b6834fe8e8d024ae1c80da758057f9505f8dff2a0211dd68d67fea4cb6de33f582be526fb0698669878264cb7ab61883a4caa4e4bc60f5421496218319c3ad4c0210383edc4daf25f43a55002d8014c287659c32cdbc6a43e0dc01c2c2effc7aa43267a0cf5c2100b4d25de0408559dd012496716837562ff79032b2f1671cd85d582 MS-CHAP-NT-Enc-PW = 0x060100030c2cb9971bac6562e7e0615b9d89c703e7bbd4e0765af7c420590cd3b6d0149ab90d95b03f56e543759da80aea68ca44bf4b7514a1f2550fa2be6571c1639fd67738d2351a248f43f7ce4e1c552cf769416be4b6b78e7c1f49b32e5f2b7421acebab117a2009ccb87e0170cd30b31024a331920c5c2891a939ec22061af7fad85140a0bd99e89c3c6d56a3e9eb3a8025d5ef968ba7523c78f11bb43cd49936d2b28d289788d164b507a76fb6 NAS-Port-Type = Virtual Cisco-NAS-Port = "85.112.6.36" NAS-Port = 0 NAS-Port-Id = "85.112.6.36" Service-Type = Login-User NAS-IP-Address = 10.112.14.2 Event-Timestamp = "Nov 16 2012 10:39:20 CET" (1) # Executing section authorize from file /etc/raddb/sites-enabled/vpn_nimas_tk (1) group authorize { (1) - entering group authorize {...} (1) mschap-vpn_nimas_tk : Found MS-CHAP attributes. Setting 'Auth-Type = mschap-vpn_nimas_tk' (1) [mschap-vpn_nimas_tk] = ok (1) ? if (!control:Auth-Type) (1) ? Evaluating !(control:Auth-Type) -> FALSE (1) ? if (!control:Auth-Type) -> FALSE (1) detail-vpn_nimas_tk-auth : expand: /var/log/radius/radacct/vpn_nimas_tk-auth-%Y%m%d -> /var/log/radius/radacct/vpn_nimas_tk-auth-20121116 (1) detail-vpn_nimas_tk-auth : /var/log/radius/radacct/vpn_nimas_tk-auth-%Y%m%d expands to /var/log/radius/radacct/vpn_nimas_tk-auth-20121116 (1) detail-vpn_nimas_tk-auth : expand: %t -> Fri Nov 16 10:39:20 2012 (1) [detail-vpn_nimas_tk-auth] = ok (1) Found Auth-Type = MSCHAP (1) # Executing group from file /etc/raddb/sites-enabled/vpn_nimas_tk (1) group MS-CHAP { (1) - entering group MS-CHAP {...} (1) mschap-vpn_nimas_tk : MS-CHAPv2 password change request received (1) mschap-vpn_nimas_tk : Password change payload valid (1) mschap-vpn_nimas_tk : Doing MS-CHAPv2 password change via ntlm_auth helper (1) mschap-vpn_nimas_tk : expand: username: %{mschap-vpn_nimas_tk:User-Name} -> username: testpw (1) mschap-vpn_nimas_tk : expand: nt-domain: %{mschap-vpn_nimas_tk:NT-Domain} -> nt-domain: NIMASTELECOM (1) mschap-vpn_nimas_tk : ntlm_auth said: Password-Change: No Password-Change-Error: Wrong Password . . (1) mschap-vpn_nimas_tk : ntlm auth password change failed: Password-Change-Error: Wrong Password (1) mschap-vpn_nimas_tk : Password change failed (1) [mschap-vpn_nimas_tk] = reject (1) Failed to authenticate the user. (1) Login incorrect: [NIMASTELECOM\\testpw] (from client RMADTKNIMAS01 port 0) (1) Using Post-Auth-Type Reject (1) WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. (1) Finished request 1. Waking up in 0.2 seconds. Waking up in 0.7 seconds. (1) Sending delayed reject Sending Access-Reject of id 128 from 85.112.8.156 port 1812 to 10.112.14.2 port 1645 MS-CHAP-Error = "\001E=709 R=0 M=Password change failed" Waking up in 4.9 seconds. (1) Cleaning up request packet ID 128 with timestamp +28 Ready to process requests. === The mschap derived module is simple: === mschap mschap-vpn_nimas_tk { with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap-vpn_nimas_tk:User-Name} --domain=%{mschap-vpn_nimas_tk:NT-Domain} --challenge=%{mschap-vpn_nimas_tk:Challenge:-00} --nt-response=%{mschap-vpn_nimas_tk:NT-Response:-00}" passchange { ntlm_auth = "/usr/bin/ntlm_auth -d 10 -l /var/log/samba --helper-protocol=ntlm-change-password-1" ntlm_auth_username = "username: %{mschap-vpn_nimas_tk:User-Name}" ntlm_auth_domain = "nt-domain: %{mschap-vpn_nimas_tk:NT-Domain}" retry_msg = "Re-enter (or reset) the password" } === Winbind logs: === [2012/11/16 10:39:06.810639, 6] winbindd/winbindd.c:794(new_connection) accepted socket 25 [2012/11/16 10:39:06.810793, 10] winbindd/winbindd.c:644(process_request) process_request: request fn INTERFACE_VERSION [2012/11/16 10:39:06.810841, 3] winbindd/winbindd_misc.c:384(winbindd_interface_version) [ 9918]: request interface version [2012/11/16 10:39:06.810906, 10] winbindd/winbindd.c:740(winbind_client_response_written) winbind_client_response_written[9918:INTERFACE_VERSION]: delivered response to client [2012/11/16 10:39:06.810964, 10] winbindd/winbindd.c:644(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2012/11/16 10:39:06.811002, 3] winbindd/winbindd_misc.c:417(winbindd_priv_pipe_dir) [ 9918]: request location of privileged pipe [2012/11/16 10:39:06.811068, 10] winbindd/winbindd.c:740(winbind_client_response_written) winbind_client_response_written[9918:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2012/11/16 10:39:06.811117, 6] winbindd/winbindd.c:842(winbind_client_request_read) closing socket 25, client exited [2012/11/16 10:39:06.811171, 6] winbindd/winbindd.c:794(new_connection) accepted socket 25 [2012/11/16 10:39:06.811227, 10] winbindd/winbindd.c:617(process_request) process_request: Handling async request 9918:PAM_AUTH_CRAP [2012/11/16 10:39:06.811266, 3] winbindd/winbindd_pam_auth_crap.c:56(winbindd_pam_auth_crap_send) [ 9918]: pam auth crap domain: [NIMASTELECOM] user: testpw [2012/11/16 10:39:07.071142, 10] winbindd/winbindd.c:679(wb_request_done) wb_request_done[9918:PAM_AUTH_CRAP]: NT_STATUS_PASSWORD_MUST_CHANGE [2012/11/16 10:39:07.071243, 10] winbindd/winbindd.c:740(winbind_client_response_written) winbind_client_response_written[9918:PAM_AUTH_CRAP]: delivered response to client [2012/11/16 10:39:07.071320, 6] winbindd/winbindd.c:842(winbind_client_request_read) closing socket 25, client exited [2012/11/16 10:39:20.825567, 6] winbindd/winbindd.c:794(new_connection) accepted socket 25 [2012/11/16 10:39:20.825731, 10] winbindd/winbindd.c:644(process_request) process_request: request fn INTERFACE_VERSION [2012/11/16 10:39:20.825780, 3] winbindd/winbindd_misc.c:384(winbindd_interface_version) [ 9957]: request interface version [2012/11/16 10:39:20.825851, 10] winbindd/winbindd.c:740(winbind_client_response_written) winbind_client_response_written[9957:INTERFACE_VERSION]: delivered response to client [2012/11/16 10:39:20.825916, 10] winbindd/winbindd.c:644(process_request) process_request: request fn WINBINDD_PRIV_PIPE_DIR [2012/11/16 10:39:20.825960, 3] winbindd/winbindd_misc.c:417(winbindd_priv_pipe_dir) [ 9957]: request location of privileged pipe [2012/11/16 10:39:20.826035, 10] winbindd/winbindd.c:740(winbind_client_response_written) winbind_client_response_written[9957:WINBINDD_PRIV_PIPE_DIR]: delivered response to client [2012/11/16 10:39:20.826106, 6] winbindd/winbindd.c:842(winbind_client_request_read) closing socket 25, client exited [2012/11/16 10:39:20.826169, 6] winbindd/winbindd.c:794(new_connection) accepted socket 25 [2012/11/16 10:39:20.826235, 10] winbindd/winbindd.c:644(process_request) process_request: request fn DOMAIN_NAME [2012/11/16 10:39:20.826279, 3] winbindd/winbindd_misc.c:394(winbindd_domain_name) [ 9957]: request domain name [2012/11/16 10:39:20.826341, 10] winbindd/winbindd.c:740(winbind_client_response_written) winbind_client_response_written[9957:DOMAIN_NAME]: delivered response to client [2012/11/16 10:39:20.826497, 10] winbindd/winbindd.c:617(process_request) process_request: Handling async request 9957:PAM_CHNG_PSWD_AUTH_CRAP [2012/11/16 10:39:20.826544, 3] winbindd/winbindd_pam_chng_pswd_auth_crap.c:57(winbindd_pam_chng_pswd_auth_crap_send) [ 9957]: pam change pswd auth crap domain: NIMASTELECOM user: testpw [2012/11/16 10:39:20.856407, 10] winbindd/winbindd.c:679(wb_request_done) wb_request_done[9957:PAM_CHNG_PSWD_AUTH_CRAP]: NT_STATUS_WRONG_PASSWORD [2012/11/16 10:39:20.856498, 10] winbindd/winbindd.c:740(winbind_client_response_written) winbind_client_response_written[9957:PAM_CHNG_PSWD_AUTH_CRAP]: delivered response to client [2012/11/16 10:39:20.856674, 6] winbindd/winbindd.c:842(winbind_client_request_read) closing socket 25, client exited === Regards, Carlos Velasco

2 8

building "master" under mock buildroot
by Phil Mayers 16 Nov '12

16 Nov '12

All, I'm preparing a FreeRADIUS 3 RPM, in the hope we can move to a pre-release of the "master" branch, for a bit of soak testing but also because I'm tired of backporting stuff to our local 2.x branch ;o) Sadly, the source builds fine in the "native" OS, but doesn't build under "mock" (and RPM "build in chroot" tool). I'm extremely reluctant to deviate from our normal build procedures. The errors at the end of the log are pretty mysterious: + make gcc /builddir/build/BUILD/freeradius3-3.0.0pre1/scripts/jlibtool.c -o /builddir/build/BUILD/freeradius3-3.0.0pre1/scripts/jlibtool /builddir/build/BUILD/freeradius3-3.0.0pre1/scripts/jlibtool.c: In function 'parse_args': /builddir/build/BUILD/freeradius3-3.0.0pre1/scripts/jlibtool.c:1771: warning: assignment discards qualifiers from pointer target type Making all in src... ln -sf include freeradius-devel Making all in src/include... gmake[4]: *** [features.h] Error 1 gmake[3]: *** [include] Error 2 gmake[2]: *** [all] Error 2 gmake[1]: *** [src] Error 2 RPM build errors: make: *** [all] Error 2 More annoying, if I "mock shell" into the buildroot and re-try "make", it all works fine. I can't see any obvious culprits such as an environment variable further up. Does anyone have any idea what could cause the build to fail in this way, with those gmake errors?

3 11

poptop pptpd + freeradius
by Dmitry Korzhevin 16 Nov '12

16 Nov '12

Guys, Same server, i am trying to configure pptpd with radius, please give advice, why it is not working. Radius auth is succesfull.. /var/log/messages (pppd log): http://dpaste.com/832022/ /etc/pptpd.conf http://dpaste.com/832024/ /etc/ppp/options.pptpd http://dpaste.com/832026/ freeradius -X log: http://dpaste.com/832027/ client side: /etc/ppp/chap-secrets: user * "userpass" * /etc/ppp/peers/bde: # written by pptpsetup pty "pptp PPTPD_SERVER_IP --nolaunchpppd" lock noauth debug nobsdcomp refuse-eap nodeflate novj novjccomp nologfd name user user user password userpass Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

4 5

Compiler Warnings on ArchLinux and on openSuse
by Matthias Beyer 16 Nov '12

16 Nov '12

Hi there, I'm new to this list, but anyway I hope I can ship all information you need. I had to compile the newest Version (2.2.0) of the FreeRadius-server today at work on a openSuse server (I think it's 11 or 12, 64 bit). There were 2 or 3 compiler warnings because in xlat.c[0] some functions could not be referenced. Anyway, I know how to write C code and I thought "Oh, maybe I could fix this and send a patch when I'm at home". So I did. I forked the repository at github and startet with ./configure make But at home, I run ArchLinux (64 bit machine). There were tons of compiler warnings. I am not planning to install the software on my personal machine, but maybe this is interesting for someone. I could send you the whole output of './configure' or the output of 'make' if you want to have it. [0] https://github.com/alandekok/freeradius-server/blob/master/src/main/xlat.c kind regards, Matthias Beyer

2 1

FreeRADIUS + Mysql + xl2tpd and pptpd
by Dmitry Korzhevin 15 Nov '12

15 Nov '12

Hello, Can anyone please share working configs for freeradius + xl2tpd or pptpd? Radius server is already configured, and works with mysql backend + strongSwan ipsec (dirrect connection). But, i try several pptpd / xl2tpd configurations, and suddenly they doesn't work.. I even try configuration from wiki: http://wiki.freeradius.org/config/PopTop And it is not working. I use Debian 6.0.6 x86_64, freeradius 2.1.10+dfsg-2+squeeze1, xl2tpd 1.2.7+dfsg-1, pptpd 1.3.4-3 Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

2 2

EAP-SIM authentication failed
by Yann R. Moupinda 15 Nov '12

15 Nov '12

Hi guys, for my thesis i need to realize a EAP-SIM Authentication testbed. I'm using a Nokia E52 with EAP-SIM, a MIKROTIK router as access point and FreeRADIUS 2.1.10 as Radius server. I have added the necessary commands in the clients.conf, radiusd.conf, eap.conf and default files in order to enable EAP-SIM Authentication on the FreeRADIUS and I've created a flat file ' simtriplets.dat ' that is used from the Radius during the authentication process. By trying to access to the Wlan with the mobile phone (Nokia E52), i got the message that the authentication was unsuccessful. But by looking at the radius debug file, i cannot recognize any failure or messages like 'Access-Reject'. The debug file shows that radius got two ' Access-Request' packets from MIKROTIK router and it also sent two 'Access-Challenge' packets back to the router. It seems the radius is waiting for next requests and then the authentication process just ends up. so my questions are: -how many request packets are needed to complete the eap-sim authentication? -what should I configure to get more than 2 Access-Request here is the content of my debug file: . . . Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Ready to process requests. rad_recv: Access-Request packet from host 192.168.10.212 port 38803, id=29, length=238 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "1901700000000653" NAS-Port-Id = "ap_hotspot" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "8220000e" Acct-Multi-Session-Id = "00-0C-42-64-41-9D-A8-7E-33-3E-9C-5B-82-20-00-00-00-00-00-0E" Calling-Station-Id = "A8-7E-33-3E-9C-5B" Called-Station-Id = "00-0C-42-64-41-9D:YANN" EAP-Message = 0x020100150131393031373030303030303030363533 Message-Authenticator = 0xcf4e5f6429686cc260b16bd23d82489f NAS-Identifier = "MT_Yann" NAS-IP-Address = 192.168.10.212 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} rlm_sim_files: authorized user/imsi 1901700000000653 rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1901700000000653", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 21 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 108 ++[eap] returns handled Sending Access-Challenge of id 29 to 192.168.10.212 port 38803 EAP-Message = 0x016c0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x870e2a6987623891aa6e49c2b1bcc9b6 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.212 port 50478, id=30, length=287 Service-Type = Framed-User Framed-MTU = 1400 User-Name = "1901700000000653" State = 0x870e2a6987623891aa6e49c2b1bcc9b6 NAS-Port-Id = "ap_hotspot" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "8220000e" Acct-Multi-Session-Id = "00-0C-42-64-41-9D-A8-7E-33-3E-9C-5B-82-20-00-00-00-00-00-0E" Calling-Station-Id = "A8-7E-33-3E-9C-5B" Called-Station-Id = "00-0C-42-64-41-9D:YANN" EAP-Message = 0x026c0034120a000007050000c27cfb1cfa7a257c9c89796e49bca230100100010e05001031393031373030303030303030363533 Message-Authenticator = 0xc691af8b618d9da88f9e289557530f6f NAS-Identifier = "MT_Yann" NAS-IP-Address = 192.168.10.212 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} rlm_sim_files: authorized user/imsi 1901700000000653 rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "1901700000000653", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 108 length 52 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: Service-Type = Framed-User Framed-MTU = 1400 User-Name = "1901700000000653" State = 0x870e2a6987623891aa6e49c2b1bcc9b6 NAS-Port-Id = "ap_hotspot" NAS-Port-Type = Wireless-802.11 Acct-Session-Id = "8220000e" Acct-Multi-Session-Id = "00-0C-42-64-41-9D-A8-7E-33-3E-9C-5B-82-20-00-00-00-00-00-0E" Calling-Station-Id = "A8-7E-33-3E-9C-5B" Called-Station-Id = "00-0C-42-64-41-9D:YANN" EAP-Message = 0x026c0034120a000007050000c27cfb1cfa7a257c9c89796e49bca230100100010e05001031393031373030303030303030363533 Message-Authenticator = 0xc691af8b618d9da88f9e289557530f6f NAS-Identifier = "MT_Yann" NAS-IP-Address = 192.168.10.212 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000c27cfb1cfa7a257c9c89796e49bca230 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x31393031373030303030303030363533 [eap] Underlying EAP-Type set EAP ID to 109 ++[eap] returns handled Sending Access-Challenge of id 30 to 192.168.10.212 port 50478 EAP-Message = 0x016d0050120b0000010d00000123456789abcdef0123456789abcdef0123456789abcdef0123456789abcde00123456789abcdef0123456789abcd180b0500000bffb0f7777b066616d98519e625a531 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x870e2a6986633891aa6e49c2b1bcc9b6 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 29 with timestamp +17 Cleaning up request 1 ID 30 with timestamp +17 Ready to process requests. Has anyone an idea why the authentication breaks up? Thank you in advance. Regards, Yann

5 10

AcctSessionId UNIQUE
by Lorenzo Milesi 15 Nov '12

15 Nov '12

Is there any contraindication in marking the radacct.AcctSessionId column UNIQUE? >From what I've read by researching in old threads, and looking at the current source [1], it looks like there is no one. I'm still using old FR 1.1.7. I know this is a sympthom of something else, and I already investigated and found the solution, but while I wait I get this activated I need to mitigate the problem. thanks [1] https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/sql/mysql… -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

3 4

Complex eduroam radius design
by Olivier Beytrison 15 Nov '12

15 Nov '12

Hello, We're planning to deploy eduroam centrally for all the university of applied science of west-switzerland. (consists of ~27 schools and 25'000 people). On one side, we will have the central radius servers, connected to the central ldap backend which contains all the user account. On the other side, we will have local radius servers (about 7 pairs of servers, because the schools are grouped regionally and under a central management). The idea is the following : User join the WLAN (802.1x, eduroam). the WiFi controller (nas) contact the local radius for authentication, which in turn contact the central radius to authenticate the user. upon successful authentication, the central radius return the Access-Accept along with some custom attribute about the user. The local radius then perform admission control based on those attributes. (selecting the correct vlan, subnet, ect) So I have two questions : 1. is this implementation possible ? 2. If it is possible, will the inner-tunnel for eap-peap and eap-ttls end on the local or central radius, taking in account that the authentication is performed by the central radius. (I'll go for the central one) Thanks in advance for your answers. Best regards, Olivier B. -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mail: olivier(a)heliosnet.org

5 10

Re: accounting data
by Dirk van der Walt 15 Nov '12

15 Nov '12

Hi, I've done the same exercise on my side and have the following observations based on the debug output. 1.)The rlm_counter is only interested in Accounting Stop packets. 2.)If I send two subsequent Accounting Stop requests using the radclient and the file with the Accounting Stop AVP bundles, only the first one is used and the second one is ignored due to the fact that the packet with the unique ID is already recorded in the database and thus ignored: rlm_counter: Packet Unique ID = '9c5a417fc48a9b9e' rlm_counter: Searching the database for key 'aclice' rlm_counter: Key found. rlm_counter: Counter Unique ID = '8d3af3931deff832' rlm_counter: Unique IDs for user match. Droping the request. The Packet Unique ID is created by the acct_unique module in the preacct section: [acct_unique] WARNING: Attribute NAS-Identifier was not found in request, unique ID MAY be inconsistent [acct_unique] Hashing 'NAS-Port = 0,,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "4D2BB8AC-00000099",User-Name = "alice"' [acct_unique] Acct-Unique-Session-ID = "9c5a417fc48a9b9e". ++[acct_unique] returns ok This is covered in the pre-accounting section on page 133. Since this is a simulation, in the real world the next packet will have a different value for Acct-Session-Id. So by simply changing the value of Acct-Session-Id to 4D2BB8AC-00000099 in these files containing the AVP bundles and running the session simulation again you can see the following: rlm_counter: Packet Unique ID = '56a4675037d8b965' rlm_counter: Searching the database for key 'aclice' rlm_counter: Key found. rlm_counter: Counter Unique ID = '8d3af3931deff832' rlm_counter: User=aclice, Counter=30. rlm_counter: User=aclice, New Counter=60. rlm_counter: Storing new value in database. rlm_counter: New value stored successfully. ++[daily] returns ok So the important thing to remember if you want simulate a user's session is that the value of Acc-Session-Id needs to be unique for every simulated session. A session simulation will consist of an Accounting Start and Stop request (and also may include optional Accounting Interim-Update requests). With that in mind, refer again to the description of Acct-Session-Id on page 131. Although rlm_counter is primarily used as an introduction here to better understand the counter modules, the next section covers the rlm_sqlcounter module. This module is more flexible and preferred. Hope this helps you.

3 2

Re: Complex eduroam radius design
by Alan Buxey 14 Nov '12

14 Nov '12

Hi, >Radsec can run over TCP. Another good >reason to go for Freeradius3 and >use radsec. Btw if I want to test FR3, I >guess that it's available on >git. But I didn't find where and how to >get it. any hint ? It's clearly linked from the downloads page...if you can't get past that small hurdle I really wouldn't advise running FR3 on your architecture ... ...but yes, you are correct with the certificate assertion. Just one needed. :) alan

1 0