- Freeradius-Users - lists.freeradius.org

Re: Expired Active Directory Passwords & Wireless Authentication
by Jason Agress 10 Oct '12

10 Oct '12

Will that allow successful RADIUS authentication - and, therefore wireless access - before the password change is initiated? Because our clients are Macs that won't prompt for password change until after they are connected to the wireless and authenticating against AD. Alan DeKok Wrote: Jason Agress wrote: > I've read lots about this problem with FreeRADIUS and have seen some > implied solutions, but nothing concrete. So here's my question: With > FreeRADIUS, is there a way to allow successful RADIUS authentication > with an expired password? This way the AD login process can commence and > the user can be prompted to change his/her password wirelessly. Use the git "master" branch. It supports changing passwords via PEAP. See raddb/mods-available/mschap Alan DeKok.

3 3

Re: Expired Active Directory Passwords & Wireless Authentication
by Alan Buxey 10 Oct '12

10 Oct '12

No. You cannot do a successful auth against an incorrect password as you haven't got agreement from both ends and therefore no keying material required for WPA-RADIUS...therefore no key for the wireless association. Password change can only be performed INSIDE the PEAP negotiation. As has already been said, latest version already supports this...some clients do to. alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2

rlm_exec
by Thomas Raabo - Zitcom A/S 10 Oct '12

10 Oct '12

Could you implement (minisqueeze) [~/work/smsotpd] ./pap_challenge_request.pl Enter username: directory\Administrator Enter password: server response type = Access-Challenge (11) Enter otp: 97350 server response type = Access-Accept (2) This sort of thing with rlm_exec? Med venlig hilsen | Best regards Thomas Raabo Senior Network Engineer CCIE #33466 _____________________________________________ tr(a)zitcom.dk | Direkte: +45 69 10 60 18 | Tlf.: +45 70 23 55 66

1 0

Re-transmits arriving via a different proxy / EAP duplicate detection
by Phil Mayers 10 Oct '12

10 Oct '12

All, Bit of an odd one here. Not sure where best to bring it up... if anyone has a more suitable discussion forum, please point me that way! As I iterate through our logging config, I'm gaining increasing visibility of all kinds of peculiar stuff. This one I spotted today - we are seeing remote RADIUS servers (eduroam visited sites) sending retransmits via different intermediate proxies. This goes wrong in two ways. First, the FreeRADIUS duplicate detect / retransmit logic doesn't apply because the source IP, shared secret, Proxy-State and Message-Authenticator are all different, even though all other attributes are identical. This is correct behaviour AFAICT from the RFCs. Second, because the retransmits aren't eaten by the duplicate detection, they arrive as real packets in the server core, but are rejected because the "State" attribute is no longer valid - this is because FR mutates "State" on every round-trip, mixing in the EAP type/id/exchange number. This latter (being reprocessed) is a problem two ways. The first is that these retransmits always generate a "reject" due to invalid "State". If the original "accept" was dropped (thereby causing the remote server to move to another intermediate proxy, and trigger this issue), we're effectively cancelling that "accept" and issuing a "reject". We're also generating a lot of logging and noise, though that's an internal problem. Does anyone have any thoughts on the matter? Absent RADIUS-over-TCP, this seems like a really tricky one... Cheers, Phil

3 3

Encode multiple sub-attributes in single vsa?
by Far.Runner 10 Oct '12

10 Oct '12

Hi, RFC2865 states "Multiple subattributes MAY be encoded within a single Vendor-Specific attribute, although they do not have to be." in section 5.26. Does Freeradius support this? if yes, how to enable it? F.R

5 9

Expired Active Directory Passwords & Wireless Authentication
by Jason Agress 10 Oct '12

10 Oct '12

Hi all, We're currently using Microsoft IAS for RADIUS on our Cisco managed wireless network. We do wireless logon on our clients, which requires the user to first authenticate to RADIUS to initiate the wireless connection, then authenticate against Active Directory to complete the login process. The problem we run into is when a user's password expires and RADIUS authentication is unsuccessful; since the wireless connection cannot be made, AD cannot be contacted to authenticate the user and, ideally, prompt to change the password. I've read lots about this problem with FreeRADIUS and have seen some implied solutions, but nothing concrete. So here's my question: With FreeRADIUS, is there a way to allow successful RADIUS authentication with an expired password? This way the AD login process can commence and the user can be prompted to change his/her password wirelessly. Thanks in advance!

3 2

store encypted passwords
by jon jon 10 Oct '12

10 Oct '12

Hello, I have set up FreeRADIUS Version 2.1.10 on an Ubuntu server 12.04, Mysql Server version: 5.5.24. Everything is up and running but the users passwords are stored in plain text in raddacct. I tried changing the attribute to Crypt-Password but it doesn't change anything. Do I need to make a change to a config file also? Not sure what type of encryption would be best one that works MD5? Thanks,

4 7

Re: Auth All and Logging
by Alan Buxey 10 Oct '12

10 Oct '12

Possible....but unlikely to get what you want if you are using EAP methods and wireless alan

1 0

Auth All and Logging
by Metcalf, David 10 Oct '12

10 Oct '12

Can freeradius be configured to authenticate all requests and only log the authentication attempts, including username and password in plain text.

2 1

Upgrade to 2.2.0
by Morris, Andi 10 Oct '12

10 Oct '12

I've just updated my freeradius servers from 2.1.7 to 2.1.12 via yum update and it worked like a charm, I'd always been a little nervous to do this until now. This has given me the confidence to look into upgrading the servers from the source files to get up to 2.2.0. Reading the README and the INSTALL file from within the tar.gz file I can see that I need to run ./configure make make install Firstly running ./configure failed because my server (CentOS 5.5) didn't have a C compiler installed. I installed GCC via yum, and on we go. Now the configure.log tells me I don't have make installed. I installed that via yum, and on we go. Now configure seems to be going along like the clappers, quicker than I can read the output to look for errors. I then ran make, which also seemed to go along just fine. Then make install, and likewise, nothing obviously wrong. However when I ran the service in debug mode I can see that it hasn't been touched by the installer and is still running version 2.1.12, and working. Looking back through and grepping config.log for 'error' I see the following: conftest.c:8:28: error: ac_nonexistent.h: No such file or directory conftest.c:8:28: error: ac_nonexistent.h: No such file or directory conftest.c:16: error: size of array 'off_t_is_large' is negative conftest.c:26: error: 'not' undeclared (first use in this function) conftest.c:26: error: (Each undeclared identifier is reported only once conftest.c:26: error: for each function it appears in.) conftest.c:26: error: expected ';' before 'big' | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. conftest.c:66:22: error: resource.h: No such file or directory conftest.c:33:22: error: resource.h: No such file or directory conftest.c:83:21: error: winsock.h: No such file or directory conftest.c:50:21: error: winsock.h: No such file or directory conftest.c:85:26: error: sys/security.h: No such file or directory conftest.c:52:26: error: sys/security.h: No such file or directory conftest.c:90:18: error: prot.h: No such file or directory conftest.c:57:18: error: prot.h: No such file or directory conftest.c:94:17: error: sia.h: No such file or directory conftest.c:61:17: error: sia.h: No such file or directory conftest.c:94:18: error: siad.h: No such file or directory conftest.c:61:18: error: siad.h: No such file or directory | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. conftest.c:102: error: void value not ignored as it ought to be conftest.c:109: error: 'struct utmpx' has no member named 'ut_xtime' | /* Override any GCC internal prototype to avoid an error. | /* Override any GCC internal prototype to avoid an error. conftest.c:114: error: too many arguments to function 'ctime_r' I guess there's something here to show what's wrong? Is there any log created by make and make install? Do I need to specify an installation directory or does the code know where my existing installation is? Cheers in advance for any help. Andi ________________________________ >From 1st November 2011 UWIC changed its title to Cardiff Metropolitan University. From the 6th December 2011, as part of this change, all email addresses which included @uwic.ac.uk have changed to @cardiffmet.ac.uk. All emails sent from Cardiff Metropolitan University will now be sent from the new @cardiffmet.ac.uk address. Please could you ensure that all of your contact records and databases are updated to reflect this change. Further information can be found on the website here.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx> Ar Dachwedd y 1af 2011 newidiodd UWIC ei henw i Brifysgol Fetropolitan Caerdydd. O Ragfyr 6ed, fel rhan o'r newid yma, bydd pob cyfeiriad e-bost sy'n cynnwys @uwic.ac.uk yn newid i @cardiffmet.ac.uk. Bydd yr holl ebyst a ddanfonir o Brifysgol Fetropolitan Caerdydd yn cael eu danfon o'r cyfeiriad @cardiffmet.ac.uk newydd. Gwnewch yn siwr eich bod yn diweddaru eich cofnodion cyswllt a'ch cronfeydd data i adlewyrchu hyn. Gellir cael rhagor o wybodaeth ar y wefan yma.<http://www3.uwic.ac.uk/English/News/Pages/UWIC-Name-Change.aspx>

7 11