- Freeradius-Users - lists.freeradius.org

v2.2
by David Peterson 09 Oct '12

09 Oct '12

I seem to be losing it today. How do I check out the 2.2 version from git? David

2 2

Outpairs not working on external script when user is located in MYSQL
by Thomas Raabo - Zitcom A/S 09 Oct '12

09 Oct '12

Need som help getting my external script to work Here is my External module exec MOTP { wait = yes program = "/etc/raddb/otpverify.sh %{User-Name} %{User-Password} %{reply:Secret} %{reply:Pin} %{reply:Offset}" input_pairs = request output_pairs = reply } >From radcheck (211, 'test', 'Pin', ':=', '0201'), (212, 'test', 'Secret', ':=', '43ab97e05b3a11cb'), (213, 'test', 'Offset', ':=', '0'), (214, 'test', 'Auth-Type', ':=', 'External'); Output from debug. rad_recv: Access-Request packet from host 172.16.24.4 port 38043, id=190, length=74 User-Name = "test" User-Password = "ce3e3e3ebdbf" NAS-IP-Address = 172.16.24.4 NAS-Port = 1 Message-Authenticator = 0x3492fb805715bd7da5ec0371282f71b5 Mon Oct 8 23:52:57 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group authorize {...} Mon Oct 8 23:52:57 2012 : Info: ++[preprocess] returns ok Mon Oct 8 23:52:57 2012 : Info: ++[chap] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[mschap] returns noop Mon Oct 8 23:52:57 2012 : Info: [suffix] No '@' in User-Name = "test", looking up realm NULL Mon Oct 8 23:52:57 2012 : Info: [suffix] No such realm "NULL" Mon Oct 8 23:52:57 2012 : Info: ++[suffix] returns noop Mon Oct 8 23:52:57 2012 : Info: [eap] No EAP-Message, not doing EAP Mon Oct 8 23:52:57 2012 : Info: ++[eap] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[unix] returns notfound Mon Oct 8 23:52:57 2012 : Info: ++[files] returns noop Mon Oct 8 23:52:57 2012 : Info: [sql] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [sql] sql_set_user escaped user --> 'test' Mon Oct 8 23:52:57 2012 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] User found in radcheck table Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT groupname FROM usergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM usergroup WHERE username = 'test' ORDER BY priority Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT groupname FROM usergroup WHERE username = 'test' ORDER BY priority Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Info: [sql] User found in group test Mon Oct 8 23:52:57 2012 : Info: [sql] expand: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{Sql-Group}' ORDER BY id -> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql_mysql: query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'test' ORDER BY id Mon Oct 8 23:52:57 2012 : Debug: rlm_sql (sql): Released sql socket id: 4 Mon Oct 8 23:52:57 2012 : Info: ++[sql] returns ok Mon Oct 8 23:52:57 2012 : Info: ++[expiration] returns noop Mon Oct 8 23:52:57 2012 : Info: ++[logintime] returns noop Mon Oct 8 23:52:57 2012 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Mon Oct 8 23:52:57 2012 : Info: ++[pap] returns noop Mon Oct 8 23:52:57 2012 : Info: Found Auth-Type = External Mon Oct 8 23:52:57 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group External {...} Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Password} -> ce3e3e3ebdbf Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Secret} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Pin} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Offset} -> Mon Oct 8 23:52:57 2012 : Debug: Exec-Program output: FAIL Mon Oct 8 23:52:57 2012 : Debug: Exec-Program-Wait: plaintext: FAIL Mon Oct 8 23:52:57 2012 : Debug: Exec-Program: returned: 13 Mon Oct 8 23:52:57 2012 : Info: ++[MOTP] returns fail Mon Oct 8 23:52:57 2012 : Info: Failed to authenticate the user. Mon Oct 8 23:52:57 2012 : Info: Using Post-Auth-Type Reject Mon Oct 8 23:52:57 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/default Mon Oct 8 23:52:57 2012 : Info: +- entering group REJECT {...} Mon Oct 8 23:52:57 2012 : Info: [attr_filter.access_reject] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Oct 8 23:52:57 2012 : Info: ++[attr_filter.access_reject] returns updated Mon Oct 8 23:52:57 2012 : Info: Delaying reject of request 0 for 1 seconds Mon Oct 8 23:52:57 2012 : Debug: Going to the next request Mon Oct 8 23:52:57 2012 : Debug: Waking up in 0.9 seconds. Mon Oct 8 23:52:58 2012 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 190 to 172.16.24.4 port 38043 Mon Oct 8 23:52:58 2012 : Debug: Waking up in 4.9 seconds. As you can see it dosent seem to get the reply vars Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Name} -> test Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{User-Password} -> ce3e3e3ebdbf Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Secret} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Pin} -> Mon Oct 8 23:52:57 2012 : Info: [MOTP] expand: %{reply:Offset} -> In /usr/share/freeradius/dictionary I have $INCLUDE dictionary.motp And from my Dictionary.motp # ATTRIBUTE Secret 960 string ATTRIBUTE Pin 961 string ATTRIBUTE Offset 962 string All my configuration is based on http://nicoblog.goralski.fr/tag/Radius Med venlig hilsen | Best regards Thomas Raabo Senior Network Engineer CCIE #33466 _____________________________________________ tr(a)zitcom.dk | Direkte: +45 69 10 60 18 | Tlf.: +45 70 23 55 66

3 3

freeRadius against Active Directory
by Martin.Heinzmann＠belden.com 09 Oct '12

09 Oct '12

Hi, I am in my internship and have the task to authenticate devices over freeRadius against Active Directory (Windows Server 2008 R2). So far I managed to authenticate succesfully with freeRadius against Active Directory after I was finished with the tutorial from Deploying RADIUS. Thanks for that :-) Now I am having the problem that the devices I want to authenticate are requesting the Service-Type(Attribute 6). Do you have any idea how to set the Service-Type in Active Directory for each user? Is that even possible or do I have to configure the users file for each user and his corresponding Service-Type? Thanks in advance, Regards Martin Heinzmann Intern R&D Embedded Software DISCLAIMER: Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.

4 5

Re: help - simultaneous accounting
by 劉君羿 09 Oct '12

09 Oct '12

I am using *Chillispot* on my NAS. But it doesn't seem to support CoA. Can you suggest other AP controllers? By the way, I though concurrent accounting was a feature that should be supported. I wonder why it's not supported by the major AAA protocols.

3 3

IP Grouping
by George Innocent 08 Oct '12

08 Oct '12

I have a set of IP for my NAS and wish to group this together so i don't have to create a set of new ones on the clients.conf file every time a new NAS is created. What's the best way to do this without causing a crash -- Regards: George Innocent.

3 4

Execution of rlm code when remote server is not responding.
by Arka Sharma 08 Oct '12

08 Oct '12

Hi, I have a remote PPS server where I am proxying radius requests coming from the NAS. I have a requirement like when that remote PPS goes down(which I am simulating by setting a wrong ip in proxy.conf realm configuration) then I have to perform a certain task in rlm code.But my observation is when I am setting a dummy ip for PPS, the radius server running on my machine is marking that remote server as zombie after 3 retries,now I want in this case that my rlm code to execute and handle the scenario when remote server is down.Any help will be highly appreciated.Also I may have used some naive terminology being a newbie apologizing for that. Regards, Arka

3 7

help - simultaneous accounting
by 劉君羿 06 Oct '12

06 Oct '12

I want to allow simultaneous use of accounts. However, *RFC 2866 *says that the* Acct-Session-Time* > can only be present in Accounting-Request records where the > Acct-Status-Type is set to Stop [Page 17] Does this mean that RADIUS protocol can not manage simultaneous use of an account? For example, an account with *Session-Timeout *2 hours is shared by two users. User1 login first and use the account for 1 hour, user2 then login (user1 still accessing the account), then user2 turns out two have *2 hours*, which is wrong and is because that user1 not yet send Acct-Session-Time to the server. If RADIUS is not suit for the scenario above, should I try other protocols such as DIAMETER and TACACS+? Thanks.

3 2

Identifying Virtual-Server from Inner-Tunnel
by Jordan Dohms 05 Oct '12

05 Oct '12

I’m still fairly new at FreeRADIUS. Running 2.1.10 (we are planning our upgrade shortly). Kind of a two pronged question here...I'm encountering a particular issue, but also would like to hear if my broad approach is suitable. I am attempting to do the following: - Use one FreeRADIUS server to authenticate for two different 802.1X networks (EAP-PEAP / MSCHAP). - Both will use the mschap module to interface with Microsoft Active Directory. - The first 802.1X network will authenticate against DOMAIN1, the second against both DOMAIN1 and DOMAIN2. The first network should reject authentication attempts from DOMAIN2. - All usernames are specified with a full realm / fqdn. - The RADIUS clients (wireless access points) will all be the same for the two networks. What (I think) is the solution: - In order for FreeRADIUS to distinguish what set of users (DOMAIN1 or DOMAIN1/2) to authenticate against, I have setup two virtual servers listening on different ports and (obviously) different names. (working) - The clients connect to FreeRADIUS over a different port depending on the network they're attempting to connect to. (working) - Setup realms for both DOMAIN1 and DOMAIN2 to have them both authenticate locally. (working) - Setup two mschap modules to call ntlm_auth command with the proper DOMAIN string. (working) - Depending on the realm provided, call a different mschap module from the inner-tunnel. (working) - Depending on the virtual server the request was received through, call a different mschap module from the inner-tunnel or reject the request. (not working) If there's a better/cleaner/simpler way to do this, I'm all ears. My issue: Since its EAP-PEAP, the request passes through the outer and inner-tunnel virtual servers. In my inner-tunnel, I'm doing an IF on the Realm. That seems to be evaluating properly if I look at the debug logs. If I do an IF on Virtual-Server it comes back with 'inner-tunnel'. If I do outer.request:Virtual-Server it oddly also comes back with 'inner-tunnel'. How do I see the actual virtual-server? Should I need to set a separate variable in the outer-server and read it below? Here is my attempted code in "server inner-tunnel" authenticate { Auth-Type MS-CHAP { if ("%{outer.request:Virtual-Server}" == "secure") { mschap_domain1 } else { if ("%{Realm}" == "domain1.fqdn.org") { mschap_domain1 } elsif ("%{Realm}" == "domain2.fqdn.org") { mschap_domain2 } } } eap } In my debug logs: Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +- entering group MS-CHAP {...} Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++? if ("%{outer.request:Virtual-Server}" == "secure") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{outer.request:Virtual-Server} -> inner-tunnel Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{outer.request:Virtual-Server}" == "secure") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++? if ("%{outer.request:Virtual-Server}" == "secure") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++- entering else else {...} Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" == "domain1.fqdn.org") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{Realm} -> domain2.fqdn.org Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}" == "domain1.fqdn.org") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" == "domain1.fqdn.org") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" == "domain2.fqdn.org") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{Realm} -> domain2.fqdn.org Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}" == "domain2.fqdn.org") -> TRUE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" == "domain2.fqdn.org") -> TRUE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++- entering elsif ("%{Realm}" == "domain2.fqdn.org") {...} Any suggestions for what I'm doing wrong or maybe a better way to tackle it? Thanks, Jordan Dohms

3 3

RedHat FreeRadius reload or restart?
by Mike Diggins 05 Oct '12

05 Oct '12

I've been running the RedHat "version" of FreeRADIUS Version 2.1.3 for a few years. Each morning I update the users authorization file and run "service radius reload" for the changes to take affect. I recently patched the system, which updated FreeRADIUS to version 2.1.12. I find now that after reloading, using the same script, it appears to reload successfully but my authentications (through ntlm_auth to an MS AD) begin failing. If I instead use "service radiusd restart", it's fine. Did anything change between versions that would explain this? Oct 5 07:30:02 radserv radiusd[3825]: Login OK: [xxxx] (from client wlc-7 port 0 via TLS tunnel) Oct 5 07:30:02 radserv radiusd[3825]: Login OK: [xxxxx] (from client wlc-7 port 13 cli 6c-c2-6b-98-06-52) Oct 5 07:30:02 radserv radiusd[15741]: Loaded virtual server <default> Oct 5 07:30:02 radserv radiusd[15741]: Loaded virtual server inner-tunnel Oct 5 07:30:02 radserv radiusd[15741]: ... adding new socket proxy address * port 0 Oct 5 07:30:02 radserv radiusd[3825]: Received HUP signal. Oct 5 07:30:02 radserv radiusd[3825]: HUP - Re-reading configuration files Oct 5 07:30:02 radserv radiusd[3825]: HUP - loading modules Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "radutmp" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "suffix" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "attr_filter.access_reject" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "attr_filter.accounting_response" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "detail" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "mschap" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "pap" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "files" Oct 5 07:30:02 radserv radiusd[3825]: Loaded virtual server <default> Oct 5 07:30:02 radserv radiusd[3825]: Loaded virtual server inner-tunnel Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-6 port 0 via TLS tunnel) Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect: [xxxxx] (from client wlc-6 port 13 cli 00-26-08-e6-13-90) Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-7 port 0 via TLS tunnel) Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect: [xxxx] (from client wlc-7 port 13 cli 7c-11-be-c3-20-72) Oct 5 07:30:05 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-6 port 0 via TLS tunnel) Oct 5 07:30:05 radserv radiusd[3825]: Login incorrect: [xxxxx] (from client wlc-6 port 13 cli 48-60-bc-f4-1d-31) Oct 5 07:30:07 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-7 port 0 via TLS tunnel) Oct 5 07:30:07 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxxx] (from client wlc-6 port 0 via TLS tunnel) Oct 5 07:30:07 radserv radiusd[3825]: Login incorrect: [xxxx] (from client wlc-6 port 13 cli 48-60-bc-f4-1d-31) -Mike

3 4

Indeterministic EAP error
by Matthias Nagel 05 Oct '12

05 Oct '12

Hello, sometimes I get the error WARNING: !! EAP session for state 0xABCDEFGHIJKLMNOP did not finish! in my log files / debug output. Before anybody says have a look at http://deployingradius.com/documents/configuration/eap-problems.html that will help, please read on, because I already have done that and I believe the problem is a little bit more tricky. I support PEAP+MsCHAPv2 only and 90% of time it just works. I am pretty sure that the certificate is all right. If anybody wants to check it, one can find it here https://freeradius:eaperror@www.stud.uni-karlsruhe.de/~uzbii/hekauth-certs.… The certificate file includes all intermediate issuers and the trusted CA. The CA is Germany's biggest telco, so most OSes ship with that by default. The certificate also includes the X509v3 Extended Key Usage TLS Web Client and Authentication and TLS Web Server Authentication in order to satisfy Windows clients. My radius config looks like that: certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/hekauth-key.pem certificate_file = ${certdir}/hekauth-certs.pem # CA_file = CA_path = ${certdir}/empty-by-purpose/ If a new client connects for the very first time, most OSes automatically detect the correct authentication scheme, ask for username and password, present the certificate for confirmation and it works out of the box. (No errors on neither client nor server side.) Randomly, I get this error message although the respective client normally works. In that case the client just restarts the authentication and then succeeds on the second trial. Hence the only difference the user might notice is an authentication that might take some milliseconds longer. During the last four days there have been 1278 such errors, 2519 session, 9651 successful authentication attempts, i.e. each session triggered approximately 3.8 re-authentications, 93 different clients and at least 6 different OSes. I cannot find any pattern, so I do not believe it to be a client side issue. Of course, one can argue to ignore the warning as it works most of the time, but I do not like indeterministically behaving IT systems, hence it preys on my mind. Has anybody an idea what the reason might be? If anybody wants to see a full debug output or a tcpdump, I can provide you with plenty of that. But I could not find anything. Yours, Matthias ---------------------------------------------------------------------- Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 e-Mail: matthias.h.nagel(a)gmail.com ICQ: 499797758 Skype: nagmat84

5 8