PEAP/MSCHAPv2 bounded to a particular MAC Address
[ Sorry, i'm not subscribed to that list, i will follow it on the web interface but if you can, put me on CC. Thanks. ] Platform: debian squeeze, freeradius 2.1.10+dfsg-2+squeeze1. Some year ago i've setup a (i think rather standard) freeradius config to handle PEAP/MSCHAPv2 authentication (also machine account one) for some portable system. I've also enabled some ''static'' account, for some guests, eg i can add in 'users' file something like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00" now i need to lock that ''static'' password to a particular MAC address. I've verified that my AP send 'Calling-Station-Id', and i've tried to (with some google help) something like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Calling-Station-Id == "c8b5b723ecd7" or like that: username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Huntgroup-Name == "ipm1" having in 'huntgroups' a line like: ipm1 Calling-Station-Id == c8b5b723ecd7 But nothing works. I've also see: http://wiki.freeradius.org/guide/Mac-Auth/46b5f10bc41dd0d5bf3f8dda41e87dd9c3... but seems to me unrelated, or at least probably could be useful the mac address normalization across different AP, but for now i'm in a testing phase. I'm doing the right thing? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
Marco Gaiarin wrote:
[ Sorry, i'm not subscribed to that list, i will follow it on the web interface but if you can, put me on CC. Thanks. ]
You should make it easy for people to help you. If you make it hard, you will probably be ignored.
Platform: debian squeeze, freeradius 2.1.10+dfsg-2+squeeze1.
Some year ago i've setup a (i think rather standard) freeradius config to handle PEAP/MSCHAPv2 authentication (also machine account one) for some portable system. I've also enabled some ''static'' account, for some guests, eg i can add in 'users' file something like that:
username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00"
Well, that's wrong. We've been recommending Cleartext-Password instead of User-Password in for almost 10 years now.
now i need to lock that ''static'' password to a particular MAC address. I've verified that my AP send 'Calling-Station-Id', and i've tried to (with some google help) something like that:
username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Calling-Station-Id == "c8b5b723ecd7"
or like that:
username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00", Huntgroup-Name == "ipm1"
having in 'huntgroups' a line like:
ipm1 Calling-Station-Id == c8b5b723ecd7
But nothing works.
See the FAQ for "it doesn't work". There's a reason it's in the FAQ (and README, "man" page, and daily on this list). If you're not going to bother following the documentation, then it's no surprise you can't get it to work. Alan DeKok.
Mandi! Alan DeKok In chel di` si favelave...
[ Sorry, i'm not subscribed to that list, i will follow it on the web interface but if you can, put me on CC. Thanks. ] You should make it easy for people to help you. If you make it hard, you will probably be ignored.
I think it was not a so big trouble. I've re-enabled email receiving in mailman. sorry.
username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00" Well, that's wrong.
...but it works. ;-)
We've been recommending Cleartext-Password instead of User-Password in for almost 10 years now.
Probably my freeradius setup was built exactly 10 years ago. I was not aware of that, or i've missed that. Sorry. I will change my config files and upgrade my internal wiki. Thanks.
See the FAQ for "it doesn't work".
If you meant: http://wiki.freeradius.org/guide/FAQ i've read the faq, but i've not found anything that i think is related to my trouble. As i've just stated, i've also found: http://wiki.freeradius.org/guide/Mac%20Auth but also on that i've not found information (apart calling-station-id normaization, that i've to implement surely...) that seems to me useful/related. Probably i'm not a so bright sysadmin, probably freeradius (generally: RADIUS) is not a so simple service to setup, but on the past i've go through the docs/wiki/... and fix some little trouble (the last, username normalization, because win7 client send username/hostname in CAPITAL letters, and winxp not), but really i've no clue on how to handle that task. So:
There's a reason it's in the FAQ (and README, "man" page, and daily on this list). If you're not going to bother following the documentation, then it's no surprise you can't get it to work.
i'm very happy to know that there's a reason because does not work (and so, i suppose a solution to make it work) but really i'm now able to even see them on «the FAQ (and README, "man" page, and daily on this list)». Sorry. Can you (or, some other list member) provide me at least some hint? I'm only asking that. Thanks to all. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
Hi, On Thu, Jan 30, 2014 at 10:54:10AM +0100, Marco Gaiarin wrote:
username1 User-Password := "password1", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Apr 29 2010 18:00:00" Well, that's wrong.
...but it works. ;-)
It does, but it won't in version 3. There have been warnings in version 2 for years to give people notice to change it.
There's a reason it's in the FAQ (and README, "man" page, and daily on this list). If you're not going to bother following the documentation, then it's no surprise you can't get it to work.
i'm very happy to know that there's a reason because does not work (and so, i suppose a solution to make it work) but really i'm now able to even see them on «the FAQ (and README, "man" page, and daily on this list)». Sorry.
Can you (or, some other list member) provide me at least some hint? I'm only asking that.
Daily reminder: - Run 'radiusd -X' - do the auth that you have problems with - post the entire debug output to the list. Without the debug output (including the packet), nobody can see what's happening. Don't add any extra -x type options; they obscure the useful stuff. Hope that helps :) Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
Mandi! Matthew Newton In chel di` si favelave... [about User-Password]
It does, but it won't in version 3. There have been warnings in version 2 for years to give people notice to change it.
Ahem, evidently i've missed that.
- Run 'radiusd -X' - do the auth that you have problems with - post the entire debug output to the list.
Ok. Only a litle note. My setup works, and so i'm triyng to make it NOT authenticate some client... eg, i've done: in users: ipm1 Cleartext-Password := "pass", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Jan 28 2017 19:00:00", Huntgroup-Name := "ipm1" in huntgroup: ipm1 Calling-Station-Id == "c8b5b723ecd6" And i've deliberatly insert wrongly the MAC addess, that is 'c8b5b723ecd7', as you can see looking at the log. So, the log report a successful authentication, but is not the intended behaviour. ;-) -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
Marco Gaiarin wrote:
It does, but it won't in version 3. There have been warnings in version 2 for years to give people notice to change it.
Ahem, evidently i've missed that.
The warning is printed out in debug mode...
Ok. Only a litle note. My setup works, and so i'm triyng to make it NOT authenticate some client... eg, i've done:
in users: ipm1 Cleartext-Password := "pass", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Jan 28 2017 19:00:00", Huntgroup-Name := "ipm1"
See "man users". You're not checking huntgroup membership above. You're setting it.
So, the log report a successful authentication, but is not the intended behaviour. ;-)
It's working as documented. Alan DeKok.
Mandi! Alan DeKok In chel di` si favelave...
ipm1 Cleartext-Password := "pass", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Jan 28 2017 19:00:00", Huntgroup-Name := "ipm1" See "man users". You're not checking huntgroup membership above. You're setting it.
AArrgghhh! But i'm sure i've done my test with '==' previously, probably was some ''desperation addings''... anyway, now i have in users: ipm1 Cleartext-Password := "pass", MS-CHAP-Use-NTLM-Auth := 0, Expiration := "Jan 28 2017 19:00:00", Huntgroup-Name == "ipm1" and i've tried adding in huntgroups: ipm1 Calling-Station-Id == "c8b5b723ecd6" (eg, the wrong MAC), and effectively the authentication failed, in a manner that seems to me that all work well. See 'freeradius-wrongmac.log' attached. But then i've put the right MAC: ipm1 Calling-Station-Id == "c8b5b723ecd7" but auth failed, in a different manner, see 'freeradius-correctmac.log'. Seems to me that the Calling-Station-Id does not pass through the inner tunnel, it is right? How can i fix it? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
Mandi! Phil Mayers In chel di` si favelave...
See "copy_request_to_tunnel" in eap.conf
Wonderful. I was also forced to add a 'preprocess' stanza in inner-tunnel, that missed. Now works as expected. Many thanks to all. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)lanostrafamiglia.it t +39-0434-842711 f +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)
participants (4)
-
Alan DeKok -
Marco Gaiarin -
Matthew Newton -
Phil Mayers