Renaming during Machine Authentication
Hi all i have freeradius 2.1.10 setup on a SLES server. When the workstation boots it sends an mschapv2 request in the form host/machinename. What is the best way to convert this to machinename$ ? Sorry if this has been asked before Im stumped and cannot find the answer. Here is part of the log: Ready to process requests. rad_recv: Access-Request packet from host 10.152.0.100 port 32819, id=79, length=203 NAS-IP-Address = 10.152.0.100 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "host/TECH-11501" Calling-Station-Id = "00265EE9B2CA" Called-Station-Id = "000B86611894" MS-CHAP-Challenge = 0x0568442cb1608fce03cb2662dcf52694 MS-CHAP2-Response = 0x07007e63e9fa7fb503e4cfff2a2c00568698000000000000000057f0c5ece05913c5eeaf48096b25dcbd01f39d20a71404e1 Service-Type = Login-User Aruba-Essid-Name = "HPSD_RAD2" Aruba-Location-Id = "Tech 01" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "host/TECH-11501", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for host/TECH-11501 [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=TECH-11501$) [ldap] expand: o=hpsd_48 -> o=hpsd_48 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=hpsd_48, with filter (uid=TECH-11501$) [ldap] Added the eDirectory password xxxxx in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user host/TECH-11501 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: host/TECH-11501 [mschap] Told to do MS-CHAPv2 for host/TECH-11501 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/TECH-11501 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 13 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 13 Sending Access-Reject of id 79 to 10.152.0.100 port 32819 Waking up in 4.9 seconds. Cleaning up request 13 ID 79 with timestamp +926 Ready to process requests. Here is the log from same machine after logging in: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.152.0.100 port 32819, id=82, length=194 NAS-IP-Address = 10.152.0.100 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "mjones" Calling-Station-Id = "00265EE9B2CA" Called-Station-Id = "000B86611894" MS-CHAP-Challenge = 0xe744e26bd3741ff3a339f931e5d541cc MS-CHAP2-Response = 0x070001ee52a851770be78f667189c6bdec3b000000000000000050e99570745eb5a68f290dfe79879837d3997b7aa9b7b3cc Service-Type = Login-User Aruba-Essid-Name = "HPSD_RAD2" Aruba-Location-Id = "Tech 01" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "mjones", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for mjones [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=mjones) [ldap] expand: o=hpsd_48 -> o=hpsd_48 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=hpsd_48, with filter (uid=mjones) [ldap] Added the eDirectory password xxxx in check items as Cleartext-Password [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user mjones authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: mjones [mschap] Told to do MS-CHAPv2 for mjones with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 82 to 10.152.0.100 port 32819 MS-CHAP2-Success = 0x07533d41344438423931334434454244384437463634353436353933374137343737324136433138463139 MS-MPPE-Recv-Key = 0x263a0e89b5a8a78aa7e728c79ea3844f MS-MPPE-Send-Key = 0xfef0768ff8ca7d3a76d43ce8feb4189b MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 16. Going to the next request Waking up in 3.7 seconds. Cleaning up request 15 ID 81 with timestamp +1049 Waking up in 1.2 seconds. Cleaning up request 16 ID 82 with timestamp +1051 Ready to process requests. Thanks all Mark This communication is intended for the use of the recipient to which it is addressed and may contain confidential, personal and/or privileged information. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.
On 05/13/2011 11:03 PM, Mark Jones wrote:
Hi all i have freeradius 2.1.10 setup on a SLES server. When the workstation boots it sends an mschapv2 request in the form host/machinename. What is the best way to convert this to machinename$ ? Sorry if this has been asked before Im stumped and cannot find the answer.
Why do you need to "rename" it? If you want to do LDAP or SQL queries, you can use this in the query: %{mschap:User-Name} ...which expands: user -> user DOMAIN\user -> user host/name.domain.com -> name$
That sounds good...where exactly do I put that in the config files?
Phil Mayers <p.mayers@imperial.ac.uk> 5/13/2011 4:15 PM >>> On 05/13/2011 11:03 PM, Mark Jones wrote: Hi all i have freeradius 2.1.10 setup on a SLES server. When the workstation boots it sends an mschapv2 request in the form host/machinename. What is the best way to convert this to machinename$ ? Sorry if this has been asked before Im stumped and cannot find the answer.
Why do you need to "rename" it? If you want to do LDAP or SQL queries, you can use this in the query: %{mschap:User-Name} ...which expands: user -> user DOMAIN\user -> user host/name.domain.com -> name$ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This communication is intended for the use of the recipient to which it is addressed and may contain confidential, personal and/or privileged information. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.
On 05/13/2011 11:21 PM, Mark Jones wrote:
That sounds good...where exactly do I put that in the config files?
Well, since you didn't explain why you wanted to rename it (for what purpose) I can't say for sure. Usually, a lot of what goes on in FreeRADIUS is done with string expansions - for example you might have an SQL query defined in sql.conf: some_query = "select something from table where username='%{SQL-User-Name}" In this case, you're replace that with: some_query = "select something from table where username='%{mschap:User-Name}" But this is just an example. You need to be more specific about the problem(s) you're having if you want people to give you advice.
participants (2)
-
Mark Jones -
Phil Mayers