Re:Re: Accounting-Request packet shared secret fail (Alan DeKok)

8 Aug 2018

      Thank you Alan DeKok. I will go recheck my configs!

________________________________
From: Freeradius-Users <freeradius-users-bounces+kevin.virk=faithlife.com@lists.freeradius.org> on behalf of freeradius-users-request@lists.freeradius.org <freeradius-users-request@lists.freeradius.org>
Sent: Wednesday, August 8, 2018 3:00 AM
To: freeradius-users@lists.freeradius.org
Subject: Freeradius-Users Digest, Vol 160, Issue 10

Send Freeradius-Users mailing list submissions to
freeradius-users@lists.freeradius.org

To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users<http://lists.freeradius.org/mailman/listinfo/freeradius-users>
or, via email, send a message with subject or body 'help' to
freeradius-users-request@lists.freeradius.org

You can reach the person managing the list at
freeradius-users-owner@lists.freeradius.org

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."

Today's Topics:

1. Re: Dynamic vlan assignment (Deepak Sehrawat)
2. Re: Dynamic vlan assignment (Alan DeKok)
3. Re: ldap module for user and mac authentication (Alan DeKok)
4. Re: ldap module for user and mac authentication (Dave Macias)
5. Accounting-Request packet shared secret fail (Kevin Virk)
6. Re: Accounting-Request packet shared secret fail (Alan DeKok)

----------------------------------------------------------------------

Message: 1
Date: Tue, 7 Aug 2018 22:38:47 +0530
From: Deepak Sehrawat <d.sehrawat@gmail.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Dynamic vlan assignment
Message-ID: <A1C9AE51-ED3D-4394-9887-274F1A2F210B@gmail.com>
Content-Type: text/plain; charset=us-ascii

Can we configure it via MySQL as well?
...
On 07-Aug-2018, at 5:19 PM, Elias Pereira <empbilly@gmail.com> wrote:
You can configure it in the post-auth option of the sites-enable/default
configuration file.
E.g:
...
ldap
if (Ldap-Group == "CN=ADM,OU=GRUPOS,DC=mycompany,DC=intra") {
update reply {
&Tunnel-Type = VLAN
&Tunnel-Medium-Type = IEEE-802
&Tunnel-Private-Group-Id = "51"
}
}
elsif (Ldap-Group == "CN=ALUNOS,OU=GRUPOS,DC=mycompany,DC=intra") {
update reply {
&Tunnel-Type = VLAN
&Tunnel-Medium-Type = IEEE-802
&Tunnel-Private-Group-Id = "40"
elseif ...
...
On Tue, Aug 7, 2018 at 8:05 AM aseem kaushal <aseemkaushal91@gmail.com>
wrote:
...
Need to configure freeradius for dynamic vlan assignment. What could be the
various methods for the above.
Thanks in advance.
Regards
-Aseem Kaushal
-
List info/subscribe/unsubscribe? See
http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>
--
Elias Pereira
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>
------------------------------

Message: 2
Date: Tue, 7 Aug 2018 14:16:32 -0400
From: Alan DeKok <aland@deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Dynamic vlan assignment
Message-ID: <EC8BA115-117B-408F-ADB3-C81489452CA3@deployingradius.com>
Content-Type: text/plain; charset=us-ascii

On Aug 7, 2018, at 1:08 PM, Deepak Sehrawat <d.sehrawat@gmail.com> wrote:
...
Can we configure it via MySQL as well?
The documentation has lots of information on how the SQL module works.

Read it. Ask questions if you don't understand.

Alan DeKok.

------------------------------

Message: 3
Date: Tue, 7 Aug 2018 15:08:48 -0400
From: Alan DeKok <aland@deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: ldap module for user and mac authentication
Message-ID: <76519810-BEB1-40AC-A1E2-A3E6FA28B6E6@deployingradius.com>
Content-Type: text/plain; charset=us-ascii

On Aug 7, 2018, at 11:50 AM, Dave Macias <davama@gmail.com> wrote:
...
On the SLAVE, I am able to use the ldap module to auth a mac address
On the MASTER, i am also able to auth a mac but by doing something like the
links below:
http://lists.freeradius.org/pipermail/freeradius-users/2015-April/076948.html<http://lists.freeradius.org/pipermail/freeradius-users/2015-April/076948.html>
http://lists.freeradius.org/pipermail/freeradius-users/2018-August/092319.html<http://lists.freeradius.org/pipermail/freeradius-users/2018-August/092319.html>
Is there a way on the MASTER to use the ldap module to also auth macs?
You can do any kind of LDAP query in FreeRADIUS. Why not just do the same %{ldap:...} checks there?

Alan DeKok.

------------------------------

Message: 4
Date: Tue, 7 Aug 2018 16:04:10 -0400
From: Dave Macias <davama@gmail.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: ldap module for user and mac authentication
Message-ID:
<CA+nFYV-f2c+ZB4k7WxPf_tznrc3hdRb_WB+DCTAzqvT7Y6D_oA@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"

Thank you for the reply Alan!
...
You can do any kind of LDAP query in FreeRADIUS. Why not just do the
same %{ldap:...} checks there?
Yes, I had thought of something to the effect of (suggestions welcomed) :

* if
(!"%{ldap:ldap://master1/ou=%{client:shortname},ou=macs,dc=myorg,dc=net?cn?sub?(*
*&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}") {*
* if
(!"%{ldap:ldap://master2/ou=%{client:shortname},ou=macs,dc=myorg,dc=net?c*
*n?sub?(&(objectClass=ieee802Device)(macAddress=%{Calling-Station-Id}))}")
{*
* reject*
* }*
* }*
* update {*
* control:Auth-Type := Accept*
* }*

But this does not account for the scenario of openldap being dead.
The 1st "if" statement will be always be FALSE and never attempt the next
"if" statement and therefore 'Accept'

We currently use do_not_respond in conjunction with the ldap module so that
radius never response if openldap it were down
http://lists.freeradius.org/pipermail/freeradius-users/2018-May/091477.html<http://lists.freeradius.org/pipermail/freeradius-users/2018-May/091477.html>

The nice feature of the module is that you can configure multiple ldap
servers. If one fails then it will automatically try the next and so forth.

*mods-enabled/ldap*
*ldap {*
*server = host1 # <- this one is dead*
*server = host2 # <- this one is alive so use this one in the query*
*...*
*}*

Unless there is a way to query the "live" ldap server which the ldap module
found %{ldap:ldap://%{live.ldap.server}/...} , if that makes sense

Thanks!

------------------------------

Message: 5
Date: Tue, 7 Aug 2018 22:04:17 +0000
From: Kevin Virk <Kevin.Virk@faithlife.com>
To: "freeradius-users@lists.freeradius.org"
<freeradius-users@lists.freeradius.org>
Subject: Accounting-Request packet shared secret fail
Message-ID: <1533679457716.32160@faithlife.com>
Content-Type: text/plain; charset=WINDOWS-1252

I am having an issue with configuring my cisco switch to authenticate with freeradius. My secret is the same on both sides but I keep getting error that the shared secret is not correct. I did a tcpdump of the traffic and then opened in wireshark to see. The password is coming through encrypted as I would suspect. Could this encrypted password be the reason that I am not able to authenticate. Side note: Using wpa supplicant and eapol_test I was able to get a successful test. Only non success is this cisco switch.

ready to process requests.
rad_recv: Accounting-Request packet from host 172.17.17.227 port 49181, id=0, length=97
Received Accounting-Request packet from client 172.17.17.227 with invalid Request Authenticator! (Shared secret is incorrect.) Dropping packet without response

------------------------------

Message: 6
Date: Tue, 7 Aug 2018 18:24:30 -0400
From: Alan DeKok <aland@deployingradius.com>
To: FreeRadius users mailing list
<freeradius-users@lists.freeradius.org>
Subject: Re: Accounting-Request packet shared secret fail
Message-ID: <D7FE269D-82BB-4365-A2A5-170524AF30E2@deployingradius.com>
Content-Type: text/plain; charset=us-ascii

On Aug 7, 2018, at 6:04 PM, Kevin Virk <Kevin.Virk@faithlife.com> wrote:
...
I am having an issue with configuring my cisco switch to authenticate with freeradius. My secret is the same on both sides but I keep getting error that the shared secret is not correct.
Then the shared secret isn't correct.
...
I did a tcpdump of the traffic and then opened in wireshark to see. The password is coming through encrypted as I would suspect. Could this encrypted password be the reason that I am not able to authenticate.
The password is encrypted with the shared secret. If the shared secret is wrong, then FreeRADIUS can't decrypt the password.
...
Side note: Using wpa supplicant and eapol_test I was able to get a successful test. Only non success is this cisco switch.
Likely because they're using different IP addresses.

Are you editing the "client" configuration for the Cisco switch?

Have you tried setting the shared secret to something like "hello" ?

TBH, your choices here are:

a) the Cisco firmware works for everyone else, but not for you

b) FreeRADIUS works for everyone else, but not for you

c) you're entering the wrong shared secret, or maybe the correct shared secret, but in the wrong place.

Alan DeKok.

------------------------------

Subject: Digest Footer

-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html<http://www.freeradius.org/list/users.html>

------------------------------

End of Freeradius-Users Digest, Vol 160, Issue 10
*************************************************

Kevin Virk

tags

participants (1)