Plain Mac-Auth - server accepts but client does not connect
Hello everyone, I am following the instructions on the wiki (http://wiki.freeradius.org/guide/Mac%20Auth) to configure our freeradius server for "Plain Mac-Auth" and the server is not responding how I expect. I have the server configured and an "authorized_macs" file created that contains the mac address of an android phone that I would like accepted onto the network. When I attempt to join the network from the phone, I am prompted for 802.1X credentials. If I type no credentials, the server won't handle the request at all. If I type something into one or both of the credentials fields, the server handles the request and displays "Auth-Type = Accept, accepting the user" and "Sending Access-Accept of id 7 to 216.54.247.198 port 58063", but my phone does not join the network. It simply times out. The Ubiquiti UniFi AP is in rental office space with a managed network, and the freeradius server is in the ec2 cloud. Does anyone have any ideas how to troubleshoot this? I don't think the UDP return traffic is being blocked, because the same thing happens if I move the AP to my house network with a COTS router. Thanks, Mike [root@freeradius2 ~]# radiusd -X radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Aug 14 2015 at 16:36:35 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 0.0.0.0/0 { require_message_authenticator = no secret = "<scrubbed>" shortname = "XMDAP" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ▒▒▒? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Loading virtual module rewrite_calling_station_id Module: Linked to module rlm_always Module: Instantiating module "noop" from file /etc/raddb/modules/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Linked to module rlm_files Module: Instantiating module "authorized_macs" from file /etc/raddb/modules/files files authorized_macs { usersfile = "/etc/raddb/authorized_macs" compat = "no" key = "%{Calling-Station-ID}" } reading pairlist file /etc/raddb/authorized_macs Module: Instantiating module "reject" from file /etc/raddb/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 38386 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 216.54.247.198 port 10027, id=4, length=163 User-Name = "a" NAS-IP-Address = 192.168.0.137 NAS-Identifier = "0418d6cee172" NAS-Port = 0 Called-Station-Id = "0A-18-D6-CF-E1-72:xmd-authorized" Calling-Station-Id = "00-02-71-D3-44-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02cd00060161 Message-Authenticator = 0xcb2f355e41f81c5808fb38890f50e2e9 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++policy rewrite_calling_station_id { +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { ++++update request { expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-02-71-D3-44-2B expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-02-71-d3-44-2b ++++} # update request = noop +++} # if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) = noop +++ ... skipping else for request 0: Preceding "if" was taken ++} # policy rewrite_calling_station_id = noop [authorized_macs] expand: %{Calling-Station-ID} -> 00-02-71-d3-44-2b [authorized_macs] users: Matched entry 00-02-71-d3-44-2b at line 1 [authorized_macs] expand: Mike's Android phone with MAC %{Calling-Station-Id} authorized for network access -> Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access ++[authorized_macs] = ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++else else { +++update control { +++} # update control = noop ++} # else else = noop +} # group authorize = ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 4 to 216.54.247.198 port 10027 Reply-Message = "Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 4 with timestamp +207 Ready to process requests. ------------------------------------------------- Join the XstremeMD email list.<http://visitor.r20.constantcontact.com/d.jsp?llr=strsmmvab&p=oi&m=1122476050034&sit=umss8bbkb&f=6f63beb1-7717-4ecb-b0cf-5b79859802f9> ------------------------------------------------- XstremeMD EMAIL NOTICE - This transmission may be strictly confidential. If you are not the intended recipient of this message, you may not disclose, print, copy, or disseminate this information. If you have received this in error, please reply and notify the sender (only) and delete the message. Unauthorized interception of this e-mail is a violation of federal criminal law. This communication does not reflect an intention by the sender or the sender's principal to conduct a transaction or make any agreement by electronic means. Nothing contained in this message or in any attachment shall satisfy the requirements for a writing, and nothing contained herein shall constitute a contract or electronic signature under the Electronic Signatures in Global and National Commerce Act, any version of the Uniform Electronic Transactions Act, or any other statute governing electronic transactions.
On Mon, Jan 04, 2016 at 10:38:24PM +0000, Michael Linder wrote:
When I attempt to join the network from the phone, I am prompted for 802.1X credentials. If I type no credentials, the server won't handle the request at all. If I type something into one or both of the credentials fields, the server handles the request and displays "Auth-Type = Accept, accepting the user" and "Sending Access-Accept of id 7 to 216.54.247.198 port 58063", but my phone does not join the network.
You can't do plain MAC auth with wireless - you must use EAP. You could check mac address as well (but really, these days it's probably not worth it), but not on its own. If you want to authenticate the device then EAP-TLS is the way to go. But at least it won't break when the devices decide to change their MAC addresses, as so many are starting to do randomly these days. Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 01/04/2016 05:56 PM, Matthew Newton wrote:
On Mon, Jan 04, 2016 at 10:38:24PM +0000, Michael Linder wrote:
When I attempt to join the network from the phone, I am prompted for 802.1X credentials. If I type no credentials, the server won't handle the request at all. If I type something into one or both of the credentials fields, the server handles the request and displays "Auth-Type = Accept, accepting the user" and "Sending Access-Accept of id 7 to 216.54.247.198 port 58063", but my phone does not join the network.
You can't do plain MAC auth with wireless - you must use EAP.
You could check mac address as well (but really, these days it's probably not worth it), but not on its own.
If you want to authenticate the device then EAP-TLS is the way to go. But at least it won't break when the devices decide to change their MAC addresses, as so many are starting to do randomly these days.
Matthew
I'm curious about your assertion. I'm just starting to deploy FreeRADIUS in order to do mac auth for a wireless network (Aruba), and I've been following: http://wiki.freeradius.org/guide/mac-auth#plain-mac-auth which seems to contradict your claim. I'm curious if I am misunderstanding something. - -- Munroe Sollog LTS - Network Analyst x85002 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJWlWhYAAoJEPbbZiWCKDVCBoIH/2m4ZyrHnKfEPDjcziqV3D5U cVEtbD+Xbqh+LjNjAaPGlKsJsrQwHV4MTregZOM2DmDc2PopOYfRKFyuTNA3yqLG pLxFY9919Q349//6NVNuOcgcHKMyYtXQxnYH1FySbNIKfihbV2C1UeK+hn3OqFXl /2Fihry0t1rEBkSaJos2Pd3JGOxr8wFiNHG8Lb6MAjNTE5kqROyn23pjN6IKtnR2 m4V3H8zOpc9lEdXFK1jpSFfnk7TG7HhAGDVKlglJFRH0CoyAs9McJJW0IdmXYZO8 vl0GDqQllAfSLnYflhr94bB6HUQDX01pQZnLxdGWwC/2T7ysKIWsfTNxWCh+pyU= =Tw6K -----END PGP SIGNATURE-----
On Jan 12, 2016, at 3:55 PM, Munroe Sollog <mus3@lehigh.edu> wrote:
I'm curious about your assertion. I'm just starting to deploy FreeRADIUS in order to do mac auth for a wireless network (Aruba), and I've been following:
http://wiki.freeradius.org/guide/mac-auth#plain-mac-auth
which seems to contradict your claim. I'm curious if I am misunderstanding something.
Yes. EAP is *required* for wireless networks. Mac auth can *reject* on wireless networks. It cannot cause the user to be authenticated on wireless networks. This is because the session requires 802.1X session keys, which are derived from a *successful* EAP authentication. For wired networks without 802.1X, you can do Mac auth. For wired networks with 802.1X and *not* Macsec, you can force a user online with Mac auth, by faking the EAP success. For wired networks with 802.1X and Macsec, Mac auth can reject a user. It cannot cause the user to be authenticated. This is because the session requires Macsec session keys, which are derived from a *successful* EAP authentication. Alan DeKok.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On 01/12/2016 04:11 PM, Alan DeKok wrote:
On Jan 12, 2016, at 3:55 PM, Munroe Sollog <mus3@lehigh.edu> wrote:
I'm curious about your assertion. I'm just starting to deploy FreeRADIUS in order to do mac auth for a wireless network (Aruba), and I've been following:
http://wiki.freeradius.org/guide/mac-auth#plain-mac-auth
which seems to contradict your claim. I'm curious if I am misunderstanding something.
Yes.
EAP is *required* for wireless networks.
Mac auth can *reject* on wireless networks. It cannot cause the user to be authenticated on wireless networks. This is because the session requires 802.1X session keys, which are derived from a *successful* EAP authentication.
For wired networks without 802.1X, you can do Mac auth.
For wired networks with 802.1X and *not* Macsec, you can force a user online with Mac auth, by faking the EAP success.
For wired networks with 802.1X and Macsec, Mac auth can reject a user. It cannot cause the user to be authenticated. This is because the session requires Macsec session keys, which are derived from a *successful* EAP authentication.
Alan DeKok.
That means that FreeRadius can't be used at all to allow devices that don't support EAP (smart TVs, wireless sensors, etc) to join any SSID? Is the wiki wrong or am I missing the clarification in the documentation? - -- Munroe Sollog LTS - Network Analyst x85002 -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQEcBAEBCAAGBQJWlXAeAAoJEPbbZiWCKDVCs9UH/2fKvL+YOYZYQThoGBgiOrA6 3kyBxijPIzhUAtmNJzhl9PwMdrOn8SJlooofbm1wrdHTO0vtNH4aLeJTrBmYizpT afSvX+eiRlZ7/pKEAyDV3Fxdax4bLhMQXQDNr+J7iI1pMlRaE5YzWJYs/dA1vM40 oHXkpk4R/yb3vtzLt6MAo6mY+vizxYa6tyUK+0p4h+vpKPehPxA+jTPYGmyenTFo n+f3I4iZIrCUmdaOFRLqWGqPf7srtFOV/LKiowNW796usTleiTfPkZBc5FkXmwMS m8Q4jF0b2QFAq+v6mRYWMyn2DPheXb6KptgQlkW302VbbP9Ai8v81XZXrIwwG2w= =ryyf -----END PGP SIGNATURE-----
That means that FreeRadius can't be used at all to allow devices that don't support EAP (smart TVs, wireless sensors, etc) to join any SSID? Is the wiki wrong or am I missing the clarification in the documentation?
Mac-Auth can be used to authorize users for open wireless networks, or networks wireless secured by a PSK. It doesn't generate keying material so can't be used for WPA[2]-Enterprise -Arran Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
On 01/12/2016 04:43 PM, Arran Cudbard-Bell wrote:
That means that FreeRadius can't be used at all to allow devices that don't support EAP (smart TVs, wireless sensors, etc) to join any SSID? Is the wiki wrong or am I missing the clarification in the documentation?
Mac-Auth can be used to authorize users for open wireless networks, or networks wireless secured by a PSK.
It doesn't generate keying material so can't be used for WPA[2]-Enterprise
-Arran
I see what you're saying. I've been reading this thread from last year: http://lists.freeradius.org/pipermail/freeradius-users/2015-January/075146.h... And this seems to be what people do, or at least how vendors are implementing radius-backed mac-auth in their hardware. TL;DR, the NAS generates an EAP-MD5 packet with the MAC address as the username and password.
Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team
FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- Munroe Sollog LTS - Network Analyst x85002
On Jan 12, 2016, at 4:47 PM, Munroe Sollog <mus3@lehigh.edu> wrote:
I see what you're saying. I've been reading this thread from last year:
http://lists.freeradius.org/pipermail/freeradius-users/2015-January/075146.h...
And this seems to be what people do, or at least how vendors are implementing radius-backed mac-auth in their hardware.
They do MAC auth only when there's no EAP, and no Macsec.
TL;DR, the NAS generates an EAP-MD5 packet with the MAC address as the username and password.
That's still Mac auth. It does NOT work for wireless. Alan DeKok.
On 12 Jan 2016, at 21:29, Munroe Sollog <mus3@lehigh.edu> wrote:
That means that FreeRadius can't be used at all to allow devices that don't support EAP (smart TVs, wireless sensors, etc) to join any SSID? Is the wiki wrong or am I missing the clarification in the documentation?
There are no such devices. Wireless 802.1x *requires* the supplicant to support EAP. If a wireless client claims to support wireless dot1x but not EAP, then it's some invented proprietary supplicant and you'll need to ask the vendor what tricks need to be done to make it work. If you read the manual for your Aruba gear fully, you'll see that MAC auth runs alongside dot1x for wireless clients, not instead of. Your options are: * require MAC auth AND dot1x * require dot1x only * require dot1x with optional MAC auth (l2 fallthrough) MAC only is only supported by wired ports.
TL;DR, the NAS generates an EAP-MD5 packet with the MAC address as the username and password.
That is how *wired* MAC auth works. The device in the thread is a Cisco ethernet switch. Regards, Adam Bishop gpg: 0x6609D460 jisc.ac.uk | Networkshop 44: Save the date! | 22-24 March 2016 @ University of Manchester Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 2881024, VAT number GB 197 0632 86. The registered office is: One Castle Park, Tower Hill, Bristol BS2 0JA. T 0203 697 5800.
Hi Mike, Do you have MAC auth activated on the Client ? (Ubiquiti controller) Is your objective to bypass authentication if your mac is on this list or 802.1x auth + MAC ? What is the output of debugging ? (radiusd -X) Thanks, Le lundi 4 janvier 2016, Michael Linder <mlinder@xstrememd.com> a écrit :
Hello everyone,
I am following the instructions on the wiki ( http://wiki.freeradius.org/guide/Mac%20Auth) to configure our freeradius server for "Plain Mac-Auth" and the server is not responding how I expect. I have the server configured and an "authorized_macs" file created that contains the mac address of an android phone that I would like accepted onto the network. When I attempt to join the network from the phone, I am prompted for 802.1X credentials. If I type no credentials, the server won't handle the request at all. If I type something into one or both of the credentials fields, the server handles the request and displays "Auth-Type = Accept, accepting the user" and "Sending Access-Accept of id 7 to 216.54.247.198 port 58063", but my phone does not join the network. It simply times out. The Ubiquiti UniFi AP is in rental office space with a managed network, and the freeradius server is in the ec2 cloud. Does anyone have any ideas how to troubleshoot this? I don't think the UDP return traffic is being blocked, because the same thing happens if I move the AP to my house network with a COTS router.
Thanks, Mike
[root@freeradius2 ~]# radiusd -X radiusd: FreeRADIUS Version 2.2.6, for host x86_64-redhat-linux-gnu, built on Aug 14 2015 at 16:36:35 Copyright (C) 1999-2013 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/soh including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/cache including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/rediswho including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/replicate including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/radrelay including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/dhcp_sqlippool including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/redis including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel including configuration file /etc/raddb/sites-enabled/default main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20.000000 response_timeouts = 1 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client 0.0.0.0/0 { require_message_authenticator = no secret = "<scrubbed>" shortname = "XMDAP" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes timeout = 10 } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file ▒▒▒? modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 1024 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" ecdh_curve = "prime256v1" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" use_nonce = yes timeout = 0 softfail = no } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } reading pairlist file /etc/raddb/huntgroups reading pairlist file /etc/raddb/hints Module: Loading virtual module rewrite_calling_station_id Module: Linked to module rlm_always Module: Instantiating module "noop" from file /etc/raddb/modules/always always noop { rcode = "noop" simulcount = 0 mpp = no } Module: Linked to module rlm_files Module: Instantiating module "authorized_macs" from file /etc/raddb/modules/files files authorized_macs { usersfile = "/etc/raddb/authorized_macs" compat = "no" key = "%{Calling-Station-ID}" } reading pairlist file /etc/raddb/authorized_macs Module: Instantiating module "reject" from file /etc/raddb/modules/always always reject { rcode = "reject" simulcount = 0 mpp = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, NAS-Identifier, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } reading pairlist file /etc/raddb/users reading pairlist file /etc/raddb/acct_users reading pairlist file /etc/raddb/preproxy_users Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.accounting_response Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" relaxed = no } reading pairlist file /etc/raddb/attrs.access_reject } # modules } # server server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 38386 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 216.54.247.198 port 10027, id=4, length=163 User-Name = "a" NAS-IP-Address = 192.168.0.137 NAS-Identifier = "0418d6cee172" NAS-Port = 0 Called-Station-Id = "0A-18-D6-CF-E1-72:xmd-authorized" Calling-Station-Id = "00-02-71-D3-44-2B" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11b" EAP-Message = 0x02cd00060161 Message-Authenticator = 0xcb2f355e41f81c5808fb38890f50e2e9 # Executing section authorize from file /etc/raddb/sites-enabled/default +group authorize { ++[preprocess] = ok ++policy rewrite_calling_station_id { +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) ? Evaluating (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++? if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) -> TRUE +++if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) { ++++update request { expand: %{1}-%{2}-%{3}-%{4}-%{5}-%{6} -> 00-02-71-D3-44-2B expand: %{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}} -> 00-02-71-d3-44-2b ++++} # update request = noop +++} # if (Calling-Station-Id =~ /([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:.]?([0-9a-f]{2})[-:]?([0-9a-f]{2})/i) = noop +++ ... skipping else for request 0: Preceding "if" was taken ++} # policy rewrite_calling_station_id = noop [authorized_macs] expand: %{Calling-Station-ID} -> 00-02-71-d3-44-2b [authorized_macs] users: Matched entry 00-02-71-d3-44-2b at line 1 [authorized_macs] expand: Mike's Android phone with MAC %{Calling-Station-Id} authorized for network access -> Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access ++[authorized_macs] = ok ++? if (!ok) ? Evaluating !(ok) -> FALSE ++? if (!ok) -> FALSE ++else else { +++update control { +++} # update control = noop ++} # else else = noop +} # group authorize = ok Found Auth-Type = Accept Auth-Type = Accept, accepting the user # Executing section post-auth from file /etc/raddb/sites-enabled/default +group post-auth { ++[exec] = noop +} # group post-auth = noop Sending Access-Accept of id 4 to 216.54.247.198 port 10027 Reply-Message = "Mike's Android phone with MAC 00-02-71-d3-44-2b authorized for network access" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 4 with timestamp +207 Ready to process requests. ------------------------------------------------- Join the XstremeMD email list.< http://visitor.r20.constantcontact.com/d.jsp?llr=strsmmvab&p=oi&m=1122476050...
------------------------------------------------- XstremeMD EMAIL NOTICE - This transmission may be strictly confidential. If you are not the intended recipient of this message, you may not disclose, print, copy, or disseminate this information. If you have received this in error, please reply and notify the sender (only) and delete the message. Unauthorized interception of this e-mail is a violation of federal criminal law. This communication does not reflect an intention by the sender or the sender's principal to conduct a transaction or make any agreement by electronic means. Nothing contained in this message or in any attachment shall satisfy the requirements for a writing, and nothing contained herein shall constitute a contract or electronic signature under the Electronic Signatures in Global and National Commerce Act, any version of the Uniform Electronic Transactions Act, or any other statute governing electronic transactions.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (7)
-
Adam Bishop -
Alan DeKok -
Arran Cudbard-Bell -
Matthew Newton -
Max .M -
Michael Linder -
Munroe Sollog