November 2005 - Freeradius-Users - lists.freeradius.org

Proxying a PEAP request to an IAS server
by Dan Newcombe 09 Nov '05

09 Nov '05

Hi all. I've done my best to try and figure this out myself, but am really stuck. First the basics: An enterasys C2 switch setup to do 802.1x authentication. This switch points to my freeradius server. Attached to the swich is my XP notebook, which is setup to do 802.1x via PEAP. On the back end is a Win2k3 server which is running IAS. The idea is to have all the network switches send the authentication requests to the freeradius server, which will then decide if it needs to go to the windows box (for staff) or a different box (for students). Also, the Win2k3 IAS server has a limit of 50 clients unless you scale up to the advanced server, which I find just sad that they have done this. Anyway, I have tested from the freeradius box to the IAS box using radtest, and everything is working, so I am being seen as a client. The problem is when I try and have the notebook authenticate. I see rlm_eap: Request is supposed to be proxied to Realm NULL. Not doing EAP. in the debug output, which I gather is normal, but somehow part of the problem. Basically, the IAS server seems to ignore whatever is coming across from the freeradius box. My (uneducated) guess is that this is because it has the EAP parms in it, but is not eap??? However, a normal "clear-text" attempt via radtest works fine. I have found this post by Alan DeKok - http://thread.gmane.org/gmane.comp.dial-up.freeradius.user/26170 which sounds very similar to what I am doing First, configure the server to terminate the tunnel, and authenticate the inner session locally. Once that works, configure the server to proxy the inner session only. I guess where I am really lost is how to follow the above suggestion. This is what it is sending to the IAS box, which is being ignored. Sending Access-Request of id 1 to 172.25.8.114:1812 User-Name = "CCSU\\dan" Called-Station-Id = "00-11-88-12-6e-70" Calling-Station-Id = "00-0f-1f-43-c8-38" NAS-Identifier = "00-11-88-12-6e-5d" NAS-IP-Address = 172.25.7.11 NAS-Port = 19 Framed-MTU = 1500 NAS-Port-Type = Ethernet EAP-Message = 0x0202001201434353555c646e6577636f6d63 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x3432 Thanks for any help...I'm really stuck on this part! -Dan

3 6

Re: JRadius
by Raoul Demour 09 Nov '05

09 Nov '05

Hello thanks for all the answers! > Regarding EAP-SIM, JRadius has no specific support > for it. What is it > you are trying to do? What I have understood: FreeRADIUS is able to authenticate using EAP-SIM. But you need to set the attributes: EAP-SIM-Rand1 EAP-SIM-SRES1 EAP-SIM-KC1 EAP-SIM-Rand2 EAP-SIM-SRES2 EAP-SIM-KC2 EAP-SIM-Rand3 EAP-SIM-SRES3 EAP-SIM-KC3 (do you really need to set all the 9 attributes? or just one rand, one SRES and one Kc is enough?) I dont have access to GSM network and I dont know Ki (share secret). But to check if the system is correctly set up, I would like to give manually the attributes (on the serveur). (In a way I cheat...). Or to reproduce the generation of Rand, SRES and Kc (using my own algorithm) and on the supplicant I simulate SIM card... With JRadius it is possible to create object like Attr_UserPassword (according to the given example of JRadius). After what, it is used to set the attribut UserPassord for FreeRADIUS. So I think it would not be too complicate to create new attribute like: Attr_EAP_SIM_Rand, Attr_EAP-SIM-SRES, Attr_EAP-SIM-KC. In a way, I would like to use JRadius to avoid writing a module which will set the nine above attributes. My explanation may be not realy clear because I still learning how the thing work (for exemple, I suppose that the algorith to generate Rand, SRES and Kc is mobil operator specific, but I'm not complitly sure of the fact) Raoul __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs

1 0

Failed attempts log
by Thierry Hoferlin 09 Nov '05

09 Nov '05

Hi, I've configured a freeradius 1.0.5 with MSSQL authentification. It works fine. Is there a way to log failed authentification records to SQL ? For the moment i've just the accounting information logged to SQL. Thanks in advance Thierry H.

3 2

RE: Cisco AP Vlan assignment when proxying EAP-PEAP?
by Guy Davies 09 Nov '05

09 Nov '05

You could do this on IOS based APs by creating multiple SSIDs. You can have a secured SSID that connects to your protected VLAN. Then, you could have an appropriately named SSID (NEWUSERSSTARTHERE ? :-) that is unencrypted and unauthenticated. It is associated with a walled garden VLAN with some kind of web capture device so that when the user connects and opens their browser, they're redirected to your webpage with instructions on how to download the client and configure it. They then get reassociated to the secured SSID. Other vendors do this more elegantly by providing the ability to specify a "last-resort" VLAN to which users are dumped if they fail authentication via EAP. The main difficulty is that an SSID that supports EAP is encrypted whereas you need an unencrypted SSID for a last-resort type user. So you generally end up with different SSIDs anyway. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Josh Howlett Sent: 09 November 2005 14:39 To: FreeRadius users mailing list Subject: Re: Cisco AP Vlan assignment when proxying EAP-PEAP? Hi Jezz, > Do you have any cunning solutions to how you might get around the > reject issue? > I'd imagine it's quite a common scenario, IE wanting to let users know > that they are doing something wrong as opposed to just rejecting them. Not really. FWIW, I think that a module that caught proxied packets (such as Access-Rejects) and converted them into other packet-types (such as Access-Accepts) would be very useful. best regards, josh. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

RE: Cisco AP Vlan assignment when proxying EAP-PEAP?
by Palmer J.D.F. 09 Nov '05

09 Nov '05

Cheers Josh. :) That's pretty much the way we do the Roanmode stuff. Just wasn't sure being EAP whether you could mess around with the return packet. Do you have any cunning solutions to how you might get around the reject issue? I'd imagine it's quite a common scenario, IE wanting to let users know that they are doing something wrong as opposed to just rejecting them. This must be one of the only redeeming features of web redirect. :-D Thanks, Jezz. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Josh Howlett Sent: 08 November 2005 16:30 To: FreeRadius users mailing list Subject: Re: Cisco AP Vlan assignment when proxying EAP-PEAP? Hi Jezz, Palmer J.D.F. wrote: > Hi, > > Can anyone tell me if it's possible to proxy EAP-PEAP from a Cisco Aironet > to an IAS server via FreeRADIUS (I can do this bit), then, set the user's > VLAN information within FreeRADIUS in the access-accept packet returned to > the AP? Yes - write a script that outputs the relevant attributes to stdout, and specify it in an "exec" clause in radiusd.conf, making sure you set packet_type = access-accept. Invoke the exec clause by placing it in post-proxy section. For example (assuming you've got the proxying working): assign-vlan.sh: #!/bin/bash VLAN = "123" # We can also grab the RADIUS username attribute from the environment. # USER = $USER_NAME # This might be useful if you wanted to drop users # into different VLANs. # if ( $USER == "bujfxh(a)bristol.ac.uk ); then # VLAN = "666" # fi echo "Tunnel-Medium-Type = 802" echo "Tunnel-Type = VLAN" echo "Tunnel-Private-Group-ID = $VLAN" exit 0 radiusd.conf: exec assign-vlan { program = "/path/to/assign-vlan.sh" input_pairs = proxy-reply output_pairs = proxy-reply wait = yes packet_type = Access-Accept } authorize { ... # Make sure you put this AFTER the clause that invokes proxying assign-vlan ... } > Also, is there a way to return an access-accept with a 'dirty' VLAN ID, even > if the IAS server rejects the user? The idea being that the user would be > put into a dead end VLAN so they could get info on how to register to use > the service. No; only a couple of attributes are permitted in Access-Reject packets. I don't think it would be possible to "catch" Access-Rejects from IAS and cunningly turn them into Access-Accepts, either :-/ (well, it would be possible, but you'd need to hack FR to do this). josh. > Many thanks, > Jezz Palmer. > > **************************************** > Jezz Palmer. > Internet Systems Officer. > Library and Information Services > University of Wales, Swansea > Singleton Park > Swansea > SA2 8PP > **************************************** > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Freeradius .. EAP/PEAP ... no accounting
by Guy Davies 09 Nov '05

09 Nov '05

Is your AP configured to send accounting information? Many don't do this by default. You will have to set it and tell it to use the same RADIUS server for accounting. Rgds, Guy -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Simone Sent: 09 November 2005 12:11 To: freeradius-users(a)lists.freeradius.org Subject: Freeradius .. EAP/PEAP ... no accounting hi all.. I have installed a freeradius 1.0.5.. For my project i need to use it for authenticate and log (accounting) the wi-fi customer on an area of my city.. All is done ok.. the Hot-spot is configured for work with Radius using WPA - EAP using PEAP and radius.. Freeradius is configured with TLS and PEAP and the authentication way working correctly.. I'm able to use my winXp client with Wi-fi.. connecting to the Hotspot and get the IP address via DHCP.. all great.. DAMN !!! freeradius don't log the accounting and i don't find what is the problem.. all the config on radiusd.conf about auth and accounting seem to be ok.. Some part of radiusd.conf =============== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ....... ....... # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = yes # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = yes ......... ......... # Write a detailed log of all accounting records received. # detail { # Note that we do NOT use NAS-IP-Address here, as # that attribute MAY BE from the originating NAS, and # NOT from the proxy which actually sent us the # request. The Client-IP-Address attribute is ALWAYS # the address of the client which sent us the # request. # # The following line creates a new detail file for # every radius client (by IP address or hostname). # In addition, a new detail file is created every # day, so that the detail file doesn't have to go # through a 'log rotation' # # If your detail files are large, you may also want # to add a ':%H' (see doc/variables.txt) to the end # of it, to create a new detail file every hour, e.g.: # # ..../detail-%Y%m%d:%H # # This will create a new detail file for every hour. # detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d # # The Unix-style permissions on the 'detail' file. # # The detail file often contains secret or private # information about users. So by keeping the file # permissions restrictive, we can prevent unwanted # people from seeing that information. detailperm = 0600 } # # Many people want to log authentication requests. # Rather than modifying the server core to print out more # messages, we can use a different instance of the 'detail' # module, to log the authentication requests to a file. # # You will also need to un-comment the 'auth_log' line # in the 'authorize' section, below. # detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } ........... ........... # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } ============================= Anyone could tell me .. "stupid here the error" :)) thanks for help.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

1 0

Freeradius .. EAP/PEAP ... no accounting
by Simone 09 Nov '05

09 Nov '05

hi all.. I have installed a freeradius 1.0.5.. For my project i need to use it for authenticate and log (accounting) the wi-fi customer on an area of my city.. All is done ok.. the Hot-spot is configured for work with Radius using WPA - EAP using PEAP and radius.. Freeradius is configured with TLS and PEAP and the authentication way working correctly.. I'm able to use my winXp client with Wi-fi.. connecting to the Hotspot and get the IP address via DHCP.. all great.. DAMN !!! freeradius don't log the accounting and i don't find what is the problem.. all the config on radiusd.conf about auth and accounting seem to be ok.. Some part of radiusd.conf =============== prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd # # The logging messages for the server are appended to the # tail of this file. # log_file = ${logdir}/radius.log ....... ....... # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = yes # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = yes log_auth_goodpass = yes ......... ......... # Write a detailed log of all accounting records received. # detail { # Note that we do NOT use NAS-IP-Address here, as # that attribute MAY BE from the originating NAS, and # NOT from the proxy which actually sent us the # request. The Client-IP-Address attribute is ALWAYS # the address of the client which sent us the # request. # # The following line creates a new detail file for # every radius client (by IP address or hostname). # In addition, a new detail file is created every # day, so that the detail file doesn't have to go # through a 'log rotation' # # If your detail files are large, you may also want # to add a ':%H' (see doc/variables.txt) to the end # of it, to create a new detail file every hour, e.g.: # # ..../detail-%Y%m%d:%H # # This will create a new detail file for every hour. # detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d # # The Unix-style permissions on the 'detail' file. # # The detail file often contains secret or private # information about users. So by keeping the file # permissions restrictive, we can prevent unwanted # people from seeing that information. detailperm = 0600 } # # Many people want to log authentication requests. # Rather than modifying the server core to print out more # messages, we can use a different instance of the 'detail' # module, to log the authentication requests to a file. # # You will also need to un-comment the 'auth_log' line # in the 'authorize' section, below. # detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! detailperm = 0600 } ........... ........... # # Accounting. Log the accounting data. # accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf # sql # Cisco VoIP specific bulk accounting # pgsql-voip } ============================= Anyone could tell me .. "stupid here the error" :)) thanks for help..

2 1

dialup_admin online users problems
by Eric Tanguy 09 Nov '05

09 Nov '05

Hi, i use freeradius-1.0.1 with mysql on Fermi Linux LTS Release 3.0.1 and dialup_admin1.62 I have a problem in showing the online user in dialup_admin. when a user over ppp connect on NAS, it doesn't appear in user online because nothing is writing into the radacct table and i don't know why. it 's different when an administrator connect into the NAS iver telnet or ssh, this session is writing into the radacct table. can anyone help me. -- mailto : eric.tanguy(a)gicm.fr G.I.C.M. Infrastructure & réseau 32 Rue Mirabeau, 29480 Le Relecq-Kerhuon Tél : +33 298003671 Fax : +33 298284005 -- Ce message et toutes les pieces jointes (ci-apres le "message") sont confidentiels et etablis a l'intention exclusive de ses destinataires. Toute utilisation ou diffusion non autorisee est interdite. Tout message etant susceptible d'alteration, l'emetteur decline toute responsabilite au titre de ce message s'il a ete altere, deforme ou falsifie. ----------------------------------- This message and any attachments (the "message") are confidential and intended solely for the addressees. Any unauthorised use or dissemination is prohibited. As e-mails are susceptible to alteration, the issuer shall not be liable for the message if altered, changed or falsified.

1 0

Segmentation Fault
by Linda Pagillo 08 Nov '05

08 Nov '05

I just installed the newest version of Freeradius (1.0.5) on my Linux Redhat 9 server. All went well except this... when i start the radius in debug mode.. all starts fine, but when the first user tries to authenticate, i get a Segmentation Fault and the radius stops. Any ideas? Linda Pagillo Director of Technical Services N2 The Net, LLC lpagillo(a)n2thenet.com 931-372-9179

10 27

JRadius
by Raoul Demour 08 Nov '05

08 Nov '05

Hello Does anyone have ever tried JRadius (jradius.sf.net)? As I'm more familiar whith Java than C, I wonder if I'm not going to use it to handle EAP-SIM (I am not completly sure I can do so, but if it is possible I will do so). Any experience is welcome. __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com

3 2