December 2005 - Freeradius-Users - lists.freeradius.org

using freradius 1.0.5 to secure an WLAN AP
by Frank Buttner 30 Dec '05

30 Dec '05

Hello, I try to use freeradius to secure my WLAN. But it will not work. The clients talk to the ap and the ap to my radius Server. But the answer of the radius server is not ok:( It will use EAP-TLS. The clients has valid certificates. This is the output of radiusd -X -A when a client try's to connect: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.2:2068, id=0, length=163 User-Name = "schneeball.netz-von-frank" NAS-IP-Address = 192.168.1.2 Called-Station-Id = "0014bfa57781" Calling-Station-Id = "000e2e3ee98f" NAS-Identifier = "0014bfa57781" NAS-Port = 24 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200001e017363686e656562616c6c2e6e65747a2d766f6e2d6672616e6b Message-Authenticator = 0x66c2303e813aec1cfd1cde8a17334a73 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/192.168.1.2/auth-detail-20051228' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/192.168.1.2/auth-detail-20051228 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_realm: No '@' in User-Name = "schneeball.netz-von-frank", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 30 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 0 to 192.168.1.2:2068 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2ba99a35bae31f77cfceff5a7b53c1db Finished request 0 Going to the next request In this case the name of the client machine is schneeball.netz-von-frank what make I wrong??

2 10

linux QoS with pppd and freeradius
by Jandre Olivier 30 Dec '05

30 Dec '05

I am using freeradius for our vpn servers and pppoe-servers ( all linux based) . My QoS scripts which is tc scripts(HTB/SFQ) with iptables connection tracking which I manipulate via acct_users stop and start bits when the users logs on. I use alot of scripts to make database checks for QoS pools and shape the username accordingly as the ips is dynamic. Found a site http://bubble.nsys.by/projects/tc_config/beta-docs/README.dynamic where this guy does his shaping with attributes which would be awesome to do. Anyone with advice on doing it this kinda way with attributes.? J -- /*---------------------------------------------------------------------*/ __ _ ---------- / / (_)__ __ ____ __ --------- ------- / /__/ / _ \/ // /\ \/ / -------- ---- /____/_/_//_/\_,_/ /_/\_\ ------ localhost(a)localdomain.za.net

1 0

FreeRadius 1.1.0-pre0 on OpenBSD
by Vincent Bernat 30 Dec '05

30 Dec '05

Hi ! I succeed in compiling cleanly Freeradius 1.1.0-pre0 on OpenBSD 3.8 with the following configure : ./configure --with-rlm_ldap --without-rlm_krb5 \ --without-rlm_acct_unique --without-rlm_otp \ --without-rlm_perl --enable-shared=no --enable-debug Freeradius starts fine. I try to do PEAP authentication but then Freeradius segfaults : [...] rad_recv: Access-Request packet from host 138.231.141.222:2050, id=0, length=173 User-Name = "steve" NAS-IP-Address = 138.231.141.222 Called-Station-Id = "0014bf2f3eb5" Calling-Station-Id = "00306526e4e0" NAS-Identifier = "0014bf2f3eb5" NAS-Port = 34 Framed-MTU = 1400 State = 0x5d72cc5f52f81774f1e5bf1a75d99195 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0208002a1900170301001fa547984d5e50c6234839710cb5afe897a3033acdcf0d198a5b8b2cee149bdf Message-Authenticator = 0xd21e950adad5ec474294ff09906adf03 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 modcall[authorize]: module "mschap" returns noop for request 8 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: EAP packet type response id 8 length 42 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 8 users: Matched entry steve at line 5 modcall[authorize]: module "files" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 8 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 8 modcall: leaving group authenticate (returns ok) for request 8 Sending Access-Accept of id 0 to 138.231.141.222 port 2050 MS-MPPE-Recv-Key = 0x07903df33fbfac78c62a677bd381cda4a3e33adb7c7bbab591f1f7b54e78f16d zsh: segmentation fault (core dumped) HISTFILE=$HISTFILE-root ZDOTDIR=~ sudo /usr/local/sbin/radiusd -X -A I have the original configuration files with EAP defaulting to PEAP and TLS enabled. Here is the backtrace from gdb : (gdb) bt #0 0x06fdcbb6 in memset () from /usr/lib/libc.so.38.2 #1 0x80601740 in ?? () #2 0x1c03c33f in make_tunnel_passwd ( output=0xf5bdcac1, outlen=0x0, input=0x0, inlen=32, secret=0x0, vector=0x0) at radius.c:256 #3 0x00000000 in ?? () If I look at line 256, I see this : memset(passwd + 3 + inlen, 0, sizeof(passwd) - 3 - inlen); However, passwd is defined as : uint8_t passwd[AUTH_VECTOR_LEN + AUTH_PASS_LEN]; It is 16 + 16 = 32 bytes long. passwd + 3 + inlen is then outside passwd. I have tried to make passwd 259 bytes long to avoid segmentation fault but I get this : Sending Access-Accept of id 0 to 138.231.141.222 port 2050 MS-MPPE-Recv-Key = 0x64ab77b394aac0e36fec6b33df71b9cdd2d93356d7574cd548026938b21240af MS-MPPE-Send-Key = 0xddb31798589e6c89b3e60a428483012bb867fd2182aeb0375b36637998cf239f EAP-Message = 0x031a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "steve" The NAS seems unhappy with such an answer, maybe because of the Message-Authenticator which is empty. I have also tried to only uses 16 first bytes of input with no change... -- /* * Hash table gook.. */ 2.4.0-test2 /usr/src/linux/fs/buffer.c

2 2

The entries should be ordered
by M T 29 Dec '05

29 Dec '05

In man 5 users, HINTS, from: http://www.freeradius.org/doc/users.5.html#index Does "the entries should be ordered" mean in alphabetical order? (username first) TIA

2 2

A small question...
by Samuel Degrande 29 Dec '05

29 Dec '05

Hello everybody, I wish you a merry christmas. I have one small question, something I don't understand, and I didn't found any explication nowhere : I have something like this : --- radiusd.conf authorization { ... etc_smbpasswd files ... } --- users DEFAULT Auth-Type != MS-CHAP ..... DEFAULT Auth=Type == MS-CHAP ..... In the debug output of radiusd, I see something like : rlm_passwd: Added LM-Password: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' to config_items rlm_passwd: Added NT-Password: 'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' to config_items rlm_passwd: Added SMB-Account-CTRL-TEXT: '[UX ]' to config_items rlm_passwd: Adding "Auth-Type = MS-CHAP" That's done before the mod_call to 'files'. However, there's no matched entry in 'users'. What does it mean ? Why is not Auth-Type set to MS-CHAP before to look at 'users' ? Is there a doc somewhere that precisely describes how the server chains things ? But perhaps it's a big secret, a kind of graal that only radius core developpers can touch ? :-) However, a public version could be really helpfull... -- Samuel Degrande LIFL - UMR8022 CNRS - INRIA Futurs - Bat M3 Phone: (33)3.28.77.85.30 USTL - Universite de Lille 1 Fax: (33)3.28.77.85.37 59655 VILLENEUVE D'ASCQ CEDEX - FRANCE [CA certs: http://igc.services.cnrs.fr/CNRS-Standard/recherche.html ]

3 3

huntgroups file, aclip
by Adam KOSA 29 Dec '05

29 Dec '05

Hi all, google and the wiki search option did not answer my question, it may be too dumb to ask. i have the following huntgroup contents: aclip Calling-Station-Id == 127.0.0.1 aclip Calling-Station-Id == 127.0.0.11 aclip Calling-Station-Id == 10.61.11.17 aclip Calling-Station-Id == 10.61.13.41 ... aclip Calling-Station-Id == 10.61.14.10 aclip NAS-Port-Type == Async for restricting the logins to our cisco devices. what i'm looking for is the ability to use 127.0.0.0/24 or 127.0.0.1-255 instead of the first two lines. the above / and - syntax did not work. is this possible? what doc am i missing? btw: i need the first two lines because of cisco modules, that are using AAA, and can log into them via console, in which case the connection appears to be coming from 127.0.0.0/24. thanks in advance Adam

2 1

postgres + freeradius trouble
by André Lemos 29 Dec '05

29 Dec '05

1 0

radiusd core dumps on authentication (solaris 9)
by Johan Ramm-Ericson 29 Dec '05

29 Dec '05

Hello freeradius-users! I am currently experiencing an authentication problem and am wondering if anyone has run into something similar (or has an answer as to what I'm doing wrong I am running freeradius 1.0.5 on a Solaris 9 box. I have my users accounts currently stored in a NIS/YP database hosted by a Linux (Suse SLES9) server. My users - configuration file - currently looks like this: DEFAULT Auth-Type = Pam Fall-Through = No I have tried using Auth-Type = {System | Pam | unix}. No matter which I try radiusd core dumps as soon as it comes to the Authenticate module (see debug log below). This does not happen if I set Auth-Type = Local, then everything works as expected. _But_ that would give me two username / password databases to maintain - which is not something I look forward to.... Anyone have any ideas as to what's going on? TIA, Johan PS. No idea if this helps but I have an old freeraidius 1.0.2 lying around. The results (using the same config files) are the same. debug log --------------- /etc/init/freeradiusd start .... Module: Instantiated realm (MIP02) realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (NULL) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/opt/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/detail-combined" detail: detailperm = 384 detail: dirperm = 493 detail: locking = yes Module: Instantiated detail (accounting_replication_log) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (pre_proxy_log) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (post_proxy_log) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) detail: detailfile = "/opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.11.249:3644, id=171, length=121 NAS-IP-Address = 192.168.11.249 NAS-Identifier = "vrr_ggsn_2" Called-Station-Id = "xxxx.xxx.xx" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Virtual User-Name = "daniel" User-Password = "secret" Calling-Station-Id = "00001111" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/opt/freeradius/var/log/radius/radacct/192.168.11.249/auth-detail-20051229' rlm_detail: /opt/freeradius/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /opt/freeradius/var/log/radius/radacct/192.168.11.249/auth-detail-20051229 modcall[authorize]: module "auth_log" returns ok for request 0 users: Matched entry DEFAULT at line 152 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type Pam auth: type "PAM" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 pam_pass: using pamauth string <radiusd> for pam.conf lookup Segmentation Fault - core dumped radiusd

2 1

Freeradius vs NT Domain Authentication
by Richard Bortolucci 29 Dec '05

29 Dec '05

Hi, I know that's possible to configure Freeradius to authenticate Windows NT Domain users, but I just can't find a good/complete documentation about it... Is it possible for anyone on this forum to provide such documentation (files/links/instructions) to me? Thanks, -- Richard Bortolucci

2 3

Client authenticated but no internet connection
by mfred 29 Dec '05

29 Dec '05

Hi, The clients can login (through chillispot login page) and authenticate via the radius server and mysqldb. So they have an IP like 192.168.182.5. But even if they get authenticated they still cannot connect to the internet. And I have no idea why. Any hints ? TIA mfred

5 4