July 2005 - Freeradius-Users - lists.freeradius.org

Script to encrypt/decrypt User-Password
by Tore Anderson 19 Jul '05

19 Jul '05

Hi. Does anyone have a script that implements the encrypting/ decrypting algorithm of User-Password that they'd like to share? I want to be able to input the Authenticator, shared secret, a password, and then get the encrypted password in return (or vice verca). Thanks -- Tore Anderson

3 5

Adding a binary null to a value using attr_rewrite
by Tore Anderson 19 Jul '05

19 Jul '05

Hi. I'm using attr_rewrite to add a Class attribute in my auth- reply packets. I need to include a binary null-byte in the value, but I cannot figure out how to do so. If I add a verbatim null-byte in radiusd.conf, the string is truncated there in the reply packet (seems like the code interprets it at some point as the string terminator). If I write \0 instead, it is simply ignored. Does someone know how to accomplish this? Thanks -- Tore Anderson

2 4

freeradius cisco-avpair problem
by Matthias Wolf 19 Jul '05

19 Jul '05

Hello I have y problem with the cisco-avpairs and a 525 cisco pix. After the pix has gotten the avpairs and created the access-list (e.g. AAA-user-test), the logging-table says that he needs an authorization. But radius and authorization? No really! Here is the line from the logging-table: "Authorization denied (acl= AAA-user-test) for user 'test' from 10.10.10.23/1369 to xx.xx.xx.xx/53 on interface inside". My avpair looks like: "ip:inacl#1=permit tcp host 10.10.10.23 any ". Where is my mistake? Either on the pix or at my kind of avpairs? Muchas gracias, Matthias Wolf

1 0

multiple realm proxying based on huntgroup.
by Roy D. Hockett 19 Jul '05

19 Jul '05

I appoligize if this question is covered somewhere, in docuementation, but I haven't found it. If you can point me to I would greatly appreciate it. I am trying to figure out a way to have different groups of realm proxies for different NAS/huntgroups. For example, for a VPN resouces I don't want realms, but for wireless/wired 802.1x I want to be able to forward to other realms. I would like to do this without running multiple instances of radiusd. I have been able to do this with Merit's AAA server for a long time, but it doesn't support kerberos v5 authentication, nor 802.1x currently. Thanks, -Roy -- /********************************************************************/ /* Roy Hockett * Telephone: (734) 763-7325 */ /* Network Engineer, * FAX: (734) 615-1727 */ /* ITCom, * Internet: royboy(a)umich.edu */ /* University of Michigan * */ /********************************************************************/

2 2

Listen to multiple ports on a single server?
by Erling Paulsen 19 Jul '05

19 Jul '05

Hello. Right now I'm running multiple servers for listening to multiple ports, for having the option of accomadating both NAS'es that use the old 1645 port and the ones using the newer 1812 port for requests. Is there a possibillity to have one radiusd listen to more ports, or do I have to reconfigure/tell all the old external participants to use the new 1812 port? >From what I can read from the docs, I guess it's not possible! Running v.1.0.4 - Erling Paulsen -- ----------------|sig|--- Erling.Paulsen(a)cc.uit.no Nettseksjonen, ITavd UiT

4 4

Re: Password with comma fail with LDAP
by Turtiainen, Tero 19 Jul '05

19 Jul '05

Hi, > We have FreeRADIUS 0.9.3 using LDAP for authorisation. We now have a > problem that for example password with certain characters is cut. For > example password "test,ing" is cut to "test". This is caused by the > gettoken function in src/lib/token.c which is used by the rlm_ldap > module. Google search seems to indicate that the same problem has been > with the SQL-module which also uses gettoken. > > This kind of behaviour is of course quite evil. Is our problem unique? .... > I made a quick test fix by replacing all occurences of gettoken in > src/modules/rlm_ldap/rlm_ldap.c with getbareword-function (also in > src/lib/token.c) which does not care about the tokens .... I have looked at this a little bit more and I still don't get it. Why does the LDAP-module use the gettoken() function? I have thought that the authorisation data stored in LDAP should be usually taken "as is", but in the LDAP/gettoken case it seems that there could also be some special handling. But in our case this breaks the password handling if the password contains some of those delimiters (like ,=> etc...). Storing the passwords in MD5 or some other one-way encryption is not a solution as CHAP is used for authentication. And the gettoken also breaks other attributes, not just passwords. Is there something that I don't understand or is this a bug in the LDAP-module? Replacing gettoken with getbareword in the rlm_ldap.c seemed to fix this, but this may brake a lot of other things... :) Or should this be discussed in freeradius-devel? -- Tero Turtiainen Telecom, Media & Entertainment Capgemini tero.turtiainen(a)capgemini.com This message contains information that may be privileged or confidential and is the property of the Capgemini Group. It is intended only for the person to whom it is addressed. If you are not the intended recipient, you are not authorized to read, print, retain, copy, disseminate, distribute, or use this message or any part thereof. If you receive this message in error, please notify the sender immediately and delete all copies of this message.

1 0

Accessing IP list...
by Kamran Bukhari 19 Jul '05

19 Jul '05

Hello I want My Radius server not to access the clients IP List, and it should entertain everyother IP which sends the request. It must not block the IP to get info. HOw can i do this? Second, if there is any way that radius server should look for Mysql database for the IP which tries to connect to it. I mean, if i send some request from some new IP, then radius server should check the database for the list and then authenticate? Bye -- Kamran Bukhari

1 0

building
by DALE REAMER 18 Jul '05

18 Jul '05

I am new to tweaking freeradius code. Since I am having trouble forming the information to be encrypted by SSL and then sent to the wpa_supplicant (bad decryptopmn or bad mac error on the wpa_supplicant side, and also sometimes on the server side) I want to put in some printf's in freeradius, probably in tls.c. After I add code, what needs to be built and installed, every directory has a makefile. The encryption problem is after a successful handshake and after the first server encrypted start packet, so I trust the encryption process. Thanks

2 3

EAP/TLS and XP client
by ksochack 18 Jul '05

18 Jul '05

Hi, I configured a freeRADIUS(RH-FC4) server to authenticate Proxim AP700 clients via eap/tls. The radius server processes the authentication request and challenges however in the logs I don't see 'access-accepted' messages (see detailauth log below). The AP monitor shows a number of request and challenges but none accepted or rejected, I can get rejected if I point to the wrong cert on the server or change the shared secret. The problem is the client never gets connected to AP to grab a IP address after authentication. Any help would be greatly appreciated. TIA, Kevin Sochacki Detailauth log excert: Packet-Type = Access-Request Mon Jul 18 13:37:14 2005 User-Name = "RadiusIS-X01.frsd.k12.nj.us" NAS-IP-Address = 10.10.10.89 Called-Station-Id = "00-20-a6-58-ec-4c:RFLTC8-AP" Calling-Station-Id = "00-90-4b-2c-ed-88" NAS-Identifier = "RFLTC8-AP" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021200200152616469757349532d5830312e667273642e6b31322e6e6a2e7573 Message-Authenticator = 0x2dc2f241788db9a17495d302732c41d7 Client-IP-Address = 10.10.10.89 Packet-Type = Access-Request Mon Jul 18 13:37:15 2005 User-Name = "RadiusIS-X01.frsd.k12.nj.us" NAS-IP-Address = 10.10.10.89 Called-Station-Id = "00-20-a6-58-ec-4c:RFLTC8-AP" Calling-Station-Id = "00-90-4b-2c-ed-88" NAS-Identifier = "RFLTC8-AP" State = 0x161f68d6d1793490de3cdbb9dadab669 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021300500d800000004616030100410100003d030142dbe8cb6e242a151a510a83d4d4a61d 3672f6685afe6b0b2b92f1484e8f2ce700001600040005000a00090064006200030006001300 1200630100 Message-Authenticator = 0x18a80f1d01826f6bf20ed7afa13b5a4b Client-IP-Address = 10.10.10.89 Packet-Type = Access-Request Mon Jul 18 13:37:15 2005 User-Name = "RadiusIS-X01.frsd.k12.nj.us" NAS-IP-Address = 10.10.10.89 Called-Station-Id = "00-20-a6-58-ec-4c:RFLTC8-AP" Calling-Station-Id = "00-90-4b-2c-ed-88" NAS-Identifier = "RFLTC8-AP" State = 0x36ee47bde8d663c9102fa6cb7c84532c Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x021400060d00 Message-Authenticator = 0xe69c50763abab6320cc27ebc402c3644 Client-IP-Address = 10.10.10.89

2 3

FreeRADIUS and LDAP
by Matt Juszczak 18 Jul '05

18 Jul '05

Hi all, Our setup in LDAP right now is: ou=People,dc=domain,dc=net Under the Organizational Unit of "People", we have our posixAccount users, which have valid UNIX uid's and have email accounts. However, not all of our Email users (ou=People) have radius accounts as well, and sometimes, user "bob" in Email is not the same user as user "Bob" in radius. Therefore, I'm thinking of just creating ou=Radius, and then putting our dial up customers in there. If I were to do that, is there a better schema I can use other than posixAccounts? Such as a radius-only schema that supports radius parameters as well? Thanks! -Matt

2 1