August 2005 - Freeradius-Users - lists.freeradius.org

Freeradius + TLS for Wifi networks
by Moonshi Mohsenruddin 05 Aug '05

05 Aug '05

Hello there, I am implementing freeradius with openssl to do authentication for Wifi Windows XP clients with Wireless Access Points which has support for WPA. I am using a CommGate Shield product which is based on Red Hat Linux 9.0 with the latest patches, with a custom-compiled freeradius-1.0.4 and openssl-0.98 as the base system. After the compilation and configuration, we did our testing with a Windows XP Pro SP2 client and the integration was successful. However, I noticed that we have had multiple dropped connections from Windows XP Pro with the Planet WAP-4000 and 3Com Office Connect Wireless Access Points every 30 to 45 minutes but the freeradius server logs does not show any errors. I don't think this is a freeradius issue but I need to verify with someone that this is not a radius related problem. My question: ----------- Is there any configuration parameters within freeradius that I can tweak to debug and check that radius is not the one causing this problem? Logically, I don't think it's a radius issue but I might be wrong. If there is anyone that would like to get a copy of our RADIUS + TLS HOWTO documentation with to find out how we did this integration, please send me a personal email and I will send the PDF copy over. -- Stay driven! Moonshi Mohsenruddin CommGate Inc.

2 2

Multiple Password Prompts
by ragan_davis＠colstate.edu 04 Aug '05

04 Aug '05

Hi, The Odyssey Client prompts at least twice for the password. Once connected, clients can roam across different AP's within the same WLAN with no problems. Has anyone else experienced this problem with a similar configuration? Running Environment: -- Freeradius Server = Gentoo Linux running FreeRADIUS v1.0.2 -- User DB = Novell NetWare 6.5 SP3 w/ eDirectory 8.7.3.5 (LDAP) -- Wireless Switch = Cisco Airespace 4100 WLAN Switch with WLAN configured for WPA-TKIP using dynamic key exchange -- Wireless AP = Cisco 1000 Series AP's (was Airespace) -- Wireless Client = Funk Odyssey Client v4.0.1 on Windows XP configured for WPA-TKIP and EAP-TTLS We have captured debug output on the Odyssey Client, on the Airespace WLAN switch, and on FreeRADIUS, as well as an ethereal sniff on the freeradius interface on the radius server. I can provide these as well as freeradius configs if needed. Thanks!

1 0

forcing client certificate authentication during EAP-PEAP and EAP-TTLS
by Michael Wang 04 Aug '05

04 Aug '05

Hi, I was wondering if there is a way to configure the radiusd to force the client to present his certificate during EAP-PEAP and EAP-TTLS. (I know this is not necessary, but I need to do it anyways....) I saw an interesting piece of code in eaptls_initiate() which indicates someone was thinking about it: /* * If we're TTLS or PEAP, then do NOT require a client * certificate. * * FIXME: This should be more configurable. */ if (handler->eap_type != PW_EAP_TLS) { vp = pairfind(handler->request->config_items, PW_EAP_TLS_REQUIRE_CLIENT_CERT); if (!vp) { client_cert = FALSE; } else { client_cert = vp->lvalue; } } So it seems like radiusd will force client certificate authentication during PEAP or TTLS if this particular value pair is set with lvalue==1. But I don't see any code where the PW_EAP_TLS_REQUIRE_CLIENT_CERT gets put into the config_items. Can someone "in the know" comment? I am looking at the source code from freeradius-1.0.4 Thanks, Michael

2 2

Need inbound CHAP authentication user profile examples
by RUCHIR MALHOTRA 04 Aug '05

04 Aug '05

Hi RADIUS gurus,I need some inbound CHAP authentication user profile examples for RADIUS testing with CHAP turned on. Please email me if you have some. Thanks in advance, Ruchir __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Cisco, DNIS and ISDN Problems
by Wilhelm Lehmann 04 Aug '05

04 Aug '05

Hi Everyone, I have been using Livingston Radius for a very long time, and decided it was time to upgrade to FreeRadius. We have various pop's authenticating to our radius server, and to make sure everything worked ok I first set only the lucent based pop's to authenticate on FreeRadius. This worked 100% and we decided to let the cisco boxes also authenticate on the new radius server. Suddenly we found the ISDN users can't authenticate. "tail -f radius.log Thu Aug 4 11:24:28 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as2 port 20012 cli 061xxx) Thu Aug 4 11:24:30 2005 : Auth: Login incorrect: [sonjapretorius/xxx] (from client Windhoek-as2 port 20012 cli 061xxx) Thu Aug 4 11:24:31 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as2 port 20330 cli 061xxx) Thu Aug 4 11:24:33 2005 : Auth: Login incorrect: [japhet/xxx] (from client Windhoek-as2 port 20330 cli 061xxx) Thu Aug 4 11:24:52 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Industria-as1 port 77 cli 061xxx) Thu Aug 4 11:24:58 2005 : Auth: Login OK: [lords/<CHAP-Password>] (from client Industria-as1 port 77 cli 061xxx) Thu Aug 4 11:25:05 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as1 port 20424 cli 061xxx) Thu Aug 4 11:25:10 2005 : Auth: Login incorrect: [japhet/xxx] (from client Windhoek-as1 port 20424 cli 061xxx) Thu Aug 4 11:25:51 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as1 port 72 cli 061xxx) Thu Aug 4 11:25:56 2005 : Auth: Login OK: [kaysererongo/<CHAP-Password>] (from client Windhoek-as1 port 72 cli 061xxx) " The two Login OK's are Async users. I noticed the port numbers are very high on the ISDN users, 20000+ while the Async ports are < 200 Just something else, for example the same user "japhet" can connect fine as he should on the Lucent NAS on ISDN or Async. The moment he connects to the Cisco I get the Login incorrect. No changes done at all. (Async works fine on the Cisco) On the DNIS:1040 even on my Livingston radius I used to get the dnis:1040 user every time a user connects to the cisco nas's but this is just a minor irritation it didn't affect the users operation. How can I get rid of this ? The National Teleco (running the Cisco's) say there is nothing they can do, as they share the E1's and modems with all ISP's in our country, but determining who's customer it is by the number dialed, and this is where the dnis:1040 comes from and told me just to ignore it. Running radiusd -xx gives no info as to why it was rejected. Hope someone can assist. Thank you Wilhelm Lehmann

3 5

RES: Limiting the number of connections
by Jose Divino de Lima 04 Aug '05

04 Aug '05

Hi Alan, Thanks for your explanation. We´ve a shell script that do exactly what you sad. I´m trying to look for another way to do this. We´ve here a VoIP network and we need to restrict "N" connections to some groups. When i using a shell script it´s run properly, but it´s not fast. I thought that it can be did via mySQL in authorize_check query. It´s my scenario. Tks, Lima -----Mensagem original----- De: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]Em nome de Alan DeKok Enviada em: quarta-feira, 3 de agosto de 2005 13:32 Para: FreeRadius users mailing list Assunto: Re: Limiting the number of connections "Jose Divino de Lima" <jdlima(a)prolan.com.br> wrote: > I´ve a challenge now to limit thu number of simultaneous connections > (i.e: we can permit only ten connections at the same time). doc/Simultaneous-Use If you're limiting connections to 10 *different* people, you'll have to write some custom code. Even a shell script would do. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: ldap basedn assignment
by ggreen＠olemiss.edu 04 Aug '05

04 Aug '05

> How do you have this setup? Check out doc/configurable_failover. That > should show you how to do it. > I'm using configurable failover to get it to roll as it is. >From my radiusd.conf file: Authorize{ ldap1{ reject=1 } ldap2{ reject=1 ok=return } } Authenticate{ Auth-Type LDAP { ldap1{ reject=1 ok=return } ldap2{ reject=1 ok=return } } } The output I see when I try to authenticate with an openldap username/password where the username is also in AD rad_recv: Access-Request packet from host 130.74.186.38:17688, id=1, length=46 User-Name = "username" User-Password = "test123" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(sAMAccountName=username)' radius_xlat: 'cn=Users,dc=dept,dc=university,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ad.dept.university.edu:389, authentication 0 rlm_ldap: bind as cn=aduser,cn=Users,dc=dept,dc=university,dc=edu/adpassword to ad.dept.university.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=Users,dc=dept,dc=university,dc=edu, with filter (sAMAccountName=username) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'dc=university,dc=edu,c=US' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to openldap.university.edu:1744, authentication 0 rlm_ldap: bind as uid=ldapuser,ou=Special Users,dc=university,dc=edu,c=US/ldappassword to openldap.university.edu:1744 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=university,dc=edu,c=US, with filter (uid=username) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap2" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "username" with password "test123" rlm_ldap: user DN: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu rlm_ldap: (re)connect to ad.dept.university.edu:389, authentication 1 rlm_ldap: bind as CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu/test123 to ad.dept.university.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap1" returns reject for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "username" with password "test123" rlm_ldap: user DN: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu rlm_ldap: (re)connect to openldap.university.edu:1744, authentication 1 (THIS LINE IS THE PROBLEM) rlm_ldap: bind as CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu/test123 to openldap.university.edu:1744 rlm_ldap: waiting for bind result ... rlm_ldap: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu bind to openldap.university.edu:1744 failed No such object rlm_ldap: ldap_connect() failed modcall[authenticate]: module "ldap2" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. The above problem line should be: rlm_ldap: bind as uid=username, ou=People, dc=university,dc=edu,c=us/test123 to openldap.university.edu:1744 However, it is taking the userdn from the ad server which gave the first authorize ok. What I need is for it to attempt to authenticate with the appropriate userdn depending on which server it is authenticating to. So it would use the userdn from AD authenticating to the AD server and the openldap userdn when authenticating to the openldap server. Thanks

3 2

Authentication problem
by Hamid Salim 04 Aug '05

04 Aug '05

On Wed, 3 Aug 2005, Hamid Salim wrote: > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication *:1812 > Listening on accounting *:1813 > Listening on proxy *:1814 > Ready to process requests. > Dusty's response: You need to figure out why your NAS is not sending radius packets to the radius server. Check your network connections, your firewall rules, etc.. My question: i am not using NAS (as i understand) also i am not using Radius accounting. I am trying to use FreeRadius solely for authentication. what is check_with_nas = yes used for? do i need to change this??? thanks. Hamid.

2 1

RE: accounting - respose from freeradius, and forward
by Tariq Rashid 04 Aug '05

04 Aug '05

i'm happy to work with anyone with the programming talent to do this. tariq -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Alan DeKok Sent: 04 August 2005 16:34 To: FreeRadius users mailing list Subject: Re: accounting - respose from freeradius, and forward Tariq Rashid <tariq.rashid(a)uk.easynet.net> wrote: > i'll have another look to see if it is possible using mechanisms within the > radiusd.conf (perhaps calling 2 modules, one to reply, one to forward). There could be a "replicate" module, which would send packets to multiple destinations. I'd prefer not to have it in the server core. For that matter, proxying could very much be a module. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: accounting - respose from freeradius, and forward
by Tariq Rashid 04 Aug '05

04 Aug '05

thanks for the suggestion. i've had a look at this and it doesn't seem like an elegant solution to me. i'll have another look to see if it is possible using mechanisms within the radiusd.conf (perhaps calling 2 modules, one to reply, one to forward). t -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]On Behalf Of Nicolas Baradakis Sent: 03 August 2005 15:47 To: FreeRadius users mailing list Subject: Re: accounting - respose from freeradius, and forward Tariq Rashid wrote: > we'd like freeradius to reply to accounting requests (start, stop, interim) > with acknowledgements, but also to forward the accounting request to a > backend radius server but to ignore the response from this prozy behaviour. > > this means that the querying NAS equipment doesn't spend time and resources > waiting for a backend reply to an accounting request. however, the backend > radius (possibly belionging to a 3rd party organisation) will need to see > the accounting packets - we just ignore/drop their repsonse. You could use radrelay. See the radrelay(8) manpage in 1.0.x version or radrelay.conf(5) manpage in CVS version. -- Nicolas Baradakis - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1