February 2006 - Freeradius-Users - lists.freeradius.org

freeradius authorization without "username"
by ???????, ?? ???????? 27 Feb '06

27 Feb '06

I have a freeradius, and I need "Calling-Station-Id" for authorization. This is the one attribute, which I select in the radiusd.conf checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } (But in fact, I do not use this) Why, when freeradius rescieve the access-request packet, and "username" field is empty, then we got access-denied? I use SQL authorization module. In the database (I use it as a blacklist, id Calling-Station-Id exist in the list, then access denied.): +----+------------+-----------+----+--------+ | id | UserName | Attribute | op | Value | +----+------------+-----------+----+--------+ | 2 | 3339222222 | Auth-Type | == | Reject | | 1 | all_users_not_in_black_list | Auth-Type | == | Accept | +----+------------+-----------+----+--------+ >From sql.conf: authorize_check_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authcheck_table} \ WHERE Username = IF(Username='%{SQL-User-Name}','%{SQL-User-Name}','all_users_not_in_black_list') \ LIMIT 1" authorize_reply_query = "SELECT id, UserName, Attribute, Value, op \ FROM ${authreply_table} \ WHERE Username = 'all_users_not_in_black_list' \ ORDER BY id" So, info from radiusd in debug mode: rad_recv: Access-Request packet from host XXX.XXX.XXX.XXX:1812, id=182, length=113 NAS-Identifier = "ggsn2" User-Name = "" User-Password = "" NAS-IP-Address = XXX.XXX.XXX.XXX NAS-Port-Type = Virtual Called-Station-Id = "1000" Calling-Station-Id = "3339222225" Acct-Session-Id = "d45d6126057478b1" Acct-Multi-Session-Id = "d45d61260000b77a" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/auth-detail.log' rlm_detail: /usr/local/var/log/radius/radacct/auth-detail.log expands to /usr/local/var/log/radius/radacct/auth-detail.log modcall[authorize]: module "auth_log" returns ok for request 0 rlm_sql (sql): zero length username not permitted modcall[authorize]: module "sql" returns invalid for request 0 modcall: leaving group authorize (returns invalid) for request 0 Invalid user: [/] (from client ggsn2 port 0 cli 3719248521) Sending Access-Reject of id 182 to XXX.XXX.XXX.XXX port 1812 I don't care, what kind of username do we have! How I can avoid this problem? :-( Can someone help me with this quesion? Here is the part of my radiusd.conf file: <...skipped...> modules { checkval { # The attribute to look for in the request item-name = Calling-Station-Id # The attribute to look for in check items. Can be multi valued check-name = Calling-Station-Id # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no notfound-reject = yes } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } # Livingston-style 'users' file # files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/acct-detail.log detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/auth-detail.log detailperm = 0600 } detail reply_log { detailfile = ${radacctdir}/reply-detail.log detailperm = 0600 } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{Calling-Station-Id} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } } instantiate { } authorize { auth_log # See "Authorization Queries" in sql.conf sql } authenticate { } accounting { detail radutmp } session { radutmp } # Post-Authentication post-auth { reply_log } ------------------------------------------------------------------------------- http://www.one.lv - Tavs mobilais e-pasts! Tagad lasi savu e-pastu ar mobilo telefonu - wap.one.lv!

2 1

re: Client certs with MSCHAPV2 in PEAP
by Norbert Wegener 27 Feb '06

27 Feb '06

>"Dave Huff" <dbhuff at yahoo.com <http://lists.freeradius.org/mailman/listinfo/freeradius-users>> wrote: >>/ > For EAP-TLS to work, the client certs have to be />>/ > signed by the server cert. />>/ Signed by the server cert or by the CA cert? I have a CA that signed the />/> server and client certs, and the eap.conf file knows where server and CA />/> certs are. / > If you're using 1.0.x, that won't work. It doesn't do certificate >chains. The client cert MUST be signed by the server cert. Using a >CA to sign them, both won't work. > > I'm not even sure it will work in 1.1.0, to be honest. > > Alan DeKok In 1.1.0 I have chained client certificates and for me EAP-TLS works, if the client does not require the server to authenticate itself. The client cert is not signed by the server cert. It seems to be neccessary,that if you have a root ca and an issuing ca, the CA_file must contain the certificates of both of them. If the client requires the server to authenticate itself, the whole process fails. Norbert Wegener

1 0

how to confirm locally??
by pelusa vali 27 Feb '06

27 Feb '06

hi everybody, i'm using debian sarge kernel 2.6.13, openssl 0.9.8a, hostapd 0.5.1, freeradius 1.0.5, madwifi-ng-r1406, i want to use eap-tls in my wlan and over my own ap over linux. so i can install and configure all programs (except hostapd, so instead compile myself i installed it from .deb format), now i have my certificates and programs running but when try to connect a windows client i get this error: "Received packet from (my freeradius server ip direction) with invalid Message Authenticator (invalid signature) (shared secret is incorrect)". i generate certifictes using winxp extensions. so my question is: is there any way i can test my certificates from freeradius?? any command? or may be install wpa-supplicant over my debian and test from there (authenticator and supplicant in same machine??). If clients try to connect without freeradius and hostapd running it's possible, but with these two programs clients lost immediately ip direction and show a message of "Error authenticating". could any body try to help? thanks in advance for your help and time. _________________________________________________________________ MSN Amor: busca tu ½ naranja http://latam.msn.com/amor/

1 0

Open Authentication for a realm
by John Oxley 27 Feb '06

27 Feb '06

Hi, I am still quite new to radius so please forgive me if I make invalid assumptions or this question has been answered somewhere. I want to have open authentication on a realm and setup an IP pool for that realm. So if your username is anything@foo, you will be authenticated, no matter what your password is and you will be given an IP from the pool 10.0.0.0/24. Where in the config files do I have to put this? I'm running FreeRadius 1.0.4 on FreeBSD 4.11-STABLE. Regards, -John

2 2

Re: Freeradius + Microsoft Active Directory
by Sandworm 27 Feb '06

27 Feb '06

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 "Natalia Escalera" <nescalera(a)gmail.com> wrote: >I have another question, how can we avoid referrals coming from AD >Ldap server? How can we specify those settings? >From the list archives: See http://lists.freeradius.org/pipermail/freeradius-users/2004- October/037218.html -----BEGIN PGP SIGNATURE----- Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 2.4 wkYEARECAAYFAkQCP0sACgkQmw4BJyaatJ0v0wCfVh0g2C1mTgdDxuV6qzBqg8FxTnsA nilt8+Zkbe4sXvs8HCpieRZ7kZQd =B4JO -----END PGP SIGNATURE-----

2 1

RE: Adding Ascend-Data-Filter to MySQL
by Jonathan De Graeve 27 Feb '06

27 Feb '06

> But when I add the same Ascend-Data-Filter information above into mysql > database file (radgroupcheck table), although authenticates fine, I don't > get "Ascend-VSA-Data-Filter=\0x01\0x01\0x01 ...." in attribute dump. > Below is what is added to the table: > > GroupName Attribute op Value > -------------------------------------------- > Dialup Auth-Type := LOCAL > Dialup Service-Type = Framed-User > Dialup Framed-Protocol = PPP > Dialup Framed-Compression = Van-Jacobsen-TCP-IP > Dialup Ascend-Data-Filter += "ip in forward tcp est" > Dialup Ascend-Data-Filter += "ip in forward dstip a.b.c.0/20" > Dialup Ascend-Data-Filter += "ip in forward tcp dstport = 25" > Dialup Ascend-Data-Filter += "ip in forward" > It should be in radgroupreply table J.

2 1

TNC Compliance
by Robert Myers 26 Feb '06

26 Feb '06

Is FreeRadius TNC compliant? -Bob

2 1

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 26 Feb '06

26 Feb '06

Exactly as I suggested in original post...

1 0

Is it possible to make PAP module understand both CRYPT (MD5) and plaintext passwords?
by Alex Savguira 26 Feb '06

26 Feb '06

Please ignore... Found the answer already...

2 1

rtl8186 + radius
by Norbert Grochal 26 Feb '06

26 Feb '06

Hi, I try to secure wireless network with freeradius (on linux PC). Access Points on rtl8186, WPA2(mixed), clients cards edimax on ralink rt2500 and ralink rt2400, PEAP. Firmware on AP: (newest versions) Planet 4035, Planet wrt414, Edimax ew-7206, Edimax ew-7209, OvisLink Airlive... Problems (all need reset AP, after reboot all is work ok 1-4 hours...): 1. wds disconnects every 3-4 hours. 2. If count of peoples > 4 then after 1-4 hours AP stops talk with freeradius 3. and sometimes freezes and peoples can't connect at all I have connect the AP to COM on my PC and see, that there are no error messages in builtin linux, there is anough memory and ramdisc space. I think this may be problem with driver for radio (RF, RTL8180/RTL8185). Anyone succesfully 'run' freeradius with PEAP + AP on rtl8186 with WPA2(mixed) + about 10-15 users?? Norbert

2 1