July 2006 - Freeradius-Users - lists.freeradius.org

Questions about debug output
by Paul Long 08 Jul '06

08 Jul '06

I have a few questions about the debug output from an ultimately successful EAP-TTLS-CHAP authentication. Consider this snippet: ... rad_recv: Access-Request packet from host 192.168.1.228:1045, id=210, length=166 User-Name = "anonymous" NAS-IP-Address = 192.168.1.228 Connect-Info = "CONNECT 802.11" Called-Station-Id = "000b6b8c03f9" Calling-Station-Id = "00146c6f2e75" NAS-Identifier = "00-14-6c-6f-2e-75" NAS-Port-Type = Wireless-802.11 NAS-Port = 15 NAS-Port-Id = "15" Framed-MTU = 1400 State = 0x656cef9c49bb7e305b809bc113ece6c4 EAP-Message = 0x020700061500 Message-Authenticator = 0xfd14176dee74fed4980d51bbf880b8a6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "anonymous", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 7 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry DEFAULT at line 173 ... 1. First, what does this mean: 'module "chap" returns noop for request 3?' My client uses CHAP, so why doesn't "chap," here, return ok? What does "noop" mean? 2. I read in a comment in the out-of-the-box eap.conf file that it is customary to specify "anonymous" for the "name of the user 'outside' of the tunnel" with ttls { use_tunneled_reply = yes }. Is the User-Name field in the above Access-Request this outside user name? 3. Is the User-Name in the Access-Request the same as what I've seen called the "outer identity?" 4. Is just using "anonymous" okay? Should I include a realm, e.g., anonymous(a)example.net? Is there something I lose by not specifying a realm in User-Name (everything seems to work okay so far)? 5. What does "No EAP Start" mean? 6. Why does modcall[authorize] say "Matched entry DEFAULT at line 173" here and in the subsequent challenge response (not shown), whereas later in the challenge response it says "Matched entry plong at line 76" ("plong" is the name part of the inner identity, if I'm using the terminology correctly)? Paul

2 1

Authentication by validating RADIUS attribute value
by Hariharan R 08 Jul '06

08 Jul '06

1 0

Radius + 802.1X
by Emerson 07 Jul '06

07 Jul '06

Hi, i posted 2 messages with Radius + Dhcp and Radius with ip pool, but for this answers, i learn that radius don't have anithing with dhcp, and ip pool work with connections PPP. But I need to deliver ip's to my clients, they use wifi hardware 802.1X. Why i deliver ip's for them ? My freeradius work ok, and i put dhcp to work together, but not work, anyone can answer this for me ? Anyone have any experience with it ? Thank's..... Emerson

2 1

rlm_sql variable substitution clarification
by Guy Fraser 07 Jul '06

07 Jul '06

I have run into an issue where we now have different types of NAS servers. I would like to use %{Connect-Info} if available or a string formatted from two attributes like : D%{Ascend-Data-Rate}_X%{Ascend-Xmit-Rate} This is how I tried to do it : ConnectInfo_stop = \ '%{Connect-Info:-D%{Ascend-Data-Rate}_X%{Ascend-Xmit-Rate}}' This is what I get when %{Connect-Info} is not available : "D_X" I haven't seen any examples where two attributes are combined to make one attribute. Thanks

2 4

802.1x authentication
by Jin Fan 07 Jul '06

07 Jul '06

Hi, All: I need some pointers on how to set up 802.1x (PEAP/MSCHAP v.2) authentication in freeradius. Generating certificates? Modifying configurations? Jin

2 2

Session Log
by fvt3 07 Jul '06

07 Jul '06

Is there a session log in freeradius? I want to find out who logged on and how much time they have until there session is timeout. Is there such a thing? __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

Standalone FreeRadius EAP-SIM Configuration Recipe?
by Duncan Glendinning 07 Jul '06

07 Jul '06

Hello, I'm attempting to configure FreeRadius to use EAP-SIM, in a standalone fashion (i.e., the GSM tuples are stored locally). Does a 'recipe' exist to appropriately FreeRadius to do so? It appears that the documentation is not complete, and I haven't found reference to such a configuration in the last 6 months or archives. I want to be able to use a USB SIM card reader along with EAP-SIM to authenticate a wireless supplicant. Thanks for your help, Duncan --- <mailto:Duncan.Glendinning@cox.net> Duncan.Glendinning(a)cox.net

2 1

Re: Radius ip pool
by Stefan Winter 07 Jul '06

07 Jul '06

Hi, (please respond to the list, not me privately. Others may have the same question) > yes, my clients using 802.1X. > I make a DHCP Server together with freeradius, but he don't deliver ip's. > I want to know if the radius have any configuration for this, to work > with a DHCP server. In fact, others _did_ have the same question. Reading the list archives would have helped. .1X authentication and DHCP have *nothing* to do with each other. If you have a DHCP server and it doesn't talk to your authenticated clients, that's a completely FreeRADIUS unrelated problem. Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

2 1

Error: rlm_sql_mysql: MYSQL Error
by jayesh 07 Jul '06

07 Jul '06

Hi all, I am using freeradius 1.1.0. The backend is mysql 5.0.22 which is located on a different server on the same network. My configuration is as follows: I am doing some stress testing to benchmark my infrastructure. I use SIPp for the same. The SIPp sends the calls to cisco gateway, the cisco gateway sends the authentication request to freeradius server. The radius server queries the mysql database and once the authentication is successful and the call is completed; the accounting request is also passed to the radius server by cisco which in turn is sent to the mysql database. Now I kept the SIPp at rate of 45 calls per second, but after say 10 to 15 minutes the radius server dies. This is the message I could see in the log: rlm_sql (sql): There are no DB handles to use! skipped 0, tried to connect 0 Error: rlm_sql_mysql: MYSQL Error: Cannot get result Fri Jul 7 14:18:46 2006 : Error: rlm_sql_mysql: MYSQL Error: Fri Jul 7 14:18:46 2006 : Error: rlm_sql_mysql: MYSQL Error: No Fields Fri Jul 7 14:18:46 2006 : Error: rlm_sql_mysql: MYSQL error: Fri Jul 7 14:18:46 2006 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Fri Jul 7 14:18:46 2006 : Error: rlm_sql (sql): failed after re-connect. I tried googling the archive but could not get a proper solution. One more thing; I had configured rlm_mysql using the following command: ./configure --without-thread. Could this be a cause of some problem, I did this as the radius was not finding mysql libraries. Can someone please help on this. Thanks in advance. w/regards, Jayesh Nambiar

1 0

RE: FW: mpd+freeradius+AD
by Егоров Сергей 07 Jul '06

07 Jul '06

Thank you so much Nikos! -----Original Message----- From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] Sent: Friday, June 30, 2006 4:57 PM To: freeradius-users(a)lists.freeradius.org Cc: Егоров Сергей Subject: Re: FW: mpd+freeradius+AD On Friday 30 June 2006 11:57, Егоров Сергей wrote: > Ok, this is my users file > > > test Auth-Type := MS-CHAP > Framed-IP-Address = 192.168.10.65 > DEFAULT Auth-Type := MS-CHAP > > And this is freeradius log, then I connect to mpd via test account: > > Login OK: [test/<no User-Password attribute>] (from client localhost port 0 > cli 192.168.12.126) Sending Access-Accept of id 121 to 127.0.0.1 port 49791 > Framed-IP-Address = 192.168.10.65 > MS-CHAP2-Success = > 0x01533d4245433430393843434139344338323441384444443146393830364138413345323 >6394441413430 MS-MPPE-Recv-Key = 0x0bbdc1d49670112e799bd5a86b084808 > MS-MPPE-Send-Key = 0x0df81127464f94a443c13e7e683f5251 > MS-MPPE-Encryption-Policy = 0x00000002 > MS-MPPE-Encryption-Types = 0x00000004 > rad_recv: Accounting-Request packet from host 127.0.0.1:54511, id=119, > length=139 NAS-Identifier = "testradius.ion.ru" > NAS-Port = 0 > NAS-Port-Type = Virtual > Service-Type = Framed-User > Framed-Protocol = PPP > Calling-Station-Id = "192.168.12.126" > User-Name = "test" > Framed-IP-Address = 192.168.10.12 > Acct-Status-Type = Start > Acct-Session-Id = "1652038-pptp0" > Acct-Multi-Session-Id = "1652038-pptp0" > Acct-Link-Count = 1 > Acct-Authentic = RADIUS > Sending Accounting-Response of id 119 to 127.0.0.1 port 54511 > > In this log freeradius said that account test OK, and his address > 192.168.10.65. But mpd replace it this his own. How could I improve it? > use radius-ip read more here /usr/local/share/doc/mpd/mpd22.html > > > -----Original Message----- > From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] > Sent: Thursday, June 29, 2006 7:05 PM > To: Undisclosed.Recipients : > Cc: Егоров Сергей > Subject: Re: FW: mpd+freeradius+AD > > On Thursday 29 June 2006 15:28, Егоров Сергей wrote: > > >This is Framed-IP-Address in radius dialect. > > > > Thanks for explaining freeradius basic concepts. I understood, that to > > assign IP to user I should use users freeradius file. But I couldn't > > configure it correctly. Now I have only one line in this file > > > > DEFAULT Auth-Type := MS-CHAP > > > > I've add another string (for user test), but it doesn't correct > > > > test Auth-Type := MS-CHAP, > > Try without the comma > > run the server in debug mode(radiusd -X) > and use radclient > > > Framed-IP-Address = 192.168.10.65, > > I think you can put this in AD. Don't know... > > > That should I fix? > > > > > > -----Original Message----- > > From: Nikos Vassiliadis [mailto:nvass@teledomenet.gr] > > Sent: Monday, June 26, 2006 5:09 PM > > To: freeradius-users(a)lists.freeradius.org > > Cc: Егоров Сергей > > Subject: Re: mpd+freeradius+AD > > > > On Monday 26 June 2006 14:04, Егоров Сергей wrote: > > > Thanks for reply. > > > > > > >You can use one of the three firewalls avaliable in the base > > > > system(ipfw, > > > > > > > > >ipf and pf), however mpd comes with a small dictionary that uses > > > > > > > > ipfw(8) >and you can easily define some filter bound to an interface > > > > (bound to a >username) via a radius reply attribute, let filter be a > > > > pipe(for bandwidth >control) or a packet filtering expression. > > > > > > That's fine for filtering vpn users access to local net. But how could > > > I assign specific IP for specific user in AD? > > > > > > > Your questions don't clearly tell where your problem is. > > > >Active Directory? mpd? or FreeRADIUS? You should define > > > >them better in order to get help from the list. > > > > > > My goal is to replace VPN server, based on win2003, with FreeBSD one. > > > WIN 2003 can do 1 and 2 in my questions, so I have to realize how to > > > setup this in mpd + freeradius. I already authenticate users from AD > > > group: > > > > > > ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key > > > --username=%{Stripped-User-Name:-%{User-Name:-None}} > > > --challenge=%{mschap:Challenge:-00} > > > --nt-response=%{mschap:NT-Response:-00} > > > --require-membership-of=EXAMPLE+VPN_Allowed". > > > > > > But I have several vpn groups and need to setup timeouts on each one. > > > > setup timeout? This looks like Session-Timeout in radius dialect. > > > > > Also > > > I need to I assign specific IP for specific user in AD. > > > > This is Framed-IP-Address in radius dialect. > > > > > Looks like > > > FreeRadius should respond for this. > > > > Yes, you have to have basic understanding of what radius is. All of these > > are very basic setup. I don't know how FreeRADIUS interacts with AD and > > what info it should get from AD. So, try searching (or asking) for active > > directory and FreeRADIUS. Keep the mpd part out of it, since it will > > add unneeded complexity. Or perhaps start from setting up mpd and > > FreeRADIUS. And then you could add AD. > > > > A few suggestions, Nikos > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html

1 0