January 2007 - Freeradius-Users - lists.freeradius.org

RE: Restrict Password from detail file , accounting
by Ellis, Scott 1 (N-Comptel Inc.) 11 Jan '07

11 Jan '07

Do you know what version was the first to introduce this feature? Is there any other solution for the older versions? Thanks, Scott -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: Wednesday, January 10, 2007 3:10 PM To: FreeRadius users mailing list Subject: Re: Restrict Password from detail file , accounting Hi, > Is there a way to eliminate the password from being written to the > accounting log files? Either not in clear text or altogether? which accounting logs? with the recent versions of FreeRADIUS you can add the following to the last part of each detail logging stanza suppress { User-Password } usage of obfuscation is also recommended for, eg MySQL logging. simply replace the User-Password INSERT with the value of 'password' alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Freeradius-1.1.3 + Mysql ?
by adreas Polyxronopoulos 11 Jan '07

11 Jan '07

Hi list, I have compiled freeradius-1.1.3 with out any configure option. I don't have mySql server on my pc (ubuntu 6.10) . If i would like to store accounting information in mySql , what i have to do? When i download mySql server package do i have to configure freeradius again or just configure radiusd.conf ? thanks... Adreas Polyxronopoulos ___________________________________________________________ New Yahoo! Mail is the ultimate force in competitive emailing. Find out more at the Yahoo! Mail Championships. Plus: play games and win prizes. http://uk.rd.yahoo.com/evt=44106/*http://mail.yahoo.net/uk

3 2

RE: Restrict Password from detail file , accounting
by Ellis, Scott 1 (N-Comptel Inc.) 11 Jan '07

11 Jan '07

Thanks. I will give it a try. -----Original Message----- From: freeradius-users-bounces+scott.1.ellis=lmco.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+scott.1.ellis=lmco.com@lists.freeradius .org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: Wednesday, January 10, 2007 3:10 PM To: FreeRadius users mailing list Subject: Re: Restrict Password from detail file , accounting Hi, > Is there a way to eliminate the password from being written to the > accounting log files? Either not in clear text or altogether? which accounting logs? with the recent versions of FreeRADIUS you can add the following to the last part of each detail logging stanza suppress { User-Password } usage of obfuscation is also recommended for, eg MySQL logging. simply replace the User-Password INSERT with the value of 'password' alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Problems with radeapclient and EAP-SIM test files
by Ramm-Ericson, Johannes 11 Jan '07

11 Jan '07

Hi Freeradius users, Does anyone have any input on why radeapclient is core-dumping when running one of the EAP-SIM tests? Freeradius v.1.1.4 OS : Suse Enterprise Linux 10 (kernel 2.6.16.21-0.8-smp) TIA, Johannes R-E rad01:/opt/freeradius/src/freeradius-1.1.4/src/tests/eapsim-03 # /opt/freeradius/current/bin/radeapclient -x localhost auth testing123 < eapsim-in.txt +++> About to send encoded packet: User-Name = "eapsim" NAS-IP-Address = 255.255.255.255 EAP-Code = Response EAP-Type-Identity = "eapsim" Message-Authenticator = 0x30 NAS-Port = 0 EAP-Sim-Rand1 = 0xabcd1234abcd1234abcd1234abcd1234 EAP-Sim-Rand2 = 0xbcd1234abcd1234abcd1234abcd1234a EAP-Sim-Rand3 = 0xcd1234abcd1234abcd1234abcd1234ab EAP-Sim-SRES1 = 0x1234abcd EAP-Sim-SRES2 = 0x234abcd1 EAP-Sim-SRES3 = 0x34abcd12 EAP-Sim-KC1 = 0x0011223344556677 EAP-Sim-KC2 = 0x1021324354657687 EAP-Sim-KC3 = 0x30415263748596a7 *** glibc detected *** /opt/freeradius/current/bin/radeapclient: munmap_chunk(): invalid pointer: 0x08120c24 *** ======= Backtrace: ========= /lib/libc.so.6[0xb7cb0911] /opt/freeradius/1.1.4/lib/libeap-1.1.4.so(eap_basic_compose+0x29f)[0xb7f 6815f] /opt/freeradius/1.1.4/lib/libeap-1.1.4.so(map_eap_types+0x113)[0xb7f682a 3] /opt/freeradius/current/bin/radeapclient[0x8049e02] /opt/freeradius/current/bin/radeapclient[0x804b537] /lib/libc.so.6(__libc_start_main+0xdc)[0xb7c6287c] /opt/freeradius/current/bin/radeapclient[0x8049521] ======= Memory map: ======== 08048000-0804d000 r-xp 00000000 fd:02 7413 /opt/freeradius/1.1.4/bin/radeapclient 0804d000-0804e000 rw-p 00004000 fd:02 7413 /opt/freeradius/1.1.4/bin/radeapclient 0804e000-08137000 rw-p 0804e000 00:00 0 [heap] b7c08000-b7c3d000 r--s 00000000 fd:00 94469 /var/run/nscd/dbJr1wJV (deleted) b7c3d000-b7c45000 r-xp 00000000 fd:00 12475 /lib/libnss_files-2.4.so b7c45000-b7c47000 rw-p 00007000 fd:00 12475 /lib/libnss_files-2.4.so b7c47000-b7c49000 rw-p b7c47000 00:00 0 b7c49000-b7c4b000 r-xp 00000000 fd:00 12464 /lib/libdl-2.4.so b7c4b000-b7c4d000 rw-p 00001000 fd:00 12464 /lib/libdl-2.4.so b7c4d000-b7d66000 r-xp 00000000 fd:00 12458 /lib/libc-2.4.so b7d66000-b7d68000 r--p 00118000 fd:00 12458 /lib/libc-2.4.so b7d68000-b7d6a000 rw-p 0011a000 fd:00 12458 /lib/libc-2.4.so b7d6a000-b7d6d000 rw-p b7d6a000 00:00 0 b7d6d000-b7e7c000 r-xp 00000000 fd:00 34638 /usr/lib/libcrypto.so.0.9.8 b7e7c000-b7e90000 rw-p 0010f000 fd:00 34638 /usr/lib/libcrypto.so.0.9.8 b7e90000-b7e93000 rw-p b7e90000 00:00 0 b7e93000-b7ecc000 r-xp 00000000 fd:00 34639 /usr/lib/libssl.so.0.9.8 b7ecc000-b7ed0000 rw-p 00038000 fd:00 34639 /usr/lib/libssl.so.0.9.8 b7ed0000-b7ee0000 r-xp 00000000 fd:00 12484 /lib/libpthread-2.4.so b7ee0000-b7ee2000 rw-p 0000f000 fd:00 12484 /lib/libpthread-2.4.so b7ee2000-b7ee4000 rw-p b7ee2000 00:00 0 b7ee4000-b7ef3000 r-xp 00000000 fd:00 12486 /lib/libresolv-2.4.so b7ef3000-b7ef5000 rw-p 0000e000 fd:00 12486 /lib/libresolv-2.4.so b7ef5000-b7ef8000 rw-p b7ef5000 00:00 0 b7ef8000-b7f09000 r-xp 00000000 fd:00 12469 /lib/libnsl-2.4.so b7f09000-b7f0b000 rw-p 00010000 fd:00 12469 /lib/libnsl-2.4.so b7f0b000-b7f0d000 rw-p b7f0b000 00:00 0 b7f0d000-b7f16000 r-xp 00000000 fd:00 12462 /lib/libcrypt-2.4.so b7f16000-b7f19000 rw-p 00008000 fd:00 12462 /lib/libcrypt-2.4.so b7f19000-b7f40000 rw-p b7f19000 00:00 0 b7f42000-b7f4c000 r-xp 00000000 fd:00 16331 /lib/libgcc_s.so.1 b7f4c000-b7f4d000 rw-p 00009000 fd:00 16331 /lib/libgcc_s.so.1 b7f4d000-b7f4f000 rw-p b7f4d000 00:00 0 b7f4f000-b7f64000 r-xp 00000000 fd:02 7297 /opt/freeradius/1.1.4/lib/libradius-1.1.4.so b7f64000-b7f65000 rw-p 00014000 fd:02 7297 /opt/freeradius/1.1.4/lib/libradius-1.1.4.so b7f65000-b7f66000 rw-p b7f65000 00:00 0 b7f66000-b7f6d000 r-xp 00000000 fd:02 7359 /opt/freeradius/1.1.4/lib/libeap-1.1.4.so b7f6d000-b7f6e000 rw-p 00006000 fd:02 7359 /opt/freeradius/1.1.4/lib/libeap-1.1.4.so b7f6e000-b7f6f000 rw-p b7f6e000 00:00 0 b7f6f000-b7f89000 r-xp 00000000 fd:00 12451 /lib/ld-2.4.so b7f89000-b7f8b000 rw-p 00019000 fd:00 12451 /lib/ld-2.4.so bf94a000-bf960000 rw-p bf94a000 00:00 0 [stack] ffffe000-fffff000 ---p 00000000 00:00 0 [vdso] Aborted rad01:/opt/freeradius/src/freeradius-1.1.4/src/tests/eapsim-03 #

2 1

Cisco AS5300 POD Packets
by Cory Robson 11 Jan '07

11 Jan '07

I have seen a few different posts on this and am seeking clarification. Does the latest version of radclient support POD for the cisco's. I have seen a patch written in 2003 that said its been added but nothing further?

3 3

Authentication methods.
by Evan Vittitow 11 Jan '07

11 Jan '07

The issue is, I want a secure means of authenticating nodes to my WAP, but I don't want to degrade my traffic for things like Quake. The authentication can be encrypted, but not all the traffic. And I did look at pppd. pppd is launching in CHAP mode, and it shouldn't be.

2 1

Testing EAP-PEAP with freeradius
by Bin Chen 11 Jan '07

11 Jan '07

Hi, I want to deploy the EAP-PEAP in our WLAN hotspot, we are using EAP-TLS before and it works fine with our AP. But a PKI is very inconvenient so we want to migrate to EAP-PEAP. Any changes need to be done to radiusd.conf? The client will provide the user-name and password, the file 'users' will used to match the user-name and password? And is it enough? I mean, in EAP-TLS it also need user-name and password, just left the same as EAP-TLS? And, I also want to know when the AP or Windows client encounter obstacle to cooperate with this change, which client should I use to verify in freeradius side the configuration is work but not the windows client's problem? Can radclient be used and how can I do? I am newbie to this area and may be silly question, any help appreciated. Thanks in advance. Bin Chen

4 6

dictionary.3gpp2 suggested patch
by Alexander Serkin 11 Jan '07

11 Jan '07

Hi, freeradius-users. I'd suggest a small patch for dictionary.3gpp2. The corrections include some attributes described in latest 3gpp2 specifications, which are used in our environment. It corrects 3GPP2-R-P-Session-ID to be integer, and sets several attributes according to their description in http://www.3gpp2.org/Public_html/specs/X.S0011-005-C_v3.0_061030.pdf : 3GPP2-Always-On 3GPP2-MEID and http://www.3gpp2.org/Public_html/specs/A.S0008-B_v1.0_061019.pdf (Annex E): 3GPP2-HRPD-Access-Authentication 3GPP2-HRPD-AT-Hardware-Id The patch itself is: --- dictionary.3gpp2.orig 2005-12-01 01:17:18.000000000 +0300 +++ dictionary.3gpp2 2007-01-11 09:39:51.900975000 +0300 @@ -57,12 +57,12 @@ ATTRIBUTE 3GPP2-IP-QoS 36 integer # 37-38 ? ATTRIBUTE 3GPP2-Airlink-Priority 39 integer -ATTRIBUTE 3GPP2-Airlink-Record-Type 40 integer # ? -#ATTRIBUTE 3GPP2-R-P-Session-ID 41 string -ATTRIBUTE 3GPP2-Airlink-Sequence-Number 42 integer # ? +ATTRIBUTE 3GPP2-Airlink-Record-Type 40 integer +ATTRIBUTE 3GPP2-R-P-Session-ID 41 integer +ATTRIBUTE 3GPP2-Airlink-Sequence-Number 42 integer ATTRIBUTE 3GPP2-Received-HDLC-Octets 43 integer ATTRIBUTE 3GPP2-Correlation-Id 44 string -ATTRIBUTE 3GPP2-Module-Orig-Term-Indicator 45 octets # ? +ATTRIBUTE 3GPP2-Module-Orig-Term-Indicator 45 octets ATTRIBUTE 3GPP2-Inbound-Mobile-IP-Sig-Octets 46 integer ATTRIBUTE 3GPP2-Outbound-Mobile-IP-Sig-Octets 47 integer ATTRIBUTE 3GPP2-Session-Continue 48 integer @@ -80,7 +80,10 @@ # The next set of attributes contain sub-types ATTRIBUTE 3GPP2-Remote-IP-Address 59 octets -# 60 - 69 are marked "reserved" +ATTRIBUTE 3GPP2-HRPD-Access-Authentication 60 integer +ATTRIBUTE 3GPP2-HRPD-AT-Hardware-Id 61 octets + +# 62 - 69 are marked "reserved" ATTRIBUTE 3GPP2-Remote-IPv6-Address 70 octets ATTRIBUTE 3GPP2-Remote-Address-Table-Index 71 octets @@ -91,10 +94,7 @@ # the following don't contain subtypes ATTRIBUTE 3GPP2-DNS-Update-Required 75 integer -# Is this 76 or 78? Check... -#ATTRIBUTE 3GPP2-Always-On 76 integer -# 77 ? -#ATTRIBUTE 3GPP2-Always-On 78 integer +ATTRIBUTE 3GPP2-Always-On 78 integer ATTRIBUTE 3GPP2-Foreign-Agent-Address 79 ipaddr ATTRIBUTE 3GPP2-Last-User-Activity-Time 80 integer ATTRIBUTE 3GPP2-MN-AAA-Removal-Indication 81 integer @@ -123,5 +123,6 @@ # The next set of attributes contain sub-types ATTRIBUTE 3GPP2-Remote-IPv6-Octet-Count 97 octets ATTRIBUTE 3GPP2-PrePaid-Tariff-Switching 98 octets +ATTRIBUTE 3GPP2-MEID 116 string END-VENDOR 3GPP2 -- Sincerely Yours, Alexander

1 0

My PPTP+802.1X+MS-CHAP+EAP+OpenLDAP+MySQL Project.
by Evan Vittitow 11 Jan '07

11 Jan '07

I'm a hard core Linux User with a Linux infrastructure I am attempting to expand upon and include FreeRadius, with my existing Linux-only OpenLDAP, Kerberos, Samba, Bind Infrastructure. Here is my situation. I want to be able to create MS-CHAPv2 VPNs, that use pptpd, pppd and freeRadius. I want to secure my Wireless Access points using 802.1X and PEAP, or EAP-TLS that are operated by my Cisco Aironet 340. I'm not interested in encrypting traffic. I have UDP Protocols like Quake 3 that are degraded by WPA, WEP and IPSec. IPSec may get implemented in due time, but for now, thats not on the agenda. My current issue is securing the APs from unauthorized access. My Progess so far: The issue with the VPNs is that even through Client Side PPP uses MS-CHAP, FreeRadius is causing pppd to think its authenticating normal CHAP. Jan 9 03:09:00 kurama pppd[12373]: Peer User failed CHAP authentication rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request Now, The Server works fine when I turn off the Radius plugin and enter the and enter stuff in the chap-secrets. This is the output of radisd -fX rad_recv: Access-Request packet from host 127.0.0.1:35034, id=77, length=62 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "User" Calling-Station-Id = "192.168.0.3" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for User radius_xlat: '(uid=User)' radius_xlat: 'dc=pukey' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to kurama.pukey:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=pukey/password to kurama.pukey:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=pukey, with filter (uid=User) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value AA6D039ED308809C... & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value AEC210AF99DB43C... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user User authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "User", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 54 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Why is this happening? I haven't started on the AP security yet, because this is holding me back.

3 4

Return values for rlm_exec scripts
by Garry Glendown 11 Jan '07

11 Jan '07

Hi, I'm trying to configure dynamic values in the users-file, which works fine using the rlm_expr module. Anyway, due to some more complicated expressions that can not be formed using rlm_expr, I tried to set up an external script that will return the value I need ... only problem is: I can't seem to get the format right, and I can't seem to find any docs on what exactly to return so that the %{exec:...} entry will be used ... e.g, on a field that expects a numeric value, I tried something like this: Session-Timeout := `%{exec:/bin/echo 200}` But all I get is this in the loggfile: Mon Jan 8 16:05:24 2007 : Error: Exec-Program-Wait: /bin/echo 200: unparsable reply What do I have to do to get FreeRadius to understand the return value? Thanks!!!

2 4