December 2007 - Freeradius-Users - lists.freeradius.org

rlm_eap: Identity does not match User-Name...
by Michael Patzer 12 Dec '07

12 Dec '07

hi, i found the same question and also this topic already on the mailinglist, but no solution which works for me. i'm already debugging this thing the whole day, without any solution. i'm using 802.1x with clients: winXP sp2 method: EAP-MSCHAPv2 server: 2.0.0-pre1 it works all fine, as long as i'm not supply any domain-name. if i supply a domain-name it immediately fails with rlm_eap: Identity does not match User-Name, setting from EAP Identity. could anybody help me with that? and yes, there is no entry in "users" for EAP. thx michael ****************** * DEBUG LOG ****************** rad_recv: Access-Request packet from host 192.168.0.240 port 1645, id=66, length=149 User-Name = "DOMAINXYZ\\mipa" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-E2-D8-3D-81" Calling-Station-Id = "00-80-C8-39-16-92" EAP-Message = 0x0202001601454e54455250524953455c7061747a6572 Message-Authenticator = 0xfe2f2b31d8a812b6338524fe5618414e NAS-Port-Type = Ethernet NAS-Port = 50001 NAS-IP-Address = 192.168.0.240 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 22 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns noop for request 0 perl_pool: item 0x816a2d8 asigned new request. Handled so far: 1 found interpetator at address 0x816a2d8 rlm_perl: Added pair NAS-Port-Type = Ethernet rlm_perl: Added pair Service-Type = Framed-User rlm_perl: Added pair Calling-Station-Id = 00-80-C8-39-16-92 rlm_perl: Added pair Called-Station-Id = 00-1A-E2-D8-3D-81 rlm_perl: Added pair Message-Authenticator = 0xfe2f2b31d8a812b6338524fe5618414e rlm_perl: Added pair User-Name = DOMAINXYZ\\mipa rlm_perl: Added pair EAP-Message = 0x0202001601454e54455250524953455c7061747a6572 rlm_perl: Added pair EAP-Type = Identity rlm_perl: Added pair NAS-IP-Address = 192.168.0.240 rlm_perl: Added pair NAS-Port = 50001 rlm_perl: Added pair Framed-MTU = 1500 rlm_perl: Added pair Auth-Type = EAP perl_pool total/active/spare [32/0/32] Unreserve perl at address 0x816a2d8 modcall[authorize]: module "perl" returns ok for request 0 modcall[authorize]: module "expiration" returns noop for request 0 modcall[authorize]: module "logintime" returns noop for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: group authenticate returns invalid for request 0 auth: Failed to validate the user. Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 0 radius_xlat: 'DOMAINXYZ\\mipa' attr_filter: Matched entry DEFAULT at line 11 modcall[post-auth]: module "attr_filter.access_reject" returns updated for request 0 modcall: group REJECT returns updated for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 66 to 192.168.0.240 port 1645 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 66 with timestamp 475edfcb Nothing to do. Sleeping until we see a request.

2 1

ip assignment without ip pool
by hadi golestani 12 Dec '07

12 Dec '07

Hello, I need to assign static ips to serveral users but not all of theme, and I feel it's a bad way to define an ip pool for each of theme. how to assign a specific ip address to a user?

2 5

Example listed in huntgroup file does not work
by Reynolds, Walter 11 Dec '07

11 Dec '07

I have tried to set up a huntgroup to match based on the example that is given in the file itself, but am not getting expected results. I want to limit the users that can connect to specific NAS's which works well if there is only one NAS in the huntgroup, but does not work for more than one. So I am sure that there is something simple I am missing Following is what I have. It will prevent user test3 from authenticating on 192.168.2.6, but not .5 alphen NAS-IP-Address == 192.168.2.5 alphen NAS-IP-Address == 192.168.2.6 User-Name == test1, User-Name == test2 So why does the authorize section not see the first NAS listed in the huntgroup? I have many boxes that need the same users while limiting all others. This could be done with a huntgroup for each NAS, but then if a user changes I am forced to modify every huntgroup. I am using 1.1.6. Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

3 2

RE: powerfull manager?
by Edvin Seferovic 11 Dec '07

11 Dec '07

>I love GPL, but unfortunatelly there is too few software being developed >for Radius... That was my problem too ! >All I need is actually: >- bandwith, time, volume limitation >- username/password authentication >- MAC authentication (but here is a trick - few MAC's for a one "billing" >user) >- card generator Almost everything covered ! >And of course something that would allow me to print bills ;) I have PDF generation :) > Do you know anything, that would do that? Not at the time of writing this. PhpMyPrePaid has some of interesting features. >I suppose, that as your project is a Uni project, you can't make it as GPL? Actually I am developing it for my company and my BS project is about data accounting and anomaly detection in systems that use RADIUS ! I'll let you know ! Anyone interested in supporting this project ? Regards, E:S

1 0

powerfull manager?
by CoMeC 11 Dec '07

11 Dec '07

Hi, Just wanted to ask if you know any freeware/lowcost billing managers for Radius... I know Radius Manager - is cool, but does not cover some options. PhpMyPrepaid seems to be ok, but it is not being developed for a long time. Any ideas? Thanks in advance, CoMeC

2 1

How to add attributes to Access-Accept replies
by Lucien RENAULT 11 Dec '07

11 Dec '07

Hi, I'm running a configuration where a Cisco 1600 router is running a PPPoE server and check user passwords against a freeRadius server running under FreeBSD. This Radius server checks passwords against a LDAP database running on another BSD server. The authentication is working great, the Radius replies with an "Access-Accept" reply to the Cisco router but it seems that the router needs two attributes to accept this reply : Service-Type = Framed-User, Framed-Protocol = PPP, So I did the following configuration in users.conf : DEFAULT Framed-Protocol == PPP Service-Type = Framed-User, Framed-Protocol = PPP, Fall-Through = Yes But freeradius still replies with no attributes in Access-Accept packet... I read a lot of documentation about this and I'm quite confused since I don't really see any other mean to add attributes to replies... Any Ideas ? Thanks

3 8

Two databases
by rgreiner 11 Dec '07

11 Dec '07

Hi, is there any reference text I could use to see how to configure a Freeradius server to use two different mysql databases? What I need is, depending on the realm of the user, I have to check his password in one of two different databases. Thank you, Roberto -- ----------------------------------------------------- Marcos Roberto Greiner Os otimistas acham que estamos no melhor dos mundos Os pessimistas tem medo de que isto seja verdade Murphy -----------------------------------------------------

2 1

ip assignment issue with poptop
by hadi golestani 11 Dec '07

11 Dec '07

Hi, I wana use freeradius to dynamically assign ip to my vpn clients. so I defined an ip pool with the range of 10.3.3.1 to 10.3.3.255, with the radtest command , I'm getting the the ip in answer but while trying to connect from vpn client and at the same time looking the debug mod output there's no ip returned in answer. radtest: radtest new3 new3 localhost 1685 testing123 Sending Access-Request of id 8 to 127.0.0.1 port 1812 User-Name = "new3" User-Password = "new3" NAS-IP-Address = 255.255.255.255 NAS-Port = 1685 rad_recv: Access-Accept packet from host 127.0.0.1:1812, id=8, length=32 Framed-IP-Address = 10.3.3.91 Framed-IP-Netmask = 255.255.255.255 debug mod: rad_recv: Access-Request packet from host 127.0.0.1:33802, id=99, length=146 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "new3" MS-CHAP-Challenge = 0x9dbdf0a41b6c569d8565b6813f9ae9e2 MS-CHAP2-Response = 0xbf00403c6176c9e7b825fc6332f4ecbb5c8a00000000000000000a65a6f35ab28326cf016a4c0636a167d0213b2d4d161cf9 Calling-Station-Id = "85.15.42.219" NAS-IP-Address = 127.0.0.1 NAS-Port = 1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 1 rlm_realm: No '@' in User-Name = "new3", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 1 radius_xlat: 'new3' rlm_sql (sql): sql_set_user escaped user --> 'new3' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'new3' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'new3' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'new3' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'new3' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 1 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 1 rlm_mschap: Told to do MS-CHAPv2 for new3 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 1 modcall: leaving group MS-CHAP (returns ok) for request 1 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 1 rlm_ippool: Searching for an entry for nas/port: 127.0.0.1/1 rlm_ippool: Found Framed-IP-Address attribute in reply attribute list. rlm_ippool: override is set to no. Return NOOP. modcall[post-auth]: module "main_pool" returns noop for request 1 rlm_sql (sql): Processing sql_postauth radius_xlat: 'new3' rlm_sql (sql): sql_set_user escaped user --> 'new3' radius_xlat: 'INSERT into radpostauth (user, pass, reply, date) values ('new3', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (user, pass, reply, date) values ('new3', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 1 modcall: leaving group post-auth (returns ok) for request 1 Sending Access-Accept of id 99 to 127.0.0.1 port 33802 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0xbf533d39463644384641333530454543384532453141324231444532453443333036333538323435303646 MS-MPPE-Recv-Key = 0x6bf743cc4d6fcdfe9ca3db2ffa091f2d MS-MPPE-Send-Key = 0xf7c1c3f1197d3b3637982d14423a98de MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 1 ID 99 with timestamp 475e1954 Nothing to do. Sleeping until we see a request.

2 1

FreeRADIUS CVS head supports PEAPv1 and EAP-FAST
by Alan DeKok 11 Dec '07

11 Dec '07

I have just committed a new module: rlm_eap2. It uses the hostap libraries to implement EAP. This means that FreeRADIUS now has two independent EAP modules, and can support a wider range of EAP types. There are some limitations: * The rlm_eap2 module is experimental, and requires some Makefile changes on both hostap && rlm_eap2 to build. * The inner tunneled sessions for PEAP and TTLS are *not* run through a virtual server, as with rlm_eap. This can be fixed before 2.0. * The inner tunneled sessions CANNOT be proxied (see above for why) * the eap types in use CANNOT be controlled by the server. This can be fixed before 2.0. The goal is to enable a wider range of EAP types to be used in FreeRADIUS. I will try to put together some upstream patches for hostap which will make it easier for EAP servers to selectively control which types they choose to implement. Alan DeKok.

1 0

Re: freeradius2 CVS - hostname lookup has no effect
by Alan DeKok 10 Dec '07

10 Dec '07

Edvin Seferovic wrote: > Well I do. Just got the CVS version. Tried hostname_lookups = off / no ! No > help. Only when the client is being entered in the clients.conf it is > recognised. In the other hand I get Ok... the issue isn't related to hostname lookups. The server keeps "known" clients internally, which are global. i.e. the "per-server" lookups confused the code. Try doing "cvs update". It should be fixed. > How come the only "known" clients are found in the clients.conf ? Does the > logging part even take a look at the virtual server configs? It does now. > Is clients.conf being read at "reload" ? I have to "restart" the server to > get the client back into the known list :( The clients aren't read on HUP. See the debug output for what's read on HUP. i.e. In CVS head, HUP *works*. Nothing bad happens, and *some* modules are reloaded. Even though not everything is reloaded... what *is* reloaded doesn't cause anything to crash. Alan DeKok.

2 1