February 2007 - Freeradius-Users - lists.freeradius.org

VPN and Group Policy
by Berndt Sevcik 21 Feb '07

21 Feb '07

We are using a Cisco ASA Firewall for VPN access (lika a VPN3000). The RADIUS server should authenticate our users and assign them a group policy. Somewhere I read that I have to send the CLASS attribute in the RADIUS reply to assign the grou policy to a user. When I look at the debug output from the firewall I can see that the attribut is sent to the firewall. Also the access accept packet is received by the firewall. Radius: Code = 2 (0x02) Radius: Identifier = 17 (0x11) Radius: Length = 88 (0x0058) Radius: Vector: 2B9061A9AA15E08DA2F1FACCFFD012F7 Radius: Type = 25 (0x19) Class Radius: Length = 16 (0x10) Radius: Value (String) = 4f 55 3d 49 54 2d 53 65 72 76 69 63 65 3b | OU=IT-Service; ,,,,, rad_procpkt: ACCEPT RADIUS_ACCESS_ACCEPT: normal termination RADIUS_DELETE remove_req 0xf6d9874 session 0x208 id 17 free_rip 0xf6d9874 radius: send queue empty Is there an other attribut so send back? Something special to know about freeRADIUS config? Has someone a working config ore some tipps for me? Thanks in advance. Berndt ----------------------------------------- TGM - Die Schule der Technik IT-Service A-1200 Wien, Wexstr. 19-23 Tel. +43(1)33126/316 Fax: +43(1)33126/154 E-Mail: berndt.sevcik(a)tgm.ac.at -----------------------------------------

1 0

EAP on Cisco Cat2960 & Aironet1200: TLS Fails
by Senandung Mendonan 21 Feb '07

21 Feb '07

Hi, I'm setting up a secure authenticated wired and wireless network for a client of mine, closely following the following HOWTO documents:- http://vuksan.com/linux/dot1x/802-1x-LDAP.html integrating latest FreeRADIUS 1.1.4 with recently purchased (end 2006) Cisco Catalyst 2960 and Cisco Aironet 1200. We're attempting to do PEAP authentication with a mix of WinXP and MacOS X as supplicants. Details of each component:- 1. FreeRADIUS v1.1.4 - Running on FreeBSD 6.2-RELEASE, compiled via FreeBSD ports. The raddb config diffs comparing to sample configs:- http://absolute-p.ath.cx/Debug/DIFFS.txt - Nothing out of the ordinary (i.e. standard EAP-PEAP config, using simple users file for now) - The certs in certs directory are recreated as per FAQ item (i.e. via CA.all script + xpextensions). 2. Cisco Catalyst 2960 (show ver):- Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)SEE2, RELEASE SOFTWARE (fc1) Copyright (c) 1986-2006 by Cisco Systems, Inc. Compiled Fri 28-Jul-06 04:33 by yenanh 3. Cisco Aironet 1200 (show ver):- Cisco Internetwork Operating System Software IOS ™ C1200 Software (C1200-K9W7-M), Version 12.3(2)JA6, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2006 by cisco Systems, Inc. Compiled Fri 31-Mar-06 13:44 by pwade The Cisco Aironet 1200 configs closely follow this PDF document:- http://blog.segfault.be/Documentation/Wireles%20802.1x%20+%20PEAP%20with%20… resulting in this config:- http://absolute-p.ath.cx/Debug/aironet1200-config.txt (The author of the above document shared his working Aironet IOS version: c1200-k9w7-mx.123-8.JEA : I am planning to get hold of this and repeat tests). Problem: EAP Fails (Doesn't even get to TLS negotiation). In both cases, we get perpetual "Access-Challenge" messages sent by FreeRADIUS, at a very early stage — even before / during the initial TLS negotiation in EAP. Some FreeRADIUS debugging logs (radiusd -X):- I. Problematic Authenticators:- 1. Aironet 1200:- http://absolute-p.ath.cx/Debug/freeradius1.1.4-users-aironet1200-c1200-k9w7… 2. Cisco Catalyst 2960:- (I will update this post once I get hold of Cisco Catalyst 2960 debug info, which is similar to what I'm seeing with Aironet 1200). II. Working Authenticators:- Meanwhile, I also tested the same environment with the following authenticators, and got it working with no changes:- 1. Linksys WRT54GS (firmware v4.71.1 + hyperwrt-2.1b1-thibor15c):- All works OK with WPA Enterprise, as shown here:- http://absolute-p.ath.cx/Debug/freeradius1.1.4-users-linksyswrt54gs-4.71.1-… 2. Older Cisco Catalyst 2950:- I managed to get hold of an older Cisco 2950 model, with an earlier IOS version, and tested the same environment on it, this time it works! (I will update this post once I get its details and debugging output). This leads to a conclusion that something might be up with latest Cisco IOS implementation i.e. not playing nice with FreeRADIUS. Aside from expressing this issue with our local Cisco support (which I feel will be like barking to the right (but apathetic) tree , since I would think they only support Cisco / MS RADIUS products) ;-) ), I would appreciate if anybody here with experience with such equipment can shed some light on this issue. Thanks in advance! :) p.s. longer and constantly updated version of this post is in my blog:- http://absolute-p.ath.cx/2007/02/12/freeradius-vs-certain-recent-cisco-ios-… --mendonan "Yang mimpikan secangkir kopi panas dengan selimut.." (Dreaming of a cup of hot coffee, and a blanket..")

3 3

Problem with PEAP authentication
by jonr＠destar.net 20 Feb '07

20 Feb '07

Hello, I have a strange problem. I have about 65 users using wpa+PEAP+FreeRadius with Linksys WAP4400n APs. I have 3 buildings with 19 AP's per building using POE and wired back to a switch and each switch in each building uses an ethernet cable to tie into the main switch connected to the server. I have no LDAP or mysql backend and am just using the users file. Here is one of my users in the users file that is having problems: username Calling-Station-Id != "00-0F-B5-B5-35-2E", Auth-Type := Reject username User-Password == "password" Now this user sometimes connects successfully and sometimes he gets this error: Mon Feb 19 17:06:42 2007 : Auth: Login incorrect: [username/<no User-Password attribute>] (from client ShmAp-12 port 0 cli 00-0F-B5-B5-35-2E) Mon Feb 19 17:07:44 2007 : Auth: Login OK: [username] (from client UNKNOWN-CLIENT port 0) Notice the timestamp, this is not the only user this happens to about 20 of about 70 people on this setup. Please let me know what information I could provide that would help isolate this problem. I have found a hotfix put out by Microsoft, hotfix# 885453-x86 and it seems promising but I want to do some more testing before I recommend it. Thanks for any help or ideas, Jon

1 0

check active threads
by Andrew Long 20 Feb '07

20 Feb '07

freeradius 1.4 on CentOS 4.4 How can I verify the number of threads? I only see one process with > ps aux | grep radiusd I could have sworn I used to see each thread with 0.9 and I am concerned that the threads are not starting correctly as defined in radiusd.conf: thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } -- Regards, Andrew Long

3 3

rlm_passwd and Class -attribute
by Lasse Karstensen 20 Feb '07

20 Feb '07

Hello. We're running freeradius 1.0.5 on SLES9, and are trying to set up FR to work against a cisco vpn concentrator. We're using rlm_passwd as backends, both crypt and mschapv2-hashes.(NT-Password) As we've got different groups in vpn, we need to set the Class -attribute in replies sent back to the NAS. This Class -attribute is based on with password file (rlm_passwd) that had the user in question. Previously I've just hacked this together with Exec-Program-Wait in the users -file and a shell script, but I'm now looking for a cleaner solution. Any help appriciated. -- Lasse

2 3

attr_rewrite
by Ben Butler 20 Feb '07

20 Feb '07

Hi, I am having some problems with attr_rewrite. What I want to do is the following at a pre authorisation phase: User-Name = username(a)somedomain.com To User-Name = somedomain.com I want to call by attr_rewrite function for each of the domains that I want to stip the username from prior to authorisation. This is what I have in radiusd.conf: attr_rewrite checkdomain1 { attribute = User-Name searchin = packet searchfor = ".(a)domain1.net" replacewith = "domain1.net" ignore_case = yes new_attribute = no max_matches = 10 append = no This is kind of working but =mMy problem is that I am not sure what to use in the regular expersion for the match query: I have tried .(a)domain1.com, ^$(a)domain1.com, ?(a)domain.com, \w.(a)domain.com I have read the list history and trawlled google and I guess I am just not bright enough to get these pesky (ir)regular expressions! Can someone please tell me what I need to put in here: searchfor = ".(a)domain1.net" To match: anything(a)domain1.net Why Am I doing this??? ---------------------- DSL Wholesale Layer2 Tunneling Switch - (LTS) 1 querries my Radius Server 1 for tunnel paramaters. Radius Server 1 will then for: user(a)mydomain.com into various Tunnels / groups swtiched based on full username to NAS1,2,3 etc domain1.com classify any users at this domain into tunnel1 and switch to LTS 2 domain2.com classify any users at this domain into tunnel2 and switch to LTS 2 Because I dont know the users in domain1&2, I cant authenticate using the fully qualified username, and for other reasons it is not possible to set LTS1 to athenticate its tunnels based on realm rather than username, it has to use username. So -tThis above is why I am trying to rewrite the user to be just a realm in radius server 1 for domain 1&2.net For those that are intersted, what happens next is... LTS 2 then looks up in another radius server (radius 2) for the tunnel ID where to switch the tunnel to for the terminating NAS for that partner/reseller. This NAS will then query its radius server (a third party) to handle the actual user authentication and PPP paramaters. For mydomain.com NAS1,2,3 will querry radius server 3 for the authentication of my own users and PPP paramaters. So: DSL Wholesale LTS -> In house NASes or In house LTS boxes In house LTS boxes -> Partner NASes Kind Regards Ben

3 6

Re: log to mysql?
by Phil Mayers 20 Feb '07

20 Feb '07

Arjuna Scagnetto wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > thanks for answering about the possibility to send the log to mysql > directly from radius. Please don't email me directly, I'm not a helpline. The mailing list is there for a reason. > > But :) could you send me some more infos plz. > > The logs are about everything concern freeradius and not only about > auth/acct on a mysql server. Is it realy possible? I'm sure there are a million ways of sending the non-accounting logs to SQL, but why would you want to - in normal (non-debugging) mode, the FreeRadius logs are basically useless.

2 1

Re: EAP-MD5 test
by Amin BEN ABDALLAH 20 Feb '07

20 Feb '07

Thanks, it works successfully now, but is it possible to choose different EAP Methods for different EAP users. Amin BEN ABDALLAH On Mon, 19 Feb 2007 23:22:44 +0000, Phil Mayers wrote > Amin BEN ABDALLAH wrote: > > > > I am a new user of Radius Server and I want to know > > how to test the authentification of an EAP-MD5 user > > using radtest, radclient or radeapclient. > > > > > > *users file :* > > ___________________________________________________________________ > > ali Auth-Type := EAP, User-Password == "ali" > > Reply-Message = "success" > > Auth-Type needs to die. I seriously think it should be replaced with > an attribute named: > > I-Should-Not-Be-Setting-Auth-Type-I-Acknowledge-What-I-Am-Doing-Is-Wrong > > * don't set Auth-Type > * use := for password > > That is: > > ali User-Password := "ali" > Reply-Message = "success" > > Try again with this. If it fails, repost and when showing debug > output, don't trim it. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

New to FreeRadius, having a small issue
by Marc Hultquist 20 Feb '07

20 Feb '07

Hey Everyone, I am new to freeradius, and when receiving a auth request to the server, in the /var/log/radius/radiusd.log file, I get the following line whenever the auth request comes though. ---- Mon Feb 19 12:29:46 2007 : Error: Invalid operator for item User-Password: reverting to '==' ---- If anyone could point me in the direction of a document or manual on how i could fix this, would be appretiated, i checked the man pages but dont see anything specific there towards my problem, and well to be honest I just dont seem to be able to find a relevant document for FreeRadius on this error. Any help would be appretiated. Kind Regards - Marc

2 3

FreeRADIUS + LVS problem
by Sam Schultz 20 Feb '07

20 Feb '07

According to my research, FreeRADIUS supposedly does work from behind an LVS load balancer. My current configuration works perfectly outside of the LVS, but once it is put behind the LVS it ceases to work. Connections seem to succeed even behind the LVS, until they get to an access challenge, where I get: rad_recv: Access-Challenge packet from host 192.168.240.111:5058, id=42, length=64 Authentication reply packet code 11 sent to a non- proxy reply port from client WPA_Test:5058 - ID 42 : IGNORED >From what little information I could find on this, it looks like the freeradius thinks these are proxied requests due to ip mangling done by the LVS load balancer (Basically, it's a 1:1 NAT). Has anyone come across anything like this? Any pointers for work- arounds would definitely be appreciated. P.S. Alan, I would definitely think this (LVS + FreeRADIUS) would be a good topic for your book -- Click for free info on adult education and start making $150k/ year http://tagline.hushmail.com/fc/CAaCXv1S62Uaoe8eWguezq8EENBamjiB/

4 12