March 2007 - Freeradius-Users - lists.freeradius.org

Re: EAP-TTLS outer identity & accounting
by Sam Schultz 20 Mar '07

20 Mar '07

After alot of experimenting & researching, I still haven't found a solution to the TTL anonymous outer identity being used for accounting. I have set a DEFAULT entry that sets the User-Name attribute via ':=', but I still end up with two User-Name attributes (anonymous identity & real identity). This is especially strange, since use_tunneled_reply & copy_request_to_tunnel are both enabled as well. If I understand correctly, := should replace the anonymous (first) User-Name value with the real (second) value permitting they are in the same session. Upon looking back at the debug output, it looks like the tunneled request is actually handled as if it were a seperate request than the one containing it (request->eap module-(unpack)- >new request). This would explain why two User-Name attributes are showing up in the final response. Is there any way to discard the first (anonymous) entry via a module or other method without hacking FR code? Surely someone has this working. My setup is just basic TTLS-PAP auth'ing against LDAP. P.S. A link to a list of known-good access points, or personal recommendations on access points would also be appreciated. We will be replacing a few 3com APs soon because they don't play well with...well...ANYTHING. One (3com OfficeConnect) doesn't even have options for radius account, even though it advertises the feature right on the box. -- Click for free info on criminal justice degrees and make $150K/ year http://tagline.hushmail.com/fc/CAaCXv1S4xqOnm2zOGqjRJ3VXHodSBUi/

3 2

problem with rlm_sql or mysql-server ?
by Mathieu Lemaitre 20 Mar '07

20 Mar '07

Hi everybody, I have a problem with freeradius 1.0.2 and mysql 4.0.24, on a debian stable, used for about 1700 clients. I often have (about 10 times an hour) errors like these: Tue Mar 20 12:21:29 2007 : Auth: Login incorrect: [XXXX/YYYYY] (from client ZZZZ port 0) Tue Mar 20 12:21:40 2007 : Info: rlm_sql (sql): No matching entry in the database for request from user [XXXXX] Tue Mar 20 12:21:40 2007 : Auth: Login incorrect: [XXXXX/YYYYY] (from client ZZZZ port 0) Tue Mar 20 12:22:00 2007 : Info: rlm_sql (sql): No matching entry in the database for request from user [XXXXX] Tue Mar 20 12:22:00 2007 : Auth: Login incorrect: [XXXXX/YYYYY] (from client ZZZZ port 0) Tue Mar 20 12:22:21 2007 : Auth: Login OK: [XXXXX/YYYYY] (from client ZZZZ port 0) whereas, of course, the username exists, and the pass didn't change... is this a problem with the freeradius config, or is the mysqlserver too busy? thanks for your answers, Mathieu

2 1

freeradius don't start!!
by peppeska 20 Mar '07

20 Mar '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 debian:/etc/freeradius# /etc/init.d/freeradius start Starting FreeRADIUS daemon: freeradiusSun Mar 18 19:29:57 2007 : Info: Starting - reading configuration files ... . debian:/etc/freeradius# /etc/init.d/freeradius stop Stopping FreeRADIUS daemon: freeradius/var/run/freeradius/freeradius.pid not found.... debian:/etc/freeradius# freeradius.pid not found ??? what??? - -- <<<<---------------------------------------------------------->>>> |Giuseppe Moscato aka peppeska - Linux User - no html messages---| |donpeppiniello(a)tiscali.it - http://peppeska.altervista.org------| |Fingerprint = 90DC 05A8 2D65 BC04 BD1B 4C07 C389 434B 3201 319D| <<<<---------------------------------------------------------->>>> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.3 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org iD8DBQFF/uEqkA6hcnFZI/YRAmqKAKDMzSBvtq9J1kjS7XnNjZiFzJZUbACfbI+a M7u3iIzlAGCQt6ZEX27caQ8= =Y+O/ -----END PGP SIGNATURE-----

2 3

Question on Accounting Proxy Features?
by WRIGHT Alan 20 Mar '07

20 Mar '07

Hi Folks, I am newbie to Freeradius and considering using it. However, I have a specific requirement, which I cannot find any info on either on Web Search or Wiki or FAQ. I wish to use Freeradius as an Accounting Proxy, essentially to copy a Accounting Request to a server. The Freeradius box will be placed after an existing Radius box which will send the accounting info to it. However, there are some requirements. 1. Freeradius needs to proxy accounting to another server 2. Freeradius needs to provide an accounting response to the first radius box, without waiting for a response from the proxied Server Is this possible with Freeradius today? Thanks Alan

2 1

Issues with rlm_pap
by Deramus, Chris 20 Mar '07

20 Mar '07

To all, I am finally attempting to upgrade from version 1.1.3 to 1.1.5 and have encountered an issue when attempting to use pap to authenticate users with the new auto_header feature. The Cisco NAS I have used over the past three years has always sent the user password to FreeRADIUS in clear-text, and then I would have encryption_scheme set to MD5 to compare the sent password to the MD5 value in the database. This no longer seems to work, as FreeRADIUS seems to be attempting to compare the clear-text password with the MD5 password returned from the database. I'm guessing it's an oversight on my end, and wanted to see if anyone on this list noticed anything. I have included portions of my radiusd.conf and users files which are pertinent to this issue. users //---------- DEFAULT NAS-IP-Address == "192.168.1.1", Autz-Type := sql1 DEFAULT NAS-IP-Address == "192.168.2.1", Autz-Type := sql2 radiusd.conf //---------- modules { pap { auto_header = yes } } authorize { preprocess autztype sql1 { sql } autztype sql2 { sql2 } files pap } authenticate { Auth-Type PAP { pap } } rad_recv: Access-Request packet from host 192.168.1.1:32805, id=3, length=70 User-Name = "test.user" User-Password = "testpassword" CVPN3000-Auth-Server-Priority = 2 NAS-IP-Address = 192.168.1.1 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 users: Matched entry DEFAULT at line 151 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 Found Autz-Type sql1 Processing the authorize section of radiusd.conf modcall: entering group sql1 for request 0 radius_xlat: 'test.user' rlm_sql (sql): sql_set_user escaped user --> 'test.user' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE UserName = '265100' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 9 radius_xlat: '' radius_xlat: '' radius_xlat: '' rlm_sql (sql): Released sql socket id: 9 modcall[authorize]: module "sql" returns ok for request 0 modcall: leaving group sql1 (returns ok) for request 0 auth: type Local auth: user supplied User-Password does NOT match local User-Password auth: Failed to validate the user. Login incorrect: [test.user/testpassword] (from client 192.168.1.1 port 0) Delaying request 0 for 2 seconds Finished request 0 Thanks in advance, Chris DeRamus HQ VPN Administrator SAIC

2 3

Proxying Eap Requests in round robbin.
by Arran Cudbard-Bell 20 Mar '07

20 Mar '07

Hi, I have two backend RADIUS servers with a front end proxy server. All servers are running 1.1.5. Authentication type is EAP-PEAP. On the front end i've got a stripped down radiusd.conf just doing Realm detection and proxying. And a proxy.conf realm sussex.ac.uk { type = RADIUS authhost = radius1.uscs.susx.ac.uk:1812 accthost = radius1.uscs.susx.ac.uk:1813 secret = 31charhashedsecret ldflag = round_robin nostrip } realm sussex.ac.uk { type = RADIUS authhost = radius2.uscs.susx.ac.uk:1812 accthost = radius2.uscs.susx.ac.uk:1813 secret = 31charhashedsecret ldflag = round_robin nostrip } Whats happening if the first round of authentication will go to radius1.uscs.susx.ac.uk Second will go to radius2.uscs.susx.ac.uk, but the second doesn't know about the previous request and bails out with. modcall: entering group authenticate for request 0 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request So firstly is EAP proxying actually possible ? Secondly is there something really stupid i've missed ? There are two ways I can see this working, either the proxy server directs all the authentication rounds for one session to one proxy server. Or the eap module on either backend instance figures out what the previous part of the conversation was. Also I noticed this entry in eap.conf # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 Anyone know where this list actually exists ? If it's just in memory or an actual file ? Thanks, Arran Cudbard-Bell -- Arran Cudbard-Bell (ac221(a)sussex.ac.uk) Authentication Authorisation & Accounting Officer Infrastructure Services | ENG1 FF08 EXT:3900

2 1

Nested VSA
by Nitin Naveen 20 Mar '07

20 Mar '07

Hi, I want to add new VSA parameters to freeradius. This means that I need to add a new dictionary file. But I am not able to understand is how do I add attributes whose value is another attribute. For eg. ATTRIBUTE NITIN----> NAVEEN Where NAVEEN is ATTRIBUTE NAVEEN 10 integer. Kindly help. Regards Nitin ************************************************** DISCLAIMER ************************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ****************************************************************************************************************************

2 1

Re : Re : CA.all
by Eshun Benjamin 20 Mar '07

20 Mar '07

The link below works fine, http://www.missl.cs.umd.edu/wireless/eaptls/doc/CA.all ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : "tnt(a)kalik.co.yu" <tnt(a)kalik.co.yu> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 19 Mars 2007, 16h45mn 26s Objet : Re: Re : CA.all http://www.openssl.org/ Dana 19/3/2007, "Eshun Benjamin" <bkeshun(a)yahoo.fr> piše: >Who has CA.all script for generating test certificates for testng purpose on radius. Link me up. > >================================================== > >Benjamin K. Eshun > >----- Message d'origine ---- >De : Alan DeKok <aland(a)deployingradius.com> >Ŕ : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> >Envoyé le : Lundi, 19 Mars 2007, 9h31mn 22s >Objet : Re: Authentication against an executable and mysql > >Kenneth Penza wrote: > >> I am trying to get user authenticated against a >> shell script. I have added the following configuration >> to freeradius: >> >> under the modules section i have added >> exec myauth { >> wait = yes >> program = >> "/etc/raddb/myscripts/auth.sh %{User-Name}" >> input_pairs = request >> output_pairs = reply >> packet_type = Access-Request >> } >> and under the authorize section I have added >> myauth > > And what's in the "authenticate" section? You say you want to >authenticate, but you haven't touched any of the "authenticate" >configuration. > > If you're just executing a shell script, see "Exec-Program-Wait", it's >in the documentation. > > Alan DeKok. >-- > http://deployingradius..com - The web site of the book > http://deployingradius.com/blog/ - The blog >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > > > > > > >___________________________________________________________________________ >Découvrez une nouvelle façon d'obtenir des réponses ŕ toutes vos questions ! >Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses >http://fr.answers.yahoo.com > - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

1 0

automated response
by Olaf Becker 19 Mar '07

19 Mar '07

Dear Sender, I will be out of the office till the 1st of April 2007. During this time I will have no access to my emails. Kind Regards, Olaf Becker TRUST.WIZCOM. by Travelport

1 0

simultaneous-use per NAS
by Marc Boisis-Delavaud 19 Mar '07

19 Mar '07

Hello, Is it possible to "allow only one authentication per NAS" but "not allow many authentication on the same NAS" per user ? ex: toto authenticate on NAS1 and NAS2 simultaneous toto can't authenticate two times on NAS1 simultaneous

2 1