June 2007 - Freeradius-Users - lists.freeradius.org

[meta] admin tools and utilities
by Hugh Messenger 29 Jun '07

29 Jun '07

Forgive me if meta-discussions are frowned upon. I was just wandering what tools and utilities (not shipped with freeradius) people find useful in day to day admin and testing. My vote goes to NTRadPing, a fully featured Windows take on the standard UN*X radping. Freebie, from http://www.dialways.com/download/. Very intuitive UI for creating, saving, loading and executing auth and accounting queries. Configurable dictionary file. I'd be lost without it. Something I'd really like to find is an 'unsolicited' test service, simulating a NAS listening on 1700, to help diagnose disconnect request issues. -- hugh

3 2

Banning users in a nice way...
by Arran Cudbard-Bell 29 Jun '07

29 Jun '07

Hi, Being a nice friendly openish institution, and not wanting to overload our helpdesk staff with hundreds of users trying to set up their laptops, we decided to make registration, a self service kind of affair. We decided to setup an unauthorised VLAN, on this VLAN there exists a support server , serving support pages. On wired connections, assigning users to this VLAN is fine .. our HP Procurve switches have a lovely feature called OpenVLAN which assigns users with broken supplicant software to an arbitrary VLAN. Unfortunately there is no such solution for the wireless access points.. *sigh*.. So we currently have to reject broken supplicants, failed authentication attempts etc ... Our solution to this is not as smooth as I would like ... and that is to create a second unauthenticated, unencrypted BSSID which is attached to our unauthorised VLAN. Users connect to this BSSID, register, setup their software, then connect to the 802.1x authenticated BSSID. What we really want to be able to do, is for users with broken software, force the wireless association to succeed, and put them on the unauthorised VLAN. Of course just sending a plain old Access-Accept packet isn't sufficient, as it requires the tunneled authentication to succeed as well... Has anyone got any ideas ? I'm assuming theres no way to do it.. Oh and by broken I mean windows XP type broken, as in will only attempt TLS authentication broken... and sends the username and password a user logged into the machine with by default broken... and so can never work out of the box broken. Theres no issues with Mac Users, everything works fine there. and were assuming people running linux are clever enough to setup x supplicant without support :) -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 3

RE: Sending CA certificate during EAP-TLS
by Josh Howlett 29 Jun '07

29 Jun '07

Hi Reimer, > How do you check if FreeRadius is actually sending the chain? I find Wireshark useful for this. It re-assembles the fragmented TLS handshake, which makes it much easier to understand... josh.

1 0

Sending CA certificate during EAP-TLS
by Rafa Marin 29 Jun '07

29 Jun '07

Hi all, Is there any way to configure free radius + eap-tls module to avoid to send CA certificate during EAP-TLS negotiation? As Free Radius is sending it right now EAP-TLS packets get fragmented and I would like to avoid it. Thanks in advance.

6 8

Re : Sending CA certificate during EAP-TLS
by Eshun Benjamin 29 Jun '07

29 Jun '07

Well in my current configuration I have the RADIUS server certificate in certificate_file and CA certificate in CA_file. But with that configuration , the radius server is still sending the CA certificate. The CA_path folder is empty and the CA_file is commented out. This should work for you. tls { # # These is used to simplify later configurations. # certdir = ${raddbdir}/certs cadir = ${raddbdir}/certs/trustedCA private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem # Trusted Root CA list - CA_path folder is empty # CA_file = ${cadir}/ca.pem CA_path = ${raddbdir}/certs/trustedCA dh_file = ${certdir}/dh random_file = ${certdir}/random # fragment_size = 1024 # include_length = yes # check_crl = yes # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "DEFAULT" #make_cert_command = "${certdir}/bootstrap" } ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Rafa Marín López <rafa.marinlopez(a)gmail.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cc : Rafa Marin Lopez <rafa(a)dif.um.es> Envoyé le : Mercredi, 20 Juin 2007, 18h10mn 12s Objet : Re: Sending CA certificate during EAP-TLS Reimer Karlsen-Masur, DFN-CERT escribió: Hi Karlsen, thanks for the answer, please see inline... > > Argh, your misunderstanding is because of the inline > documentation/default setup of the eap config file. > > *Trusted* CAs for client auth are stored in > > CA_file > > or > > CA_path > > So there is no conflict here with certificate_file option. > > And IMO usually CA_file and certificate_file should *not* contain the > same CA certs Well in my current configuration I have the RADIUS server certificate in certificate_file and CA certificate in CA_file. But with that configuration , the radius server is still sending the CA certificate. Having said that , your proposal was to not include the CA certificate in the RADIUS server certificate (in certificate_file variable) My RADIUS server certificate does not have the CA certificate included. Even so, the RADIUS server is including the CA certificate :(... any alternative solution?. > because I guess in the majority of cases the RADIUS server cert is > issued by some (commercial) server CA where as the client certs are > mostly issued by some home grown user CA. > > Saying that there might be cases where the CA certificates from > CA_file are indeed the CA chain certs of the RADIUS server > certificate..... > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

radclient and radtest.
by Diana Robert 29 Jun '07

29 Jun '07

hi, when i m using the radtest command to test the server, eg: radtest Mahalakshmi test localhost 0 testing123 i got Access- Accept Packet from server. but when i m using raclient, echo "User-Name = Mahalakshmi" | radclient localhost auth testing123 i got Access-Reject packet . can anyone say wat am i missing for radclient, thank u. --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 1

Problems with multiple groups in rlm_sql
by Pshem Kowalczyk 29 Jun '07

29 Jun '07

Hi, I'm trying to set up rlm_sql for users that belong to multiple groups. (1.1.6, postgresql 8.1). If user belongs to only one group - everything works fine - i.e. user can auth, gets correct attributes back. If I add the user to another group - it stops working all together - ie the user gets rejected. Database scheme and sql queries are default from the 1.1.6 version. Content of the database for the relevant user: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'przem' ORDER BY id; id | username | attribute | value | op ---------+----------+-----------+----------+---- 1944943 | przem | Password | xxxyyyzz | == (1 row) SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'przem' ORDER BY id; id | username | attribute | value | op ----+----------+-----------+-------+---- (0 rows) SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'przem' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; id | groupname | attribute | value | op ----+-----------+----------------+--------+---- 27 | DIALUP | Huntgroup-Name | DIALUP | == 28 | ADSL | Huntgroup-Name | ADSL | == (2 rows) SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = 'przem' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; id | groupname | attribute | value | op ----+-----------+-----------------+-------------+---- 37 | DIALUP | Framed-Protocol | PPP | := 38 | DIALUP | Service-Type | Framed-User | := 39 | ADSL | Framed-Protocol | PPP | := 40 | ADSL | Service-Type | Framed-User | := (4 rows) huntgroups file: DIALUP Huawei-Domain-Name == "ihug-dialup" WIREDCOUNTRY Huawei-Domain-Name == "ihug-pppoe-wc" ADSL Huawei-Domain-Name == "ihug-ubs" ADSL Huawei-Domain-Name == "ihug-dsl-pppoe" Debug is in the attached file. What am I missing here? kind regards Pshem

1 0

radclient
by Diana Robert 29 Jun '07

29 Jun '07

hi, i m using radclient with "auth" option to send a request packet to the server, now i want to know wat wil the other options namely auto, status, discover,coa do. and wat information has to be sent to the server if the corresponding option is used. thank you. --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0

Re: sqlippool reject authentication if no IP?
by Hugh Messenger 28 Jun '07

28 Jun '07

Peter Nixon <listuser(a)peternixon.net> said: > On Thu 28 Jun 2007, Alan DeKok wrote: > > Hugh Messenger wrote: > > > With my current configuration, if sqlippool cannot assign an IP, the > > > authentication still succeeds. > > > > The module returns NOOP. It could arguable return "fail". Just a nitpick, but for pool depletion it returns 'notfound'. > > > How can I set things up so if no IP is available, the authentication > > > will fail with some informative Reply-Message, like the simultaneous > use > > > session control does? > > > > Use configurable failover (see doc/configurable_failover). It's not > > yet integrated into the unlang nicely. I'd like to do that before > > releasing -pre2. > > Yeah. Its currently designed to allow you to run two copies of the module > side by side and have the second one assign the IP if the first one > doesn't > (Simply by listing one module after the other). This is to allow > replicated > pools on 2 different physical database servers. Additionally I use it with > one table for dynamic ips, and a separate table for "static" ips. OK, that makes sense. I see why it returns 'NOOP' rather than 'fail'. Wow, that was easy! Freeradius rocks. I just skimmed the configurable_failover doc, and tried this: post-auth { # Get an address from the IP Pool. sqlippool { # not much point auth'ing them if we can't give them an IP notfound = reject noop = reject } ... } ... which seems to do exactly what I need. When I add a second sql server, I'll work out how to handle the noop so it fails over, whilst still rejecting on a notfound. OK, that's the functionality. How about setting the "informative Reply-Message"? Even if the customer doesn't see them, at least it'll be in my Mtik logs. Speaking of which. What would be the simplest way of having an email alert if a 'notfound' happens? This is all for PPPOE wireless clients, which are carefully provisioned. So we should never end up running out of dynamic pool space, and I need to know about it if we do. > Peter Nixon > http://www.peternixon.net/ > PGP Key: http://www.peternixon.net/public.asc -- hugh

2 2

Windows sesion Login and Password
by alfonso celestino 28 Jun '07

28 Jun '07

Hi everybody! We need your help. We are using freeradius for wireless users authentication using WPA - PEAP - with login and password different of Windows sesion; but there are many many users who treating to authenticate with windows sesion login; Can We limit the number of attempts or send them a message that they have wrong configuration?? log(user attempting to authenticate with Windows sesio credencials) ... ... Thu Jun 28 09:40:56 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:40:56 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:40:58 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:40:59 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:40:59 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:01 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:01 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:02 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:04 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:04 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:04 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:07 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:07 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:07 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:11 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:11 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:11 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:14 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:14 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:14 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:17 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:17 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:17 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:19 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:20 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:20 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:22 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:22 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:23 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:25 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:25 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:25 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:27 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:28 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:28 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:31 2007 : Info: rlm_eap_mschapv2: Issuing Challenge Thu Jun 28 09:41:32 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client localhost port 0) Thu Jun 28 09:41:32 2007 : Auth: Login incorrect (rlm_ldap: User not found): [host/LPTCYP1] (from client MYNAS port 1 cli 0018DE1A62F3) Thu Jun 28 09:41:34 2007 : Info: rlm_eap_mschapv2: Issuing Challenge ... ... Thanks in advance Alfonso Celestino --------------------------------- Do You Yahoo!? La mejor conexión a Internet y 2GB extra a tu correo por $100 al mes. http://net.yahoo.com.mx

2 1