November 2008 - Freeradius-Users - lists.freeradius.org

Modifying AVPs when acting as a proxy
by Olli Salonen 05 Nov '08

05 Nov '08

Hello, I have a problem with my NAS and my current RADIUS server. The RADIUS server is responding with 2 vendor-specific AVPs, which my NAS is not able to understand. However, there are corresponding vendor-specific AVPs in my NAS as well. Could I install FreeRADIUS as a proxy between my current NAS and RADIUS server and have it somehow modify the answer I get from my current RADIUS, effectively acting as a translator between my two current nodes? Cheers, -olli

2 1

Re: Freeradius-Users Digest, Vol 43, Issue 17
by Rolando Tejada 05 Nov '08

05 Nov '08

hi, i would like to know if somebady can help me to configurate a cautive portal in monowall to autenticate user in freeradius.

2 1

freeradius-1.0.5_EAP-TTLS_MSCHAPv2 auth issue
by Prasad Parab 05 Nov '08

05 Nov '08

Hi all, Kindly help me with the issue involving freeradius-1.0.5 for EAP-TTLS_mschapv2 auth type. ** *SEPUP:* ** *WIN XP (wifi client) <-------> AP <----------> freeradius-1.0.5* *EAP-TTLS_mschapv2 authenticator eap type = ttls* Attached is the debug log and eap.conf file. *But with same setup EAP-TTLS with mschap works*. Pls advice if my eap.conf is wrong ?? Regards Prasad

2 4

Trouble using % percent sign in usernames with MySQL auth
by Jonas Frey 05 Nov '08

05 Nov '08

Hello, i am running into problems while using usernames which include a percent % sign. The rlm_sql_mysql module apparently translates these into the ascii of "=25". So a username which was isp/somebody%somewhere gets translated into isp/somebody=25somewhere. Additionally these users are listed incorrect via dialup admin. If you click on their names (even if they include the =25) you cant administer them since dialupadmin apparently strips out the equalsign (as well as the percent sign). Is anyone observing similar behaviour and/or knows of a fix? Regards, Jonas

2 1

Re: Unable to authenticate to Open Directory
by Kerry Tobin 04 Nov '08

04 Nov '08

I think we're back to what I had been trying to do on my test machines now and still can't seem to get working. When I add "DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To- Realm := DOMAIN" to users of the first server (I believe that's the correct place to put it). I get "rlm_eap: Request is supposed to be proxied to Realm DOMAIN. Not doing EAP." on the first server and the proxy server still says " rlm_eap: Identity does not match User-Name, setting from EAP Identity." Thanks, Kerry Tobin On Nov 4, 2008, at 1:04 PM, freeradius-users-request(a)lists.freeradius.org wrote: > > Message: 1 > Date: Tue, 04 Nov 2008 17:39:50 +0100 > From: <tnt(a)kalik.net> > Subject: Re: Unable to authenticate to Open Directory > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <0PGr4bPr.1225816790.3478220.tnt(a)kalik.net> > Content-Type: text/plain; charset=ISO-8859-2 > >> OK, I've tried using a proxy and now it fails on rlm_eap and says the >> User-Name doesn't match EAP Identity. Is there a way to have EAP >> processed on the local machine but authentication happen on the >> remote? Is that even the problem? >> > > DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := DOMAIN > > That will proxy only the inner tunnel. > > Ivan Kalik > Kalik Informatika ISP >

2 1

Re: Re: EAP - TLS Client Certification Stored Removable Media
by Aydın KOÇAK 04 Nov '08

04 Nov '08

Hello ; Thank you for your replays... You are rigth it isn't related radius... I can do it but it is take a time... Thank You, Aydin KOCAK.

1 0

rlm_ldap and Stripped-User-Name
by Luke 04 Nov '08

04 Nov '08

I'm trying to use rlm_ldap to do group lookups for dynamic vlan assignment. I've got freeradius (version 2.1.1) to connect to my ldap server, but when it tries searching, it's not working correctly. I'm not getting a Stripped-User-Name, and the non-stripped user name is coming across as "<domain>\5c<username>". I've been looking around for a couple of hours now, and have yet to find out how to make it either a) give me a stripped user name or b) figure out some way to strip the username myself. I was trying to use something I had found before where someone was using attr_rewrite to manually create the Stripped-User-Name, but it wasn't working at all. The first part was copying User-Name into Stripped-User-Name, and since the original username happens to have the string \t in it, it was interpreting that as a tab, instead of straight copying the text. Then when I tried to do regex replacement on it, the string was in this crazy state where it had a bunch of extra spaces in it due to the \t being interpreted as a tab. Can someone help me out with this? I'm not sure what I'm doing wrong that's preventing the Stripped-User-Name from working in the first place, or how to work around the fact that the attr_rewrite is not directly copying the text into my variable, and is instead interpreting it. Thanks, Luke

1 1

WiFI EAP-PEAP with VLAN
by Dajka Tamás 04 Nov '08

04 Nov '08

Hi all, Is it possible to include a VLAN tag in the reply, so that client is assigned to the appropirate VLAN based on it's auth group ( so, if USER_A is member of GROUP_A, than it's assigned to VLAN_A) Is this possible? Or should be done elsewhere, than the radius? Thanks, Tamas

4 3

My problem: user supplied CHAP-Password does NOT match local User-Password
by Zhifeng Yang 04 Nov '08

04 Nov '08

Hello, everybody I've setup FreeRadius based on MySQL in Debian system. The system passed local test, but failed with remote user login request from a Coovachilli portal. It really confused me, because I always get following log message in FreeRadius debug mode: auth: user supplied CHAP-Password does NOT match local User-Password I am SURE I input correct password. I wonder if anybody can kindly give me any hints to resolve this issue. Here are details about: OS: Debian version 4.0 r5 FreeRadius: 1.1.3 (this is the newest stable version I can apt-get for Debian) MySQL server and client 5.0 CoovaChilli: CoovaAP 1.0 beta7d (this is firmware for Linksys box with CoovaChilli integrated) This is item in radcheck table: +----+------------+---------------+----+------------+ | id | UserName | Attribute | op | Value | +----+------------+---------------+----+------------+ | 9 | chillispot | User-Password | := | chillispot | And, this is message I have in FreeRadius log: --------------------------------------------------- rad_recv: Access-Request packet from host 192.168.0.130:2085, id=69, length=301 ChilliSpot-Version = "1.0.11" User-Name = "chillispot" CHAP-Challenge = 0x51239bfb2d63ea383f908d3f255915cb CHAP-Password = 0x00edbc2df1249e7552bdf39f05fa465234 NAS-IP-Address = 192.168.0.130 Service-Type = Login-User Framed-IP-Address = 10.1.0.2 Calling-Station-Id = "00-14-A5-62-AB-2B" Called-Station-Id = "00-18-39-C6-0D-C0" NAS-Identifier = "00-18-39-C6-0D-C0" Acct-Session-Id = "491058fb00000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 WISPr-Location-ID = "isocc=,cc=,ac=,network=Coova,Coova" WISPr-Location-Name = "My_HotSpot" WISPr-Logoff-URL = "http://10.1.0.1:3660/logoff" Message-Authenticator = 0x103de768642d50fd1afaacaa5780a226 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 12 modcall[authorize]: module "mschap" returns noop for request 12 rlm_realm: No '@' in User-Name = "chillispot", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 12 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 12 radius_xlat: 'chillispot' rlm_sql (sql): sql_set_user escaped user --> 'chillispot' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'chillispot' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 1 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'chillispot' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'chillispot' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'chillispot' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 1 modcall[authorize]: module "sql" returns ok for request 12 modcall: leaving group authorize (returns ok) for request 12 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied CHAP-Password does NOT match local User-Password auth: Failed to validate the user. ------------------------------------------------- Thanks in advantage! Steven Yang

2 1

Add reply attributes to a proxy radius response
by Paul TAVERNIER 04 Nov '08

04 Nov '08

Hi all, I run with Freeradius 2.1, CiscoASA and RSASecurid "OTP"+RSARadius. I set my CiscoASA to authenticate against freeradius. On this freeradius server, i created a realm "OTP" which proxy the request to a RSARadius (the only one who can ask RSAOTP Securid database). So when i authenticate with myuserlogin@OTP/Passcode with my CiscoVPNclient, the authentication is successful. No pb. Here's the log: ======(log) [suffix] Looking up realm "otp" for User-Name = "xxxxxxxxxx@otp" [suffix] Found realm "otp" [suffix] Adding Stripped-User-Name = "xxxxxxxxxx" [suffix] Adding Realm = "otp" [suffix] Proxying request from user xxxxxxxxxx to realm otp [suffix] Preparing to proxy authentication request to realm "otp" ++[suffix] returns updated ... rad_recv: Access-Accept packet from host 192.168.1.1 port 1812, id=4, length=85 Class = x53425232434cd5a0c3accfca8fd9efc01180270180038198 Proxy-State = 0x313530 ======(end of log) The second thing i want to do is to "import" the user's "policy group" (radiusClass) and its own IP Address (radiusFramedIPAddress). Those attributes are located in a LDAP directory server. So i decided to add the "ldap" module in the authorization section of my freeradius conf files. In the logs, i clearly see that freeradius is doing a great job (asking and receiving my ldap attrs) ======(log) [ldap] performing user authorization for xxxxxxxxxx WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=xxxxxxxxxx) expand: o=gouv,c=fr -> o=gouv,c=fr rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection ... rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=gouv,c=fr, with filter (uid=xxxxxxxxxx) [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... rlm_ldap: radiusClass -> Class = 0x646976696e666f rlm_ldap: radiusFramedIPAddress -> Framed-IP-Address = 1.2.3.4 WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] Setting Auth-Type = LDAP [ldap] user xxxxxxxxxxx authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ======(end of log) My problem is that that finally i get 2 successful auth (i interpret it like these sorry...), and Freeradius "chooses" Auth-Type=Accept (ProxyRSARadius Response which doesn't contain my class and framedipaddress i need to push to my CiscoASA) ======(log) Found Auth-Type = LDAP Found Auth-Type = Accept Warning: Found 2 auth-types on request for user 'xxxxxxxxxxx' Auth-Type = Accept, accepting the user +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 150 to 192.168.1.2 port 1025 Class = 0x53425232434cd5a0c3accfca8fd9efc0118027018 Finished request 0. ======(end of log) In other words (sorry for being so long), i would love to authenticate againt my OTP RSASecurid boxes and concatenate Radius attributes found in a LDAP directory... Where should i go? post_proxy module? Any help would be greatly appreciated. Kind regards, Paul -- ============================ Paul TAVERNIER Equipe Reseaux-Securite Division Informatique Rectorat de ROUEN

2 2