November 2008 - Freeradius-Users - lists.freeradius.org

How to test whether EAP-PEAP works?
by Sebo PL 27 Nov '08

27 Nov '08

Hi all! Is it possible to test whether EAP works from the shell? I'm looking for something simullar to: $ radtest And the only thing I found is this: http://wiki.eduroam.cz/rad_eap_test/ But I'm confused about this script cause I just can't see any 'chalange' or etc in # freeradius -X when $ rad_eap_test I use freeradius-1.1.7@Debian. Here is the output of: # freeradius -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/freeradius/proxy.conf Config: including file: /etc/freeradius/clients.conf Config: including file: /etc/freeradius/snmp.conf Config: including file: /etc/freeradius/eap.conf Config: including file: /etc/freeradius/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/freeradius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/freeradius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/freeradius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/freeradius/freeradius.pid" main: user = "freerad" main: group = "freerad" main: usercollide = no main: lower_user = "before" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "/etc/shadow" unix: group = "(null)" unix: radwtmp = "/var/log/freeradius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = yes eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/freeradius/peap/radsrv.key" tls: certificate_file = "/etc/freeradius/peap/radsrv.pem" tls: CA_file = "/etc/freeradius/peap/root.crt" tls: private_key_password = "99e7c2a6d917239f32ebf9cbffebb062" tls: dh_file = "/etc/freeradius/peap/dh" tls: random_file = "/etc/freeradius/peap/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = yes peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/etc/freeradius/huntgroups" preprocess: hints = "/etc/freeradius/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/freeradius/users" files: acctusersfile = "/etc/freeradius/acct_users" files: preproxy_usersfile = "/etc/freeradius/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/freeradius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:1089, id=0, length=123 User-Name = "sebopl" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "70-6F-6C-69-73-68" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "rad_eap_test + eapol_test" EAP-Message = 0x0200000b017365626f706c Message-Authenticator = 0xc1f9054dc966ca6d78baa2e7ac480605 rad_lowerpair: User-Name now 'sebopl' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "sebopl", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry sebopl at line 89 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 127.0.0.1 port 1089 Reply-Message = "Welcome %u :)" Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 492e9f4f Nothing to do. Sleeping until we see a request. And here is: $ rad_eap_test -H localhost -P 1812 -S test1 -u sebopl -p password -m WPA-EAP -c -e PEAP access-reject; 2 Sending RADIUS message to authentication server RADIUS message: code=1 (Access-Request) identifier=0 length=123 Attribute 1 (User-Name) length=8 Value: 'sebopl' Attribute 4 (NAS-IP-Address) length=6 Value: 127.0.0.1 Attribute 31 (Calling-Station-Id) length=19 Value: '70-6F-6C-69-73-68' Attribute 12 (Framed-MTU) length=6 Value: 1400 Attribute 61 (NAS-Port-Type) length=6 Value: 19 Attribute 77 (Connect-Info) length=27 Value: 'rad_eap_test + eapol_test' Attribute 79 (EAP-Message) length=13 Value: 02 00 00 0b 01 73 65 62 6f 70 6c Attribute 80 (Message-Authenticator) length=18 Value: c1 f9 05 4d c9 66 ca 6d 78 ba a2 e7 ac 48 06 05 Received RADIUS message RADIUS message: code=3 (Access-Reject) identifier=0 length=35

3 2

new to radius: wireless ap with radius: TLS problem ?
by Jerome Blomart 27 Nov '08

27 Nov '08

Hello, i am new to freeraidus. Have set up a radius server for a linksys ap. - debian server: compiled a freeradius with eap/tls support - mysql db: - tried "dialupadmin" and "phpMyprepaid": but those had problems in their "sql" scripts ( default values for timestamp and smallint ). - corrected sql scripts and created database - as i have applied the scripts from multiple sources on the same db, the tables structures are a bit special comparing to tutorials stuff - access point ( linksys ): - configured : - RADIUS server name ( ip address given ) - RADIUS port - shared pass phrase ( NAS sghared secret given -- configured in mysql's radius.nas table ) - generated four keys ( to complie with the linksys's dialogs ) Now : As i try Wireless clients connections : - the client connects to the wireless network, and tries to get an ip address....but no...after retries it disconnects to the network What is happenning: - in the freeradius's outpput i ca

2 1

SOS FreeRADIUS
by ELOM ETSE 27 Nov '08

27 Nov '08

I'm a user of daloRADIUS. I set up successfuly coovaAp for redirection. Now i want to configure FreeRADIUS for authentification. Here are some settings: Server FreeRADIUS: Bind address: * Port: 0. Must i use Listen options and add the real address? that is 192.168.1.14? What about clients.conf file? Must i add also the NAS address or set it on 127.0.0.1? I ask these questions because of the fact that radtest didn't match with these settings! I need your help because i'm just a beginner! ________________________________ ETSE Elom, Etudiant en fin de formation en informatique au CIC/UL-TOGO ________________________________

4 3

EAP-SIM
by Fernando 27 Nov '08

27 Nov '08

Hi all, I'm trying to configurate a basic scenario form EAP-SIM using wpa_supplicant like client, hostapd like access point and freeradius like AAA server. So, I don't know how to configure EAP-SIM in freeradius as default EAP method. Could somebody provide me with a configuration for freeradius? Thanks, Fernando.

2 3

My error:
by Martin Silvero 27 Nov '08

27 Nov '08

Hello! but this log are of Radius, you tell me a problem is in the supplicant? but I try with many supplicant and I have the same error. Ever had a case like this? because I come with this problem long ago and do not get results despite dealing with various forms and follow the documentation. thanks again.

1 0

attr_filter issue
by Mustapha Bouikhif 27 Nov '08

27 Nov '08

Hi Folk, I have activated attr_filter for a realm (dr4.cnrs.fr) and want users from that realm to have 2 possible values of VLANs (VISITEUR or SIRC) Here is my attr_file: dr4.cnrs.fr Service-Type == Login-User, Framed-IP-Address == 255.255.255.254, Framed-MTU >= 576, Proxy-State =* ANY, Reply-Message =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, State =* ANY, Session-Timeout <= 28800, Idle-Timeout <= 600, Port-Limit <= 2, Proxy-State =* ANY, MS-MPPE-Recv-Key =* ANY, MS-MPPE-Send-Key =* ANY, User-Name =* ANY, Called-Station-Id =* ANY, Calling-Station-Id =* ANY, NAS-Port-Type =* ANY, NAS-Port =* ANY, NAS-IP-Address =* ANY, NAS-Identifier =* ANY, Framed-Filter-ID =* ANY, Tunnel-Type == VLAN, # Tunnel-Type =* ANY, Tunnel-Medium-Type == IEEE-802, # Tunnel-Medium-Type =* ANY, Trapeze-VLAN-Name == VISITEUR, Trapeze-VLAN-Name == SIRC, # Trapeze-VLAN-Name =* ANY, Tunnel-Private-Group-Id == VISITEUR, Tunnel-Private-Group-Id == SIRC # Tunnel-Private-Group-Id =* ANY When i test the connexion with my account (my attribute Tunnel-Private-Group-Id = Trapeze-VLAN-Name = VISITEUR), the authentification is OK but radius server do not send this attribute to the NAS: they are filtered and they should not. When I set those attributes to * ANY, every thing works well. I don't understand this behaviour. Thanks for any ideas/help -- Mustapha BOUIKHIF Service Systèmes d'Information CNRS - DR4 tel: +33 1 69 82 33 97 fax: +33 1 69 82 33 39

3 5

Somewhat OT: Mac OS self asigned IP issues
by Sergio Belkin 27 Nov '08

27 Nov '08

Hi, I am using OpenWRT Kamikaze and sometimes there is a problem with Mac OS clients. Clients get Access-Accept, but Mac OS says that only gets a self asigned IP and then it can't surf the web. Problem happens using either TTLS or PAP. It is a problem of Mac OS or a OpenWRT one? I'd be glad to read suggestions and comments... Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

3 2

combining LDAP and SQL
by mj mailing lists user 27 Nov '08

27 Nov '08

Hi, I've got a working (my)sql freeradius2.1 configuration where users are put in groups (usergroup). I added an 'IP' column to radgroupcheck table so that I can force radius clients into some groups (via %{Client-IP-Address} ) . This allows me to say who can connect from where (WiFi, Dialup, StudentRooms,...) and have users in multiple groups Up to now all my users are stored in the db. I'm now asked to integrate a new LDAP server into the equation. Not all users will be put in LDAP (guest users, conference groups will stay in the DB). So there still be users in the DB. All LDAP users have to be granted WiFi access. Other access are DB dependent (dialup,StudentRooms,...) I've tried to add both ldap and sql authorization but I've got trouble limiting LDAP users. This is how it should work: a: if LDAP OK and client is in "WiFi" accept b: if LDAP OK and user in usergroup for the right group (%{Client-IP-Address} dependent) accept c: if LDAP !OK do the classic sql processing. If I understand well the usual sql process is as follows: 1. check user in radcheck 2. if found check user in usergroup 3. if found check radgroupcheck But if LDAP knows the user I've got to add 'WiFi' group to the result of the usergroup query and skip the radcheck query Do you see a way through this? Thanks for reading me. Michel

1 0

Methods not supported by freeradius source code
by Fernando 27 Nov '08

27 Nov '08

Hi all, after configure EAP2 module and test it with EAP-MD5 (it works properly) I want use the EAP-PSK and/or EAP-GPSK . But if I add in eap2 module ... eap2 { psk { } } When I run radiusd... it fails showing that "psk is unknown", how can these not native freeradius methods provided by libeap.so (hostap) be used? Thanks.

1 1

Freeradius error: "Discarding conflicting packet"
by jelle-e 26 Nov '08

26 Nov '08

Hi, I've enabled extensive logging and radiusd runs as daemon process (# /usr/local/sbin/radiusd). I have a medium sized network with about 25 Access Points (AP's) now (Linksys WAP54G). It runs with following encryption options: WPA-Enterprise, AES, PEAP, mschapv2, without using certificates. Everything seems to run smoothly but before every login attempt the logs say (something like): "Error: Discarding conflicting packet from client NAS-NAME port 3072 - ID: 3 due to recent request 28." After that the user logs in correctly. I have no idea where to start searching for the answer. Since this error appears to occur on every AP, I don't think they're all 'broken'. Does anybody have an idea? Thanks in advance! In the freeradius source I found the following regarding the error: gettimeofday(&when, NULL); when.tv_sec -= 1; /* * If the cached request was received * within the last second, then we * discard the NEW request instead of the * old one. This will happen ONLY when * the client is severely broken, and is * sending conflicting packets very * quickly. */ if (timercmp(&when, &request->received, <)) { radlog(L_ERR, "Discarding conflicting packet from " "client %s port %d - ID: %d due to recent request %d.", client->shortname, packet->src_port, packet->id, request->number); return 0; } -- View this message in context: http://www.nabble.com/Freeradius-error%3A-%22Discarding-conflicting-packet%… Sent from the FreeRadius - User mailing list archive at Nabble.com.

10 21