December 2008 - Freeradius-Users - lists.freeradius.org

RE: Duplicate IPs for Radius Clients with different secrets - allow any client IP?
by Eric Geier 17 Dec '08

17 Dec '08

Thank you for the info, David. I think the following is an example of how this could work, which I googled: > client 212.37.57.2 { > secret = "%{sql:SELECT secret FROM accesspoints WHERE id = %{raw:NAS-Identifier}}" > shortname = "just one of our example networks" >} I'm thinking I could even just have one client entry like this...but set to allow any IP. Is that possible? This would prevent me from having to track Internet IP changes among the multiple offices and locations where these separate WPA-Enterprise networks will be located at. Thanks! Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of wlanmac > Sent: Wednesday, December 17, 2008 8:42 AM > To: freeradius-users(a)lists.freeradius.org > Subject: Re: Duplicate IPs for Radius Clients with different secrets > > It's easy! Just google for rlm_raw and use it with a SQL xlat rule to > pick out the shared secret from a database. I have been doing this way > for years... in FreeRADIUS v1 and v2. > > David > coova.org > > > Date: Wed, 17 Dec 2008 10:16:17 +0200 > > From: Johan Meiring <jmeiring(a)pcservices.co.za> > > Subject: Re: Duplicate IPs for Radius Clients with different secrets > > To: FreeRadius users mailing list > > <freeradius-users(a)lists.freeradius.org> > > Message-ID: <4948B551.6030406(a)pcservices.co.za> > > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > Eric Geier wrote: > > > > > > If I understand what you said, I would only need one IP entry (the > Internet > > > IP) in the config file for each location, right? > > > > > > Most of these locations will be using dynamic Internet IPs; I'm not > sure > > > how'd I keep the config updated. Plus this would make each > location/network > > > use the same shared secret among all their APs, which I want to > prevent. > > > > > > > > > Alan, > > > > The Nas-Identifier being available to dynamic clients will also solve > > Eric's problem. > > > > Any update on when it might be available? > > > > Thanks! > > > > > > -- > > > > > > Johan Meiring > > Cape PC Services CC > > Tel: (021) 883-8271 > > Fax: (021) 886-7782 > > > > > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - http://www.avg.com > Version: 8.0.176 / Virus Database: 270.9.19/1853 - Release Date: > 12/17/2008 8:31 AM

2 1

FW: Working config file for data counter.
by Marcel Grandemange 17 Dec '08

17 Dec '08

>Good Day. >I am still struggling to get a working solution with freeradius and mysql as backend. >What im trying to do simply is have the radius server use data counters instead of time counters. >I want to limit a users collective data to amounts of 1gb,2gb,3gb, all the way up. >And it must be resset on the first of the month. >I have tried many versions of freeradius with many different queries and methods and there is ALWAYS something that doesn't seem to work properly. >With Freeradius 2.1.3 I cannot use anything above 4gb, although I followed instructions on wiki to the tee for overcoming the wrapping problem. (wiki >was outdated, but still tried) >With 1.1.7 I think it was I would simply get arratic responses. Sometimes worked fine with up to 8gb tested, the next month it wouldn't. 2gb limits >would also only sometimes work. >The only one that was consistant was the 1gb option. >Now ive tried so many methods, versions , tricks and wiki's and docs.. It's been years and still I cannot get it working correctly. There is a bit of >a lack of docs on what I would like to do and ive come to the conclusion that if I could see someone elses working config for this sort of setup I >could deduce where im going wrong. >Thank You! Is the only way to get this working to pay someone? If so who can help? Just note this is private and im using this box to teach myself hence I cant offer much... Input? __________ NOD32 3696 (20081216) Information __________ This message was checked by NOD32 antivirus system. http://www.eset.com

2 1

mac2vlan
by alois blasbichler 17 Dec '08

17 Dec '08

Hello list I want to assign a certain vlan to a certain mac of a client-pc. I tried the module mac2vlan - is there a better/other way ? But it does not work. I created the file ${confdir}/mac2vlan with : 00:40:96:B4:5B:0F,TECH-WLAN But normaly a vlan is defined with a number like "155". How should this work ? Am i missind something important ? Wath other steps i have to do ? Thank you luis

2 1

Re: Duplicate IPs for Radius Clients with different secrets
by wlanmac 17 Dec '08

17 Dec '08

It's easy! Just google for rlm_raw and use it with a SQL xlat rule to pick out the shared secret from a database. I have been doing this way for years... in FreeRADIUS v1 and v2. David coova.org > Date: Wed, 17 Dec 2008 10:16:17 +0200 > From: Johan Meiring <jmeiring(a)pcservices.co.za> > Subject: Re: Duplicate IPs for Radius Clients with different secrets > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4948B551.6030406(a)pcservices.co.za> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Eric Geier wrote: > > > > If I understand what you said, I would only need one IP entry (the Internet > > IP) in the config file for each location, right? > > > > Most of these locations will be using dynamic Internet IPs; I'm not sure > > how'd I keep the config updated. Plus this would make each location/network > > use the same shared secret among all their APs, which I want to prevent. > > > > > Alan, > > The Nas-Identifier being available to dynamic clients will also solve > Eric's problem. > > Any update on when it might be available? > > Thanks! > > > -- > > > Johan Meiring > Cape PC Services CC > Tel: (021) 883-8271 > Fax: (021) 886-7782 > >

1 0

IP per user
by Sergio Belkin 17 Dec '08

17 Dec '08

Hi, I wonder if radius force to a given user eg jdoe that only get from an Access Point always the same IP address? Thanks in advance -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

2 2

rlm_perl authentication override
by Henry 17 Dec '08

17 Dec '08

Greets, Using freeradius 2.0.5 and rlm_perl. Let's say we have a username which is locked in /etc/shadow. Normal authentication will prevent this user from logging in. I would like to override this behaviour in either authorize() or post_auth() and allow the user to login (but with modified $RAD_REPLY) despite the locked system user. In authorize(), changing $RAD_REPLY (to allow a modified service) is no problem, but I'm not sure what to return so radiusd will authenticate the user even though their password is incorrect (return RLM_MODULE_OK of course doesn't change this behaviour) - eg, rejecting a user is easy, just return RLM_MODULE_REJECT. Is there a way to change the reply from Access-Reject, to Access-Accept? Thanks Henry

2 2

vlan in ldap - full version
by alois blasbichler 17 Dec '08

17 Dec '08

Hello list I was send the last mail wrongly - here the correct version : I am trying to assign different vlans for my different Radius-users. The good news is that with a user defined in the users file it works fine. The users file : tester cleartext-Password := "alois" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 155 The message: ++[eap] returns ok Login OK: [tester] (from client ciscosw port 29 cli 00-1F-E1-23-71-85) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 255 to 10.53.240.10 port 32769 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "155" User-Name = "tester" MS-MPPE-Recv-Key = 0x283b539628ec3ece70444bce496d078fc67323356a6cd12f435f878743447f7a MS-MPPE-Send-Key = 0xa978c29338aa1547d14524b0f43bfcde45841e3bce0f9c30a0b6c3d57187d810 EAP-Message = 0x03130004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 12. But with my users in Ldap - it does not work - seems that radius dont replay the vlan-attributes Some hints? luis my user in ldap : dn: uid=test,ou=users,dc=sb-brixen,dc=it objectClass: radiusprofile radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 154 The message i get: [ldap] looking for check items in directory... rlm_ldap: radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 == "154" rlm_ldap: radiusTunnelMediumType -> Tunnel-Medium-Type:0 == IEEE-802 rlm_ldap: radiusTunnelType -> Tunnel-Type:0 == VLAN ... Login OK: [test] (from client ciscosw port 29 cli 00-1F-E1-23-71-85) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 97 to 10.53.240.10 port 32769 User-Name = "test" MS-MPPE-Recv-Key = 0x460785611f313ad630d4947a9f319303a05238d5b340b0a32d38a58b81a416aa MS-MPPE-Send-Key = 0xceeebab47129af3baa96c6fa859b26434b3894a32fddeeffc4f86bb9dfc080b1 EAP-Message = 0x031a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 53.

4 5

RE: Duplicate IPs for Radius Clients with different secrets
by Eric Geier 17 Dec '08

17 Dec '08

Opps I didn't see this message at first. Does this go along with what Alan was thinking? If I understand what you said, I would only need one IP entry (the Internet IP) in the config file for each location, right? Most of these locations will be using dynamic Internet IPs; I'm not sure how'd I keep the config updated. Plus this would make each location/network use the same shared secret among all their APs, which I want to prevent. The best solution I can think of that I want to mimic is SecureMyWiFi from WiTopia, a hosted radius service (www.witopia.net) Their service works just like I want. Thanks, Eric > -----Original Message----- > From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org > [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On > Behalf Of Paul Bartell > Sent: Tuesday, December 16, 2008 2:13 AM > To: FreeRadius users mailing list > Subject: Re: Duplicate IPs for Radius Clients with different secrets > > Okay. What you need to do is set ips in the client configuraiton file > for each of the APs that is going to be authenticating by using their > external ip address, which is where the connection will appear to come > from to freeradius. do a freeradius -X and it should be quite > explanatory, when you try to connect through an AP to it. > > On Mon, Dec 15, 2008 at 6:56 PM, Eric Geier <me(a)egeier.com> wrote: > >> >Hi, I'm wondering if someone can point me in the right direction. I > >> want to > >> >list radius clients with the same IPs (and different shared > secrets). > >> This > >> >would let me use freeradius among multiple offices, where each > could > >> use the > >> >same IP addresses for the radius clients. > >> > >> And how is routing going to work there? How is radius server suposed > to > >> send the response back to the correct client? This can work only if > >> carry radius server from office to office so it works a little bit > >> here, > >> little bit there. If you connect those clients onto a network they > will > >> all stop working (or, at best, first one you put on the network will > >> work but others won't). > >> > >> Ivan Kalik > >> Kalik Informatika ISP > > > > I'm not exactly sure. How does a RADIUS server work over the > Internet? I'm > > not connecting the radius clients onto the same LAN. If a radius > request > > comes in from the internet, would the server send responses to the > Internet > > IP that it received it from (which I think would work for my case) or > would > > it send to the radius client IP? > > > > Here's what I'm trying to do: > > Host a radius server on the Internet...for PEAP 802.1X (WPA- > enterprise). > > Each AP at the different offices would be set with the Internet IP > address > > of where the radius server is running, along with a shared secret. > There > > would likely be APs set to the same IP address, that's why I'm asking > about > > all this. > > > >> > Hi, I'm wondering if someone can point me in the right direction. > I > >> want to > >> > list radius clients with the same IPs (and different shared > secrets). > >> This > >> > would let me use freeradius among multiple offices, where each > could > >> use the > >> > same IP addresses for the radius clients. I need something very > >> dynamic; > >> > manually creating virtual servers in the config file won't work > well. > >> > >> RADIUS doesn't work that way. > >> > >> Shared secrets are per client IP. Each client IP is used to look > up > >> the shared secret. You can't have multiple shared secrets for one > IP. > >> > >> > Right now I'm using v1.188.2.4.2.14 > >> > >> That's not the server version number. > >> > >> Use "radiusd -v" to get the version information. > >> > >> Alan DeKOk. > > > > I know it traditionally doesn't, just checking to see what people > think and > > if I might find a way to do what I want to do. > > > > What got me thinking something like this could work is when using a > > different server, I thought I could modify the SQL select statement > that's > > used to find the shared secret. For example, the default is "select > > SharedSecret from NASES where ClientIPAddress='$c'" I thought I could > just > > add the following to the end "and where Domain=(function that takes > the > > domain from the username...after the @) I found that server can't > register > > the username attribute during the select statement...so it all didn't > work. > > > > Opps. I'm using v1.1.7 because at the moment I'm using FreeRadius.net > on > > Windows > > > > Thanks for your help guys - Eric > > > > > > > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > -- > Random quote of the week/month/whenever i get to updating it: > "Opportunity knocked. My doorman threw him out." - Adrienne Gusoff > > "At school you don't get parole, good behavior only brings a longer > sentence." - The History Boys > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > No virus found in this incoming message. > Checked by AVG - http://www.avg.com > Version: 8.0.176 / Virus Database: 270.9.18/1850 - Release Date: > 12/15/2008 5:04 PM

4 3

EAP/MD5 with mysql authentication failed
by henry1412 17 Dec '08

17 Dec '08

EAP/MD5 with mysql authentication failed My running environment is freeraius-2.1.3 and mysql-5.0.37. The authentication type is EAP/MD5. It's running well with individual 'user' file, however, If I enable the sql optioal, it rejects with '[eap] Handler failed in EAP/md5'. The mysql module was loaded success and could connected with my database. It could authorized in freeradius-1.0.5 and freeradius-1.1.7 with mysql, but failed in freeradius-2.1.3. I paste my mainly configuration file and debug information below. Thanks for your help! IN radius.conf ---------------------- $INCLUDE sql.conf IN sql.conf ---------------------- server = "localhost" port = 3306 login = "radius" password = "radius" IN sites-enabled/inner-tunnel ---------------------- authorize { eap { ok = return } files sql expiration logintime } authenticate { eap } IN eap.conf ---------------------- eap { default_eap_type = md5 timer_expire = 60 ignore_unknown_eap_types = no max_sessions = 2048 md5 { } } IN user ---------------------- DEFAULT Auth-Type := EAP Fall-Through = 1 IN radcheck table ---------------------- mysql> select * from radcheck; +----+----------+--------------------+----+-------+ | id | username | attribute | op | value | +----+----------+--------------------+----+-------+ | 1 | test | Cleartext-Password | := | test | IN radreply table ---------------------- mysql> select * from radreply; +----+----------+-------------------+----+---------------+ | id | username | attribute | op | value | +----+----------+-------------------+----+---------------+ | 1 | test | Framed-IP-Address | := | 192.168.1.55 | DEBUG information ---------------------- -----------Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.7 port 1024, id=0, length=142 User-Name = "test" NAS-IP-Address = 192.168.1.7 NAS-Port = 0 Called-Station-Id = "00-0F-1E-51-00-04:" Calling-Station-Id = "00-13-D7-20-00-90" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000090174657374 Message-Authenticator = 0xbfed0ae2dd3f0b2a36fe1a88cbd3569d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.7 port 1024 EAP-Message = 0x01010016041095e48ee00d7d5ecc1639d149c9aa7283 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x40ca4f4d40cb4b4734e42cbd94a7636b Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.7 port 1024, id=1, length=173 User-Name = "test" NAS-IP-Address = 192.168.1.7 NAS-Port = 0 Called-Station-Id = "00-0F-1E-51-00-04:" Calling-Station-Id = "00-13-D7-20-00-90" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100160410f34f8c1c140e4f4b3846e691a7aa2175 State = 0x40ca4f4d40cb4b4734e42cbd94a7636b Message-Authenticator = 0xa9e8279e3d299800129cc25ad426acce +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 144 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/md5 [eap] processing type md5 rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication [eap] Handler failed in EAP/md5 [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> test attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 1 to 192.168.1.7 port 1024 EAP-Message = 0x04010004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 3.9 seconds.-----------

3 2

vlan in ldap
by alois blasbichler 17 Dec '08

17 Dec '08

Hello list I am trying to assign different vlans for my different Radius-users. The good news is that with a user defined in the users file it works fine. The users file : tester cleartext-Password := "alois" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = 155 The message: ++[eap] returns ok Login OK: [tester] (from client ciscosw port 29 cli 00-1F-E1-23-71-85) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 255 to 10.53.240.10 port 32769 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "155" User-Name = "tester" MS-MPPE-Recv-Key = 0x283b539628ec3ece70444bce496d078fc67323356a6cd12f435f878743447f7a MS-MPPE-Send-Key = 0xa978c29338aa1547d14524b0f43bfcde45841e3bce0f9c30a0b6c3d57187d810 EAP-Message = 0x03130004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 12. But with my users in Ldap - it does not work my user in ldap : dn: uid=test,ou=users,dc=sb-brixen,dc=it objectClass: radiusprofile radiusTunnelMediumType: IEEE-802 radiusTunnelType: VLAN radiusTunnelPrivateGroupId: 154 The message: [ldap] looking for check items in directory... rlm_ldap: radiusTunnelPrivateGroupId -> Tunnel-Private-Group-Id:0 == "154" rlm_ldap: radiusTunnelMediumType -> Tunnel-Medium-Type:0 == IEEE-802 rlm_ldap: radiusTunnelType -> Tunnel-Type:0 == VLAN ...

2 1