February 2008 - Freeradius-Users - lists.freeradius.org

Re: Two networks: WEP+MAC Filtering and WPA(PEAP)
by Ivan Kalik 28 Feb '08

28 Feb '08

> >rad_recv: Access-Request packet from host 10.10.10.139:6001, id=7, >length=115 > > User-Name = "00-18-de-4e-8f-1d" > > User-Password = "secret" > > NAS-IP-Address = x.x.x.139 > > Called-Station-Id = "00-20-a6-64-66-a3:A" > > Calling-Station-Id = "00-18-de-4e-8f-1d" > > NAS-Port = 2 > > NAS-Port-Type = Wireless-802.11 > >I have this entry in my users file : > >00-18-de-4e-8f-1d Auth-Type:=Local, User-Password == "secret" > > > >Is this correct(right) way to control MAC addresses thought radius? > This will work fine considering that mac address will not be used for mschap eap etc. Correct way is not to use Auth-Type and use Cleartext-Password with := as operator (if this is a recent Freeradius version). > > >Another question is : what is correct way to separate two types(MAC&PEAP) of >requests to radius server? > There is nothing to do. mac auth wil be a pap request (like the one you posted) and peap will be an eap request. So, your AP will do that for you. > > >At this moment I have situation when my MAC request tries to authorize >thought LDAP and only afterward looks in users file. > Upgrade to 2.0.2. Than you can process pap and eap requests differently. Ivan Kalik Kalik Informatika ISP

1 0

Need to customized the table schema.
by johnson elangbam 28 Feb '08

28 Feb '08

hi, I am using free radius 2 with MS Sql 2000. I want to make a database schema of my own to store only username and password in MS Sql. I would like to modify the query so that the radius server reads only this information from my customized table.I've tryied modyfying sql queries from dialup.confto read from my table but it doesn't work. Please help. Here is the piece of output of the radius server after rejecting the username and the password. rad_recv: Access-Request packet from host 127.0.0.1 port 32835, id=208, length=56 User-Name = "John" User-Password = "1" NAS-IP-Address = 192.168.2.227 NAS-Port = 0 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "John", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> John rlm_sql (sql): sql_set_user escaped user --> 'John' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT name,value FROM checking WHERE name = '%{SQL-User-Name}' -> SELECT name,value FROM checking WHERE name = 'John' query: SELECT name,value FROM checking WHERE name = 'John' rlm_sql: The 'Attribute' field is empty or NULL, skipping the entire row. rlm_sql (sql): Error getting data from database rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 ++[sql] returns fail Invalid user: [John/1] (from client localhost port 0) Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> John attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 208 to 127.0.0.1 port 32835 Waking up in 4.9 seconds. Cleaning up request 0 ID 208 with timestamp +17 Ready to process requests. With Regards Elangbam Johnson

2 1

Re: Two networks: WEP+MAC Filtering and WPA(PEAP)
by Phil Mayers 28 Feb '08

28 Feb '08

> Could you please correct me about mac authorization. > > In my debug log I see mac authorization request : > > rad_recv: Access-Request packet from host 10.10.10.139:6001, id=7, > length=115 > > User-Name = "00-18-de-4e-8f-1d" > > User-Password = "secret" > > NAS-IP-Address = x.x.x.139 > > Called-Station-Id = "00-20-a6-64-66-a3:A" > > Calling-Station-Id = "00-18-de-4e-8f-1d" > > NAS-Port = 2 > > NAS-Port-Type = Wireless-802.11 > > I have this entry in my users file : > > 00-18-de-4e-8f-1d Auth-Type:=Local, User-Password == "secret" That's incorrect. On a recent (1.1.7 or 2.x) version of the server, assuming you haven't fiddled with the default config too much, do this: 00-18-de-4e-8f-1d Cleartext-Password := "secret" However, this system has some disadvantages; specifically if you use another NAS (AP, switch) that doesn't send "secret" or formats the username differently. > > > > Is this correct(right) way to control MAC addresses thought radius? There's no one "correct" way. It depends on your environment. We (for example) lookup the Calling-Station-Id in SQL and allow or deny based on that. > > > > Another question is : what is correct way to separate two > types(MAC&PEAP) of requests to radius server? Yes. You didn't say what version of the server you're using, but in 1.1.x you can do this: modules { files { .. } files macauth { ... } } authorize { preprocess files Autz-Type MACAUTH { files_macauth } Autz-Type OTHER { ldap eap mschap } } ...then in "users": # match mac addresses, set autz-type DEFAULT User-Name =~ "..-..-..-..-..-..", Autz-Type := MACAUTH Fall-Through = no # everything else is eap, ldap DEFAULT Autz-Type := OTHER ...see doc/Autz-Type for more info. In 2.x you can make use of the virtual server capabilities.

1 0

Two networks: WEP+MAC Filtering and WPA(PEAP)
by Era 28 Feb '08

28 Feb '08

Hello, I would like to setup two WLAN networks on one AP with different VLAN. >From Radius I need MAC authorization for network #1 and WPA(PEAP) authorization for network #2. I have successfully setup both types of authorization separately. Could you please correct me about mac authorization. In my debug log I see mac authorization request : rad_recv: Access-Request packet from host 10.10.10.139:6001, id=7, length=115 User-Name = "00-18-de-4e-8f-1d" User-Password = "secret" NAS-IP-Address = x.x.x.139 Called-Station-Id = "00-20-a6-64-66-a3:A" Calling-Station-Id = "00-18-de-4e-8f-1d" NAS-Port = 2 NAS-Port-Type = Wireless-802.11 I have this entry in my users file : 00-18-de-4e-8f-1d Auth-Type:=Local, User-Password == "secret" Is this correct(right) way to control MAC addresses thought radius? Another question is : what is correct way to separate two types(MAC&PEAP) of requests to radius server? At this moment I have situation when my MAC request tries to authorize thought LDAP and only afterward looks in users file. rad_recv: Access-Request packet from host 89.113.128.139:6001, id=7, length=115 User-Name = "00-18-de-4e-8f-1d" User-Password = "secret" NAS-IP-Address = 89.113.128.139 Called-Station-Id = "00-20-a6-64-66-a3:A" Calling-Station-Id = "00-18-de-4e-8f-1d" NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00-18-de-4e-8f-1d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "00-18-de-4e-8f-1d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00-18-de-4e-8f-1d at line 2 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for 00-18-de-4e-8f-1d radius_xlat: '(&(uid=00-18-de-4e-8f-1d)(objectClass=posixAccount))' radius_xlat: 'dc=x,dc=xxx,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=x,dc=xxx,dc=com, with filter (&(uid=00-18-de-4e-8f-1d)(objectClass=posixAccount)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 7 to xx.xx.xx.139 port 6001 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 7 with timestamp 47c698d Thank a lot Era

1 0

Re: header enrichment
by mauro 28 Feb '08

28 Feb '08

please have a look inline thanks > Normally in a mobile services there's no specification into the header > about connection type. *Which header? You are assuming that everyone here is familiar with 3g *terminology. You were already told we were not. i didn't mention anything about 3G, i spoke about mobile services, i think you know perfectly wich kind of services I'm talkig about, anyway I can try to support you: Mobile Services: means all the services that a mobile Operator can give to the customers, from SMS to WAP connections, normally when the user connect to Mobile Operator network infrastructure the connection ( mainly if we are talking about WAP connection) is treathed as an internet connection and the mobile browser request contain http header as well as common internet header. Now using some infrastructure is possible to add more parameters to the header......>>>> > many sniffing were done but only specific equipment allows to enrich the > header with this inofrmation, *Could you describe what you mean in more words? It is meaningless to *say "enrich the header". We have no idea what you mean by that. enrich the header as for google search is a particular feature of a system to add specific tag to the header and it's a common way to describe procedure. here below in attach and example of mobile header and the voice Nokia-bearer is that one that gives info about connection type: we need to determinate the type of of the connection to add to the header the needed parameters normally into a mobile operator some particualr equipment are used as well as radius server to get network parameters as connection type ( i mean connection established by7 the user) this is why I asked for i hope is everything clear now! thanks ------header example--- GET /wap/ HTTP/1.0 If-None-Match: "0-6f-3e6cf51a" Accept: image/gif, text/x-vCalendar, image/vnd.wap.wbmp, application/vnd.wap.wmlscriptc, text/x-vCard, application/vnd.wap.wmlc, application/vnd.wap.wbxml, text/vnd.wap.wml, text/vnd.wap.wmlscript, text/plain Accept-Language: en Accept-Charset: US-ASCII, ISO-8859-1, UTF-8, ISO-10646-UCS-2 profile: http://wap.sonyericssonmobile.com/UAprof/T200.xml User-Agent: SonyEricssonT200/R101 bearer-indication: 0 accept-application: 1,2 X-Nokia-CONNECTION_MODE: CMODE X-Nokia-BEARER: GPRS <-- PARAMETER NEEDED----FRRERADIUS CAN HELP?? X-Nokia-gateway-id: NAWG/3.1/Build52 Via: WTP/1.1 Vodafone wap FTC (Nokia WAP Gateway 3.1/ECD9/3.1.52), 1.1 vlsp1:9010 (squid/2.5.STABLE3) X-Forwarded-For: 172.27.9.3 Host: redsox.tcs.auckland.ac.nz -------------------------------------------- L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

3 2

RE: EAP-PEAP with LDAP for 802.1x authentication
by Ryan 28 Feb '08

28 Feb '08

I have installed smbldap-tools and tried to modify existing LDAP records using smbldap-usermod after updating the smbldap.conf and smbldap_bind.conf to connect to the LDAP but I keep getting an error that user cannot be found. Using ldapsearch, syslog shows Feb 28 17:54:42 advert slapd[5679]: connection_get(10) Feb 28 17:54:42 advert slapd[5679]: ==> bdb_bind: dn: cn=admin,o=com Feb 28 17:54:42 advert slapd[5679]: send_ldap_result: err=0 matched="" text="" Feb 28 17:54:42 advert slapd[5679]: connection_get(10) Feb 28 17:54:42 advert slapd[5679]: SRCH "o=com" 2 0 Feb 28 17:54:42 advert slapd[5679]: 0 0 0 Feb 28 17:54:42 advert slapd[5679]: filter: (&(objectClass=advert-account)(uid=samba_servers)) Feb 28 17:54:42 advert slapd[5679]: attrs: But using smbldap-usermod, syslog shows Feb 28 17:57:25 advert slapd[5679]: connection_get(10) Feb 28 17:57:25 advert slapd[5679]: ==> bdb_bind: dn: cn=admin,o=com Feb 28 17:57:25 advert slapd[5679]: send_ldap_result: err=0 matched="" text="" Feb 28 17:57:25 advert slapd[5679]: connection_get(10) Feb 28 17:57:25 advert slapd[5679]: SRCH "o=com" 2 2 Feb 28 17:57:25 advert slapd[5679]: 0 0 0 Feb 28 17:57:25 advert slapd[5679]: filter: (&(?=undefined)(uid=samba_servers)) Feb 28 17:57:25 advert slapd[5679]: attrs: Feb 28 17:57:25 advert slapd[5679]: Feb 28 17:57:25 advert slapd[5679]: bdb_idl_fetch_key: [b49d1940] Feb 28 17:57:25 advert slapd[5679]: send_ldap_result: err=0 matched="" text="" Feb 28 17:57:25 advert slapd[5679]: connection_get(10) This is not a freeradius issue but can someone advise what could be the problem? Regards, Ryan

1 0

Re: Consuming card code
by Juraj Bilic 28 Feb '08

28 Feb '08

> >> Can i implement user login, consuming of card codes, etc. with only packets (acct) >> or im missing some crucial points? > > No idea. What "card codes" are you talking about? > The problem: There is a host that controls internet access for 25 different machines. For having internet access machine user must type prepaid code. (there are 1000 generated prepaid valid codes) With one prepaid code user can use the internet for 1h. If user used only 20min of his current prepaid code he can use it again. on another machine (this code now gives 40min of internet access) My naive solution: Use freeradius on host and special .net app on every user machine to control everything. >> I hope that i (user, client) can make an behaviour of communicating with freeradius every 10sec >> and consuming 10sec of currently selected card code. > > You don't want to send accounting packets to the server every 10s. > It's a very bad idea. > > If you need 10s granularity on accounting, use a local database. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

3 2

can't get radtest/radclient to work
by Dan Gahlinger 28 Feb '08

28 Feb '08

I'm having a really stupid problem. I created a "dummy" user for testing: useradd -m testing passwd testing (set password to "testing"). not secure, but who cares - it's just for testing. left share secret as default, tried to login locally with this: echo "User-Name = testing,password=testing" | /usr/bin/radclient localhost:1812 auth testing123 I enabled bad password logging, and get this error in the log: Wed Feb 27 15:13:18 2008 : Auth: rlm_unix: [testing]: invalid password Wed Feb 27 15:13:18 2008 : Auth: Login incorrect: [testing/testing] (from client localhost port 0) I also tried this way: radtest testing testing 127.0.0.1:1812 0 testing123 and this was the result: Sending Access-Request of id 92 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 92 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=92, length=20 All the radius.conf defaults are left the same except the extra bad password logging. I have no idea why that's failing. I know it's something really stupid like the "system" login fall-through bypass not being high up enough in the config or something. Can anyone jog my memory again? thanks! Dan. _________________________________________________________________

5 8

Help With Cisco Configuration
by Joseph.Corrado＠nc4.us 27 Feb '08

27 Feb '08

I am trying to get a freeradius implementation rolled out for the first time and am running into a few issues that I cannot seem to resolve. I have a Cisco 2960 in a test lab with a Linux server running freeradius 2.0.0 for authentication. There are 2 problems I am running into. 1. I cannot seem to get the radius server to authenticate a user and place them at the privilege exec prompt, even thought I have configured the 'users' file to place all users at the privilege exec prompt when logging in by default (I did this just to test, ultimately I would like to create groups with different privilege levels). 2. I cannot seem to get the Cisco 2960 to accept the radius servers authentication response when logging in the device via a VTY session using SSH. When running the server in debug mode, you can see the request coming in and the server sending the authentication response back to the switch, but the authentication will still fail at the switch. The only authentication I get is at the console level. Any help would be greatly appreciated. Thank you. Joe Disclaimer: This message is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential, proprietary, or exempt from disclosure under applicable law. If you are not the intended recipient or the person responsible for delivering the message to the intended recipient, you are strictly prohibited from disclosing, distributing, copying, or in any way using this message. If you have received this communication in error, please notify the sender and destroy and delete any copies you may have received.

2 2

Re: header enrichment
by mauro 27 Feb '08

27 Feb '08

Normally in a mobile services there's no specification into the header about connection type. many sniffing were done but only specific equipment allows to enrich the header with this inofrmation, for example some particular charging proxy. We need to have this information cause from server side could be interesting to give to the user different services according to the user connections. now i asked, if freeradius can help us in this. regards Mauro ----- Messaggio originale ----- Da: Guy Davies <aguydavies(a)gmail.com> A: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Inviato: Mercoledì 27 febbraio 2008, 12:01:21 Oggetto: Re: header enrichment On 27/02/2008, Alan DeKok <aland(a)deployingradius.com> wrote: > mauro wrote: > > Hi all > > i would like to know if freeradius can help to enrich the user header > > for that mobile services that needs some particular params as for > > connection type ( 3g, gprs...). > > > What does that mean? > > I'm not a 3g expert. Maybe the 3g equipment you're using can use > RADIUS attributes. If so, see it's documentation for what RADIUS > attributes it uses. Alan is right. I would imagine that you'd need to use the 3GPP or 3GPP2 RADIUS dictionary to respond with attributes that could be used by the client to perform the header enrichment. As long as the information can be presented as a regular RADIUS attribute or VSA, then you can use FreeRADIUS to provide that information to the client (the device performing the header enrichment function). Rgds, Guy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

2 1