February 2008 - Freeradius-Users - lists.freeradius.org

VMPS support
by Phil Mayers 27 Feb '08

27 Feb '08

All, I'm moving our legacy switches over to the VMPS support in FreeRadius 2 and I'm aware there are others on the list who have done this. I'm seeing several different formats of VMPS request. The "easy" ones are from older switches e.g. cisco 1900s: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 2207055872 VMPS-Client-IP-Address = 172.28.72.65 VMPS-Port-Name = "22" VMPS-VLAN-Name = "PROD" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:01:4a:f8:93:e5 However, newer switches e.g. Cisco 3500XL are sending Reconfirm-Request packets with no MAC (but with a cookie): VMPS-Packet-Type = VMPS-Reconfirm-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13320 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "PROD" VMPS-Unknown = 0x01 VMPS-Cookie = 00:1b:78:a5:96:e0 How do I need to respond to these? It seems that if I return a Join-Response it will simply be obeyed, but I'm worried it will explode later. Do I need to return a Reconfirm-Reponse with a Deny if the requested vlan is different to the desired on, or a permit otherwise? We're also seeing from the newer switches join packets with no MAC or cookie, but an ethernet header: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13329 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/3" VMPS-VLAN-Name = "--NONE--" VMPS-Unknown = 0x00 VMPS-Ethernet-Frame = 0xffffffffffff001636e46d1b08004500015... What's the easiest way to get the MAC address out of these?

2 4

RE: Radius MAC filtering with EAP-PEAP
by Ivan Kalik 27 Feb '08

27 Feb '08

1. Debug is a bit longer than that. You should post the whole thing. 2. This is not a mac authentication request. 3. That Calling-Station-Id is not going to get checked. Read instruction in users file where do check items go. Ivan Kalik Kalik Informatika ISP Dana 27/2/2008, "Era" <alexey.eronko(a)gmail.com> piše: >Hi! > >Could you please assist me to find my fault. I have test user with laptop. I >want to restrict access for this laptop. In users file I added wrong mac >address (00-18-de-4e-8f-11) but laptop still can connect with testuser/12345 >credentials. > >:( > >Here is my AP request : > >rad_recv: Access-Request packet from host 10.10.10.139:6001, id=65, >length=195 > User-Name = "testuser" > NAS-IP-Address = 89.10.10.139 > Called-Station-Id = "00-20-a6-64-66-a3:A" > Calling-Station-Id = "00-18-de-4e-8f-1d" > NAS-Identifier = "ORiNOCO-AP-700-64-66-a3" > State = 0x47e0330ad155ef064a62de62873e8690 > Framed-MTU = 1400 > NAS-Port = 2 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020900261900170301001b139845f4c8e9bcb46 > >Debug log: > >rlm_checkval: Item Name: Calling-Station-Id, Value: 00-18-de-4e-8f-1d >rlm_checkval: Could not find attribute named Calling-Station-Id in check >pairs > modcall[authorize]: module "checkval" returns notfound for request 8 > > > >Here is my users file: > >testuser User-Password == "12345" > Calling-Station-Id = "00-18-de-4e-8f-11" > >Here is my checkval config: > >checkval { > # The attribute to look for in the request > item-name = Calling-Station-Id > # The attribute to look for in check items. Can be multi >valued > check-name = Calling-Station-Id > # The data type. Can be > # string,integer,ipaddr,date,abinary,octets > data-type = string > # If set to yes and we dont find the item-name attribute in >the > # request then we send back a reject > # DEFAULT is no > notfound-reject = yes > } > >Era > >-----Original Message----- >From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org >[mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or >g] On Behalf Of Ivan Kalik >Sent: Wednesday, February 27, 2008 12:33 PM >To: FreeRadius users mailing list >Subject: Re: Radius MAC filtering with EAP-PEAP > >>Could you please suggest me how can I check MAC filter(via Radius) and >after >>that do EAP-PEAP authorization? >> > >Read your NAS documentation. > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Re: Radius MAC filtering with EAP-PEAP
by Liran Tal 27 Feb '08

27 Feb '08

On Wed, Feb 27, 2008 at 1:19 PM, Era <alexey.eronko(a)gmail.com> wrote: > Era wrote: > > > Could you please assist me to find my fault. I have test user with > laptop. > I > > want to restrict access for this laptop. In users file I added wrong mac > > address (00-18-de-4e-8f-11) but laptop still can connect with > testuser/12345 > > credentials. > > Did you read the documentation for the "users" file? > > [Era]: Yes I did. But no result. > > > Here is my users file: > > > > testuser User-Password == "12345" > > Calling-Station-Id = "00-18-de-4e-8f-11" > > What do you think this entry does? > > [Era:] I thought that this entry maps user with mac hardware address. > > No that lines means that the user tester/12345 will be granted access and freeradius will send a Calling-Station-Id attribute reply to the NAS in return, which is not what you wanted... I hope this makes more sense. Regards, Liran Tal.

1 0

Re: Radius MAC filtering with EAP-PEAP
by Alan DeKok 27 Feb '08

27 Feb '08

Era wrote: > Could you please assist me to find my fault. I have test user with laptop. I > want to restrict access for this laptop. In users file I added wrong mac > address (00-18-de-4e-8f-11) but laptop still can connect with testuser/12345 > credentials. Did you read the documentation for the "users" file? > Here is my users file: > > testuser User-Password == "12345" > Calling-Station-Id = "00-18-de-4e-8f-11" What do you think this entry does? > Here is my checkval config: I don't think you need to use the "checkval" module. In 2.0, you can just write the logic you want in "unlang". Alan DeKok.

2 1

header enrichment
by mauro 27 Feb '08

27 Feb '08

Hi all i would like to know if freeradius can help to enrich the user header for that mobile services that needs some particular params as for connection type ( 3g, gprs...). Somebody has experience in this ? thanks ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

3 2

Complex redundant ldap setup
by Capelle, Mark (PCMC-GB) 27 Feb '08

27 Feb '08

I have an LDAP setup with multiple module statements pointing to the same LDAP server, but at different OU's (referred to as sites) to get around issues due to the large tree size present. This is currently working with the following setup radiusd.conf: modules { ldap srv1-sitea { .. set_auth_type = yes } ldap srv1-siteb { .. set_auth_type = yes } } sites-available/default: authorize { srv1-sitea srv1-siteb } authenticate { Auth-Type srv1-sitea { srv1-sitea } Auth-Type srv1-siteb { srv1-siteb } } Now my goal is to make this a redundant configuration. I have duplicated my modules config, changing "srv1" to "srv2" and changing the IP address of the LDAP server. The rest of the configuration is what is fuzzy for me. I assume that my authorize section would be: authorize { redundant { srv1-sitea srv2-sitea } redundant { srv1-siteb srv2-siteb } Now the authentication part is where is becomes complicated. I don't even know where to begin with this. I tried this based on some old configs I had used in the past, but this failed miserably: authenticate { Auth-Type ldap { group { srv1-sitea { reject = 1 ok = return } srv2-siteb { reject = return ok = return } } } I read the "configurable failover" docs, but it is still not clear to me what I would need to do in this situation. I am sure there is probably an easy way to accomplish this so that for each OU ("site") it uses both LDAP servers ("srv1","srv2") in a redundant fashion, but how to do it is something I am having a heck of a time figuring out.

4 3

Re: Radius MAC filtering with EAP-PEAP
by Ivan Kalik 27 Feb '08

27 Feb '08

>Could you please suggest me how can I check MAC filter(via Radius) and after >that do EAP-PEAP authorization? > Read your NAS documentation. Ivan Kalik Kalik Informatika ISP

2 1

Radius MAC filtering with EAP-PEAP
by Alexey Eronko 27 Feb '08

27 Feb '08

I want to setup two WIFI networks: MAC Filter with EAP-PEAP. MAC Filter with WEP. How can I use Radius MAC filtering and EAP-PEAP simultaneously in one network. Could you please suggest me how can I check MAC filter(via Radius) and after that do EAP-PEAP authorization? Thank you Alexey

1 0

Expiration Value
by Tim White 26 Feb '08

26 Feb '08

I'm attempting to use Expiration to expire user accounts after a set time period. What format does the Date/Time (Value field) have to be? From what I can see it's in the format of "Monthname Day Year Hour:Min:Sec". So for example "March 24 2008 00:00:00". But it appears that in this format you can't use normal SQL datetime operators to see if it's expired (for example, to run a SQL query to remove all expired accounts). Can someone who has it working please let me know what format they use for Expiration value, and how they can use MySQL comparison operators with it? (Ether 2.0.2 or 1.1.7). Thanks Tim

5 10

Segmentation Fault on RH EL4 x86_64 with 2.0.2
by Reynolds, Walter 26 Feb '08

26 Feb '08

I am having a problem that I am not sure where to look for a solution. I install Freeradius via src with the straight 'configure', 'make' and 'make install'. No real problems show up during the install that are obvious so I configure and run the server with a local account. All good and fine still. Next I configure for Kerberos authentication which all works well....IF I am not in debug mode. If I enter debug mode however I always Segfault when the server enters the rlm_krb5 module. Thu Feb 21 11:33:34 2008 : Debug: +- entering group Kerberos Thu Feb 21 11:33:34 2008 : Debug: modsingle[authenticate]: calling krb5 (rlm_krb5) for request 0 Program received signal SIGSEGV, Segmentation fault. [Switching to Thread 182896438976 (LWP 21233)] 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 (gdb) Quit (gdb) info threads * 1 Thread 182896438976 (LWP 21233) 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 (gdb) thread apply all bt full Thread 1 (Thread 182896438976 (LWP 21233)): #0 0x00000037e4541f29 in krb5_get_init_creds () from /usr/lib64/libkrb5.so.3 No symbol table info available. #1 0x00000037e454364f in krb5_get_in_tkt_with_password () from /usr/lib64/libkrb5.so.3 No symbol table info available. #2 0x0000002a95bb0491 in krb5_auth (instance=0x6c5f90, request=Variable "request" is not available. ) at rlm_krb5.c:298 r = Variable "r" is not available. The hardware from gromit (where I get this) Linux gromit.umnet.umich.edu 2.6.9-67.0.1.ELsmp #1 SMP Fri Nov 30 11:57:43 EST 2007 x86_64 x86_64 x86_64 GNU/Linux Hardware on other box where it works: Linux engin-test1.ns.itd.umich.edu 2.6.9-1.667 #1 Tue Nov 2 14:41:25 EST 2004 i686 i686 i386 GNU/Linux Running freeradius 2.0.2. I have pointers that this could be anything from Krb libraries, the rlm_krb to autoconf files. I am not sure exactly what I am seeing here or why it is only when running in debug. I have tried using various installs from specifying library for rlm_krb5 to using broad library direction to local system tools. Always comes back with the Secmentation fault with kerberos like the trace listed above. Any help would be great. Thanks. --- Walt Reynolds Principal Systems Security Development Engineer Information Technology Central Services University of Michigan (734) 615-9438

2 1