April 2008 - Freeradius-Users - lists.freeradius.org

Re: Possible to limit user access to different types of authentication?
by Ryan 30 Apr '08

30 Apr '08

Got it figured. Was actually trying to ask if it will terminate all EAP requests regardless of realm. Regards, Ryan Date: Tue, 22 Apr 2008 16:41:33 +0200 From: Alan DeKok <aland(a)deployingradius.com> Subject: Re: Possible to limit user access to different types of authentication? To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <480DF91D.3060404(a)deployingradius.com> Content-Type: text/plain; charset=ISO-8859-1 Ryan wrote: > I have worked around it using the proxy-inner-tunnel method to > terminal the EAP on the front radius and then proxy MS-CHAP to an > internal radius that will do an LDAP bind with an additional > attribute. Ok... > As the front radius will also handle EAP requests that will not be > handled by the internal radius, will it just proxy the EAP request > based on the domain or it will terminate and forward to my internal > radius instead? Huh? You said in the first paragraph that it will terminate & forward. Where's the confusion? Alan DeKok.

1 0

Re: HOWTO PEAP + FreeRadius + XP Client
by Gustavo Chavelas 29 Apr '08

29 Apr '08

Hi. George KNIGHT Here there are many people's experts. I have an infrastructure as yours EAP, PEAP, WinCE with HANDHELD, WIN XP, WIN VISTA and Cisco. It's working very good in a two CentOS Servers, 1 master and 1 backup for redundancy. Alan Dekok sends you instructions but don't worry, if you have any questions and I can help you, I do it. Saludos! -----Mensaje original----- De: freeradius-users-bounces+gchavelas=bfmx.com.mx(a)lists.freeradius.org [mailto:freeradius-users-bounces+gchavelas=bfmx.com.mx@lists.freeradius.org] En nombre de freeradius-users-request(a)lists.freeradius.org Enviado el: Martes, 29 de Abril de 2008 02:08 p.m. Para: freeradius-users(a)lists.freeradius.org Asunto: Freeradius-Users Digest, Vol 36, Issue 173 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. Re: can peap and ttls live together? (Sergio Belkin) 2. dot1x specification EAPOL-Logoff clarification (Arran Cudbard-Bell) 3. Re: dot1x specification EAPOL-Logoff clarification (Arran Cudbard-Bell) 4. HOWTO PEAP + FreeRadius + XP Client (George KNIGHT) 5. Re: HOWTO PEAP + FreeRadius + XP Client (Michael Schwartzkopff) 6. Re: SPAM-LOW: Re: EAP/TLS connection problem.. (Alan DeKok) 7. Re: HOWTO PEAP + FreeRadius + XP Client (Alan DeKok) ---------------------------------------------------------------------- Message: 1 Date: Tue, 29 Apr 2008 12:56:38 -0300 From: "Sergio Belkin" <sebelk(a)gmail.com> Subject: Re: can peap and ttls live together? To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <8c6f7f450804290856oce00b42h557aba09dfb7ee22(a)mail.gmail.com> Content-Type: text/plain; charset=ISO-8859-2 2008/4/29 Ivan Kalik <tnt(a)kalik.net>: > That probably won't work in 2.0. Mapping to Cleartext-Password will. I am using 2.0.2 :) > > > Ivan Kalik > Kalik Informatika ISP > > > > Dana 29/4/2008, "Sergio Belkin" <sebelk(a)gmail.com> pi?e: > > > > >2008/4/29 Ivan Kalik <tnt(a)kalik.net>: > >> You need to add the entry for Cleartext-Password. Something like: > >> > >> checkItem Cleartext-Password clrtxtPassword > >> > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> > >> > >> > >Hmmmm. I advanced and before of reading your answer I added: > > > >checkItem User-Password userPassword > > > >replyItem Tunnel-Type radiusTunnelType > >replyItem Tunnel-Medium-Type radiusTunnelMediumType > >replyItem Tunnel-Private-Group-Id radiusTunnelPrivateGroupId > > > >end of snip > > > >It worked! Anywat Is that right? > > > >-- > >-- > >Open Kairos http://www.openkairos.com > >Watch More TV http://sebelk.blogspot.com > >Sergio Belkin - > > > >- > >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin - ------------------------------ Message: 2 Date: Tue, 29 Apr 2008 17:33:06 +0100 From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> Subject: dot1x specification EAPOL-Logoff clarification To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <48174DC2.3060205(a)sussex.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi, Having some interesting issues with a HP ProCurve 2510 an Apple Mac Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same wired port. I know this isn't strictly the list for this as this isn't really RADIUS, but i'm not sure where to post... Two questions: IEE802.1x-2004 8.1.3 EAPOL-Logoff When a Supplicant wishes the Authenticator PAE to perform a logoff (i.e., to set the controlled Port state to unauthorized), the Supplicant PAE originates an EAPOL-Logoff message (see 7.5.4) to the Authenticator PAE. As a result, the Authenticator PAE immediately places the controlled Port in the unauthorized state 1) It appears in the spec that there is no requirement or indeed method of the Supplicant PAE of confirming that the EAPOL-Logoff has been honoured. So the supplicant PAE could be in the unauthorised state while the Authenticator could be in the authorised state. Is this an over site of the dot1x spec, or is this meant to be handled at a higher level with EAP ? --- 2) On the termination of an EAP session, VLAN membership is usually altered, either to a MAC-Authorised VID a default unauthorised VID, or the port is blocked. Windows clients are pretty crap in terms of DHCP when this happens, and fail to renew their leases when moving between authorised and unauthorised states. Apple Mac clients however are very good in terms of DHCP dot1x integration. Unfortunately with EAP-Based and MAC-Based authentication transistions, DHCP renewal doesn't appear to work. This is what i've seen from the traces: FRAME 6436 - TS 212.482482 - Assumed VLAN 603 - Actual VLAN 603 - EAPOL Logoff FRAME 6440 - TS 212.484947 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP REQUEST FRAME 6443 - TS 212.487252 - Assumed VLAN Blocked (transistion) - Actual VLAN 603 - DHCP ACK (Answered by server on 603) FRAME 6454 - TS 212.529774 - Assumed VLAN 134 - Actual VLAN 134 - EAP Failure (Seems to denotate MAC Authentication succeeding) So it appears after the supplicant sends the EAPOL-Logoff, the DHCP client attempts to get a lease very quickly; so quickly in fact that the switch hasn't altered the state of the port. The result being that the DHCP request is acked by the DHCP server on the dot1x authorised VLAN, the VLAN transistion *then* occurs, but as the DHCP client has satisfied itself that it has a valid lease for the PAE unauthorised state it doesn't renew the lease until it expires... Should I be shouting at HP to get their switches to register the state change faster, or shouting at Apple to make their DHCP timings less agressive ? Many Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900 ------------------------------ Message: 3 Date: Tue, 29 Apr 2008 17:50:14 +0100 From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> Subject: Re: dot1x specification EAPOL-Logoff clarification To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <481751C6.7050301(a)sussex.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Arran Cudbard-Bell wrote: > Hi, > > Having some interesting issues with a HP ProCurve 2510 an Apple Mac > Power Book running OSX 10.5.2, and MAC-Auth + EAP-Auth on the same > wired port. > > I know this isn't strictly the list for this as this isn't really > RADIUS, but i'm not sure where to post... > > Two questions: > > IEE802.1x-2004 > 8.1.3 EAPOL-Logoff > When a Supplicant wishes the Authenticator PAE to perform a > logoff (i.e., to set the controlled Port state to > unauthorized), the Supplicant PAE originates an EAPOL-Logoff > message (see 7.5.4) to the Authenticator > PAE. As a result, the Authenticator PAE immediately places the > controlled Port in the unauthorized state > > 1) It appears in the spec that there is no requirement or indeed > method of the Supplicant PAE of confirming that the EAPOL-Logoff has > been honoured. So the supplicant PAE could be in the unauthorised > state while the Authenticator could be in the authorised state. Is > this an over site of the dot1x spec, or is this meant to be handled at > a higher level with EAP ? Sorry. Looking at the diagrams in 8-5 it appears my suspicion is correct. Unless a re-auth timer is implemented by the Authenticator PAE, this mismatched authentication state could persist indefinitely. The EAPOL-LOGOFF frame is *not* retransmitted to the Authentication server... and the Authenticator PAE does not respond to EAPOL-LOGOFF frames, it just alters it's state. So if the EAPOL-LOGOFF frame was lost in transit... damn, why no EAPOL-LOGOFF-CONFIRMATION packet ... In every other part of the EAP/dot1x spec a request *should* always be answered by a response... but not here... are these guys idiots, or am I being dense ?! See this would solve the issue in question 2 perfectly. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900 ------------------------------ Message: 4 Date: Tue, 29 Apr 2008 14:14:16 -0400 From: "George KNIGHT" <georgeknight(a)gmail.com> Subject: HOWTO PEAP + FreeRadius + XP Client To: freeradius-users(a)lists.freeradius.org Message-ID: <d6da8e1d0804291114g56d9d9bfr2f58e923357e093e(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Hello everyone, Before I write my question here, I just want to let all of you know that I did lots of searching in both google and this email list. But couldn't find anything to get the answer. My question is I have been looking for a HOWTO paper for a beginner to set freeradius as an AAA server in a wireless environment to Windows XP SP2 clients. I will use Windows' own PEAP client. Is there such a paper someone can give me the link? I'm very frustrated to find out that there is no information available for a setup from the scratch. I wrote papers like that before for various topics such as subversion implementation for a multiple OS environment, VoIP implementation with a Linux based open sources S/W etc. I have intention to write such a paper for how to set up PEAP implementation with freeradius as well. But for that, I'm hoping someone can give me a good start. OK, here is my network settings and needed information; I have a SUSE SLES 10 server to be used as an AAA server. This server is called store-AAA and also acts as a DHCP server for the clients. I have a few of Cisco 1242 AP as an authenticator. Clients are going to be computers with WinCE as their OS and they will contact to the LAN wirelessly. What I want to achieve is authenticating this clients with server-AAA using PEAP before letting them use the other network resources. Thank you in advance for your time and effort. George Knight

1 0

EAP/TLS connection problem..
by Johan Nyman 29 Apr '08

29 Apr '08

Hello All, I can seem to connect to the radius server, this is the error code: Anyone has a clue on what It could be? ........................................ Ready to process requests. User-Name = "Linux1" NAS-IP-Address = 10.0.0.197 Called-Station-Id = "00-20-a2-64-c3-b1:devnet" Calling-Station-Id = "00-0e-33-fe-3a-36;devnet" NAS-Identifier = "MVG-1" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020a000b014c696e757831 Message-Authenticator = 0x68a4345956d14cfdd678854f4c955ac7 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "Linux1", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 10 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry Linux1 at line 219 expand: Hello, %{User-Name} -> Hello, Linux1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Reply-Message = "Hello, Linux1" EAP-Message = 0x010b00060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x84a6103884ad1d7df7f1c190d83cc59f Finished request 16. ........................................ The wpa_supplican.conf loks like this: network={ ssid="devnet" scan_ssid=1 key_mgmt=WPA-EAP pairwise=CCMP TKIP group=CCMP TKIP auth_alg=OPEN proto=RSN eap=TLS identity="Linux1" ca_cert="/Certs/ca.pem" client_cert="/Certs/client.pem" private_key="/Certs/client.pem" private_key_passwd="secret" } ........................................

3 4

can peap and ttls live together?
by Sergio Belkin 29 Apr '08

29 Apr '08

Hi, I had been using EAP-TTLS, but I've commented in an earlier post, I have no luck with securew2 and Vista. So I am planning use a "secondary password" for radius in clear-text. But I'd want to know if TTLS and PEAP can live together, my current eap.conf is as follow: eap { default_eap_type = ttls timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } leap { } gtc { auth_type = PAP } tls { private_key_file = /etc/pki/tls/certs/ips-spectrum-key.pem certificate_file = /etc/pki/tls/certs/ips-spectrum-crt.pem CA_file = /etc/pki/tls/certs/ips-ca-bundle.crt dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random cipher_list = "DEFAULT" } ttls { default_eap_type = md5 copy_request_to_tunnel = no use_tunneled_reply = yes } peap { default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no } mschapv2 { } } -- -- Open Kairos http://www.openkairos.com Watch More TV http://sebelk.blogspot.com Sergio Belkin -

4 9

Expiration?
by Marco Gaiarin 29 Apr '08

29 Apr '08

Using: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO as a base, i've setup freeradius to authenticate against my domain (samba, not AD, but little difference). In this way users can access my wireless network, using their domain account with password expiration and so on. Perfect. But could be that i will need some 'guest access': for, ahem, guests, or for speakers at a conference, ... Creating and deleting domain accounts only for that it is not my preferred choice. The same HOWTO above say: Configuration of users The configuration of this file is not necesary to get work the freeradius against the Active Directory, it is only necessary for advanced usage of FreeRADIUS. One of this advanced features, (among others) is the case when we want to have some local users that does not rely on the Active Directory that is working, but in the local file of users under ${sysconfdir}/raddb directory, an with the same authentication schema of PEAP. Open your users file with your favorite editor and put a line like this: username1 Cleartext-Password := "user-password1", MS-CHAP-Use-NTLM-Auth := 0 Perfectly, also this works. But i'm lazy as many system administrators, and i know that probably i will forgot to have account like this. Googling around i've found the Expiration radius tag that seems suit my needs, but i've found no example around, nor an expalnation if can be used and how on 'users' file. Speaking clearly: can i define in 'users' file some users with an explicit 'expiration date'? Someone can explain me how? Thanks. -- dott. Marco Gaiarin GNUPG Key ID: 240A3D66 Associazione ``La Nostra Famiglia'' http://www.sv.lnf.it/ Polo FVG - Via della Bontà, 7 - 33078 - San Vito al Tagliamento (PN) marco.gaiarin(at)sv.lnf.it tel +39-0434-842711 fax +39-0434-842797 Dona il 5 PER MILLE a LA NOSTRA FAMIGLIA! http://www.lanostrafamiglia.it/chi_siamo/5xmille.php (cf 00307430132, categoria ONLUS oppure RICERCA SANITARIA)

3 5

radius user-password on the wire
by Riccardo Veraldi 29 Apr '08

29 Apr '08

Hello, I used wireshark to sniff communication between my radisu server and the user-password attribute is encrypted 0000 3e ca 2d b0 97 2b b3 f9 0c e9 fc e7 e0 ed e9 fd to test if this is strong enough I wanted to ask if there is a way to decrypt this user-password attribute since my radisu server is doign proxy to other radius server. actually my radius server is authenticating a WiFi captive portal and is prosying requests upon username@domainname user attributes are stripped from domain and sent to proper radius server my question is how much is risky to have user-passsword attribute travellign across the network ? is the encryption applyed to the user-password strong enough ? thanks Rick

5 4

Re: Radius-based windows authentication
by Phil Mayers 29 Apr '08

29 Apr '08

Julien MIOTTE wrote: >> 1. Using the windows native supplicant and machine account >> authentication. Basically the process is this: >> * machine powers on - no-one logged in >> * machine uses its own domain account to login "host/$machinename" >> * user presses ctrl+alt+del >> * machine validates credentials to the domain controller, over the >> current network connection >> * machine downloads the users profile >> * once the profile is download, the machine does an EAP-Logoff and >> then re-authenticates using the user credentials >> * when the user logs out, the machine does and EAP-Logoff and then >> logs back in using the machine account > > Hi, I've been trying to do as you told me. There's no need to CC me. I read the list. > Using the native supplicant and MSCHAPv2 on PEAP, the machine sends now it's > own credentials. My problem is that the login is sent with the > prefix "host/". In my LDAP, the entry of the machine is machine_name$. > > I tried to fix this trough various ways, and I succeded by adding an entry in > the hint file : > DEFAULT Prefix == "host/", Strip-User-Name = "Yes" > > and by changing the filter in the LDAP section : > filter="(uid=%{Stripped-User-Name:-%{User-Name}})" > to > filter="(uid=%{Stripped-User-Name:-%{User-Name}}$)" > > Now the authorization works fine, but when the authenticate section is > processed, the debug prints this : > rlm_eap: Identity does not match User-Name, setting from EAP Identity. > > Am I doing all of this right ? > There's a better way; use the mschap module expansion function, which will both strip and suffix for you: filter = "(uid=%{mschap:User-Name})"

2 1

RE: SQLippool problems (duplicate IPs handed out)
by rsg 29 Apr '08

29 Apr '08

This is with reference to the email with subject "SQLippool problems (duplicate IPs handed out)" posted by Dave on Jan 14 2008. According to him when the number of connections are increased(30+), it was unavoidable that duplicate IPs being handed out. I would like to know the MySQL storage used. Even if it is of type InnoDB was end result the same? Thanks, rg

1 0

Help needed with freeradius, solaris and trapeze
by Miguel Dias 29 Apr '08

29 Apr '08

Hello all, I'm new with Freeradius... I've a machine with solaris 10 installed and with freeradius installed too but I'm taking a lot of problems to use it with my Trapeze infrastructure. Can anyone help? I'm starting with WPA2 - TKIP and I would Like to configure FreeRadius to Authenticate some test users that I can create on freeradius. please help really needed... Where should I start??? thank you all.

4 6

Newbie & EAP/TLS
by Mauro Iorio - Smart Soft s.r.l. 28 Apr '08

28 Apr '08

Hi all, sorry for this newbie question, but I was wondering if there's a way to implement EAP/TLS in freeradius. Does freeradius support TLS? Is there any documentation about it? Any information would be very appreciated. Thank You, Mauro Iorio

3 2