May 2008 - Freeradius-Users - lists.freeradius.org

Re: SNMP error
by Alan DeKok 20 May '08

20 May '08

Edvin Seferovic wrote: > I am also curious about the answer on this question ! Are there any plans to > implement AgentX protocol into freeradius project? No plans. At this point, the only plans for 2.0 are minor feature improvements and bug fixes. I plan on spending time working on the book, unless otherwise motivated. Alan DeKok.

3 5

proxy.conf problem: username send with suffix
by Hans Bornemann 20 May '08

20 May '08

Hi, what is wrong in this configuration: # A standard realm entry. A request from "user(a)company.com" will be # sent to radius.company.com as "user", unless the 'nostrip' # configuration item is specified. If the 'nostrip' configuration # item is specified, then the request will be proxied as # "user(a)company.com" # realm tu-dortmund.de { type = radius authhost = LOCAL accthost = LOCAL } but freeradius takes username(a)tu-dortmund.de to check against radcheck. debug output: rad_recv: Access-Request packet from host 129.217.169.191:32769, id=14, length=280 User-Name = "mhanborn(a)tu-dortmund.de" Calling-Station-Id = "00-19-D2-CF-E5-50" Called-Station-Id = "00-0B-85-60-39-10:ITMC-WPA2" NAS-Port = 29 NAS-IP-Address = 129.217.157.246 NAS-Identifier = "mh-wlc4" Airespace-Wlan-Id = 5 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3503" EAP-Message = 0x0210005019800000004616030100410100003d03014832b93a0818b6073bdbd9b486630753af0d0f2e0469e2b071963d5240815fae00001600040005000a000900640062000300060013001200630100 State = 0x622cbb3df28c136e779e7cacb89d1a8d Message-Authenticator = 0xc969e31716dd9b76025be36ae5e396e4 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 81 modcall[authorize]: module "preprocess" returns ok for request 81 modcall[authorize]: module "chap" returns noop for request 81 modcall[authorize]: module "mschap" returns noop for request 81 rlm_realm: Looking up realm "tu-dortmund.de" for User-Name = "mhanborn(a)tu-dortmund.de" rlm_realm: Found realm "tu-dortmund.de" rlm_realm: Adding Stripped-User-Name = "mhanborn" rlm_realm: Proxying request from user mhanborn to realm tu-dortmund.de rlm_realm: Adding Realm = "tu-dortmund.de" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 81 rlm_eap: EAP packet type response id 16 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 81 radius_xlat: 'mhanborn(a)tu-dortmund.de' rlm_sql (sql): sql_set_user escaped user --> 'mhanborn(a)tu-dortmund.de' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'mhanborn(a)tu-dortmund.de' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): User mhanborn(a)tu-dortmund.de not found in radcheck radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'mhanborn(a)tu-dortmund.de' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'mhanborn(a)tu-dortmund.de' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): User mhanborn(a)tu-dortmund.de not found in radgroupcheck Thanks Hans -- Hans Bornemann Universitaet Dortmund - ITMC Tel. ++49 231 755 2132 Fax. ++49 231 755 2731

2 1

Segmentation fault when use Odyssey Client
by Hangjun He 20 May '08

20 May '08

If I select EAP-TTLS + use only my certificate for auth will cause segmentation fault. Others seems OK. Debug info: rad_recv: Access-Request packet from host 192.168.200.57:32785, id=95, length=325 User-Name = "bbb" NAS-IP-Address = 192.168.200.57 NAS-Identifier = "auth_test" NAS-Port = 0 Called-Station-Id = "00-19-77-02-E6-90:auth-wpa2-tkip-8021x" Calling-Station-Id = "00-1D-7E-03-2B-CF" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0215009015800000008616030100461000004200400d423029041904e4b654b0384c78b56d7490853af607b909c2f54fc376bebac512ebfb7663e9ee2fc7320d175037da31f09e90ad986d539d519d6ef6c39f577914030100010116030100302027f914730434165f520dc31734211631a5c96402b0ddabaf4d815209d07bb6c0f2817ed3a2233822587288715beab6 State = 0x4f6739def5f0e9f45fd60479253cc3cd Message-Authenticator = 0xe06aac6aeeefc91f7920fd60b05ea9ab Processing the authorize section of radiusd.conf modcall: entering group authorize for request 9 modcall[authorize]: module "preprocess" returns ok for request 9 modcall[authorize]: module "chap" returns noop for request 9 modcall[authorize]: module "mschap" returns noop for request 9 rlm_realm: No '@' in User-Name = "bbb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 9 rlm_eap: EAP packet type response id 21 length 144 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 9 rlm_ldap: - authorize rlm_ldap: performing user authorization for bbb radius_xlat: '(uid=bbb)' radius_xlat: 'ou=radius,dc=bestgo,dc=aero' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,dc=bestgo,dc=aero, with filter (uid=bbb) rlm_ldap: checking if remote access for bbb is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "1234" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id:0 = "1" rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type:0 = IPv4 rlm_ldap: Adding radiusTunnelType as Tunnel-Type:0 = GRE rlm_ldap: user bbb authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 9 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 9 modcall: leaving group authorize (returns updated) for request 9 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0046], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 9 modcall: leaving group authenticate (returns handled) for request 9 Sending Access-Challenge of id 95 to 192.168.200.57 port 32785 Tunnel-Private-Group-Id:0 = "1" Tunnel-Medium-Type:0 = IPv4 Tunnel-Type:0 = GRE EAP-Message = 0x0116004515800000003b1403010001011603010030b081e94e6f9087f3c237216ab3fd9d65fc8311b18e37e66208369fb451d373695f16b167d85e80c870295da3d2f21cf4 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x10aabdcc7ef9ba295475b0706b6e070c Finished request 9 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.200.57:32785, id=96, length=187 User-Name = "bbb" NAS-IP-Address = 192.168.200.57 NAS-Identifier = "auth_test" NAS-Port = 0 Called-Station-Id = "00-19-77-02-E6-90:auth-wpa2-tkip-8021x" Calling-Station-Id = "00-1D-7E-03-2B-CF" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x021600061500 State = 0x10aabdcc7ef9ba295475b0706b6e070c Message-Authenticator = 0xa07cb0441d0e9d898030c912f9ae54d3 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 10 modcall[authorize]: module "preprocess" returns ok for request 10 modcall[authorize]: module "chap" returns noop for request 10 modcall[authorize]: module "mschap" returns noop for request 10 rlm_realm: No '@' in User-Name = "bbb", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 10 rlm_eap: EAP packet type response id 22 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 10 rlm_ldap: - authorize rlm_ldap: performing user authorization for bbb radius_xlat: '(uid=bbb)' radius_xlat: 'ou=radius,dc=bestgo,dc=aero' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=radius,dc=bestgo,dc=aero, with filter (uid=bbb) rlm_ldap: checking if remote access for bbb is allowed by uid rlm_ldap: No default NMAS login sequence rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "1234" rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id:0 = "1" rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type:0 = IPv4 rlm_ldap: Adding radiusTunnelType as Tunnel-Type:0 = GRE rlm_ldap: user bbb authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 10 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 10 modcall: leaving group authorize (returns updated) for request 10 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 10 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake is finished eaptls_verify returned 3 eaptls_process returned 3 Segmentation fault John --------------------------------- 雅虎邮箱，您的终生邮箱！

2 1

freeradius documentation: Auth-Type
by NPY 20 May '08

20 May '08

Hi, As someone very new to freeradius, I find that I am struggling with the available documentation. I have problem trying to find explanations on important attributes such as Auth-Type on what it means, what are the valid values etc. Can someone point me to the right place? I know http://www.freeradius.org/rfc/attributes.htm is around but it does not list all attributes, including Auth-Type.

6 8

users advanced configuration
by tribestom 20 May '08

20 May '08

Hi I have a little hard to configure freeradius. here is what i want to do : I want to run an hotspot with different accounts which give different connection time. I have an openldap server with this organisation : dc=com | dc=exempl | | ou=heure ou=jour | | uid=user1 uid=user2 What i have running now : I can authenticate a users with a time limit. Here is my users file : DEFAULT Auth-Type = ldap,Max-Daily-Session := 3600 I want add a second line with correspond to a day like this : DEFAULT Auth-Type = ldap,Max-Daily-Session := 86400 and i want that user from ou=heure use the first one and user from ou=jour use the policy with a day time which attribute should i add to this line or how should i do to realize this. I haven t found any clue on the net how to do this. Here is my ldap conf in radiusd.conf : server = "192.168.20.240" # ip de la machine avec le serveur ldap identity = "cn=admin,dc=exempl,dc=lcom" # login sur le serveur ldap password = "******" # mots de passe sur le serveur ldap basedn = "dc=exempl,dc=com" # base de recherche sur le serveur ldap filter ="uid=%u" # filtre de recherche ( ici tout utilisateur ) ldap_connections_number = 5 # nombre de tentative de connection timeout = 4 timelimit = 3 net_timeout = 1 tls { start_tls = no } dictionary_mapping = ${raddbdir}/ldap.attrmap edir_account_policy_check = no Sorry for my bad english and thanks for your help If you need more informations just tell me Tribolet Thomas

4 6

Question of Monthly-Session-Time
by Roberto Salazar M. 19 May '08

19 May '08

Hi: Sorry my english!! I need modify begin of period of Monthly-Session-Time parameter, this reset on 00:00:00 of the first day of each month, but I need set begin period in: day 24 of each month to 00:00:00. Is that possible? Regards, Roberto _________________________________________________________________ Do more with your photos with Windows Live Photo Gallery. http://www.windowslive.com/share.html?ocid=TXT_TAGLM_Wave2_photos_022008

1 0

RE: Cisco Mac-Auth-Bypass with Freeradius 2.0.4
by MONTFORD, AUSTIN 19 May '08

19 May '08

Frank & Ivan, Just wanted to thank yall for the advice and let you know this worked like a charm. Just had to change Fall-Through = True to Fall-Through = Yes which was simple enough using the debug output. Version thing with the syntax I guess... Thanks again! Austin -----Original Message----- Message: 5 Date: Fri, 16 May 2008 10:27:06 +1000 From: "Ranner, Frank MR" <Frank.Ranner(a)defence.gov.au> Subject: RE: Cisco Mac-Auth-Bypass with Freeradius 2.0.4 [SEC=UNCLASSIFIED] To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> ______________________________ From: freeradius-users-bounces+frank.ranner=defence.gov.au(a)lists.freeradius.or g [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@lists.freer adius.org] On Behalf Of MONTFORD, AUSTIN Sent: Friday, 16 May 2008 07:31 To: freeradius-users(a)lists.freeradius.org Subject: Cisco Mac-Auth-Bypass with Freeradius 2.0.4 Hey, I just got this working on a test server finally using the users file and have a quick question. I was wondering is there a way where I don't have to type the last 3 lines of this everytime in my users file? I was thinking of using some kind of setup with a seperate file for each vlan containing only the first statement (with the mac address as the user/pass). Then $include each vlanfile in the users file with freeradius appending the correct tunnel statements depending on what vlanfile the mac address was in. Anyways I haven't quite wrapped my head around the syntax to do this or am sure this is the best way. If someone has any advice that would be great. 123400000000 Cleartext-Password := "123400000000" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "Students" By the way Freeradius rocks! Thanks, Austin There is a couple of ways to do this. 1. Use groups. 2. Use Fall-Through and group you users file. Example: # Set boilerplate text DEFAULT Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Fall-Through = True # Staff systems DEFAULT Tunnel-Private-Group-Id := "Staff", Fall-Through = True $INCLUDE staff.users # Student systems DEFAULT Tunnel-Private-Group-Id := "Students", Fall-Through = True $INCLUDE student.users ... DEFAULT Auth-Type:=reject Student.users would have lines like: 123400000000 Cleartext-Password := "123400000000" 123500000000 Cleartext-Password := "123500000000" and could be generated by a script. Regards, Frank Ranner

1 0

2 server radius (same configuration), different log messages
by Enrico Fanti 19 May '08

19 May '08

Hi all. I have 2 server radius and 1 "AP Cisco" configured to use EAP Authentication. I have 2 server radius with freeradius 1.1.7 (fedora 8), configured in the same way (PEAP) (I haad configured my first server radius and then I copied my configuration files , and the certificates in second server radius) Then by my linux laptop, with wpa_supplicant I try to connect to my wireless ntwork. 1) If my AP is configured to require the authentication on first server radius 1, I obtain this log messages: *Mon May 19 08:51:20 2008 : Error: TLS_accept:error in SSLv3 read client certificate A Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon May 19 08:51:20 2008 : Info: (other): SSL negotiation finished successfully Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message* Mon May 19 08:51:20 2008 : Info: rlm_eap_mschapv2: Issuing Challenge *Mon May 19 08:51:20 2008 : Auth: Login OK: [fanti/<no User-Password attribute>] (from client localhost port 3686 cli 001e.4c00.dade) Mon May 19 08:51:20 2008 : Auth: Login OK: [fanti/<no User-Password attribute>] (from client ap-alternet port 3686 cli 001e.4c00.dade)* ############################################################## If I start with radius -X: rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: group authenticate returns ok for request 9 *Login OK: [fanti/<no User-Password attribute>] (from client ap-alternet port 3687 cli 001e.4c00.dade)* ################################################################## 2) In my second server radius I obtain: Mon May 19 08:50:38 2008 : Info: rlm_eap_mschapv2: Issuing Challenge *Mon May 19 08:50:38 2008 : Auth: Login OK: [fanti] (from client localhost port 3689 cli 001e.4c00.dade) Mon May 19 08:50:38 2008 : Auth: Login OK: [fanti] (from client ap-alternet port 3689 cli 001e.4c00.dade)* ##################### If I start with radius -X: rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 *Login OK: [fanti] (from client ap-alternet port 3690 cli 001e.4c00.dade *I don't understand why I have differences in this 2 logs (In rows where I have Login OK). Can you help me please ? Thank you enrico

2 2

Problem in testing Radius server
by youness hsina 19 May '08

19 May '08

Hi all sorry for my english. i'm running a freeradius server.and i wanted to test it but it doesn't work and i don't know why. i have tried this command : *radtest yhsina yhsina @IPserver 1 testing123.* ** *yhsina *is a user who is located in a LDAP server. it give me this thing : *radclient: no reponse from server for ID 107* thank for your help in advance. Uness -- HSINA Youness Etudiant R&T - IUT--Velizy 78140 Tél : 06.28.73.76.75 -- HSINA Youness Etudiant R&T - IUT--Velizy 78140 Tél : 06.28.73.76.75

1 0

Problem with CHAP, rlm_ldap, edir
by Lothar.Haeger＠steria-mummert.de 19 May '08

19 May '08

stupid me! wasn't the freeradius config, that's just fine with ldap being edirectory. Only I had "overconfigured" my testaccount by setting Auth-Type=LDAP on it, so all other types were rejected ;-( Removed that ldap attribute and see, it works :-) Cheers, Lothar

1 0