July 2008 - Freeradius-Users - lists.freeradius.org

authorization: unlang/NAS-IP-Address
by leopold 23 Jul '08

23 Jul '08

Hi, I am using freeradius 2.0.5 with MySQL, I am very new to Radius and FreRadius so please pardon my ignorance I need to reject user if his NAS-IP-Address input attribute does not match check attributes defined for his group. For example radgroupcheck | 1 | GROUP1 | NAS-IP-Address | == | x.x.x.1 | 2 | GROUP1 | NAS-IP-Address | == | x.x.x.2 | 3 | GROUP1 | NAS-IP-Address | == | x.x.x.3 If user is coming from NAS-IP-Address x.x.x.1 or x.x.x.2 or x.x.x.3 the user should be accepted and reply attributes are sent back If however if user is coming from NAS-IP-Address y.y.y.1 he should be rejected (even in the case he provide a valid password and NAS y.y.y.1 is properly defined in NAS table with a valid shared key) Since I found that only one operator "==" for NAS-IP-Address check attrubute can be found, I changed authorize_group_check_query, but still I managed to get reply list as empty for invalid NAS-IP and expected attributes from valid NAS (which is part of check attributes) but user is accepted in both cases. Is there a way to check if "reply" list is empty in unlang (does not contain ANY attributes)? I tried this, but it does not work. if (!reply:[0]) { # reply list is empty reject } Do you have any suggestions? Thanks you very much for your reply. -- View this message in context: http://www.nabble.com/authorization%3A-unlang-NAS-IP-Address-tp18609937p186… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

POP3
by Vittore Zen 23 Jul '08

23 Jul '08

Hi, how to use (a remote) pop3 server with (a local) freeradius to authenticate users? thanks v.

4 3

Does anyone have a "fast reauth(session resumption)" patch for freeradius server???
by Cristian Novac 23 Jul '08

23 Jul '08

Thank you!!! Cristian Novac.

1 0

What's possible in hints file?
by Stefan A. 23 Jul '08

23 Jul '08

Gurus, normally, I would do a short check, but currently I've no connection to one of my running FR, but have to plan some extensions. Has someone of you done something like the following? Regarding 'hints' - file: Would it be possible to use - $INCLUDE /path/file? - Fall-Trough? - temp A/V pairs defined in the global dictionary file using an ID > 3000 and using them as %{My-Attribute} later on? Thank you. Regards Stefan

2 1

does anyone have a "fast reauth(session resumption)" patch???
by Cristian Novac 23 Jul '08

23 Jul '08

Thank you ! Cristian NOVAC

1 0

Keeping a set amount of detail logs
by lowbassman＠gmail.com 23 Jul '08

23 Jul '08

I've enabled "detail auth_log" and "detail reply_log" (it'd be great if there was a way to tie auths and replies together from the different log files somehow) and FreeRadius is creating new logs each day. I'm assuming that I'll need to take care of removing old logs on my own? Otherwise I'll be filling my disk up pretty quickly. Thanks, ~Matt

5 5

BCD decoding
by Stefan A. 23 Jul '08

23 Jul '08

Gurus, Would it be possible to BCD decode a VSA value coming from the NAS? I'm working in 3GPP environment. Some of my older GGSNs are sending the 3GPP-IMEISV as it will be delivered to them by the SGSN, which is BCD encoded. They just put the information into the 3GPP VSA. Times ago, it was not clearly defined by 3GPP, how the GGSN has to handle this attribute. Now it is defined, that it must be a string of 16 digits, which will be handled correctly by our new GGSNs. I can separate the different behaviors by the NAS IP, but will need the readable IMEI in the string format for later processing. How would I put such a decoding into a DEFAULT area, possibly in the hints file? Regards Stefan

1 0

FreeRadius Log
by Danilo Molini 23 Jul '08

23 Jul '08

Hi all, I have installed freeradius on a debian machine and it work well. In the log I see that freeradius record failed and accepted authentication, reporting the user, the password and the user client station, but not the device wich someone has tried to make access. For example: from my pc I try to connect to a router without the correct credentials. Freeradius log that my PC with IP address 1.1.1.1 has tried to make access with the user "admin" and password "admin", but do not report the address of the router to wich someone has tried to make access, so if I use freeradius for authenticating user on many device, I can't know on which device someone has tried to make access. There is a way to log also this information? Regards Danilo

3 5

how to set eap/ttls tunnel with auth-type pap work
by Andy An 23 Jul '08

23 Jul '08

Hi Alan/Ivan: As i configured my freeradius server 2.0.5 for our realm xxxx.ca with Ivan's guides it works well by local test or NTRadPing (from WinXP) which did not use any eap stuff. But as I tested by Netgear AP which needs to use eap/ttls/ tunnel and in the tunnel to use pap then it failed with message "rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user." (no matter if my username with/without realm). Before I created realm xxxx.ca in proxy.conf file both types of tests( i.e. with/without eap/ttls tunnel)work fine. enclosed here the debugging output message: rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=52, length=153 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000b01616e6479616e Message-Authenticator = 0x9b0622cd28c0ca07a2894252266d9582 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:18 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 0 length 11 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated rlm_ldap: - authorize rlm_ldap: performing user authorization for andyan WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=andyan) expand: ou=People,dc=eciad,dc=ca -> ou=People,dc=eciad,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ldap1.eciad.ca:389, authentication 0 rlm_ldap: bind as cn=radius,ou=Applications,dc=eciad,dc=ca/#password to ldap1.eciad.ca:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=People,dc=eciad,dc=ca, with filter (uid=andyan) rlm_ldap: Added User-Password = {crypt}24234234fsdgfs2342 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user andyan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 52 to 10.10.10.29 port 1265 EAP-Message = 0x010100061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424c846361777cb0ac160f1e24 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=53, length=272 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201007015800000006616030100610100005d030148867b68f229dc3370728c32f16cc8eba5dace189d85f03d39f18438ab70dbde000036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100 State = 0x4c8576424c846361777cb0ac160f1e24 Message-Authenticator = 0x5d147b305a321b03b57beb1712544955 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:18 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 1 length 112 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 102 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0061], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 085e], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 53 to 10.10.10.29 port 1265 EAP-Message = 0x0102040015c0000008bb160301004a02000046030148867b5eef813368f7f8a4d7a1763bcb77f3abe2e302c009685f134c0dd2a5d820f3f04518281bc20040b6888ed2ac438c03f5acefad34e1e45c69a9d22ddd6349002f00160301085e0b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d3126302406035504 EAP-Message = 0x03131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303631383232303934315a170d3039303631383232303934315a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100c5d8f1bfb0aec2555c5e034ee4677c814ac120afc2c6737fae65f755df4a EAP-Message = 0x2af9434f85596064fc5bcd9b5f2e16f426c39ff51614c80a65c2e067a3a4c7911a38a3b8839007ea4d03cbda93410f383e643cd8bd788e9e14d2b3abd1067ad10efcc6eb0f8b8c0302ff00327e8604af8c16debd1e6ca2195d2b8187ca25e77d5f7bd4c84b985981baf5fd0be7cabe98da5d14817bd3ad62f2ac4f281098433100a22663ddb348f2a6ed0dd82f1de13a8ad2a57a3afe6d1e82eca0bf7f708ef7b7999a1af5b78b30171d2a40ce03d8b4daedcacd5bd389559f4b7fc82a4c411712829a3b5a09686b33a1c50abe21e8cff6189d8a481e19871e6f8b629e79dbf5ff590203010001a317301530130603551d25040c300a06082b06010505 EAP-Message = 0x070301300d06092a864886f70d01010405000382010100abdc8d29f0855dd309bd358b192e5c368fa45e161de5671519a4ae6db6c8ed586c8a6c3565dbc39b7c3c648061daabd6d1a220997c7caf6d105df85affd385a5dbae3b9b9040f59b066fa399496d909f04ffbe88e13cb90791e3fa8cb66577101e2967fe5a9d562b5c903c7f3625c59de375241836391ccb85aaad9d02a15af33203b928cdff6276ad00bfdaf17f5ef12d0370926d5dee595b22f0dd8a332ffe2c6e3f80d55551787a6b58e31933c44a6282f6eaaefc8c454955db064b742cf6907cf558d08da46b3a3e1925581fee05bb6ca641511d4f35c7880bbedfed8ea20f0276b21a85 EAP-Message = 0x2889877f5db3c70defc739be Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424d876361777cb0ac160f1e24 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=54, length=166 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061500 State = 0x4c8576424d876361777cb0ac160f1e24 Message-Authenticator = 0x0b5f2f4dbef2761860878e8a58a3fb97 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 2 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 54 to 10.10.10.29 port 1265 EAP-Message = 0x0103040015c0000008bbcef8e8135051d22c8e604c46bbe50004ab308204a73082038fa003020102020900964407b7ca8a72e7300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3038303631383232303933395a170d3038303731383232303933395a308193310b EAP-Message = 0x3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100e71a28d861d1bc000ead67dda77fc24c88fd7f4e6b154ec39e6c1328da93acb45c4203d45485a76bd3ebf28e55486d785b45f54c81ee601a8e73e1c07d16f606a1b6146055903f54ebc8a5 EAP-Message = 0x06d421fb703b664bc1a37493d95559d894f04a2ca09c3c5292e9d82cff10a031177cab034ab883b3871e6c2460325a0d8a2a68322698cde33ad81ed808a429177249ff720932bea36f3558c8037fba4110a20451ed263bdd7021686bc816249ff209de18ebc36a923977b852b198a70b3601fb87b263c740a0d191a59591300981709f9beb6987b67bdfa820db88dcb3c3af3fa827552afb43f6accf386739f292c311b7f6287609afec629a4b8f1c0c0d4a9e165d0203010001a381fb3081f8301d0603551d0e041604148fc1ab4304f6a473ea66c4512ef6f9a078dbe3623081c80603551d230481c03081bd80148fc1ab4304f6a473ea66c4512ef6 EAP-Message = 0xf9a078dbe362a18199a48196308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900964407b7ca8a72e7300c0603551d13040530030101ff300d06092a864886f70d010105050003820101008c2687a029f098693008dbc4ee9968c7e71b0a4792003dc2d62403a142c75c227df610ac8979ffd430cf55103bab EAP-Message = 0xb78977c9a55b9a3571e655a3 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424e866361777cb0ac160f1e24 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=55, length=166 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061500 State = 0x4c8576424e866361777cb0ac160f1e24 Message-Authenticator = 0x427b0f9046aa0368441bfe10c2d7179a +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 3 length 6 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 55 to 10.10.10.29 port 1265 EAP-Message = 0x010400d91580000008bb04ae601515d34e563c02cc3de859401a836dc8d5b9e0c675cc610078839fc238a6f3ca30ce79381a61c588416489587635fe1fa874b66bc643d652e322305ad54f40382d23f7fe74c6df9df734c099780d8604e304ca13d8bc9e2bb3ebd9221731634de6099bb36ff584bae8b16bfd00d3b19ffe67c20b40e9d66366325f55810904fc6fa593c6186bf3cedd075e3c447a65a23d444547c434ec02220b377133980437496ee79601f296ea241e10ed902bcdf83adac9980a26ac91f4b034ef1e88febcd2e3a416030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c8576424f816361777cb0ac160f1e24 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=56, length=498 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0204015015800000014616030101061000010201004ceebe5f879c41a3395d900eea4eb9966d09e70dc9df76e62f4b0affb35186dbaf85a117a323524a163eaa6f96d26ed9c7e9e75bbf86c15067035166e9e00b5e7226527516b954ba6b671993562c37555bbfe8a01223163311723e6e54d4f799c84d5c31745b311c0ac699953c5b854eb6f490116780513148e5d1e65c5974824b5fb3d951969c0e631c0511f7a5e4362927de0802017cb1bddf30bcf459b83f4faf5c1bc0e9b3d2714121d5e8952ab7746f63747bfb56134f5943d006a9c08a66de60ee8f2bf08ecea6919f8c9b1fd54dd4ad4d4ceefe6ac7bdeb8a4618549b22278c2065efcff4 EAP-Message = 0x24092ced63af3d613749e3b3b718a8050e3598c26e4fa27914030100010116030100300e32ab01355213c817cdedc7514b16d9b5f9e654efa6b9719e0270680c1ba911b01901404fc087870162cdadcd55db30 State = 0x4c8576424f816361777cb0ac160f1e24 Message-Authenticator = 0x35b507b12476ef1128fe82146ce3a7eb +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 4 length 253 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 326 rlm_eap_tls: Length Included eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 56 to 10.10.10.29 port 1265 EAP-Message = 0x0105004515800000003b1403010001011603010030fde8c6f00ff0117be406521d638021351155e4bf6e518fe011ae9856c9a02a77a7c883770992848eb3f5ef926cb0a2cd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x4c85764248806361777cb0ac160f1e24 Finished request 4. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.10.10.29 port 1265, id=57, length=319 User-Name = "andyan" NAS-IP-Address = 10.10.10.29 NAS-Port = 2 Called-Station-Id = "00-14-6C-CC-93-E8:eduroam" Calling-Station-Id = "00-17-F2-52-8A-C7" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0205009f1580000000951703010090a9ab31a7f43c2c59f864f296d626095e508727aa6d4307653d6b9ecbe7650e8ea07fdb2154f9309e6beae535be1fff046b09d490cb1812abd04d9786a8581c5aff4c9bcded643edc67f71220341b01f4bcc1cd1eb13f3610fe7ddef6bb2b7b78f9d131f3c788f156c965e1fcd9fa219ae71b29e33f8cb796582208aa4155e240d2f19d32eb483e97707ca9d74e47924c State = 0x4c85764248806361777cb0ac160f1e24 Message-Authenticator = 0x0ae56b01a9b527a7ea9ec6b016b0f1c3 +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: EAP packet type response id 5 length 159 rlm_eap: Continuing tunnel setup. ++[eap] returns ok rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS TLS Length 149 rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. +- entering group authorize expand: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.10.10.29/auth-detail-20080722 expand: %t -> Tue Jul 22 17:29:19 2008 ++[auth_log] returns ok rlm_realm: No '@' in User-Name = "andyan", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "andyan" rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. ++[suffix] returns ok rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for andyan WARNING: Deprecated conditional expansion ":-". See "man unlang" for details expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=andyan) expand: ou=People,dc=eciad,dc=ca -> ou=People,dc=eciad,dc=ca rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=People,dc=eciad,dc=ca, with filter (uid=andyan) rlm_ldap: Added User-Password = {crypt}26dafouiho8902 in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user andyan authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: No clear-text password in the request. Not performing PAP. ++[pap] returns noop auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select ++[eap] returns invalid auth: Failed to validate the user. Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> andyan attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 57 to 10.10.10.29 port 1265 EAP-Message = 0x04050004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 5. Going to the next request Thanks in advance for any guide/clue. -- Andy An Junior Programmer Information Technology Services Emily Carr University of Art and Design Tel: 604-630-4556 Fax: 604-844-3801 SB Room 341

2 1

ntlm_authentication for multiple supplicants
by splintered thoughts 23 Jul '08

23 Jul '08

Hello, I've trying to get ntlm_auth to authenticate several supplicants using freeradius 1.1.6, specifically with MacOS and Windows XP SP3, and I've attempting to inspect the contents of variables while doing the ntlm_auth authentication. My ntlm_auth command is: ntlm_auth --request-nt-key --username=%{Stripped-User-Name:-%{User-Name:-%{mschap:User-Name}}} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} Is there a way to use regular expressions or otherwise to inspect the Stripped-User-Name to adjust which radius attribute is used in the ntlm_auth command, in other words look for a value Stripped-User-Name =~ /^value(.*)$/ and then use, for instance, the %{mschap:User-Name}in its place to authenticate? Is there a better approach? Thanks, John

2 1