September 2008 - Freeradius-Users - lists.freeradius.org

Missing field in accounting
by Arrigo Savio 30 Sep '08

30 Sep '08

Hi everybody. I'm trying to complete the setup of freeradius 2.1.1. I have the following problem: When the data flow passes from authentication to accounting, I miss the stripping of the username/realm. I mean: in first authentication step, I have correctly splitted the username (test) from the realm (realm.com) and infact the "INSERT INTO radpostauth" is correctly populated. The next query, that should write into accounting table, doesn't find %{Stripped-User-Name} and %{Realm} values, so that it put empty fields in the table. All other fields are correct. BTW, if I put in dialer.conf accounting query the field %{SQL-User-Name}, I find the field populated with the whole username (test(a)realm.com, in the example below). Can you help me, please? Arrigo [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' . ++[sql] returns ok Login OK: [prova(a)realm.com/realm] (from client C831 Test port 92) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/reply-detail-20080930 [reply_log] expand: %t -> Tue Sep 30 17:53:01 2008 ++[reply_log] returns ok [sql] expand: %{Stripped-User-Name} -> test [sql] sql_set_user escaped user --> 'test' [sql] expand: %{User-Password} -> realm [sql] expand: INSERT INTO radpostauth (username, realm, pass, reply, authdate) VALUES ( '%{Stripped-User-Name}', '%{Realm}', '%{%{User- ... ++[sql] returns ok +- entering group preacct {...} [acct_unique] Hashing 'NAS-Port = 92,Client-IP-Address = 10.0.1.224,NAS-IP-Address = 10.0.1.224,Acct-Session-Id = "000000D8",User-Name = "prova(a)realm.com"' [acct_unique] Acct-Unique-Session-ID = "1bdfdc3b2335277d". ++[acct_unique] returns ok +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.0.1.224/detail-20080930 [detail] expand: %t -> Tue Sep 30 17:53:01 2008 ++[detail] returns ok [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' [sql] expand: %{Acct-Delay-Time} -> 0 [sql] expand: INSERT INTO radacct (acctsessionid, acctuniqueid, username, realm, nasipaddress, nasportid, nasporttype, acctstarttime, acctstoptime, acctsessiontime, acctauthentic, connectinfo_start, connectinfo_stop, acctinputoctets, acctoutputoctets, calledstationid, callingstationid, acctterminatecause, servicetype, framedprotocol, framedipaddress, acctstartdelay, acctstopdelay, xascendsessionsvrkey) VALUES ('%{Acct-Session-Id}', '%{Acct-Unique-Session-Id}', '%{Stripped-User-Name}', '%{Realm}', '%{NAS-IP-Address}', '%{NAS-Port}', '%{NAS-Port-Type}', '%S', NULL, '0', '%{Acct-Authentic}', '%{Connect-Info}', '', '0', '0', '%{Called-Station-Id}', '%{Calling-Station-Id}', '', '%{Service-Type}', '%{Framed-Protocol}', '%{Framed-IP-Address}', rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 ++[sql] returns ok Arrigo

2 1

EAP-TTLS-PAP using LDAP for authorization and PAM for authentication
by Erik Karlsson 30 Sep '08

30 Sep '08

Hello! I am trying to set up a simple Wlan-authentication using EAP-TTLS to avoid client certificates and PAM to use the server system authentication scheme. PAM doesn't know about users, and the users are situated in a LDAP database, which I think makes it logical to use rlm_ldap for authorization. I.e. I just want to check that users exist in LDAP and then move on to checking the password against PAM. The problem is that PAM is never used. This seems to be an artifact of the fact that rlm_ldap is supposed to fetch a "known good" password, but I don't have passwords in the LDAP database. rlm_ldap is indeed successful in authorizing, but there is no Auth-Type set to handle the authentication. If I for example force Auth-Type to PAM in the users file (not good, I know), TTLS-negotiation is never run. If I add Auth-Type LDAP { pam } to the authenticate section and let rlm_ldap set Auth-Type, it works with radtest, but fails using TTLS: pam_pass: function pam_acct_mgmt FAILED for <USERNAME>. Reason: Authentication service cannot retrieve authentication info My configuration is: FreeRADIUS 2.0.5 sites-enabled/default: authorize { preprocess auth_log eap { ok = return } files ldap pap } authenticate { Auth-Type PAP { pap } pam eap } Regards, Erik Karlsson.

4 11

Proxying EAP-TTLS requests via 2.1.0 to 1.1.7
by Peter Eriksson 30 Sep '08

30 Sep '08

Sorry about this long first mail, but I figured I'd try to include as much information as possible. right away.. I'm trying to set up a rather complicated RADIUS structure that I hope will be able to support a number of different needs. Anyway, some bit of background information. Things I need to support: EDUROAM for my roaming users at other sites around Europe. EDUROAM for roaming users at my site via WLAN access points (SSID "EDUROAM"). Normal 802.1x for our local users via WLAN (another SSID) Normal 802.1x-enabled ethernet ports on switches. Modem pool access (Ascend MAX4000 - olde faithful still going strong :-) for out users and two neighboring departments (separate user databases) VPN gateway access (Nortel Contivity and OpenVPN) for out users and one other neighboring department. + More stuff (web services)... "Access" Hardware/Software: D-Link DWL-3200AP and DWL-8200AP WLAN access points HP ProCurve ethernet switches Ascend MAX4000 modem pool Nortel Contivity IPSEC VPN gateway OpenVPN server Anyway, I have set up our access points to successfully do EAP-TTLS authentication via RADIUS to a FreeRadius 1.1.7 server since this spring. (The VPN and modem pool is handled by another very old RADIUS server for the moment but I'm planning on moving those to the new FreeRadius structure when things are working smoothly). But now in our quest for implementing EDUROAM I starting looking at using FreeRadius 2.1 and do some intelligent proxying based on various criterias which gets complicated pretty quickly... :-) 1) Users connecting to the WLAN SSID "EDUROAM" should be handled as EDUROAM authentication requests and routed thru those RADIUS servers, and if successful should end up on our "EDUROAM" VLAN. 2) Users connecting to our "PERSONAL" WLAN SSID should be handled as local users only and if successfully authenticated should end up on our "TWILIGHT ZONE" VLAN. It seems I should be able to distinguish at the RADIUS server side between #1 and #2 via the "Called-Station-Id" attribute since the D-Link AP's we are using sets that to something like: Called-Station-Id = "00-17-9A-D3-9A-BA:EDUROAM" (where the last part is the WLAN SSID). 3) Users connecting to the 802.1x enabled physical ethernet ports should if authenticating as USER(a)ifm.liu.se be handled like #2 above, else be handled like #1 above, and if completely unsuccessful should be conencted to a third special VLAN. (This should be doable via the a RADIUS attribute telling the switch which VLAN to switch a successfully authenticated user's port to). 4) Modem pool users should accept request from three different realms USER(a)ifm.liu.se USER(a)dept2.liu.se USER(a)dept3.liu.se Route those to the correct RADIUS server responsible for authenticating those users, and in the response set the Ascend-special attributes to 'give' the user the right IP# from the departments special IP pools 5) VPN pool users should do something similar to #4 but using the Nortel-specific attributes. (We do #4 and #5 already today with the stoneage RADIUS server, sans the RADIUS-proxying stuff I want to do). Anyway - what I'm curious about is if there are others 'out there' that have done similar stuff before? Any cookbooks for setting up a FreeRadius 2 server in an EDUROAM environment? Anyone with experience talking to D-Link DWL-3200AP or 8200AP with EAP-TTLs and FreeRadius 2? I ran into a problem directly - for some unknown reason when I redirect my APs to talk to a proxying-only FreeRadius 2.1.0 server that forwards requests to our old FreeRadius 1.1.7 server the access points doesn't seem to correctly understand or mishandles (sort of - it looks like things are going OK, but the Window and MacOS X clients just goes into a loop with reretrying the authentication sequence and never finishing) the 'Access-Accept' sent to them after having successfully authenticated the user... And I'm at a loss as to why. I tried running the radiusd servers with -X to see what the difference in the responses are and I can't really see any big differences: FreeRadius 1.1.7 directly to the Access Point: First request: rad_recv: Access-Request packet from host 192.168.160.158:1115, id=0, length=181 Message-Authenticator = 0x377dba909d00b36f5edacd2d732b8cc6 Service-Type = Framed-User User-Name = "testson" Framed-MTU = 1488 Called-Station-Id = "00-17-9A-D3-9A-BA:EDUROAM" Calling-Station-Id = "00-30-65-18-72-61" NAS-Identifier = "ap13434" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000c0174657374736f6e NAS-IP-Address = 192.168.160.158 NAS-Port = 2 NAS-Port-Id = "STA port # 2" Last response: Sending Access-Accept of id 6 to 192.168.160.158 port 1096 MS-MPPE-Recv-Key = 0xd95114ac0ba4ea2f18815d9d713bcc09730dce74705a24e87c1b3ff1e59bb391 MS-MPPE-Send-Key = 0x59bdb8c81b2d31916a50dbd43079f019616468618cd956c2bb8db99b29436b22 EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testson" Finished request 6 FreeRadius 2.1.0 directly to the Access Point (with a response received via Proxying to the same 1.1.7 server): First request: rad_recv: Access-Request packet from host 192.168.160.158 port 1036, id=0, length=181 Message-Authenticator = 0x54e5c5b797c55e4cf49655edfa140e05 Service-Type = Framed-User User-Name = "testson\000" Framed-MTU = 1488 Called-Station-Id = "00-17-9A-D3-9A-BA:EDUROAM" Calling-Station-Id = "00-30-65-18-72-61" NAS-Identifier = "ap13434" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000c0174657374736f6e NAS-IP-Address = 192.168.160.158 NAS-Port = 2 NAS-Port-Id = "STA port # 2" Last response: Sending Access-Accept of id 6 to 192.168.160.158 port 1036 Vendor-Specific = 0x0000013711348565439b6986f71bfa7425319eac8dd791f24936bc66a8cdd928a91c9c4343958ef040212 4dd4f552726302e356b878e6474 Vendor-Specific = 0x0000013710348b855687f3a4ef1194289232229fe0be952c98689fb606c1e9d6ceae6a388baee98eeb292 be2d41ae58efa7f67737dec758c EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testson" Finished request 6. (I assume that 'Vendor-Specific' stuff is the MS-MPPE-Recv-Key stuff that the 1.1.7 talks about). Any suggestions? - Peter

2 8

RLM-EAP-MD5 compilation problem
by Andre Dieball 30 Sep '08

30 Sep '08

Hi there I¹m trying to build a rpm for my CentOS 5.2 system. Everything worked fine the first time, but I need to do it again, as I need to include some special rlm-eap-md5 src files in order to make my freeradius to work with Kobil SecOvid (something similar to RSA SecureID). When I start to comile the rpm, it stops with the following: ---cut--- Making all in rlm_eap_md5... gmake[9]: Entering directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes/rlm_eap_md5' /usr/bin/libtool --mode=compile gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/libltdl -I../.. -I../../libeap -c rlm_eap_md5.c mkdir .libs gcc -O2 -g -march=i386 -mcpu=i686 -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -Wall -D_GNU_SOURCE -DNDEBUG -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src -I/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/libltdl -I../.. -I../../libeap -c rlm_eap_md5.c -fPIC -DPIC -o .libs/rlm_eap_md5.o `-mcpu=' is deprecated. Use `-mtune=' or '-march=' instead. rlm_eap_md5.c:24:22: error: autoconf.h: No such file or directory rlm_eap_md5.c:31:24: error: rad_assert.h: No such file or directory rlm_eap_md5.c: In function 'md5_initiate': rlm_eap_md5.c:73: warning: implicit declaration of function 'lrad_rand' gmake[9]: *** [rlm_eap_md5.lo] Error 1 gmake[9]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes/rlm_eap_md5' gmake[8]: *** [common] Error 2 gmake[8]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes' gmake[7]: *** [all] Error 2 gmake[7]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap/t ypes' gmake[6]: *** [common] Error 2 gmake[6]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules/rlm_eap' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/home/adieball/rpmbuild/BUILD/freeradius-server-2.1.0' make: *** [all] Error 2 error: Bad exit status from /var/tmp/rpm-tmp.22909 (%build) RPM build errors: Bad exit status from /var/tmp/rpm-tmp.22909 (%build) ---cut--- As I'm a total newbie of both systems, I'd like to ask some questions: 1. can anyone see what the real problem is? Are the src files (the replacements) using something which is not available in freeradius 2.x anymore? They say they have tested with 1.x. (I'm currently trying to get information on their support of 2.x) Thanks a lot in advance Andre

3 6

Reject from SQL when user is in users file
by Karl Auer 29 Sep '08

29 Sep '08

Anyway, this is the first of three *actual* questions. I have just set up freeradius 2.1.1. I have an entry in the users file, and when I use radtest, I get the expected correct answers back from the radius server. Then I added "sql" to the default authorize, accounting and post-auth sections in site-enabled/default. The database exists, but not the tables. The server makes connections to the database just fine, but obviously all queries fail :-) Now I get Accept-Reject for the same user. The users file is the same. No changes have been made to the configuration except adding the SQL stuff. If *just* the "sql" lines in the authorize section and the post-auth section are commented out, it goes back to working. My question is: Is this to be expected? Does a failure in SQL somehow override the entry in the users file? Or is this an indication that I've screwed something else up? Regards, K. -- ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Karl Auer (kauer(a)biplane.com.au) +61-2-64957160 (h) http://www.biplane.com.au/~kauer/ +61-428-957160 (mob) GPG fingerprint: DD23 0DF3 2260 3060 7FEC 5CA8 1AF6 D9E3 CFEE 6B28

2 4

Accounting table in MS-CHAP session
by Arrigo Savio 29 Sep '08

29 Sep '08

Hi. I'm trying to configuring accounting in MS-Chap session. I can see in logs (attached) that accounting is written in /var/log/radius/radacct directory, but not in radacct table, as PAP, CHAP and other types of authentication. Can you explain me where I have to setup it? Arrigo Here are the logs: +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [sql] expand: %{User-Name} -> wifi [sql] sql_set_user escaped user --> 'wifi' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wifi' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wifi' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'wifi' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok [suffix] No '@' in User-Name = "wifi", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = MSCHAP +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for wifi with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok Login OK: [wifi/<via Auth-Type = mschap>] (from client WLController port 1535 cli 00-16-EA-87-5D-46) +- entering group post-auth {...} [reply_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/radius/radacct/10.0.4.223/reply-detail-20080929 [reply_log] /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/10.0.4.223/reply-detail-20080929 [reply_log] expand: %t -> Mon Sep 29 17:54:34 2008 ++[reply_log] returns ok [sql] expand: %{User-Name} -> wifi [sql] sql_set_user escaped user --> 'wifi' [sql] expand: %{User-Password} -> [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wifi', '', 'Access-Accept', '2008-09-29 17:54:34') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'wifi', '', 'Access-Accept', '2008-09-29 17:54:34') rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok Finished request 18.

2 1

2.1.1 - radiusd.sock - permission denied
by John Horne 29 Sep '08

29 Sep '08

Hi, I have installed FR2.1.1 onto a test server, built using the Fedora rawhide RPM source. No problems building and installing FR, but when I start FR it seems to immediately stop. The radius.log file just shows: Fri Sep 26 17:20:58 2008 : Error: Failed to stat /var/run/radiusd/radiusd.sock: Permission denied The ls command shows: ls -l /var/run/radiusd/radiusd.sock srw-rw---- 1 radiusd radiusd 0 Sep 26 16:53 /var/run/radiusd/radiusd.sock I have tried disabling selinux, and iptables, but they made no difference. Changing the permissions to 666 on the socket made no difference. Running 'radiusd -C' shows nothing, and 'radiusd -X' starts up okay. If I then use a different terminal I can run 'radmin' with no problem (which I gather uses the socket). The problem is, I can't see what permissions may be wrong. Anyone any ideas on this? John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 587287 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 587001

3 5

SLM248G switch
by David Blackman 29 Sep '08

29 Sep '08

I have purchased a Linksys SLM248G switch that has 802.1x support. I am new to radius server and would like to use this switch to authenticate ports for a lab to a freeradius server. I have installed freeradius 2.1.0 on freebsd 7.0 system. It is the default configuration for FreeRadius 2.1.0 with the following added to the client.conf. client 128.227.232.133 { secret = thisislinksys shortname = 232.133 } The Linksys switch is setup as follows: IP address: 128.227.220.28 Priority: 0 Authenticatio port: 1812 number of retries: 3 timeout for reply: 3 dead time: 0 key string: thisislinksys source IP address: 128.227.232.133 usage type: 802.1x The WindowsXP setup: enable 802.1x auth: checked EAP type: MD5-challenge I do not see any output from the Freeradius server running radiusd -X.

5 9

Auth-Type question!
by Jelena Žagar 29 Sep '08

29 Sep '08

Hy! I am using JRadius together with the FreeRadius. I put the jradius module inside the authorize and post-authenticate sections. Authorize section (implemented inside JRadsius server) sets the Auth-Type on Accept. As you can see, the next is received from the rlm_jradius module of FreeRadius when auth-type is set on Accept by JRadius server. The code of auth-type attribute is 1000 and as you can see there is such attribute in the Radius request. rlm_jradius: reading packet: code=1 len=203 rlm_jradius: reading attribute: type=1; len=6 rlm_jradius: reading attribute: type=2; len=11 rlm_jradius: reading attribute: type=61; len=4 rlm_jradius: reading attribute: type=5; len=4 rlm_jradius: reading attribute: type=4; len=4 rlm_jradius: reading attribute: type=232; len=4 rlm_jradius: reading attribute: type=31; len=10 rlm_jradius: reading attribute: type=6; len=4 rlm_jradius: reading attribute: type=80; len=16 rlm_jradius: reading attribute: type=1052; len=4 rlm_jradius: reading attribute: type=1000; len=4 Why FreeRadius is saying: auth: No authenticate method (Auth-Type) configuration found for the request: Re jecting the user I saw that auth-type is defined inside dictionyry.freeradius.internal file and that file is incuded inside the dictionary main file. What else must be done in order for FreeRadius to recognize auth-type when it is set inside the Radius request. Sincerelly, Žagar Jelena

2 5

Freeradius free zone/content accounting
by islouis 29 Sep '08

29 Sep '08

Hi all: I'm new to freeradius. Really need some help and advice here. I want to set up a LAN with 100 client, if the client want to access the LAN service(local server, local media/web) is free and/Or not count in freeradius, but if the client want to access the WAN, the freeradius will count for those traffic. Is there any way i can distinguish the traffic couting base on ip or LAN/WAN in freeradius? Or is there any NAS can do this? My network setup at the moment is Local client PPPOE router-->Switch-->freeradius+mysql+pppoe+pptpd-->ADSL router to WAN | LAN server Many thanks for any advice and help!!! Louis -- View this message in context: http://www.nabble.com/Freeradius-free-zone-content-accounting-tp19545278p19… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2