January 2009 - Freeradius-Users - lists.freeradius.org

Is it possible to have eap-peapv0 connect before xp shows logon box?
by Josh Hiner 28 Jan '09

28 Jan '09

So, I was going to use eap-tls to have the windows xp workstations sign into the wireless network before the user logs on (by assigning a cert to the machine account) but tls is not working for users or machines and I would like to have a backup. I have eap-peopv0 and eap-ttls working fine but they require a client username and password to connect and those are not supplied until the user logs in. We have many clients here on roaming profiles, so their profiles time out if I set them to peap or ttls since the wireless doesnt fire up in time after they log in. Is there a way to get peap or ttls (with ttls I use the SecureW2 client) to connect before the user logs on? I know that sounds lame because peap and ttls need a username and password... but maybe we can assign it statically in the background to the machine account or something? What are others doing? I really dont want wpa2-aes with a psk. Thanks for any ideas. Hopefully I can get the eap-tls thing sorted out with help but would like a backup plan. -Josh

1 0

sql insert via unlang
by Flamur Rogova 28 Jan '09

28 Jan '09

Hi, I have a couple of modules in this order, and I need to log only rejects(from each module) to sql, - check_password, "a1 User-Password := "a1" - check_maxoctets, "a1 Max-All-Octets := 100000" in my authorize section, I have this, ... check_password if(notfound) { # log notfound to sql, the line below gives error... "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" } check_maxoctets if(reject) { # log to sql... } ... When I start radiusd, it gives: ... rlm_fastusers: Loaded 3 users and 1 defaults /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to find module "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }". /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to parse "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" entry. /home/radius205/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules ... man unlang says it is possible to obtain results from db, but I need to execute only sql INSERT, is my syntax wrong ? Thanks, Flamur

7 10

Re: Rules in policy.conf
by Martin Silvero 28 Jan '09

28 Jan '09

for example in the policy file type: permit_only_eap { if (Calling-Station-Id==001f.3c22.674a) { ... here, depending on the mac, is due to the user a VLAN } this would be after the auntenticacion for PEAP-MSCHAPv2 with username and password. the idea is to authenticate users with LDAP, but once authenticated check your Calling-Station-Id, and depends on the mac is due to a specified VLAN

2 1

Copying Attributes Between Proxy-Reply and Reply Messages
by Mike Loosbrock 28 Jan '09

28 Jan '09

Hello, I'm running 2.0.4 on Debian testing. I have a test setup in which I'm proxying access requests between two virtual servers running inside the same daemon: radtest <---> [ virtual server A <---(proxy)---> virtual server B ] Proxing is triggered using the rlm_realm module and all attr_filter module instances in radiusd.conf have been commented out. Authentication works fine, but reply attributes created by B are not being returned to radtest unless I configure the following in A: post-auth { update reply { Attribute1 := "%{proxy-reply:Attribute1}" Attribute2 := "%{proxy-reply:Attribute2}" Attribute3 := "%{proxy-reply:Attribute3}" ... } } My understanding is that without any attribute filters in place, the proxy-reply list in virtual server A is supposed to be automatically copied to its reply list. Is this correct, or is there an option that needs to be set somewhere? Also, it seems that this scenario is functionally similar to how the peap and ttls modules proxy tunneled EAP exchanges to another virtual server using the 'virtual_server' option. Those modules use a 'use_tunneled_reply' option which seems to force the behavior I'm trying to achieve. Or am I way off the mark? I've attached what I think is just the relevant debug output. If more is needed, please let me know. Thanks! ### START DEBUG OUTPUT ### ... server monitor { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating vpn_realm realm vpn_realm { format = "prefix" delimiter = "." ignore_default = yes ignore_null = yes } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } server vpn { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } } server { modules { } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "proxy" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 4041 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 4030, id=27, length=76 User-Name = "vpn_realm.mloosbro" User-Password = "password" NAS-IP-Address = 10.0.1.200 NAS-Port = 1 Framed-Protocol = PPP server monitor { +- entering group authorize rlm_realm: Looking up realm "vpn_realm" for User-Name = "vpn_realm.mloosbro" rlm_realm: Found realm "vpn_realm" rlm_realm: Adding Stripped-User-Name = "mloosbro" rlm_realm: Adding Realm = "vpn_realm" rlm_realm: Proxying request from user mloosbro to realm vpn_realm rlm_realm: Preparing to proxy authentication request to realm "vpn_realm" ++[vpn_realm] returns updated } # server monitor +- entering group pre-proxy ++[noop] returns noop >>> Sending proxied request internally to virtual server. server vpn { +- entering group authorize expand: %{control:NS-Override-User} -> expand: %{Stripped-User-Name} -> mloosbro expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> mloosbro expand: %{%{control:NS-Override-User}:-%{%{Stripped-User- Name}:-%{%{User-Name}:-DEFAULT}}} -> mloosbro rlm_sql (ns-sql-vpn): sql_set_user escaped user --> 'mloosbro' rlm_sql (ns-sql-vpn): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck_asa WHERE username = '%{SQL-User- Name}' ORDER BY id -> SELECT id, username, a WHERE username = 'mloosbro' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergr BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupcheck_asa WHERE groupname = 'its- network' ORDER BY id rlm_sql (ns-sql-vpn): User found in group its-network expand: SELECT id, groupname, attribute, value, op FROM radgroupreply_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupreply_asa WHERE groupname = 'its- network' ORDER BY id expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupcheck_asa WHERE groupname = 'employee' ORDER BY id rlm_sql (ns-sql-vpn): User found in group employee expand: SELECT id, groupname, attribute, value, op FROM radgroupreply_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupreply_asa WHERE groupname = 'employee' ORDER BY id rlm_sql (ns-sql-vpn): Released sql socket id: 4 ++[ns-sql-vpn] returns ok ++[control] returns ok rad_check_password: Found Auth-Type Kerberos auth: type "Kerberos" +- entering group Kerberos rlm_krb5: verify_krb_v5_tgt: host key not found : No such file or directory ++[krb5] returns ok Login OK: [mloosbro/password] (from client monitor port 1 via TLS tunnel) } # server vpn Going to the next request <<< Received proxied response from internal virtual server. +- entering group authorize rlm_realm: Proxy reply, or no User-Name. Ignoring. ++[vpn_realm] returns noop rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Login OK: [vpn_realm.mloosbro/password] (from client monitor port 1) +- entering group post-auth ++[noop] returns noop Sending Access-Accept of id 27 to 127.0.0.1 port 4030 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 4030, id=27, length=76 Sending duplicate reply to client monitor port 4030 - ID: 27 Sending Access-Accept of id 27 to 127.0.0.1 port 4030 Waking up in 4.9 seconds. Cleaning up request 0 ID 27 with timestamp +3 Ready to process requests. ### END DEBUG OUTPUT ### Mike Loosbrock Bethel University Network Services 651-638-6723

2 1

including freeRADIUS
by rosect190＠yahoo.com 27 Jan '09

27 Jan '09

Does anyone have experience in including freeRADIUS in their project, just like including openSSL in a project?

2 1

MAC address restriction with EAP-TLS
by John T. Guthrie III 27 Jan '09

27 Jan '09

Hello all, We are currently using EAP-TLS authentication with FreeRADIUS at the place where I work right now. Management would like to be able to restrict the use of a given certificate for this authentication to specific MAC addresses. In other words, for each certificate, the desire is to tie that certificate to one or a couple MAC addresses, and to say that that certificate may only be used if it is coming from those specific MAC addresses. If the certificate is used from a different MAC address, then authentication should fail. I have tried to look for info on this on the web to no avail. I also understand that EAP-TLS authentication generally needs to be left out of the users file. But the only way that I can think of to restrict MAC addresses would be to place some kind of line involving a Calling-Station-ID in the users file. So I am at a loss. Does anyone have any suggstions? We are currently using 1.1.3. Thank you very much. John Guthrie guthrie(a)counterexample.org

2 5

Rules in policy.conf
by Martin Silvero 27 Jan '09

27 Jan '09

Hi list. I want to know if I can handle VLAN's on file policies and create a conditions with Calling-Station-Id this should be make after the authentication with user and pass.

2 1

Affect IP with script perl into freeradius
by Phibee Network Operation Center 27 Jan '09

27 Jan '09

Hi i use the perl example supplied with freeradius for authenticate my user. modules { perl { module = "/etc/raddb/Test-Auth.pl" func_accounting = accounting func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_checksimul = checksimul func_xlat = xlat } If i want add a IP Address for one specific user, what is the process ? sample: All user => Use Pool of the NAS One specific user => use 192.168.50.1 (static IP) Thanks jerome

2 7

eap-ttls failing
by Josh Hiner 27 Jan '09

27 Jan '09

I have a Ruckus ZoneDirector 1025 with waps that I just installed. Testing out different EAP types I can use. I am using FreeRadius 2.1.3. I have eap-ttls and eap-peapv0 working perfectly (I am using windows to control the wireless card for peap and it works great). Was going to try eap-tls by assigning client certificate to the machine account so the computer account authenticates on the wireless and then the user can log into the domain. I did this and get errors. It kind-of looks to me that the Zone Director is not sending the correct eap message for eap-tls. Maybe someone could point me in the right direction. Also, something is putting host/ in front of the User-Name field. In the certificate, I have the common name as joshhiner not host/joshhiner. Wonder if the zone director is mangling eap? Also, the wireless card is a mini-pci broadcom in a compaq 6710b. Thanks -Josh Error: Ready to process requests. rad_recv: Access-Request packet from host 172.17.10.108 port 1027, id=186, length=192 User-Name = "host/joshhiner" NAS-IP-Address = 172.17.10.108 NAS-Identifier = "00:1f:41:3a:82:f9" NAS-Port = 2 Called-Station-Id = "00-1F-41-3A-82-F9:CCISD-REMC1" Calling-Station-Id = "00-21-00-41-AE-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001301686f73742f6a6f736868696e6572 Message-Authenticator = 0x5a46b20a893c5d940dfacf2c35c1bd83 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/joshhiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "host/joshhiner", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 0 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 226 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/joshhiner attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 186 to 172.17.10.108 port 1027 Waking up in 4.9 seconds. Cleaning up request 2 ID 186 with timestamp +373 Ready to process requests.

2 10

2.1.3 first start error
by hege 27 Jan '09

27 Jan '09

Hi I have installed the freeradius 2.1.3 from source, and and get this error, on first start: radiusd: error while loading shared libraries: libfreeradius-radius-2.1.3.so: cannot open shared object file: No such file or directory what is the problem. Gabor

1 0