October 2009 - Freeradius-Users - lists.freeradius.org

Custom Logging
by Nasser Heidari 04 Oct '09

04 Oct '09

Dear Folks, I have added some additional radcheck options using checkval module. For example I have several NAS Servers, and I've defined which user from which NAS allowed to login. Now I want to know is it possible to configure Freeradius in a way, that when it rejects a user, it prints a custom error in log file? e.g: user test is not allowed to login via NAS 1.2.3.4, it is configured to login via 4.3.2.1 . Thanks in Advance Nasser

2 1

WiMAX HA access-request problem
by Webb Allen 04 Oct '09

04 Oct '09

Hi All, I am using the FreeRADIUS 2.1.7 for WiMAX authentication.Everything is fine in WiMAX authetication phase 1. FreeRADIUS send the Access-Accept message to ASN-GW with some required attributes as below. Sending Access-Accept of id 23 to 192.168.10.10 port 6001 MS-MPPE-Recv-Key = 0xdd32bb1bf83d56f4493782d3244f5d501011ffce043c3f5d70fb2f8ec22675c7 MS-MPPE-Send-Key = 0xd131eacf354482cec6a997bd7b25e7660f96c85f0290572af781fbe6f79e31fa EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Service-Type = Framed-User Framed-MTU = 1400 WiMAX-HA-RK-Lifetime = 172788 WiMAX-hHA-IP-MIP4 = 172.16.10.10 WiMAX-HA-RK-Key = 0xe3004e23455fd2e998b8def4dfe9ddaa34528742 WiMAX-HA-RK-SPI = 283734 WiMAX-FA-RK-Key = 0x85dd1a75f40398fe0168602b3a200a235db058fd WiMAX-MSK = 0xdd32bb1bf83d56f4493782d3244f5d501011ffce043c3f5d70fb2f8ec22675c7d131eacf354482cec6a997bd7b25e7660f96c85f0290572af781fbe6f79e31fa WiMAX-AAA-Session-Id = 0xc4e88757e4a7773cb7868674d19199e4 WiMAX-Capability = 0x020301 WiMAX-Packet-Flow-Descriptor = 0x01040001030600000002040303050307060301 WiMAX-DNS-Server = 172.16.1.1 Session-Timeout = 43200 Termination-Action = RADIUS-Request Chargeable-User-Identity = "test(a)testwimax.com" WiMAX-MN-hHA-MIP4-Key = 0x58c32ecc237cdc44474cc0a32b4203e511c6d569 WiMAX-MN-hHA-MIP4-SPI = 571665657 WiMAX-FA-RK-SPI = 571665656 In phase 2, ASN-GW send the MobileIP registration request to Home Agent. The Home Agent will check this MIP RRQ is valid or not by sending a radius request to AAA. FreeRADIUS received the request as below: rad_recv: Access-Request packet from host 172.16.10.10 port 52511, id=10, length=213 Packet-Type = Access-Request User-Name = "test(a)testwimax.com" NAS-IP-Address = 172.16.10.10 NAS-Identifier = "HA_1" WiMAX-HA-RK-SPI = 283734 Framed-IP-Address = 0.0.0.0 WiMAX-MN-HA-MIP4-SPI = 571665657 WiMAX-hHA-IP-MIP4 = 172.16.10.10 Vendor-Specific = 0x00001fe4180600000003 Vendor-Specific = 0x00001fe4a906d34f3f31 WiMAX-Release = "1.0" WiMAX-Accounting-Capabilities = 3 WiMAX-GMT-Timezone-offset = 28800 Service-Type = Framed-User Event-Timestamp = "Sep 30 2009 15:21:22 CST" Message-Authenticator = 0x30f398da4df2f3673568f56b36063a2b Chargeable-User-Identity = "NUL" I set the FreeRADIUS to send the Home Agent the Access-accept packet with some attribute(WiMAX-HA-RK-SPI,WiMAX-HA-RK-Key) with fixed value. But the FreeRADIUS can not generate the WiMAX-MN-hHA-MIP4-Key and WiMAX-MN-hHA-MIP4-SPI for that request. so Home Agent fail to validate the MIP RRQ because short of the attribute(WiMAX-MN-hHA-MIP4-Key and WiMAX-MN-hHA-MIP4-SPI). Is that any configurations for FreeRADIUS to generate the original WiMAX-MN-hHA-MIP4-Key and WiMAX-MN-hHA-MIP4-SPI for Home Agent Authentication request, or can the FreeRADIUS cache the keys been generated in phase 1 and for use in phase 2 authentication? Thanks and Regards, Allen Web

2 1

FreeRADIUS with LDAP backend (PAP works but CHAP or any other modules does not work), help please
by Ryaz Khan 04 Oct '09

04 Oct '09

Hi Guys, I am glad to say that I was able to setup FreeRADIUS ver. 2.1.7 with LDAP (slapd) authentication after a continuous research of a whole week. I can authenticate user via LDAP but it only works for PAP, radtest tool works, NTRadPing works but only when using PAP (un-checking CHAP). I tried every possible option/combination I can think of, but unfortunately none of them worked. I would appreciate if some of you can help me with that or can guide me to the right path Thx guys Ryaz Khan

3 2

Freeradius as a proxy converting EAP to non EAP radius Request
by Jacques FOUCHER 04 Oct '09

04 Oct '09

Hi, I have stil the same problem since a week and I don't understand why. Probably because I discover freeradius product, i did a basic error for somebody who know it. I reinstall Debian in the last stable version, i reinstall freeradius after that and the problem is exactly the same . In attach files, you'll find result of compiling/make, raddb configurations files and debug file when i start radiusd and when EAP response is done from radius client This is what I want to do do for those who don't know : I use eap to authenticate Wireless users on an radius server wich don't know EAP protocol. It seems that is possible to do that using a proxy freeradius. The architecture should be : Access Point as a NAS Freeradius as a proxy Radius server without EAP 192.168.0.250 192.168.0.128 192.168.0.252 The idea is to convert an EAP Response/Identity to a radius Access-Request without EAP inside As the first radius i use freeradius Version 2.1.7 As the second one, i use IAS (just to test, but in the final configuration, it will not) I modified these files: eap.conf (peap function), proxy.conf (add realm jacques.net) clients.conf (add 192.168.0.250) sites-enabled/proxy-inner.conf (modify Proxy-to-Realm) sites-enabled/default (comment suffix) remove enabled/proxy-inner.conf Nothing else ! I hope somebody could help me. Jacques

4 15

extra user attributes
by srg 03 Oct '09

03 Oct '09

Hi: I have freeradius working fine with users file in mysql instead of the "normal" users file (/etc/raddb/users). I need to have some custom user attributes for each user (lets call it custom1 and custom2 attributes and both are strings). Anybody knows what are the "best practices" to store those new custom attributes in the mysql tables? I am thinking simply to add more rows to the radcheck table having "username: user1, attribute: custom1, op:+=, value: val1". Thanks and best regards

2 1

freeradius-snmp.pl
by Jens Link 03 Oct '09

03 Oct '09

Hi all, what is the status of freeradius-snmp.pl? README says it's still alpha. Anybody still working on that? cheers Jens -- ------------------------------------------------------------------------- | Foelderichstr. 40 | 13595 Berlin, Germany | +49-151-18721264 | | http://www.quux.de | http://blog.quux.de | jabber: jenslink(a)guug.de | -------------------------------------------------------------------------

4 6

EAP/TTLS + virtual_server woes
by Alexander Clouter 02 Oct '09

02 Oct '09

Hi, Okay, I munched over the source code and I'm guessing I'm being a crettin, but I'm hoping you can tell me what I'm doing wrong. If you use the 'virtual_server' functionality in the ttls{} section of eap.conf, everything works great if you get an Access-Accept from the inner virtual server ('auth' for me). When I say "works great", I mean the 'post-auth' section of the EAP calling ('auth-eap') virtual server is munched through. However, if 'Access-Reject' is returned then 'post-auth' is not parsed and it bombs immediently back out to the to outer virtual server's ('dot1x') post-proxy section. My convoluted (for reasons of 'code' reuse) virtual server approach is: dot1x -> auth-eap -> auth Down in 'auth' is where all the LDAP magic to check user credentials is done, 'auth-eap' is dead simple: ---- server auth-eap { authorize { eap } authenticate { eap } post-auth { # if 'eap' fails, post-auth does not get run # and we have no way to get User-Name/Reply-Message :( # probably a bug I should report at some stage #Post-Auth-Type Reject { #} # slip some goodies upstream (goes into 'control' so # we can get the original request username if need be) update outer.control { User-Name := "%{reply:User-Name}" } # if we put this into 'control' then we get two # Auth-Type's (although it works), if we put it # into 'reply' it gets filtered update outer.request { Auth-Type := "%{%{reply:Auth-Type}:-%{Auth-Type}}" EAP-Type := "%{EAP-Type}" } } } ---- Any suggestions, it would be nice if on Access-Reject that post-auth section was passed in 'auth-eap'. Of course if you want config files and/or logs, do ask. Cheers -- Alexander Clouter .sigmonster says: Pushing 30 is exercise enough.

4 5

Freeradius not authenticating Wireless Clients
by Seann Clark 02 Oct '09

02 Oct '09

All, I am having problems with my freeradius server for the past 24 hours, which seems that the radius server isn't authenticating EAP-TLS clients from my wireless network. I am looking for a little advice from the local subject matter experts. I am running a Vista and an XP home client right now, both worked, I rebuilt the Vista machine and wasn't able to authenticate. my WAP tends to not service Radius requests when the radius server goes away for whatever reasons, and the fix is just to cycle power on it. It is a WRT54GS by Linksys, and after the last power cycle, it just doesn't authenticate clients anymore. If it is the WAP, I am wondering what suggestions people have for a good WAP that is stable and runs WPA2 Enterprise? What I am seeing from Radiusd on Debug mode is: rad_recv: Access-Request packet from host 192.168.10.10 port 1784, id=1, length=152 User-Name = "mizu.tsukinokage.net" NAS-IP-Address = 192.168.10.10 Called-Station-Id = "001c10486288" Calling-Station-Id = "0014a5a6a5cc" NAS-Identifier = "001c10486288" NAS-Port = 15 Framed-MTU = 1400 State = 0x639a9b23609f96504f388f2c9ad13fd9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500060d00 Message-Authenticator = 0x1f961b8013c153936ae43b6773041886 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 5 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.10.10 port 1784 EAP-Message = 0x010603940d8000000b767587a713825ca119ce08932bbe4020c901ad46aeebce040fa4d3117a1fa50d80f5fb10f57fac4df7c4f0d7faee4bebbcfed4e6f57361f5e9cc9deb2dda9bd3b180b4c2ba44dbad255360dc7ea5458f996ccad8a9898c9e0b68ecb3d25bd7a162389ca470f3570486595ff691f067db5465ac15e3ed0203010001a382012530820121301d0603551d0e041604141cb898aede20e0af4cdf6b2d9318d91ea47fa5143081f10603551d230481e93081e680141cb898aede20e0af4cdf6b2d9318d91ea47fa514a181c2a481bf3081bc310b30090603550406130255533111300f060355040813084e65627261736b61310e300c06 EAP-Message = 0x0355040713054f6d6168613120301e060355040a13175473756b696e6f6b61676520456e746572707269736573311c301a060355040b13134e6574776f726b20456e67696e656572696e67311f301d060355040313166861727568692e7473756b696e6f6b6167652e6e65743129302706092a864886f70d010901161a6e6f6d6272616e647565407473756b696e6f6b6167652e6e65748209009ea0873a2fb16562300c0603551d13040530030101ff300d06092a864886f70d010105050003820101004ccbaf1b8a85e6584c42c610702d25ed5b9477e6a5a4382285f588a3e657584a57c5367ef65881080835111345c094b944d1681af38ee4d20a EAP-Message = 0xe72024114c87ac199a1565d4928aa71274d1111b9c62136dc6f2dbbf8d0d8f0112907aa7ee4c8a51915d8c8ba4012ebe8d015a0d4634d48ef74410f9ad3eefb19c5b2c0107caab3e856575ef8946ed1bd854200b3996bb85939db7c1611d599bc8f4c0b0dfd421126ba709d1cfcf741f0e72963d6e081c46bdc1b7f17d1d26fdf5f23961044e4730dad2e25c96f87457e14c4f97b531745cc5a26e6e63a184d4c02833fa26160ae8edb8ec189286dc4dddeea81a08d871bf8e94d8215838b4f1c825f114a1dd8816030100ce0d0000c602010200c100bf3081bc310b30090603550406130255533111300f060355040813084e65627261736b61310e30 EAP-Message = 0x0c060355040713054f6d6168613120301e060355040a13175473756b696e6f6b61676520456e746572707269736573311c301a060355040b13134e6574776f726b20456e67696e656572696e67311f301d060355040313166861727568692e7473756b696e6f6b6167652e6e65743129302706092a864886f70d010901161a6e6f6d6272616e647565407473756b696e6f6b6167652e6e65740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x639a9b23679c96504f388f2c9ad13fd9 Finished request 67. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.10 port 1786, id=1, length=152 User-Name = "mizu.tsukinokage.net" NAS-IP-Address = 192.168.10.10 Called-Station-Id = "001c10486288" Calling-Station-Id = "0014a5a6a5cc" NAS-Identifier = "001c10486288" NAS-Port = 15 Framed-MTU = 1400 State = 0x639a9b23679c96504f388f2c9ad13fd9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600060d00 Message-Authenticator = 0x0bafacf4ec9889421fde967080dbc63d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 6 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.10.10 port 1786 EAP-Message = 0x0107000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x639a9b23669d96504f388f2c9ad13fd9 Finished request 68. Going to the next request Waking up in 4.9 seconds. Cleaning up request 63 ID 1 with timestamp +594 Cleaning up request 64 ID 1 with timestamp +594 Cleaning up request 65 ID 1 with timestamp +594 Cleaning up request 66 ID 1 with timestamp +594 Cleaning up request 67 ID 1 with timestamp +594 Cleaning up request 68 ID 1 with timestamp +594 Ready to process requests.

2 2

Store session on mysql
by michel＠casa.co.cu 02 Oct '09

02 Oct '09

Hello I currently work with the version 2.1.6 without any problem, session of my users are stored in the file "radutmp. I would store them at the same time in mysql, is this possible? Is there any page where this is documented? I want to make a script for my squid server then checks against mysql search if the user is connected, compare against a file if it exists in that list, take the IP address that you assign and freeradius in the squid allows internet access. Suggestions? Greetings Michel ---------------------------------------------- Webmail, servicio de correo electronico Casa de las Americas - La Habana, Cuba.

3 2

misbehaving nas's send accounting to both primary and secondary servers
by Joe Maimon 02 Oct '09

02 Oct '09

What is the best way to deal with misbehaving nas's that send accounting to both the primary and secondary server, even while receiving replies to both queries. This results in multiple accounting records in sql, with duplicate acctsessionid and acctuniqueid values. Assuming the NAS cannot be properly configured, either for technical or other reasons, these are the potential options. - configure only one of the primary or secondary on the NAS - get the server to recognize the existing record and update it instead of inserting a new one Now there is account_start_query_alt, but that appears to only be called if the account_start_query fails. With the default mysql schema, I dont think there is anything to cause that query to ever fail. Tips and advice are greatly appreciated. Thanks, Joe

3 7