December 2009 - Freeradius-Users - lists.freeradius.org

Static ippool based on NAS source
by renator＠flash.net.br 07 Dec '09

07 Dec '09

Greetings, We are using Freeradius v2 to authenticate and give IP to a large group of mobiles, connected to us via gprs through 2 NAS randomicaly. We need this group of mobiles to get an IP address based on the NAS where they authenticate from and keep this IP always it connects from this same NAS again and other if it connects from the other NAS, the nearest possible of an static IP served by the Radius server via IPPOOL. We have a limitation because the gprs operator's demands the same login/password for all the mobiles. Today we use, based in what I read in this list and the documentation, the configuration: users: DEFAULT NAS-IP-Address == xxx.xxx.xxx.1, Pool-Name := "pool1" X-Ascend-Client-Assign-DNS = 1, X-Ascend-Client-Primary-DNS = xxx.xxx.xxx.4, X-Ascend-Client-Secondary-DNS = xxx.xxx.xxx.5, Service-Type = Framed-User, Simultaneous-Use := 10000, Framed-Protocol = PPP, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Fall-Through = Yes DEFAULT NAS-IP-Address == xxx.xxx.xxx.2, Pool-Name := "pool2" X-Ascend-Client-Assign-DNS = 1, X-Ascend-Client-Primary-DNS = xxx.xxx.xxx.4, X-Ascend-Client-Secondary-DNS = xxx.xxx.xxx.5, Service-Type = Framed-User, Simultaneous-Use := 10000, Framed-Protocol = PPP, Framed-MTU = 1500, Framed-Compression = Van-Jacobsen-TCP-IP, Fall-Through = Yes radiusd.conf (ippool): ippool pool1 { range-start = xxx.xxx.2.1 range-stop = xxx.xxx.3.254 netmask = 255.255.254.0 cache-size = 510 session-db = ${raddbdir}/db.ippool1 ip-index = ${raddbdir}/db.ipindex1 override = no maximum-timeout = 0 lease-duration = 86400 key = "%{NAS-IP-Address} %{Calling-Station-Id}" } ippool pool2 { range-start = xxx.xxx.0.1 range-stop = xxx.xxx.1.254 netmask = 255.255.254.0 cache-size = 510 session-db = ${raddbdir}/db.ippool2 ip-index = ${raddbdir}/db.ipindex2 override = no maximum-timeout = 0 lease-duration = 86400 key = "%{NAS-IP-Address} %{Calling-Station-Id}" } With a big "lease-duration" we want the mobiles to get the same IP most of the time. The pool1 and pool2 are configured in accounting and post-auth of sites-enabled/default file... So, trying to be clear, what we need is: IF mobile CONNECTS via NAS1 -> Gets IP from pool1 IF mobile CONNECTS via NAS1 again -> Gets THE same IP from pool1 IF mobile CONNECTS via NAS2 -> Gets IP from pool2 IF mobile CONNECTS via NAS2 again -> Gets THE same IP from pool2 Everything seems to work, BUT, the mobiles are getting always 2 ips instead of 1. I mean: Mobile CONNECTS via NAS1 -> Gets IP from pool1 Mobile CONNECTS again via NAS1 -> Gets ANOTHER IP from pool1 Mobile CONNECTS via NAS2 -> Gets IP from pool2 Mobile CONNECTS again via NAS2 -> Gets ANOTHER IP from pool2 If I keep reconnecting with this mobile several times, I always get 1 of these 4 ips. Is there a better way to do what I need? Please, forgive me if I am not beeing clear enought, as English is not my primary language. I hope you can help me about this issue. Thank you very much for taking the time to read!

4 5

Auth-Type
by jon michaels 07 Dec '09

07 Dec '09

Hi, First i want to say that i think that freeradius is a great piece of software. My NAS, pppd, does not grant access to a user with attribute Auth-Type set to Accept but radtest does work. Could this be solved by recompiling pppd with the dictionary file included in the source that reads VALUE Auth-Type None 254 changed to VALUE Auth-Type Accept 254? I already changed the dictionary in /etc/radiusclient/dictionary to this setting, but this didn't solve it. Thanks, Jon.

3 6

RE: Re: Problems when trying to start Freeradius with eap
by Peter Carlstedt 07 Dec '09

07 Dec '09

> Message: 5 > Date: Thu, 3 Dec 2009 14:18:14 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Problems when trying to start Freeradius with eap > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20091203141814.GB5878(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > hi, > > did you check permissions etc for the freeradius config > directory - need to ensure you have read/write priv for > the user you chose to run as in the certs directory (or > wherever you configured EAP to look for certs etc. > > standard install with standard permissions and no configuration/touching > of files will work > > alan > ------------------------------ > > Message: 5 > Date: Thu, 3 Dec 2009 14:18:14 +0000 > From: Alan Buxey <A.L.M.Buxey(a)lboro.ac.uk> > Subject: Re: Problems when trying to start Freeradius with eap > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <20091203141814.GB5878(a)lboro.ac.uk> > Content-Type: text/plain; charset=us-ascii > > hi, > > did you check permissions etc for the freeradius config > directory - need to ensure you have read/write priv for > the user you chose to run as in the certs directory (or > wherever you configured EAP to look for certs etc. > > standard install with standard permissions and no configuration/touching > of files will work > > alan > > > ------------------------------ Hi, I complied it on my own before I installed it. I can write down for you what steps I took. The steps i took was following: 1. $ I opened the terminal and wrote "wget ftp://ftp.freeradius.org/pub/freeradius/freeradius-server-2.1.7.tar.gz" 2. $ tar xzf freeradius-server-2.1.7.tar.gz 3. $ cd freeradius-server-2.1.7 4. $ ./configure --with-openssl --with-openssl-includes=/usr/local/openssl/include/ --with-openssl-libraries=/usr/local/openssl/lib/ 5. $ make 6. $ sudo make install 7. $ sudo ldconfig Is there any of the above steps that is incorrect? I did it on my normal user account and not the root account. I have tried once with another installation of ubuntu and freeradius to do the same when i was logged in as root but got the same error message. I will add the output once more below: peter@freeradius:~$ sudo radiusd -X FreeRADIUS Version 2.1.7, for host i686-pc-linux-gnu, built on Dec 2 2009 at 16:29:59 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /usr/local/etc/raddb/radiusd.conf including configuration file /usr/local/etc/raddb/proxy.conf including configuration file /usr/local/etc/raddb/clients.conf including files in directory /usr/local/etc/raddb/modules/ including configuration file /usr/local/etc/raddb/modules/files including configuration file /usr/local/etc/raddb/modules/realm including configuration file /usr/local/etc/raddb/modules/checkval including configuration file /usr/local/etc/raddb/modules/linelog including configuration file /usr/local/etc/raddb/modules/mac2vlan including configuration file /usr/local/etc/raddb/modules/counter including configuration file /usr/local/etc/raddb/modules/attr_filter including configuration file /usr/local/etc/raddb/modules/preprocess including configuration file /usr/local/etc/raddb/modules/logintime including configuration file /usr/local/etc/raddb/modules/sradutmp including configuration file /usr/local/etc/raddb/modules/inner-eap including configuration file /usr/local/etc/raddb/modules/always including configuration file /usr/local/etc/raddb/modules/mschap including configuration file /usr/local/etc/raddb/modules/ippool including configuration file /usr/local/etc/raddb/modules/sqlcounter_expire_on_login including configuration file /usr/local/etc/raddb/modules/passwd including configuration file /usr/local/etc/raddb/modules/smbpasswd including configuration file /usr/local/etc/raddb/modules/unix including configuration file /usr/local/etc/raddb/modules/chap including configuration file /usr/local/etc/raddb/modules/wimax including configuration file /usr/local/etc/raddb/modules/krb5 including configuration file /usr/local/etc/raddb/modules/smsotp including configuration file /usr/local/etc/raddb/modules/pap including configuration file /usr/local/etc/raddb/modules/pam including configuration file /usr/local/etc/raddb/modules/acct_unique including configuration file /usr/local/etc/raddb/modules/detail.log including configuration file /usr/local/etc/raddb/modules/cui including configuration file /usr/local/etc/raddb/modules/ldap including configuration file /usr/local/etc/raddb/modules/policy including configuration file /usr/local/etc/raddb/modules/attr_rewrite including configuration file /usr/local/etc/raddb/modules/radutmp including configuration file /usr/local/etc/raddb/modules/detail.example.com including configuration file /usr/local/etc/raddb/modules/sql_log including configuration file /usr/local/etc/raddb/modules/otp including configuration file /usr/local/etc/raddb/modules/echo including configuration file /usr/local/etc/raddb/modules/etc_group including configuration file /usr/local/etc/raddb/modules/digest including configuration file /usr/local/etc/raddb/modules/detail including configuration file /usr/local/etc/raddb/modules/mac2ip including configuration file /usr/local/etc/raddb/modules/expr including configuration file /usr/local/etc/raddb/modules/exec including configuration file /usr/local/etc/raddb/modules/perl including configuration file /usr/local/etc/raddb/modules/expiration including configuration file /usr/local/etc/raddb/eap.conf including configuration file /usr/local/etc/raddb/sql.conf including configuration file /usr/local/etc/raddb/sql/mysql/dialup.conf including configuration file /usr/local/etc/raddb/policy.conf including files in directory /usr/local/etc/raddb/sites-enabled/ including configuration file /usr/local/etc/raddb/sites-enabled/control-socket including configuration file /usr/local/etc/raddb/sites-enabled/default including configuration file /usr/local/etc/raddb/sites-enabled/inner-tunnel including dictionary file /usr/local/etc/raddb/dictionary main { prefix = "/usr/local" localstatedir = "/usr/local/var" logdir = "/usr/local/var/log/radius" libdir = "/usr/local/lib" radacctdir = "/usr/local/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/usr/local/var/run/radiusd/radiusd.pid" checkrad = "/usr/local/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client Netgear1 { ipaddr = 192.168.118.15 require_message_authenticator = no secret = "kaffe" nastype = "other" } client Netgear2 { ipaddr = 192.168.118.25 require_message_authenticator = no secret = "kaffe" nastype = "other" } client Mikrotik { ipaddr = 192.168.118.10 require_message_authenticator = no secret = "kaffe" nastype = "other" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/usr/local/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/local/etc/raddb/certs/server.pem" certificate_file = "/usr/local/etc/raddb/certs/server.pem" CA_file = "/usr/local/etc/raddb/certs/ca.pem" private_key_password = "kaffe" dh_file = "/usr/local/etc/raddb/certs/dh" random_file = "/usr/local/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/local/etc/raddb/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Generating a 2048 bit RSA private key ..........................+++ ....................................................................................................................................................................................................+++ unable to write 'random state' writing new private key to 'server.key' ----- problems making Certificate Request 4098:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 make: *** [server.csr] Error 1 Generating DH parameters, 1024 bit long safe prime, generator 2 This is going to take a long time ......................................................+.........+...................................................................+...................+......................................+...................................+...........................................................+...........................................................................+.............+........................+.......................................................................+........++*++*++* unable to write 'random state' Generating a 2048 bit RSA private key .......+++ ...........................................+++ unable to write 'random state' writing new private key to 'server.key' ----- problems making Certificate Request 4101:error:0D07A097:asn1 encoding routines:ASN1_mbstring_ncopy:string too long:a_mbstr.c:154:maxsize=2 Exec-Program output: openssl req -new -out server.csr -keyout server.key -config ./server.cnf Exec-Program-Wait: plaintext: openssl req -new -out server.csr -keyout server.key -config ./server.cnf Exec-Program: returned: 1 rlm_eap: Failed to initialize type tls /usr/local/etc/raddb/eap.conf[17]: Instantiation failed for module "eap" /usr/local/etc/raddb/sites-enabled/inner-tunnel[223]: Failed to find module "eap". /usr/local/etc/raddb/sites-enabled/inner-tunnel[176]: Errors parsing authenticate section. Best regards/ Peter Carlstedt _________________________________________________________________ Windows Live: Keep your friends up to date with what you do online. http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/so…

2 1

RE: Config Examples
by freeradius＠corwyn.net 07 Dec '09

07 Dec '09

At 02:54 PM 12/5/2009, Alex Bahoor wrote: >Ivan, > >Imagine DNS uses dynamic port assignment instead of port 53? Guess >what, no one would be able to use the internet. :-) > >Alex First, I believe you're trying to respond to me. Second, you're asking questions about which you don't apparently understand. What if I wanted to run my own implementation of DNS to do something bizarre? SSH on a different port than 22 (quite common)? A web server on port 88? Telnet on port 8000. I can do all of those things. And apache, bind, tftp, ftp, telnet, sshd (and really almost every service that assigns a port) all have the ability to change the default port. If I'm running my own services, I might want the ability to run them on non-standard ports. That's why there are defaults, AND the ability to change them. Rick

7 10

Problem with EAP-TLS
by _Stefan_H 06 Dec '09

06 Dec '09

I want to configure EAP-TLS on freeradius but it doesn’t work I hope the information below is enough. I am using freeradius 2.1.1. (openSUSE11.1), first I configured PAP using this tutorial( http://en.opensuse.org/RadiusServerHOWTO#Configuring_file_based_authenticat… http://en.opensuse.org/RadiusServerHOWTO#Configuring_file_based_authenticat… ) and it works with an xp supplicant. Then I wanted to configure EAP-TLS. Well the tutorials I found said that there is not much to do and I guess that's wrong. I only edited pap to tls in the eap.conf: eap { default_eap_type = tls The Cisco2950 Switch was added in the clients.conf while the pap tutorial: client 192.168.5.3 { secret = testing123 shortname = cisco } Well I added some kind of attributes in the users file because of dynamic vlans but I think that's not relevant now, isn't it?: oss-radius Cleartext-Password:="hello" Auth-Type :=EAP, Tunnel-Type= 13, Tunnel-Medium-Type= 6, Tunnel-Private-Group-Id= 5 For testing i created the standard certificates from freeradius with this commands: cd /etc/raddb/certs/ make all make client.pem Before I did this I changed the commonName and the email address in the client.cnf: [client] countryName = FR stateOrProvinceName = Radius localityName = Somewhere organizationName = Example Inc. emailAddress = oss-radius commonName = oss-radius I imported the ca.der and the client.p12 on the XP Client and at last I configured the XP Client using EAP-TLS: http://old.nabble.com/file/p26515010/zertifikateinstellung.jpg The authentication doesn't work and that is the debugging output: rad_recv: Access-Request packet from host 192.168.5.3 port 1812, id=3, length=110 NAS-IP-Address = 192.168.5.3 NAS-Port = 50012 NAS-Port-Type = Ethernet User-Name = "oss-radius" Calling-Station-Id = "00-0B-6A-2B-DA-78" Service-Type = Framed-User EAP-Message = 0x0201000f016f73732d726164697573 Message-Authenticator = 0xf68cf58770b7aca2671434c718bc4fb9 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oss-radius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 15 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry oss-radius at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 3 to 192.168.5.3 port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "5" EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8f71f7ba8f73faff5e448e0442a84581 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.5.3 port 1812, id=4, length=193 NAS-IP-Address = 192.168.5.3 NAS-Port = 50012 NAS-Port-Type = Ethernet User-Name = "oss-radius" Calling-Station-Id = "00-0B-6A-2B-DA-78" Service-Type = Framed-User State = 0x8f71f7ba8f73faff5e448e0442a84581 EAP-Message = 0x020200500d800000004616030100410100003d03014b0d47720ea38e9c9e290d9e80220a921d82c0e9cb675bbf329d349ac5f22ec700001600040005000a000900640062000300060013001200630100 Message-Authenticator = 0x20c78201bedf353fa22ef5383779e476 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "oss-radius", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 80 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry oss-radius at line 204 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS TLS Length 70 [tls] Length Included [tls] eaptls_verify returned 11 [tls] (other): before/accept initialization [tls] TLS_accept: before/accept initialization [tls] <<< TLS 1.0 Handshake [length 0041], ClientHello [tls] TLS_accept: SSLv3 read client hello A [tls] >>> TLS 1.0 Handshake [length 002a], ServerHello [tls] TLS_accept: SSLv3 write server hello A [tls] >>> TLS 1.0 Handshake [length 085e], Certificate [tls] TLS_accept: SSLv3 write certificate A [tls] >>> TLS 1.0 Handshake [length 00a6], CertificateRequest [tls] TLS_accept: SSLv3 write certificate request A [tls] TLS_accept: SSLv3 flush data [tls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 4 to 192.168.5.3 port 1812 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "5" EAP-Message = 0x010304000dc00000093d160301002a0200002603014b128ce6a59c7cc44dc8e5dda195b7358a9511b32aee8be1c928dadb4091169200000400160301085e0b00085a0008570003a6308203a23082028aa003020102020103300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039313132323133343533305a170d3130313132323133343533305a307c310b3009060355040613024652310f300d0603550408130652616469757331153013060355040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c65205365727665722043657274696669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100ac980cc4c9ec4ad3e23bf9d75989232fb1b5014896413398e3361287de22a5b5c00cac1e0c1b72b2f991aa8c2eeb1e452a7c67950e6af12e31414acbf8a9 EAP-Message = 0x8b96c26e6408da5ca899b30f00799999610945ad89094441a7cafca4067557b4ed52070fdf54b386b2a7a1aa76f134a9b5e7bfdeef3e18bc3d8ba98b49f1f4bb156dd1bbb46ee09b466df0120593471c59acfcb7a2977219e6db535008526dda1f91c374f01bf392d909a1ecde7ec11f926cfd310b39171121228c528a5853524e62ba21f1006c56ef85aa0837bdb123a11a0664015e7b8176b20619e36204f7b7b75d6e445aa84a0cdc49c9a8a82ea97e5686a28a56eced48e43f9c471499d0604f0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101009dc4e0c6f6e79b6e1c EAP-Message = 0x330b69759c25ac74cef621f5e8115248b9ea758e5b2af73574bd81953c2b5beb514765bdf4b07d50586dded8cfaac20f6ece9b661938bec737d87348f061ea7e3cd2a7338e786cd765aa8f3db636291c10c041d790ab49fcbcf5b41e7ec1ae2f65495b975286e656b23fed0321284cd6643aa411da03918e148eab2b222aa462bb62d50491ba9a27773e297dc8a59b1b0aa1a6fd2e6a110b2d3f94e81563417a2a4f1127937d38a0c6376e25ec51a0eabcd289a6fdfbcbc6f5c708050d8fdc9ad61cade8fa2b90ce4a6f4ff2ef465a1d61bbeb9373f4ef0c6a9c3d558b8424c130052899aa96271e0a9db4beb254ffcda04e8546e544140004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8f71f7ba8e72faff5e448e0442a84581 Finished request 1. Going to the next request Waking up in 4.7 seconds. Cleaning up request 0 ID 3 with timestamp +66 Waking up in 0.2 seconds. Cleaning up request 1 ID 4 with timestamp +66 Ready to process requests. Well I use the standardcertificate only for testing, but am I right that the problem is caused by the certificates? If you need the full output or the configs please don’t hesitate to contact me. -- View this message in context: http://old.nabble.com/Problem-with-EAP-TLS-tp26515010p26515010.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 10

[dhcp virtual server with module sql]
by Thomas Fagart 06 Dec '09

06 Dec '09

Hello, I've managed to configure freeeradius to do static dhcp assignement with the dhcp virtual server and the mac2ip module. Could we use any module inside dhcp server ? I wanted to use sql but doesn't seems to work. server dhcp { modules { Module: Checking dhcp DHCP-Discover {...} for more modules to load Module: Linked to module rlm_passwd Module: Instantiating mac2ip passwd mac2ip { filename = "/usr/local/etc/raddb/mac2ip" format = "*DHCP-Client-Hardware-Address:=DHCP-Your-IP-Address" delimiter = "," ignorenislike = yes ignoreempty = yes allowmultiplekeys = no hashsize = 100 } rlm_passwd: nfields: 2 keyfield 0(DHCP-Client-Hardware-Address) listable: no /usr/local/etc/raddb/sites-enabled/dhcp[25]: Failed to find module "sql". /usr/local/etc/raddb/sites-enabled/dhcp[25]: Failed to parse "sql" entry. Thomas

2 1

separating Users?
by freeradius＠corwyn.net 06 Dec '09

06 Dec '09

There's a piece of RADIUS that I'm not understanding. If I have an entry in my ./users file DEFAULT Auth-Type:=Accept,Ldap-Group == "Group1" Service-Type=NAS-Prompt-User,cisco-avpair="shell:priv-lvl=15" And another entry DEFAULT Auth-Type:=Accept,Ldap-Group == "Group2" Service-Type=NAS-Prompt-User,cisco-avpair="shell:priv-lvl=15" where I'm trying to authorize users in Group1 for one set of switches, and users in Group2 for another set of switches, how does freeradius know which is which? Rick Rick Steeves http://www.sinister.net In reality nothing is more damaging to the adventurous spirit within a man than a secure future - Alexander Supertramp

11 49

MsChap authentication not working
by Wim De Hul 05 Dec '09

05 Dec '09

Dear members, I'm trying to setup a tunnel and authenticate with mschap, but it does not seem to work. I thought the client is not sending the password, but when debugging, I saw that the mschap module is skipped.. I think I have a good config. What is wrong? : root@testbox:~# freeradius -XC FreeRADIUS Version 2.1.0, for host i486-pc-linux-gnu, built on Apr 30 2009 at 07:22:56 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/mysql/dialup.conf including configuration file /etc/freeradius/sql/mysql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 3 proxy_requests = no log { stripped_names = no auth = yes auth_badpass = yes auth_goodpass = yes } security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Skipping instantiation of expiration Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_mschap Module: Skipping instantiation of mschap Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_detail Module: Instantiating auth_log detail auth_log { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_sql Module: Skipping instantiation of sql Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking accounting {...} for more modules to load Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking post-auth {...} for more modules to load Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } radiusd: #### Skipping IP addresses and Ports #### Configuration appears to be OK. ---------------------------------------------------------- ad_recv: Access-Request packet from host 127.0.0.1 port 45716, id=28, length=65 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "wim" Calling-Station-Id = "10.0.0.1"" NAS-IP-Address = 192.168.1.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20091205 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20091205 expand: %t -> Sat Dec 5 23:34:59 2009 ++[auth_log] returns ok ++[mschap] returns noop ++[chap] returns noop expand: %{User-Name} -> wim [sql] sql_set_user escaped user --> 'wim' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'wim' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'wim' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'wim' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] No clear-text password in the request. Not performing PAP. ++[pap] returns noop !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No User-Password or CHAP-Password attribute in the request. Cannot perform authentication. Failed to authenticate the user. Login incorrect: [wim/<no User-Password attribute>] (from client localhost port 0 cli X.X.X.X) Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> wim attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 28 to 127.0.0.1 port 45716 Waking up in 4.9 seconds. Cleaning up request 0 ID 28 with timestamp +19 Ready to process requests. ------------------------------------------------------------------------------------ config: authorize { preprocess auth_log mschap chap sql expiration logintime pap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type CHAP { chap } Auth-Type PAP { pap } } mschap { use_mppe = yes require_encryption = yes require_strong = yes -- Wim

2 1

Ldap shadow expire
by decor＠supagro.inra.fr 05 Dec '09

05 Dec '09

hi, In a ldap authentication i try to check the expiration date. With default ldap schema there is ldap attribute named "shadowexpire". And i'm pretty sure the format is unix timestamp. Can i use it directly with freeradius ldap.attrmap like that : checkItem Expiration shadowexpire ??? i've found an answer saying : you must create in ldap a new attribute named radiusExpiration and check it in ldap.attrmap. why don't use directly shadowexpire ? thanks

2 1

How do I stop RADIUS running in debug mode (radiusd -X)?
by agalnx77 04 Dec '09

04 Dec '09

I have tried 'radiusd stop' but the process remains up and running. agalnx-srv-01:~ # ps -a PID TTY TIME CMD 22599 pts/1 00:00:00 su 22603 pts/1 00:00:00 bash 22812 pts/2 00:00:00 su 22814 pts/2 00:00:00 bash 23218 pts/2 00:00:00 radiusd 23400 pts/3 00:00:00 su 23402 pts/3 00:00:00 bash 23661 pts/3 00:00:00 ps agalnx-srv-01:~ # radiusd stop agalnx-srv-01:~ # ps -a PID TTY TIME CMD 22599 pts/1 00:00:00 su 22603 pts/1 00:00:00 bash 22812 pts/2 00:00:00 su 22814 pts/2 00:00:00 bash 23218 pts/2 00:00:00 radiusd 23400 pts/3 00:00:00 su 23402 pts/3 00:00:00 bash 23670 pts/3 00:00:00 ps agalnx-srv-01:~ # agalnx-srv-01:/etc/raddb # radiusd -v radiusd: FreeRADIUS Version 2.1.6, for host i686-pc-linux-gnu, built on Oct 27 2009 at 17:05:49 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. For more information about these matters, see the file named COPYRIGHT. agalnx-srv-01:/etc/raddb # Thank you, --ag

3 4