September 2009 - Freeradius-Users - lists.freeradius.org

Attr-Rewrite and Users File
by Anja Ruckdaeschel 07 Oct '09

07 Oct '09

Hi there! Please help.... I´m doing a attr_rewrite with an attribute in the request: attr_rewrite strip-vpn { attribute = Acct-Session-Id searchin = packet searchfor = "^[^$]+([\(])([^$]+).+$" replacewith = %{2} new_attribute = no max_matches = 1 append = no } Radius doing the rewrite seems okay to me... [strip-vpn] expand: ^[^(]+([(])([^)]+).+$ -> ^[^(]+([(])([^)]+).+$ [strip-vpn] expand: %{2} -> test1 strip-vpn: Changed value for attribute Acct-Session-Id from 'abc00000(test1)"Mon Sep 28 13:34:40 2009"9XMBQBrh' to 'test1' strip-vpn: Could not find value pair for attribute Acct-Session-Id ++[strip-vpn] returns ok Later in the files modules I´d like to use the stripped value for checking against an ldap-group: DEFAULT User-Name =~ "^(\.*)([a-zA-Z]{3}[0-9]{5})", Huntgroup-Name == "test", ldapgroups1-Ldap-Group=="cn=%{Acct-Session-Id},o=test,c=de" So, if the user is a member of the group cn=test1,o=test,c=de he should get an access-accept, else he should be rejected. The FIRST request after RADIUS started it looks like this: expand: cn=%{Acct-Session-Id},o=test,c=de -> cn=test1,o=test,c=de rlm_ldap: Entering ldap_groupcmp() ... rlm_ldap: performing search in cn=test1,o=test,c=de, with filter .... and it´s working as it should be. The next request from the same user but with test2 instead of test1 in the request: [strip-vpn] expand: ^[^(]+([(])([^)]+).+$ -> ^[^(]+([(])([^)]+).+$ [strip-vpn] expand: %{2} -> test2 strip-vpn: Changed value for attribute Acct-Session-Id from 'abc00000(test2)"Mon Sep 28 13:34:40 2009"9XMBQBrh' to 'test2' strip-vpn: Could not find value pair for attribute Acct-Session-Id ++[strip-vpn] returns ok Now radius doesn´t do the expansion like it did for the first request, but the search in the group with the value used in the request before: rlm_ldap: Entering ldap_groupcmp() ... rlm_ldap: performing search in cn=test1,o=test,c=de, with filter .... Is there some kind of caching or do I miss something? Thank you very much Anja --------------------------------------------------------------------------------------------- Anja Ruckdäschel M.A.; Rechenzentrum der Universität Regensburg; Universitätsstr.31; 93 053 Regensburg Telefon: +49 941 943 4826 ---------------------------------------------------------------------------------------------

3 5

Freeradius not authenticating Wireless Clients
by Seann Clark 02 Oct '09

02 Oct '09

All, I am having problems with my freeradius server for the past 24 hours, which seems that the radius server isn't authenticating EAP-TLS clients from my wireless network. I am looking for a little advice from the local subject matter experts. I am running a Vista and an XP home client right now, both worked, I rebuilt the Vista machine and wasn't able to authenticate. my WAP tends to not service Radius requests when the radius server goes away for whatever reasons, and the fix is just to cycle power on it. It is a WRT54GS by Linksys, and after the last power cycle, it just doesn't authenticate clients anymore. If it is the WAP, I am wondering what suggestions people have for a good WAP that is stable and runs WPA2 Enterprise? What I am seeing from Radiusd on Debug mode is: rad_recv: Access-Request packet from host 192.168.10.10 port 1784, id=1, length=152 User-Name = "mizu.tsukinokage.net" NAS-IP-Address = 192.168.10.10 Called-Station-Id = "001c10486288" Calling-Station-Id = "0014a5a6a5cc" NAS-Identifier = "001c10486288" NAS-Port = 15 Framed-MTU = 1400 State = 0x639a9b23609f96504f388f2c9ad13fd9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500060d00 Message-Authenticator = 0x1f961b8013c153936ae43b6773041886 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 5 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.10.10 port 1784 EAP-Message = 0x010603940d8000000b767587a713825ca119ce08932bbe4020c901ad46aeebce040fa4d3117a1fa50d80f5fb10f57fac4df7c4f0d7faee4bebbcfed4e6f57361f5e9cc9deb2dda9bd3b180b4c2ba44dbad255360dc7ea5458f996ccad8a9898c9e0b68ecb3d25bd7a162389ca470f3570486595ff691f067db5465ac15e3ed0203010001a382012530820121301d0603551d0e041604141cb898aede20e0af4cdf6b2d9318d91ea47fa5143081f10603551d230481e93081e680141cb898aede20e0af4cdf6b2d9318d91ea47fa514a181c2a481bf3081bc310b30090603550406130255533111300f060355040813084e65627261736b61310e300c06 EAP-Message = 0x0355040713054f6d6168613120301e060355040a13175473756b696e6f6b61676520456e746572707269736573311c301a060355040b13134e6574776f726b20456e67696e656572696e67311f301d060355040313166861727568692e7473756b696e6f6b6167652e6e65743129302706092a864886f70d010901161a6e6f6d6272616e647565407473756b696e6f6b6167652e6e65748209009ea0873a2fb16562300c0603551d13040530030101ff300d06092a864886f70d010105050003820101004ccbaf1b8a85e6584c42c610702d25ed5b9477e6a5a4382285f588a3e657584a57c5367ef65881080835111345c094b944d1681af38ee4d20a EAP-Message = 0xe72024114c87ac199a1565d4928aa71274d1111b9c62136dc6f2dbbf8d0d8f0112907aa7ee4c8a51915d8c8ba4012ebe8d015a0d4634d48ef74410f9ad3eefb19c5b2c0107caab3e856575ef8946ed1bd854200b3996bb85939db7c1611d599bc8f4c0b0dfd421126ba709d1cfcf741f0e72963d6e081c46bdc1b7f17d1d26fdf5f23961044e4730dad2e25c96f87457e14c4f97b531745cc5a26e6e63a184d4c02833fa26160ae8edb8ec189286dc4dddeea81a08d871bf8e94d8215838b4f1c825f114a1dd8816030100ce0d0000c602010200c100bf3081bc310b30090603550406130255533111300f060355040813084e65627261736b61310e30 EAP-Message = 0x0c060355040713054f6d6168613120301e060355040a13175473756b696e6f6b61676520456e746572707269736573311c301a060355040b13134e6574776f726b20456e67696e656572696e67311f301d060355040313166861727568692e7473756b696e6f6b6167652e6e65743129302706092a864886f70d010901161a6e6f6d6272616e647565407473756b696e6f6b6167652e6e65740e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x639a9b23679c96504f388f2c9ad13fd9 Finished request 67. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.10.10 port 1786, id=1, length=152 User-Name = "mizu.tsukinokage.net" NAS-IP-Address = 192.168.10.10 Called-Station-Id = "001c10486288" Calling-Station-Id = "0014a5a6a5cc" NAS-Identifier = "001c10486288" NAS-Port = 15 Framed-MTU = 1400 State = 0x639a9b23679c96504f388f2c9ad13fd9 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600060d00 Message-Authenticator = 0x0bafacf4ec9889421fde967080dbc63d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [eap] EAP packet type response id 6 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/tls [eap] processing type tls [tls] Authenticate [tls] processing EAP-TLS [tls] Received TLS ACK [tls] ACK handshake fragment handler [tls] eaptls_verify returned 1 [tls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 1 to 192.168.10.10 port 1786 EAP-Message = 0x0107000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x639a9b23669d96504f388f2c9ad13fd9 Finished request 68. Going to the next request Waking up in 4.9 seconds. Cleaning up request 63 ID 1 with timestamp +594 Cleaning up request 64 ID 1 with timestamp +594 Cleaning up request 65 ID 1 with timestamp +594 Cleaning up request 66 ID 1 with timestamp +594 Cleaning up request 67 ID 1 with timestamp +594 Cleaning up request 68 ID 1 with timestamp +594 Ready to process requests.

2 2

rlm
by José Johnny RANDRIAMAMPIONONA 01 Oct '09

01 Oct '09

Dear all, I posted this problem a week ago after searching in posted and solved emails like here ( http://www.mail-archive.com/search?q=rlm_ldap&l=freeradius-users@lists.cist… ). I have already asked but the answers were not effective... Anyway, I d like to express my gratitude to those who have tried to read and respond to my problems ! So I m asking myself if : Using LDAP with freeradius is it something new or something? My problem is about the ldap library for freeradius (libldap which is needed by rlm_ldap) ... What should I do to install and configure it 'cause it's not in the freeradius-server package(I rebuilt it 5 times and I paid attention to the output? If I ll receive the same answers I received before then maybe the problem is in my operating system(CentOsV5.3) Thanks to all ... Best regards ... NB: I am fed up of this buuuuuuuuuuuuug! Neeed help! -- JJohnny RANDRIAMAMPIONONA Phone: +212663682554, +212533158575 National School of Applied Sciences ZIP 1818 TANGIER 90000 ---------Morocco ---------------

7 10

Rlm_ldap not found
by Leighton Man 01 Oct '09

01 Oct '09

Hi all, Hope this is an easy one: Freeradius 2.1.6 on arch linux installed from a package. All is well until I uncomment ldap in the authorise section of sites-enabled/inner-tunnel then I get: /etc/raddb/modules/ldap[29]: Failed to link to module 'rlm_ldap': file not found followed by Failed to find module "ldap" ...... rlm_ldap.so is a symlink to rlm_ldap-2.1.6.so which has the same permissions and is in the same directory as the other modules which load OK (they are also symlinks in the same directory). I've checked for typos until I'm beginning to see them even when they are not there! Radiusd -X shows no errors or warnings and after the ***Loading Virtual Servers**** message continues linking and instantiating modules up to and including "files" then the error above. Not easy to post the whole output as I haven't got ftp running yet. Where should I look next? Regards, Leighton --- This transmission is confidential and may be legally privileged. If you receive it in error, please notify us immediately by e-mail and remove it from your system. If the content of this e-mail does not relate to the business of the University of Huddersfield, then we do not endorse it and will accept no liability.

3 7

(no subject)
by jon jon 01 Oct '09

01 Oct '09

Hi, I was wondering where to look in free radius, for something that is kicking the wireless clients off at a certain time. I have a backend mysql database that allows the clients certain times to login from. Where would the file be located that is telling the free radius server that there time is up and boot them off? thanks

2 2

EAPTLS Stress test: 2.1.7
by leopold 01 Oct '09

01 Oct '09

Hi, We tried to stress test (EAPTLS) FreeRADIUS 2.1.7 which sits behind Load Balancer We had 2 FreeRADIUS servers behind load balancer (R1,R2) Some requests got rejected (Access-Reject was sent) and the log showed Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Wed Sep 30 11:56:31 2009 : Error: rlm_eap: No EAP session matching the State variable. Now we understand that if EAPTLS session started (we have 10 Access-Challenge messages because of our certificate chain) against Radius_1 and then continued to Radius_2 because load balancer reverted it there then EAPTLS handshake cannot succeed, but we expected that FreeRADIUS should drop packets and NOT RESPOND instead of sending Access-Reject when it cannot find STATE variable By looking at the code we think eap_tls module returns RLM_MODULE_INVALID or RLM_MODULE_FAIL when it cannot find EAP session in the tree. What is proper configuration that we can do? Is something like this recommended? authorize { .. eap { ok = return updated = return handled = return } if (invalid) { do_not_respond } # if we reach here then Auth-Type != EAP .. } Thanks you for your response -- View this message in context: http://www.nabble.com/EAPTLS-Stress-test%3A-2.1.7-tp25686662p25686662.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

FreeRADIUS with 2 certs/CAs etc
by Alan Buxey 01 Oct '09

01 Oct '09

hi, in the UK I deal with various questions regarding FreeRADIUS configuration and abilities - occasionally a question pops up that I'm very unfamilar with or havent got a direct clue to answer.. today one of those reemerged and as this might affect anyone at any point I was looking for best practice or a methodology. Say you have a nice FR setup...all is going well and everything is fine but then you have an issue with the certificate - eg its going to expire , or its been revoked...then you are going to have to have a new certificate for your FR server - but your clients will have the old certificate and CA - and your new clients will have the new cert and CA..and you might not be able to sort out all your clients for some time - hopefully before the final day of cert validity! anyway, in summary, your RADIUS server has to answer to the old clients and the new clients. What is the best practice way or configuration to ensure that your RADIUS server can be both people...old servercert+old_CA and new servertcert+new_CA so that it can deal with both types of clients. I'm thinking 2 virtual servers....one with old eap.conf and the other with neweap.conf with each virtual server ready to deal with each type of client - but then how to direct the incoming EAP to the right way. I cant see the normal fall-through group working --because the client has to create the EAP tunnel... or would a normal fallthrough system work... we send it to eap1 and if it fails send it to eap2 (which should be okay if client config okay!) ? I can envisage fronting it with a.n.other RADIUS solution which will proxy the request through a remote server list UNTIL it doesnt get a REJECT back.. but i dont want additional software in the mix thanks alan

4 6

Problem with radzap
by Pierre-henri Baraffe 01 Oct '09

01 Oct '09

Hello, I have a mistake with my freeradius. On server with 1.1.7 the command : "radzap -u username -P port-nas 127.0.0.1 secret" work with no problem On a new server with FR 2.0.5, with the same command i have this error radclient:: failed to get value I have no more message with the "-x" option and nothing in the log. I have the same things if i replace "127.0.0.1" by "localhost" my client.conf client localhost { ipaddr = 127.0.0.1 secret = secret require_message_authenticator = no shortname = localhost nastype = other # localhost isn't usually a NAS... } I don't understand. Thanks for your help. ph

3 3

Re: Start Freeradius at boot
by Paul.Blalock＠gmail.com 30 Sep '09

30 Sep '09

So I went back to a clean install of Fedora 11, followed the instructions on installing freeradius via yum. Then I issued the command: chkconfig --list radiusd (and got the following) radiusd 0:off 1:off 2:off 3:off 4:off 5:off 6:off so i entered sudo chkconfig radiusd on and then I got chkconfig --list radiusd radiusd 0:off 1:off 2:on 3:on 4:on 5:on 6:off I then restart the computer to verify that it works correctly, and it does not. I still have to log into an account before the service starts. Is there anything else I can try to get this working correctly?

4 6

delayed update on sql logging
by Oguzhan Kayhan 30 Sep '09

30 Sep '09

Hi, I am checking simultaneous-use information, logged users etc on sql server. The problem is, if a user logges in, nearly after a minute later i can see the logged on user on mysql tables. But i can see the same user with radlast command in the same second the user logs in. So it seems like there is a delay between updating the data on sql. And with this, user can log in mutliple times with same username even i set sim-use to 1. Is there any parameter for that??? Or what else can cause that problem.

5 9