November 2010 - Freeradius-Users - lists.freeradius.org

Logging ntlm authentication
by Sion 17 Nov '10

17 Nov '10

Hi, I've got freeradius 2.1.7 setup on a CentOS system working as an AAA server for our WPA Enterprise based wireless network with clients successfully authenticating using PEAP and TTLS. Now to my question, I've configured linelog to log certain attributes but I also want it to log either the Exec-Program output of ntlm_auth or the peap reply value for the MS-CHAP-Error attribute but so far I've been unsuccessful in doing this. Is this possible? if so can anybody give me any pointers? Regards, Sion

6 34

Differences between FreeRadius and GNU Radius
by den2k 17 Nov '10

17 Nov '10

Hi, I'm new to RADIUS and I have to configure a rather complex system. Due to the lack of (well made) documentation on the wiki I googled around and I've found a good manual for GNU Radius (the old radiusd). So my question is: how much can I rely on that documentation while writing configuration files for FreeRADIUS? Does exist some piece of documentation which lists the differences between the two systems? I'm especially interested in the 'huntsgroup' file and in the authentication protocols Thank you for interesting, Denis -- \ __ __ _ * _\ \__\ \ \ _\ \/ \_\ \__ \ \ \__ \\ -------------------------> Registered Linux User # 372295 -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GCS/CM d--- s:+: a-- C+++ UL+++S E--- W+(-) N o+ w--- O? M-- PS+ PE Y+ PGP t+(++) 5? X- R* tv-- b+ DI+ D++++ G+ e h! r++ y* ------END GEEK CODE BLOCK------

2 1

Having two MS-MPPE key pairs...
by Panagiotis Georgopoulos 17 Nov '10

17 Nov '10

Hello all, I am using EAP-TTLS/EAP-MSCHAPv2 to authenticate clients with a FR 2.1.10 backend AAA server. Requests go over an Access Point (playing the role of the NAS), then get forwarded to a Proxy AAA FR 2.1.10 server and finally get routed to my backend server. My client is using wpa_supplicant with "EAP=TTLS" and "Phase2="autheap=mschapv2"" options in the configuration file. The problem I am having is that when the FR sends the final Accept-Accept to the client, I end up having two MS-MPPE-Send-Key and MS-MPPE-Recv-Key keys of different length, one added by the mschap module and one added by the eap module, as seen here : Sending Access-Accept of id 52 to 2001:db95::100 port 1814 Reply-Message = "Hello, bob-mr1" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x8566119a6066e8eb7c1663dea8d1629b MS-MPPE-Recv-Key = 0xc1f99bac753248c48db73fd5585bf810 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "bob-mr1" MS-MPPE-Recv-Key = 0x2eb89da2ac20179cb2b99391f94ca2bddf1701c67c524badad98ce56f09873dc MS-MPPE-Send-Key = 0x0cf013411cfcea14ae9dee56baaf5467e55caed80fa83ffbbdf0f5998ce7fe62 EAP-Message = 0x03cf0004 Proxy-State = 0x3130 (if someone wants a full debug output of the server it is posted here : http://pastebin.com/aXFMXXbT ) Having two MS-MPPE key pairs is wrong and does not allow the end-client to properly finish its key exchange with the Access Point, but restarts the EAP-TTLS communication. I figured out that I could remove one pair of keys, by either doing this at the end of my post-auth section of my inner-tunnel : update reply { MS-MPPE-Send-Key !* 0x00 MS-MPPE-Recv-Key !* 0x00 } ..or if I set "use_mppe=no" to the mschap module although this means that I will be loosing the MS-MPPE-Encryption-Policy and MS-MPPE-Encryption-Types attributes as well. Which one do you think is the best approach and has less impact for other authentication methods (e.g. straightforward mschapv2 or others)? By the way, I also tried using PEAP and mschapv2 for phase 2 but it didn't have the above problem (it had just one pair of MS-MPPE keys). Isn't that weird since mschapv2 in PEAP is also eap-mschapv2 so it would expect to get exactly the same phase 2 with EAP-TTLS.. What am I missing here? Thanks a lot in advance, Panos

1 0

How to block user to authenticate over ldap
by eduardo moreira 16 Nov '10

16 Nov '10

Hi, With help of list i make my freeradius + ldap, now works. But now i have other doubt, how to disable one user to authenticate in freeradius? Remember, i dont block user to log in ldap, but block user to use freeradius. Thank for help.

2 1

Chargeable-User-Identity implementation
by Stefan Winter 16 Nov '10

16 Nov '10

Hello, since quite a while, there's an implementation of Chargeable-User-Identity in the works by people of eduroam R&D (inside the GEANT3 project). Attached is the most recent implementation. We hope that it is worthy of inclusion into the mainline release now: it's a small set of new files (modules/cui, SQL schema definitions) and a few stand-in replacements that augment some shipped files (policy.conf, sites-available/*). Please take a look and comment. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

4 5

proxy.conf - type = auth issue
by Alan Buxey 16 Nov '10

16 Nov '10

hi, Tue Nov 16 11:16:39 2010 : Info: Exiting normally. Tue Nov 16 11:16:42 2010 : Error: /etc/raddb/proxy.conf[118]: Home server test2 of unexpected type "auth" realm test2.co.uk { pool = test2 } server_pool test2 { home_server = test2 } home_server test2 { ipaddr = 10.11.12.13 secret = "topsecret" type = auth port = 1645 strip } this is with 2.1.10 why isnt type = auth valid? the remote server doesnt have a listener for accounting so I dont want it to handle accounting... alan

2 1

one of the FreeRADIUS FTP servers is dead
by Alan Buxey 15 Nov '10

15 Nov '10

Hi, it appears that one of the servers answering as ftp.freeradius.org is poorly. failing FTP connect and not pingable Name: ftp.freeradius.org Address: 64.34.165.250 Name: ftp.freeradius.org Address: 88.191.76.128 [src]# ping 64.34.165.250 PING 64.34.165.250 (64.34.165.250) 56(84) bytes of data. --- 64.34.165.250 ping statistics --- 2 packets transmitted, 0 received, 100% packet loss, time 1000ms [src]# ping 88.191.76.128 PING 88.191.76.128 (88.191.76.128) 56(84) bytes of data. 64 bytes from 88.191.76.128: icmp_seq=1 ttl=52 time=15.0 ms alan

1 0

Sporadic Windows 802.1x-PEAP-MSchapv2 failures solved with 2.1.10
by Cannady, Mike 15 Nov '10

15 Nov '10

I just wanted to let everyone know that the 2.1.10 release fixed a sporadic problem that we were having with PEAP-MSchapv2 and 802.1x. We had several PCs that would work only sometimes with freeradius, but they would always work with Microsoft's IAS. I would move a problem PC from a switch authenticating with windows to another switch authenticating through freeradius and back and the problem stayed with the freeradius one. I was running 2.1.7 at the time. I installed 2.1.10 to get to the latest version before using this list for help, just to have it fix the problem. I suspect bug#17 was the issue. If the issue hadn't been solved, we were preparing to go to two MS server datacenter servers to do just the radius work (we have a *lot* of switches) which I thought was a lot of overkill and wouldn't give us the flexibility to do what we plan with the radius server in the future. Now we don't need the MS servers now! Thanks a bunch!!!! You made me very happy! Mike Cannady ********************************************************************** HTC Disclaimer: The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. **********************************************************************

2 1

Logical OR with Check Attributes
by Gary T. Giesen 15 Nov '10

15 Nov '10

Is there any way to perform a logical OR with the check attributes (specifically with the NAS-IP-Address)? What I'd like to do is to authenticate the user if it's coming from one of a list of NAS-IP-Address values, and reject otherwise. Is this possible? GG

3 3

Mysql Socket Timeout
by Rhommel Lamas 15 Nov '10

15 Nov '10

Is there anyway i can configure Mysql timeout on the sockets connection?, it has come to my attention that if i configure Radius With redundant options, it takes too long to close all sockets and on consequence Freeradius freeze until all connections are tested.

1 0