November 2010 - Freeradius-Users - lists.freeradius.org

Re: PEAP/TTLS and Client certificates
by rdeboer 04 Nov '10

04 Nov '10

I'm using the Juniper Odyssey Access Client, you can download a trial from the Juniper website. So far it's the only supplicant I've come across that allows for PEAP or TTLS with client certificates. Drawback being you have to buy licenses for each instance of it running inside the company, which undoubtedly is going to cost a fortune. So if anyone out there has any idea of a free open source solution I'm game... About the perl module, I'll start looking into that, thanks for the tip. -- View this message in context: http://freeradius.1045715.n5.nabble.com/PEAP-TTLS-and-Client-certificates-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

which user is using this IP? (Ethernet, no dial-up)
by Guido De Rosa 04 Nov '10

04 Nov '10

[Apparently the usenet gateway is not bidirectional, so I re-post here, sorry] Hello, AFAIK, there's nothing in the RADIUS protocol allowing you to ask a RADIUS server which user is currently using a given IP address... or am I missing something? The only thing you can do is FreeRADIUS-specific like issuing the "radwho" command which shows you a list of currently logged users, their IP addresses and other informations. Another option is querying the FreeRADIUS database (MySQL/whatever...), which is actually what some front-ends do (like DaloRADIUS...). Do you know a more robust/standard/portable solution to get these info? To clarify my question I will explain why I need this. I'm configuring DansGuardian web content filtering (http://dansguardian.org) which has the possibility to configure several "filter groups" each with different filtering rules. I would like to match filter groups by RADIUS login but since this is not implemented I'm willing to contribute some code to the project, and here I need to clarify some technical details. The programmatic counterpart of running radwho should be reading /var/log/freeradius/radutmp, which is simply the serialization of a C struct, as I read here: http://goo.gl/Rq1c7 http://goo.gl/BSvAn http://goo.gl/erLtw Would be this one the correct approach? Any suggestion? Thanks! Guido De Rosa P.S. the matching thread in the DG mailing list is: http://tech.groups.yahoo.com/group/dansguardian/message/24488

3 4

EAP-PEAP/MSCHAPv2 Proxy
by Влад Власов 04 Nov '10

04 Nov '10

Hello everyone, Please help me I try to setup FreeRadius as proxy. I want to extract MSCHAPv2 auth from EAP-PEAP/MSCHAPv2 ,and proxy only MSCHAPv2 request to another radius server ,that does not work with a EAP-PEAP. changed only the following items: clients.conf client 172.100.100.24/30 { secret = secretpass shortname = AP_50 } proxy.conf realm nc { authhost = 172.10.10.1:1812 accthost = 172.10.10.1:1813 secret = secretpass } realm DEFAULT { authhost = 172.10.10.1:1812 accthost = 172.10.10.1:1813 secret = secretpass } eap.conf default_eap_type = peap default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no Result: Ready to process requests. rad_recv: Access-Request packet from host 172.100.50.24 port 1041, id=0, length=165 NAS-IP-Address = 172.100.50.24 NAS-Port = 1 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = Authenticate-Only Called-Station-Id = "00-18-25-10-2b-20:SOME" Calling-Station-Id = "0c-60-76-7c-af-d0" NAS-Port-Id = "0c-60-76-7c-af-d0" User-Name = "testuser@nc" EAP-Message = 0x020000120174612d32323331313236406e63 Message-Authenticator = 0x0d82a782af2e0cc67d993968ef2b793c # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "nc" for User-Name = "testuser@nc" [suffix] Found realm "nc" [suffix] Adding Stripped-User-Name = "testuser" [suffix] Adding Realm = "nc" [suffix] Proxying request from user testuser to realm nc [suffix] Preparing to proxy authentication request to realm "nc" ++[suffix] returns updated [eap] Request is supposed to be proxied to Realm nc. Not doing EAP. ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop WARNING: Empty pre-proxy section. Using default return values. Sending Access-Request of id 79 to 172.10.10.1 port 1812 NAS-IP-Address = 172.100.50.24 NAS-Port = 1 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = Authenticate-Only Called-Station-Id = "00-18-25-10-2b-20:SOME" Calling-Station-Id = "0c-60-76-7c-af-d0" NAS-Port-Id = "0c-60-76-7c-af-d0" User-Name = "testuser" EAP-Message = 0x020000120174612d32323331313236406e63 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Proxying request 0 to home server 172.10.10.1 port 1812 Sending Access-Request of id 79 to 172.10.10.1 port 1812 NAS-IP-Address = 172.100.50.24 NAS-Port = 1 Framed-MTU = 1388 NAS-Port-Type = Wireless-802.11 Service-Type = Authenticate-Only Called-Station-Id = "00-18-25-10-2b-20:SOME" Calling-Station-Id = "0c-60-76-7c-af-d0" NAS-Port-Id = "0c-60-76-7c-af-d0" User-Name = "testuser" EAP-Message = 0x020000120174612d32323331313236406e63 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x30 Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 172.10.10.1 port 1812, id=79, length=44 Invalid packet code 1 sent to a proxy port from home server 172.10.10.1 port 1812 - ID 79 : IGNORED Waking up in 0.9 seconds. Waking up in 13.0 seconds.

3 3

Re: Problem suppressing timestamp/Request-Athenticator in detailed logging
by Janet Plato 03 Nov '10

03 Nov '10

Alan, > You're stuck on a solution that isn't working. > You should instead describe the problem. > There is likely a better way to get the same results. > > Alan DeKok. Thanks for replying and your work on this project. I am installing a new radius server and want to accomplish three kinds of logging, only one of which I mentioned. In one paragraph: - I want to to send messages related to radiusd to a local file such as /var/log/messages or radius.log - I was accounting related messages written out one line each in a local file since it is easy to automatically filter them to notice anomalies. I want to limit the size of log files and putting it all on one line works better for me. - I want the accounting related messages to also be reflected to a remote syslog server that is part of our monitoring systems, where it can cause visual alerts when certain things happen. - I want to configure networks in clients.conf, but have logging done by NAS-IP-Addr. At this moment the server seems to be answering fine and the default config is mostly working. I am now trying to work step by step towards the following: - I want to have log messages related to the radius daemon appear in /var/log/radius/radius.log (or /var/log/messages), things like starting and stopping the server, errors in the config and so on. Local detail files could also go there, but I'd rather they went in their own detail file. - I want radiusd to send syslog messages concerning logins to a remote syslog server at the same time it logs local details. I could enable logging to the local syslog socket and having syslogd reflect local1.* to @syslog.remote.my.net, but: radiusd cannot log to both files and syslog in the same log {} stanza in radiusd.conf and also syslogd would have to reflect all events of facility.* to the remote server. Right now nothing else uses local1.* but that might not always be true. Also, if radiusd sends everything to a remote syslog server that is fine, as long as it also does local file logging. If radiusd does its own remote syslog sending, then local processes are free to send to the local socker on local1.* without conflict. I could probably get syslogd to log to both a file and a remote server but that causes problems with other processes potentially using the same facility.severity. - I want to be able to configure networks in my clients.conf file but have logging by NAS IP address. I have this in clients.conf client 10.0.0.0/16 { secret = Hint:ThisIsNotTheRealSecret } I get this as a log entry: Tue Nov 2 13:06:04 2010 : Auth: Login OK: [uname] (from client 10.0.0.0/16 port 1812) I'd like to log the header line I specified and suppress everything else: 2010-11-03 14:50:38 1b17d86ead 10.1.1.1: User uname from 192.168.1.1 Start 2010-11-03 14:50:38 1b17d86ead 10.1.1.1: User uname from 192.168.1.1 Stop This lets me easily notice trends in the system, does not fill up my logs, allows me to filter out logins from known users on their desktops, and see what is left. I can easily write something that views the log file as a series of stanzas, and only shows those stanzas that do not contain both (a username line with a known user and a client-IP from a known host). The detail log rolls daily which is nice, but I would prefer the server messages to go into radius.log which rolls less often. So how can I just have it create a header with what I want, and suppress everything else as well as log to a remote syslog server? Cheers, Janet

2 1

PROXY settings can't be reload with sig HUP
by ichiro tanaka 03 Nov '10

03 Nov '10

Hi. I was using freeradus-2.1.10 as radius proxy server. proxy.conf says this. # Also, the mapping of host name to address is done ONCE # when the server starts. If DNS is later updated to # change the address, FreeRADIUS will NOT discover that # until after a re-start, or a HUP. So, I send to freeradius "kill -HUP". But authhost and accthost was not reloaded to new ip-address. ----- my proxy.conf ----- realm example.jp { authhost = example.jp accthost = example.jp secret = secret nostrip } Thanks for your help. ichiro tanaka

2 1

Distriubtion Recommendation
by Johnson, Neil M 03 Nov '10

03 Nov '10

Which Linux Distro is recommended for running FreeRadius 2.1 ? I'm looking to avoid having to compile Samba by hand. Thanks. -Neil -- Neil Johnson Network Engineer Information Technology Services The University of Iowa 319 384-0938 neil-johnson(a)uiowa.edu

4 4

Problem suppressing timestamp/Request-Athenticator in detailed logging
by Janet Plato 03 Nov '10

03 Nov '10

Greetings, I am running freeradius 2.1.7 and attempting to have limited details in my detail logfile. I edited modules/detail to include the header I like, and added just about everything else to the suppress stanza. I get mostly what I want, but it still prints Timestamp and Request-Athenticator, but logs an error that those are not valid values and cannot suppress them. Does anyone have any suggestions on where I might have gone astray? I am getting the following error in /var/log/radius/radius.log Wed Nov 3 14:25:41 2010 : Info: rlm_detail: WARNING: No such attribute Timestamp: Cannot suppress printing it. Wed Nov 3 14:25:41 2010 : Info: rlm_detail: WARNING: No such attribute Request-Authenticator: Cannot suppress printing it. The following is the suppress stanza of /etc/raddb/modules/detail, note that I suppress those two items. detail { # stuff header = "%S %{Acct-Unique-Session-Id} %n: User %u from %i %{Acct-Status-Type}" # stuff suppress { User-Password Acct-Session-Id User-Name Acct-Authentic Acct-Terminate-Cause Acct-Session-Time Acct-Status-Type Calling-Station-Id Service-Type NAS-IP-Address NAS-Port NAS-Port-Id NAS-Port-Type Acct-Delay-Time Acct-Unique-Session-Id Timestamp Request-Authenticator } I get the following in the detail file, note that I get Timestamp and Request-Authenticator which I am trying to stop: 2010-11-03 14:20:35 23e0e50bb883d1a1 146.151.161.4: User plato from 144.92.67.114 Stop Timestamp = 1288812035 Request-Authenticator = Verified 2010-11-03 14:25:47 f93811307e83dc9d 146.151.161.4: User plato from 144.92.67.114 Start Timestamp = 1288812347 Request-Authenticator = Verified I have manually shutdown the server and ran it with radiusd -X and it says basically the same thing: ... Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/radius/radacct/detail-%Y%m%d" header = "%S %{Acct-Unique-Session-Id} %n: User %u from %i %{Acct-Status-Type}" detailperm = 420 dirperm = 493 locking = no log_packet_header = no } rlm_detail: WARNING: No such attribute Timestamp: Cannot suppress printing it. rlm_detail: WARNING: No such attribute Request-Authenticator: Cannot suppress printing it. Module: Instantiating attr_filter.accounting_response ... I've looked for extra spaces and non-printed characters in the config, but that does not seem to be it. Does anyone have any suggestions on where to look? Cheers, Janet, who can be reached at techgrrl2003 at yahoo dot com.

2 1

Help on passing parameter to exec
by nghiapt 03 Nov '10

03 Nov '10

Hi all, At first, to the people who is working on FreeRADIUS, you're doing an awesome, awesome job! Ok, so I'm having this configuration: in sites-available/default: [...] preacct { # Echo here yields WARNING and doesn't catch Session-Timeout # echo if (Acct-Status-Type == "Start"){ acctstart } if (Acct-Status-Type == "Stop"){ acctstop } [...] where acctstart and acctstop is 2 exec modules, defined like this: exec acctstart { wait = yes program = "/accounting_start_sh.sh %{User-Name} %{reply:Session-Timeout}" input_pairs = reply output_pairs = reply shell_escape = yes } exec acctstop { wait = yes program = "/accounting_stop_sh.sh %{User-Name} input_pairs = reply output_pairs = reply shell_escape = yes } Basically, the shell script is to ssh and terminate stuff in NAS after Session-Timeout seconds have passed (Don't ask, but NAS doesn't support Session-Timeout so we need to do it this way). The problem is, when we have a run, the debug yield: [...] Sending Access-Accept of id 121 to 127.0.0.1 port 45280 Reply-Message = "Hello, test" Session-Timeout = 94 Finished request 0. Going to the next request Waking up in 4.7 seconds. rad_recv: Accounting-Request packet from host 127.0.0.1 port 45280, id=123, length=155 NAS-Identifier = "OpenVPN.localhost.localdomain" User-Name = "test" NAS-Port = 27 Service-Type = Dialout-Framed-User Framed-Protocol = PPP Acct-Status-Type = Start Framed-IP-Netmask = 255.255.248.0 Acct-Session-Id = "OpenVPN.localhost.localdomain.as0t1.1288162180.5521.27" Framed-IP-Address = 5.5.8.25 NAS-Port-Type = Virtual +- entering group preacct {...} ++? if (Acct-Status-Type == "Start") ? Evaluating (Acct-Status-Type == "Start") -> TRUE ++? if (Acct-Status-Type == "Start") -> TRUE ++- entering if (Acct-Status-Type == "Start") {...} [acctstart] WARNING! Input pairs are empty. No attributes will be passed to the script [acctstart] expand: %{User-Name} -> test [acctstart] expand: %{reply:Session-Timeout} -> expr: syntax error Exec-Program output: test is scheduled to be terminated after min(s) Exec-Program-Wait: plaintext: test is scheduled to be terminated after min(s) Exec-Program: returned: 0 [...] Note the 2 bold lines, the Session-Timeout isn't passed to the acctstart exec, leading to shellscript doesn't run correctly. My question is can I somehow pass the Session-Timeout value from the Access-Accept packet to this section of preaccounting? FYI, I'm using sql counter (the default noresetcounter) to calculate the Session-Timeout. Thanks a lot in advance, N. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Help-on-passing-parameter-to-exec-t… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 5

None
by Влад Власов 03 Nov '10

03 Nov '10

Hello everyone, Please help me I try to setup FreeRadius as proxy. I want to extract MSCHAPv2 auth from EAP-PEAP/MSCHAPv2 ,and proxy only MSCHAPv2 request to another radius server ,that does not work with a EAP-PEAP. changed only the following items:

1 0

dot1x with samba workstation accounts part two
by steffo76＠gmx.de 02 Nov '10

02 Nov '10

Hi list, I am new here and would like to respond to a message which has been sent before I was subscribed: https://lists.freeradius.org/pipermail/freeradius-users/2010-June/msg00432.… I ran into the same problem and might have a solution that satisfies both sides, I added a configuration option to modules/mschap which is called "enforce_user_flag". With this patch the following happens: If the disabled flag is set, it rejects anyway. If the enforce_user_flag is not set or set to 'yes', mschap checks for the presence of the user flag (this has been the behaviour so far). If enforce_user_flag is set to 'no', mschap checks for the presence of the „workstation trust account“ „server trust account“ or „normal user account“. If one of them is present it is satisfied with the flags. With this solution mschap behaves like it did before with out of the box settings but is able to honor the workstation or server trust account flags if the configuration option is set accordingly. There would be no need to disable the check of the 'disabled' flag. It is probably not the best code ever but maybe it helps someone. Regards Stephan

1 0