November 2010 - Freeradius-Users - lists.freeradius.org

Having 2 User-Name when using Session Resumption
by Panagiotis Georgopoulos 19 Nov '10

19 Nov '10

Hello all, I am experiencing the following problem when using EAP-TLS and session resumption. When my client tries to authenticate for the 2nd time and FR recognizes that it has a valid session for it, it goes on and adds a cached attribute to the reply (User-Name) thus ending up with two User-Name attributes in my packet reply to NAS. Debug: SSL Connection Established Debug: SSL Application Data Info: [tls] eaptls_process returned 3 Info: [tls] Retrieved session data from cached session Info: [tls] Adding cached attributes to the reply: User-Name = "anonymous(a)myisp2.com" Info: [eap] Freeing handler Info: ++[eap] returns ok Auth: Login OK: [anonymous(a)myisp2.com] (from client my_proxy_AAAServer1 port 1 cli 00-1B-2F-29-00-99) Info: # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default Info: +- entering group post-auth {...} Info: ++[exec] returns noop Sending Access-Accept of id 23 to 2001:db95::100 port 1814 User-Name = "anonymous(a)myisp2.com" User-Name = "anonymous(a)myisp2.com" MS-MPPE-Recv-Key = 0x40a71fc0b17fd5ce0bee1cfc06ebf8c48a6d37aa710c436a1da4aa3459a22007 MS-MPPE-Send-Key = 0x54ef81d0a961dda08062bb5e9f433a289f3b6628622122b0314a758abacacce2 EAP-Message = 0x03c90004 Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x34 How could I check if my reply has two User-Name attributes and remove one? I am guessing that I should add some code in my post-auth.. Thanks a lot in advance, Panos PS. in order for session resumption to work on EAP-TLS I am having an update reply { User-Name = "%{request:User-Name}"} section at the end of my auth stanza of default which explains why it is not surprising to have the first instance of User-Name there when FR decides to add cached attributes... (if I don't have this update reply code SR doesn't work in EAP-TLS)

2 2

Changing a Reject into an Accept
by Brian Candler 19 Nov '10

19 Nov '10

Is it possible to turn a reject into an accept inside the post-auth section? The idea is to tunnel specific groups of failed users to an appropriate help page. I have tried: post-auth { ... Post-Auth-Type REJECT { if ( .... ) { applyTunnelAttributes ok } } } The attributes are added, but the 'ok' doesn't change the packet into an Access-Accept. I also tried, unsuccessfully, update control { Packet-Type := Access-Accept Response-Packet-Type := Access-Accept } update reply { Packet-Type := Access-Accept Response-Packet-Type := Access-Accept } (freeradius reports that modifying the value of a virtual attribute is not supported) I could mess about with the authenticate section, but this goes against the stern advice in the default config: # Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for. Going against that advice, the following appears to work: authenticate { Auth-Type PAP { pap { ok = return reject = 1 } applyTunnelAttributes } Auth-Type CHAP { chap { ok = return reject = 1 } applyTunnelAttributes } } So, any better way of achieving this? Thanks, Brian.

2 1

Radmin segmentation fault
by David Seira 19 Nov '10

19 Nov '10

Hi list, I'm trying radmin with freeradius 2.1.10, in debian distro with 2.6.26-2-686 kernel. When I put the "show module config sql" I receive a segmentation fault un radiusd. Has anybody have the same bug? Regards, David

2 1

No NAS Port seen ?
by Michael Arndt 19 Nov '10

19 Nov '10

Hello * -is the error belwo caused by fault of the NAS -or a stupid mistake of mine within setup ? rlm_radutmp: No NAS-Port seen. Cannot do anything. rlm_radumtp: WARNING: checkrad will probably not work! -other attributes are sent correctly -device is a lancom 315-agn TIA Micha

2 1

Re: configure output summary
by ironrake＠yahoo.com 19 Nov '10

19 Nov '10

"But newcomers aren't that trained yet." Perhaps you should change your course material? Sent from Verizon Wireless

2 1

want to set up something a little more complex, not sure how to start. (hosts authenticated against openldap server)
by Christ Schlacta 19 Nov '10

19 Nov '10

I've currently got a single host configured to have a certificate, the certificate is issued on a per-host basis. I want to somehow link a specific machine to a specific ssl certificate. it's my understanding that openldap or mysql can do this. I'd prefer not to use mysql as the mysql authentication server is already running on a separate server from my radius server, and I want the radius server to be self-sufficient. the load is low enough to sustain this, but I'd also prefer not to maintain 2 mysql servers separately. ergo, mysql is a last resort solution. that leaves openldap. I should say now I'm authenticating wireless clients over wpa2 + eap-tls. I'm still looking for a fairly simple "install a keypair+cacert on a client and it just works from then on", but I'd like to register in openldap that a given host (identified by some combination of name, mac address) is permanently tied to a given certificate. If the host and certificate don't match, I'd want to get some sort of notification in the logs or an e-mail alert or similar. what I don't want is for users to have to maintain any sort of "password" or "username" to connect to the wireless network. we're not using passwords now, we don't want to add complexity to the user side. I'm not really sure how to accomplish authorizing a certificate that's already passed tls authentication, but if it's possible, I know you folks will be able to point me to a guide or provide some input as to how to accomplish this.

2 1

configure output summary
by Stefan Winter 19 Nov '10

19 Nov '10

Hi, when running configure, lots of somewhat important messages scroll by, like "silently disabling something you need" :-) An untrained eye may miss these easily, leading to confusion afterwards (I'm currently running a lecture on RADIUS, and pretty much all of my students took their time figuring out that they need openssl-devel for PEAP to work etc.). I think it would generally make sense to put a summary output of configure at the end of its run, so that one can easily see which modules will be disabled. In an acute case of bash script fiddling, I created the attached proof of concept "test.sh" script, which recursively goes through all config.log files and a) greps all lines with WARNING b) greps all lines with "silently not building" and puts these out in massaged human-readable form. Would something like this have any chances of getting included into the tarball? It could run as the very last thing in configure... Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

6 11

Re: Re: LDAP auth success / User reject
by Michael Arndt 19 Nov '10

19 Nov '10

Hello *, Problem solved thx to Alans help -Find out what part of the configuration is setting "Auth-Type := Reject" -Look in the "files" configuration, and in the data in LDAP. The reject was the last default statement in the users file My problem was, that the patterns for both entries before failed. I resolved the reason, It was a Bug in the LDAP Tree of customer for this site, not noticed by me before. Michael

1 0

Dynamic VLAN assignment on NAS
by Attou eric 19 Nov '10

19 Nov '10

Hi the list I'm sure this is NAS question, not Freeradius' question. But perhaps somebody on the list had experienced this issue. Here is my problem. I setup : - A Freeradius configuration EAP/PEAP with user credentials stored in LDAP directory. - A NAS zcomax ag3621 wireless access point with VLAN 802.1q support. on this access point, i have one SSID associated by default with guest VLAN 30. meaning if a user failed authentication, he will still connected but on this VLAN with reduced privileges. However radius return the following Access-accept packet to my NAS, Sending Access-Accept of id 81 to 192.168.32.88 port 1032 Tunnel-Private-Group-Id:0 = "60" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN User-Name = "user1" The access point just put user1 on VLAN 30. My NAS ignore the VLAN ID 60 (Tunnel-Private-Group-Id:0 = "60") contained in the Access-Accept. I try with two different models of Access point (zcomax and cisco) My question: Is there a particular config to do to ask the NAS to consider the VLAN ID contained in the Access-Accept packet ? Thanks for your answers

2 1

Accounting data and NULL sessions
by Natr Brazell 19 Nov '10

19 Nov '10

I have two questions if I may. One I think I've asked before but just getting around to trying to tackle it again. 1. I am using mysql for radacct data to keep track of sessions. The accounting data is going into flat files on each radius server. Is there a way to get the accounting data to go directly to into a mysql table? I don't want the accounting data in radacct. 2. I have multiple NULL sessions in my radacct file??? What causes these and how do folks deal with them? Thanks, N

2 1