June 2010 - Freeradius-Users - lists.freeradius.org

unsubscribe
by Tawanda Kavayi 08 Jun '10

08 Jun '10

1 0

Rewriting Exec-Program-Wait
by Mindaugas Riauba 08 Jun '10

08 Jun '10

Hello, Just upgraded to freeradius2 2.1.7 on CentOS 5.5. And Exec-Program-Wait no longer works now for accounting packets. Rewrote to exec module. But for performance reasons we were not executing external program for all the packets before. We used more specific user entries in users and acct_users files to return result without executing program. Like: DEFAULT Auth-Type := Accept, NAS-Identifier == "company", Calling-Station-Id =~ "^49", 3GPP-SGSN-Address =~ "^10.20.20." DEFAULT Auth-Type := Accept Exec-Program-Wait = "/etc/raddb/external-auth" How to change that to exec module syntax? So that external-auth would not be called for certain packets? Regards, Mindaugas

1 0

reauth-problem with WPA2-tls
by Andreas Hartmann 07 Jun '10

07 Jun '10

Hello, I'm using freeradius 2.1.8 with wpa_supplicant 0.7.1, both on 32bit-linux with openssl 1.0.0 or openssl 0.9.8. AP is a Linksys WAP610N. In eap.conf, the option eap -> tls -> cache -> enable is switched off and fast_reauth in wpa_supplicant is enabled. The initial login works fine. But there seems to be a problem to fill the cache during initial login: rad_recv: Access-Request packet from host 192.168.1.9 port 2048, id=50, length=178 User-Name = "myuser@mydom" NAS-Port = 0 Called-Station-Id = "00-25-....:mywlan" Calling-Station-Id = "00-13-..." Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020800060d00 State = 0x89d58d3e8edd800104fb11e3a0338e57 Message-Authenticator = 0xe8f5eca1715e4bd2ecfa23c444efe859 Wed Jun 2 20:29:14 2010 : Info: +- entering group authorize {...} Wed Jun 2 20:29:14 2010 : Info: ++[preprocess] returns ok Wed Jun 2 20:29:14 2010 : Info: ++[chap] returns noop Wed Jun 2 20:29:14 2010 : Info: ++[mschap] returns noop Wed Jun 2 20:29:14 2010 : Info: [suffix] Looking up realm "mydom" for User-Name = "myuser@mydom" Wed Jun 2 20:29:14 2010 : Info: [suffix] No such realm "mydom" Wed Jun 2 20:29:14 2010 : Info: ++[suffix] returns noop Wed Jun 2 20:29:14 2010 : Info: [eap] EAP packet type response id 8 length 6 Wed Jun 2 20:29:14 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Jun 2 20:29:14 2010 : Info: ++[eap] returns updated Wed Jun 2 20:29:14 2010 : Info: ++[unix] returns notfound Wed Jun 2 20:29:14 2010 : Info: [files] users: Matched entry myuser@mydom at line 203 Wed Jun 2 20:29:14 2010 : Info: ++[files] returns ok Wed Jun 2 20:29:14 2010 : Info: ++[expiration] returns noop Wed Jun 2 20:29:14 2010 : Info: ++[logintime] returns noop Wed Jun 2 20:29:14 2010 : Info: ++[pap] returns noop Wed Jun 2 20:29:14 2010 : Info: Found Auth-Type = EAP Wed Jun 2 20:29:14 2010 : Info: +- entering group authenticate {...} Wed Jun 2 20:29:14 2010 : Info: [eap] Request found, released from the list Wed Jun 2 20:29:14 2010 : Info: [eap] EAP/tls Wed Jun 2 20:29:14 2010 : Info: [eap] processing type tls Wed Jun 2 20:29:14 2010 : Info: [tls] Authenticate Wed Jun 2 20:29:14 2010 : Info: [tls] processing EAP-TLS Wed Jun 2 20:29:14 2010 : Info: [tls] Received TLS ACK Wed Jun 2 20:29:14 2010 : Info: [tls] ACK handshake is finished Wed Jun 2 20:29:14 2010 : Info: [tls] eaptls_verify returned 3 Wed Jun 2 20:29:14 2010 : Info: [tls] eaptls_process returned 3 Wed Jun 2 20:29:14 2010 : Info: [tls] Adding user data to cached session Wed Jun 2 20:29:14 2010 : Info: [tls] Saving response in the cache Wed Jun 2 20:29:14 2010 : Info: [tls] WARNING: No information to cache: session caching will be disabled for this session. If the reconnect takes place, the missing cache-data seems to be the problem -> the user cannot be authenticated: rad_recv: Access-Request packet from host 192.168.1.9 port 2048, id=55, length=237 User-Name = "myuser@mydom" NAS-Port = 0 Called-Station-Id = "00-25-...:mywlan" Calling-Station-Id = "00-13-..." Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = ...df1e94bea7671e5b6cf4571cf262db282b055d78ab191a3 State = 0x01880c0103840161cd60973c24894f7d Message-Authenticator = 0xf8b7771a372c0768720c9bf05de8708b Wed Jun 2 20:39:18 2010 : Info: +- entering group authorize {...} Wed Jun 2 20:39:18 2010 : Info: ++[preprocess] returns ok Wed Jun 2 20:39:18 2010 : Info: ++[chap] returns noop Wed Jun 2 20:39:18 2010 : Info: ++[mschap] returns noop Wed Jun 2 20:39:18 2010 : Info: [suffix] Looking up realm "mydom" for User-Name = "myuser@mydom" Wed Jun 2 20:39:18 2010 : Info: [suffix] No such realm "mydom" Wed Jun 2 20:39:18 2010 : Info: ++[suffix] returns noop Wed Jun 2 20:39:18 2010 : Info: [eap] EAP packet type response id 12 length 65 Wed Jun 2 20:39:18 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Jun 2 20:39:18 2010 : Info: ++[eap] returns updated Wed Jun 2 20:39:18 2010 : Info: ++[unix] returns notfound Wed Jun 2 20:39:18 2010 : Info: [files] users: Matched entry myuser@mydom at line 203 Wed Jun 2 20:39:18 2010 : Info: ++[files] returns ok Wed Jun 2 20:39:18 2010 : Info: ++[expiration] returns noop Wed Jun 2 20:39:18 2010 : Info: ++[logintime] returns noop Wed Jun 2 20:39:18 2010 : Info: ++[pap] returns noop Wed Jun 2 20:39:18 2010 : Info: Found Auth-Type = EAP Wed Jun 2 20:39:18 2010 : Info: +- entering group authenticate {...} Wed Jun 2 20:39:18 2010 : Info: [eap] Request found, released from the list Wed Jun 2 20:39:18 2010 : Info: [eap] EAP/tls Wed Jun 2 20:39:18 2010 : Info: [eap] processing type tls Wed Jun 2 20:39:18 2010 : Info: [tls] Authenticate Wed Jun 2 20:39:18 2010 : Info: [tls] processing EAP-TLS Wed Jun 2 20:39:18 2010 : Info: [tls] eaptls_verify returned 7 Wed Jun 2 20:39:18 2010 : Info: [tls] Done initial handshake Wed Jun 2 20:39:18 2010 : Info: [tls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Wed Jun 2 20:39:18 2010 : Info: [tls] <<< TLS 1.0 Handshake [length 0010], Finished Wed Jun 2 20:39:18 2010 : Info: [tls] TLS_accept: SSLv3 read finished A Wed Jun 2 20:39:18 2010 : Info: [tls] (other): SSL negotiation finished successfully Wed Jun 2 20:39:18 2010 : Debug: SSL Connection Established Wed Jun 2 20:39:18 2010 : Debug: SSL Application Data Wed Jun 2 20:39:18 2010 : Info: [tls] eaptls_process returned 3 Wed Jun 2 20:39:18 2010 : Info: [tls] Retrieved session data from cached session Wed Jun 2 20:39:18 2010 : Info: [tls] WARNING: No information in cached session! Wed Jun 2 20:39:18 2010 : Info: [eap] Freeing handler Wed Jun 2 20:39:18 2010 : Info: ++[eap] returns reject Wed Jun 2 20:39:18 2010 : Info: Failed to authenticate the user. Wed Jun 2 20:39:18 2010 : Auth: Login incorrect: [myuser@mydom] (from client WAP610N port 0 cli 00-13-...) Wed Jun 2 20:39:18 2010 : Info: Using Post-Auth-Type Reject Wed Jun 2 20:39:18 2010 : Info: +- entering group REJECT {...} Wed Jun 2 20:39:18 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> myuser@mydom Wed Jun 2 20:39:18 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Wed Jun 2 20:39:18 2010 : Info: ++[attr_filter.access_reject] returns updated Wed Jun 2 20:39:18 2010 : Info: Delaying reject of request 13 for 1 seconds Wed Jun 2 20:39:18 2010 : Debug: Going to the next request Wed Jun 2 20:39:18 2010 : Debug: Waking up in 0.9 seconds. Wed Jun 2 20:39:19 2010 : Info: Sending delayed reject for request 13 Sending Access-Reject of id 55 to 192.168.1.9 port 2048 EAP-Message = 0x040c0004 Message-Authenticator = 0x00000000000000000000000000000000 Independently of this incorrect login. the connection between the supplicant and the AP isn't disconnected or interrupted(!!), but the reauthentication is done every minute now. If the cache in eap.conf is disabled, the user can't be authenticated too, but the error during reauthentication is another (SSL_GET_PREV_SESSION:session id context uninitialized): rad_recv: Access-Request packet from host 192.168.1.9 port 2048, id=77, length=1484 User-Name = "myuser@mydom" NAS-Port = 0 Called-Station-Id = "00-25-...:mywlan" Calling-Station-Id = "00-13-...." Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = ...0170018001900230420447af7318cf8a9 EAP-Message = ...a3900200a0967a31318e54f7028eb6869963739a506ba EAP-Message = ...a35e57c17bbc86639826ba135d40271a953ec8fc6b1748 EAP-Message = ...ffe48b048b34ca5e97417950e1963592be7aa223ef906e8 EAP-Message = ...5647e8913e37299de4c889576a3cc2ac565285a27750f EAP-Message = ...5cccfedd1b96f38c9897681d78bbf75296a5e559e31c59b State = 0xaeafb685afa4bb3f1df61345a8211214 Message-Authenticator = 0xef86f802b12b474972c47fcd3692ae4f Wed Jun 2 21:04:16 2010 : Info: +- entering group authorize {...} Wed Jun 2 21:04:16 2010 : Info: ++[preprocess] returns ok Wed Jun 2 21:04:16 2010 : Info: ++[chap] returns noop Wed Jun 2 21:04:16 2010 : Info: ++[mschap] returns noop Wed Jun 2 21:04:16 2010 : Info: [suffix] Looking up realm "mydom" for User-Name = "myuser@mydom" Wed Jun 2 21:04:16 2010 : Info: [suffix] No such realm "mydom" Wed Jun 2 21:04:16 2010 : Info: ++[suffix] returns noop Wed Jun 2 21:04:16 2010 : Info: [eap] EAP packet type response id 11 length 253 Wed Jun 2 21:04:16 2010 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Wed Jun 2 21:04:16 2010 : Info: ++[eap] returns updated Wed Jun 2 21:04:16 2010 : Info: ++[unix] returns notfound Wed Jun 2 21:04:16 2010 : Info: [files] users: Matched entry myuser@mydom at line 203 Wed Jun 2 21:04:16 2010 : Info: ++[files] returns ok Wed Jun 2 21:04:16 2010 : Info: ++[expiration] returns noop Wed Jun 2 21:04:16 2010 : Info: ++[logintime] returns noop Wed Jun 2 21:04:16 2010 : Info: ++[pap] returns noop Wed Jun 2 21:04:16 2010 : Info: Found Auth-Type = EAP Wed Jun 2 21:04:16 2010 : Info: +- entering group authenticate {...} Wed Jun 2 21:04:16 2010 : Info: [eap] Request found, released from the list Wed Jun 2 21:04:16 2010 : Info: [eap] EAP/tls Wed Jun 2 21:04:16 2010 : Info: [eap] processing type tls Wed Jun 2 21:04:16 2010 : Info: [tls] Authenticate Wed Jun 2 21:04:16 2010 : Info: [tls] processing EAP-TLS Wed Jun 2 21:04:16 2010 : Info: [tls] eaptls_verify returned 7 Wed Jun 2 21:04:16 2010 : Info: [tls] Done initial handshake Wed Jun 2 21:04:16 2010 : Info: [tls] (other): before/accept initialization Wed Jun 2 21:04:16 2010 : Info: [tls] TLS_accept: before/accept initialization Wed Jun 2 21:04:16 2010 : Info: [tls] <<< TLS 1.0 Handshake [length 050b], ClientHello Wed Jun 2 21:04:16 2010 : Error: TLS_accept:error in SSLv3 read client hello C Wed Jun 2 21:04:16 2010 : Error: rlm_eap: SSL error error:140D9115:SSL routines:SSL_GET_PREV_SESSION:session id context uninitialized Wed Jun 2 21:04:16 2010 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Wed Jun 2 21:04:16 2010 : Debug: TLS receive handshake failed during operation If fast_reauth in wpa_supplicant is disabled, the reauthentication works fine, but the connection between the AP and the supplicant ist interrupted for about 20 seconds - much to long :-). Do you have any idea how to solve this problem? Thanks for you help, Andreas

5 30

Username manipulation
by Greg Malewski 07 Jun '10

07 Jun '10

Hi, I have been unable to find any examples - if the facility exists - of being able to process a username prior to forwarding it. For example, I may wish to take a username such as joe_bloggs and convert it into joe.bloggs prior to passing it on to the authentication oracle. Furthermore, is it possible to only do this with some RADIUS clients? Thanks in advance Greg

2 1

OCSP support
by Nikita Koshikov 07 Jun '10

07 Jun '10

Hello list, Is freeradius able to validate certificates using OCSP protocol for EAP-TLS clients ? If yes - where can I find relevant config example?

2 1

Accounting to MySQL not working
by Christoph Schwabl 07 Jun '10

07 Jun '10

Hello, I have a small problem with accounting to mysql. freeradius 2.1.8 mysql Ver 14.12 Distrib 5.0.51a, for debian-linux-gnu (i486) using readline 5.2 The NAS is sending accounting data, which I can see in: more /var/log/freeradius/radacct/192.168.1.10/detail-20100526 ... Wed May 26 23:43:57 2010 Acct-Session-Id = "00000039" Called-Station-Id = "0011.2177.0da4" Calling-Station-Id = "001f.3b1c.f25b" Cisco-AVPair = "ssid=testradius" Cisco-AVPair = "vlan-id=0" Cisco-AVPair = "nas-location=unspecified" User-Name = "testuser" Cisco-AVPair = "connect-progress=Call Up" Acct-Session-Time = 237 Acct-Input-Octets = 35971 Acct-Output-Octets = 64059 Acct-Input-Packets = 473 Acct-Output-Packets = 98 Acct-Authentic = RADIUS Acct-Status-Type = Interim-Update NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "296" NAS-Port = 296 Service-Type = Framed-User NAS-IP-Address = 192.168.1.10 Acct-Delay-Time = 0 Acct-Unique-Session-Id = "4d69927723cb56d8" Timestamp = 1274910237 Request-Authenticator = Verified But I cann't find accounting data in MySQL database. My configuration is: radiusd.conf ================== ... $INCLUDE sql.conf ... readclients = yes ... sites-enabled/inner-tunnel ================== ... authorize { chap mschap unix suffix update control { Proxy-To-Realm := LOCAL } eap { ok = return } files sql expiration logintime pap } ... sites-enabled/default ================== ... authorize { preprocess chap mschap suffix eap { ok = return } unix files sql expiration logintime pap } ... accounting { detail unix radutmp sql attr_filter.accounting_response } ... Using users (radcheck) and clients (nas) from MySQL are working well. However, accounting into MySQL is not working. Anybody an idea? thx & br Christoph -- GMX.at - Österreichs FreeMail-Dienst mit über 2 Mio Mitgliedern E-Mail, SMS & mehr! Kostenlos: http://portal.gmx.net/de/go/atfreemail

6 14

strange accounting update
by Good One 07 Jun '10

07 Jun '10

I am observing that some of the user’s sessions are accounting a wrong update which is very strange. The send/receive byte updated value for such sessions is always 4294967296 KB (4096GB). So if you aggregate both in/out it is 4096+4096 for a single session. It's really very strange why radius accouting is being updated with the same value for certain users on periodic interval. Any comments/thoughts will be appreciated. Thanks Andrew _________________________________________________________________ Hotmail: Trusted email with powerful SPAM protection. https://signup.live.com/signup.aspx?id=60969

2 1

Re: Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi. Thank you for reply. I thought same thing could be possible, so i created an other user on mysql server. I connected directly to USG on the Public IP of its (no VPNs now) I performed radiusd -X . . . .... User-Name = "vito" User-Password = "catozzo" NAS-IP-Address = 172.16.68.10 NAS-Identifier = "weblogin" NAS-Port = 24081 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "78.aa.bb.148" *<- this is my current IP address at home* .... My Daloradius NAS reports the two NAS, addresses of WAN2* and WAN1** of USG in HQ LAN1 of USG is 172.16.68.253. Server WIn2003 has 172.16.68.10. Has a Radius on, but users are created by a VB client i developed some yrs ago, with only numers and dots on both username and password for eache user. No way to have vito/catozzo on :-) ID NAS NAS IP/Host Diminutivo NAS Tipo NAS Porte NAS NAS Secret Descrizione NAS 3 89.aa.bb.cc o-fw* other 0 myshared 6 79.dd.ee.ff o-tvc** other 0 myshared

2 1

RE: Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi. Sorry for some errors in former mails. "Yes" parameter is the right one. Once i set this i obtain what i want: it works! I had misunderstood what parameter yes/no would have changed on setting. I already attach log file with *yes* setting. *So problem has been solved! :-)* Anyway . . . I see something strange in part of it: *address 172.16.68.10* I explain my configuration: a. remote NAS USG100 with publicIP 89.aa.bb.cc. LAN IP is 172.16.68.253 gateway for 172.16.68.0/24 network. it holds iformations about all AAA servers. b. my freeradius (with mysql) is behind a router (public IP 79.ss.dd.ss) that forwards 1812/1813 UDP to WAN Iface of my Fedora Server. Now . . . *172.16.68.10 is* the IP address of a Win2003 Server with WinRadius (MS Access DB) on. 172.16.68.16 is client i reach via SSL tunnel. From this one i, thru WEBLogIN (useraware of USG100), i provide username/password stored in my mysql server and authentication goes fine with freeradius. Why does it reports informations about other AAA servers? Is it an error of USG? Thanks in advance! Little abstracts about radiusd -x Setting . ... *readclients = yes* in /usr/local/etc/raddb/sql.conf, running #radiusd -X User-Name = "cactus" User-Password = "barilotto" NAS-IP-Address = 172.16.68.10 NAS-Identifier = "weblogin" NAS-Port = 15330 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "172.16.68.16"

2 1

Freeradius is unable to read NAS table in mysql db
by superataru - 07 Jun '10

07 Jun '10

Hi all. I'm pretty new with Freeradius, but it seems matching my targets :-) I set Freeradius with mysql server and Daloradius Management. After some troubles to install FR, it worked fine, at least as basical startup: i can authenticate remote users! For real it works if i use /raddb/clients.conf file, setting readclients = yes in /raddb/sql.conf. Once i set it to "no", autentication fails. I checked nas table structure and it's ok, the same as in /usr/local/etc/raddb/sql/mysql/nas.sql User are instead loaded fine from mysql users table. How could i solve it? Thanks in advance Here my configuration. Fedora Core 10 Freeradius 2.1.9 Daloradius 0.9-7 MySQL 5.0.88 Remote NAS: ZyXEL USG100 (2.21) Superataru --

3 5