August 2010 - Freeradius-Users - lists.freeradius.org

User Information
by Christian Rahl 09 Aug '10

09 Aug '10

I am working on trying to get information from connections such as Mac-Address and last connected IP from the device. Once we get this information I would like to add this to the radius database, either in the radpostauth or radacct. I am completely new to radius so not to sure about if I need to add it to a script or have to create my own database for the information and my own script. Christian Rahl

1 0

sql nas and accounting
by Jiann-Ming Su 09 Aug '10

09 Aug '10

Two questions: 1. Does listing clients in the nas database table support virtual servers? If so, what field do I enter that info in and do I need to update the SQL query used in dialup.conf? 2. How do I get sql accounting to work? That is, how do configure freeradius to update the radacct table? Right now, freeradius process seems to be rejecting accounting requests: "Ignoring request to accounting address * port 1813 from unknown client..." The"unknown client" works fine for authentication. Thanks for any tips.

1 1

how to enable session resumption in fr?
by WWF 09 Aug '10

09 Aug '10

dear all, hi! Now I use fr 2.19 for wimax. The CPE asks for session resumption in TTLS-MACHAPv2. like this: Mon Aug 9 16:14:16 2010 : Info: [eap] Request found, released from the list Mon Aug 9 16:14:16 2010 : Info: [eap] EAP/ttls Mon Aug 9 16:14:16 2010 : Info: [eap] processing type ttls Mon Aug 9 16:14:16 2010 : Info: [ttls] Authenticate Mon Aug 9 16:14:16 2010 : Info: [ttls] processing EAP-TLS Mon Aug 9 16:14:16 2010 : Info: [ttls] eaptls_verify returned 7 Mon Aug 9 16:14:16 2010 : Info: [ttls] Done initial handshake Mon Aug 9 16:14:16 2010 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Mon Aug 9 16:14:16 2010 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Mon Aug 9 16:14:16 2010 : Info: [ttls] TLS_accept: SSLv3 read finished A Mon Aug 9 16:14:16 2010 : Info: [ttls] (other): SSL negotiation finished successfully Mon Aug 9 16:14:16 2010 : Debug: SSL Connection Established Mon Aug 9 16:14:16 2010 : Debug: SSL Application Data Mon Aug 9 16:14:16 2010 : Info: [ttls] eaptls_process returned 3 Mon Aug 9 16:14:16 2010 : Info: [ttls] Skipping Phase2 due to session resumption Mon Aug 9 16:14:16 2010 : Info: [ttls] FAIL: Forcibly stopping session resumption as it is not allowed. Mon Aug 9 16:14:16 2010 : Info: [eap] Freeing handler Mon Aug 9 16:14:16 2010 : Info: ++[eap] returns reject Mon Aug 9 16:14:16 2010 : Info: Failed to authenticate the user. Mon Aug 9 16:14:16 2010 : Info: Using Post-Auth-Type Reject Mon Aug 9 16:14:16 2010 : Info: +- entering group REJECT {...} Mon Aug 9 16:14:16 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> B8616F001F47 Mon Aug 9 16:14:16 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Aug 9 16:14:16 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Aug 9 16:14:16 2010 : Info: Delaying reject of request 69 for 1 seconds Mon Aug 9 16:14:16 2010 : Debug: Going to the next request Mon Aug 9 16:14:16 2010 : Debug: Waking up in 0.9 seconds. Mon Aug 9 16:14:17 2010 : Info: Sending delayed reject for request 69 Sending Access-Reject of id 3 to 25.25.25.25 port 36867 EAP-Message = 0x043c0004 Message-Authenticator = 0x00000000000000000000000000000000 But , if I enabled session resumption by setting it in eap.conf by: # # Enable it. The default is "no". # Deleting the entire "cache" subsection # Also disables caching. # # You can disallow resumption for a # particular user by adding the following # attribute to the control item list: # # Allow-Session-Resumption = No # # If "enable = no" below, you CANNOT # enable resumption for just one user # by setting the above attribute to "yes". # enable = yes then I got: Mon Aug 9 16:55:26 2010 : Info: [eap] EAP/ttls Mon Aug 9 16:55:26 2010 : Info: [eap] processing type ttls Mon Aug 9 16:55:26 2010 : Info: [ttls] Authenticate Mon Aug 9 16:55:26 2010 : Info: [ttls] processing EAP-TLS Mon Aug 9 16:55:26 2010 : Info: [ttls] Received TLS ACK Mon Aug 9 16:55:26 2010 : Info: [ttls] ACK handshake is finished Mon Aug 9 16:55:26 2010 : Info: [ttls] eaptls_verify returned 3 Mon Aug 9 16:55:26 2010 : Info: [ttls] eaptls_process returned 3 Mon Aug 9 16:55:26 2010 : Info: [ttls] Saving response in the cache Mon Aug 9 16:55:26 2010 : Info: [ttls] WARNING: No information to cache: session caching will be disabled for this session. Mon Aug 9 16:55:26 2010 : Info: [eap] Freeing handler Mon Aug 9 16:55:26 2010 : Info: ++[eap] returns ok Mon Aug 9 16:55:26 2010 : Info: +- entering group post-auth {...} Mon Aug 9 16:55:26 2010 : Info: ++[exec] returns noop Mon Aug 9 16:55:26 2010 : Info: expand: %{User-Name} -> 1109d0389bf34a72981580a304b50f3b Mon Aug 9 16:55:26 2010 : Info: ++[reply] returns noop Mon Aug 9 16:55:26 2010 : Info: [wimax] MIP-RK = 0x61c8c180fc45a070ca34e0d84e905c23329eec7d5ae69fe3f037d0b404988c7fec960a3dfcebba7615bf1a616ae527f699c87a93e29d66dc79f7fb02208fc1c1 Mon Aug 9 16:55:26 2010 : Info: [wimax] MIP-SPI = 29e23a18 Mon Aug 9 16:55:26 2010 : Info: [wimax] WARNING: WiMAX-IP-Technology not found in reply. Mon Aug 9 16:55:26 2010 : Info: [wimax] WARNING: Not calculating MN-HA keys Mon Aug 9 16:55:26 2010 : Info: ++[wimax] returns updated Mon Aug 9 16:55:26 2010 : Info: expand: %{EAP-MSK} -> Mon Aug 9 16:55:26 2010 : Info: expand: %{User-Name} -> 1109d0389bf34a72981580a304b50f3b Mon Aug 9 16:55:26 2010 : Info: expand: %{md5:%{User-Name}} -> 879d5828deac9e6abd6b86721968d541 Mon Aug 9 16:55:26 2010 : Info: ++[reply] returns updated Sending Access-Accept of id 7 to 25.25.25.25 port 36867 And when resumption: Mon Aug 9 16:53:46 2010 : Info: [eap] Request found, released from the list Mon Aug 9 16:53:46 2010 : Info: [eap] EAP/ttls Mon Aug 9 16:53:46 2010 : Info: [eap] processing type ttls Mon Aug 9 16:53:46 2010 : Info: [ttls] Authenticate Mon Aug 9 16:53:46 2010 : Info: [ttls] processing EAP-TLS Mon Aug 9 16:53:46 2010 : Info: [ttls] eaptls_verify returned 7 Mon Aug 9 16:53:46 2010 : Info: [ttls] Done initial handshake Mon Aug 9 16:53:46 2010 : Info: [ttls] <<< TLS 1.0 ChangeCipherSpec [length 0001] Mon Aug 9 16:53:46 2010 : Info: [ttls] <<< TLS 1.0 Handshake [length 0010], Finished Mon Aug 9 16:53:46 2010 : Info: [ttls] TLS_accept: SSLv3 read finished A Mon Aug 9 16:53:46 2010 : Info: [ttls] (other): SSL negotiation finished successfully Mon Aug 9 16:53:46 2010 : Debug: SSL Connection Established Mon Aug 9 16:53:46 2010 : Debug: SSL Application Data Mon Aug 9 16:53:46 2010 : Info: [ttls] eaptls_process returned 3 Mon Aug 9 16:53:46 2010 : Info: [ttls] Skipping Phase2 due to session resumption Mon Aug 9 16:53:46 2010 : Info: [ttls] WARNING: No information in cached session! Mon Aug 9 16:53:46 2010 : Info: [eap] Freeing handler Mon Aug 9 16:53:46 2010 : Info: ++[eap] returns reject Mon Aug 9 16:53:46 2010 : Info: Failed to authenticate the user. Mon Aug 9 16:53:46 2010 : Info: Using Post-Auth-Type Reject Mon Aug 9 16:53:46 2010 : Info: +- entering group REJECT {...} Mon Aug 9 16:53:46 2010 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 5e6b5185dcc44c0db5e23c6f0668c7a6 Mon Aug 9 16:53:46 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Mon Aug 9 16:53:46 2010 : Info: ++[attr_filter.access_reject] returns updated Mon Aug 9 16:53:46 2010 : Info: Delaying reject of request 109 for 1 seconds Mon Aug 9 16:53:46 2010 : Debug: Going to the next request I don't know how to set the following: # You can disallow resumption for a # particular user by adding the following # attribute to the control item list: # # Allow-Session-Resumption = No It seems this attr can't be added into the access-xxx messages. How can I do to enable session resumption in fr?

2 1

how to configure a proxy radius server but the username doesn't have any realm ?
by freddychu 09 Aug '10

09 Aug '10

Hi, I want to configure a proxy radius server and the username doesn't have any realm, just like 'tom'. So I configure realm NULL section in proxy.conf file, but it doesn't work, the error message in radiusd terminal when redius server received the accounting message: Proxying request 0 to home server 218.83.175.155 port 1813 The message can't be proxy to myProxyPool_1, I don't understand why the home server become 218.83.175.155. Can anybody help me? How to configure it ? proxy.conf file: #home server 1 home_server myProxyServer_1 { type = auth+acct ipaddr = 192.168.1.111 port = 1812 secret = testing123 require_message_authenticator = no response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 10 num_answers_to_alive = 3 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } #home server 2 home_server myProxyServer_2 { type = auth+acct virtual_server = localserver } # home server pool 1 home_server_pool myProxyPool_1{ type = fail-over home_server = myProxyServer_1 home_server = myProxyServer_2 } #realm realm chuanwei.com { auth_pool = myProxyPool_1 acct_pool = myProxyPool_1 nostrip } realm NULL { authhost = myProxyPool_1 accthost = myProxyPool_1 secret = testing123 } Freddy

2 1

FreeRadius + LDAP on WPA2
by rrperez＠apc.edu.ph 09 Aug '10

09 Aug '10

FreeRadius 2.1.7 with OpenLDAP as backend for Wireless Network I have configured the radius and ldap server on the same machine which is a virtual machine by the way. I have this problem when running the radtest on localhost and also I'm having a problem with the communication between the server and the access point because they don't respond to each other. I really need help, ASAP... Here is the debug in local radtest: rad_recv: Access-Request packet from host 127.0.0.1 port 51734, id=11, length=58 User-Name = "etaban" User-Password = "s3cur1ty" NAS-IP-Address = 127.0.0.1 NAS-Port = 2 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "etaban", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 191 ++[files] returns ok [ldap] performing user authorization for etaban [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> etaban [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=etaban) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.96.100.206:389, authentication 0 rlm_ldap: bind as / to 10.96.100.206:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=testldap1,dc=test,dc=corpoff, with filter (uid=etaban) [ldap] looking for check items in directory... rlm_ldap: userPassword -> Cleartext-Password == "s3cur1ty" rlm_ldap: userPassword -> User-Password == "s3cur1ty" [ldap] looking for reply items in directory... [ldap] user etaban authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} rlm_eap: EAP-Message not found [eap] Malformed EAP Message ++[eap] returns fail Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> etaban attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 11 to 127.0.0.1 port 51734 Waking up in 4.9 seconds. Cleaning up request 0 ID 11 with timestamp +9 Ready to process requests.

3 6

Can't connect through Access Point
by Ron Perez 08 Aug '10

08 Aug '10

Here is the debug when I try to connect to the wireless network with freeradius2. rad_recv: Access-Request packet from host 10.96.100.205 port 1095, id=0, length=127 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0201000c017272706572657a Message-Authenticator = 0x4f2ba1b95873a9bf8b13863f1ce6d52f +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry rrperez at line 93 ++[files] returns ok [ldap] performing user authorization for rrperez [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> rrperez [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=rrperez) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testldap1,dc=test,dc=corpoff, with filter (uid=rrperez) [ldap] looking for check items in directory... rlm_ldap: userpassword -> Cleartext-Password == "p@ssw0rd" rlm_ldap: userPassword -> User-Password == "p@ssw0rd" [ldap] looking for reply items in directory... [ldap] user rrperez authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1095 EAP-Message = 0x010200160410b26f8606d20313bfb074702fb88c12dc Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a339647283709d04328c11ec504b2 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1097, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a339647283709d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020200060319 Message-Authenticator = 0x2d96e463cb33f53668e660cc806f5396 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry rrperez at line 93 ++[files] returns ok [ldap] performing user authorization for rrperez [ldap] expand: %{Stripped-User-Name} -> [ldap] expand: %{User-Name} -> rrperez [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=rrperez) [ldap] expand: dc=testldap1,dc=test,dc=corpoff -> dc=testldap1,dc=test,dc=corpoff rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in dc=testldap1,dc=test,dc=corpoff, with filter (uid=rrperez) [ldap] looking for check items in directory... rlm_ldap: userpassword -> Cleartext-Password == "p@ssw0rd" rlm_ldap: userPassword -> User-Password == "p@ssw0rd" [ldap] looking for reply items in directory... [ldap] user rrperez authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1097 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a339646292a09d04328c11ec504b2 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1099, id=0, length=251 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a339646292a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0203007619800000006c16030100670100006303014c60485419960635d1ade97d45e42d310da2c1bd2228f6a268e4c8d2725deccc000018002f00350005000ac009c00ac013c0140032003800130004010000220000000c000a0000077272706572657a000a00080006001700180019000b00020100 Message-Authenticator = 0xfb781696d1e2b68de3ca4be44368e6ba +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 118 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 108 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0067], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0847], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1099 EAP-Message = 0x0104040019c000000884160301002a0200002603014c5ef69f90cc66244e85fa9ea030af56c83a42baaf970ef5afd98d6a5c23a1af00002f0016030108470b00084300084000039e3082039a30820282a003020102020101300d06092a864886f70d010104050030818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407130550617361793111300f060355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d31 EAP-Message = 0x30303830353231343433315a170d3131303830353231343433315a3079310b3009060355040613025048310f300d060355040813064d616e696c613111300f060355040a1308534d205072696d65312330210603550403131a4578616d706c65205365727665722043657274696669636174653121301f06092a864886f70d01090116127272706572657a406170632e6564752e706830820122300d06092a864886f70d01010105000382010f003082010a0282010100c6e7ab6d35efefbf0f386233076f46ad36cbbd54ddc07f0488bee8c4db14c0fe37a0ea6818d01ebbd3b409769818e4036bfc962238f8475d6583da6ac2512363845f5fb04d9d EAP-Message = 0xbd5b53e9c2ef6647a4b8dd02daceb3066d9a9ae26cd11a8300b9d53c043f09b33b53354bdbcf6ce4d0b1a8e4770eb537f583c6ebce6487ffa1dc2b1c4cc541aa04e98fae7a73336ee461bdbdc0909080852e47fc49b64b146ad18cbafaf350647f19758c5e781d6bd8882f6d8e136f87b1f3e013342b79c05deef124b9c800c2461cb265ae547aa5c299facd146c391c91abcd5e0f03aac4cba67d9b5a86ff440e52850806b7c9b7f45ba4f4bcecb86bb5bb5f9dba3453e974fb0203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104050003820101004aac0765701c5185080a5fb6e5363b88b5 EAP-Message = 0xc7390b7836e78f8547c84ee349ca8b9d6a71e78cdf38ed81af871098700b1c03aa6970cd9a14107ec7aa9f4a84409a359a2c87c5eb09cca8b35d7c55ac7f2ee3db355438c00c50a5a0c96e5b6b850db681772588de4ca7035e033fa00f2c6091b1fbbdc232bc4374b1e653d08a9bdc91f5bdedc1f21ab134093737c8972f0ddd6c53bb535ba2808f59563caddf2c14f684f1856e78a49f8e6009495f1ec9115fc41f5fe3786444758c65121b714422aef588fa496d876beade61319aa7c4812908f4aeb34a13692a725fd11a5cd9a065daca5c078bf289686c7038c6e77fb9410b320bd5a62d7e3994d4353531cf7b00049c3082049830820380a00302 EAP-Message = 0x0102020900e6d6f0b5c23c70 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396452e2a09d04328c11ec504b2 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1101, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a3396452e2a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020400061900 Message-Authenticator = 0x2e5b1abd57419deda1b17bc06072af82 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1101 EAP-Message = 0x010503fc1940a5300d06092a864886f70d010105050030818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407130550617361793111300f060355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3130303830353231343433315a170d3131303830353231343433315a30818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407130550617361793111300f06 EAP-Message = 0x0355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a0282010100c377b277cfce89da192b6975f0e2c6f2860fd64da3fd80309a1ea8bb2ef91fa0d004899dfb920f5bd5bba909cc537b86d0ac729985a36c6c7bb562a02aeb6cbbadbd25c73240631e24c7bc66d8bcc423848426c6094bebdca51e781a251f99361eb4885aaa88541eabb41ccf08250ccfa82eb3f18b3ba6025f53e1994f0e9a5f81 EAP-Message = 0x96ab436778d1b5b28ffa1d177836b9584f8228ae3f38eb1b255e5ecc9ffdb5fd5f41ed8f88d07fb1865be3b978d27fd8f5de8a5f66814c415f2f81948713e5475d61ff81076a6c12afd11a2b4efb8114e2dee083866a63775065a83aecaa60f96d32d41db2651e6523d1dda4968768503b77957ed302e70148af04bea6b33d0203010001a381f63081f3301d0603551d0e04160414eb114a719ea71a316c157f42cb959cbe3d7ad1453081c30603551d230481bb3081b88014eb114a719ea71a316c157f42cb959cbe3d7ad145a18194a4819130818e310b3009060355040613025048310f300d060355040813064d616e696c61310e300c0603550407 EAP-Message = 0x130550617361793111300f060355040a1308534d205072696d653123302106092a864886f70d0109011614706572657a2e32726f6e40676d61696c2e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479820900e6d6f0b5c23c70a5300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100560f8590dfda5419fd715a32a3c02c7dfea64b4f7ab3f1d76173a6206a9919d372f97837051eba6b10fa29e2f813863875f2f260ce5e7935ddc4267fb7b6230d9c2b4cdaaf825e25b4910d895ed0355c1860eb0cb62961ee54228efe26aa5315820139132002a30d07 EAP-Message = 0xbd4b27e772945483 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396442f2a09d04328c11ec504b2 Finished request 5. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1103, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a3396442f2a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020500061900 Message-Authenticator = 0x748755f79dc28feaac6975d483fb2606 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1103 EAP-Message = 0x0106009e19006f0fd8a5dc5276fa83706f679780f3e60b36f5b3489d5551b7dc0590f2ddf6959d4ba9550b38329c20dce0ab3182205608a19b3d2964953695b467af4cd29ade6a679b18dfa5492a4286fe5b2a13c12d8305450e32b2441a68b97f9701655d60ad7d399f3b693b9562b3353d3bd5d730cab42857c0e5edb72fde0d9b70eeb03dd0afd787e1ceede01810d2c9e83bdc16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396432c2a09d04328c11ec504b2 Finished request 6. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 10.96.100.205 port 1105, id=0, length=139 User-Name = "rrperez" NAS-IP-Address = 10.96.100.205 Called-Station-Id = "0014bf8abbc5" Calling-Station-Id = "0016e3cdc0a3" NAS-Identifier = "0014bf8abbc5" NAS-Port = 46 Framed-MTU = 1400 State = 0x472a3396432c2a09d04328c11ec504b2 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020600061900 Message-Authenticator = 0x31c7e07cdcbfbce9826ce983e511159b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "rrperez", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 0 to 10.96.100.205 port 1105 EAP-Message = 0x010700061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x472a3396422d2a09d04328c11ec504b2 Finished request 7. Going to the next request Waking up in 4.7 seconds. Cleaning up request 2 ID 0 with timestamp +50 Cleaning up request 3 ID 0 with timestamp +50 Cleaning up request 4 ID 0 with timestamp +50 Cleaning up request 5 ID 0 with timestamp +50 Cleaning up request 6 ID 0 with timestamp +50 Cleaning up request 7 ID 0 with timestamp +51 Ready to process requests. I don't know where is the error why I can't connect to the network, need help ASAP...

1 0

Different users file per virtual server
by Cory Johnson 07 Aug '10

07 Aug '10

Is there a way to have seperate "users" files per virtual server? The location of the users file appears to be specified in modules/files. I can only seem to load modules from the global radiusd.conf, so each server uses the same users file. My goal is to use a different users file based on the IP of the client. -CJ

3 4

VMPS configuration examples
by Brett A. Karns 06 Aug '10

06 Aug '10

Can someone point me in the right direction of some VMPS configuration examples please, there seems to be very limited information about this on the web. ___________________________________________ Brett

2 1

Assistance in handling ldap query failure scenario
by John Douglass 06 Aug '10

06 Aug '10

I believe this bit of magic can be done based on other configurations but I can't work out the right "foo" so hopefully someone can help me out. I have my service manager asking for some additional magic out of our freeradius servers that handle our wireless WPA enterprise authentication/authorization. Situation: LDAP connect/lookup fails (returns 'fail') and I want to continue processing as if it were "ok". Right now we want to ensure to err on the side of the customer and continue in the event there is an LDAP service outage. Setup: I have the system working correctly with LDAP utilizing Freeradius 1.1.9. However, I am not sure how to do unlang control in the event of an LDAP failure. I am handling if an LDAP lookup is not found however. Test: What I am attempting to test with is configure the ldap module with a non-existent LDAP server to fail but continue processing in the event of an LDAP failure. I have Googled, read many configuration examples, and got a decent grip of unlang so hopefully someone can point me in the right direction. I'm close, but missing a small key component I imagine. Here are (what I believe to be ) he important configuration sections and debug output. authorize { preprocess # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP authentication. eap { ok = return } # LDAP: Development where if not found, steer them to group vlan0316 # This part works as expected when LDAP answers and the user is not found gted-lawn-authz if(notfound) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 316 } notfound = return } # Look in an SQL database. The schema of the database is meant to mirror the "users" file. sqlwpa } The LDAP module configuration is as follows: ldap gted-lawn-authz { # # Note that this needs to match the name in the LDAP # server certificate, if you're using ldaps. server = "ldaps://blahserver.gatech.edu" port = 636 identity = "myBindDNDeletedForPrivacy" password = "myPasswordDeletedForPrivacy" basedn = "myBaseDNdeletedForPrivacy" filter = "myFilterThatWorksNormallyDeleted" ldap_connections_number = 10 timeout = 4 timelimit = 10 net_timeout = 1 tls { start_tls = no tls_mode = no require_cert = "never" } # Mapping of RADIUS dictionary attributes to LDAP directory attributes. dictionary_mapping = ${confdir}/ldap.attrmap edir_account_policy_check = no set_auth_type = no } I have tried to handle this in the authorize{} section but not sure how to override the "fail" returncode from the ldap module in order to continue. gted-lawn-authz # want to detect a failure of the above gted-lawn-authz module, on failure skip to the next section which is "sqlwpa" if(fail) { fail = return } if(notfound) { update reply { Tunnel-Type := "VLAN" Tunnel-Medium-Type := "IEEE-802" Tunnel-Private-Group-Id := 316 } notfound = return } # Look in an SQL database. The schema of the database is meant to mirror the "users" file. sqlwpa Running it in debug mode I see it never hits the if(fail) section. My guess (but I haven't found any concrete info on how to continue) would be to have something in the gted-lawn-authz ldap module configuration as it looks like it breaks out of the loop there. +- entering group authorize {...} ++[preprocess] returns ok [eap] EAP packet type response id 0 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [gted-lawn-authz] performing user authorization for test-account [gted-lawn-authz] expand: (filterDeleted) [gted-lawn-authz] expand: (baseDeleted) [gted-lawn-authz] ldap_get_conn: Checking Id: 0 [gted-lawn-authz] ldap_get_conn: Got Id: 0 [gted-lawn-authz] attempting LDAP reconnection [gted-lawn-authz] (re)connect to ldaps://bleh.gatech.edu, authentication 0 [gted-lawn-authz] setting TLS Require Cert to never [gted-lawn-authz] bind as uid=deletedForPrivacy [gted-lawn-authz] uid=deletedForPrivacy [gted-lawn-authz] (re)connection attempt failed [gted-lawn-authz] search failed [gted-lawn-authz] ldap_release_conn: Release Id: 0 ++[gted-lawn-authz] returns fail Invalid user: [jd187/<via Auth-Type = EAP>] (from client localhost port 0 cli 02-00-00-00-00-01) } # server wpa Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> jd187 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Thanks in advance, - John Douglass, Georgia Institute of Technology

2 1

Setting up pam_radius_auth
by Mike J 06 Aug '10

06 Aug '10

Hi, I'm trying to get the the pam radius module to work. I've built a test radius server (FreeRADIUS Version 2.1.9) and I've setup a linux box with the pam radius module (1.3.17) The server seems to be setup properly to authenticate users: # radtest testing password 127.0.0.1 0 testing123 Sending Access-Request of id 87 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=87, length=20 I have the following config on the server to correspond to my pam radius client: clients.conf: client testclient1 { ipaddr = CLIENTIP secret = testing123 require_message_authenticator = no shortname = testc1 nastype = other # localhost isn't usually a NAS... } And on the client (using pam_radius_auth) I have the following in /etc/raddb/server: # server[:port] shared_secret timeout (s) SERVERIP testing123 4 Now, when I try to authenticate my pam radius client, I get this in the client logs: Jul 22 10:22:45 (none) pamtest: pam_radius_auth: Got user name testing Jul 22 10:22:54 (none) pamtest: pam_radius_auth: Sending RADIUS request code 1 Jul 22 10:22:54 (none) pamtest: pam_radius_auth: DEBUG: getservbyname(radius, udp) returned 267885588. Jul 22 10:22:55 (none) pamtest: pam_radius_auth: packet from RADIUS server SERVERIP fails verification: The shared secret is probably incorrect. Jul 22 10:22:55 (none) pamtest: pam_radius_auth: All RADIUS servers failed to respond. Jul 22 10:22:55 (none) pamtest: pam_radius_auth: authentication failed And I get this on the radius server (running in debug mode, i.e. radiusd -X) rad_recv: Access-Request packet from host CLIENTIP port 18580, id=32, length=72 User-Name = "testing" User-Password = "\237TqI\3335Q\231\025O\020bw\021;\362" NAS-Identifier = "other" NAS-Port = 17555 NAS-Port-Type = Virtual Service-Type = Authenticate-Only +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry testing at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "?TqI�5Q??O?bw?; [pap] Using clear text password "password" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 32 to CLIENTIP port 18580 Waking up in 4.9 seconds. Cleaning up request 0 ID 32 with timestamp +24 Ready to process requests. Now obviously is says there's a problem with the secret, but I believe I've setup the secret correctly in the configs I've shown above. Does anybody have any ideas what I'm doing wrong? Thanks.

2 6