March 2011 - Freeradius-Users - lists.freeradius.org

peap termination issue when using fault tolerance
by Gil Mazor 27 Mar '11

27 Mar '11

I setup FreeRadius as proxy as I want to extract MSCHAPv2 auth from EAP-PEAP/MSCHAPv2 ,and proxy only MSCHAPv2 request to another two radius servers for fault tolerance. I can successfully do it with each one of the IAS servers below individually, however if one of the serves goes down and request is forward to the second servers on the list I get an error : Error receiving packet: Connection reset by peer Any suggestions how to enable Fault tolerance when using two realms ?? clients.conf client 172.100.100.24/30 { secret = secretpass shortname = NETMOTION } proxy.conf realm mydomain.com { authhost = 192.168.1.10:1812 accthost = 192.168.1.10:1813 secret = 1111 nostrip } realm mydomain.com { authhost = 192.168.1.117:1812 accthost = 192.168.1.117:1813 secret = 1111 nostrip users.conf DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := mydomain.com Eap.conf default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no use_tunneled_reply = no copy_request_to_tunnel = yes -- View this message in context: http://freeradius.1045715.n5.nabble.com/peap-termination-issue-when-using-f… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

peap termination issue when using fault tolerance
by Mazor, Gil 27 Mar '11

27 Mar '11

I setup FreeRadius as proxy as I want to extract MSCHAPv2 auth from EAP-PEAP/MSCHAPv2 ,and proxy only MSCHAPv2 request to another two radius servers for fault tolerance. I can successfully do it with each one of the IAS servers below individually, however if one of the serves goes down and request is forward to the second servers on the list I get an error : Error receiving packet: Connection reset by peer Any suggestions how to enable Fault tolerance when using two realms ?? clients.conf client 172.100.100.24/30 { secret = secretpass shortname = NETMOTION } proxy.conf realm mydomain.com { authhost = 192.168.1.10:1812 accthost = 192.168.1.10:1813 secret = 1111 nostrip } realm mydomain.com { authhost = 192.168.1.117:1812 accthost = 192.168.1.117:1813 secret = 1111 nostrip users.conf DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := mydomain.com Eap.conf default_eap_type = mschapv2 proxy_tunneled_request_as_eap = no use_tunneled_reply = no copy_request_to_tunnel = yes The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

1 0

Post Logout/Session timeout SQL
by Marc Phillips 26 Mar '11

26 Mar '11

I'm using freeradius with coova-chilli. Works fine and dandy, but I'm trying to enforce some policy which I can do with some scripts, but it would be much cleaner to do with radius (IMHO). What I want to happen is when user session timeout or bandwidth restriction has been hit, update a database field. right now on session timeout accounting_update_query appears to be run. I would like to run an additional query as well, to disable the account (I've added a "disabled" field to the radcheck and updated my auth query to check that). Is this something that can be configured, or is there some better way to accomplish what I'm trying to do? R. Marc

2 2

Strip off the domain part from the User-Name
by Thomas Wunder 26 Mar '11

26 Mar '11

Hi, I'm currently trying to configure my Win7 clients to do wired 802.1X authentication using the credentials a user provides at the login screen. Wired 802.1X auth itself works fine but as soon as I have it use the logon credentials (using the "Automatically use my Windows logon name and password (and domain if any).") Windows sends User-Names like 'computername\\username'. That's normal so far I think. To get the rlm_ldap related stuff working I simply changed my filter and groupmembership_filter settings in modules/ldap to be "[...]uid=%{mschap:User-Name:-%{User-Name}}[...]" instead of "[...]uid=%{%{Stripped-User-Name}:-%{User-Name}}[...]" and that works well. But when it comes to MSCHAP authentication I've got a problem: I get errors like "[mschap] ERROR: User-Name (testpc\tom1) is not the same as MS-CHAP Name (tom1) from EAP-MSCHAPv2" (...which sounds consequent) I've tried solve that problem by changing "with_ntdomain_hack = yes" (I know you recommend against that) without any luck: +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [tom1] (from client swtswitch01 port 0 via TLS tunnel) Somewhere I've read that in such a case one should use the realms concept but I can't seem to get it working. There's an entry like realm ntdomain { format = prefix delimiter = "\\" } in the modules/realm but what else do I need? Thanks!fr Best regards Tom

7 16

rlm_linelog and syslog over UDP
by Stefan Winter 26 Mar '11

26 Mar '11

Hi, are there any plans to add logging to *remote* syslog servers to the rlm_linelog module? Would be kinda cute; we want to log authentication results to a central statistics collection host - and going through re-send on the local syslog instance is a superfluous extra step. Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

3 2

Change session on the fly
by Euler Thomas Garcia 25 Mar '11

25 Mar '11

Hi sorry, I do not know if this issue was discussed earlier. Wonder if it is possible to change parameters of the session on the fly eg Rate-Limit. Thank you for your attention Euler Thomas Garcia email / msn: euler.garcia(a)pocos-net.com.br

3 2

Wrong packing of attributes?
by Kristoffer Milligan 25 Mar '11

25 Mar '11

radiusd: FreeRADIUS Version 3.0.0, for host i686-pc-linux-gnu, built on Mar 24 2011 at 15:45:30 I'm on a bit of a limb here, but I think I might have found a bug. Far from sure though, so please don't kill me if I'm wrong. Example of authentication reply: Sending Access-Accept of id 162 to 192.168.106.240 port 1812 WiMAX-R3-IF-Name = "KRIS" 01 06 4b 52 49 53 WiMAX-PDFID = 1 02 04 00 01 *WiMAX-R3-IF-Descriptor = ...*<- *Perfect* 1a 13 000060b5 (24757) 8b 0d 00 01 06 4b 52 49 53 02 04 00 01 WiMAX-Packet-Data-Flow-Id = 1 01 04 00 01 WiMAX-Direction = Bi-Directional 04 03 03 WiMAX-Transport-Type = Ethernet 06 03 03 WiMAX-Uplink-QOS-Id = 1 07 03 01 WiMAX-Downlink-QOS-Id = 1 08 03 01 WiMAX-ClassifierID = 1 01 03 01 WiMAX-Classifier-Priority = 1 02 03 01 WiMAX-Classifier-Direction = Bi-Directional 04 03 03 WiMAX-VLAN-ID = 50 09 04 00 32 *WiMAX-Classifier = ...* <- *Perfect* 0b 0f 01 03 01 02 03 01 04 03 03 09 04 00 32 WiMAX-QoS-Id = 1 01 03 01 WiMAX-Schedule-Type = Best-Effort 04 03 02 WiMAX-Traffic-Priority = 1 05 03 01 WiMAX-Maximum-Sustained-Traffic-Rate = 2000000 06 06 00 1e 84 80 WiMAX-Packet-Flow-Descriptor = ... 1a 37 000060b5 (24757) 1c 31 00 01 04 00 01 04 03 03 06 03 03 07 03 01 08 03 01 *0b 0f 01 03 01 02 03 01 04 03 03 09 04 00 32 01 *<-Our classifier has been packed in the flow descriptor 03 01 04 03 02 05 03 01 06 06 00 1e 84 80 Calling-Station-Id = "00-10-E7-AA-40-C4" 1f 13 30 30 2d 31 30 2d 45 37 2d 41 41 2d 34 30 2d 43 34 EAP-Message = 0x03070004 4f 06 03 07 00 04 Message-Authenticator = 0x00000000000000000000000000000000 50 12 ... User-Name = "{am=1}34f1c6d378383b0a78a50d1d61c14976" 01 28 7b 61 6d 3d 31 7d 33 34 66 31 63 36 64 33 37 38 33 38 33 62 30 61 37 38 61 35 30 64 31 64 36 31 63 31 34 39 37 36 WiMAX-AAA-Session-Id = 0x3635613865393037626230306231653539633164643033626162353832353630 1a 29 000060b5 (24757) 04 23 00 36 35 61 38 65 39 30 37 62 62 30 30 62 31 65 35 39 63 31 64 64 30 33 62 61 62 35 38 32 35 36 30 WiMAX-MSK = 0xbb7ceda36bf48308924b3c134c73a576e4f0a290ee7e099070d0b6efe09a98032a0a4f93e626a3a1c803ca964d0288da345587f2c8b64d76c39957e482662b4a 1a 5b 000060b5 (24757) 05 55 00 87 2b dc 67 b2 50 8a 3f 02 95 25 c3 d2 c2 52 d2 07 50 3b a1 a9 e0 53 48 3a a2 74 3f 86 5c 22 17 a2 a6 72 64 c9 0e de 93 53 a7 18 a4 92 40 79 6e 54 d3 81 c5 9e c7 3c ac 2c 53 12 c8 b0 63 81 a5 8e ca ed c4 f8 ed 05 29 42 4a 40 98 56 8b 34 8b b5 2f Code: 2 Id: 162 Length: 309 Vector: 8b8551e57f89b4247daf7b2f0d312efa Data: 1a 13 000060b5 (24757) 8b 0d 00 01 06 4b 52 49 53 02 04 00 01 1a 37 000060b5 (24757) 1c 31 00 01 04 00 01 04 03 03 06 03 03 07 03 01 08 03 01 0b 0f 01 03 01 02 03 01 04 03 03 09 04 00 32 01 03 01 04 03 02 05 03 01 06 06 00 1e 84 80 1f 13 30 30 2d 31 30 2d 45 37 2d 41 41 2d 34 30 2d 43 34 4f 06 03 07 00 04 50 12 b5 7e 69 23 2f d4 52 d0 5b 8d de e2 83 41 c3 22 01 28 7b 61 6d 3d 31 7d 33 34 66 31 63 36 64 33 37 38 33 38 33 62 30 61 37 38 61 35 30 64 31 64 36 31 63 31 34 39 37 36 1a 29 000060b5 (24757) 04 23 00 36 35 61 38 65 39 30 37 62 62 30 30 62 31 65 35 39 63 31 64 64 30 33 62 61 62 35 38 32 35 36 30 1a 5b 000060b5 (24757) 05 55 00 87 2b dc 67 b2 50 8a 3f 02 95 25 c3 d2 c2 52 d2 07 50 3b a1 a9 e0 53 48 3a a2 74 3f 86 5c 22 17 a2 a6 72 64 c9 0e de 93 53 a7 18 a4 92 40 79 6e 54 d3 81 c5 9e c7 3c ac 2c 53 12 c8 b0 63 81 a5 8e ca ed c4 f8 ed 05 29 42 4a 40 98 56 8b 34 8b b5 2f Fri Mar 25 09:15:51 2011 : Info: (6) Finished request. The problem here though, is that the following attributes: *WiMAX-QoS-Id* = 1 01 03 01 *WiMAX-Schedule-Type* = Best-Effort 04 03 02 *WiMAX-Traffic-Priority* = 1 05 03 01 *WiMAX-Maximum-Sustained-Traffic-Rate* = 2000000 Should really be packed into a WiMAX-QoS-Descriptor,as far as I can see? Cut'n'paste from Dictionary: ATTRIBUTE WiMAX-QoS-Descriptor 29 tlv ATTRIBUTE WiMAX-QoS-Id 29.1 byte ATTRIBUTE WiMAX-Global-Service-Class-Name 29.2 string # 6 octets ATTRIBUTE WiMAX-Service-Class-Name 29.3 string ATTRIBUTE WiMAX-Schedule-Type 29.4 byte ATTRIBUTE WiMAX-Traffic-Priority 29.5 byte ATTRIBUTE WiMAX-Maximum-Sustained-Traffic-Rate 29.6 integer ATTRIBUTE WiMAX-Minimum-Reserved-Traffic-Rate 29.7 integer ATTRIBUTE WiMAX-Maximum-Traffic-Burst 29.8 integer ATTRIBUTE WiMAX-Tolerated-Jitter 29.9 integer ATTRIBUTE WiMAX-Maximum-Latency 29.10 integer ATTRIBUTE WiMAX-Reduced-Resources-Code 29.11 byte ATTRIBUTE WiMAX-Media-Flow-Type 29.12 byte ATTRIBUTE WiMAX-Unsolicited-Grant-Interval 29.13 short ATTRIBUTE WiMAX-SDU-Size 29.14 short ATTRIBUTE WiMAX-Unsolicited-Polling-Interval 29.15 short ATTRIBUTE WiMAX-Media-Flow-Description-SDP 29.16 string And should most definately *not* be included in the WiMAX-Packet-Flow-Descriptor. Am I messing up something here, or could there be a bug in the encoder? - Kristoffer Milligan

3 11

Radutmp help
by Waqas Toor 25 Mar '11

25 Mar '11

Hello Community, I am unable to understand why my radutmp file is not being created. Can some body point me where I can be wrong. FreeRadius version 2.1.10 below is a snippet from log. [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp Fri Mar 25 15:41:53 2011 : Debug: [radutmp] expand: %{User-Name} -> 002682A4E826(a)test_cpe.com Fri Mar 25 15:41:53 2011 : Debug: ++[radutmp] returns noop and in configuration session { radutmp # # See "Simultaneous Use Checking Queries" in sql.conf # sql } Thank you. Waqas Toor

2 4

Duplicate "Auth: Login OK:"
by John.Hayward＠wheaton.edu 25 Mar '11

25 Mar '11

Free Radius Fans, First - thanks to the people who contribute to this product! Our environment - Wireless 802.1x, Novell NDSLdap to lookup passwords or mysql, Peap with mschapv2. I observe when a client successfully authenticates to the radius server there are two "Auth: Login OK:" messages - one with a via TLS tunnel and one without. In looking at the eap messages (ID 9 or 10) it appears that the inner tunnel return a success but the outer sends another request. I wonder if this is what is expected, or if I have a configuration issue, or if there is a bug in the free radius code. In looking at the RFCs for eap a success packet is to have no data. It appears that mschap-v2 passes back a success packet with an authenticator response string (S=...). I am not sure what the exact sequence of packets should be at the end of a successful authentication. The log file running radius -x -x -X are at: http://cs.wheaton.edu/~johnh/FreeRadius if people want to see. TIA for help you can provide. johnh...

6 12

freeradius
by Rtz Poknat 25 Mar '11

25 Mar '11

i have a freeradius server with 25 vpn servers. i enabled simultaneous-use = 1, menaing only 1 user can login at a time the problem is, some vpn reboots suddently, so they didnt sent STOP packets to the radius server to close user connections. so when a vps suddenly reboots, there are still user sessions there but infact, they are not coz the vpn server shutdown suddently. so when these users tried to login, they cant coz there is still a ghost session. are there any means to solve this problem? pls help

2 5