April 2011 - Freeradius-Users - lists.freeradius.org

new to radius osx client 3com switch
by jeffrey j donovan 11 Apr '11

11 Apr '11

hello I have been learning about freeradius and could use some guidance. I have a freeradius server a 3com 5500 switch and mac osx client I setup a test machine and added a client record and shared secret. Joe User is getting his credentials from ldap, and the machine he sent the request on is 10.5.1.8, freeradius running on 10.5.1.101. Now I need to configure a 3Com switch, and mac OSX client to send/accept EAP or EAPTLS. neither apple or 3com have good setup docs, so Im looking to the list , maybe someone has crossed this river before I build a new bridge ? here was my auth test from remote user; echo "User-Name = joeuser\n User-Password = hispassword" | radclient -sx 10.5.1.101 auth Secret Sending Access-Request of id 137 to 10.5.1.101 port 1812 User-Name = "joeuser" User-Password = "hispassword" rad_recv: Access-Accept packet from host 10.5.1.101:1812, id=137, length=20 Total approved auths: 1 Total denied auths: 0 Total lost auths: 0 Mon Apr 11 20:17:42 2011 : Debug: Ready to process requests. rad_recv: Access-Request packet from host 10.5.1.8 port 57337, id=254, length=51 User-Name = "joeuser" User-Password = "hispassword" Mon Apr 11 20:27:04 2011 : Info: +- entering group authorize {...} Mon Apr 11 20:27:04 2011 : Info: ++[preprocess] returns ok Mon Apr 11 20:27:04 2011 : Info: ++[chap] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[mschap] returns noop Mon Apr 11 20:27:04 2011 : Info: [suffix] No '@' in User-Name = "joeuser", looking up realm NULL Mon Apr 11 20:27:04 2011 : Info: [suffix] No such realm "NULL" Mon Apr 11 20:27:04 2011 : Info: ++[suffix] returns noop Mon Apr 11 20:27:04 2011 : Info: [eap] No EAP-Message, not doing EAP Mon Apr 11 20:27:04 2011 : Info: ++[eap] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[unix] returns updated Mon Apr 11 20:27:04 2011 : Info: ++[files] returns noop Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: The SACL group "com.apple.access_radius" does not exist on this system. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: The host 10.5.1.8 does not have an access group. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: no access control groups, all users allowed. Mon Apr 11 20:27:04 2011 : Debug: rlm_opendirectory: Setting Auth-Type = opendirectory Mon Apr 11 20:27:04 2011 : Info: ++[opendirectory] returns ok Mon Apr 11 20:27:04 2011 : Info: ++[expiration] returns noop Mon Apr 11 20:27:04 2011 : Info: ++[logintime] returns noop Mon Apr 11 20:27:04 2011 : Info: [pap] Found existing Auth-Type, not changing it. Mon Apr 11 20:27:04 2011 : Info: ++[pap] returns noop Mon Apr 11 20:27:04 2011 : Info: Found Auth-Type = opendirectory Mon Apr 11 20:27:04 2011 : Info: +- entering group opendirectory {...} Mon Apr 11 20:27:04 2011 : Info: ++[opendirectory] returns ok Mon Apr 11 20:27:04 2011 : Auth: Login OK: [joeuser/hispassword] (from client noc port 0) Mon Apr 11 20:27:04 2011 : Info: +- entering group post-auth {...} Mon Apr 11 20:27:04 2011 : Info: ++[exec] returns noop Sending Access-Accept of id 254 to 10.5.1.8 port 57337 Mon Apr 11 20:27:04 2011 : Info: Finished request 2. Mon Apr 11 20:27:04 2011 : Debug: Going to the next request Mon Apr 11 20:27:04 2011 : Debug: Waking up in 4.9 seconds. okay so thats good. now I assume that I can configure the switch , after following 3coms instructions i end up with 5500G-EI]display dot1x int g1/0/5 Equipment 802.1X protocol is enabled CHAP authentication is enabled DHCP-launch is disabled Proxy trap checker is disabled Proxy logoff checker is disabled Configuration: Transmit Period 30 s, Handshake Period 15 s Quiet Period 60 s, Quiet Period Timer is disabled Supp Timeout 30 s, Server Timeout 100 s The maximal retransmitting times 2 Total maximum 802.1x user resource number is 1024 Total current used 802.1x resource number is 1 GigabitEthernet1/0/5 is link-up 802.1X protocol is enabled Proxy trap checker is disabled Proxy logoff checker is disabled The port is a(n) an authenticator Authenticate Mode is Auto Port Control Type is Mac-based Max on-line user number is 256 Authentication Success: 0, Failed: 2 EAPOL Packets: Tx 13, Rx 12 Sent EAP Request/Identity Packet : 5 EAP Request/Challenge Packets: 5 Received EAPOL Start Packets : 3 EAPOL LogOff Packets: 0 EAP Response/Identity Packets : 5 EAP Response/Challenge Packets: 0 Error Packets: 0 1. Unauthenticated user : MAC address: 0025-xxxx-xxxx Controlled User(s) amount to 1 [5500G-EI] disp domain 0 Domain = nocdomain State = Active RADIUS Scheme = nocsys Access-limit = Disable Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable 1 Domain = system State = Active Scheme = LOCAL Access-limit = Disable Domain User Template: Idle-cut = Disable Self-service = Disable Messenger Time = Disable at this point I thought I had it, but the OSX client just fails and it's like the eap never leaves the 3com switch nothing hits the logs, it's quiet. so, I need to know what each side is looking for. can someone smack me around a bit thanks for any insight -j

1 0

MLPPP Acct-Session-Id
by Jay Kuhne (jkuhne) 11 Apr '11

11 Apr '11

Hi, Is there another attribute syntax on radclient that could be used aside from Acct-Session-Id to perform COA to a session We are using MultilinkPPP (single session per bundle still) and it is not working as it normally would with PPP. Thanks, Jay RADIUS: COA received from id 48 x.x.x.99:1052, CoA Request, len 149 COA: x.x.x.20 request queued RADIUS: authenticator 70 8D C4 4D 97 82 50 02 - 73 6B 53 27 81 52 29 BD RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Acct-Session-Id [44] 10 "000110A4" RADIUS: Vendor, Cisco [26] 46 RADIUS: Cisco AVpair [1] 40 "ip:sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 48 RADIUS: Cisco AVpair [1] 42 "ip:sub-qos-policy-out=policy_session_out_coa" COA: Message Authenticator missing or failed decode ++++++ CoA Attribute List ++++++ 7FD2EA5DA700 0 00000009 username(447) 23 user1(a)asr_5_6_mlp.com1 7FD2EA5DB090 0 00000001 session-id(409) 4 69796(110A4) 7FD2EA5DB0A8 0 00000009 sub-qos-policy-in(421) 17 policy_session_in_coa 7FD2EA5DB0C0 0 00000009 sub-qos-policy-out(423) 18 policy_session_out_coa RADIUS/ENCODE(00000000):Orig. component type = Invalid RADIUS(00000000): sending RADIUS(00000000): Send CoA Nack Response to x.x.x.99:1052 id 48, len 157 RADIUS: authenticator 76 2F 9A 52 29 2C 26 57 - 27 F6 E0 CC A6 E6 F1 13 RADIUS: User-Name [1] 25 "user1(a)5_6_mlp.com1" RADIUS: Vendor, Cisco [26] 43 RADIUS: Cisco AVpair [1] 37 "sub-qos-policy-in=policy_session_in_coa" RADIUS: Vendor, Cisco [26] 45 RADIUS: Cisco AVpair [1] 39 "sub-qos-policy-out=policy_session_out_coa" RADIUS: Reply-Message [18] 18 RADIUS: 4E 6F 20 76 61 6C 69 64 20 53 65 73 73 69 6F 6E [ No valid Session] RADIUS: Dynamic-Author-Error[101] 6 Unsupported Service [405]

3 11

LDAP-group filter search is failing
by joezamosc 11 Apr '11

11 Apr '11

2.1.10 Here's a snippet of freeradius -X... +- entering group post-auth {...} [ldap] Entering ldap_groupcmp() [files] expand: ou=Departments,dc=corp,dc=development,dc=com -> ou=Departments,dc=corp,dc=development,dc=com [files] expand: (&(sAMAccountName=%{mschap:User-Name})) -> (&(sAMAccountName=RobertTest1)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(sAMAccountName=RobertTest1)) [ldap] ldap_release_conn: Release Id: 0 [files] expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames)(uniquemember=%{control:Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=Departments,dc=corp,dc=development,dc=com, with filter (&(cn=WANN)(|(&(objectClass=GroupOfNames)(member=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom))(&(objectClass=GroupOfUniqueNames)(uniquemember=CN\3dRobertTest1\2cOU\3dWANN\2cOU\3dDepartments\2cDC\3dcorp\2cDC\3ddevelopment\2cDC\3dcom)))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in CN=RobertTest1,OU=WANN,OU=Departments,DC=corp,DC=development,DC=com, with filter (objectclass=*) rlm_ldap::ldap_groupcmp: ldap_get_values() failed [ldap] ldap_release_conn: Release Id: 0 ++[files] returns noop Sending Access-Accept of id 100 to 192.168.100.2 port 1645 User-Name = "DEVELOPMENT\\RobertTest1" MS-MPPE-Recv-Key = 0xa873077b6643bb983d8dbf04da66667699d7832fe38f78c5458b0318eaa27db6 MS-MPPE-Send-Key = 0x866779d60ae2e9da0a928ebfb1f20e2f5e26dc05d050075dc8e65210e2946936 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 8. This is in my postauth_users file... DEFAULT Huntgroup-Name == Switches, Ldap-Group == "WANN" Service-Type = "Framed-User", Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Tunnel-Private-Group-Id = "dragons_cave" The 10th line from the bottom of the snippet returns with the following... rlm_ldap::ldap_groupcmp: ldap_get_values() failed I'm waiting for a subsequent "[ldap] performing search in" my DN and to match with filter (cn=WANN) But it's not happening. Any insight? Thx. Joe -- View this message in context: http://freeradius.1045715.n5.nabble.com/LDAP-group-filter-search-is-failing… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

UTF-8 UaseName permit?
by ziyen 11 Apr '11

11 Apr '11

Hi I want to use UserName as chinese UTF-8 characters type. is't special config? olso it permit? Thanks

2 1

Duplicate Accounting maybe once, twice a day
by Marius Pesé 11 Apr '11

11 Apr '11

Hi everyone, we are having an issue on our FreeRadius setup where our redundant servers will maybe once, twice a day create duplicate accounting entries. I have switched the servers to debug for a full day and caught one of these incidents in the log file, see attached. The strange thing is it only happens maybe once a day, regardless of realm or user, and the other couple of hundred accounting requests are fine. Can anyone see why this particular one would bounce back and forth? Our setup consists of two virtually identical FreeRadius2 servers, each with their own mySQL database, so each of them is capable of doing Auth and Acct, and proxies Acct to the other one. Also I changed the acct_update_alt query to write to a failover table since I thought this was the alt query being triggered, but this does not make a difference. Still duplicates in radacct table. Thanks! Marius __________________________________________ Marius Pesé Senior Software Developer B.Sc. Computer Science [cid:image003.jpg@01CBF85B.77F8AF50]<http://www.mindspring.co.za/> Unit 5, Doncaster Office Park Mindspring Computing Punters Way, Kenilworth P O Box 46926 Cape Town, South Africa Glosderry 7702 Phone: +27 21 657 1780 Fax : +27 21 671 7599 Cell : 072 100 70 73 E-mail: marius(a)mindspring.co.za<mailto:marius@mindspring.co.za>

1 0

Freeradius proxy caching users
by Ivan Luska 11 Apr '11

11 Apr '11

Hello, I use Freeradius as proxy server. Is it possible to cache authenticated users on the proxy and resend access-accept to these users, if home server fails? Ivan Luska

3 2

FR and AD with ntlm and Users group
by Raheel Itrat 11 Apr '11

11 Apr '11

Hi, I am authenticating my Cisco devices by integrating FreeRadius with Active Directory. Not using LDAP but ntlm_auth. Now If I make a group on my AD server for example Router Admins and put some users in it. Now, where would I define in the FreeRadius that only users from Router Admin group are permitted. Do I need to define it in the smb.conf? BR, Raheel

1 0

problem in assigning Tunnel-Private-Group-ID
by syharash 11 Apr '11

11 Apr '11

Hi, My freeradius is set and working fine, the authentication is successful on a windows XP machine on the wireless network. I am using Cisco Switches and Ruckus Zone Director 1000 with Ruckus AP's. They are connected to the switches on the trunk ports with all vlans allowed. I get the following PEAP output; [peap] Got tunneled reply code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "18" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x4f6c9d87690bee0a58553bc0511d5d8b MS-MPPE-Recv-Key = 0x3a8d8e6495f46657b8eb7fd7de5414ca EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" [peap] Got tunneled reply RADIUS code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "18" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x4f6c9d87690bee0a58553bc0511d5d8b MS-MPPE-Recv-Key = 0x3a8d8e6495f46657b8eb7fd7de5414ca EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" [peap] Tunneled authentication was successful. but the machine does not get the IP address from the vlan id assigned to it, i get this output; [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 182 to 10.73.93.151 port 1036 EAP-Message = 0x010b00261900170301001b02e15cc2abe26c501fdcd17fcd4f071c3f8a537b5dd5b0ebb210e9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b2c3d415227240db5e9ddff32a6a83d Finished request 9. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 10.73.93.151 port 1036, id=183, length=231 User-Name = "abdul" Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-CB-0D" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-CB-0D" Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020b00261900170301001bbb6ec9c29da3419792e34574056635e11eee7834778d5fad460595 State = 0x5b2c3d415227240db5e9ddff32a6a83d Vendor-25053-Attr-3 = 0x55464f4d6f7669657a Message-Authenticator = 0x4263907cbffb8eec9f8b93a9138037dd # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "abdul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [abdul] (from client UFO-Network port 1 cli 00-1F-3C-E1-17-A9) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 183 to 10.73.93.151 port 1036 MS-MPPE-Recv-Key = 0x2427d16802fc1cc49ddea287efb9c9d5ba0f8698cc2a9ea300c43d46d720a4d5 MS-MPPE-Send-Key = 0xc3d215b48856c14b29eb75f29b0fbeb6c3a3c83ed5d657259df03cb3759c4d9f EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" Finished request 10. Going to the next request Waking up in 4.5 seconds. Cleaning up request 0 ID 173 with timestamp +8 Waking up in 0.3 seconds. Cleaning up request 1 ID 174 with timestamp +9 Cleaning up request 2 ID 175 with timestamp +9 Cleaning up request 3 ID 176 with timestamp +9 Cleaning up request 4 ID 177 with timestamp +9 Cleaning up request 5 ID 178 with timestamp +9 Cleaning up request 6 ID 179 with timestamp +9 Cleaning up request 7 ID 180 with timestamp +9 Cleaning up request 8 ID 181 with timestamp +9 Cleaning up request 9 ID 182 with timestamp +9 Cleaning up request 10 ID 183 with timestamp +9 Ready to process requests. rad_recv: Accounting-Request packet from host 10.73.93.151 port 1044, id=184, length=213 User-Name = "abdul" Acct-Status-Type = Start Acct-Authentic = RADIUS Framed-IP-Address = 169.254.67.194 Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-CB-0D" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-CB-0D" Connect-Info = "AC-67-06-39-CB-0D" Acct-Session-Id = "4D9EBE6D-00000037" Acct-Multi-Session-Id = "ac670639cb0d001f3ce117a94d9f077c00d2" Vendor-25053-Attr-3 = 0x55464f4d6f7669657a # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 10.73.93.151,NAS-IP-Address = 10.73.93.151,Acct-Session-Id = "4D9EBE6D-00000037",User-Name = "abdul"' [acct_unique] Acct-Unique-Session-ID = "c55f8220b641e9bd". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "abdul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.73.93.151/detail-20110408 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.73.93.151/detail-20110408 [detail] expand: %t -> Fri Apr 8 18:38:10 2011 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> abdul ++[radutmp] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> abdul attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 184 to 10.73.93.151 port 1044 Finished request 11. Cleaning up request 11 ID 184 with timestamp +68 Going to the next request Ready to process requests. I have checked the /etc/raddb/users, which looks like this; DEFAULT Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Service-Type = Framed-User, Fall-Through = Yes abdul Cleartext-Password := "test123" Tunnel-Private-Group-ID = 18 Is there anything that I need to do on the FreeRadius or is it my switches or the Zone Director which is the culprit. Please help. Syed -- View this message in context: http://freeradius.1045715.n5.nabble.com/problem-in-assigning-Tunnel-Private… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Simple "Guest user" web front end for FreeRADIUS
by up＠3.am 10 Apr '11

10 Apr '11

On my client's wifi network, we are authenticating staff users via FreeRADIUS against the corporate LDAP database. I've created a new SSID/WLAN with an IP pool that I've restricted through router ACLs that we want to deploy for temporary "guest" users. I can set up a new FreeRADIUS server (I've done many of those) backend for this, but am unfamiliar with 2 things that will be different here, which are: 1) A Web front end for a clerical type to enter in temporary accounts to FreeRADIUS. I imagine there must be a simple php interface for some sort of "Internet cafe" type of use. I'd prefer as simple as possible (ie, flat file), but would be fine if MySQL is the way to go for account info storage. I know I COULD put together a FreeRADIUS and OpenLDAP server with something like a webmin front end, but that seems overkill to me. 2) Some sort of automatic password generator for above...not absolutely necessary, but would be nice. I would imagine this wheel has already been invented, so if anybody could point me in the right direction, it would be appreciated. Thanks!

4 4

Something about the commonName of client certificate
by xuyu 10 Apr '11

10 Apr '11

Hi! I want to build eap/tls so i need to produce a client certificate. in the certs catalog there are ca.pem and server.pem,but not client.pem.so I should use command "make client.pem". in the README file there are some words:"Be sure that the commonName field here is the User-Name that will be used for logins!" Does it mean ommonName must the same with the login name in the eapol_test ? thank you for your help ,best regards.

1 0