April 2011 - Freeradius-Users - lists.freeradius.org

New to RASIUS
by Jahm 23 Apr '11

23 Apr '11

Hi, good day! I have 25% knowledge about servers (Win2k3 and Mac) and completely noob when it comes to RADIUS. I'll just ask a few things for me to get started. What are the things needed for me to set-up a RADIUS server? Is FreeRADIUS is somehow the same as the RADIUS server offered in Snow Leopard Server? Sent from my iPhone

2 1

Example of how to use caching (Cached-Session-Policy)?
by John Douglass 23 Apr '11

23 Apr '11

I am apparently using the Caching improperly in regards to configuration in eap.conf. The first authentication works great (EAP-PEAP-MSChapv2) and DB lookups. The second time (with caching enabled) it appears to only be adding the User-Name attribute to the reply. I see the comments in the file "eap.conf" but they don't go very far into explaining how to get certain attributes saved INTO the cache or pulled out of it. Does anyone have an example of how to use this "Cached-Session-Policy" which is applied to the cached session? eap.conf cache section reads: The "Cached-Session-Policy" is the name of a policy which should be applied to the cached session. This policy can be used to assign VLANs, IP addresses, etc. It serves as a useful way to re-apply the policy from the original Access-Accept to the subsequent Access-Accept for the cached session. What exactly am I supposed to store into the attribute "Cached-Session-Policy"? Is this referring to a policy within the file "policy.conf" that will run and extract attributes according to the function there or is it something else? The notes also say: # You probably also want "use_tunneled_reply = yes" when using fast session resumption. And I have turned that on everywhere I could find, but it doesn't appear to be even saving the 1st values of Tunnel-Private-Group-Id. Debug output: First time that responds correctly given a VLAN. [snipped] [peap] Using saved attributes from the original Access-Accept Tunnel-Private-Group-Id:0 = "316" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 User-Name = "jd187" [peap] Saving response in the cache [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /services/freeradius/etc/raddb//sites-enabled/dvlan-1x-working } # server dvlan-1x-test1 Sending Access-Accept of id 157 to 128.61.2.253 port 1645 Tunnel-Private-Group-Id:0 = "316" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 User-Name = "jd187" MS-MPPE-Recv-Key = 0xbdc694a560b3fc4e37385fe08bb9876e11d215add69317c704fa374f462bcb0a MS-MPPE-Send-Key = 0xa039b0c10a7ef3511a68cdd837f13747c7a4adcb86dc5d73a8506f0105a9ced4 EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 7. Going to the next request After attempting a second auth which appears to bypass the logic to assign a VLAN but doesn't appear to be adding it to the response from the cache at all. [snipped] [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [peap] Adding cached attributes to the reply: User-Name = "jd187" [eap] Freeing handler ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. # Executing section post-auth from file /services/freeradius/etc/raddb//sites-enabled/dvlan-1x-working } # server dvlan-1x-test1 Sending Access-Accept of id 161 to 128.61.2.253 port 1645 User-Name = "jd187" MS-MPPE-Recv-Key = 0x0d398b0ed22899753eac37c8b308afb8a600a4be2b35d4260470148c6f4774cc MS-MPPE-Send-Key = 0x570045c77b56ef4d327189610f20f358038cea5bda215ded4ca32eefd2a72cf2 EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 11.

3 4

Limit Period time
by googerdi 22 Apr '11

22 Apr '11

Hi How can i limit a group or user to be logined in a specific time. for example i have night group that i want to be logined from 1 am to 7 am. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Limit-Period-time-tp4333210p4333210… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 2

Radius bug?
by duhvir＠ilimtimber.com 22 Apr '11

22 Apr '11

Hello. I use last git freeradius version. radiusd -v (3.0.0) All config in default state, except: proxy.conf --------------- realm xxx { authhost=192.168.1.1:18121 secret=test } modules/eap.conf ----------------------- default_eap_type = peap #Certificate definitions peap { default_eap_type = mschapv2 copy_request_to_tunnel = yes use_tunneled_reply = yes proxy_tunneled_request_as_eap = no virtual_server = "proxy-inner-tunnel" } sites-enabled/proxy-inner-tunnel ------------------------------------------- authorize { update control { Proxy-To-Realm := "xxx" } sites-enabled/sql-auth ---------------------------------- server sql-auth { listen { type = auth ipaddr=192.168.1.1 port=18121 } client 192.168.1.1/32 { secret = test } authorize { Perl } authenticate { Perl } } modules/perl Realy don't matter, freeradius don't go here ( That's all i thing. radius -X All seems ok. If you need I'll post it. When I send request from WiFi client. I see: .... no matter what, I didn't see nothing what can help handle with problem. .... (17) # Executing group from file /usr/local/etc/raddb/sites-enabled/proxy-inner-tunnel (17) +- entering group authenticate {...} (17) [eap] Request found, released from the list (17) [eap] EAP/mschapv2 (17) [eap] processing type mschapv2 (17) [eap] Not-EAP proxy set. Not composing EAP (17) ++[eap] returns handled PEAP: Tunneled authentication will be proxied to ITI PEAP: Remembering to do EAP-MS-CHAP-V2 post-proxy. (17) [eap] Tunneled session will be proxied. Not doing EAP. (17) ++[eap] returns handled (17) There was no response configured: rejecting request (17) Using Post-Auth-Type Reject ... reject and it's all over ... Main error is: There was no response configured: rejecting request. With that config on 2.1.10 in FreeBSD reps no such error, but there is 118 bug with eap proxification. What I do wrong? Do I need something add to config? Best regards, Andrey.

1 0

Documentation for Setting up Freeradius with MYSQL
by Jaikanth Krishnaswamy 21 Apr '11

21 Apr '11

Hi All, I have a requirement to set up freeradius with MySQL in my environment. I was able to find the DDL Script required for MYSQL Database to be built. Is there a complete How-to from Scratch for compiling free radius to work with MySQL on Ubuntu. Please advice. Thanks JK

1 0

ASCII NUL in NAS-Filter-Rule
by Ruslan Pustovoytov 21 Apr '11

21 Apr '11

Hi All My nas box can use attribute NAS-Filter-Rule from radius server to construct filter rules per subscriber "on the fly". Accodingly to rfc 4849 this attribute should contain ascii NUL (0x00) as a delimiter between individual filter rules and at the end of rules. Freeradius define this attribute as a string and I do not know how to create valid string with nul character. I changed attribute type to octets and successfully add null character but a whole string converted to hex also and attribute was not readable. How to send nul character without changing attribute type ?

4 5

MySQL support in freeradius 3.0.0
by akinpelu emmanuel 21 Apr '11

21 Apr '11

Hi All, I am installing Free Radius 3.0.0 I am having problem compiling mysql support even when I used the required options. Please below the output from ./configure [root@AbujaBAX1 frad]# ./configure --with-mysql-lib-dir=/home/oracle/mysql/mysql-5.1.31-linux-i686-glibc23/lib/ --with-mysql-include-dir=/home/oracle/mysql/mysql-5.1.31-linux-i686-glibc23/include/ |grep warn configure: WARNING: snmpget not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: silently not building rlm_eap_ikev2. configure: WARNING: FAILURE: rlm_eap_ikev2 requires: libeap-ikev2 EAPIKEv2/connector.h. configure: WARNING: the TNCS library isn't found! configure: WARNING: silently not building rlm_eap_tnc. configure: WARNING: FAILURE: rlm_eap_tnc requires: -lTNCS. configure: WARNING: EVP_sha256 not found, may have issues wirh WiMAX certificates configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: MySQL headers not found. Use --with-mysql-include-dir=<path>. configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r mysql.h. configure: WARNING: silently not building rlm_sql_postgresql. configure: WARNING: FAILURE: rlm_sql_postgresql requires: libpq-fe.h libpq. configure: WARNING: oracle headers not found. Use --with-oracle-include-dir=<path>. configure: WARNING: silently not building rlm_sql_oracle. configure: WARNING: FAILURE: rlm_sql_oracle requires: oci.h. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. Any help would be appreciated. Emmanuel

2 1

verisign CA HOWTO?
by ziyen 21 Apr '11

21 Apr '11

Hi is't a verisign CA HOWTO? Thanks.

1 0

EAP-TTLS & Kerberos
by Thorsten Fischer 20 Apr '11

20 Apr '11

All, I have a number of NASs - wireless APs running hostapd. I am setting up a freeradius 2.1.10 server to control the authentication of username(a)net.example.com to the wireless network; the decision is to be made by a Kerberos server. The setup is not working as intended, which I think stems either from my misunderstanding of the protocols involved or of how to set up freeradius correctly. Or both. Later, all authentication requests of username(a)example.com (without the net.) are to be forwarded to another Radius server. There will likely be more services integrated in the same vein later, so I would like to branch out into separate virtual servers based on realm. My understanding is that the communication between a user(a)net.example.com and freeradius needs to involve EAP-TTLS, because of the cleartext password which is required to be passed on to kerberos. The required keytab is set up and configured correctly. modules/krb5 is set up accordingly. bootstrap in raddb/certs has been run to create self-signed certs. I have an entry in the users file: DEFAULT Realm == "net.example.com", Auth-Type = Kerberos The realm is set up like this: realm net.example.com { virtual_server = net.example.com } And the virtual server as well as the inner-tunnel have Auth-Type Kerberos { krb5 } in their authenticate section, right after Auth-Type PAP. Key changes in eap.conf: eap { default_eap_type = ttls ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } } Local tests succeed as follows: $ radtest -t pap thorsten(a)net.example.com pwd 127.0.0.1 0 testing123 $ radtest -t eap-md5 thorsten(a)net.example.com pwd 127.0.0.1 0 testing123 $ radtest -t pap thorsten(a)net.example.com pwd 127.0.0.1:18120 0 testing123 In each of these cases, the reason for success is successful communication with Kerberos, as exemplified by the following lines (and wrong kerberos passwords let authentication fail): Wed Feb 2 15:59:06 2011 : Info: Found Auth-Type = Kerberos Wed Feb 2 15:59:06 2011 : Info: # Executing group from file /etc/freeradius/sites-enabled/net.example.com Wed Feb 2 15:59:06 2011 : Info: +- entering group Kerberos {...} Wed Feb 2 15:59:06 2011 : Info: ++[krb5] returns ok Wed Feb 2 15:59:06 2011 : Auth: Login OK: [thorsten] (from client localhost port 0 via TLS tunnel) However, tests with eapol_test locally as well as with the actual access points fail: $ cat eap-ttls.conf network={ ssid="myssid" key_mgmt=WPA-EAP eap=TTLS identity="thorsten(a)net.example.com" password="pwd" phase2="auth=PAP" } $ eapol_test -c eap-ttls.conf -s testing123 produces: rad_recv: Access-Request packet from host 127.0.0.1 port 60596, id=0, length=172 User-Name = "thorsten(a)net.example.com" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 Calling-Station-Id ="02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000250174686f727374656e406e65742e742d6c6162732e74752d6265726c696e2e6465 Message-Authenticator = 0x3f0be4354cfc77a6285a0ad074341101 Wed Feb 2 15:33:32 2011 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Wed Feb 2 15:33:32 2011 : Info: +- entering group authorize {...} Wed Feb 2 15:33:32 2011 : Info: ++[preprocess] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[chap] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[mschap] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[digest] returns noop Wed Feb 2 15:33:32 2011 : Info: [suffix] Looking up realm "net.example.com" for User-Name = "thorsten(a)net.example.com" Wed Feb 2 15:33:32 2011 : Info: [suffix] Found realm "net.example.com" Wed Feb 2 15:33:32 2011 : Info: [suffix] Adding Stripped-User-Name = "thorsten" Wed Feb 2 15:33:32 2011 : Info: [suffix] Adding Realm = "net.example.com" Wed Feb 2 15:33:32 2011 : Info: [suffix] Proxying request from user thorsten to realm net.example.com Wed Feb 2 15:33:32 2011 : Info: [suffix] Preparing to proxy authentication request to realm "net.example.com" Wed Feb 2 15:33:32 2011 : Info: ++[suffix] returns updated Wed Feb 2 15:33:32 2011 : Info: [eap] Request is supposed to be proxied to Realm net.example.com. Not doing EAP. Wed Feb 2 15:33:32 2011 : Info: ++[eap] returns noop Wed Feb 2 15:33:32 2011 : Info: [files] users: Matched entry DEFAULT at line 71 Wed Feb 2 15:33:32 2011 : Info: ++[files] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[expiration] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[logintime] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[pap] returns noop Wed Feb 2 15:33:32 2011 : Info: WARNING: Empty pre-proxy section. Using default return values. Wed Feb 2 15:33:32 2011 : Info: >>> Sending proxied request internally to virtual server. Wed Feb 2 15:33:32 2011 : Info: server net.example.com { Wed Feb 2 15:33:32 2011 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/net.example.com Wed Feb 2 15:33:32 2011 : Info: +- entering group authorize {...} Wed Feb 2 15:33:32 2011 : Info: ++[preprocess] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[digest] returns noop Wed Feb 2 15:33:32 2011 : Info: [suffix] Request already proxied. Ignoring. Wed Feb 2 15:33:32 2011 : Info: ++[suffix] returns ok Wed Feb 2 15:33:32 2011 : Info: [files] users: Matched entry DEFAULT at line 71 Wed Feb 2 15:33:32 2011 : Info: ++[files] returns ok Wed Feb 2 15:33:32 2011 : Info: ++[expiration] returns noop Wed Feb 2 15:33:32 2011 : Info: ++[logintime] returns noop Wed Feb 2 15:33:32 2011 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Wed Feb 2 15:33:32 2011 : Info: ++[pap] returns noop Wed Feb 2 15:33:32 2011 : Info: Found Auth-Type = Kerberos Wed Feb 2 15:33:32 2011 : Info: # Executing group from file /etc/freeradius/sites-enabled/net.example.com Wed Feb 2 15:33:32 2011 : Info: +- entering group Kerberos {...} Wed Feb 2 15:33:32 2011 : Auth: rlm_krb5: Attribute "User-Password" is required for authentication. Wed Feb 2 15:33:32 2011 : Info: ++[krb5] returns invalid Wed Feb 2 15:33:32 2011 : Info: Failed to authenticate the user. [...] Apparently, the cleartext password does not get passed on. And I need to figure out why. This is were you come in, mailing list ;) Thank you in advance for suggestions. Cheers, t -- Thorsten Fischer, BOWL Project Administrator <thorsten(a)net.t-labs.tu-berlin.de> Technische Universität Berlin, FG INET, TEL16, 18th floor Ernst-Reuter-Platz 7, 10587 Berlin, Germany Tel: +49 30 835358542, Fax: +49 391 53478347

3 3

Proxy state attribute in accounting
by Waqas Toor 20 Apr '11

20 Apr '11

Hello Community, I am doing store and proxy accounting to different servers, Now I want to remove the proxy-state attribute from the proxied packet. The problem is that other accounting servers that are not FreeRadius are not accepting proxy-state attribute. So they are not sending the acccounting response back. This makes the detail file size increase. I am using FreeRadius version 2.1.10 with roubust-accounting configuration. the proxy servers are being load-balanced. and detail file is being created correctly Thank you Waqas Toor

2 7