August 2011 - Freeradius-Users - lists.freeradius.org

How to tell freeradius of the encryption used in DB
by det.explorer＠yahoo.com 18 Aug '11

18 Aug '11

Hi, I am testing freeradius. I use dialup admin and mysql to add users, which is configured to store passwords in md5. The attribute is User-Password. Used radtest for testing, but seems radtest is only able to recognize cleartext password. How to tell freeradius that passwords are in md5? Should i need to use other client aside from radtest? Thanks so much, Det

3 4

RE: NAS-IP-Address or NAS-Identifier in Access-Request?
by Eric Geier 17 Aug '11

17 Aug '11

I found %{Packet-Src-IP-Address} but when I include this in the postauth_query, it doesn't work...the fields are blank in the DB when I view it. How could I log the source IP address of successful authentications? - Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Eric Geier Sent: Tuesday, August 16, 2011 3:49 PM To: 'FreeRadius users mailing list' Subject: RE: NAS-IP-Address or NAS-Identifier in Access-Request? Understood, thanks! Can I log the source IP address to the Post-Auth DB table? Thanks, Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 16, 2011 10:38 AM To: FreeRadius users mailing list Subject: Re: NAS-IP-Address or NAS-Identifier in Access-Request? Eric Geier wrote: > Yes I read that in the RFC, but was wondering what vendors usually do, > what's the most typical, etc. I'm also wondering the same about the > Calling-Station-Id and Called-Station-ID. But sounds like those aren't > included very often, completely optional. There's no way to know what is typical. There are many dozens of vendors, each of whom has many dozens of products using RADIUS. Each product may have dozens of different firmware revisions, each of which behaves slightly differently. > But now that I've thought of it, if there isn't a NAS-IP-Address then > authentication wouldn't work, right? Cause FR needs to lookup the > shared secret based upon the NAS-IP-Address? No. The shared secret is looked up by source IP address. The NAS-IP-Address can be anything. It is pretty much ignored by the core RADIUS protocol. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Can translation of RADIUS packet attributes (e.g., NAS-Port-Type) be configured?
by Jack Patmos 17 Aug '11

17 Aug '11

I am running FreeRADIUS 2.1.7. I am attempting to write accounting data to Postgres database. In the database the NAS port type from the request is stored as the integer value that defines the port type in RFC2865 (e.g., 19 - 'Wireless - IEEE 802.11'). The database table is fixed and cannot be changed. When I send a test packet from radclient that contains a port type: Called-Station-Id = "xx-xx-xx-xx-xx-xx" User-Name = "REALM/user" Framed-IP-Address = xxx.xxx.xxx.xxx NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port-Type = 19 [...] Then when it is received by the server the port type has always been translated into its string value: rad_recv: Accounting-Request packet from host 127.0.0.1 port 54361, id=245, length=262 Called-Station-Id = "xx-xx-xx-xx-xx-xx" User-Name = "REALM/user" Framed-IP-Address = xxx.xxx.xxx.xxx NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port-Type = Wireless-802.11 Acct-Status-Type = Start [....] +- entering group preacct {...} ++[preprocess] returns ok Obviously, I can't insert 'Wireless-802.11' into an integer field in the database. Is there away of disabling this lookup so that FreeRADIUS does not translate these values when it receives a packet, or am I going to have to code my own reverse lookup into my accounting module? I also have the same problem for other fields like Acct-Termination-Cause. Jack.

3 4

force logout user on nas at accounting
by Christoph Thielecke 17 Aug '11

17 Aug '11

Hello, I want to know how I can tell the nas to logout a user on Accounting packet. What i have to return at my module to let the nas disable the user? I have a request like this: Service-Type=Call-Check NAS-Identifier="rad100" NAS-Port=1 NAS-Port-Id="Controlled" NAS-Port-Type=Wireless-802.11 NAS-IP-Address=xx.xx.xx.xx User-Name="user1" Acct-Status-Type=Interim-Update Acct-Session-Id="1313155182" Acct-Session-Time=63 Acct-Delay-Time=0 Acct-Authentic=RADIUS Called-Station-Id="00-1F-D4-xx-xx-xx" Calling-Station-Id="00-1C-4A-xx-xx-xx" Framed-IP-Address=192.168.xx.xx Acct-Input-Packets=20 Acct-Input-Octets=7004 Acct-Output-Packets=24 Acct-Output-Octets=4153 Acct-Unique-Session-Id="16028485e4b3f41e" With best regards Christoph -- Linux User Group Wernigerode http://www.lug-wr.de/

2 1

RE: NAS-IP-Address or NAS-Identifier in Access-Request?
by Eric Geier 16 Aug '11

16 Aug '11

Understood, thanks! Can I log the source IP address to the Post-Auth DB table? Thanks, Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 16, 2011 10:38 AM To: FreeRadius users mailing list Subject: Re: NAS-IP-Address or NAS-Identifier in Access-Request? Eric Geier wrote: > Yes I read that in the RFC, but was wondering what vendors usually do, > what's the most typical, etc. I'm also wondering the same about the > Calling-Station-Id and Called-Station-ID. But sounds like those aren't > included very often, completely optional. There's no way to know what is typical. There are many dozens of vendors, each of whom has many dozens of products using RADIUS. Each product may have dozens of different firmware revisions, each of which behaves slightly differently. > But now that I've thought of it, if there isn't a NAS-IP-Address then > authentication wouldn't work, right? Cause FR needs to lookup the > shared secret based upon the NAS-IP-Address? No. The shared secret is looked up by source IP address. The NAS-IP-Address can be anything. It is pretty much ignored by the core RADIUS protocol. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Openssl Private Key error
by voxner 16 Aug '11

16 Aug '11

Hi, I had generated certificates for EAP-TLS authentication. It worked fine in a linux setup but windows wouldn't play ball. Somebody pointed out that the CA.* scripts in the ssl directory can generate windows compatible certs. I did that but when I try to use that I get the following error regarding the private key I use during the eap handshake at the supplicant end (taken from the logs of wpa_supplicant). ================================================== OpenSSL: tls_connection_client_cert - SSL_use_certificate_file (DER) failed error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:140C800D:SSL routines:SSL_use_certificate_file:ASN1 lib OpenSSL: SSL_use_certificate_file (PEM) --> OK OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (DER) failed error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag OpenSSL: pending error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib OpenSSL: pending error: error:140CB00D:SSL routines:SSL_use_PrivateKey_file:ASN1 lib OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (PEM) failed error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm OpenSSL: pending error: error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error OpenSSL: pending error: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error OpenSSL: pending error: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib OpenSSL: pending error: error:140CB009:SSL routines:SSL_use_PrivateKey_file:PEM lib OpenSSL: tls_read_pkcs12 - Failed to use PKCS#12 file error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: Failed to load private key TLS: Failed to load private key '/home/user/supplicant_testing/eap_authenticator_test/last_cert/newkey.pem' ================================================== I use wpa_supplicant (0.7.1) in the supplicant end. Can somebody plz give me some pointers on how to get over this problem. Is there any specific ssl command or openssl configuration at the supplicant end that I need to take care of... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Openssl-Private-Key-error-tp4704998… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

RE: NAS-IP-Address or NAS-Identifier in Access-Request?
by Eric Geier 16 Aug '11

16 Aug '11

Thanks, Alan. Yes I read that in the RFC, but was wondering what vendors usually do, what's the most typical, etc. I'm also wondering the same about the Calling-Station-Id and Called-Station-ID. But sounds like those aren't included very often, completely optional. But now that I've thought of it, if there isn't a NAS-IP-Address then authentication wouldn't work, right? Cause FR needs to lookup the shared secret based upon the NAS-IP-Address? - Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: Tuesday, August 16, 2011 4:32 AM To: FreeRadius users mailing list Subject: Re: NAS-IP-Address or NAS-Identifier in Access-Request? Hi, > Does anyone happen to know if consumer-level Wi-Fi routers typically > transmit the NAS-IP-Address or NAS-Identifier (or maybe both) in the > Access-Request? RFC's say An Access-Request MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both). so, you will get one or the other (or from good vendors, both!) if you dont get either than the kit isnt fit for purpose, or valid for anything (because if they cant follow such as basic RFC requirement then what hope have you for anything else to operte correctly on it?) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Declare a time availability of NASs?
by Eric Geier 16 Aug '11

16 Aug '11

Is there any way to declare a time availability of NASs.such as a Login-Time attribute for NASs? I'd like to globally control when (time of day, time of week) all users can login through a certain wireless access point on my 802.1X network. Thanks, Eric

2 1

NAS-IP-Address or NAS-Identifier in Access-Request?
by Eric Geier 16 Aug '11

16 Aug '11

Does anyone happen to know if consumer-level Wi-Fi routers typically transmit the NAS-IP-Address or NAS-Identifier (or maybe both) in the Access-Request? Would be great if there was a central place to look up the exact attributes and formats vendors use. Thanks, Eric

2 1

Cant Start Radius Server MAC OSX (snow leopard)
by DavidS 16 Aug '11

16 Aug '11

Hi I tried to Run Radius Server on Mac OSX Server Snow Leopard. Tried to START Radius It wont start I had made a few changed (detailed below) I went to DEBUG with following out put: server10:~ admin$ radiusd -X FreeRADIUS Version 2.1.3, for host i386-apple-darwin10.0, built on Apr 11 2011 at 17:19:07 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /private/etc/raddb/radiusd.conf Unable to open file "/private/etc/raddb/radiusd.conf": Permission denied Errors reading /private/etc/raddb/radiusd.conf server10:~ admin$ I had not edited this file Can anyone help ? Thanks CHANGES I MADE PRIOR TO GETTING THIS ERROR First time I used the Radius Server Using Server Admin selected the Radius service - it appeared as expected identified and I entered a local time capsule (That appeared as a base station) The Radius Server was running I stopped the Radius Server AND using textwrangler edited /etc/raddb/clients.conf I entered the following text below the preceding "#" and above the text "client localhost {" client { ipaddr = 192.168.0.100 netmask = 32 secret = XXXX require_message_authenticator = no shortname = slr877 nastype = cisco } I saved the file closed the file Using textwrangler I edited /etc/raddb/users At the end of the file entered user1 Cleartext-Password := “password” Service-Type = NAS-Prompt-User, cisco-avpair = “webvpn:user-vpn-group=SLRgroup1” Saved the file closed the file Tried to restart the Radius Server and got the above error Please help Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/Cant-Start-Radius-Server-MAC-OSX-sn… Sent from the FreeRadius - User mailing list archive at Nabble.com.

8 13