October 2012 - Freeradius-Users - lists.freeradius.org

freeRadius against Active Directory
by Martin.Heinzmann＠belden.com 09 Oct '12

09 Oct '12

Hi, I am in my internship and have the task to authenticate devices over freeRadius against Active Directory (Windows Server 2008 R2). So far I managed to authenticate succesfully with freeRadius against Active Directory after I was finished with the tutorial from Deploying RADIUS. Thanks for that :-) Now I am having the problem that the devices I want to authenticate are requesting the Service-Type(Attribute 6). Do you have any idea how to set the Service-Type in Active Directory for each user? Is that even possible or do I have to configure the users file for each user and his corresponding Service-Type? Thanks in advance, Regards Martin Heinzmann Intern R&D Embedded Software DISCLAIMER: Privileged and/or Confidential information may be contained in this message. If you are not the addressee of this message, you may not copy, use or deliver this message to anyone. In such event, you should destroy the message and kindly notify the sender by reply e-mail. It is understood that opinions or conclusions that do not relate to the official business of the company are neither given nor endorsed by the company. Thank You.

4 5

Re: help - simultaneous accounting
by 劉君羿 09 Oct '12

09 Oct '12

I am using *Chillispot* on my NAS. But it doesn't seem to support CoA. Can you suggest other AP controllers? By the way, I though concurrent accounting was a feature that should be supported. I wonder why it's not supported by the major AAA protocols.

3 3

IP Grouping
by George Innocent 08 Oct '12

08 Oct '12

I have a set of IP for my NAS and wish to group this together so i don't have to create a set of new ones on the clients.conf file every time a new NAS is created. What's the best way to do this without causing a crash -- Regards: George Innocent.

3 4

Execution of rlm code when remote server is not responding.
by Arka Sharma 08 Oct '12

08 Oct '12

Hi, I have a remote PPS server where I am proxying radius requests coming from the NAS. I have a requirement like when that remote PPS goes down(which I am simulating by setting a wrong ip in proxy.conf realm configuration) then I have to perform a certain task in rlm code.But my observation is when I am setting a dummy ip for PPS, the radius server running on my machine is marking that remote server as zombie after 3 retries,now I want in this case that my rlm code to execute and handle the scenario when remote server is down.Any help will be highly appreciated.Also I may have used some naive terminology being a newbie apologizing for that. Regards, Arka

3 7

help - simultaneous accounting
by 劉君羿 06 Oct '12

06 Oct '12

I want to allow simultaneous use of accounts. However, *RFC 2866 *says that the* Acct-Session-Time* > can only be present in Accounting-Request records where the > Acct-Status-Type is set to Stop [Page 17] Does this mean that RADIUS protocol can not manage simultaneous use of an account? For example, an account with *Session-Timeout *2 hours is shared by two users. User1 login first and use the account for 1 hour, user2 then login (user1 still accessing the account), then user2 turns out two have *2 hours*, which is wrong and is because that user1 not yet send Acct-Session-Time to the server. If RADIUS is not suit for the scenario above, should I try other protocols such as DIAMETER and TACACS+? Thanks.

3 2

Identifying Virtual-Server from Inner-Tunnel
by Jordan Dohms 05 Oct '12

05 Oct '12

I’m still fairly new at FreeRADIUS. Running 2.1.10 (we are planning our upgrade shortly). Kind of a two pronged question here...I'm encountering a particular issue, but also would like to hear if my broad approach is suitable. I am attempting to do the following: - Use one FreeRADIUS server to authenticate for two different 802.1X networks (EAP-PEAP / MSCHAP). - Both will use the mschap module to interface with Microsoft Active Directory. - The first 802.1X network will authenticate against DOMAIN1, the second against both DOMAIN1 and DOMAIN2. The first network should reject authentication attempts from DOMAIN2. - All usernames are specified with a full realm / fqdn. - The RADIUS clients (wireless access points) will all be the same for the two networks. What (I think) is the solution: - In order for FreeRADIUS to distinguish what set of users (DOMAIN1 or DOMAIN1/2) to authenticate against, I have setup two virtual servers listening on different ports and (obviously) different names. (working) - The clients connect to FreeRADIUS over a different port depending on the network they're attempting to connect to. (working) - Setup realms for both DOMAIN1 and DOMAIN2 to have them both authenticate locally. (working) - Setup two mschap modules to call ntlm_auth command with the proper DOMAIN string. (working) - Depending on the realm provided, call a different mschap module from the inner-tunnel. (working) - Depending on the virtual server the request was received through, call a different mschap module from the inner-tunnel or reject the request. (not working) If there's a better/cleaner/simpler way to do this, I'm all ears. My issue: Since its EAP-PEAP, the request passes through the outer and inner-tunnel virtual servers. In my inner-tunnel, I'm doing an IF on the Realm. That seems to be evaluating properly if I look at the debug logs. If I do an IF on Virtual-Server it comes back with 'inner-tunnel'. If I do outer.request:Virtual-Server it oddly also comes back with 'inner-tunnel'. How do I see the actual virtual-server? Should I need to set a separate variable in the outer-server and read it below? Here is my attempted code in "server inner-tunnel" authenticate { Auth-Type MS-CHAP { if ("%{outer.request:Virtual-Server}" == "secure") { mschap_domain1 } else { if ("%{Realm}" == "domain1.fqdn.org") { mschap_domain1 } elsif ("%{Realm}" == "domain2.fqdn.org") { mschap_domain2 } } } eap } In my debug logs: Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +- entering group MS-CHAP {...} Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++? if ("%{outer.request:Virtual-Server}" == "secure") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{outer.request:Virtual-Server} -> inner-tunnel Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{outer.request:Virtual-Server}" == "secure") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++? if ("%{outer.request:Virtual-Server}" == "secure") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ++- entering else else {...} Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" == "domain1.fqdn.org") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{Realm} -> domain2.fqdn.org Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}" == "domain1.fqdn.org") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? if ("%{Realm}" == "domain1.fqdn.org") -> FALSE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" == "domain2.fqdn.org") Thu Oct 4 13:05:18 2012 : Info: [mschapv2] expand: %{Realm} -> domain2.fqdn.org Thu Oct 4 13:05:18 2012 : Info: [mschapv2] ? Evaluating ("%{Realm}" == "domain2.fqdn.org") -> TRUE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++? elsif ("%{Realm}" == "domain2.fqdn.org") -> TRUE Thu Oct 4 13:05:18 2012 : Info: [mschapv2] +++- entering elsif ("%{Realm}" == "domain2.fqdn.org") {...} Any suggestions for what I'm doing wrong or maybe a better way to tackle it? Thanks, Jordan Dohms

3 3

RedHat FreeRadius reload or restart?
by Mike Diggins 05 Oct '12

05 Oct '12

I've been running the RedHat "version" of FreeRADIUS Version 2.1.3 for a few years. Each morning I update the users authorization file and run "service radius reload" for the changes to take affect. I recently patched the system, which updated FreeRADIUS to version 2.1.12. I find now that after reloading, using the same script, it appears to reload successfully but my authentications (through ntlm_auth to an MS AD) begin failing. If I instead use "service radiusd restart", it's fine. Did anything change between versions that would explain this? Oct 5 07:30:02 radserv radiusd[3825]: Login OK: [xxxx] (from client wlc-7 port 0 via TLS tunnel) Oct 5 07:30:02 radserv radiusd[3825]: Login OK: [xxxxx] (from client wlc-7 port 13 cli 6c-c2-6b-98-06-52) Oct 5 07:30:02 radserv radiusd[15741]: Loaded virtual server <default> Oct 5 07:30:02 radserv radiusd[15741]: Loaded virtual server inner-tunnel Oct 5 07:30:02 radserv radiusd[15741]: ... adding new socket proxy address * port 0 Oct 5 07:30:02 radserv radiusd[3825]: Received HUP signal. Oct 5 07:30:02 radserv radiusd[3825]: HUP - Re-reading configuration files Oct 5 07:30:02 radserv radiusd[3825]: HUP - loading modules Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "radutmp" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "suffix" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "attr_filter.access_reject" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "attr_filter.accounting_response" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "detail" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "mschap" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "pap" Oct 5 07:30:02 radserv radiusd[3825]: Module: Reloaded module "files" Oct 5 07:30:02 radserv radiusd[3825]: Loaded virtual server <default> Oct 5 07:30:02 radserv radiusd[3825]: Loaded virtual server inner-tunnel Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-6 port 0 via TLS tunnel) Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect: [xxxxx] (from client wlc-6 port 13 cli 00-26-08-e6-13-90) Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-7 port 0 via TLS tunnel) Oct 5 07:30:04 radserv radiusd[3825]: Login incorrect: [xxxx] (from client wlc-7 port 13 cli 7c-11-be-c3-20-72) Oct 5 07:30:05 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-6 port 0 via TLS tunnel) Oct 5 07:30:05 radserv radiusd[3825]: Login incorrect: [xxxxx] (from client wlc-6 port 13 cli 48-60-bc-f4-1d-31) Oct 5 07:30:07 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxx] (from client wlc-7 port 0 via TLS tunnel) Oct 5 07:30:07 radserv radiusd[3825]: Login incorrect (mschap: External script says ): [xxxxxx] (from client wlc-6 port 0 via TLS tunnel) Oct 5 07:30:07 radserv radiusd[3825]: Login incorrect: [xxxx] (from client wlc-6 port 13 cli 48-60-bc-f4-1d-31) -Mike

3 4

Indeterministic EAP error
by Matthias Nagel 05 Oct '12

05 Oct '12

Hello, sometimes I get the error WARNING: !! EAP session for state 0xABCDEFGHIJKLMNOP did not finish! in my log files / debug output. Before anybody says have a look at http://deployingradius.com/documents/configuration/eap-problems.html that will help, please read on, because I already have done that and I believe the problem is a little bit more tricky. I support PEAP+MsCHAPv2 only and 90% of time it just works. I am pretty sure that the certificate is all right. If anybody wants to check it, one can find it here https://freeradius:eaperror@www.stud.uni-karlsruhe.de/~uzbii/hekauth-certs.… The certificate file includes all intermediate issuers and the trusted CA. The CA is Germany's biggest telco, so most OSes ship with that by default. The certificate also includes the X509v3 Extended Key Usage TLS Web Client and Authentication and TLS Web Server Authentication in order to satisfy Windows clients. My radius config looks like that: certdir = ${confdir}/certs cadir = ${confdir}/certs private_key_file = ${certdir}/hekauth-key.pem certificate_file = ${certdir}/hekauth-certs.pem # CA_file = CA_path = ${certdir}/empty-by-purpose/ If a new client connects for the very first time, most OSes automatically detect the correct authentication scheme, ask for username and password, present the certificate for confirmation and it works out of the box. (No errors on neither client nor server side.) Randomly, I get this error message although the respective client normally works. In that case the client just restarts the authentication and then succeeds on the second trial. Hence the only difference the user might notice is an authentication that might take some milliseconds longer. During the last four days there have been 1278 such errors, 2519 session, 9651 successful authentication attempts, i.e. each session triggered approximately 3.8 re-authentications, 93 different clients and at least 6 different OSes. I cannot find any pattern, so I do not believe it to be a client side issue. Of course, one can argue to ignore the warning as it works most of the time, but I do not like indeterministically behaving IT systems, hence it preys on my mind. Has anybody an idea what the reason might be? If anybody wants to see a full debug output or a tcpdump, I can provide you with plenty of that. But I could not find anything. Yours, Matthias ---------------------------------------------------------------------- Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 e-Mail: matthias.h.nagel(a)gmail.com ICQ: 499797758 Skype: nagmat84

5 8

RE: Volume limit/data limit with Mikrotik NAS on FreeRADIUS
by Angel Elena 05 Oct '12

05 Oct '12

the volume limit, across / nat the mikrotik ? -----Mensaje original----- De: Antonio Fernández Pérez <antoniofernandez(a)fabergames.com> Enviado: Vie 05-10-2012 13:44 Asunto: Volume limit/data limit with Mikrotik NAS on FreeRADIUS Para: freeradius-users(a)lists.freeradius.org; > Hi everybody, > > I'm interested in configuring data limit/volume limit with RADIUS users using > Mikrotik NAS. I have read that maybe configuring some attributes like > Mikrotik-Rate-Limit is possible, but I could not to get it after done some > tests. I have gotten to configure data limit by session with > Mikrotik-Xmit-Limit and Mikrotik-Recv-Limit. Anybody can help me? Anybody has > the same problem? > > Thank you very much. > > Best regards, > > Antonio. > > -- > > Antonio Manuel Fernández Pérez > > Ingeniero Técnico en Informática > Dpto. Programación y Sistemas Fabergames S.L. > TLF:966261111 / FAX:966551801 > www.fabergames.com <http://www.fabergames.com/> > > > <http://www.facebook.com/fabergames> > > * * * ADVERTENCIA LEGAL * * * > > Le informamos, como destinatario de este mensaje, que el correo electrónico y > las comunicaciones por medio de Internet no permiten asegurar ni garantizar la > confidencialidad de los mensajes transmitidos, así como tampoco su integridad o > su correcta recepción, por lo que FABERGAMES S.L. no asume responsabilidad > alguna por tales circunstancias. Si no consintiese en la utilización del correo > electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y > ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de > manera exclusiva, a su destinatario y contiene información confidencial y > sujeta al secreto profesional, cuya divulgación no está permitida por la ley. > En caso de haber recibido este mensaje por error, le rogamos que, de forma > inmediata, nos lo comunique mediante correo electrónico remitido a nuestra > atención o a través del teléfono (+ 34) 966 26 11 11 y proceda a su > eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, > le comunicamos que la distribución, copia o utilización de este mensaje, o de > cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están > prohibidas por la ley. > > > > > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Volume limit/data limit with Mikrotik NAS on FreeRADIUS
by Antonio Fernández Pérez 05 Oct '12

05 Oct '12

Hi everybody, I'm interested in configuring data limit/volume limit with RADIUS users using Mikrotik NAS. I have read that maybe configuring some attributes like Mikrotik-Rate-Limit is possible, but I could not to get it after done some tests. I have gotten to configure data limit by session with Mikrotik-Xmit-Limit and Mikrotik-Recv-Limit. Anybody can help me? Anybody has the same problem? Thank you very much. Best regards, Antonio. -- *Antonio Manuel Fernández Pérez* *Ingeniero Técnico en Informática *Dpto. Programación y Sistemas Fabergames S.L. TLF:966261111 / FAX:966551801 www.fabergames.com [image: Imágenes integradas 1] [image: Imágenes integradas 3]<http://www.facebook.com/fabergames> [image: Imágenes integradas 4] <https://twitter.com/#!/Fabergames> [image: Imágenes integradas 5] * * * ADVERTENCIA LEGAL * * * Le informamos, como destinatario de este mensaje, que el correo electrónico y las comunicaciones por medio de Internet no permiten asegurar ni garantizar la confidencialidad de los mensajes transmitidos, así como tampoco su integridad o su correcta recepción, por lo que FABERGAMES S.L. no asume responsabilidad alguna por tales circunstancias. Si no consintiese en la utilización del correo electrónico o de las comunicaciones vía Internet le rogamos nos lo comunique y ponga en nuestro conocimiento de manera inmediata. Este mensaje va dirigido, de manera exclusiva, a su destinatario y contiene información confidencial y sujeta al secreto profesional, cuya divulgación no está permitida por la ley. En caso de haber recibido este mensaje por error, le rogamos que, de forma inmediata, nos lo comunique mediante correo electrónico remitido a nuestra atención o a través del teléfono (+ 34) 966 26 11 11 y proceda a su eliminación, así como a la de cualquier documento adjunto al mismo. Asimismo, le comunicamos que la distribución, copia o utilización de este mensaje, o de cualquier documento adjunto al mismo, cualquiera que fuera su finalidad, están prohibidas por la ley.

1 0