November 2012 - Freeradius-Users - lists.freeradius.org

what about mac spoofing
by pideil matthew 23 Nov '12

23 Nov '12

Hello all ! Please tell me, does radius auth over wifi (wpa2) affected by mac spoofing attack ? I think not because after successfull auth, exchange key mechanism is performed and all traffic become crypted. But my wifi laptop can already be disconnected by spoofed packet ? Regards, Matt

2 1

Git master branch & Debian build
by Olivier Beytrison 23 Nov '12

23 Nov '12

Hello, Just a quick question, before I loose too much time on this. Is the debian build system on the master repository working ? I'm getting hard time to build the deb packages. git clone from yesterday, ubuntu 12.04 LTS Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

5 38

Newbie question about rlm_exec usage
by Hoggins! 23 Nov '12

23 Nov '12

Hello everyone, We're facing an issue with rlm_exec, or at least Ithink our problem comes from there. We use FreeRADIUS for a Wifi access point. We userlm_sql, and our clients authenticate using 802.1x, with a certificate and a pair of login/password credentials. Everything works just fine, and we just had to customize a little bit the SQL queries to match our shared tables. Now, we would like to use another way of authorizing our users on our Wifi network. Basically, a script should be called by FreeRADIUS, and the result of the script would determine whether the user is granted access or not.To be precise, the script uses a curl callwith POST parameters (over an SSL connexion), andthe returned result happens to be the authentication request result. The script works perfectly, exiting with the correct error code, according to what it should return. Yay ! So we just replaced the line "sql" in the authorize { } with a "curl" line, "curl" being a module we created, copying the "echo" module. Alas, it does not work, and mschap complains about the absence of Cleartext-Password. So before posting a lotof debug info and our scripts, does this procedure seem ok to you ? Thanks in advance, Hoggins!

1 0

Re: what about mac spoofing
by Alan Buxey 23 Nov '12

23 Nov '12

802.1X authentication ? (WPA2-RADIUS) If so , system is authenticated by user/pass and/or a certificate and the client and AP have a unique encryption key.. no other device can just come along with the same MAC and just start using the network. For WPA2 PSK, another client would need to know the shared key to authenticate and associate with the AP. you could have MAC control ...and so if the attacker knows the PSK then yes, they could get online by spoofing the MAC of an allowed client alan

1 0

Debian build the freeradius package with unixodbc support
by Dominick Rivard 23 Nov '12

23 Nov '12

Hi, Here is what I am trying to achieve, we want to install freeradius using a Microsoft SQL backend. I read on the internet that we need to achieve this goal using the unixodbc driver. I am able to set up the unixodbc driver from apt-get and if I configure Freetds to use it. After the installation and configs I can run the test command: isql -v DVSQLServer USERNAME PASSWORD +---------------------------------------+ | Connected! | | sql-statement | help [tablename] | quit | +---------------------------------------+ This is actually working. But I found out downloading the freeradius tarbal that it can't use the rlm_sql_unixodbc driver, because in the debian/rules file they compile it using the flag: --without-rlm_sql_unixodbc I thought it would be easy to remove the flag from debian/rules and just build my own package using the command line: fakeroot dpkg-buildpackage -b -uc But it is failing with error: checking for SQLConnect in -lodbc... no checking for sql.h... yes configure: error: set --without-rlm_sql_unixodbc to disable it explicitly. configure: error: ./configure failed for ./drivers/rlm_sql_unixodbc configure: error: ./configure failed for src/modules/rlm_sql make: *** [config.status] Error 1 dpkg-buildpackage: error: debian/rules build gave error exit status 2 Do you have any idea of what I am missing to compile it successfully? I can also tell you that I ran these apt-get command to make sure I was having all the dependencies. apt-get build-dep -y unixodbc freetds-bin freetds-common freetds-dev tdsodbc freeradius apt-get install -y unixodbc freetds-bin freetds-common freetds-dev tdsodbc libssl-dev dpkg-dev Regards Dominick Dominick Rivard, Solutions Architect 5275 Queen Mary Montréal, Qc H3W 1Y3 Tel: 514-385-4448 ext 126 Fax: 514-385-6660 Notice: This message is confidential and privileged. If you are not the addressee, please inform the sender by return e-mail immediately and delete this message and destroy all copies. Avis : Ce message est confidentiel et protégé par le secret professionnel. Si vous nêtes pas le destinataire, veuillez informer lexpéditeur par courrier électronique immédiatement et effacer ce message et en détruire toute copie.

2 4

problem with test aaa-server in ciscoasa
by studyfordo 23 Nov '12

23 Nov '12

Hi,all I have install freeradius-server-2.2.0, and make test such as ./ratest test test 127.0.0.1 0 testing123. the result is ok. so i ass user tsb to users file as following format. tsb Auth-Type := Local, User-Password == "12345678" and add asa ip to clients. client X.X.X.X{ secret = testvpn shortname =asa5520 } complete this I do testing in asa5520 like this test asa-server authencation RadiusVPN host X.X.X.X username tsb password 12345678 hint Authentication Rejected: AAA failure I debug it. the folloing is details. FO: Attempting Authentication test to IP address <192.168.4.145> (timeout: 12 seconds) radius mkreq: 0xbeaf alloc_rip 0x74e172b4 new request 0xbeaf --> 68 (0x74e172b4) got user 'tsb' got password add_req 0x74e172b4 session 0xbeaf id 68 RADIUS_REQUEST radius.c: rad_mkpkt RADIUS packet decode (authentication request) -------------------------------------- Raw packet data (length = 61)..... 01 44 00 3d 96 17 04 ed 22 b3 70 e9 6e 0f 9c a5 | .D.=....".p.n... 7a 2b 88 21 01 05 74 73 62 02 12 c1 64 1a 52 c7 | z+.!..tsb...d.R. 3f 73 72 16 82 39 8a 0a e0 24 20 04 06 c0 a8 1e | ?sr..9...$ ..... fe 05 06 00 00 00 3c 3d 06 00 00 00 05 | ......<=..... Parsed packet data..... Radius: Code = 1 (0x01) Radius: Identifier = 68 (0x44) Radius: Length = 61 (0x003D) Radius: Vector: 961704ED22B370E96E0F9CA57A2B8821 Radius: Type = 1 (0x01) User-Name Radius: Length = 5 (0x05) Radius: Value (String) = 74 73 62 | tsb Radius: Type = 2 (0x02) User-Password Radius: Length = 18 (0x12) Radius: Value (String) = c1 64 1a 52 c7 3f 73 72 16 82 39 8a 0a e0 24 20 | .d.R.?sr..9...$ Radius: Type = 4 (0x04) NAS-IP-Address Radius: Length = 6 (0x06) Radius: Value (IP Address) = 192.168.30.254 (0xC0A81EFE) Radius: Type = 5 (0x05) NAS-Port Radius: Length = 6 (0x06) Radius: Value (Hex) = 0x3C Radius: Type = 61 (0x3D) NAS-Port-Type Radius: Length = 6 (0x06) Radius: Value (Hex) = 0x5 send pkt 192.168.4.145/1812 rip 0x74e172b4 state 7 id 68 rad_vrfy() : response message verified rip 0x74e172b4 : chall_state '' : state 0x7 : reqauth: 96 17 04 ed 22 b3 70 e9 6e 0f 9c a5 7a 2b 88 21 : info 0x74e173ec session_id 0xbeaf request_id 0x44 user 'tsb' response '***' app 0 reason 0 skey 'testvpn' sip 192.168.4.145 type 1 RADIUS packet decode (response) -------------------------------------- Raw packet data (length = 20)..... 03 44 ERROR: Authentication Rejected: AAA failure TSBA6-5520-Int# 00 14 35 f4 1a 63 3a 45 ca bd 4f 52 85 73 | .D..5..c:E..OR.s 5c e2 f2 22 | \.." Parsed packet data..... Radius: Code = 3 (0x03) Radius: Identifier = 68 (0x44) Radius: Length = 20 (0x0014) Radius: Vector: 35F41A633A45CABD4F5285735CE2F222 rad_procpkt: REJECT RADIUS_DELETE remove_req 0x74e172b4 session 0xbeaf id 68 free_rip 0x74e172b4 radius: send queue empty

3 2

FreeRADIUS and databases
by Yann R. Moupinda 22 Nov '12

22 Nov '12

Hi guys, shortly i realized a successful eap-sim authentication test using a simple flat file 'simtriplets.dat' containing the triplets. Now i want let Freeradius to use a mysql database or in best case a sqlite database if possible. The sqlite3 database containing the sim information (triplets) is located on another linux board. Does anybody have any idea how i can manage it? best regards Yann

3 2

rlm_perl without DynaLoader
by Julius Plenz 22 Nov '12

22 Nov '12

Hi, when using rlm_perl with a very simple Perl script that does *not* use DynaLoader to load some *.so files, upon thread exit, FreeRADIUS (current v2.x.x branch) throws errors: Error: Could not get @DynaLoader::dl_librefs for unloading. The errors originate from rlm_perl_get_handles(), which is invoked via pthread_key_create(key, rlm_destroy_perl): https://github.com/FreeRADIUS/freeradius-server/blob/v2.x.x/src/modules/rlm… Adding an (otherwise useless) 'require DynaLoader;' to the Perl script fixes the errors. Why is this an error case, rather than "no libs, no unloading necessary"? Thanks, Julius

2 3

vendor number of dictionary not working
by Meike Stone 22 Nov '12

22 Nov '12

Hello, I try to include a additional dictionary from fdXtended via $INCLUDE /etc/raddb/dictionary.fdXtended in the dirctionary file. I get the error: including dictionary file /etc/raddb/dictionary Errors reading dictionary: dict_init: /etc/raddb/dictionary.fdXtended[1]: dict_init: /etc/raddb/dictionary.fdXtended[1]: dict_init: The file /etc/raddb/dictionary.fdXtended looks like: ======================================== VENDOR fdXtended 34536 BEGIN-VENDOR fdXtended ATTRIBUTE fdXtended-Bandwidth-Up 1 integer ATTRIBUTE fdXtended-Bandwidth-Down 2 integer ATTRIBUTE fdXtended-PostAuthURL 3 string ATTRIBUTE fdXtended-One2onenat-IP 4 string ATTRIBUTE fdXtended-ContentFilter 5 integer ATTRIBUTE fdXtended-NetworkPolicy 6 integer ATTRIBUTE fdXtended-BytesDown 7 integer ATTRIBUTE fdXtended-BytesUp 8 integer ATTRIBUTE fdXtended-Expiration 9 string ATTRIBUTE fdXtended-SessionTimeout 10 integer ATTRIBUTE fdXtended-Wan-Interface 11 string END-VENDOR fdXtended ======================================= The number of the dictionary is reserved by IANA (http://www.iana.org/assignments/enterprise-numbers) and correct. So I tried other numbers and realized, that only numbers are accepted, who are smaller than 2^15. The largest working number is 32766. What is going wrong here? Thanks Meike

2 2

Freeradiux -X tells me it's in use how to get the log back?
by Tzvika Gelber 22 Nov '12

22 Nov '12

I need to see the connection log when users login to the radius i was using freeradius -X and it was working great yesterday it started giving this error : } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 Failed binding to authentication address * port 1812: Address already in use /etc/freeradius/radiusd.conf[240]: Error binding to port for 0.0.0.0 port 1812 how do i free it so i will get the log again? (I am running in superuser mode.) Thank you -- ____ Sometimes you just glow in the dark...

3 2