April 2012 - Freeradius-Users - lists.freeradius.org

Configuring freeradius for MACsec
by Matija Levec 03 May '12

03 May '12

Hello everyone, I'm trying to configure MACsec (per http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6638/de… ) in a test lab using cisco supplicant & switch and freeradius 2.1.12. Cisco docs say: "The CAK is delivered in the RADIUS vendor-specific attributes (VSAs) MS-MPPE-Send-Key and MS-MPPE-Recv-Key." "...authentication server sends an EAP key identifier that is derived from the EAP exchange and is delivered to the authenticator in the EAP Key-Name attribute of the Access-Accept message." With successful EAP-TLS authentication the Access-Accept message sent from freeradius looks like this: Sending Access-Accept of id 37 to 10.20.64.9 port 1645 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "123" MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03640004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" What should be configured for radius to also send EAP-Key-Name AVP? Kind regards, Matija Levec

5 6

Multi-valued LDAP attribute
by Adam Track 02 May '12

02 May '12

Hi All, In a continuation to my previous issue about how to reference an LDAP attribute in post-auth, I am now wondering how to iterate through a multi-valued attribute in a perl script I call from post-auth. In the debug you can see all three values are returned: ... [ldap] looking for reply items in directory... [ldap] personType -> Person-Type = "employee" [ldap] personType -> Person-Type = "fulltime" [ldap] personType -> Person-Type = "it" ... The perl module currently has the following code because I can't seem to be able to get any result other than the first, ie "employee", and I really need the other two (possibly more) to do a proper VLAN assignment: while (($att,$val) = each(%RAD_REPLY)){ if ($att =~ 'Person-Type'){ $count++; if ($count == 1){ $one = $val; } else { $two = $val; } } } $RAD_REPLY{'Reply-Message'} = "Total: $count, first: $one, second: $two."; The results are: ... Reply-Message = "Total: 1, first: employee, second: ." ... I'm no perl expert, but shouldn't I be able to reference all three values with $RAD_REPLY{'Person-Type'}? If not, where are the other values being stored? I read from the archives that this can be done with 3.X and foreach using unlang, but I'm stuck with 2.1.10 at the moment. Or, do multi-valued attributes need to be defined another way? Thanks, A.

2 5

Using rlm_caching: rejects on cached requests
by Jeroen Scheerder 01 May '12

01 May '12

Hi, We have a SSL-VPN client that authenticates in two stages. When using authentication with RSA OTP tokens, the second request is considered to be a replay by the RSA server, and denied for that reason. The authentication itself is handled by proxy through a Freeradius server (2.1.12 with experimental modules). What I'd like to acomplish is: - Cache authentication requests - Uncached or expired requests are passed on to the proxy - Cached authentication requests are handled (within the specified TTL) I've set up caching, and I see some of it working. From the debug output, I see this for the first request: ---- Snip ---- +- entering group authorize {...} [preprocess] expand: %{User-Name} -> js [preprocess] hints: Matched DEFAULT at 80 [preprocess] expand: on2it-%{User-Name}(a)rsa.on2it.net -> on2it-js(a)rsa.on2it.net ++[preprocess] returns ok [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: Searching the database for key 'on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: Could not find the requested key in the database. rlm_caching: Cache Queries: 4, Cache Hits: 0, Hit Ratio: 0.00% […] [then we see the proxy request being handled, successfully] […] +- entering group post-auth {...} ++[exec] returns noop rlm_caching: Found Auth-Type, value: '' [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: VP=Class,VALUE=default_group,length=38,cache record length=39, space left=711 rlm_caching: Storing cache for Key='on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: New value stored successfully. ++[caching] returns ok Sending Access-Accept of id 69 to 127.0.0.1 port 18782 Class = 0x64656661756c745f67726f757000 ---- pinS ---- This all seems more or less plausible, except for "Found Auth-Type, value: ''" For the second request (fired within a few seconds), I see: ---- Snip ---- Executing section authorize from file /root/etc/raddb/sites-enabled/default +- entering group authorize {...} [preprocess] expand: %{User-Name} -> js [preprocess] hints: Matched DEFAULT at 80 [preprocess] expand: on2it-%{User-Name}(a)rsa.on2it.net -> on2it-js(a)rsa.on2it.net ++[preprocess] returns ok [caching] expand: %{User-Name}:%{User-Password}:%{NAS-IP-Address} -> on2it-js@rsa.on2it.net:480378:172.17.202.55 rlm_caching: Searching the database for key 'on2it-js@rsa.on2it.net:480378:172.17.202.55' rlm_caching: Key Found. rlm_caching: VP='Class',VALUE='default_group',lenth='14',cache record length='39' rlm_caching: Adding Auth-Type '' rlm_caching: Cache Queries: 5, Cache Hits: 1, Hit Ratio: 20.00% ++[caching] returns ok Found Auth-Type = Local WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. No "known good" password was configured for the user. As a result, we cannot authenticate the user. Failed to authenticate the user. Using Post-Auth-Type Reject ---- pinS ---- So I'm getting a Reject for a cached Accept, in effect, and that seems to be due to the Auth-Type. This happens equally for non-proxied requests, i.e. with the following entry in "users": testing Cleartext-Password := "password" User-Name = "%{User-Name}", NAS-IP-Address = "%{NAS-IP-Address}" What am I missing, and what can I do to get cached authentication requests handled? TIA, JS. -- Jeroen Scheerder ON2IT B.V. Steenweg 17 B 4181 AJ WAARDENBURG T: +31 418-653818 | F: +31 418-653716 W: www.on2it.net | E: Jeroen.Scheerder(a)on2it.net Premier Business Partner - IBM | Reseller of the Year 2011 - Palo Alto Networks

4 8

RE2: Log-rotation FeeBSD 8.2
by newuse＠qip.ru 30 Apr '12

30 Apr '12

> You need to HUP the server to get it to re-open the logs. This is > normal daemon behavior. > > Alan DeKok. Thanks, but why I can clean logs via echo command without restart? Could the same behavior be implemented to auto-rotation of FR2 logs?

2 1

Log-rotation FeeBSD 8.2
by newuse＠qip.ru 30 Apr '12

30 Apr '12

Hi all, something strange: I am trying to setup newsyslog to rotate logs of FreeRADIUS 2.1.11 my setup string is looking like [code] /var/log/radius.log freeradius:freeradius 644 7 5 * Z [/code] but after rotation no logs are writing to /var/log/radius.log until restarting freeradius But if I just run echo "" > /var/log/radius.log all logs are clean and writing well What am I doing wrong? -- Best regards, NewUse.

4 4

Restart service of Radius
by Sharad P 30 Apr '12

30 Apr '12

After the changes are made in config files (user.conf), Radius server needs to be restarted. Is there any way that Radius server will fetch the changed configurations without restarting the Radius server? Thanks, Sharad Panicker. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Restart-service-of-Radius-tp5675936… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

Maximum limit for clients.
by Sharad P 30 Apr '12

30 Apr '12

Hi, I have been using Radius server downloaded from freeradius.net website from quite a long time. For creating user id and password required for my clients to authenticate with my radius server, I usually configure user id and password using following command in user.conf file present in radius server. <user id> Cleartext-Password := "<password>" My queries are listed below. 1. I wanted to know whether, there is any limit for such configurations? How many user id's and password can be added to the file? 2. If we want to increase the limit, then what are the available options? 3. What is the normal CPU and memory usage of device where Radius server is installed and running? And what is the usage when maximum clients try to authenticate with the Radius. Thanks in advance. Regards, Sharad Panicker. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Maximum-limit-for-clients-tp5675649… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 5

Question: which 3rd party CA for EAP
by Uwe Kastens 30 Apr '12

30 Apr '12

Hi, We are trying to setup eap for different mobile devices. We don't need certificates for each user, we want to authorize againt the radius with username and password only. With self signed certificates its working if the mobile devices installs the root ca certifcate. We tried several 3rd party certificates: StartSSL, united ssl, godaddy, test certificates from thawte. Apple and windows clients are claiming, that the certificate is not trusted. Has anybody a working solution with 3rd party certificates and can tell us which certifcate could be used and what needs to be configured in eap.conf? Kind Regards Uwe

2 1

newbiie
by Khapare Joshi 29 Apr '12

29 Apr '12

I am just a new with freeradius. so please consider. This is what I am trying to do today. 1. installed pptpd server on centos 6 box, tested with chap-secert password and worked. 2. installed freeradius server to handle stuff like ip pool and authenticaton, and integrate with my existing openldap server for authentication. 3. I looked at the /etc/raddb/radiusd.conf but I do not see the the LDAP section 4. how can I integrate the my freeradius server to hook up with ldap server ? I followed this doc but got stucked. I am nearly there I think wiki.freeradius.org/PopTop any help, guide or tips would be great help. here are my versino of freeradius Installed Packages Name : freeradius Arch : x86_64 Version : 2.1.10 Release : 5.el6 Size : 5.5 M and client Installed Packages Name : radiusclient-ng Arch : x86_64 Version : 0.5.6 Release : 5.el6 Size : 102 k Repo : installed >From repo : epel Tell me what I am missing! Khapare

6 15

Re: Autoconf in Ubuntu
by newuse＠qip.ru 29 Apr '12

29 Apr '12

Thanks, but I really need the working autoconf: I am patching very old billing system: freenibs-2.2.3, it is rlm_sql-based module, so it seems working with new FR 2.x yet, but every new version of FR I need manually regenerate src/modules/rlm_nibs/rlm_nibs_mysql/configure from src/modules/rlm_nibs/rlm_nibs_mysql/configure.in and then patch src/modules/rlm_nibs/rlm_nibs_mysql/configure instead of just regenerating it.... my patches are available at http://forum.netbynet.ru/index.php?act=attach&type=post&id=67866 >> Hi all, it seems to be very old trouble, but I am not able to resolve it, I am regenerating src/modules/rlm_sql_mysql/configure >Why? >> Could you please help me to resolve trouble, btw, in FreeBSD ports all is OK, I have tried to find a patch of configure.in in my FreeBSD system, but failed (I am new to programming) >Don't break the software. >The "configure" scripts work. If you're new to programming, you have no business changing them. >Alan DeKok.

2 1