May 2012 - Freeradius-Users - lists.freeradius.org

Multiple Realms
by Shawky Skaff 23 May '12

23 May '12

Hi, I have spent some time reading and trying to configure multiple realms to no avail. Basically I currently have one active realm and need to have another realm configured onto the same radius box. For example dsl.example.com.au is one and voice.example.com.au is the second. How can I configure the second? I know it's somewhat to do with proxy.conf file, but not sure how or where to do this. Thanks

2 1

User management hints
by Germano Paciocco 22 May '12

22 May '12

Hi everyone. I'm new to Freeradius, and I would like to write a very simple user management php/mysql script, that should allow me to do some simple things: 1) create a user; 2) set expire date for a user; 3) disable user, automatically at expire date or manually if needed. I installed successfully freeradius with mysql on a debian box and tested a new user with radtest. I also began to study sql schema, but I can't find many information on internet about it. Can anyone you suggest me some good documentation, just to begin? Thank you very much. Regards. -- GP

2 1

How to proxy according to attribute value?
by mimir 22 May '12

22 May '12

Hello, I want to proxy accounting packets according to Calling-Station-Id attribute. I first think that I must use keyed-balance method for this. I set realm as below: home_server_pool vas1 { type = keyed-balance home_server = vas1 ---> I want to send acct pkgs with calling-st-id like 1234% home_server = vas2 ----> I want to send acct pkgs with calling-st-id like 0000% } I added Load-Balance key definition in control statement. preacct { preprocess update control { Load-Balance-Key = "%{Calling-Station-Id}" Proxy-To-Realm := VAS1 } ..... but, I could not find how to differentiate the key, and select the home_server. can you please help on this issue? I am on a wrong way ? Thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/How-to-proxy-according-to-attribute… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 4

Escaped backslash in User-Name when sending Access-Accept
by Roberto Franceschetti 22 May '12

22 May '12

Hi, I'm having some issues authenticating iOS clients (with FreeRADIUS v2.1.10 installed on a Ubuntu server) with EAP-TLS when the username contains a domain name in the form of Domain\Username (the account is in Active Directory). I think the issue is caused by the fact that the final Access-Accept reply has the backslash after the domain name escaped, so that the output looks like this: Sending Access-Accept of id 171 to 172.27.28.84 port 32769 User-Name = "ocg\\cmctrf3" instead of containing the original, un-escaped domain\username: Sending Access-Accept of id 171 to 172.27.28.84 port 32769 User-Name = "ocg\cmctrf3" Mine is just a theory, but I cannot verify it until I figure out how to have the un-escaped ocg\cmctrf3 string being sent in the output instead of the current escaped one. So my question is "how do I cause the User-Name to be send un-escaped? Do I make a change in the clients.con file...? The eap.conf file...? If so, under which section and where..? Sorry for what may look like a dumb question, but I could not find this mentioned anywhere else. As a side-note, if I omit the domain name in the iOS device and just login with the username "cmctrf3" for example, the iPhones/iPads are able to login without problems. The issue only occurs when the domain name appears before escaped. All other devices (Windows and Mac desktops) seem to be able to get past that escaped sequence without problems. Below is a blurb showing the debug output. I do see the un-escaped ocg\cmctrf3 being logged, but the escaped one at the end is what is porbably biting me. Thanks, Roberto Franceschetti # Executing section authorize from file /etc/freeradius/clients.conf +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "ocg\cmctrf3", skipping NULL due to config. ++[suffix] returns noop [ntdomain] Looking up realm "ocgov" for User-Name = "ocg\cmctrf3" [ntdomain] No such realm "ocgov" ++[ntdomain] returns noop ++[mschap] returns noop [eap] EAP packet type response id 10 length 43 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/freeradius/clients.conf +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [ocg\\cmctrf3] (from client 172.27.28.84 port 29 cli f0-cb-a1-2b-61-4d) # Executing section post-auth from file /etc/freeradius/clients.conf +- entering group post-auth {...} ++[exec] returns noop } # server lwap-clients Sending Access-Accept of id 171 to 172.27.28.84 port 32769 MS-MPPE-Recv-Key = 0x15c9ba070e3579e43c54314c24e7e09f4753c779e4e013b4bbd080a2cab4bbb2 MS-MPPE-Send-Key = 0x4f27c90c8fdf27be122e70c2c4d82bebd65797dafebe2ebb4ca91bedfd244cb5 EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ocg\\cmctrf3" PLEASE NOTE: Florida has a very broad public records law (F. S. 119). All e-mails to and from County Officials are kept as a public record. Your e-mail communications, including your e-mail address may be disclosed to the public and media at any time.

3 2

Test Client which supports PAP Access-Challenge
by Thomas Glanzmann 21 May '12

21 May '12

Hello, I'm interested in a radius test client which supports pap ACCESS-Challenge. Can anyone point me to one or to a library which allows me to easily write on preferrably in perl? Cheers, Thomas

2 6

2 Certs for 2 SSID (802.1x)
by C.F. Yeung 21 May '12

21 May '12

We have 2 SSL Certs for two SSID (802.1x). How can my freeradius server present wifi clients the cert based on SSID? Should I have two eap.conf? Thanks, CF

4 10

Using attibutes
by Emmanuel BILLOT 21 May '12

21 May '12

Hi, Our WIFI access is managed by EAP-TTLS/EAP-PEAP with radius authentication based on LDAP. So users can connect and use Internet, however is possible to limit access (bandwith, connecting time) with Freeradius ? In other words, it seems (maybe i'm wrong) that Freeradius can send attribut with values when answering with Access Accept packet. I guess that clients have to understand it for being effective right ? So when using access point with EAP protocol, i guess native EAP client have to be compatibe with an attribut list ? This behaviour seems to be implemented in captive portal, and attributes can be managed in portal configuration. Is it possible with EAP access (native client or secure w2 like ?) BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 4

Re: PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
by Bruce Nunn 19 May '12

19 May '12

For my installations I've disabled the EAP cache to make things work better. Only a few users noticed. Does anyone know if the same thing happens In the 3.0 branch? I was planning to put one of my production servers on the 3.0 code this Summer. Alan DeKok <aland(a)deployingradius.com> wrote: >Phil Mayers wrote: >> Am I being dumb / getting something wrong or does the post-auth session >> not get called if PEAP/MSCHAP returns a reject? >> >> It seems to run for successful auths, but not failures. > > That is the case. > >> This is in the context of us not seeing log messages for EAP auth >> failures; I suspect that the client may just "hang up" and let the EAP >> session expire, and since the inner post-auth doesn't run, and the outer >> session expires, I have no logs. > > There was talk about getting it to do Post-Auth-Type Reject in the >inner tunnel. No code yet, tho. > > Alan DeKok. >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

FreeRadius proxy to MS-NPS for MSCHAPv2 authentication.
by Jan Hugo Prins 19 May '12

19 May '12

Hi, This last week I have been setting up my Aruba environment authenticating users that are in OpenLDAP and all have a Windows Password etc. This installation worked straight out of the box and the part that took most of the time was making a clean setup that I can copy paste to other installations etc and getting to know unlang. So far so good. Now the next question is our partner that is a full M$ shop. They have a Windows ADS environment and all windows users. My first idea was to use proxy.conf to proxy all users with a username of user(a)domain.com to the MS-NPS server on the Windows ADS. Is this going to work with MSCHAPv2 authentication? I would expect so. If this is going to work my next problem is adding some things to access-accept replies. I need to add: Aruba-User-Vlan = <vlanid> Aruba-User-Role = <authenticated-role> The first one is to set the proper VLAN and the second one is to move the user to an authenticated role of this M$-Shop. Can this be done somewhere in the proxy.conf on the proxy-reply? I really don't want to install Samba on the FreeRadius server and make it authenticate to the ADS, this is because it doesn't scale on the long run if you need to authenticate to more then one ADS environment. I also read that their are some issues with the radius packets that are accepted by the MS-NPS server, with the risk that the packets are dropped at the MS-NPS side. Does someone have a overview of what should be in the radius packets and what should not be in them? Thanks a lot, Jan Hugo Prins

3 5

PEAP/MSCHAP doesn't run post-auth in inner-tunnel for reject?
by Phil Mayers 19 May '12

19 May '12

Am I being dumb / getting something wrong or does the post-auth session not get called if PEAP/MSCHAP returns a reject? It seems to run for successful auths, but not failures. This is in the context of us not seeing log messages for EAP auth failures; I suspect that the client may just "hang up" and let the EAP session expire, and since the inner post-auth doesn't run, and the outer session expires, I have no logs. This is in 2.1.12

3 3