July 2012 - Freeradius-Users - lists.freeradius.org

a question about the connection to the server
by Andreas Meyer 04 Jul '12

04 Jul '12

Hello! If some machine is in the same subnet as the radiusd and the AP, how do I prevent it from sniffing the secret for authentication to the server? Regards Andreas

2 1

two freeradius + 1 db server
by Tiago 03 Jul '12

03 Jul '12

Hello again, I'm building a scenario that initially should have: - two redundant freeradius - one mysql server (soon will be a clustered server) Should I be aware of something? I mean if requests goes to both servers, one specific customer auth session will be handled only by that specific freeradius server that received the request? I'm concerned to avoid any kind of inconsistency on my db data. Thanks

1 0

Stuck on very basic freeradius setup
by Tiago 03 Jul '12

03 Jul '12

Hello, I've just installed freeradius 2.x on an ubuntu server 12.04 with apt-get. I've follow documentation and I'm stuck on a very basic setup (pap auth). Basically I'm testing the default config using the users file to test auth with radtest. So, here is the thing: *users file - first line: teste Cleartext-Password:="teste"* I'm running freeradius on debug mode, here is the error log: rad_recv: Access-Request packet from host 127.0.0.1 port 38134, id=101, length=57 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 201.x.x.x NAS-Port = 0 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "teste", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry teste at line 1 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} *[pap] login attempt with password "teste" [pap] No password configured for the user. Cannot do authentication* *++[pap] returns fail Failed to authenticate the user.* Login incorrect: [teste/teste] (from client localhost port 0) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> teste attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated.... My radtest command: radtest teste teste 127.0.0.1 0 testing123 Ok, is that so obvious that I'm blind? Is there pap auth looking for another file instead users file? What am I missing? Thanks people.

5 11

Authenication with certifiactes
by Andreas Meyer 03 Jul '12

03 Jul '12

Hello! # radiusd -v radiusd: FreeRADIUS Version 2.1.9, for host i686-pc-linux-gnu I could need some help with authenticating users per certificate to a freeradius server. I created the certificates and copied the ca.pem the testing supplicant. Startet freeradius with radius -X and a local executed radtest miles davis45 192.168.1.220 1812 testing123 gives this result: Sending Access-Request of id 206 to 192.168.1.220 port 1812 User-Name = "miles" User-Password = "davis45" NAS-IP-Address = 192.168.3.1 NAS-Port = 1812 rad_recv: Access-Accept packet from host 192.168.1.220 port 1812, id=206, length=20 I have this in the sqltrace.sql then: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'miles', 'davis45', 'Access-Accept', '2012-07-02 19:31:45'); I tried all kind of settings on the supplicant but I cannot get access using the ca.pem and get no lease from the DHCP-Server of the AP, TL-WA901ND I post the following output of a radius -X session: rad_recv: Access-Request packet from host 192.168.1.254 port 2048, id=155, length=153 User-Name = "andreas" NAS-IP-Address = 192.168.1.254 NAS-Port = 0 Called-Station-Id = "B0-48-7A-F8-A1-19:gehackt" Calling-Station-Id = "00-22-B0-E7-EF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200000c01616e6472656173 Message-Authenticator = 0xcfc9907d0444926482192aafdcaba630 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "andreas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> andreas [sql] sql_set_user escaped user --> 'andreas' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'andreas' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'andreas' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'andreas' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'andreas' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'andreas' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'andreas' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 155 to 192.168.1.254 port 2048 EAP-Message = 0x010100160410627ca484105a5653ea83eec8c11115b0 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0f58029d0f5906e7a9d59b95861c72dd Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.254 port 2048, id=156, length=165 User-Name = "andreas" NAS-IP-Address = 192.168.1.254 NAS-Port = 0 Called-Station-Id = "B0-48-7A-F8-A1-19:gehackt" Calling-Station-Id = "00-22-B0-E7-EF-98" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020100060315 State = 0x0f58029d0f5906e7a9d59b95861c72dd Message-Authenticator = 0x764f23c23137bd2125a294f54ca21ac1 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "andreas", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [sql] expand: %{User-Name} -> andreas [sql] sql_set_user escaped user --> 'andreas' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'andreas' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'andreas' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'andreas' ORDER BY id rlm_sql_mysql: query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'andreas' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'andreas' ORDER BY priority rlm_sql_mysql: query: SELECT groupname FROM radusergroup WHERE username = 'andreas' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 156 to 192.168.1.254 port 2048 EAP-Message = 0x010200061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0f58029d0e5a17e7a9d59b95861c72dd Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 155 with timestamp +25 Cleaning up request 1 ID 156 with timestamp +25 Ready to process requests. Can somebody help and tell me what to look for next? Thank you for every hint! Andreas

5 8

Freeradius and Zone Director
by Andrew Andonopoulos 02 Jul '12

02 Jul '12

Hello to all, I have a problem with the freeradius and the Zonedirector. I am using MySql tables to store the radrequest and radreply also the Nas tables. If i connect a cat5 cable to the core switch i am getting an IP from the correct Vlan. If i use the zone director i can't authenticate and get the correct ip. I read somewhere that Ruckus Zonedirector is using chap and freeradius pap and chap but i am not sure if that's the issue. The zonedirector and the Access points are connected with trunk ports. I am wondering if someone faced the same problem and give me some ideas. RegardsAndrew p.s attached file have the logs from the freeradius

2 6

Query regarding running radexample to connect to radiusd server over ipv6
by Harshit Shah 02 Jul '12

02 Jul '12

Hello, I have configured my server to run radius on ipv6 and I was also able to successfully connect to radius server using radclient binary on my client machine. I installed radiusclient as well my machine and I am trying to run radexample to login to radius server over ipv6, however I am not able to connect to it over ipv6. I was able to connect to radiusserver using ipv4 through radexample. Can anyone help me out with this? What all options shall I check to proceed further with this? Regards, Harshit

1 0

FreeRADIUS SQl Ippool problem -
by Taz Manian 01 Jul '12

01 Jul '12

Hi Guys, Im having a problem with Ippools with freeradius2 and i cant seem to get any username to get an address from the pool.90% of the usernames will have static IP's but i want a few to be in a pool but i really am stumped - i tried putting username@realm Framed-Pool := EZPOOL into the radreply section and it gives me a reply when i test it # Standard Framed-Pool "EZPOOL" so i know is readying that - i then have a pool set up in radippool pool_name=EZPOOLFramedIPAddress=192.168.1.200 (i have more) and my radiusd -X reply is : # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "1111111" [pap] Using clear text password "1111111" [pap] User authenticated successfully ++[pap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} [sql] expand: %{User-Name} -> user@realm [sql] sql_set_user escaped user --> 'username@realm' [sql] expand: %{User-Password} -> 1111111 [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'username@realm', '1111111', 'Access-Accept', '2012-06-28 10:59:37') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'username@realm', '1111111', 'Access-Accept', '2012-06-28 10:59:37') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 51 to 192.168.1.100 port 52433 Framed-Pool := "EZPOOL" Cisco-AVPair := "lcp:interface-config=ip vrf forwarding BLAH" Cisco-AVPair += "lcp:interface-config=ip unnumbered Loopback1" Cisco-AVPair += "lcp:interface-config=mtu 1492" Service-Type := Framed-User Framed-Protocol := PPP Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 51 with timestamp +5 Ready to process requests.

5 18