July 2012 - Freeradius-Users - lists.freeradius.org

Basic freeradius set up problem
by Mik J 13 Jul '12

13 Jul '12

Platform: OpenBSD 5.1 Version: 2.1.12 Hello, I have a problem setting up freeradius and I think it's related to the domain stripping Here's what I did for my configuration 1) Imported the scripts schema.sql, admin.sql, ippool.sql, nas.sql in my MySQL radiusdb database 2) Inserted a user: INSERT INTO radcheck (UserName, Attribute, Value) VALUES ('testuser', 'Password', 'passsecret'); 3) Configured clients.conf client localhost { ipaddr = 127.0.0.1 secret = testing123 require_message_authenticator = no nastype = other # localhost isn't usually a NAS... } 4) Uncommented in radiusd.conf $INCLUDE ${confdir}/sql.conf $INCLUDE ${confdir}/sql/mysql/counter.conf 5) In /etc/raddb/sites-enabled/default uncommented authorize { sql } accounting { sql sql_log } 6) Configured /etc/raddb/sql.conf sql { database = "mysql" driver = "rlm_sql_${database}" #socket= var/run/mysql/mysql.sock server = "localhost" port = 3306 login = "radiususer" password = "passradius" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" deletestalesessions = yes sqltrace = no sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 5 connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 nas_table = "nas" $INCLUDE sql/${database}/dialup.conf } 7) In /etc/raddb/sql/mysql/dialup.conf added sql_user_name = '%{Stripped-User-Name}' 8) I start the radius server # /usr/local/sbin/radiusd -X And make a test on the local machine $ radtest testuser passsecret 127.0.0.1 1812 testing123 And I receive an access reject: rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=222, length=20 9) Le debug says rad_recv: Access-Request packet from host 127.0.0.1 port 10251, id=122, length=78 User-Name = "testuser" User-Password = "passsecret" NAS-IP-Address = 192.168.1.1 NAS-Port = 1812 Message-Authenticator = 0xf16b463a77e5dfefbd9385915a307e88 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: -> [sql] Error generating query; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Invalid user: [testuser] (from client localhost port 1812) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 122 to 127.0.0.1 port 10251 Waking up in 4.9 seconds. Cleaning up request 1 ID 122 with timestamp +74 Ready to process requests. 10) I can see that something goes wrong with this message [sql] Error generating query; rejecting user But I don't understand why Thank you to those who can point the right direction. Regards

4 8

Re: PEAP Password
by Alan Buxey 13 Jul '12

13 Jul '12

No (i'm not even going to ask 'why would you want to do that?') alan

2 1

Re: Help needed configuring MAB on FreeRADIUS and Cisco switch
by Alan Buxey 13 Jul '12

13 Jul '12

If you get no output to screen then it doesn't matter if the RADIUS server config is wrong as you've got problem elsewhere. Ha e you checked your firewall on the server, I don't give answers to be randomly skipped over. To verify you can send radius requests from another computer..eg using radtest, eapol_test or JRADIUSSimulator etc alan -- This sma rtphone uses free WiFi around the world with eduroam, now that's what I call smart.

2 1

PEAP Password
by Carl Pierre 13 Jul '12

13 Jul '12

Hello: I would like to have FreeRADIUS check the user's submitted credentials before it even allows the Tunnel to even be set up. Is this a possibility? Regards, Carl

2 2

Re: Help needed configuring MAB on FreeRADIUS and Cisco switch
by Alan Buxey 13 Jul '12

13 Jul '12

Hi, The very last line of startup output will say Ready to process requests If you get NOTHING else then the server is not getting any packets through to it...which is either something simple such as the built in firewall of cents (edit the firewall using your favourite method to allow UDP 1812 through for RADIUS auth packets), a network issue, (routing, ACLs etc) or a switch configuration issue. alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2

Re: Help needed configuring MAB on FreeRADIUS and Cisco switch
by Alan Buxey 13 Jul '12

13 Jul '12

radiusd -X ...will print all output to the terminal it wad run in. That will show you the workings.... alan

2 1

EAP-SIM configuration on v2.1.12
by Tony Phung 13 Jul '12

13 Jul '12

Hi experts, I am trying to configure eap-sim on and when I start the radiusd process I get the following error: --- Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "sim" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } /usr/local/etc/raddb/radiusd.conf[698]: Failed to link to module 'rlm_sim_files': ld.so.1: radiusd: fatal: rlm_sim_files.so: open failed: No such file or directory /usr/local/etc/raddb/sites-enabled/default[157]: Failed to load module "sim_files". /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. --- Are there anything that I have missed? I have setup the config as follows: The eap modules are present # pwd /usr/local/lib # ls rlm_eap* rlm_eap_gtc-2.1.12.la rlm_eap_leap-2.1.12.so rlm_eap_md5.a rlm_eap_mschapv2.la rlm_eap_sim.so rlm_eap_gtc-2.1.12.so rlm_eap_leap.a rlm_eap_md5.la rlm_eap_mschapv2.so rlm_eap-2.1.12.la rlm_eap_gtc.a rlm_eap_leap.la rlm_eap_md5.so rlm_eap_sim-2.1.12.la rlm_eap-2.1.12.so rlm_eap_gtc.la rlm_eap_leap.so rlm_eap_mschapv2-2.1.12.la rlm_eap_sim-2.1.12.so rlm_eap.a rlm_eap_gtc.so rlm_eap_md5-2.1.12.la rlm_eap_mschapv2-2.1.12.so rlm_eap_sim.a rlm_eap.la rlm_eap_leap-2.1.12.la rlm_eap_md5-2.1.12.so rlm_eap_mschapv2.a rlm_eap_sim.la rlm_eap.so Config files: /usr/local/etc/raddb/radiusd.conf modules { sim_files { simtriplets = "/usr/local/etc/raddb/simtriplets.dat" } /usr/local/etc/raddb/eap.conf eap { sim { } default_eap_type = sim } /usr/local/etc/raddb/sites-enabled/default authorize { sim_files eap { ok = return } } The simtriplets.dat files are located in /usr/local/etc/raddb/ Are there anything that I missed out? Thanks, Tony

2 1

One session per username
by Ali Jawad 12 Jul '12

12 Jul '12

Hi All I have pptpd running with freeradius 2.0, all is fine but I want to limit each client to one session per username. Currently a user can logon using his username and password multiple times. Regards

1 0

EAP session for state problem
by Umut Arus 12 Jul '12

12 Jul '12

Hi, We are using freeradius2-2.1.12-3.el5 on RHEL 5.8 for eduroaming. Sometimes we are getting "EAP session for state ... did not finish!" warning as you can see on case 1. We can successfully login after every three or four tries without error (case 2). How can I overcome this problem? PS: I think it is more problem on windows 7. Case 1: rad_recv: Access-Request packet from host 10.200.0.2 port 32832, id=203, length=238 User-Name = "xxx(a)sabanciuniv.edu.tr" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C659DA0C84D" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x020a002401676f6b68616e67756e796f6c40736162616e6369756e69762e6564752e7472 Aruba-Essid-Name = "eduroam" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0x7bde0503caf078e16964c30bb649186a Thu Jul 12 08:50:06 2012 : Info: server eduroam { Thu Jul 12 08:50:06 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:06 2012 : Info: +- entering group authorize {...} Thu Jul 12 08:50:06 2012 : Info: ++[preprocess] returns ok Thu Jul 12 08:50:06 2012 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:06 2012 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:06 2012 : Info: [auth_log] expand: %t -> Thu Jul 12 08:50:06 2012 Thu Jul 12 08:50:06 2012 : Info: ++[auth_log] returns ok Thu Jul 12 08:50:06 2012 : Info: ++[mschap] returns noop Thu Jul 12 08:50:06 2012 : Info: [suffix] Looking up realm " sabanciuniv.edu.tr" for User-Name = "xxx(a)sabanciuniv.edu.tr" Thu Jul 12 08:50:06 2012 : Info: [suffix] Found realm "sabanciuniv.edu.tr" Thu Jul 12 08:50:06 2012 : Info: [suffix] Adding Stripped-User-Name = "xxx" Thu Jul 12 08:50:06 2012 : Info: [suffix] Adding Realm = "sabanciuniv.edu.tr " Thu Jul 12 08:50:06 2012 : Info: [suffix] Authentication realm is LOCAL. Thu Jul 12 08:50:06 2012 : Info: ++[suffix] returns ok Thu Jul 12 08:50:06 2012 : Info: [eap] EAP packet type response id 10 length 36 Thu Jul 12 08:50:06 2012 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Thu Jul 12 08:50:06 2012 : Info: ++[eap] returns updated Thu Jul 12 08:50:06 2012 : Info: ++[files] returns noop Thu Jul 12 08:50:06 2012 : Info: ++[expiration] returns noop Thu Jul 12 08:50:06 2012 : Info: ++[logintime] returns noop Thu Jul 12 08:50:06 2012 : Info: Found Auth-Type = EAP Thu Jul 12 08:50:06 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:06 2012 : Info: +- entering group authenticate {...} Thu Jul 12 08:50:06 2012 : Info: [eap] EAP Identity Thu Jul 12 08:50:06 2012 : Info: [eap] processing type tls Thu Jul 12 08:50:06 2012 : Info: [tls] Initiate Thu Jul 12 08:50:06 2012 : Info: [tls] Start returned 1 Thu Jul 12 08:50:06 2012 : Info: ++[eap] returns handled Thu Jul 12 08:50:06 2012 : Info: } # server eduroam Sending Access-Challenge of id 203 to 10.200.0.2 port 32832 EAP-Message = 0x010b00061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x470f24c947043df52dda4e1a3d9334ec Thu Jul 12 08:50:06 2012 : Info: Finished request 61. Thu Jul 12 08:50:06 2012 : Debug: Going to the next request Thu Jul 12 08:50:06 2012 : Debug: Waking up in 4.9 seconds. Thu Jul 12 08:50:11 2012 : Info: Cleaning up request 61 ID 203 with timestamp +434 Thu Jul 12 08:50:11 2012 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Thu Jul 12 08:50:11 2012 : Debug: WARNING: !! EAP session for state 0x470f24c947043df5 did not finish! Thu Jul 12 08:50:11 2012 : Debug: WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility Thu Jul 12 08:50:11 2012 : Debug: WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Case2: rad_recv: Access-Request packet from host 10.200.0.2 port 32832, id=215, length=263 User-Name = "xxx(a)sabanciuniv.edu.tr" NAS-IP-Address = 10.200.0.2 NAS-Port = 0 NAS-Identifier = "10.200.0.2" NAS-Port-Type = Wireless-802.11 Calling-Station-Id = "1C659DA0C84D" Called-Station-Id = "000B8661DFC4" Service-Type = Login-User Framed-MTU = 1100 EAP-Message = 0x0216002b190017030100205cd73791c5a16b72af7729c38c0070ead9b5365d5c59a3cbf94d2d04ab1c88f0 State = 0x933acfe09a2cd6ffa50d9682f870ed3a Aruba-Essid-Name = "eduroam" Aruba-Location-Id = "BM_IT_Net_Sys_3c:02" Aruba-Attr-10 = 0x424d5f62696e617369 Message-Authenticator = 0xee1ce87a79d10bcd3aab616fdf41e564 Thu Jul 12 08:50:20 2012 : Info: server eduroam { Thu Jul 12 08:50:20 2012 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:20 2012 : Info: +- entering group authorize {...} Thu Jul 12 08:50:20 2012 : Info: ++[preprocess] returns ok Thu Jul 12 08:50:20 2012 : Info: [auth_log] expand: /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:20 2012 : Info: [auth_log] /var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radius/radacct/10.200.0.2/auth-detail-20120712 Thu Jul 12 08:50:20 2012 : Info: [auth_log] expand: %t -> Thu Jul 12 08:50:20 2012 Thu Jul 12 08:50:20 2012 : Info: ++[auth_log] returns ok Thu Jul 12 08:50:20 2012 : Info: ++[mschap] returns noop Thu Jul 12 08:50:20 2012 : Info: [suffix] Looking up realm " sabanciuniv.edu.tr" for User-Name = "xxx(a)sabanciuniv.edu.tr" Thu Jul 12 08:50:20 2012 : Info: [suffix] Found realm "sabanciuniv.edu.tr" Thu Jul 12 08:50:20 2012 : Info: [suffix] Adding Stripped-User-Name = "xxx" Thu Jul 12 08:50:20 2012 : Info: [suffix] Adding Realm = "sabanciuniv.edu.tr " Thu Jul 12 08:50:20 2012 : Info: [suffix] Authentication realm is LOCAL. Thu Jul 12 08:50:20 2012 : Info: ++[suffix] returns ok Thu Jul 12 08:50:20 2012 : Info: [eap] EAP packet type response id 22 length 43 Thu Jul 12 08:50:20 2012 : Info: [eap] Continuing tunnel setup. Thu Jul 12 08:50:20 2012 : Info: ++[eap] returns ok Thu Jul 12 08:50:20 2012 : Info: ++[files] returns noop Thu Jul 12 08:50:20 2012 : Info: ++[expiration] returns noop Thu Jul 12 08:50:20 2012 : Info: ++[logintime] returns noop Thu Jul 12 08:50:20 2012 : Info: Found Auth-Type = EAP Thu Jul 12 08:50:20 2012 : Info: # Executing group from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:20 2012 : Info: +- entering group authenticate {...} Thu Jul 12 08:50:20 2012 : Info: [eap] Request found, released from the list Thu Jul 12 08:50:20 2012 : Info: [eap] EAP/peap Thu Jul 12 08:50:20 2012 : Info: [eap] processing type peap Thu Jul 12 08:50:20 2012 : Info: [peap] processing EAP-TLS Thu Jul 12 08:50:20 2012 : Info: [peap] eaptls_verify returned 7 Thu Jul 12 08:50:20 2012 : Info: [peap] Done initial handshake Thu Jul 12 08:50:20 2012 : Info: [peap] eaptls_process returned 7 Thu Jul 12 08:50:20 2012 : Info: [peap] EAPTLS_OK Thu Jul 12 08:50:20 2012 : Info: [peap] Session established. Decoding tunneled attributes. Thu Jul 12 08:50:20 2012 : Info: [peap] Peap state send tlv success Thu Jul 12 08:50:20 2012 : Info: [peap] Received EAP-TLV response. Thu Jul 12 08:50:20 2012 : Info: [peap] Success Thu Jul 12 08:50:20 2012 : Info: [peap] Using saved attributes from the original Access-Accept Cisco-AVPair = "ssid=sunet-staff-wpa2" User-Name = "xxx" Thu Jul 12 08:50:20 2012 : Info: [eap] Freeing handler Thu Jul 12 08:50:20 2012 : Info: ++[eap] returns ok Thu Jul 12 08:50:20 2012 : Info: # Executing section post-auth from file /etc/raddb/sites-enabled/eduroam Thu Jul 12 08:50:20 2012 : Info: +- entering group post-auth {...} Thu Jul 12 08:50:20 2012 : Info: ++[exec] returns noop Thu Jul 12 08:50:20 2012 : Info: } # server eduroam Sending Access-Accept of id 215 to 10.200.0.2 port 32832 Cisco-AVPair = "ssid=sunet-staff-wpa2" User-Name = "xxx" MS-MPPE-Recv-Key = 0xaea8b6a844f0e161871649d32f4ead36d6441f8b878fe3e4052b2eb5a2ea7346 MS-MPPE-Send-Key = 0xb17c40cb6eed240c390bbe4ffbbe3ee66d5244b2b6390c3e2fe11844b239e89c EAP-Message = 0x03160004 Message-Authenticator = 0x00000000000000000000000000000000 Thu Jul 12 08:50:20 2012 : Info: Finished request 72. Thu Jul 12 08:50:20 2012 : Debug: Going to the next request Thu Jul 12 08:50:20 2012 : Debug: Waking up in 3.2 seconds. Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 62 ID 205 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 63 ID 206 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 64 ID 207 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 65 ID 208 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 66 ID 209 with timestamp +446 Thu Jul 12 08:50:23 2012 : Info: Cleaning up request 67 ID 210 with timestamp +446 Thu Jul 12 08:50:23 2012 : Debug: Waking up in 1.6 seconds. Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 68 ID 211 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 69 ID 212 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 70 ID 213 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 71 ID 214 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Cleaning up request 72 ID 215 with timestamp +448 Thu Jul 12 08:50:25 2012 : Info: Ready to process requests. thanks,

1 0

PEAP/EAP_GTC
by Carl Pierre 12 Jul '12

12 Jul '12

Hello: Are there any clients that actually display the EAP-GTC challenge? Essentially, I am trying to use EAP-GTC similarly to how PAP Access-Challenge works: Client: -------User/Pass---------------->Server Client: <--Challenge Message---------Server Client: -------Challenge Response--->Server Client: <-------Accept------------------>Server So far, I cannot seem to find documentation to suggest that I CANNOT do this, and the spec suggests that I can, but I cannot seem to find anything that will do this. In addition, are there any resources that thoroughly documents EAP-GTC? The RFCs do not provide much information. Regards.

4 3