August 2012 - Freeradius-Users - lists.freeradius.org

Question setting up Virtual Servers with unique clients / users files.
by Zach Simpson 31 Aug '12

31 Aug '12

Hi, I'm relatively new to FreeRADIUS, and I'm working on moving the administrative logins of our network devices (switches, routers, etc) to it. I was planning on using AD as my data source and creating groups (ex. Switches, Routers) so people could easily be assigned permissions for the various devices. I believe I have the AD/Ldap Group retrieval parts working. What I'm having issues with is creating user file rules for each group of devices. I have a few rules in the users file that look like this: DEFAULT Ldap-Group == "Switch Admins" Reply-Message = "Welcome Switch Admin!" DEFAULT Ldap-Group == "Router Admins" Reply-Message = "Welcome Router Admin!" But the issue is that if a user is a member of both groups, it stops at the first match. Is there a way to specify a specific "users" file for each entry in the "Clients" file? I'm thinking that to do this I will need to setup a virtual server for each client group, but I'm not finding much in the ways of sample configurations that let me specify the "users" file as well. Thanks, Zach

3 3

Log rotation
by Antonio Modesto 31 Aug '12

31 Aug '12

Hi, Today I'm rotating my log files with a script that runs every night, the problem is that it must stop the radiusd process, rename the file, create a new one then start radiusd again. Is there a way to do that transparently? Via syslog or something else? Regards.

4 5

RE: Integration with CISCO Router for PEAP requests
by Andras Ionut 31 Aug '12

31 Aug '12

Hi Phil, Sorry if this looks dump for you. I've read your post the reason I've explicitely asked how to do this in PEAP is because in the post it says: "This only works for PAP, and does NOT work for EAP-TLS, CHAP, *MSCHAP*, or WIMAX authentication." Now, I especially need to send Access-Accept for PEAP with inner EAP-MSCHAPv2, and I also I don't use MyQL to select the users. I've also tried to set Access-Accept as any other AVP from my Freeradius module, but doesn't work. (extract from log attached) Can you please help? Thanks in advance. Andras On 30/08/12 15:11, Andras Ionut wrote: > Hi Phil, > > Thanks a lot for the quick response. > > I need this for PEAP with EAP protocol inside the tunnel, like EAP-MSCHAPv2. > > Again, The device MUST reject the connection as EAP is not completed, > but the ROUTER needs that Access-Accept, > in order to be able to redirect user to portal. > > Can this be done? The technique to do this is described in the FAQ entry I linked. Did you read it?

3 3

(no subject)
by QASIM RAO 31 Aug '12

31 Aug '12

sir,actual problem is when i run with 'radiusd' log file save on location i defined in radiusd.conf prefix = /usr/localexec_prefix = ${prefix}sysconfdir = ${prefix}/etclocalstatedir = ${prefix}/varsbindir = ${exec_prefix}/sbinlogdir = ${localstatedir}/log/radius but when i run radius with 'radiusd -X' i save on location defined in radiusd.dat echo -n $"Starting $prog:" cd $binfolder daemon ./radiusd > /var/log/radius`date '+%Y%m%d'`.log & RETVAL=$? sleep 2 i want to save log file on same location in both cases... please help me in this Thanx..

2 1

rlm_perl and dynamic_clients
by Steven Eksteen 31 Aug '12

31 Aug '12

Hi, I was wondering how would I use "Packet-Src-IP-Address" using Perl for Dynamic Clients. I thought it might be part of the RAD_REQUEST hash. If some direction could be made as to setting "FreeRADIUS-Client-Shortname", "FreeRADIUS-Client-Secret", etc. too I would be very grateful. I already have Perl working for the normal AAA functions. This just doesn't appear to work the same way. I am not a Perl developer in the slightest so apologies in advance if this is a monumentally stupid question. Thank you --- FreeRADIUS Version 2.1.10, for host x86_64-redhat-linux-gnu --- client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 3600 } server dynamic_client_server { authorize { dynamic-clients-pl } } --- use strict; use Data::Dumper; use vars qw(%RAD_REQUEST); use constant RLM_MODULE_REJECT => 0; use constant RLM_MODULE_FAIL => 1; use constant RLM_MODULE_OK => 2; use constant RLM_MODULE_HANDLED => 3; use constant RLM_MODULE_INVALID => 4; use constant RLM_MODULE_USERLOCK => 5; use constant RLM_MODULE_NOTFOUND => 6; use constant RLM_MODULE_NOOP => 7; use constant RLM_MODULE_UPDATED => 8; use constant RLM_MODULE_NUMCODES => 9; sub authorize { &log_request_attributes; return RLM_MODULE_FAIL; } sub log_request_attributes { for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } --- rad_recv: Access-Request packet from host 41.132.69.140 port 51951, id=31, length=212 server dynamic_client_server { } # server dynamic_client_server Ignoring request to authentication address * port 1812 as server r9 from unknown client 41.132.69.140 port 51951 Ready to process requests. ---

2 4

rlm_radutmp Logout entry for NAS has wrong ID
by Robertson, Joshua A. 30 Aug '12

30 Aug '12

I recently setup two FreeRADIUS servers and have them set as primary/secondary on Cisco WiSM2 wireless controllers. On one of the two FreeRADIUS servers everything's going great and I see the logins flying by in the logs, however on the other FreeRADIUS server I keep seeing the following in the logs: rlm_radutmp: Logout entry for NAS <wireless controller name> port 13 has wrong ID I checked the list and I saw others posting about this error, but no concrete fixes. Any ideas on a resolution? Thanks. Josh Robertson Network Systems Senior Engineer Old Dominion University Office of Computing & Communications Services j2robert(a)odu.edu<mailto:j2robert@odu.edu> http://occs.odu.edu/

2 3

Windows 7 answers LAN based EAP-TLS with EAP-NAK and PEAP
by PENZ Robert 30 Aug '12

30 Aug '12

Hi! I've a problem with 802.1x and EAP-TLS where I'm not quite sure who is responsible for this problem and how to work around it. I hope someone can help me - I couldn't find anything with Google and I just can't believe I'm the first guy with this problem. The setup is following. - Windows 7 SP1 Client with 802.1x and EAP-TLS configurated - Extreme Networks 450e Switches --> LAN based 802.1x - Freeradius 2.1.12-3.el5 on RHEL5 only TLS as EAP type configured/allowed The problem now is that in 1/3 of the clients boots (done over 40 times with a tap devices running as sniffer) the Windows Client sends an response: Legacy Nak (Response only) [RFC3748] with the wish for PEAP. After this the freeradius Server sends a reject ([eap] NAK asked for unsupported type PEAP). With the next identity request the Client does an clean EAP-TLs handshake, but the switch already put the client into the reject network. Here is the communication flow in these cases (Wireshark): Line 5 / Packet 54 is the problem No. Time Source Destination Protocol Length Info 9 27.371093 switch --> client EAP 60 Request, Identity [RFC3748] 51 43.669530 switch --> client EAP 60 Request, Identity [RFC3748] 52 43.693510 client --> switch EAP 60 Response, Identity [RFC3748] 53 43.699498 switch --> client EAP 60 Request, EAP-TLS [RFC5216] [Aboba] 54 43.700496 client --> switch EAP 60 Response, Legacy Nak (Response only) [RFC3748] 84 44.639980 switch --> client EAP 60 Request, Identity [RFC3748] 85 44.646980 client --> switch EAP 60 Response, Identity [RFC3748] 86 44.652974 switch --> client EAP 60 Request, EAP-TLS [RFC5216] [Aboba] 87 44.758887 client --> switch TLSv1 123 Client Hello 88 44.765875 switch --> client TLSv1 1042 Server Hello, Certificate, Certificate Request, Server Hello Done 89 44.766875 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 90 44.772880 switch --> client TLSv1 1042 Server Hello, Certificate, Certificate Request, Server Hello Done 91 44.772892 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 92 44.778868 switch --> client TLSv1 1042 Server Hello, Certificate, Certificate Request, Server Hello Done 93 44.779865 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 94 44.784859 switch --> client TLSv1 177 Server Hello, Certificate, Certificate Request, Server Hello Done 95 44.787862 client --> switch TLSv1 1510 Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message 96 44.793854 switch --> client EAP 60 Request, EAP-TLS [RFC5216] [Aboba] 97 44.793861 client --> switch TLSv1 530 Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message 98 44.807887 switch --> client TLSv1 87 Change Cipher Spec, Encrypted Handshake Message 102 44.818881 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 103 44.855827 switch --> client EAP 60 Success It seems to be a timing issue .... anyway: - Windows 7 is configured to EAP-TLS with GPOs - I've uninstalled anti-virus, behavior detection software In the 2/3 of the cases it works the Client does not send a NAK, so I believe it is a client problem but it's Windows 7 ... there must be thousands of installs with Windows 7 and 802.1x EAP/TLS. Would it help if freeradius ignores the EAP-NAK packets? Any help appreciated! Mit freundlichen Grüßen Robert Penz -------------------------------------------------------------- Dipl.Inf. Robert Penz DVT - Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 (0)512 508 3334 / Fax: +43 (0)512 508 3355 E-Mail: robert.penz(a)tirol.gv.at

2 3

RE: Integration with CISCO Router for PEAP requests
by Andras Ionut 30 Aug '12

30 Aug '12

Hi Phil, Thanks a lot for the quick response. I need this for PEAP with EAP protocol inside the tunnel, like EAP-MSCHAPv2. Again, The device MUST reject the connection as EAP is not completed, but the ROUTER needs that Access-Accept, in order to be able to redirect user to portal. Can this be done? Thanks in advance. Andras On 30/08/12 11:12, Andras Ionut wrote: > Thanks a lot for the quick answer Arran. > > That is exactly wahat I need - sending an Access-Accept and maybe > EAP-Success if possible. I don't care if the device will not connect. > I only need Access-Accept in order for the CISCO router to assign an > IP to the client and redirect it to portal using L4_Redirect. You're not understanding what Arran said. This is an FAQ: http://wiki.freeradius.org/FAQ#How-do-I-permit-access-to-any-user-regardles… In short: many (most?) devices will drop the connection if auth fails, including a missing or invalid final response in the inner challenge-response auth. So, forcing an accept might work for the router. But the client will probably disconnect. > > Can this be done? If yes, can you please be more explicit on how to do > this in freeradius? See the FAQ entry above.

2 1

(no subject)
by QASIM RAO 30 Aug '12

30 Aug '12

Hi, i new bie in Freeradius i am facing problem that when i run radiusd with 'radiusd -X' command it it is genrating log of it in log file but when i run radiusd with 'radiusd' command it is not genrating it log in log file.. anyone please help me in this :( Regards, Rao

3 2

Re: Integration with CISCO Router for PEAP requests
by Andras Ionut 30 Aug '12

30 Aug '12

Thanks a lot for the quick answer Arran. That is exactly wahat I need - sending an Access-Accept and maybe EAP-Success if possible. I don't care if the device will not connect. I only need Access-Accept in order for the CISCO router to assign an IP to the client and redirect it to portal using L4_Redirect. Can this be done? If yes, can you please be more explicit on how to do this in freeradius? Thanks in advance, Andras ---------------------------------------------------------- On 30 Aug 2012, at 09:40, Andras Ionut <ionut.andras(a)gmail.com> wrote: > How can I configure FreeRADIUS to work with a CISCO Router and a > captive portal in the following case... > > 1. User tries to access WiFi network with good user and wrong password > 2. FreeRADIUS should send Access-Accept with Filter-Id set to portal > redirect policy and not Access-Reject > 3. User is presented login page, bla, bla, bla > > My problem is that i have to send an Access-Accept on failed login for > PEAP (For TTLS I've managed to do it from config, but this is another > story) You can't fake an Accept that the PEAP supplicant will accept because MSCHAPv2 requires that you actually provide the correct credentials. You can send an Access-Accept back to the access point, and even force an EAP-Success but the supplicant will probably refuse to connect because it only cares about the success notification from the MSCHAPv2 inner. Your only option is to run a separate open ssid with something like macauth. TTLS works because you're using a PAP inner method, and IIRC the keying material for WPA2 is derived from the SSL tunnel which can be estsblished without knowledge of the users password. If you tried TTLS-MSCHAPv2 it would fail. -Arran

2 1