September 2012 - Freeradius-Users - lists.freeradius.org

Unable to reply to thread
by Mudasir Mirza 03 Sep '12

03 Sep '12

Hi, I am unable to reply to thread from email or from list. I get below message when I reply to email. "Delivery Status Notification (Failure)" http://freeradius.1045715.n5.nabble.com/checkrad-not-working-td5715083.html -- Kind Regards Mudasir Mirza

3 2

Re: Wiki Links
by Alan Buxey 03 Sep '12

03 Sep '12

Ooh. Github can be used to maintain Wiki? How did I miss this change? As per Doug, hers best resource to start from? alan

2 1

Apple clients suddenly can't authenticate to EAP-MSCHAPV2
by Casartello, Thomas 02 Sep '12

02 Sep '12

Having a bizarre problem that started due to someone in my department deleting the samba computer account for my freeradius machine. I recreated it and for a time everything went back to normal, but later that afternoon all of my apple clients can simply not connect to our 802.1x enabled wireless network. We are using Cisco wireless controllers. Radiusd -X doesn't seem to be giving me enough debug output. Is there any suggestion as to drill down further to see what is going on here. I am having no issues with my Windows 7 clients and Windows mobile devices. Simply not getting enough information. Everything has been working fine for months and I don't understand why all of the sudden this is going on and why its only affecting Apple IOS devices and iMacs so far. Here's an example output. This simply loops over and over again: rad_recv: Access-Request packet from host 172.20.9.253 port 32769, id=63, length=228 User-Name = "oclarke" Calling-Station-Id = "10-40-f3-27-b9-83" Called-Station-Id = "00-1f-c9-ff-8a-d0:s-wsc" NAS-Port = 29 Cisco-AVPair = "audit-session-id=ac1409fd000000085042b3cc" NAS-IP-Address = 172.20.9.253 NAS-Identifier = "diller-wism-b" Airespace-Wlan-Id = 4 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "891" EAP-Message = 0x0207000c016f636c61726b65 Message-Authenticator = 0x6015385c05fd07141cd27b2bd7d4452a # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [IPASS] No '/' in User-Name = "oclarke", looking up realm NULL [IPASS] No such realm "NULL" ++[IPASS] returns noop [suffix] No '@' in User-Name = "oclarke", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "oclarke", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 7 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry DEFAULT at line 216 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 63 to 172.20.9.253 port 32769 EAP-Message = 0x010800061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0ca5d3010cadca632a899d669d6fd38b Finished request 218. Going to the next request

2 4

Re: rlm_perl and dynamic_clients
by Steven Eksteen 01 Sep '12

01 Sep '12

Sorry. I wasn't paying attention and resent the initial question mail by accident instead of the following: I followed your instructions and the Packet-Src-IP-Address came through into the Perl script, thank you. I did however use Packet-Src-IP-Address-0 instead of Tmp-IP-Address-0 for ease of understanding, for anyone else looking at the script. I hope this is not what's affecting the operation. I hope the output below is enough information your you to see how I am adding to RAD_REPLY. I am returning RLM_MODULE_OK at the end of the script. I did try to use RLM_MODULE_UPDATED but that returned a result as if I was returning RLM_MODULE_FAIL, module failure. I also did try to use "directory = ${confdir}/dynamic-clients/" in the virtual server in case the failure might have been coming from somewhere not shown in the output, like the SQL module maybe --- client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 3600 } server dynamic_client_server { authorize { update request { Packet-Src-IP-Address-0 := "%{Packet-Src-IP-Address}" } dynamic-clients-pl } } --- rad_recv: Access-Request packet from host 192.168.0.200 port 58738, id=36, length=212 server dynamic_client_server { rlm_perl: RAD_REQUEST: Packet-Src-IP-Address-0 = 192.168.0.200 rlm_perl: RAD_REPLY: FreeRADIUS-Client-Shortname = Internal rlm_perl: RAD_REPLY: FreeRADIUS-Client-Secret = 123456 rlm_perl: RAD_REPLY: FreeRADIUS-Client-NAS-Type = other rlm_perl: RAD_REPLY: FreeRADIUS-Client-IP-Address = 192.168.0.200 rlm_perl: Added pair Packet-Src-IP-Address-0 = 192.168.0.200 rlm_perl: Added pair FreeRADIUS-Client-Shortname = Internal rlm_perl: Added pair FreeRADIUS-Client-Secret = 123456 rlm_perl: Added pair FreeRADIUS-Client-NAS-Type = other rlm_perl: Added pair FreeRADIUS-Client-IP-Address = 192.168.0.200 } # server dynamic_client_server - Cannot add client 192.168.0.200: Required attribute "FreeRADIUS-Client-Secret" is missing. Ignoring request to authentication address * port 1812 as server r9 from unknown client 192.168.0.200 port 58738 On Fri, Aug 31, 2012 at 8:52 AM, Steven Eksteen <steven(a)rad9.net> wrote: > > I am pretty sure I might be missing something here, or having a giant blonde > moment. I followed your instructions and the Packet-Src-IP-Address came > through into the Perl script, thank you. I did however use > Packet-Src-IP-Address-0 instead of Tmp-IP-Address-0 for ease of > understanding. I hope this is not what's affecting the operation. > > I hope the output below is enough information your you to see how I am > adding to RAD_REPLY. I am returning RLM_MODULE_OK at the end of the script. > I did try to use RLM_MODULE_UPDATED but that returned a result as if I was > returning RLM_MODULE_FAIL, module failure. > > I also did try to use "directory = ${confdir}/dynamic-clients/" in the > virtual server in case the failure might have been coming from somewhere not > shown in the output, like the SQL module > > --- > > client dynamic { > ipaddr = 0.0.0.0 > netmask = 0 > dynamic_clients = dynamic_client_server > lifetime = 3600 > } > > server dynamic_client_server { > authorize { > update request { > Packet-Src-IP-Address-0 := > "%{Packet-Src-IP-Address}" > } > dynamic-clients-pl > } > } > > --- > > rad_recv: Access-Request packet from host 192.168.0.200 port 58738, id=36, > length=212 > server dynamic_client_server { > rlm_perl: RAD_REQUEST: Packet-Src-IP-Address-0 = 192.168.0.200 > rlm_perl: RAD_REPLY: FreeRADIUS-Client-Shortname = Internal > rlm_perl: RAD_REPLY: FreeRADIUS-Client-Secret = 123456 > rlm_perl: RAD_REPLY: FreeRADIUS-Client-NAS-Type = other > rlm_perl: RAD_REPLY: FreeRADIUS-Client-IP-Address = 192.168.0.200 > rlm_perl: Added pair Packet-Src-IP-Address-0 = 192.168.0.200 > rlm_perl: Added pair FreeRADIUS-Client-Shortname = Internal > rlm_perl: Added pair FreeRADIUS-Client-Secret = 123456 > rlm_perl: Added pair FreeRADIUS-Client-NAS-Type = other > rlm_perl: Added pair FreeRADIUS-Client-IP-Address = 192.168.0.200 > } # server dynamic_client_server > - Cannot add client 192.168.0.200: Required attribute > "FreeRADIUS-Client-Secret" is missing. > Ignoring request to authentication address * port 1812 as server r9 from > unknown client 192.168.0.200 port 58738 > Ready to process requests. > > --- > > > On Tue, Aug 28, 2012 at 4:21 PM, Steven Eksteen <steve(a)saoirse.co.za> wrote: >> >> Thank you. Much appreciated >> >> >> On Tue, Aug 28, 2012 at 4:14 PM, Alan DeKok <aland(a)deployingradius.com> >> wrote: >> > Steven Eksteen wrote: >> >> I was wondering how would I use "Packet-Src-IP-Address" using Perl for >> >> Dynamic Clients. I thought it might be part of the RAD_REQUEST hash. >> > >> > It's not, but you can do: >> > >> > server dynamic_client_server { >> > authorize { >> > update request { >> > Tmp-IP-Address-0 := "%{Packet-Src-IP-Address}" >> > } >> > >> > dynamic-clients-pl >> > } >> > } >> > >> > >> > And then use the Tmp-IP-Address-0 in the Perl code. >> > >> >> If some direction could be made as to setting >> >> "FreeRADIUS-Client-Shortname", "FreeRADIUS-Client-Secret", etc. too I >> >> would be very grateful. >> > >> > You just set them in the RAD_REPLY hash. >> > >> >> I already have Perl working for the normal AAA >> >> functions. This just doesn't appear to work the same way. I am not a >> >> Perl developer in the slightest so apologies in advance if this is a >> >> monumentally stupid question. >> > >> > Nope. It's a complicated system. >> > >> > Alan DeKok. >> > - >> > List info/subscribe/unsubscribe? See >> > http://www.freeradius.org/list/users.html > >

2 1