March 2013 - Freeradius-Users - lists.freeradius.org

Setting up EAP-TLS as the ONLY authentication mechanism?
by Thomas Hruska 24 Mar '13

24 Mar '13

I want to set up FreeRADIUS using EAP-TLS only. I'm running Ubuntu Server 12.04.2 LTS here with the packaged build of FreeRADIUS from the default Ubuntu/Debian apt-get package repository. I'm finding junk scattered all over the place for configuring this thing (typical), so my first objective is to get FreeRADIUS into a locked-down state so that 'freeradius -X' doesn't return things that bother me (i.e. pared back to minimal functionality first). Since I only want EAP-TLS, output lines like the following bother me (I've inlined my concerns): FreeRADIUS Version 2.1.10, for host x86_64-pc-linux-gnu, built on Sep 24 2012 at 17:58:57 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... ... including configuration file /etc/freeradius/modules/pam ... including configuration file /etc/freeradius/modules/chap ... ^^^^^^^ Does FreeRADIUS really need to load all of those config files to function? That is, does it hurt in any way to load all of the module config files? From what I can tell, they don't seem to be relevant until they are instantiated later on, but I would appreciate confirmation. radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } ^^^^^ What does this do? I don't think I need a proxy server. My setup is just a consumer router plus a single Ubuntu box with FreeRADIUS on it. home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } ^^^^^ All of this seems to be in proxy.conf. It doesn't look like I need any of it but I'm not sure if it is safe to get rid of it/comment it out. Again, this will be the only RADIUS server in the network and my understanding is that proxies are for forwarding requests to other RADIUS servers. Given my setup, can I safely comment out the '$INCLUDE proxy.conf' line in 'radiusd.conf'? radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } ^^^^^ Not sure why I would need this either. Based on the 'secret' string's value, I'm wagering it has to do with the 'proxy.conf' settings, but I'm not 100% confident about that. radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } ^^^^^^ Most of that seems irrelevant to EAP-TLS. A certificate isn't exactly a password - it can expire, but the message "Password Has Expired" seems like it will never appear (or, if it does, it'll be confusing to a user). I'm probably not going to use the 'logintime' features. 'exec' might be useful since I probably will use the external 'openssl' based 'verify' method in 'eap.conf' (unless someone can suggest a better approach). radiusd: #### Loading Virtual Servers #### ... ^^^^^^ Even when 'default' was the only thing in 'sites-enabled', it loaded a bunch of stuff other than EAP-TLS. I currently have nothing in 'sites-enabled' right now, but would like insight into what the configuration file should be to just do EAP-TLS. radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. ^^^^^^ Again, I don't think I need a proxy and I'm not sure what the 'accounting' port is for. My policy is that "fewer open ports is better". So do I really want/need all of this? A few additional questions of where I'm currently a bit stuck: What do I need to do to set up FreeRADIUS so that it only supports EAP-TLS? Some of the stuff in 'eap.conf' is confusing. I've commented out 'md5', 'leap', 'mschapv2', etc. with only the 'tls' section left uncommented and set 'default_eap_type = tls', but I'm not sure if that is all I need to do. Documentation on setting up an "EAP-TLS only" RADIUS server is limited. What is the best method of setting it up so that only the router can communicate with the RADIUS server on port 1812? Sorry for the long post. -- Thomas Hruska CubicleSoft President I've got great, time saving software that you might find useful. http://cubiclesoft.com/

3 6

Re: Setting up EAP-TLS as the ONLY authentication mechanism?
by Alan Buxey 24 Mar '13

24 Mar '13

All that stuff is on by default to ensure that people who want more than a really dumb and minimal server can get up and running without having to try to find what combination of stuff needs to be enabled. So, eg proxying is enabled ..whats the issue? Unless you have actually edited proxy.conf to do something it won't do anything , there's no entry in clients.conf other than localhost too, so even if you had the required ports open to the world, nothing is going to happen. If all you want is EAP-TLS auth then its very easy to minimise to that config....much much easier than having to learn the server better and trying to get there from a minimal config that doesn't work out if the box (ask those who have tried doing it that way...look at mailing list history for those that stripped the config out before then trying to get things to work) This isn't Apache, which does have a whole load of things on and can get you p0wned on port 80 if you have that open to the world alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

how to access CallingStationId and CalledStationId propertes in diaup.conf (sql.conf) in a SQL query
by Mehdi Ravanbakhsh 23 Mar '13

23 Mar '13

Dear ALL I use this query by calling stored procedure in database : simul_count_query = "SELECT findout_cuncurrent_sessions_for_a_user('%{User-Name}','%{NAS-IP-Address}','%{CalledStationId}','%{CallingStationId}')" but I can not access to the value of CallingStationId and CalledStationId. my radius.log file : rlm_sql_postgresql: query: SELECT findout_cuncurrent_sessions_for_a_user('test1','5.190.103.4','','') rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error invalid input syntax for type inet: "" rlm_sql_postgresql: Postgresql Fatal Error: [22P02: INVALID TEXT REPRESENTATION] Occurred!! rlm_sql (sql) sql_checksimul: Database query failed

2 2

rlm_checkval and Hint attribute
by Tony Peña 22 Mar '13

22 Mar '13

Hi again... I'm starting taking some confuse idea with this... I use 3 checkvals. 1 for Calling-Station-Id 2 for Called-Station-Id and 3 for Hints and in the Hints file.. i setup my hints domains and filter to can apply for the suffix the correct acl/pool ip. also have radiusHints and radiusFilterId in my OpenLDAP db. now.. my question is.. why if Hints is not found in radius query... continue checking the rest for the values... and with any checkvals 1 or 2 works fine.. ?? so... if some user use other hints radius do access-accept... and not the reject like callings/called-station-id who with that... works fine.. simple debug. [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=gtm478) [ldap] expand: ou=institute,ou=users,dc=sld,dc=cu -> ou=institute,ou=users,dc=domain,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in ou=institute,ou=users,dc=domain,dc=com, with filter (uid=gtm478) [ldap] performing search in cn=users.ppp,ou=profiles,ou=radius,ou=services,dc=domain,dc=com, with filter (objectclass=radiusprofile) [ldap] radiusCalledStationId -> Called-Station-Id == "999999" [ldap] radiusCalledStationId -> Called-Station-Id == "888888" [ldap] radiusCalledStationId -> Called-Station-Id == "111111" [ldap] extracted attribute Max-Monthly-Session from generic item Max-Monthly-Session := 90000 [ldap] radiusIdleTimeout -> Idle-Timeout = 300 [ldap] radiusSessionTimeout -> Session-Timeout = 7200 [ldap] radiusFramedCompression -> Framed-Compression = Van-Jacobson-TCP-IP [ldap] radiusFramedMTU -> Framed-MTU = 576 [ldap] radiusFilterId -> Filter-Id = "general.in" [ldap] radiusFramedProtocol -> Framed-Protocol = PPP [ldap] radiusServiceType -> Service-Type = Framed-User [ldap] Added User-Password = {CRYPT}$1$passwordcrypted in check items [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] userPassword -> Password-With-Header == "{CRYPT}$1$cryptedpassword" [ldap] radiusCallingStationId -> Calling-Station-Id == "111111" [ldap] looking for reply items in directory... [ldap] user gtm478 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok rlm_checkval: Item Name: Calling-Station-Id, Value: 111111 rlm_checkval: Value Name: Calling-Station-Id, Value: 111111 ++[checkval1] returns ok rlm_checkval: Item Name: Called-Station-Id, Value: 88888 rlm_checkval: Value Name: Called-Station-Id, Value: 999999 rlm_checkval: Value Name: Called-Station-Id, Value: 88888 ++[checkval2] returns ok rlm_checkval: Item Name: Hint, Value: userdefault *rlm_checkval: Could not find attribute named Hint in check pairs* *++[checkval3] returns notfound* *I need to stop here.. and reject the user.. * ++? if (User-Name =~ /^(.+)(a)institute.domain.com/) ? Evaluating (User-Name =~ /^(.+)(a)institute.domain.com/) -> TRUE ++? if (User-Name =~ /^(.+)(a)institute.domain.com/) -> TRUE ++- entering if (User-Name =~ /^(.+)(a)institute.domain.com/) {...} rlm_sqlcounter: Entering module authorize code *NOT should be continue.....* the users .. logging on...ok. (with bad hints) with hints works fine. thanxs in advance... (i'm continue searching and try meanwhilte wait for this...) sorry for my bad english .. O:-) regards. -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001

1 1

regex in suffix
by Tony Peña 22 Mar '13

22 Mar '13

Hi to all. I have some suffix configure, to can do load balance between some sql accountings servers. and I have this check into radiusd.conf if (User-Name =~ /^(.+)(a)institute.domain.cu/) { monthlycounter2 } else { monthlycounter1 } and I have some users configured to can access by other way in the public PAP, using part of the suffix so i want to balance too in fact.. the question is my suffix for @institute @institude.domain @institude.domain.cu can use monthlycounter2 and the rest.. with only been 'just the user part' by montlycounter1 i test this if (User-Name =~ /^(.+)(a)institute?.domain?.cu/) { monthlycounter2 } else { monthlycounter1 } and the servers running fine.. but i'm not sure if the regex is defined ok... can help me in that...? thanxs in advance. -- Antonio Peña Secure email with PGP 0x8B021001 available at http://pgp.mit.edu Fingerprint: 74E6 2974 B090 366D CE71 7BB2 6476 FA09 8B02 1001

1 1

[Help] Is that possible to change the reject message that appears at the Windows Pop Up
by Danny Kurniawan 21 Mar '13

21 Mar '13

Hi All, So i have been able to authenticate my wireless user using 802.1x + LDAP + MAC address (using CallingStationID attriubute). So now for example when user A have MAC 11:22:33 but tried to login using another device there will be a pop up window when they try to connect - just a plain error popup saying "Unable to connect". Is there any way we can customize this error from radius? or should be from the wireless AP? So below is the unlang code that i use to check whether the user have a set of MAC address in their ldap profile or not if(!control:Calling-Station-Id){ reject } Possible to have that reject command to return some code that Windows client can understand like "No MAC address" etc? Thanks in advance Danny -- Best Regards, Danny

6 8

Vote on the new FreeRADIUS logo
by Arran Cudbard-Bell 21 Mar '13

21 Mar '13

Currently in the final round of selecting a new logo, please vote on the poll here to select your favourite, you don't need to register. http://99designs.ca/logo-design/vote-5wpx8t -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team Please contribute documentation: http://wiki.freeradius.org

5 4

unlang substring with nas-port-id
by Łukasz Kopiszka 20 Mar '13

20 Mar '13

Hi, I'm receiving from SE100: NAS-Port-Id = "2/2 vlan-id 1001 clips 132019" How to extract number 1001 which will be used in code: switch "extracted vlan-id" { case 1000 { ... } case 1001 { ... } case 1002 { ... } ... } -- Pozdrawiam, Łukasz Kopiszka www.alfa-system.pl

2 1

(no subject)
by Yervand Petrosyan 19 Mar '13

19 Mar '13

http://audacesidea.com.br/yuotube/68Multiply%20your%20income%20on-line09

1 0

send multiple parameter to stored procedure in database
by Mehdi Ravanbakhsh 19 Mar '13

19 Mar '13

can i send multiple Parameter to stored procedure ( function) in database by SQL xlat?

2 1