May 2013 - Freeradius-Users - lists.freeradius.org

Detailed Logging freeradius Request Packets
by Jean-Francois Mousinho 28 Oct '19

28 Oct '19

Hi, I've tried to find a way of detail logging the packets sent by freeradius to the client in the authentication phase but didn't found a way of doing it. Maybe I've not looked correctly so I'm asking if it's actually possible? I was able to log detailed packets sent by the client (Response packets) but not the ones sent by freeradius to the client (except accounting and proxied ones). Thanks for your time. Jean-François Mousinho

4 6

user-group for rejected users
by Fabricio Viana 21 Mar '17

21 Mar '17

Hello! Let´s suppose the following situations: 1) User exists but the password is wrong 2) User does not exist In both cases the answer is REJECT. It happens that certain hardware is making endless attempts that eventually saturating the server. - It is possible to cause the server, instead of rejecting the users, accept the login but responds ACCEPT with "framed-pool = pool-block" ? or/and - Is there any way to put REJECT users in a given group by default? Thanks! Fabricio

3 3

AVP EAP-KEY name support in FR
by Srinu Bandari 12 May '14

12 May '14

Hi, We are trying to bring up MACsec with Cisco and FR, and we are stuck because of Radius unable to send EAP-Key-Name AVP. Below is what is expected as per RFC4072 RFC4072 says "A home Diameter server receiving a Diameter-EAP-Request with a Key-Name AVP with non-empty data MUST silently discard the AVP. In addition, the home Diameter server SHOULD include this AVP in Diameter-EAP-Response only if an empty EAP-Key-Name AVP was present in Diameter-EAP-Request." But radius server is not sending EAP-Key-Name AVP (Radius Attribute Type 102) even invalid AVP present in the Diameter-EAP-Request". Below is the debug print of radius Sending Access-Accept of id 647 to 10.20.64.9 port 1645 MS-MPPE-Recv-Key = 0x84e5c624c3bcdeadca3c6210f24bd7b8336921ccc1c58399d397afc75770332c MS-MPPE-Send-Key = 0xa6c4860cc8092c251502f5adc3ee13586e05fe84cbbb8b6793b08d9523d12b1f EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "user1" Does anyone have clue on this. Thanks, Srinivas CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is for the sole use of the intended recipient(s) and may contain confidential and privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply e-mail and destroy all copies of the original message.

4 19

authorization based on ldap attribute
by Stefano Zanmarchi 29 Apr '14

29 Apr '14

Hallo, I've configured freeradius to authenticate users with PEAP, using openldap to store NTLM hashes. It works fine. Now I'd like to authorize only people who have the ldap attribute "haDirittoEduroam" set to Y (or the other way round: not to authorize users with "haDirittoEduroam" set to N). Below an example openldap entry. Is there an easy way to achive this? dn: uid=uto.ughi(a)myorg.it,dc=myorg,dc=it objectClass: sambaSamAccount objectClass: inetOrgPerson objectClass: person objectClass: dirittoEduroam cn: Uto sn: Ughi uid: uto.ughi(a)myorg.it haDirittoEduroam: N sambaSID: 121212 userPassword: {SSHA}EnK9jqiVGSPNi6EQwpqdpjThBJHtZ1fi sambaNTPassword: 2B466E3D3FB6AA4BF8AAAFEF8F59F6F3 sambaLMPassword: E52CAC67419A9A224300941ECC02054C thanks a lot for your help, Stefano

4 6

Re: SSL V3 client certificate error
by Danny Kurniawan 05 Nov '13

05 Nov '13

thank you so much .. yes it only have issue intermitenly on some user .. so i have to set our client laptop manually for the root CA? I believe it should be there as we use Global Sign ... -- Best Regards, Danny

2 1

Radperf unavailable?
by Marius Booysen 30 Oct '13

30 Oct '13

Hi, I see that there is a problem downloading Radperf from networkradius.com. Does anybody know if it will become available once again at some point? Are there any other benchmarking utilities for Freeradius? Regards Kosie

5 4

eap sim authorization problem
by raptor raptor 26 Jun '13

26 Jun '13

Hi all, i have read anything about my problem, but i dont get any idea to solve in FR i get message like this : "rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org : 0 " "[sim_files] returnnot found " it's my log: Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=215 User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000038013135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x538ea4f0fa860dbb61c7d2c88dbd8474 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 61 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x013d0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7239b8fc7204aacaafa19b7e0dac3020 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=265 Cleaning up request 0 ID 0 with timestamp +206 User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0x7239b8fc7204aacaafa19b7e0dac3020 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023d0058120a000007050000a6be580955eb9db84b9cd0ba4ac9ec71100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x7dd9b0c763e8fc3783f00303952476cb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 61 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim rlm_eap_sim: subtype= 10 start. +++> EAP-sim decoded packet: User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0x7239b8fc7204aacaafa19b7e0dac3020 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x023d0058120a000007050000a6be580955eb9db84b9cd0ba4ac9ec71100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x7dd9b0c763e8fc3783f00303952476cb EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000a6be580955eb9db84b9cd0ba4ac9ec71 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 62 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x013e0050120b0000010d0000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f0b050000f9e2857eab3d7c389db0c2455af08b29 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7239b8fc7307aacaafa19b7e0dac3020 Finished request 1. Going to the next request Waking up in 4.9 seconds. Cleaning up request 1 ID 0 with timestamp +206 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=215 User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02000038013135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f7267 Message-Authenticator = 0xdca4e2db7c20e750a430bef09ea6aebb +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 87 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x01570014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb8d25eafbda3700c521f1ba966c28c6 Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.1 port 2048, id=0, length=265 Cleaning up request 2 ID 0 with timestamp +231 User-Name = "1510019760806391(a)wlan.mnc001.mcc510.3gppnetwork.org " NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0xfb8d25eafbda3700c521f1ba966c28c6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02570058120a000007050000b6356c32e13a775e4150d27fa12bd917100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x3152ae01c462863ab1e119e0c24eac50 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc001.mcc510.3gppnetwork.org" for User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" [suffix] No such realm "wlan.mnc001.mcc510.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: insufficient number of challenges for imsi imsi(a)wlan.mnc001.mcc510.3gppnetwork.org: 0 ++[sim_files] returns notfound [eap] EAP packet type response id 87 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry imsi(a)wlan.mnc001.mcc510.3gppnetwork.org at line 205 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim rlm_eap_sim: subtype= 10 start. +++> EAP-sim decoded packet: User-Name = "imsi(a)wlan.mnc001.mcc510.3gppnetwork.org" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "48f8b315461a" Calling-Station-Id = "1814563e5189" NAS-Identifier = "48f8b315461a" NAS-Port = 38 Framed-MTU = 1400 State = 0xfb8d25eafbda3700c521f1ba966c28c6 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x02570058120a000007050000b6356c32e13a775e4150d27fa12bd917100100010e0e00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 Message-Authenticator = 0x3152ae01c462863ab1e119e0c24eac50 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000b6356c32e13a775e4150d27fa12bd917 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333135313030313937363038303633393140776c616e2e6d6e633030312e6d63633531302e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 88 ++[eap] returns handled Sending Access-Challenge of id 0 to 192.168.1.1 port 2048 EAP-Message = 0x01580050120b0000010d0000101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f303132333435363738393a3b3c3d3e3f0b0500003b9af2c5246ca03fede9d65a01cda8e1 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xfb8d25eafad53700c521f1ba966c28c6 Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 3 ID 0 with timestamp +231 Ready to process requests. Thanx for your time and your answer

6 29

Retrieving eDirectory VLAN attributes
by Dan Lietz 11 Jun '13

11 Jun '13

Hello, I'm pretty much a noob when it comes to freeradius as I still don't completely understand what files are used for authorization and authentication and where to put different certain pieces of configuration. I'm trying to set up dynamic vlans for a wireless network with a Ruckus Zone Director backend and a freeradius backend authenticating via LDAP to eDirectory running on the same box. So far I've managed to configure 802.11x authentication using PEAP and that is working well. Now I want to be able to retrieve the radius attribute in eDirectory for the vlan tag so the Ruckus Zone Directory will automatically place the user on the correct vlan once they are authenticated. I did some initial testing without using LDAP by adding the following lines to my users file: DEFAULT Tunnel-Type = VLAN, Tunnel-Medium-Type = 802, Tunnel-Private-Group-ID = 85, Fall-Through=Yes By changing the value of "Tunnel-Private-Group-ID" (set to 85 in the above example) the Zone Director will move users to the vlan ID I specify here, but it is obviously static and does not change based on the user. The next step is to configure FreeRadius to pull the info from eDir via LDAP and that's the part I'm not getting. Part of my problem is that I don't know which attributes mappings are built in and which aren't. According to this document: Integrating Novell eDirectory with FreeRadius<https://www.netiq.com/documentation/edir_radius/radiusadmin/?page=/document…> the listed radius attributes are available for use, but does that mean I don't need to add them to ldap.attr or the dictionary file at all? Or that I don't need to add an LDAP attribute map to the LDAP Group object in iManager? The other thing I don't understand is where (i.e. what file) to put the ldap call for said attributes and what the syntax would look like. I've configured my eap.conf to include 'copy_request_to_tunnel = yes' and 'use_tunneled_reply = yes' Any help is greatly appreciated and if I'm asking Thanks. Dan

2 2

ippool-dhcp and Oracle
by Бен Томпсон 09 Jun '13

09 Jun '13

Hello Everyone Could anyone advise me what would be required to us dhcp-ippool with Oracle? I had a quick look through the files in git and it seems to me that the only thing missing is queries.conf? If that is all that is required I am happy to do the work of porting the sql queries from the mysql version, but I just wanted the check that I am not missing something. Ben

3 16

Service Provisioning Using AAA (FreeRadius)
by Russell Mike 06 Jun '13

06 Jun '13

Dear FreeRadius Gurus Greetings, I work with an ISP, i have been asked to research about "service provisioning using AAA". I am NOT very new to FreeRadius. Have implemented and managing central CoovaChilli hotspot solution where we run more than 35 hotspots across the city using CoovaChilli + Freeradius. Currently, We do manually connection / disconnection. If a customer did not pay until 31st, somebody manually disconnect the link. And manually connect when customer comes to pay. i am somehow not clear with the idea, how that would work and where to start from. I am looking for advice from those have already setup such system. Any kind of help would be highly appreciated. i am further willing to study, if i know which direction to move on. Someone please help Thanks / Regards --RM

7 15