May 2013 - Freeradius-Users - lists.freeradius.org

Problem: switch authentication against Freeradius server
by Roberto Carna 23 May '13

23 May '13

Dear, I've implemented Linux SSH authentication using PAM against a Freeradius server, it was OK !!! But know I'm trying to authenticate some Allied switch users against the same Freeradius server...in the Allied switch I've defined the radius server IP, port and secret, and when I try to telnet this switch from other computer I fail and get this Freeradius log: rad_recv: Access-Request packet from host 10.4.133.254 port 49154, id=0, length=76 User-Name = "bapro2" User-Password = "&kq\356\275`_R\005\034\262m\263-\r\275" Cisco-AVPair = "shell:priv-lvl=1" NAS-IP-Address = 10.4.133.254 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "bapro2", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> bapro2 [sql] sql_set_user escaped user --> 'bapro2' rlm_sql (sql): Reserving sql socket id: 0 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'bapro2' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'bapro2' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'bapro2' ORDER BY priority rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "&kqî½`_R??²m³- ½" [pap] Using clear text password "1234" [pap] Passwords don't match ++[pap] returns reject Failed to authenticate the user. WARNING: Unprintable characters in the password. Double-check the shared secret on the server and the NAS! Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> bapro2 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 3 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 3 Sending Access-Reject of id 0 to 10.4.133.254 port 49154 Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.4.133.254 port 49154, id=0, length=76 Sending duplicate reply to client SWITCH port 49154 - ID: 0 Sending Access-Reject of id 0 to 10.4.133.254 port 49154 Waking up in 3.0 seconds. rad_recv: Access-Request packet from host 10.4.133.254 port 49154, id=0, length=76 Sending duplicate reply to client SWITCH port 49154 - ID: 0 Sending Access-Reject of id 0 to 10.4.133.254 port 49154 Cleaning up request 3 ID 0 with timestamp +368 Ready to process requests. I see this line is completed with a wrong or cipher password, I don't know why: [pap] login attempt with password "&kqî½`_R??²m³- ½" Please can you guide me in this problem ??? Really thanks, Roberto

3 8

Having problems authenticating client computers onto the wireless network using a Cisco AP1252 via FreeRadius 2.1.10 on Ubuntu 12.04.2 serves
by Elizabeth Fife 23 May '13

23 May '13

HI I am having problems authenticating client computers onto the wireless network using a Cisco AP1252 via FreeRadius 2.1.10 on Ubuntu 12.04.2 serves Setup: I have a Cisco AP1252 wireless Access Point connected to a Cisco ASA5510 on subnet X.X.5.Z The access point ip address is X.X.5.101 The ASA on another port is also connected to the wired network on a different subnet X.X.0.Z On the wired network are two radius servers - Ubuntus servers running FreeRadius 2.1.10 which are running fine and reliably authenticate wired users for ssh connections to the ASA and importantly to the AP1252 as well (The radius servers ip addresses are X.X.0.191 and X.X.0.192) Problem: When a wireless user tries to connect to the wireless network via the AP1252 after being disconnected form it for a while (or after waking from a long sleep) they are never authenticated. They just try over and over and never obtain an IP Interestingly in such a case neither Ubuntu server shows any sign of receiving an authentication request from the AP - Both ubuntu servers are running in debug mode so they show any activity - there is none Oddly: If i try to authenticate a user wirelessly to the AP and leave it in the usual state of trying over and over (with no visible activity on the ubuntu servers) BUT then go to a wired machine and attempt to authenticate an ssh connection to the AP1252 using a terminal command ssh user1(a)X.X.5.101 THEN as soon as I hit enter on that request (and before I enter a password for the ssh connection) THE WAITING WIRELESS USER IS IMMEDIATELY AUTHENTICATED and assigned an IP address (and the ubuntu server shows the authentication activity for the wireless user) Please help me understand what might be causing this behavior - it seems like the AP sleeping and the wired ssh request wakes it up so that it sees the pending wireless user waiting and then acts on that completing the wireless user authentication request Help Elizabeth

3 2

MySQL Cluster as back-end for FreeRadius
by Divyesh Raithatha 23 May '13

23 May '13

Newbie question. Has someone successfully configured a high-availability MySQL cluster as a back-end for FreeRadius? Trying to find out what architecture was used to achieve the cluster or high availabilty and how successful you have been in a Production Environment. 1. Master/Master Replication? 2. Master/Slave Replication (for DR)? 3. MySQL Cluster using NDB? What other backend databases in a high avilable configureation have been used/tested. Thanks.

5 4

RE: RE: Help with chap
by Franks Andy (RLZ) IT Systems Engineer 23 May '13

23 May '13

Hi, Yes that makes sense, although the mac address was already being reported on the switch. It’s not having any negative effect anyway, so I’m happy. Thanks Andy From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of Matthias Nagel Sent: 21 May 2013 23:23 To: freeradius-users(a)lists.freeradius.org Subject: AW: RE: Help with chap Hello, actually this behaviour is totally correct. The switch tries to authenticate a client, when the switch learns the clients MAC address. As the MAC address is extracted from the ethernet header there must be some packages sent from the client in order to do so. If the client is quiet, the switch cannot do anything about it. Matthias Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 ICQ: 499797758 Skype: nagmat84 "Franks Andy (RLZ) IT Systems Engineer" <Andy.Franks(a)sath.nhs.uk> hat geschrieben: ..Just an update.. might be interesting for people - rebooted the switch and not all clients were authenticated, but it seems all those that weren't have 0 bytes for all statistics, tx, rx etc. So I guess they are switched off and the switch seems to need some packets to flow for it to "detect" that the client needs authenticating. Otherwise it looks like it will sit with the port in an up state unathenticated all day long. I guess this sort of makes sense, but in my simple view of how things this isn't intuitive. Also HP manuals don't seem to mention it.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 21 May 2013 22:27 To: FreeRadius users mailing list Subject: RE: Help with chap Thanks Phil. I'll keep that up my sleeve for future use. We tend to separate admin / wireless / mac-based auth off on to different radius boxes. Keeps things a bit easier. Not sure what cisco do, but a lot of their stuff tends to be pap or eap. HP doing chap here seems to limit quite a lot of backend options. It's still also the only protocol, or so it seems, chosen for iscsi authentication which is an interesting choice consider it's vulnerabilites. Guess ipsec gets used instead where it needs to be secure. Now to work out the useraccountcontrol setting. Seems to be different in users and computers than in an ldap viewer, but the ldap is probably a decimal conversion or something. Thanks again Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 21 May 2013 08:06 To: freeradius-users(a)lists.freeradius.org Subject: Re: Help with chap On 05/21/2013 07:55 AM, Franks Andy (RLZ) IT Systems Engineer wrote: > Can I just use the authorize section to set the password to be the > same as the username, i.e. the mac address, after checking some basics > like whether the user exists in ldap and perhaps the > useraccountcontrol value, then in the authorize section just let the > chap bit work on the assigned password? Yes. In fact that's the best approach. Something like: authorize { ... if (some condition) { update control { Cleartext-Password := "%{User-Name}" } } ... } "some condition" would normally be some sort of check to ensure it was a macauth-via-CHAP request - obviously you wouldn't want to force password==username for a PPP/EAP/other "real" user request. On the other hand if your server / virtual server only receives this traffic, you can omit the condition. I really dislike vendors who do macauth as CHAP. It seems to completely lack value, and adds complexity. Le sigh.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

FreeRADIUS + OpenLDAP for Wireless authentication
by Mantas Šiurkus 23 May '13

23 May '13

Hello, I have configured FreeRADIUS to work with OpenLDAP. Created user in OpenLDAP. Radtest from localhost works perfect. But I can't connect from other devices (android phone, etc..). In logs I get: [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user radiusas authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok I think it is problem in plain text password or something? # Uncomment it if you want to use ldap for authentication # # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Auth-Type LDAP { ldap } If I uncoment these lines, radtest stops working too. What can I do?

3 5

Re: Virtual server setup
by Vincent Rusilowicz 22 May '13

22 May '13

I have reloaded the server and started from scratch again. I was able to authenticate with the default config, when adding client and user info. In my effort to try and convert each client to use a separate virtual so separate user files can be used I am not able to authenticate. I see the auth attempt match an entry in my second_users file, but I get a WARNING message. I would appreciate if you could look at the following output ant point me in the right direction of how to resolve what I am missing. Thanks. Starting - reading configuration files ... including configuration file /etc/raddb//radiusd.conf including configuration file /etc/raddb//proxy.conf including configuration file /etc/raddb//clients.conf including files in directory /etc/raddb//modules/ including configuration file /etc/raddb//modules/linelog including configuration file /etc/raddb//modules/acct_unique including configuration file /etc/raddb//modules/redis including configuration file /etc/raddb//modules/ippool including configuration file /etc/raddb//modules/soh including configuration file /etc/raddb//modules/wimax including configuration file /etc/raddb//modules/ntlm_auth including configuration file /etc/raddb//modules/sradutmp including configuration file /etc/raddb//modules/inner-eap including configuration file /etc/raddb//modules/pam including configuration file /etc/raddb//modules/detail.example.com including configuration file /etc/raddb//modules/perl including configuration file /etc/raddb//modules/replicate including configuration file /etc/raddb//modules/exec including configuration file /etc/raddb//modules/expr including configuration file /etc/raddb//modules/opendirectory including configuration file /etc/raddb//modules/smbpasswd including configuration file /etc/raddb//modules/attr_rewrite including configuration file /etc/raddb//modules/realm including configuration file /etc/raddb//modules/passwd including configuration file /etc/raddb//modules/detail including configuration file /etc/raddb//modules/unix including configuration file /etc/raddb//modules/checkval including configuration file /etc/raddb//modules/digest including configuration file /etc/raddb//modules/pap including configuration file /etc/raddb//modules/echo including configuration file /etc/raddb//modules/mac2vlan including configuration file /etc/raddb//modules/counter including configuration file /etc/raddb//modules/always including configuration file /etc/raddb//modules/cui including configuration file /etc/raddb//modules/logintime including configuration file /etc/raddb//modules/otp including configuration file /etc/raddb//modules/files including configuration file /etc/raddb//modules/detail.log including configuration file /etc/raddb//modules/sqlcounter_expire_on_login including configuration file /etc/raddb//modules/rediswho including configuration file /etc/raddb//modules/dynamic_clients including configuration file /etc/raddb//modules/chap including configuration file /etc/raddb//modules/attr_filter including configuration file /etc/raddb//modules/sql_log including configuration file /etc/raddb//modules/preprocess including configuration file /etc/raddb//modules/mschap including configuration file /etc/raddb//modules/smsotp including configuration file /etc/raddb//modules/expiration including configuration file /etc/raddb//modules/radutmp including configuration file /etc/raddb//modules/etc_group including configuration file /etc/raddb//modules/policy including configuration file /etc/raddb//modules/mac2ip including configuration file /etc/raddb//eap.conf including configuration file /etc/raddb//policy.conf including files in directory /etc/raddb//sites-enabled/ including configuration file /etc/raddb//sites-enabled/default including configuration file /etc/raddb//sites-enabled/control-socket including configuration file /etc/raddb//sites-enabled/smoothtest including configuration file /etc/raddb//sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb//dictionary main { name = "radiusd" prefix = "/usr" localstatedir = "/var" sbindir = "/usr/sbin" logdir = "/var/log/radius" run_dir = "/var/run/radiusd" libdir = "/usr/lib64/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 coa { irt = 2 mrt = 16 mrc = 5 mrd = 30 } } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb//modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb//modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb//modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb//modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { # from file /etc/raddb//radiusd.conf modules { Module: Creating Auth-Type = digest Module: Creating Post-Auth-Type = REJECT Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb//modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb//modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb//modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no allow_retry = yes } Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb//modules/digest Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb//modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb//eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb//certs" pem_file_type = yes private_key_file = "/etc/raddb//certs/server.pem" certificate_file = "/etc/raddb//certs/server.pem" CA_file = "/etc/raddb//certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb//certs/dh" random_file = "/etc/raddb//certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } ocsp { enable = no override_cert_url = yes url = "http://127.0.0.1/ocsp/" } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" soh = no } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb//modules/preprocess preprocess { huntgroups = "/etc/raddb//huntgroups" hints = "/etc/raddb//hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb//modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb//modules/files files { usersfile = "/etc/raddb//users" acctusersfile = "/etc/raddb//acct_users" preproxy_usersfile = "/etc/raddb//preproxy_users" compat = "no" } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb//modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb//modules/detail detail { detailfile = "/var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb//modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb//modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb//attrs.accounting_response" key = "%{User-Name}" relaxed = no } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb//modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb//attrs.access_reject" key = "%{User-Name}" relaxed = no } } # modules } # server server smoothtest { # from file /etc/raddb//sites-enabled/smoothtest modules { Module: Checking authorize {...} for more modules to load Module: Instantiating module "second_files" from file /etc/raddb//modules/files files second_files { usersfile = "/etc/raddb//second_users" acctusersfile = "/etc/raddb//second_acct_users" preproxy_usersfile = "/etc/raddb//second_preproxy_users" compat = "cistron" } [/etc/raddb//second_users]:1 Cistron compatibility checks for entry vin001 ... [/etc/raddb//second_users]:174 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb//second_users]:181 Cistron compatibility checks for entry DEFAULT ... [/etc/raddb//second_users]:188 Cistron compatibility checks for entry DEFAULT ... } # modules } # server server inner-tunnel { # from file /etc/raddb//sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 clients = "disambiguate" client TEST1 { ipaddr = 172.16.22.7 require_message_authenticator = no secret = "test" nastype = "cisco" virtual_server = "smoothtest" } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } } listen { type = "acct" ipaddr = * port = 0 clients = "disambiguate" } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } ... adding new socket proxy address * port 60134 Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.16.22.7 port 1645, id=39, length=76 User-Name = "vin001" User-Password = "admin123" NAS-Port-Type = Virtual NAS-Port = 182 NAS-Port-Id = "72.1.94.34" NAS-IP-Address = 172.16.22.7 server smoothtest { # Executing section authorize from file /etc/raddb//sites-enabled/smoothtest +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "vin001", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop [second_files] users: Matched entry vin001 at line 1 ++[second_files] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP WARNING: Unknown value specified for Auth-Type. Cannot perform requested action. Failed to authenticate the user. } # server smoothtest Using Post-Auth-Type Reject WARNING: Unknown value specified for Post-Auth-Type. Cannot perform requested action. Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 39 to 172.16.22.7 port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 39 with timestamp +156 Ready to process requests.

2 4

Dafault Auth Reply
by Cholleti, Hanumantha 22 May '13

22 May '13

Scenario/Problem: ============== Upon successful authentication of a user, have to send default WiMAX attribute (Initial Service Flow [ISF]) as part of "Access-Accept"; Only if specific WiMax attributes (user specific service flows) are *not* defined for the user in radreply; Example: ======= Let's assume our default ISF response should be: WiMAX-Packet-Data-Flow-Id 1 WiMAX-Service-Data-Flow-Id 1 WiMAX-Direction 2 WiMAX-Activation-Trigger 4 WiMAX-Transport-Type 1 WiMAX-Downlink-QOS-Id 1 WiMAX-Downlink-Classifier permit in any src any dst any WiMAX-QoS-Id 1 WiMAX-Schedule-Type 2 WiMAX-Traffic-Priority 1 WiMAX-Maximum-Sustained-Traffic-Rate 2200000 WiMAX-Minimum-Reserved-Traffic-Rate 1000 WiMAX-Transmission-Policy 208 And User "ABC" is configured to have below service flow response (in radreply), which is different from default ISF: WiMAX-Packet-Data-Flow-Id 111 WiMAX-Service-Data-Flow-Id 101 WiMAX-Direction 1 WiMAX-Activation-Trigger 4 WiMAX-Transport-Type 1 WiMAX-Uplink-QOS-Id 111 WiMAX-Uplink-Classifier permit in ip src any dst any 0-66 priority 3 WiMAX-Uplink-Classifier permit in ip src any dst any 69-65535 priority 3 WiMAX-QoS-Id 111 WiMAX-Schedule-Type 5 WiMAX-Traffic-Priority 1 WiMAX-Maximum-Sustained-Traffic-Rate 5500000 WiMAX-Minimum-Reserved-Traffic-Rate 0 WiMAX-Tolerated-Jitter 1000 WiMAX-Maximum-Latency 1000 WiMAX-Unsolicited-Grant-Interval 40 WiMAX-Transmission-Policy 211 Expected Response =============== 1) If User "ABC" successfully authenticates -> want to send only service flow configured above for "ABC". 2) If User other than ABC (say XYZ, 123, etc... for whom no service flow is configured in radreply) authenticates successfully (with default auth-type set to eap) -> want to send default IFS. Approach we took ============== 1) Added an entry in "radusergroup" table with username and groupname as "DEFAULT-IFS" +-------------+-------------+----------+ | username | groupname | priority | +-------------+-------------+----------+ | DEFAULT-ISF | DEFAULT-ISF | 1 | +-------------+-------------+----------+ 2) Added Default-IFS WiMAX attribute entries in "radgroupreply" table with groupname = "DEFAULT-IFS" 3) updated group_membership_query in dialup.conf file From: group_membership_query = "SELECT groupname \ FROM ${usergroup_table} \ WHERE username = '%{SQL-User-Name}' \ ORDER BY priority" To: group_membership_query = "SELECT groupname \ FROM ${usergroup_table} \ WHERE username = '%{SQL-User-Name}' \ OR (NOT EXISTS (select 1 from radreply where username='%{SQL-User-Name}') \ AND username='DEFAULT-ISF') \ ORDER BY priority" Question ======= The above approach works and provided the access-accept response we expected, but want to confirm if this is the correct approach to the scenario we described or is there a better way to handle this? Sorry for the long email, wanted to provide as much background as possible Thanks -Hanu

1 0

New design/deployment of freeradius
by Tena Gore 22 May '13

22 May '13

Hello, I'm new to radius so I have some basic questions regarding the design and deployment of our freeradius server. We want to use freeradius for our BYOD deployment. We have the following: Ubuntu, OpenLDAP, Ruckus Zone Director and a Safe_Connect NAC. Our passwords are not clear text in ldap. We would like to avoid client certificates and we would like to do dynamic VLAN assignments. I'd like to verify that I'm on the right track here with setting up the protocols and types to use. We have to use PAP because of not having clear text passwords? To avoid client certificates, we can use PEAP type of EAP? Also, we have a wildcard domain SSL certificate, can this be used or do we have to create a new one for this purpose on the server? Is there a recommended configuration for this type of deployment? Do you have any tips or tricks that would make our deployment go smoother? Thanks!

3 3

Selecting authentication based on NAS-IP-Address or Client IP Address
by Jeremiah Peterson 21 May '13

21 May '13

I see that it is possible to create realms and have each realm use a different proxy, but what I am more interested in is having the authentication method be selected based on client. For example: If the request comes from IP 10.10.10.10 and user bob then use home_server_pool xxx (and return attribute "blah blah blah") If the request comes from IP 10.20.20.20 and user bob then use home_server_pool yyy (and return attribute "yadda yadda yadda") If the request comes from IP 10.30.30.30 and user bob then use home_server_pool zzz (and return results from SQL query "xxxxx") I can see how this is done when making the user enter a realm name or prefix or suffix to the username, but I don't want to do that for every authentication. I want the authentication method to be selected based on the client. I have been searching for details on all the configuration files but I am not finding anything very conclusive or explanatory on how to build custom sites. Any help would be appreciated. Thanks for your help. JerLasVegas

2 4

AW: RE: Help with chap
by Matthias Nagel 21 May '13

21 May '13

Hello, actually this behaviour is totally correct. The switch tries to authenticate a client, when the switch learns the clients MAC address. As the MAC address is extracted from the ethernet header there must be some packages sent from the client in order to do so. If the client is quiet, the switch cannot do anything about it. Matthias Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 ICQ: 499797758 Skype: nagmat84"Franks Andy (RLZ) IT Systems Engineer" <Andy.Franks(a)sath.nhs.uk> hat geschrieben:..Just an update.. might be interesting for people - rebooted the switch and not all clients were authenticated, but it seems all those that weren't have 0 bytes for all statistics, tx, rx etc. So I guess they are switched off and the switch seems to need some packets to flow for it to "detect" that the client needs authenticating. Otherwise it looks like it will sit with the port in an up state unathenticated all day long. I guess this sort of makes sense, but in my simple view of how things this isn't intuitive. Also HP manuals don't seem to mention it.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 21 May 2013 22:27 To: FreeRadius users mailing list Subject: RE: Help with chap Thanks Phil. I'll keep that up my sleeve for future use. We tend to separate admin / wireless / mac-based auth off on to different radius boxes. Keeps things a bit easier. Not sure what cisco do, but a lot of their stuff tends to be pap or eap. HP doing chap here seems to limit quite a lot of backend options. It's still also the only protocol, or so it seems, chosen for iscsi authentication which is an interesting choice consider it's vulnerabilites. Guess ipsec gets used instead where it needs to be secure. Now to work out the useraccountcontrol setting. Seems to be different in users and computers than in an ldap viewer, but the ldap is probably a decimal conversion or something. Thanks again Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 21 May 2013 08:06 To: freeradius-users(a)lists.freeradius.org Subject: Re: Help with chap On 05/21/2013 07:55 AM, Franks Andy (RLZ) IT Systems Engineer wrote: > Can I just use the authorize section to set the password to be the > same as the username, i.e. the mac address, after checking some basics > like whether the user exists in ldap and perhaps the > useraccountcontrol value, then in the authorize section just let the > chap bit work on the assigned password? Yes. In fact that's the best approach. Something like: authorize { ... if (some condition) { update control { Cleartext-Password := "%{User-Name}" } } ... } "some condition" would normally be some sort of check to ensure it was a macauth-via-CHAP request - obviously you wouldn't want to force password==username for a PPP/EAP/other "real" user request. On the other hand if your server / virtual server only receives this traffic, you can omit the condition. I really dislike vendors who do macauth as CHAP. It seems to completely lack value, and adds complexity. Le sigh.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0