June 2013 - Freeradius-Users - lists.freeradius.org

Q: Define realms per virtual server.
by David Mitchell 10 Jun '13

10 Jun '13

Greetings, I'm hitting a situation where I would like to be able to define different realms in my virtual servers. Simply including realm definitions inside of the virtual servers doesn't work. It doesn't generate an error either, but the defined realm doesn't work. server internal { realm DEFAULT { authhost = remote1.com accthost = remote1.com nostrip } listen { ipaddr = * port = 1814 type = auth } listen { ipaddr = * port = 1815 type = acct } . . . } The 'realm' keyword is overloaded, being used both for the definitions of the delimiters and of the realms themselves. And while the former is loaded via a module syntax and can be loaded per-virtual-server (via suffix, ipass, etc.) I can't find any way to restrict the actual realm definitions to a virtual server. They are all global configuration loaded via proxy.conf. Is there some method I'm missing for making the realm definitions per-server? Thanks in advance, -David Mitchell ----------------------------------------------------------------- | David Mitchell (mitchell(a)ucar.edu) Network Engineer IV | | Tel: (303) 497-1845 National Center for | | FAX: (303) 497-1818 Atmospheric Research | -----------------------------------------------------------------

2 2

Re: EAP-TTLS security level
by Alan Buxey 10 Jun '13

10 Jun '13

The security depends on the configuration of your clients and the certificate chosen for your radius server alan This smartphone uses eduroam for free WiFi access around the world. Now that's what I call smart.

1 0

RE: EAP post auth reject and access-challenge
by Franks Andy (RLZ) IT Systems Engineer 10 Jun '13

10 Jun '13

Hi, I have a setup that just does admin logins for NAS equipment, some of it presents via PAP and some of it peap/mschapv2. When the user is rejected I do a linelog or sql insert, capturing a failure reason from each module. Basically an EAP reject of a user creates two entries to the logging. I do failure logging within the inner-tunnel VS as well as the default because I wanted it to capture a failure reason to the line log based on the module-failure-reason string, which is lost after the eap session rejects and can't be seen in the default. As you commented in an email from last week, updating the outer.control variable to try and pass module-failure-reason doesn't work due to the access-challenge presenting a new session. I'm also doing some stuff in the authorization section which can reject a user based on some ldap information. I thought I could perhaps just update the default tunnel post-auth reject section to not do a linelog if auth-type has been set to EAP but it doesn't work when clients are rejected in this ldap section; the EAP auth-type is set but it never authenticates as the reject is triggered first, and so a linelog would never be recorded in the inner tunnel post auth reject section. I hope that's not too confusing, it's hard to explain. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 10 June 2013 16:02 To: freeradius-users(a)lists.freeradius.org Subject: Re: EAP post auth reject and access-challenge On 10/06/13 15:45, Franks Andy (RLZ) IT Systems Engineer wrote: > Hi, > > Just wondered if someone could explain the reason why, on rejection > of EAP authentication, an access challenge request is sent out to the > NAS, and whether it's something we can control or not? I assume you're referring to the fact that the inner tunnel reject is sent as an outer access-challenge? The packet flow is this: C: Access-Request EAP / TLS-setup S: Access-Challenge EAP / TLS-setup ... C: Access-Request EAP / TLS / inner access-request S: Access-Challenge EAP / TLS / inner access-reject C: Access-Request EAP / TLS [ack] S: Access-Reject EAP / reject Basically, the protocols send the inner reject as a TLS frame, so that the client can't be tricked by a fake reject. The client then ACKs it, and the server then sends the RADIUS-level reject. So no, you can't turn it off - it's part of the protocol specifications. Why is this a problem for you? - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

EAP post auth reject and access-challenge
by Franks Andy (RLZ) IT Systems Engineer 10 Jun '13

10 Jun '13

Hi, Just wondered if someone could explain the reason why, on rejection of EAP authentication, an access challenge request is sent out to the NAS, and whether it's something we can control or not? Thanks Andy

2 1

stripping the realm
by geebs 10 Jun '13

10 Jun '13

Hello, Not sure what I'm missing here, i seem to not be able to get this to work. One of those things, I've done it many times yet I've missed a step I think. This server is used to authenticate pppoe connections on a cisco router. I just want freeradius to strip the realm every time. Debian Wheezy freeradius -XX Sun Jun 9 16:43:58 2013 : Info: FreeRADIUS Version 2.1.12, for host x86_64-pc-linux-gnu, built on Dec 16 2012 at 13:28:43 It works fine without a realm, returns all the right values; root@chronos:/etc/freeradius# radtest testaccount test1234 localhost 0 testing123 Sending Access-Request of id 95 to 127.0.0.1 port 1812 User-Name = "testaccount" User-Password = "test1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=95, length=56 Framed-IP-Address = 10.8.13.19 Tunnel-Type:0 = L2TP Tunnel-Medium-Type:0 = IPv4 Service-Type = Framed-User Framed-Protocol = PPP Framed-IP-Netmask = 255.255.255.255 root@chronos:/etc/freeradius# With a realm, no good. rad_recv: Access-Request packet from host 127.0.0.1 port 52011, id=44, length=92 User-Name = "testaccount(a)domain.com" User-Password = "test1234" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 Message-Authenticator = 0x6c233bef9def046c0b422486e2aef3a1 Sun Jun 9 16:46:05 2013 : Info: # Executing section authorize from file /etc/freeradius/sites-enabled/default Sun Jun 9 16:46:05 2013 : Info: +- entering group authorize {...} Sun Jun 9 16:46:05 2013 : Info: ++[preprocess] returns ok Sun Jun 9 16:46:05 2013 : Info: ++[chap] returns noop Sun Jun 9 16:46:05 2013 : Info: ++[mschap] returns noop Sun Jun 9 16:46:05 2013 : Info: ++[digest] returns noop Sun Jun 9 16:46:05 2013 : Info: [suffix] Looking up realm "domain.com" for User-Name = "testaccount(a)domain.com" Sun Jun 9 16:46:05 2013 : Info: [suffix] No such realm "domain.com" Sun Jun 9 16:46:05 2013 : Info: ++[suffix] returns noop Sun Jun 9 16:46:05 2013 : Info: [eap] No EAP-Message, not doing EAP Sun Jun 9 16:46:05 2013 : Info: ++[eap] returns noop Sun Jun 9 16:46:05 2013 : Info: ++[files] returns noop Sun Jun 9 16:46:05 2013 : Info: [sql] expand: %{User-Name} -> testaccount(a)domain.com Sun Jun 9 16:46:05 2013 : Info: [sql] sql_set_user escaped user --> ' testaccount(a)domain.com' Sun Jun 9 16:46:05 2013 : Debug: rlm_sql (sql): Reserving sql socket id: 3 Sun Jun 9 16:46:05 2013 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = ' testaccount(a)domain.com' ORDER BY id Sun Jun 9 16:46:05 2013 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'testaccount(a)domain.com' ORDER BY priority Sun Jun 9 16:46:05 2013 : Debug: rlm_sql (sql): Released sql socket id: 3 Sun Jun 9 16:46:05 2013 : Info: [sql] User testaccount(a)domain.com not found Sun Jun 9 16:46:05 2013 : Info: ++[sql] returns notfound Sun Jun 9 16:46:05 2013 : Info: ++[expiration] returns noop Sun Jun 9 16:46:05 2013 : Info: ++[logintime] returns noop Sun Jun 9 16:46:05 2013 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Sun Jun 9 16:46:05 2013 : Info: ++[pap] returns noop Sun Jun 9 16:46:05 2013 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Sun Jun 9 16:46:05 2013 : Info: Failed to authenticate the user. Sun Jun 9 16:46:05 2013 : Info: Using Post-Auth-Type Reject Sun Jun 9 16:46:05 2013 : Info: # Executing group from file /etc/freeradius/sites-enabled/default Sun Jun 9 16:46:05 2013 : Info: +- entering group REJECT {...} Sun Jun 9 16:46:05 2013 : Info: [attr_filter.access_reject] expand: %{User-Name} -> testaccount(a)domain.com Sun Jun 9 16:46:05 2013 : Debug: attr_filter: Matched entry DEFAULT at line 11 Sun Jun 9 16:46:05 2013 : Info: ++[attr_filter.access_reject] returns updated Sun Jun 9 16:46:05 2013 : Info: Delaying reject of request 0 for 1 seconds Sun Jun 9 16:46:05 2013 : Debug: Going to the next request Sun Jun 9 16:46:05 2013 : Debug: Waking up in 0.9 seconds. Sun Jun 9 16:46:06 2013 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 44 to 127.0.0.1 port 52011 Sun Jun 9 16:46:06 2013 : Debug: Waking up in 4.9 seconds. I don't recall having to setup a realm in previous installs. However I did used to use an older version of freeradius. Thanks in advance :) Jules.

3 4

How to get the output of Oracle PL/SQL query in table format
by manjunath uthappa ponnachana 10 Jun '13

10 Jun '13

HI, I am using oracle database in free Radius while using sql module. Have to Write a stored procedure which requires the output in table format. How to get this output in table format in free radius. Thanks & Regards Manjunath  

2 1

How to define free radius attribute as output
by manjunath uthappa ponnachana 10 Jun '13

10 Jun '13

Hi, How to define free radius attribute as output when used as a variable in SQL statement. Thanks & Regards Manjunath

2 1

ippool-dhcp and Oracle
by Бен Томпсон 09 Jun '13

09 Jun '13

Hello Everyone Could anyone advise me what would be required to us dhcp-ippool with Oracle? I had a quick look through the files in git and it seems to me that the only thing missing is queries.conf? If that is all that is required I am happy to do the work of porting the sql queries from the mysql version, but I just wanted the check that I am not missing something. Ben

3 16

EAP-TTLS security level
by Emmanuel BILLOT 09 Jun '13

09 Jun '13

Hi, We are thinking about using radius authentification trough Internet. Considering we use EAP-TTLS method for authenticating wifi users, is there any way to intercept user passwords ? Is EAP-TTLS as secure as https or smtps ? BR, -- Emmanuel BILLOT CATEL - Dpt. Système et Réseaux Rectorat - Académie d'Orléans-Tours 10, rue Molière - 45000 Orléans Tél : 02 38 79 45 57

2 1

(no subject)
by martin robertino 08 Jun '13

08 Jun '13

1 0