February 2014 - Freeradius-Users - lists.freeradius.org

EAP-TLS and random_file
by Gregory Sloop 10 Feb '14

10 Feb '14

I'm curious about the many "examples" of EAP-TLS setup "how-to's" on the web. [I did some searches of the list and elsewhere, and came up dry, though I didn't spend a long time on it...] In many of them, the random_file is a pre-generated random set of data. Knowing what [modest amount] I do, this seems like an incredibly bad idea. [At least with a functional random number generator at your disposal.] There is at least one newer one using /dev/urandom [pseudo-random]. The stock eap.conf file in Ubuntu also does this. I'm curious about why it would have ever been a pre-generated set of bits, which essentially have no entropy once they're given out/used - because they're not random any more, they're predictable. If some kind soul would give me the trivia edition of why this was a common solution, I'd be grateful. [Or school me, nicely or course, about why you think it's an "Ok" practice.] -Greg

3 2

Radius Issue, No response from server
by Rishabh.Shukla 10 Feb '14

10 Feb '14

Hello, I have deployed radius server + daloradius + MySQL in centos 6 and all configuration is done perfectly. I have added HP ProCurve switch 3400 CL as my NAS for sending authentication requests. The scenarios is this: the server is responding and accepting the packets locally but when I try to authenticate through the HP ProCurve switch the server does not respond. I have also stopped the iptables services still radius server is not listening and during debug we found that the request is not even reaching radius server and moreover I am not getting any error message at all. I will be grateful if anybody can help me out to overcome this problem. Thanks and regards Rishabh.

4 3

Question on new dictionaries & values
by Mathieu Simon (Lists) 10 Feb '14

10 Feb '14

G'day I've been pondering a bit on the different dictionnaries and hope to provide some new. I understand that modifying/renaming old values can be is putting at risk current setups current setups, however new ones are easier to add :-) What is the current consenscus on tha Attribute naming. I've learned that underline usage isn't appreciated even though some vendors use it. VENDOR foovendor <id> a) ATTRIBUTE foovendor-name-by-vendor-doc... b) ATTRIBUTE name-by-vendor-doc... I've seen both in usage but mostly consistently throughout a dictionary itself (some vendors indicate variant a, some don't but it doesn't always match with FR's dicts). Thanks for your feedback, I hope to send in some Equallogic updates to other vendors dictionaries that I've found on respective vendor docs. -- Mat

3 3

rlm_exec with ntlm_auth broken in 3.0.2+git??
by peter.geiser＠id.unibe.ch 10 Feb '14

10 Feb '14

Is ntlm_auth with clear text password broken in FR 3.0.2+git? Modul Config: # exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --domain=DOMAIN --username=%{mschap:User-Name} --password=%{User-Password}" } Debug output: Found Auth-Type = ntlm_auth (0) # Executing group from file /etc/freeradius/sites-enabled/ntlm (0) Auth-Type ntlm_auth { (0) ntlm_auth : Executing: /usr/bin/ntlm_auth --request-nt-key ‹domain=DOMAIN --username=%{mschap:User-Name} --password=%{User-Password} (0) ntlm_auth : expand: "--username=%{mschap:User-Name}" -> '--username=testuser' (0) ntlm_auth : expand: "--password=%{User-Password}" -> '--password=TEST1234' (0) ERROR: ntlm_auth : Failed parsing output from: /usr/bin/ntlm_auth --request-nt-key ‹domain=DOMAIN --username=%{mschap:User-Name} --password=%{User-Password}: Expecting operator (0) ERROR: ntlm_auth : Program returned code (0) and output 'NT_STATUS_OK: Success (0x0)' (0) [ntlm_auth] = fail (0) } # Auth-Type ntlm_auth = fail (0) Failed to authenticate the user. Authentication seems to be ok but FR can¹t parse the return values. Thanks for any Feedback. - Peter

2 2

Support for specific Cisco-Attributes
by Andreas Kalb (akalb) 07 Feb '14

07 Feb '14

Hello, I'm trying to use attributes like: Cisco-Enc += "xyz=1" Cisco-SSG-Account-Info += "Aratelimit(up=2000,down=2000)" where I get the following errors: /etc/freeradius/users[101]: Parse error (reply) for entry the-bob-10-v4v6-28(a)example.org: Invalid octet string "xyz=1" for attribute name "Cisco-Enc" Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[124]: Failed to load module "files". /etc/freeradius/sites-enabled/inner-tunnel[47]: Errors parsing authorize section. /etc/freeradius/users[113]: Parse error (reply) for entry the-bob-10-v4v6-28(a)example.org: Invalid octet string "Aratelimit(up=2000,down=2000)" for attribute name "Cisco-SSG-Account-Info" Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[124]: Failed to load module "files". /etc/freeradius/sites-enabled/inner-tunnel[47]: Errors parsing authorize section. Without these attributes all is working as expected. I tried this with combinations of Ubuntu 12.04.4, 13.10 and FreeRadius 2.1.10 (via apt-get), FreeRadius 2.2.3 and 3.0.1 (via configure/make/install) all in VMware. When going via install I preceded this with: - sudo apt-get install gcc make build-essential - sudo apt-get install libtalloc-dev to prevent concerning errors. A colleague uses above with success with 2.1.10, so I consider any setting missing. I tried to keep the config-files provided with the distribution but understood required to: - a client-entry in clients.conf for my router - listen-commands to radiusd.conf for own ip and to adjust the port to 1645/1646 - 2 user-entries in users So far I didn't try to copy his setup over, but if one proposes it, I'd give it a try. If a specific software is required or a knob is missing, I appreciated some feedback. Kind Regards, Andreas

2 2

proxy question
by adrian.p.smith＠bt.com 07 Feb '14

07 Feb '14

Hopefully an easy one to answer by the experts..... I've read some old posts, but just want to confirm. 1. When proxying requests FreeRadius will not perform any retries? But will forward retries received from clients? 2. The only retries are when status-checks are being done? Many thanks. Adrian Smith.

4 7

IP Address as User name
by Darren Ward (darrward) 07 Feb '14

07 Feb '14

Hi All I'm struggling with getting an IP address to eb accepted as a username in the clients file and suspect it's somehow being filtered but I can't find where I've create a user like: Test Cleartext-Password := "test" And using radtest can get an access-accept but when I try: 1.1.1.1 Cleartext-Password := "test" I get an access-reject and it has a noop against the files in the debug I have tried in quotes as well but no luck Can anyone point me in the right direction as the configs are quite vanilla/plain Darren

3 3

Does freeradius can automatically add new user in own user database
by matrix30003 07 Feb '14

07 Feb '14

Does freeradius can automatically add new user in own user database. For example I will be send request to freeradius with request add new user in freeradiusd users datastore.

4 4

split Called-Station-Id
by Zeus Panchenko 07 Feb '14

07 Feb '14

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 hi, please, where am I mistaking? I need to auth user, comming from via hostapd as client, only if the user belongs to definite Ldap-Group (works fine via radiusGroupName attribute set for user LDAP object) and SSID (which I'm unable to pick - From Called-Station-Id) ... please advise how to do that correct ... I am trying to do it the way described here: http://wiki.freeradius.org/guide/Mac%20Auth#Mac-Auth-authorisation-by-SSID in debug I see - ---[ quotation start ]------------------------------------------- ... rad_recv: Access-Request packet from host 10.241.16.117 port 58063, id=40, length=202 User-Name = "vudhNrF7zxJJmteIVF/Xzg==" NAS-Identifier = "es-student.wrt" Called-Station-Id = "48-5B-39-E7-B0-3B:USER_SSID" NAS-Port-Type = Wireless-802.11 NAS-Port = 2 Calling-Station-Id = "00-BD-3A-69-69-1B" Connect-Info = "CONNECT 54Mbps 802.11g" Framed-MTU = 1400 EAP-Message = 0x0254001d01767564684e7246377a784a4a6d74654956462f587a673d3d Message-Authenticator = 0x6c46a58131867c13ca7fb318d9d407fd ... Fri Jan 31 22:50:48 2014 : Info: ++[logintime] = noop Fri Jan 31 22:50:48 2014 : Info: ++policy rewrite.called_station_id { ... Fri Jan 31 22:50:48 2014 : Info: ? Evaluating (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) -> TRUE Fri Jan 31 22:50:48 2014 : Info: +++? if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) -> TRUE Fri Jan 31 22:50:48 2014 : Info: +++if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) { Fri Jan 31 22:50:48 2014 : Info: ++++update request { Fri Jan 31 22:50:48 2014 : Info: expand: %{1}%{2}%{3}%{4}%{5}%{6} -> 485b39e7b03b Fri Jan 31 22:50:48 2014 : Info: expand: %{7} -> USER_SSID Fri Jan 31 22:50:48 2014 : Info: ++++} # update request = noop Fri Jan 31 22:50:48 2014 : Info: +++} # if (Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_. ]*)?/i) = noop Fri Jan 31 22:50:48 2014 : Info: +++ ... skipping else for request 1: Preceding "if" was taken Fri Jan 31 22:50:48 2014 : Info: ++} # policy rewrite.called_station_id = updated ... - ---[ quotation end ]------------------------------------------- but what is next? so, how to get Called-Station-Id and Called-Station-SSID set to be able to add SSID to user ldap attributes? - -- Zeus V. Panchenko jid:zeus@im.ibs.dn.ua IT Dpt., I.B.S. LLC GMT+2 (EET) -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.19 (FreeBSD) iEYEARECAAYFAlLsFQQACgkQr3jpPg/3oyrdogCgn6YZa0otNybkcWo38KHLRomD adsAoKVxMXQhF48JC6unIqdftzrEXZva =oe77 -----END PGP SIGNATURE-----

2 3

Username Wildcards?
by Darren Ward (darrward) 06 Feb '14

06 Feb '14

Hi All Sorry for what I'm sure is hopefully a simple question... Is it possible to have wildcards in a username? e.g. remote* Cleartext-Password = "password" to match remote101 and remote102 etc? Addressing is being done via DHCP pools but I need to have a few common attributes sent - I know passwords will be common but that's fine I don't want to type out 500 or so identical usernames with a three character variance ! :) Cheers Darren

4 4