June 2014 - Freeradius-Users - lists.freeradius.org

Is it possible to set asterisk's VoIP authentication to be based on EAP-SIM auth of freeradius?
by Muhammad Hasan 27 Jun '14

27 Jun '14

Hi all, I want to make initial VoIP authentication process from asterisk server to be based on EAP-SIM authentication of Freeradius server (so it will be not necessary to insert account datas in the asterisk database). Is there any way of doing that from Freeradius? Or at least, is there any way to sync the EAP-SIM data on Freeradius to asterisk server? thank you -- Best Regards,

2 4

Troubleshoot Error
by Angelo C. De Guzman 26 Jun '14

26 Jun '14

Hi, I'm basically new to freeradius. Please help to isolate this problem. Shown below are the logs for radiusd -X. I'm getting the warning below. It looks like I'm having config issues and cannot find where to start. I just did a local check if Authentciation will be accepted. echo "User-Name=testing,User-Password=testing,Framed-Protocol=PPP " | /usr/local/bin/radclient localhost:1812 auth testing123 Radiusd -X debug Received Access-Request Id 252 from 127.0.0.1:60268 to 127.0.0.1:1812 length 53 User-Name = 'testing' User-Password = 'testing' Framed-Protocol = PPP (1) # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default (1) authorize { (1) filter_username filter_username { (1) if (User-Name != "%{tolower:%{User-Name}}") (1) EXPAND %{tolower:%{User-Name}} (1) --> testing (1) if (User-Name != "%{tolower:%{User-Name}}") -> FALSE (1) if (User-Name =~ / /) (1) if (User-Name =~ / /) -> FALSE (1) if (User-Name =~ /@.*@/ ) (1) if (User-Name =~ /@.*@/ ) -> FALSE (1) if (User-Name =~ /\\.\\./ ) (1) if (User-Name =~ /\\.\\./ ) -> FALSE (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) (1) if ((User-Name =~ /@/) && (User-Name !~ /(a)(.+)\\.(.+)$/)) -> FALSE (1) if (User-Name =~ /\\.$/) (1) if (User-Name =~ /\\.$/) -> FALSE (1) if (User-Name =~ /(a)\\./) (1) if (User-Name =~ /(a)\\./) -> FALSE (1) } # filter_username filter_username = notfound (1) [preprocess] = ok (1) [chap] = noop (1) [mschap] = noop (1) [digest] = noop (1) suffix : No '@' in User-Name = "testing", looking up realm NULL (1) suffix : No such realm "NULL" (1) [suffix] = noop (1) eap : No EAP-Message, not doing EAP (1) [eap] = noop (1) files : users: Matched entry DEFAULT at line 181 (1) [files] = ok (1) [expiration] = noop (1) [logintime] = noop (1) WARNING: pap : No "known good" password found for the user. Not setting Auth-Type. (1) WARNING: pap : Authentication will fail unless a "known good" password is available. (1) [pap] = noop (1) } # authorize = ok (1) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject (1) Failed to authenticate the user. (1) Using Post-Auth-Type Reject (1) # Executing group from file /usr/local/etc/raddb/sites-enabled/default (1) Post-Auth-Type REJECT { (1) attr_filter.access_reject : EXPAND %{User-Name} (1) attr_filter.access_reject : --> testing (1) attr_filter.access_reject : Matched entry DEFAULT at line 11 (1) [attr_filter.access_reject] = updated (1) eap : Request didn't contain an EAP-Message, not inserting EAP-Failure (1) [eap] = noop (1) remove_reply_message_if_eap remove_reply_message_if_eap { (1) if (reply:EAP-Message && reply:Reply-Message) (1) if (reply:EAP-Message && reply:Reply-Message) -> FALSE (1) else else { (1) [noop] = noop (1) } # else else = noop (1) } # remove_reply_message_if_eap remove_reply_message_if_eap = noop (1) } # Post-Auth-Type REJECT = updated (1) Delaying response for 1 seconds Waking up in 0.3 seconds. Waking up in 0.6 seconds. (1) Sending delayed response Sending Access-Reject Id 252 from 127.0.0.1:1812 to 127.0.0.1:60268 Waking up in 3.9 seconds. (1) Cleaning up request packet ID 252 with timestamp +1643 Ready to process requests. Thanks, Gie

2 2

RE: Certificate push for eap-tls clients
by Franks Andy (RLZ) IT Systems Engineer 25 Jun '14

25 Jun '14

Hi, Thanks for the messages back. I'd forgotten about insertion of the CA into the certificate chain with openssl, which is helpful. I guess it would be useful to experiment with using a certificate tool, web server and autogenerated html page via php or something to give the user a one-time link if they are put into the "remuneration" vlan by freeradius. No idea how you start packaging up profiles but maybe the CAT tool is useful there. Seems to always be a case of "use the commercial or brew your own" with what I'm doing at the moment! Cheers Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Matthew Newton Sent: 25 June 2014 15:25 To: FreeRadius users mailing list Subject: Re: Certificate push for eap-tls clients Hi, On Wed, Jun 25, 2014 at 12:21:48PM +0100, Franks Andy (RLZ) IT Systems Engineer wrote: > Unfortunately we don't run an openssl / tinyca etc based CA, it's AD > based and I have no control over that, and we also need to stick with > TLS rather than another method of PEAP like mschapv2. As you say you're AD based, just in case you didn't realise: if your clients are all Windows and joined to the domain, then CA management is automatic and they will have a client cert on them that you can just use to authenticate, so the domain manages that side for you and you don't need to worry about it. Of course, if some clients aren't domain joined then you do still have the cert deployment issue, which is the usual issue with EAP-TLS. As Alan said, you probably want to look at some other deployment system. FreeRADIUS isn't that. Remember you can still make an intermediate signing cert with e.g. OpenSSL, sign it with the domain CA, then use that to generate all certs for non-domain members, if you don't/can't use the AD cert services directly. Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk> - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Certificate push for eap-tls clients
by Franks Andy (RLZ) IT Systems Engineer 25 Jun '14

25 Jun '14

Hi All, I've had a look around and couldn't find much information about how to do this, so thought I'd maybe try my luck here! In a demonstration of clearpass (Aruba radius product) one nice thing it did was send certificates direct to clients (or made a webpage available with a cert download link). Does anyone know whether this is possible in some way with a freeradius based radius system? Unfortunately we don't run an openssl / tinyca etc based CA, it's AD based and I have no control over that, and we also need to stick with TLS rather than another method of PEAP like mschapv2. I'm not aware of an exposed api, apart from the obvious web based, interactive one that exists with an MS CA. Anything else presumably couldn't be controlled via linux anyway.. Any ideas? Thanks Andy

3 2

authentication : double login because of not expired cookie
by Pieter Vernooij 25 Jun '14

25 Jun '14

Experts, For a project I'm involved in, I've successfully setup Radius authentication (using OTP) between a web application (which includes an Apache webserver and mod_radius_auth) and an (external) Radius server. (Relevant: I've set cookie expiry time to a time interval of 8 hours, as choosing a shorter time interval caused problems in the behavior of my web application.) However, I have some difficulties with Radius cookie-expiry behavior. When a user closes the webapplication (after a successful login), and tries to login again with his username + token (having a cookie on his system which has not been expired yet): - the web browser either gives a 401 error page or - asks for re-authentication (asking for credentials again..) (exact behavior is browser dependent). After such message, the user can login again. It seems that the older cookie is then discarded / invalided. This is rather user unfriendly. Does anyone has an idea how to deal with this? Best would be to have the cookie deleted from my system after the user logs off or closes the browser. Is turning to mod_auth_xradius a possible solution ? Or can I tweak something on Apache level? Thanks you ever so much and greetings from the Netherlands, Pieter cheers, Pieter

1 0

Need to auth all instead of proxy for 1 realm
by azander 23 Jun '14

23 Jun '14

Greetings, I am running FreeRadius 2.2.x (Working on upgrading to 3.x.x) but ran into a near emergency situation. One of my customer's radius servers died. I need to auth-all their customers, but not any of the other proxied radius users. Is there a relatively simple way to do this? I cannot seem to find it in the docs. -- William

2 2

SQL syntax error in DHCP + Freeradius 3.x
by Marcelo Gondim 23 Jun '14

23 Jun '14

Hi all, When I try to connect via dhclient, I receive this syntax error on radiusd -X: rlm_sql (sql): Executing query: 'SELECT framedipaddress FROM radippool WHERE pool_name = 'local' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> 'DHCP-08:00:27:93:ff:5d'), (callingstationid <> '08:00:27:93:ff:5d'), expiry_time LIMIT 1 OR UPDATE' rlm_sql_mysql: MYSQL check_error: 1064 received rlm_sql (sql): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'OR UPDATE' at line 1 ) ERROR: dhcp_sqlippool : database query error on 'SELECT framedipaddress FROM radippool WHERE pool_name = '%{control:Pool-Name}' AND (expiry_time < NOW() OR expiry_time IS NULL) ORDER BY (username <> '%{User-Name}'), (callingstationid <> '%{Calling-Station-Id}'), expiry_time LIMIT 1 OR UPDATE' My allocate_find in mods-config/sql/ippool-dhcp/mysql/queries.conf: allocate_find = "\ SELECT framedipaddress \ FROM ${ippool_table} \ WHERE pool_name = '%{control:Pool-Name}' \ AND (expiry_time < NOW() OR expiry_time IS NULL) \ ORDER BY \ (username <> '%{User-Name}'), \ (callingstationid <> '%{Calling-Station-Id}'), \ expiry_time \ LIMIT 1 \ OR UPDATE" I´m using FreeBSD 10-STABLE with mysql 5.5 and Freeradius 3.0.3 Cheers, Gondim

2 1

freeradius radclient MSCHAPv2 command string
by Stephen Nichols 23 Jun '14

23 Jun '14

Hi, I want to use radclient to access radius server using MSCHAPv2. Using freeradius version 2.1.12 on CentOS and 2.2.3 on our own Linux server. I have used the following string to successfully authenticate using MSCHAPv1. Echo 'User-Name = User1,MS-CHAP-Password =mypassword,NAS-IP-Address =172.21.100.131,NAS-Port-Type=15,NAS-Port=1' | radclient -X 172.21.20.50 auth testing123 Searched around and checked radclient -h, but found no information regarding format for an MSCHAPv2 command string. Thanks This e-mail from Ultra Electronics and any attachments to it are confidential to the intended recipient and may also be privileged. If you have received it in error please notify the sender and delete it from your system. If you are not the intended recipient you must not copy it or use it for any purpose nor disclose or distribute its contents to any other person. All communications may be subject to interception or monitoring for operational and/or security purposes. Please rely on your own virus checking as the sender cannot accept any liability for any damage arising from any bug or virus infection. Recipient shall control the disclosure & access of technical data, information, and other items received under this e-mail in accordance with U.S. export control laws & regulations, including but not limited to the ITAR. No technical data, information or other items provided by Ultra Electronics - DNE Technologies, Inc. in connection with this email shall be provided to any foreign persons or to a foreign entity, including without limitation, a foreign subsidiary of recipient without the express written authorization of Ultra Electronics - DNE Technologies, Inc.; dissemination to non-U.S. persons whether in the United States or abroad requires an export license or other authorization

2 1

Logging UDP port
by Jonathan Gazeley 23 Jun '14

23 Jun '14

We've got several RADIUS clients behind a NAT, so we can't distinguish them by source IP. We do not control those NAS (or the NAT) so we can't insert arbitrary attributes, either. Is there a way radiusd can log the UDP port on which a packet entered a virtual server? I think this might be our only way of distinguishing these clients. Thanks, Jonathan

5 5

Using Client-Shortname within perl module
by Alex Sharaz 23 Jun '14

23 Jun '14

Hi, I'm using perl to convert various attributes into a standardised XX-XX-XX-XX-XX-XX format e.g $RAD_REQUEST{'Calling-Station-Id'} = &formatMac($RAD_REQUEST{'Calling-Station-Id'}); $RAD_REQUEST{'Called-Station-Id'} = &formatMac($RAD_REQUEST{'Called-Station-Id'}); $RAD_REQUEST{'User-Name'} = &formatMac($RAD_REQUEST{'User-Name'}); which works just fine. However, our Comp Science dept decided not to use the same hex formatting as us so when I proxy mac-auth requests off to their server, I need to make sure that I don't do the above. Is there any way I can wrap an if ( Client-Shortname != "cseswitches") { ... } round the above so that I only perform the conversion when processing non Comp Sci requests? Rgds A

3 2