February 2015 - Freeradius-Users - lists.freeradius.org

RE: Your message to Freeradius-Users awaits moderator approval
by Clement Ogedengbe 24 Feb '15

24 Feb '15

I posted a message giving more details and with attachment of logs captured on this problem, but unfortunately the message is being held until the list moderator can review it for approval. Can I please request for accelerated action please! Best Regards Clement Ogedengbe -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+c.ogedengbe=worc.ac.uk@lists.freeradius.org] On Behalf Of freeradius-users-owner(a)lists.freeradius.org Sent: 24 February 2015 10:44 To: Clement Ogedengbe Subject: Your message to Freeradius-Users awaits moderator approval Your mail to 'Freeradius-Users' with the subject RE: Sudden User Authentication Rejection as a result Compatibility - error Is being held until the list moderator can review it for approval. The reason it is being held: Message body is too big: 352566 bytes with a limit of 100 KB Either the message will get posted to the list, or you will receive notification of the moderator's decision. If you would like to cancel this posting, please visit the following URL: http://lists.freeradius.org/mailman/confirm/freeradius-users/d02cacda23137f…

1 0

Salted SHA security
by Robert Graham 23 Feb '15

23 Feb '15

Question for the Freeradius programmers/admins: How does the authentication for the Salted SHA-512 get handled? Yes, I know you can pull the hashed/salted password from a sql database or locally, but how does the FreeRadius server compare the users input password which would only be the first 64 bytesand the rest being the salt, when the user has only entered in their username and password at the prompts (I.E. mobile devices or laptops). Doesnt the server need to have the users password and salt to be able to compare the pulled password with the entered in password? Ive been trying to do the format that was discussed earlier by changing our code to be hash/salt appended not prepended, and by using Arrans suggestions of: update control { SSHA2-512-Password := "0x%{sql:query to get hash in hex concatenated with salt in hex}" or update control { Tmp-String-0 := "%{sql:SELECT hash FROM <table> WHERE <clause>}" Tmp-String-1 := "%{sql:SELECT salt FROM <table> WHERE <clause>}" } update control { SSHA2-512-Password := "0x%{control:Tmp-String-0}%{control:Tmp-String-1}" If I use radtest everything works just fine locally, but once PEAP is integrated into the mix, it fails (i.e. laptop,cell phone). Am I reading the protocol compability matrix incorrectly then? Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

3 2

CHAP and Cleartext-Password
by Tevfik Ceydeliler 23 Feb '15

23 Feb '15

Hi, I am newbie about Freeradius. I have One time Password Server as proxy. My user comes to freeradius from GSM operator by using an APN Freeradius uses MySQL to store username and IP Pool.When a user come, Freeradius verifies password from OTP and assing an IP address. Thsi what I wanan doç In LAN tests, there was no problem. But when I try to test from APN to connect my user I get some error. Here is my user and log ##################################### mysql> select * from radcheck where username like '%yagmurgida6%'; +-----+----------------------+------------------------------+----+-------+ | id | username | attribute | op | value | +-----+-------------+---------------------------------------+-----+-------+ | 197 | yagmurgida6 | Cleartext-Password | := | test | +-----+-------------+--------------------------------------+------+-------+ ##################################### rad_recv: Access-Request packet from host 172.30.80.1 port 24160, id=115, length=388 Calling-Station-Id = "905330443893" User-Name = "yagmurgida6" NAS-IP-Address = 172.30.80.1 NAS-Identifier = "MTCGGSNK3" Service-Type = Framed-User Framed-Protocol = GPRS-PDP-Context NAS-Port-Type = Wireless-Other 3GPP-IMSI = "286015044743893" 3GPP-IMSI-MCC-MNC = "28601" 3GPP-NSAPI = "5" 3GPP-Selection-Mode = "0" 3GPP-Charging-ID = 56032450 3GPP-GPRS-Negotiated-QoS-profile = "99-13921F7396F7FE74FAF7FE" 3GPP-Charging-Characteristics = "0800" Called-Station-Id = "yasarapn" 3GPP-SGSN-Address = 86.108.153.10 3GPP-SGSN-MCC-MNC = "28601" 3GPP-GGSN-Address = 86.108.153.126 3GPP-GGSN-MCC-MNC = "28601" 3GPP-Negotiated-DSCP = 18 3GPP-RAT-Type = 1 3GPP-Location-Info = 0x0182f610ec77e26f 3GPP-Attr-23 = 0x8000 3GPP-IMEISV = "3541140143174615" 3GPP-PDP-Type = 0 CHAP-Challenge = 0xae4696cc70b2fa9d1628d9b59e19d7c3 CHAP-Password = 0x0245569539ebb803dbc0534c0540ea2bc8 NAS-Port = 56400 # Executing section authorize from file /etc/freeradius/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "yagmurgida6", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{User-Name} -> yagmurgida6 [sql] sql_set_user escaped user --> 'yagmurgida6' rlm_sql (sql): Reserving sql socket id: 4 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE us$ [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE us$ [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'yagmurgida6' ORD$ rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = CHAP # Executing group from file /etc/freeradius/sites-enabled/default +- entering group CHAP {...} [chap] login attempt by "yagmurgida6" with CHAP password [chap] Using clear text password "test" for user yagmurgida6 authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> yagmurgida6 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 172.30.80.1 port 24160, id=115, length=388 Waiting to send Access-Reject to client TurkcellNasClient port 24160 - ID: 115 Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 115 to 172.30.80.1 port 24160 Waking up in 4.9 seconds. Cleaning up request 0 ID 115 with timestamp +3231 Ready to process requests. ################################# As I see, there is CHAP and Cleartext-Password not works together. Because of I use OTP as proxy local password not necessary. So to conenct successfully, what attribute I have to use? -- <br> <img src="http://www.yasar.com.tr/banner/yhbanner.jpg"> </img> <br><br> Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

DHCP option 252
by Дмитрий Симоненко 23 Feb '15

23 Feb '15

My DHCP server responds to DHCP-Relay, but need to respond to the client (in DHCP-Option-252 transmitted 0xfc). __________________________ С уважением, Симоненко Д.В.

1 0

DHCP Option 282
by Дмитрий Симоненко 23 Feb '15

23 Feb '15

How to get rid of DHCP-Inform requests (option 252..... WPAD)??? what add to the dictionary.dhcp and radiusd.conf??? Help please!!! __________________________ С уважением, Симоненко Д.В.

1 0

User file Includes and DEFAULT section.
by Marc Beaumont 23 Feb '15

23 Feb '15

Hi, I'm taking over admin of a bunch of freeradius servers and I'm trying to simplify the users definition file. >From the documentation I can see that you can specify a file to include using the $INCLUDE statement, but I wanted to know if it's possible to include a directory that just has files in and those are automatically included? Also I attempting to specify a DEFAULT section and move all common user entry lines there. Should the DEFAULT section be at the top of the users file or at the bottom as it doesn't seem to work correctly. My DEFAULT section has passthrough set. Marc Scanned by MailDefender - managed email security from intY - www.maildefender.net

2 1

Implementating Ldap userPassword in crypt/sha password with eap ttls mschapv2 /eap peap mschapv2
by Sautron Nick 23 Feb '15

23 Feb '15

Hello everyone, I installed freeradius 2.2.6, and I try to Implement an ldap server, however this ldap password server are "crypt" and "SHA". My question is: Would it be possible to implemente ldap with word passes into crypt/sha, with authentication method EAP TTLS mschapv2 / EAP peap mschapv2 ? Thank you for your answer and enlighten me on this. Best Regards

3 3

Implementing EAP-AKA in FreeRadius 2.2.6 + hostapd
by Landau, Nir 22 Feb '15

22 Feb '15

Hi, I know this subject may have been asked before but I didn't get the answer I was looking for so I will ask again thoroughly. All the basic facts: - I have installed FreeRadius version 2.2.6 including the rlm_sim and rlm_sim_files modules - I have successfully connected a mobile phone through EAP-SIM and it worked perfectly - I have generated the hostapd libeap.so library - I have generated quintlets for the aka auth - I have read the file raddb/experimental.conf file So after laying down all the things I have done I want to understand how to connect with the EAP-AKA. I understand that the code that runs is not part of FreeRadius and that is why we need the libeap file What I don't understand is the configuration I need to make in the FreeRadius and how everything is connected. What exactly do I need to do? (A step by step instructions would be great). Thank you very much Nir This electronic message may contain proprietary and confidential information of Verint Systems Inc., its affiliates and/or subsidiaries. The information is intended to be for the use of the individual(s) or entity(ies) named above. If you are not the intended recipient (or authorized to receive this e-mail for the intended recipient), you may not use, copy, disclose or distribute to anyone this message or any information contained in this message. If you have received this electronic message in error, please notify us by replying to this e-mail.

2 1

Freeradius reply to mikrotik for limitation bandwidth
by Jellf Nainggolan 22 Feb '15

22 Feb '15

Helo, I have a server freeradius for authentication users DHCP on my network. connection and dhcp server control by the mikrotik. now i can set IP for client base on freeradius reply. but i have a issue how to control users bandwidth. can we push mikrotik to create profiling for users with avp reply from radius? Thanks

2 1

I would like to get some referrals on a start point into FreeRadius.
by Eliezer Croitoru 21 Feb '15

21 Feb '15

Hey, My name is Eliezer Croitoru and I was interested in FreeRadius since long ago but never had the chance to get some guidance about the right path with it. I must say that most of my experience years are with PC and just now started with more advanced setups. I wanted to integrate squid with FreeRadius in some setup but unsure where and how would be the right starter point. I have seen setups with LDAP and it from a reason seems a bit complicated to my eyes since I do not have enough knowledge about it. So in general I am looking for recommendations about the right path to learn. Thanks, Eliezer

1 0