- Freeradius-Users - lists.freeradius.org

Framed-IP-Address Problem
by Tawanda Kavayi 11 Jan '12

11 Jan '12

Hi, I am using Freeradius 2.1.12 with mysql and Daloradius GUI. My setup is a Wimax network with AAA for the ASN gateway being handled by Freeradius. My problem is that I have configured FR to assign framed ip addresses to authenticated clients, but instead the IP's are being assigned from the IP pool on the ASN gateway, ignoring the configured framed IP's. After authentication, mysql returns the correct framed-ip-address 192.168.15.230 as seen below: [chap] login attempt by "test(a)domain.com" with CHAP password [chap] Using clear text password "test123" for user test(a)domain.com authentication. [chap] chap user test(a)domain.com authenticated succesfully ++[chap] returns ok Login OK: [test(a)domain.com] (from client domain-asn port 0 via TLS tunnel) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/inner-tunnel +- entering group post-auth {...} [sql] expand: %{User-Name} -> test(a)domain.com [sql] sql_set_user escaped user --> 'test(a)domain.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> 0xc5b5adb448177f060c8a0ce8e2f5d9825b [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '0xc5b5adb448177f060c8a0ce8e2f5d9825b', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '0xc5b5adb448177f060c8a0ce8e2f5d9825b', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 ++[sql] returns ok } # server inner-tunnel [ttls] Got tunneled reply code 2 Framed-IP-Address == 192.168.15.230 [ttls] Got tunneled Access-Accept [eap] Freeing handler ++[eap] returns ok Login OK: [test(a)domain.com] (from client domain-asn port 0 cli 00-1f-fb-20-77-36) # Executing section post-auth from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-auth {...} [main_pool] Could not find Pool-Name attribute. ++[main_pool] returns noop [sql] expand: %{User-Name} -> test(a)domain.com [sql] sql_set_user escaped user --> 'test(a)domain.com' [sql] expand: %{User-Password} -> [sql] ... expanding second conditional [sql] expand: %{Chap-Password} -> [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'test(a)domain.com', '', 'Access-Accept', '2012-01-10 16:36:04') rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok ++[exec] returns noop [wimax] MIP-RK = 0x47f3a3de8d92cc0321d93ba416a996bca3a05be28ce5f7fafe1bb8e5e808502314441d13c050e63812309136c0ec1146892dcea4d50314eb4b72a465bdcf7bb9 [wimax] MIP-SPI = 8cac90f1 [wimax] WARNING: WiMAX-MN-NAI was not found in the request or in the reply. [wimax] WARNING: We cannot calculate MN-HA keys. [wimax] WARNING: WiMAX-IP-Technology not found in reply. [wimax] WARNING: Not calculating MN-HA keys ++[wimax] returns updated However, a different IP address, 192.168.15.229, is seen when the Accounting-Request packet is sent by the NAS: rad_recv: Accounting-Request packet from host 192.168.12.214 port 24048, id=90, length=256 User-Name = "test(a)domain.com" Calling-Station-Id = "\000\037\373 w6" NAS-IP-Address = 192.168.12.214 Acct-Status-Type = Start Acct-Session-Id = "01B43771" NAS-Identifier = "domain-asn" Service-Type = Framed-User NAS-Port-Type = Wireless-802.16 WiMAX-BS-Id = 0x000010000001 Chargeable-User-Identity = "NUL" Acct-Authentic = RADIUS Vendor-Specific = 0x00001fe4340600000000 Vendor-Specific = 0x00001fe40506294f0c02 Vendor-Specific = 0x00001fe40606294f0c03 Vendor-Specific = 0x00001fe4020c41505449435354455354 Vendor-Specific = 0x00001fe4010600000007 WiMAX-PDFID = 1 WiMAX-Beginning-Of-Session = 1 WiMAX-IP-Technology = Reserved-1 Event-Timestamp = "Jan 10 2012 16:34:36 CAT" Framed-IP-Address = 192.168.15.229 Framed-IP-Netmask = 255.255.255.255 Vendor-Specific = 0x00001fe4180600000008 What should I be looking at to resolve this? Regards, Tawanda

2 1

Changing MTU value for EAP Session error
by Sallee, Stephen (Jake) 11 Jan '12

11 Jan '12

I have read on the list and the FR wiki that decreasing the MTU value for the tunnel can help alleviate the pesky EAP session did not finish problem. I would like to try this as I am getting the same issue on IOS and Android based phones using the default certs FR ships with. However I cannot find where to specify the MTU value, I assume it is in the inner-tunnel virtual server, but my google-fu is weak today and cannot find any instructions. I see several messages on the list saying that is should be done but none actually explaining HOW. Someone please point me in the correct direction. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221

2 1

Ignoring failed module in post-auth
by Michal Bruncko 10 Jan '12

10 Jan '12

Hello list I am using freeradius server as the authenicator for our WPA2 wifi network. We are using loggining of result for every authentication request from clients to sql database through sql module in post auth section. but in case that the central mysql server (for many radius servers) is unreachable, the loggining of request was failed and the module executions returns with "++[sql] returns fail" and also whole autentication procedure fails with REJCT even if the user was successufully authenticated inside the "authenticate" section. and my question is: how is possible to make change in radiusd configuration, that in case of mysql server unreachability the user reqested access will be authenicated even of failing sql module. sql logging is the only used module in post-auth section. thanks for help -- Ing. Michal Bruncko, PhD., CCNP Linux systems and network administrator Coupled school of business and services Ruzomberok Slovak Republic

4 6

rlm_eap_tls: authenticate instead of authorize?
by Graham Leggett 10 Jan '12

10 Jan '12

Hi all, I notice that when rlm_eap_tls checks the user's certificate, it does so in the authenticate section instead of the authorize section, and in the process none of the fields in the certificate are available to other modules until post_auth. Would there be any ill effects if the rlm_eap_tls certificate parsing was moved from the authenticate section to the authorize section? Regards, Graham --

2 2

Connecting Windows XP wirelessly with EAP TKIP
by McSparin, Joe 09 Jan '12

09 Jan '12

Is there anything special that needs to be done on windows XP to connect wirelessly to an access point using FreeRadius. I was connecting fine with Windows 7 but now tryng to connect windows XP there is nothing even triggering the Radius server I am running in radiusd -X and when I connect the xp box nothing even happens. Anyone ever seen this before? Thanks, Joseph R. McSparin Network Administrator Hill Country Memorial Hospital 830 990 6638 phone 830 990 6623 fax jmcsparin(a)hillcountrymemorial.org -- This email message and any attachments are for the sole use of the intended recipient(s) and contain confidential and/or privileged information. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient, please contact the sender by reply email and destroy all copies of the original message and any attachments.

3 4

WPA Enterprise Certificate renewal for FreeRadius
by Mike Diggins 09 Jan '12

09 Jan '12

I use a Thawte Premium Server CA for my WPA2 Enterprise freeradius authentication certificate currently. My eap.conf 'certificate file' contains the certificate only, not the root and/or intermediates. That seems to be ok, since most clients already have the Thawte Root certificate installed. I renewed the new certificate just recently and discovered that Thawte is no longer issuing certificates under the old root so my clients will likely be asked to trust the new certificate when I install it. All my documentation changes as well but that's another story. My question is, what is the value of adding the roots/intermediates to the certificate file i.e certificate_file = ${certdir}/certificate.crt? Does it really allow a client without the Root already installed to verify this certificate? -Mike

4 6

Samba + Radius
by Szilard Gyorgy 09 Jan '12

09 Jan '12

Hi I have one group of samba servers what I try to configure to auth. the windows 7 workstations using one central radius server. I found documentation about how to make other way around - like radius to use samba or krb database, but I don't want that – (In the next stage this radius server will be used by other network equipment too - so I don’t want my Cisco router to use samba database for auth :) ) Is any way how can I configure my samba servers to use one radius auth server ? Thank You, Szilard Gyorgy

2 1

Modify request before proxying
by Lorenzo 09 Jan '12

09 Jan '12

Dear Freeradius experts, Is there any way to apply ttls to non-tunneled requests before proxying them? Thanks. Lorenzo -- View this message in context: http://freeradius.1045715.n5.nabble.com/Modify-request-before-proxying-tp51… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 3

no calling-station-id received
by S Adrian 09 Jan '12

09 Jan '12

Hey everybody .... I don't seem to get a calling-station-id packet when a username is trying to connect. I'm running gentoo and have the following package versions: net-dialup/ppp-2.4.5-r1 USE="activefilter atm dhcp eap-tls pam radius -gtk -ipv6" 0 kB net-dialup/rp-pppoe-3.10-r1 USE="-X" 0 kB net-dialup/freeradius-2.1.7 USE="mysql pam ssl threads udpfromto -bindist -debug -edirectory (-firebird) -frascend -frxp -kerberos -ldap -postgres -snmp" 0 kB Another problem I seem to have is people using the same pool_key in my radippool table :/ Where should I start digging ? Thanks in advance.

4 8

Support for check_cert_subjectAltName?
by Graham Leggett 09 Jan '12

09 Jan '12

Hi all, When using client certificates in EAP-TLS, the check_cert_cn option exists that allows you to check that the username matches the CN. Is there a corresponding option somewhere that will allow you to verify the User-Name against the subjectAltName instead? Regards, Graham --

3 5