- Freeradius-Users - lists.freeradius.org

RFC compliance for Access Challenge
by sanal kumar kariazhath 12 Dec '11

12 Dec '11

Hi, As per RFC, it looks like the Access Challenge must not contain any attributes other than Reply-Message, State, Vendor-Specific, Session-Timeout and Idle-Timeout. But if i put the configuration options as below for the EAP user 'USER5', then the access challenge from Free Radius server contains those attributes. USER5 Cleartext-Password := "xyz" Service-Type = Framed-User, Framed-IP-Address = 255.255.255.255, Framed-MTU = 576, Tunnel-Medium-Type = "6", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = 400, Please find the debug logs below: Version: radiusd: FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jun 8 2011 at 15:45:1 Debug logs (Have changed the IP address) -------------------------------------------------------------- Ready to process requests. rad_recv: Access-Request packet from host AA.BB.CC.DD port 1812, id=38, length=94 NAS-IP-Address = DD.EE.AA.DD NAS-Port-Type = Ethernet NAS-Port = 43 Calling-Station-Id = "00-00-01-00-04-00" User-Name = "USER5" EAP-Message = 0x0239000a015553455235 Message-Authenticator = 0x8db99a77b408552561675e84e7840868 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "USER5", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 57 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry USER5 at line 215 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type md5 rlm_eap_md5: Issuing Challenge ++[eap] returns handled Sending Access-Challenge of id 38 to DD.EE.AA.DD port 65163 Service-Type = Framed-User Framed-IP-Address = 255.255.255.255 Framed-MTU = 576 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "400" EAP-Message = 0x013a00160410f646c8b9a0a056801f6d89a3d919ccc5 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xda41235ada7b273294cf6090be1d930c Finished request 4. Going to the next request Waking up in 4.9 seconds. -------------------------------------------------------------- Would like to know why Free Radius is putting the user configuration data in Access Challenge ? Appreciate the early response on the same, Thanks, -Sanal

3 3

802.1x authentication
by gary 11 Dec '11

11 Dec '11

Hi All I am trying to set up 802.1x with EAP PEAP/TTLS method by using intel PROSset client tool with the PC. Sometimes authentication success but mostly it fail. Log attached could someone give me some direction?thanks a lot. Best Regards Gary

5 8

wpa2 freeradius peap rlm_perl
by Ray Eads 10 Dec '11

10 Dec '11

Hi. I'm using freeradius-2.1.10-5.el6.x86_64 from RHEL 6. I'd like to use freeradius to accomplish a specific authentication goal, and haven't met with success yet. I'm assuming this is either because the configuration is difficult, or I'm trying to solve the problem the wrong way, or I don't understand the protocols, or a combination of all three. Essentially, I'd like to have an access point offer WPA2 Enterprise authentication to wireless devices of various makes and models. I'd like the user to submit for traditional username/password authentication to the radius server (without a client side certificate). I'm able to produce a yes/no answer with an rlm_perl script that functions as expected with a normal radius query. My problem is that I haven't been able to connect that rlm script properly when freeradius is contacted as part of an EAP message. >From what I can tell, my choice of Windows compatible EAP types is fairly limited. I've used PEAP in the past, but only with the intended AD repository of passwords. With this application, I'd like to use the rlm_perl script instead of AD accounts as a source of usernames and passwords. Big picture-wise, am I on the right path, or is this fundamentally the wrong way? I'm imagining a PEAP -> rlm_perl configuration. -- Ray Eads (reads(a)sno-isle.org) Network Engineer II

1 1

Re: Query regarding LEAP-authentication
by Alan Buxey 09 Dec '11

09 Dec '11

LEAP is an older form of 802.1X authentication method...superseded by PEAP, TTLS etc. You need to define a RADIUS server and use WPA/enterprise or WPA2/enterprise, or the LEAP option if your kit supports it (its sometimes listed separately) WEP is not LEAP. alan

1 0

Re: Linksys WIFI Authentication using freeradius?
by Alan Buxey 09 Dec '11

09 Dec '11

Does the router send any accounting packets ? The accounting packets, if sent ate from the NAS and therefore won't be in any EAP tunnel the clients will be using 802.11i , hence EAP , hence the need to know and trust the server cert of the RADIUS server alan

1 0

Query regarding LEAP-authentication
by Ajay Garg 09 Dec '11

09 Dec '11

Hi all. I am trying to connect to a network, via LEAP authentication. When I open 192.168.1.1 (IP address of my router), and visit the "wireless" section, I see that there are four different options 1. Radius 2. WPA Enterprise 3. WPA2 Enterprise 4. WPA/WPA2 Enterprise 2., 3., 4. are obvious. I believe 1. indicates that the router (access point) supports LEAP authentication. (I ask this, because I have read at many places, that LEAP-authentication requires support from the access-point.) So, assuming the above is true, I proceed further. Now, at 192.168.1.1, besides the obvious settings for WPA/WPA2, there is also a setting for "WEP" keys (which I believe is requried for LEAP authentication). Fair enough. I have set a WEP key. Now, I try to connect through nm-applet. nm-applet asks me two parameters (besides the obvious ones, like SSID, etc.) : a. Username b. Password * Now, my query is, what do these two parameters correspond to ? (The most obvious answer is that they correspond to username-password, as set in "users" file for the freeradius server - the obvious pair that is used in TTLS, TLS and PEAP authentication. But then where does WEP keys come into picture ??)* Obviously, I ask all this because I am unable to connect via LEAP-authentication :-) Regards, Ajay

2 1

authentetication with mysql and NAS type= other
by tolik_shavlovsky＠mail.ru 09 Dec '11

09 Dec '11

Dear All, i installed FR v 2.1.2 and mysql 5.1.55. user database is in mysql DB. 1. I was lucky to auth Wifi users via cisco AP (NAS type cisco). but Simulteneous-Use is not working. 2. my wimax users (vendor Alvarion) cannot authenticate. Althou, i can authenticate them from users file. what can be a problem? thanks. -- View this message in context: http://freeradius.1045715.n5.nabble.com/authentetication-with-mysql-and-NAS… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 19

Authentication via ntlm_auth with check the user group
by Сергей Усов 09 Dec '11

09 Dec '11

Hi I try to configure authentication via ntlm_auth to check the user group. All authentication attempts are rejected The same configuration without checking groups is working correctly policy.conf: extract_ssid { if(Called-Station-Id =~ /^([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([0-9a-f]{2})[-:]?([-a-z0-9_.]*)?/i){ update request { Called-Station-SSID := "%{7}" } if (Called-Station-SSID == localnet1) { update request{ AD-Group := WiFisec } } else { update request{ AD-Group := WiFi-public } } } else { noop } } modules/mschap ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --domain=%{mschap:NT-Domain} --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00} --require-membership-of=POMORSU+%{AD-Group}" sites-enabed/default authorize { preprocess extract_ssid freeradius 2.1.10+dfsg-2 debian squeeze

3 12

git timeout
by tolik_shavlovsky＠mail.ru 09 Dec '11

09 Dec '11

Hi, i am making procedure for Alvarion IOT. freebsd# /usr/local/bin/git clone git://git.freeradius.org/freeradius-server.git Cloning into freeradius-server... git.freeradius.org[0: 88.190.25.44]: errno=Operation timed out fatal: unable to connect a socket (Operation timed out) are there other way? thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/git-timeout-tp5058438p5058438.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

6 11

Problem with accounting and sql
by Paul Thornton 09 Dec '11

09 Dec '11

Hi I've been trying to debug why accounting information isn't making it into the SQL database on our main FR server (2.1.11) - it seems that this has been the case since upgrading from version 1.something ancient a few months back. I have a fairly simple MySQL backed setup - and minimal changes of the config files to enable this; just to be clear this was a fresh install of the OS + FreeRADIUS so no danger of old configuration files still lurking around. sql is uncommented in both the authorization and accounting sections of the sites-available/default file (accounting section shown below), and the sql module is enabled in radiusd.conf - the server works just fine for auth via SQL as can be seen in the debug. accounting { # # Create a 'detail'ed log of the packets. # Note that accounting requests which are proxied # are also logged in the detail file. detail # daily # Update the wtmp file # # If you don't use "radlast", you can delete this line. unix # # For Simultaneous-Use tracking. # # Due to packet losses in the network, the data here # may be incorrect. There is little we can do about it. radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # # Log traffic to an SQL database. # # See "Accounting queries" in sql.conf sql # # If you receive stop packets with zero session length, # they will NOT be logged in the database. The SQL module # will print a message (only in debugging mode), and will # return "noop". # # You can ignore these packets by uncommenting the following # three lines. Otherwise, the server will not respond to the # accounting request, and the NAS will retransmit. # # if (noop) { # ok # } # # Instead of sending the query to the SQL server, # write it into a log file. # # sql_log # Cisco VoIP specific bulk accounting # pgsql-voip # For Exec-Program and Exec-Program-Wait exec # Filter attributes from the accounting response. attr_filter.accounting_response # # See "Autz-Type Status-Server" for how this works. # # Acct-Type Status-Server { # # } } I can see accounting requests being received, but there seems to be no sql module action happening to insert them into the database; but I cannot see why from the debug. I've not changed any of the pre-defined SQL queries. The debug log attached (it was a bit big to post inline) has had three minor hand-amendments: - SQL server password removed. - Shared secret for the two clients removed. - The very long list of clients loaded from SQL reduced to the router being tested. Any pointers/suggestions gratefully received. Regards, Paul.

2 2