- Freeradius-Users - lists.freeradius.org

Need help authenticating local users on Apple server
by Raymond Norton 18 Aug '11

18 Aug '11

Just installed v 2.1.11 on a mac (OSX 6.3) . Freeradius is working with clear text passwords and radtest. According to the wiki, I should be able to authenticate local users accounts without changing anything on the config. That's the way I understood it anyway. However, I am getting "Access-Reject" errors when using local credentials. What documentation specifically addresses authenticating local users? Raymond

4 12

Unique Identifier
by Luke Hammond 18 Aug '11

18 Aug '11

Can someone please let me know if FreeRADIUS can assign a certain unique ID per client added to the database? I want my client numbers to automatically increment as i add them. i am guessing this is possible?

3 2

How to tell freeradius of the encryption used in DB
by det.explorer＠yahoo.com 18 Aug '11

18 Aug '11

Hi, I am testing freeradius. I use dialup admin and mysql to add users, which is configured to store passwords in md5. The attribute is User-Password. Used radtest for testing, but seems radtest is only able to recognize cleartext password. How to tell freeradius that passwords are in md5? Should i need to use other client aside from radtest? Thanks so much, Det

3 4

RE: NAS-IP-Address or NAS-Identifier in Access-Request?
by Eric Geier 17 Aug '11

17 Aug '11

I found %{Packet-Src-IP-Address} but when I include this in the postauth_query, it doesn't work...the fields are blank in the DB when I view it. How could I log the source IP address of successful authentications? - Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Eric Geier Sent: Tuesday, August 16, 2011 3:49 PM To: 'FreeRadius users mailing list' Subject: RE: NAS-IP-Address or NAS-Identifier in Access-Request? Understood, thanks! Can I log the source IP address to the Post-Auth DB table? Thanks, Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 16, 2011 10:38 AM To: FreeRadius users mailing list Subject: Re: NAS-IP-Address or NAS-Identifier in Access-Request? Eric Geier wrote: > Yes I read that in the RFC, but was wondering what vendors usually do, > what's the most typical, etc. I'm also wondering the same about the > Calling-Station-Id and Called-Station-ID. But sounds like those aren't > included very often, completely optional. There's no way to know what is typical. There are many dozens of vendors, each of whom has many dozens of products using RADIUS. Each product may have dozens of different firmware revisions, each of which behaves slightly differently. > But now that I've thought of it, if there isn't a NAS-IP-Address then > authentication wouldn't work, right? Cause FR needs to lookup the > shared secret based upon the NAS-IP-Address? No. The shared secret is looked up by source IP address. The NAS-IP-Address can be anything. It is pretty much ignored by the core RADIUS protocol. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Can translation of RADIUS packet attributes (e.g., NAS-Port-Type) be configured?
by Jack Patmos 17 Aug '11

17 Aug '11

I am running FreeRADIUS 2.1.7. I am attempting to write accounting data to Postgres database. In the database the NAS port type from the request is stored as the integer value that defines the port type in RFC2865 (e.g., 19 - 'Wireless - IEEE 802.11'). The database table is fixed and cannot be changed. When I send a test packet from radclient that contains a port type: Called-Station-Id = "xx-xx-xx-xx-xx-xx" User-Name = "REALM/user" Framed-IP-Address = xxx.xxx.xxx.xxx NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port-Type = 19 [...] Then when it is received by the server the port type has always been translated into its string value: rad_recv: Accounting-Request packet from host 127.0.0.1 port 54361, id=245, length=262 Called-Station-Id = "xx-xx-xx-xx-xx-xx" User-Name = "REALM/user" Framed-IP-Address = xxx.xxx.xxx.xxx NAS-IP-Address = xxx.xxx.xxx.xxx NAS-Port-Type = Wireless-802.11 Acct-Status-Type = Start [....] +- entering group preacct {...} ++[preprocess] returns ok Obviously, I can't insert 'Wireless-802.11' into an integer field in the database. Is there away of disabling this lookup so that FreeRADIUS does not translate these values when it receives a packet, or am I going to have to code my own reverse lookup into my accounting module? I also have the same problem for other fields like Acct-Termination-Cause. Jack.

3 4

force logout user on nas at accounting
by Christoph Thielecke 17 Aug '11

17 Aug '11

Hello, I want to know how I can tell the nas to logout a user on Accounting packet. What i have to return at my module to let the nas disable the user? I have a request like this: Service-Type=Call-Check NAS-Identifier="rad100" NAS-Port=1 NAS-Port-Id="Controlled" NAS-Port-Type=Wireless-802.11 NAS-IP-Address=xx.xx.xx.xx User-Name="user1" Acct-Status-Type=Interim-Update Acct-Session-Id="1313155182" Acct-Session-Time=63 Acct-Delay-Time=0 Acct-Authentic=RADIUS Called-Station-Id="00-1F-D4-xx-xx-xx" Calling-Station-Id="00-1C-4A-xx-xx-xx" Framed-IP-Address=192.168.xx.xx Acct-Input-Packets=20 Acct-Input-Octets=7004 Acct-Output-Packets=24 Acct-Output-Octets=4153 Acct-Unique-Session-Id="16028485e4b3f41e" With best regards Christoph -- Linux User Group Wernigerode http://www.lug-wr.de/

2 1

RE: NAS-IP-Address or NAS-Identifier in Access-Request?
by Eric Geier 16 Aug '11

16 Aug '11

Understood, thanks! Can I log the source IP address to the Post-Auth DB table? Thanks, Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Tuesday, August 16, 2011 10:38 AM To: FreeRadius users mailing list Subject: Re: NAS-IP-Address or NAS-Identifier in Access-Request? Eric Geier wrote: > Yes I read that in the RFC, but was wondering what vendors usually do, > what's the most typical, etc. I'm also wondering the same about the > Calling-Station-Id and Called-Station-ID. But sounds like those aren't > included very often, completely optional. There's no way to know what is typical. There are many dozens of vendors, each of whom has many dozens of products using RADIUS. Each product may have dozens of different firmware revisions, each of which behaves slightly differently. > But now that I've thought of it, if there isn't a NAS-IP-Address then > authentication wouldn't work, right? Cause FR needs to lookup the > shared secret based upon the NAS-IP-Address? No. The shared secret is looked up by source IP address. The NAS-IP-Address can be anything. It is pretty much ignored by the core RADIUS protocol. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Openssl Private Key error
by voxner 16 Aug '11

16 Aug '11

Hi, I had generated certificates for EAP-TLS authentication. It worked fine in a linux setup but windows wouldn't play ball. Somebody pointed out that the CA.* scripts in the ssl directory can generate windows compatible certs. I did that but when I try to use that I get the following error regarding the private key I use during the eap handshake at the supplicant end (taken from the logs of wpa_supplicant). ================================================== OpenSSL: tls_connection_client_cert - SSL_use_certificate_file (DER) failed error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:140C800D:SSL routines:SSL_use_certificate_file:ASN1 lib OpenSSL: SSL_use_certificate_file (PEM) --> OK OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (DER) failed error:0D094068:asn1 encoding routines:d2i_ASN1_SET:bad tag OpenSSL: pending error: error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: pending error: error:0D09A00D:asn1 encoding routines:d2i_PrivateKey:ASN1 lib OpenSSL: pending error: error:140CB00D:SSL routines:SSL_use_PrivateKey_file:ASN1 lib OpenSSL: tls_connection_private_key - SSL_use_PrivateKey_File (PEM) failed error:06074079:digital envelope routines:EVP_PBE_CipherInit:unknown pbe algorithm OpenSSL: pending error: error:23077073:PKCS12 routines:PKCS12_pbe_crypt:pkcs12 algor cipherinit error OpenSSL: pending error: error:2306A075:PKCS12 routines:PKCS12_item_decrypt_d2i:pkcs12 pbe crypt error OpenSSL: pending error: error:0907B00D:PEM routines:PEM_READ_BIO_PRIVATEKEY:ASN1 lib OpenSSL: pending error: error:140CB009:SSL routines:SSL_use_PrivateKey_file:PEM lib OpenSSL: tls_read_pkcs12 - Failed to use PKCS#12 file error:0D0680A8:asn1 encoding routines:ASN1_CHECK_TLEN:wrong tag OpenSSL: pending error: error:0D07803A:asn1 encoding routines:ASN1_ITEM_EX_D2I:nested asn1 error OpenSSL: Failed to load private key TLS: Failed to load private key '/home/user/supplicant_testing/eap_authenticator_test/last_cert/newkey.pem' ================================================== I use wpa_supplicant (0.7.1) in the supplicant end. Can somebody plz give me some pointers on how to get over this problem. Is there any specific ssl command or openssl configuration at the supplicant end that I need to take care of... -- View this message in context: http://freeradius.1045715.n5.nabble.com/Openssl-Private-Key-error-tp4704998… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

RE: NAS-IP-Address or NAS-Identifier in Access-Request?
by Eric Geier 16 Aug '11

16 Aug '11

Thanks, Alan. Yes I read that in the RFC, but was wondering what vendors usually do, what's the most typical, etc. I'm also wondering the same about the Calling-Station-Id and Called-Station-ID. But sounds like those aren't included very often, completely optional. But now that I've thought of it, if there isn't a NAS-IP-Address then authentication wouldn't work, right? Cause FR needs to lookup the shared secret based upon the NAS-IP-Address? - Eric -----Original Message----- From: freeradius-users-bounces+me=egeier.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+me=egeier.com@lists.freeradius.org] On Behalf Of Alan Buxey Sent: Tuesday, August 16, 2011 4:32 AM To: FreeRadius users mailing list Subject: Re: NAS-IP-Address or NAS-Identifier in Access-Request? Hi, > Does anyone happen to know if consumer-level Wi-Fi routers typically > transmit the NAS-IP-Address or NAS-Identifier (or maybe both) in the > Access-Request? RFC's say An Access-Request MUST contain either a NAS-IP-Address attribute or a NAS-Identifier attribute (or both). so, you will get one or the other (or from good vendors, both!) if you dont get either than the kit isnt fit for purpose, or valid for anything (because if they cant follow such as basic RFC requirement then what hope have you for anything else to operte correctly on it?) alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Declare a time availability of NASs?
by Eric Geier 16 Aug '11

16 Aug '11

Is there any way to declare a time availability of NASs.such as a Login-Time attribute for NASs? I'd like to globally control when (time of day, time of week) all users can login through a certain wireless access point on my 802.1X network. Thanks, Eric

2 1