- Freeradius-Users - lists.freeradius.org

Re: How to log "TLS name" instead of username
by Alan Buxey 10 Aug '11

10 Aug '11

Do not set auth-type for EAP in your users file, the server is not stupid alan

2 1

Re: Hello all
by Alan Buxey 10 Aug '11

10 Aug '11

Follow the advice of the WARNING lines and check your shared secret in clients.conf as that password looks quirky alan ----- Reply message ----- From: "Jon Cash" <chafik122(a)gmail.com> Date: Wed, Aug 10, 2011 11:51 Subject: Hello all To: "freeradius-users(a)lists.freeradius.org" <freeradius-users(a)lists.freeradius.org> Hello all i use freeradius with the network access control Packetfence I have a problem with captive portal registration I use radius authentication and i have this problem when i put login pass in the authentication page rad_recv: Access-Request packet from host 127.0.0.1 port 47764, id=171, length=50 User-Name = "user" User-Password = "\026JoL\267\277O\235:~\327\374\367" NAS-IP-Address = 127.0.0.1 server packetfence { +- entering group authorize {...} [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry user at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair User-Name = user rlm_perl: Added pair User-Password = \026JoL\267\277O\235:~\327\374\367 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Cleartext-Password = pass ++[perl] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. } # server packetfence Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 33 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 33 Sending Access-Reject of id 171 to 127.0.0.1 port 47764 Waking up in 4.9 seconds. Cleaning up request 33 ID 171 with timestamp +1302 Ready to process requests. the password match in user file any idea please cheers

1 0

Hello all
by Jon Cash 10 Aug '11

10 Aug '11

Hello all i use freeradius with the network access control Packetfence I have a problem with captive portal registration I use radius authentication and i have this problem when i put login pass in the authentication page rad_recv: Access-Request packet from host 127.0.0.1 port 47764, id=171, length=50 User-Name = "user" User-Password = "\026JoL\267\277O\235:~\327\374\367" NAS-IP-Address = 127.0.0.1 server packetfence { +- entering group authorize {...} [suffix] No '@' in User-Name = "user", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[preprocess] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop [files] users: Matched entry user at line 2 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_perl: Added pair User-Name = user rlm_perl: Added pair User-Password = \026JoL\267\277O\235:~\327\374\367 rlm_perl: Added pair NAS-IP-Address = 127.0.0.1 rlm_perl: Added pair Cleartext-Password = pass ++[perl] returns noop WARNING: Please update your configuration, and remove 'Auth-Type = Local' WARNING: Use the PAP or CHAP modules instead. User-Password in the request does NOT match "known good" password. Failed to authenticate the user. } # server packetfence Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> user attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 33 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 33 Sending Access-Reject of id 171 to 127.0.0.1 port 47764 Waking up in 4.9 seconds. Cleaning up request 33 ID 171 with timestamp +1302 Ready to process requests. the password match in user file any idea please cheers

1 0

How to log "TLS name" instead of username
by Johannes Koepcke 10 Aug '11

10 Aug '11

Hey, I'm running a freeradius2 server with mysql. Some users are authenticating via mschapv2 and some through eap-tls. My problem is that for eap-tls, the actual username field doesn't matter, user's could specify anything as the username, as long as their certificates are valid. So I would like to log the name of the certificate owner instead of the radius username to my radpostauth table. How would I do that? Or do you recommend another way to accomplish what I'm trying to do? Thanks in advance, Johannes.

4 6

Re: AW: User Problem with Cisco Nexus 4.x
by Jan.Gnepper＠t-systems.com 10 Aug '11

10 Aug '11

>> test Auth-Type := Pap, Huntgroup-Name == "nexus", MD5-Password := "098f6bcd4621d373cade4e832627b4f6" >> Login-Service = Telnet, >> Vendor-Specific = Cisco, > > What the HECK is that last line? Why is it there? What do you think >it's doing? > > *Nothing* in any of the documentation leads you to believe that line >is necessary. > > Delete it. > >> Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" >> ========================== >> dump_notok_2.cap >> >> test Auth-Type := Pap, Huntgroup-Name == "nexus", MD5-Password := "098f6bcd4621d373cade4e832627b4f6" >> Login-Service = Telnet, >> Vendor-Specific = 9, > > Delete that line, too. > >> Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" >> ========================== >> >> On Cisco Nexus older NXOS Version 4.2 login is possible with the last config (dump_notok_2.cap", >> But roles within the av-pairs are ignored. Newer devices (NXOS 4.2 and up) will ignore the "AVP too short" >> And takeover the roles from the radius paket. Seems that there was an update in the radius implementaion >> to make it more robust. >> >> And as you can see in the dump_ok.cap, "Vendor-Specific=9" was send, even if it was not in the config. >> But there is an other cisco av-pair in the config, is this the reason why the vendor-id was added to the reply? > > Don't add "Vendor-Specific" to the reply. It's not needed. > > Alan DeKok. Thanks for your answer. That is exactly what i meaned with "was added automatically". I found this line in the existing radius configuration of the system i took over. But i found nowhere in any documentation if this line was realy needed or not. Googleing shows examples with and without this line. :-( >From my side this thread is completed now. Would you please be so kind to answer my other question? "Devices in more than one huntgroup"

1 0

Re: NAS IP ALLOW ALL (Solved)
by Alan Buxey 10 Aug '11

10 Aug '11

0.0.0.0/0 ? alan ----- Reply message ----- From: "aceror" <aceror2001(a)yahoo.es> Date: Wed, Aug 10, 2011 00:18 Subject: NAS IP ALLOW ALL (Solved) To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> My last try make the job! Thanks to all. El mar, 09-08-2011 a las 07:47 +0200, aceror escribió: > Thank you, at the end I use this > > "A small note if you really want to do this: in 2.0, this will only > match for the exact address 0.0.0.0, and not for all IP addresses > anymore, like it does in 1.x. You can work around this by using two > entries, one for 0.0.0.0/1 and one for 128.0.0.0/1." > > FROM > http://lists.cistron.nl/pipermail/freeradius-users/2007-May/msg00151.html > > So I will try it and see what happen. > > El mar, 09-08-2011 a las 07:00 +0200, aceror escribió: > > Thank! > > > > is it what I was looking for. > > > > El lun, 08-08-2011 a las 17:09 -0500, Gary Gatten escribió: > > > Are you talking about in the clients.conf file? It supports network based secrets, such as 10.0.0.0 255.0.0.0 = "mysecret". > > > > > > I don't know if you can permit "every" IP with a single line, but it's possible with several lines as noted above, especially if the first octet of the IP doesn't change much. > > > > > > Check the man for clients.conf, and the sample configs within clients.conf. > > > > > > HTH > > > > > > G > > > > > > > > > -----Original Message----- > > > From: freeradius-users-bounces+ggatten=waddell.com(a)lists.freeradius.org [mailto:freeradius-users-bounces+ggatten=waddell.com@lists.freeradius.org] On Behalf Of aceror > > > Sent: Monday, August 08, 2011 4:59 PM > > > To: freeradius-users(a)lists.freeradius.org > > > Subject: NAS IP ALLOW ALL > > > > > > Hi all! > > > > > > I will like to allow all ip as valid NAS IP. > > > > > > I have various AP around and they change IP every ten days, some routers > > > works with DynDNS but others do not, so instead of change IP for NAS, > > > allow any IP as Valid NAS. > > > > > > Any idea how?? > > > > > > - > > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > > > > > > > > > > > > > <font size="1"> > > > <div style='border:none;border-bottom:double windowtext 2.25pt;padding:0in 0in 1.0pt 0in'> > > > </div> > > > "This email is intended to be reviewed by only the intended recipient > > > and may contain information that is privileged and/or confidential. > > > If you are not the intended recipient, you are hereby notified that > > > any review, use, dissemination, disclosure or copying of this email > > > and its attachments, if any, is strictly prohibited. If you have > > > received this email in error, please immediately notify the sender by > > > return email and delete this email from your system." > > > </font> > > > > > > > > > - > > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > > > > - > > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Want to silently discard the request if authentication module as web service client connecting to the web service server is down.
by Ankur G 10 Aug '11

10 Aug '11

Hi In FreeRadius 2.1.11, we have created a module name "ws" which authenticate and authorize the user request through the web-service call, exposed as a WSDL. In the successful scenario when both Radius server and web service are up, we are able to authenticate and authorize the user request and in the failure scenario when both Radius server and web service are up, but the user credential are not correct, radius server reject the request as expected. But If the exposed web-service is down, Radius server simply reject the authentication request with the response message as "Access_Rejected". We want Radius server instead of rejecting, simply discard the authentication request which will allow the RADIUS *client* to failover to another RADIUS server. So while going through the FreeRadius configuration i came across the section in sites-avaliable/default file under "post-auth" section which state that "Access-Reject packets are sent through the REJECT sub-section of the post-auth section." and is as follow: Post-Auth-Type REJECT { # log failed authentications in SQL, too. #sql attr_filter.access_reject } If you think this is the right approach, could you please provide me the sample code using which if i could check for the rlm status code and could silently discard the responses other than the "RLM_MODULE_OK" and "RLM_MODULE_REJECTED. Thanks & Regards, --Ankur

3 4

NAS IP ALLOW ALL
by aceror 09 Aug '11

09 Aug '11

Hi all! I will like to allow all ip as valid NAS IP. I have various AP around and they change IP every ten days, some routers works with DynDNS but others do not, so instead of change IP for NAS, allow any IP as Valid NAS. Any idea how??

2 4

Re: AW: User Problem with Cisco Nexus 4.x
by Jan.Gnepper＠t-systems.com 09 Aug '11

09 Aug '11

>> Cisco Nexus with NXOS Version older than 4.2 (4.0 and 4.1) don?t like >> the entry "Vendor-Specific = 9". > > What does that mean? > >> It seems that freeradius add this automatically if it?s not within the >> config. > > No. FreeRADIUS adds almost nothing automatically. > >> But, when i put it in the config, the dump shows "bad udp checksum", >> wireshark "AVP too long". When i remove this line from the config, >> "vendor-specific=9" is also transmitted, but without checksum/avp too >> long error. >> >> Is this behavior documented anywhere? >> I didn?t found this. > > See the FAQ for "it doesn't work". > > You haven't shown us the wireshark output. You haven't shown us the configuration you added. > > Short summaries are *not* enough. We need the *exact* information. > > Alan DeKok. Hi Alan, Please find the dumps attached. ========================== dump_ok.cap test Auth-Type := Pap, Huntgroup-Name == "nexus", MD5-Password := "098f6bcd4621d373cade4e832627b4f6" Login-Service = Telnet, # Vendor-Specific = Cisco, Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" ========================== dump_notok.cap test Auth-Type := Pap, Huntgroup-Name == "nexus", MD5-Password := "098f6bcd4621d373cade4e832627b4f6" Login-Service = Telnet, Vendor-Specific = Cisco, Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" ========================== dump_notok_2.cap test Auth-Type := Pap, Huntgroup-Name == "nexus", MD5-Password := "098f6bcd4621d373cade4e832627b4f6" Login-Service = Telnet, Vendor-Specific = 9, Cisco-AVPair = "shell:roles*\"network-admin\" \"vdc-admin\"" ========================== On Cisco Nexus older NXOS Version 4.2 login is possible with the last config (dump_notok_2.cap", But roles within the av-pairs are ignored. Newer devices (NXOS 4.2 and up) will ignore the "AVP too short" And takeover the roles from the radius paket. Seems that there was an update in the radius implementaion to make it more robust. And as you can see in the dump_ok.cap, "Vendor-Specific=9" was send, even if it was not in the config. But there is an other cisco av-pair in the config, is this the reason why the vendor-id was added to the reply? Jan

2 1

Validate server certificate problem
by Petar Marinkovic 09 Aug '11

09 Aug '11

I've set up latest version of FreeRadius from source on Ubuntu, and I cannot get EAP-TLS and PEAP to work when the option "Validate server certificate" is on. We're using Windows CA to be able to auth users on the domain. I saw this old article http://lists.freeradius.org/mailman/htdig/freeradius-users/2006-October/msg… on how to generate server certificate, but that fails for me in both ways 1st fails because of a missing template on Windows CA - how to create the template to match what freeradius needs? 2nd fails with the following error CA certificate and CA private key do not match 2634:error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch:x509_cmp.c:406: That's strange, cause CA cert and CA private key are in the same file (as noted in the text) and I didn't mistake the password (since I followed the message blindly, with the same password). When I untick the "Validate server certificate" in Windows clients (XP, Windows 7) I'm able to connect with both EAP-TLS and PEAP Any help is appreciated, thanks in advance.

2 4