- Freeradius-Users - lists.freeradius.org

Question about Access-Challenge
by Jamshid Abedi 08 Jul '11

08 Jul '11

Hello, I've got Mobile OTP to work with FreeRadius, I'd like to take this one step further and turn this into a two phase process. The objective is to first take the pin, authenticate that and then communicate to the NAS with a challenge to receive the OTP from the user. I think this can be done via an access-challenge reply to the NAS. My question is how do I get FreeNAS to send an Access-Challenge once it has verified the PIN is correct? If anyone can kindly give me some hints or point me in the right direction. Thank you, JJ Abdi

3 2

Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

> On 08/07/11 11:20, Nitin Bhardwaj wrote: > > However, one doubt: Shouldn't this code be conditional based on whether > "use_tunneled_reply" is yes/no. Presently the outer PEAP > does take care of it, is this taken care of in this callback > (mschap_postproxy) ? > > No. The code doesn't need to be conditional, because copying of the > attributes to the final, outer, access-accept is already conditional > on "use_tunneled_reply" - that's what it does. Ok. So do you think this patch is fit to be brought into mainline-2.x ? I will try the 3.x patch too, and let you know soon. -- Nitin.

1 0

Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 08 Jul '11

08 Jul '11

/ > Nitin Bhardwaj wrote: > > Hi, > > Please edit your posts. It's not nice to go through hundreds of lines > of garbage in order to read the *real* content of the message. /Alan, I posted the output of "radiusd -X" in the previous message as is the norm on the mailing-list, and replied to the same in last message. That is not a *garbage*, isn't it ? / > > Found out that this works perfectly fine in freeradius 3.0.0 (master git > > branch). > > That's nice to know. > > > Can anyone please suggest which patches I need to back-port to 2.1.11 to > > make this work in 2.1.x branch too ? > > You can't. The code is *completely* different. > > Alan DeKok. /In 2.1.11, I observed that the problem happens when you set "proxy_tunneled_request_as_eap = no" (with "default_eap_type = mschapv2"). Hence it seems the function mschap_postproxy() in rlm_eap_mschapv2.c is somehow wiping off the extra attributes. Comparing radiusd -X logs of 2.x with 3.x, corroborate this observation: -------------------------< snip-log 2.x >------------------------------- # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default +- entering group post-proxy {...} [eap] Doing post-proxy callback [eap] Passing reply from proxy back into the tunnel. server proxy-inner-tunnel { [eap] Passing reply back for EAP-MS-CHAP-V2 # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/proxy-inner-tunnel +- entering group post-proxy {...} [eap] Doing post-proxy callback rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8e86e20 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success ++[eap] returns ok WARNING: Empty post-auth section. Using default return values. } # server proxy-inner-tunnel -------------------------< snip-end >------------------------------- -------------------------< snip-log 3.x >--------------------------- (8) # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/default (8) group post-proxy { (8) - entering group post-proxy {...} (8) eap : Doing post-proxy callback (8) eap : Passing reply from proxy back into the tunnel. server proxy-inner-tunnel { (8) eap : Passing reply back for EAP-MS-CHAP-V2 (8) # Executing section post-proxy from file /usr/local/etc/raddb/sites-enabled/proxy-inner-tunnel (8) group post-proxy { (8) - entering group post-proxy {...} (8) [eap] = noop (8) WARNING: Empty post-auth section. Using default return values. } # server proxy-inner-tunnel -------------------------< snip-end >------------------------------- In 3.x code, We are returning a RLM_MODULE_NOOP from eap_post_proxy() : 582 /* 583 * Just in case the admin lists EAP in post-proxy-type Fail. 584 */ 585 if (!request->proxy_reply) return RLM_MODULE_NOOP; But we are not doing so in 2.1.11 code. We call the MSCHAPv2 callback, i.e. mschap_postproxy(), which might be wiping off the attributes. So, my question is: will adding this code patch to 2.x code prudent to make it work ? Or we need to fix the mschapv2 handler itself : mschap_postproxy() in rlm_eap_mschapv2.c,so that it retains the extra attributes sent by the RADIUS home server ? Please advise. -- Thanks, Nitin.

3 8

Mac-Auth
by Paulo Maia 08 Jul '11

08 Jul '11

Hi Guys , Here is the thing , im trying to use Mac-Auth , I managed to get working using authorized-macs files , although i need to use a mysql table witch i already have with the ssid and mac-address fields and i need to add an operator to expired macs , coz i work at a college campus and students mac-addresses need to expire acording to their course period . Any ideas ? Thanks in advance .

7 11

password logging only for local users
by Meike Stone 07 Jul '11

07 Jul '11

Hello, we are using the freeradius server with authentication against ldap as "local database" and proxy and realms (IPASS) to authenticate users are not in our database. So is is possible, to disable the password logging only for the proxied request. The local requests are only users who got a temporary voucher. In case of failure, the helpdesk should use the log to check if the user did use the correct password. But the password for IPASS users should not be logged. If I disable the password logging in the detail section (suppress {User-Password}), the complete password logging will be disabled. Is it possible, to disable this selective? Thanks for help - Meike

1 0

Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Alan Buxey 07 Jul '11

07 Jul '11

use version 3 ? the things you want work, why stick to 2.1.x? Alan

3 4

Running external programs
by rihad 07 Jul '11

07 Jul '11

Hi, all. We have some legacy software that ran under XTradius (xtradius.sourceforge.net) The important thing was to execute an external program for every auth & accounting request. Now I need to recreate all that on another server, and I must use the same legacy billing software. Unfortunately one can no longer build the old XTradius on modern FreeBSDs, apparently it has some variable linkage problems. Can that simple task be done in FreeRADIUS instead? Can it be configured to call an external program (Auth-Type "External" in XTradius)? Thanks!

3 4

Re: "use_tunnel_reply" not working in EAP-PEAP (Proxied as plain MSCHAPv2) in eap.conf
by Nitin Bhardwaj 07 Jul '11

07 Jul '11

/ > Hi, > > > Sigh! > > > > Tried 3.x sometime back, it was seg-faulting left-and-right in my > > 3.0 is not a static beast. sometime back is sometime back! there have been > several key fixes to it - and more when people run it. > > its no good saying seg-faulting left-ad-right' if those issues arent > reported to the dev list - as they wont get fixed unless people report > them - or run the server to find them ;-) > > > scenario, so want to stay with "official" and stable releases only. > > 3.x is an official release - its not some random fork by third party > > alan /Sorry, what I meant was, Looking at the descriptions of various branches here : http://git.freeradius.org/ : o master <http://github.com/alandekok/freeradius-server/tree/master> - The next "major" release, which will have new features and other changes. o v2.1.x <http://github.com/alandekok/freeradius-server/tree/v2.1.x> - The "long term support" release. The only changes to this code will be minor bug fixes. All new development is done in the "stable" branch. I decided to take the "long-term-support" release :) -- Nitin.

1 0

Re: Welcome to the "Freeradius-Users" mailing list
by silambarasan sundar 07 Jul '11

07 Jul '11

Hi, I am very new to radius server and installed “freeradius-1.1.2-sol10-sparc-local”. While starting the server I am seeing the below error message. I did not modify any configuration file. Just running the radius after installation. Please help me in solving this issue. I tried the freeradius-1.1.7-sol10-sparc-local , I got the same error. bash-3.00# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Segmentation Fault (core dumped) Thanks Simbu

2 1

rlm_sql: "NUMERIC VALUE OUT OF RANGE" error
by Vegard Svanberg 07 Jul '11

07 Jul '11

Freeradius 2.1.0. I have a NAS which sends a NAS-Port-Id attribute in the range 2147483648..2164260863. PostgreSQL doesn't like the query Freeradius performs. It's choking when trying to insert for instance '2163214239::integer' into the radacct table. $ select 2163214239::integer; ERROR: integer out of range Example: INSERT INTO radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStopDelay) values('80f0079f', '5c9f0b7076dcc9c0', 'username', NULLIF('', ''), '1.2.3.4', 2163214239::integer, 'Wireless-802.11', ('2008-09-26 09:52:52'::timestamp - '1'::interval - '3382'::interval), ('2008-09-26 09:52:52'::timestamp - '1'::interval), NULLIF('3382', '')::bigint, '', '', (('0'::bigint << 32) + '57743'::bigint), (('0'::bigint << 32) + '294709'::bigint), 'hotspot', 'XX:XX:XX:XX:XX:XX', 'Lost-Service', '', '', NULLIF('192.168.12.94', '')::inet, 0) rlm_sql_postgresql: Status: PGRES_FATAL_ERROR rlm_sql_postgresql: Error integer out of range rlm_sql_postgresql: Postgresql Fatal Error: [22003: NUMERIC VALUE OUT OF RANGE] Occurred!! [sql] Couldn't insert SQL accounting STOP record - ERROR: integer out of range rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Quick fixes...? -- Vegard Svanberg <vegard(a)svanberg.no> [*Takapa@IRC (EFnet)]

6 6