- Freeradius-Users - lists.freeradius.org

Who processes VLAN information?
by Alexandros Gougousoudis 25 May '11

25 May '11

Hi, if I'am transmitting VLAN Information back to the supplicant, after an Acces-Accept (see below), who does this information use? Is it an information for the Switch, working an an Authenticator, to put the switchport into VLAN 22 or is it for the Supplicant/Client to enable VLAN tagging and send all packets with the VLAN 22 tag? Who is honouring these information? radtest -t mschap host/scit-beerchen test 127.0.0.1:1812 0 testing123 Sending Access-Request of id 16 to 127.0.0.1 port 1812 User-Name = "host/scit-beerchen" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 MS-CHAP-Challenge = 0x315c8360df930d89 MS-CHAP-Response = 0x0001000000000000000000000000000000000000000000000000ebec6d1eb202859db7dcc8586ecc2469b8dae48d7aabb3ab rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=16, length=100 Tunnel-Private-Group-Id:0 = "22" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN MS-CHAP-MPPE-Keys = 0x00000000000000002066656e05c22f3a995ad9ecfed913d60000000000000000 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 TIA Alex

2 2

Radius proxy configuration
by Maglione Roberta 25 May '11

25 May '11

Hello, I need your help with freeradius proxy configuration. What I would like to do is to configure freeradius as a proxy to forward all the authentication requests to another radius server without having to wait for an answer from the RADIUS server. Could you please help me with this configuration? Thanks, Best regards, Roberta Questo messaggio e i suoi allegati sono indirizzati esclusivamente alle persone indicate. La diffusione, copia o qualsiasi altra azione derivante dalla conoscenza di queste informazioni sono rigorosamente vietate. Qualora abbiate ricevuto questo documento per errore siete cortesemente pregati di darne immediata comunicazione al mittente e di provvedere alla sua distruzione, Grazie. This e-mail and any attachments is confidential and may contain privileged information intended for the addressee(s) only. Dissemination, copying, printing or use by anybody else is unauthorised. If you are not the intended recipient, please delete this message and any attachments and advise the sender by return e-mail, Thanks.

3 7

RSA Freeradius Proxy Client IP address
by Locnar 25 May '11

25 May '11

I have an RSA Securid server that is being proxied by FreeRadius. Everything works great. When a client on a remote device authenticates, they are authenticating against the FreeRadius server's address. So I assume FreeRadius is the NAS. How do I force the client device's IP to be the one authenticated, not the FreeRadius server? I think I've tried about every attribute I can think of. And read the RFC's too! -- View this message in context: http://freeradius.1045715.n5.nabble.com/RSA-Freeradius-Proxy-Client-IP-addr… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Calling-Station-ID not sent by pam_radius_auth.
by Christiaan Ehlers 25 May '11

25 May '11

Hi I currently running the following system: Server: FreeRadius, MySQL Client: pam_radius_auth, libnss_mysql.so I use the freeradius to auth and account ssh logins, here is my pam.d/sshd file on the client. #%PAM-1.0 auth sufficient /lib/security/pam_radius_auth.so debug auth required /lib/security/pam_stack.so service=system-auth auth required /lib/security/pam_nologin.so account sufficient /lib/security/pam_radius_auth.so debug account required /lib/security/pam_stack.so service=system-auth password required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_mkhomedir.so skel=/etc/skel/ umask=0022 session sufficient /lib/security/pam_radius_auth.so debug conf=/etc/radiusclient/servers session required /lib/security/pam_stack.so service=system-auth session required /lib/security/pam_limits.so session optional /lib/security/pam_console.so Now when I authenticate I can see that the Calling-Station-ID gets passed, but when I do authentication that field seems to be missing. Here is the output of radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1:3698, id=220, length=89 User-Name = "test" User-Password = "123pass" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.1.1.1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 modcall[authorize]: module "files" returns ok for request 0 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'test' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 7 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupche ck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'test' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgrouprep ly.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'test' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 7 modcall[authorize]: module "sql" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type pap auth: type "PAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_pap: login attempt by "test" with password 123pass rlm_pap: Using password "$1$n/uxpq.r$FBKqAEC8KvsK13QVHRwAf/" for user test authentication. rlm_pap: Using CRYPT encryption. rlm_pap: User authenticated succesfully modcall[authenticate]: module "pap" returns ok for request 0 modcall: group Auth-Type returns ok for request 0 Sending Access-Accept of id 220 to 10.0.0.1:3698 Framed-IP-Address := 10.1.1.1 Framed-Protocol := PPP Service-Type := Framed-User Framed-Compression := Van-Jacobson-TCP-IP Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Accounting-Request packet from host 10.0.0.1:3698, id=66, length=72 User-Name = "test" NAS-IP-Address = 10.0.0.1 NAS-Identifier = "sshd" NAS-Port = 2673 NAS-Port-Type = Virtual Acct-Status-Type = Start Acct-Session-Id = "00002673" Acct-Authentic = RADIUS Processing the preacct section of radiusd.conf modcall: entering group preacct for request 1 modcall[preacct]: module "preprocess" returns noop for request 1 rlm_acct_unique: Hashing 'NAS-Port = 2673,Client-IP-Address = 10.0.0.1,NAS-IP-Address = 10.0.0.1,Acct-Session-Id = "00002673",User-Name = "test"' rlm_acct_unique: Acct-Unique-Session-ID = "a0ec8ab13c262f56". modcall[preacct]: module "acct_unique" returns ok for request 1 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 1 modcall[preacct]: module "files" returns noop for request 1 modcall: group preacct returns ok for request 1 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 1 radius_xlat: '/usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/10.0.0.1/detail-20050603 modcall[accounting]: module "detail" returns ok for request 1 modcall[accounting]: module "unix" returns ok for request 1 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: 'test' modcall[accounting]: module "radutmp" returns ok for request 1 radius_xlat: 'test' rlm_sql (sql): sql_set_user escaped user --> 'test' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('00002673', 'a0ec8ab13c262f56', 'test', '', '10.0.0.1', '2673', 'Virtual', '2005-06-03 14:20:01', '0', '0', 'RADIUS', '', '', '0', '0', '', '', '', '', '', '', '', '0')' rlm_sql (sql): Reserving sql socket id: 6 rlm_sql (sql): Released sql socket id: 6 modcall[accounting]: module "sql" returns ok for request 1 modcall: group accounting returns ok for request 1 Sending Accounting-Response of id 66 to 10.0.0.1:3698 Finished request 1 Going to the next request Cleaning up request 1 ID 66 with timestamp 42a05901 Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 220 with timestamp 42a05901 Nothing to do. Sleeping until we see a request. As you can see the CallingStationId is empty, also there is no mention of it in the Accounting request packet. If this is not supported by the accounting, is there a way to get it from the authentication section? Would also like to say that I know this is more related to the PAM module and I assume this makes this mail a bit out of context in this mail group, but any help would be most appreciated. Kind Regards Christiaan Ehlers

4 3

Re: Authentication issues with Win7 and WPA/WPA2 Enterprise
by Simon L. 24 May '11

24 May '11

Thanks for answers! Phil Mayers schrieb: > > On 18/05/11 16:26, Simon L. wrote: > > > >> >> Using WPA2-Enterprise results in Access-Rejects after one Request. >> > > > > That is not normal. WPA2 should be the same as WPA at the radius level. > > > > > I'll give it another try this evening. >> >> Using WPA-Enterprise results in about nine different Access-Challanges >> >> and one final Access-Accept - that cant be right. >> > > > > That is normal. EAP exchanges are usually 9/10 request/challenge pairs > > followed by a final request/accept. > > > > > > What exactly is your problem? > > > Lack of knowledge :) If that challenges are necessary than i got no problem at this point. Thanks for the info! >> >> >> >> I have set up a testing scenario with the local test user bob. If local >> >> authentication works properly i want to proxy all requests without EAP >> >> to another freeradius server. I will have questions to that later :) >> >> >> >> radtest from localhost an remotehost succeeded. >> > > > > Sorry - radtest does not do EAP. radtest is not a valid test. > I know, i just followed the FAQ for using the mailinglist on freeradius.org. Just to verify that the very basics are working. > > > >> >> I dont get a clue if the Problem is Windows, Certificates, Network oder >> >> simply misconfigured freeradius. >> > > > > You haven't told us what the problem is. WPA-Enterprise is working for > > you - the radius server is sending an access-accept. What problem are > > you experiencing? > As you told me above, i know -now- there is no Problem with that. :) > > > >> >> >> >> certificates: >> >> - i build the certs with and without that windows extension OID in >> >> server.cnf with make from ../raddb/certs >> > > > > Why? You MUST include the OID. > I was not sure about if its recommend for Windows 7 too cause everywhere its mentioned with XP SP2+ only and not for later Windows in general. > > > >> >> - 2048 bit >> >> >> >> Windows 7: >> >> - installed ca.der as root cert in win7 and configured it for the >> >> desired WiFi network >> >> - for my eyes no difference in debug logs if validate server cert or >> >> not. >> > > > > "Validate server cert" is done on the client. You won't see any > > difference on the server. > > > >> >> - unchecked using windows user or domain for auth >> >> - EAP comes with PEAP/MSCHAPv2 as default - but the certs are for eap - >> >> tls right? >> > > > > PEAP uses TLS. PEAP needs certs too. > > > >> >> >> >> WAP: >> >> - WPA2 Enterprise with AES no accept packet possible until now >> > > > > As above - that's not normal. > > > > The debug you sent contains no reject. Please send a debug for this case. > I will generate a separate log for the WPA2 scenario soon. > > > >> >> - WPA Enterprise with AES results in that 9-times Challenges until >> >> accept >> > > > > As above - this is normal > > > > Access-Accept means everything is working. > You made my day! > > > > If you are still having problems after the Access-Accept, you need to > > describe what those problems are. >

5 9

Sending Reply-Message in Access-Reject (PEAP/MSCHAPv2)
by Martin Goldstone 24 May '11

24 May '11

Hello, Just looking for a bit of advice here. I've been setting up freeradius here recently, and whilst I'm mostly finished, there are a few points that still need to be addressed. The main one is sending a (semi) meaningful reply message when a user is rejected. Unfortunately, I'm having trouble figuring out how to return a Reply-Message from with in the inner tunnel. Well, to be more specific, returning that Reply-Message within the final Access-Reject. So far, I've figured that I can update outer.reply within the inner tunnel, but this gets sent out in an Access-Challenge follows the initial failure, but not subsequently. I've tried to put the update clause within Post-Auth-Type REJECT {}, both in the inner tunnel and outside as well, with no sucess (the inner one appears never to be called), the outer one has no knowledge of what was set in the inner one, so I could set an arbitrary message such as "failed", but I was hoping to be a little more helpful than that. Any pointers as to where to look/what to do, or even if this is possible, would be appreciated. Thanks in advance, Martin -- Martin Goldstone Keele University, Keele, IT Systems Administrator Staffordshire, United Kingdom, ST5 5BG Finance & IT Telephone: +44 1782 734457

4 6

HOWTO add Framed-Ip-Address AVP to Access-Request while proxying
by Nitin Bhardwaj 24 May '11

24 May '11

Hi, I am using FreeRADIUS to proxy EAP-PEAP authentication as MSCHAPv2 to a third-party RADIUS Server. (Terminating the outer tunnel at FreeRADIUS). However, I need to send an AVP of "Framed-Ip-Address" to the third party RADIUS server ( its a legacy server), for which I tried adding a realm entry into attrs.pre-proxy: -----------------------------------------------< SNIP >------------------------------------------------------------- #brokenas # NAS-Port-Type == Ethernet # Fall-Through = Yes # The rest of this file contains the DEFAULT entry. # DEFAULT matches with all realm names. MyRealm.com Framed-IP-Address := 192.168.50.12 Fall-Through = Yes DEFAULT User-Name =* ANY, User-Password =* ANY, CHAP-Password =* ANY, CHAP-Challenge =* ANY, MS-CHAP-Challenge =* ANY, MS-CHAP-Response =* ANY, EAP-Message =* ANY, Message-Authenticator =* ANY, State =* ANY, NAS-IP-Address =* ANY, NAS-Identifier =* ANY, Proxy-State =* ANY -----------------------------------------------< END >------------------------------------------------------------- But FreeRADIUS is not generating the "Framed-Ip-Address" in the outgoing Access-Request (MSCHAPv2). How can I make FR generate the AVP ?/ /Nitin

2 1

freeradius redundancy
by Student University 24 May '11

24 May '11

Hi , i need to deploy two redundant Freeradius servers , anyone have like experience to share ,,, Thanks in Advance ,,,

3 7

Freeradius GGSN->Postgresql Based upon a SELECT it will trigger a specific IP Pool
by Pedro Costa 24 May '11

24 May '11

Hi, I'm new to Freeradius and i am trying to figure a way to use Freeradius to Authenticate a user through a CISCO GGSN in where the GGSN will send the IMSI to the Freeradius and the Freeradius will connect to a Postgresql DB doing a SELECT on 2 tables and will receive a Language that the IMSI/User has stored in the database, the Freeradius will then use the language (ex.: French or German) and choose the specific IP Pool for that Language. I'm currently trying to connect to Postgresql but i'm having doubt on how can i acheive this purpose of selecting a ip pool based upon the output of the SELECT command performed on the DB. What is the best and/or simplest way to achieve this? Is it through Perl? Or can the Freeradius connect straight to the Postgres DB and receive the Select output and be able to use the respective IP Pool, if so how can i achieve this? Hope someone can help, Best Regards, P.M.R.C.

2 1

Can't add a $ sign to the ldap search
by Alexandros Gougousoudis 24 May '11

24 May '11

Hi, I tried to change the ldap-searchfilter in the ldap module, to search for a username "user" and "user$" in LDAP, if "user" is given. This is neccecary to authenticate my workstations and users via LDAP. This is my filter definition in the ldap module: filter = "(|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(uid=%{%{Stripped-User-Name}:-%{User-Name}}\$))" This ist what I get: [ldap] expand: (|(uid=%{%{Stripped-User-Name}:-%{User-Name}})(uid=%{%{Stripped-User-Name}:-%{User-Name}}$)) -> (|(uid=scit-beerchen)(uid=scit-beerchen)) [ldap] expand: dc=verwaltung,dc=kh-berlin,dc=de -> dc=verwaltung,dc=kh-berlin,dc=de [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] attempting LDAP reconnection [ldap] (re)connect to physalis:389, authentication 0 [ldap] bind as / to physalis:389 [ldap] waiting for bind result ... [ldap] Bind was successful [ldap] performing search in dc=verwaltung,dc=kh-berlin,dc=de, with filter (|(uid=scit-beerchen)(uid=scit-beerchen)) [ldap] object not found But the "$" sign is always ignored. I tried also \\$ and some other combinations. But none worked. So I'am doing it the wrong way. How do I add (or escape) the $ into my query? BTW: The query

2 5