- Freeradius-Users - lists.freeradius.org

Re: Renaming during Machine Authentication
by Mark Jones 16 May '11

16 May '11

Thanks Phil. I am out of the office until Thursday but on my first message I posted the debug from bootup where it fails..is there more output I need to post later this week? Mark Sent from my Blackberry® wireless device -----Original Message----- From: Phil Mayers <p.mayers(a)imperial.ac.uk> To: <freeradius-users(a)lists.freeradius.org> Sent: 5/16/2011 3:01:35 AM Subject: Re: Renaming during Machine Authentication On 05/16/2011 01:03 AM, Mark Jones wrote: > Hi Phil thanks for answering. I am trying to authenticate the > machines on bootup. I have an edir backend and am following this cool > solutions article which is fairly old: > http://www.novell.com/coolsolutions/feature/17044.html In it they > talk about atrrib-rewrite but use it in the radiusd.conf file which > in my limited knowledge of freeradius I think is an older way of > doing it. Yeah, don't do it that way. Aside from the config in the article being subtly wrong (regexp in the 2nd rewrite module isn't right), there are easier ways to accomplish mutating the username if you need to do that, which you don't because you can just use %{mschap:User-Name} and it'll do it for you (as well as being more obvious IMHO) > > Right now if i join a machine to the samba domain I have created, it > automatically is imported into edirectory and named "machinename$". > The article is not complete so I am really not sure if the machine is I'm not familiar with eDir so can't say. Is it working for you now? If not, post a debug and someone can probably suggest what needs changing. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html This communication is intended for the use of the recipient to which it is addressed and may contain confidential, personal and/or privileged information. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.

1 0

Failed to build FR 2.1.10 (64-bit) on Solaris 10 x86
by Chris Howley 16 May '11

16 May '11

Alan, I'm unable to build a 64-bit version of FreeRADIUS 2.1.10 on Solaris 10 9/10 s10x_u9wos_14a X86 owing to the following problem. I'm using the latest software from the 2.1.x git repository and gcc version 3.4.3. I've noticed that the 'FNM_FILE_NAME' flag is not declared in the fnmatch.h file on my system if this helps. Thanks in advance, Chris gcc -m64 -O -g -I/opt/local/include -I/opt/webstack/mysql/include/mysql -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -g -Wshadow -Wpointer-arith -Wcast-qual -Wcast-align -Wwrite-strings -Wstrict-prototypes -Wmissing-prototypes -Wmissing-declarations -Wnested-externs -W -Wredundant-decls -Wundef -I/export/home/ecl6ch/freeradius-server/src -I/export/home/ecl6ch/freeradius-server/libltdl -c rlm_detail.c -fPIC -DPIC -o .libs/rlm_detail.o rlm_detail.c: In function `do_detail': rlm_detail.c:276: warning: comparison between pointer and integer rlm_detail.c:278: error: `FNM_FILE_NAME' undeclared (first use in this function) rlm_detail.c:278: error: (Each undeclared identifier is reported only once rlm_detail.c:278: error: for each function it appears in.) gmake[6]: *** [rlm_detail.lo] Error 1 gmake[6]: Leaving directory `/export/home/ecl6ch/freeradius-server/src/modules/rlm_detail' gmake[5]: *** [rlm_detail] Error 2 gmake[5]: Leaving directory `/export/home/ecl6ch/freeradius-server/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/export/home/ecl6ch/freeradius-server/src/modules' gmake[3]: *** [modules] Error 2 gmake[3]: Leaving directory `/export/home/ecl6ch/freeradius-server/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/export/home/ecl6ch/freeradius-server/src' gmake[1]: *** [src] Error 2 gmake[1]: Leaving directory `/export/home/ecl6ch/freeradius-server' gmake: *** [all] Error 2

2 1

RE: Alvarion BreezeMAX & 4Motion Service Profiles
by Ryan Williams 16 May '11

16 May '11

I have a working solution. For Alvarion to assign service profiles to subscribers through FreeRADIUS the Filter-Id attribute must be provided in the Access-Accept in the following format. Filter-Id = "SP=sp1:MSF=msf1;" Where sp1 is the name of the pre-configured service profile and msf1 is the name of the pre-configured multiple service flow profile. I can confirm that this format works with both the 4Motion and the BreezeMAX extreme product lines from Alvarion. Thanks to everyone for your assistance. -----Original Message----- From: Ryan Williams [mailto:ryan@integritynet.com.au] Sent: Friday, 13 May 2011 11:40 AM To: 'freeradius-users(a)lists.freeradius.org' Subject: Alvarion BreezeMAX & 4Motion Service Profiles Has anyone been able to get the Alvarion BreezeMAX to apply a service profile for a subscriber through radius? or has anyone been able to get debug logging out of the BreezeMAX perhaps via syslog? I believe I've got the service interfaces, service groups etc configured the same in both products. The BreezeMAX works if I disable RADIUS but doesn't work with the following radius reply. The following access accept works with the Alvarion 4Motion product but not with the BreezeMAX. Sending Access-Accept of id 13 to 10.12.15.50 port 49154 Session-Timeout = 3600 Termination-Action = RADIUS-Request Filter-Id = "SP1" EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "{am=1}test(a)test.com.au" WiMAX-MSK = 0x18bffebb46ac2e95ee730b7ecc0eaa5eb4b586fe29e5113f97f1ab794b4405f9d77aaa432c bb91eb9e4d3ea7e65dded2bb765e18491c62530cf3edee80c644a1

1 0

freeradius availability
by Student University 15 May '11

15 May '11

Hi , for multiple POP deployment (NAS1 , NAS2 ... NASn spread over different geographical location) NAS = Cisco LNS Routers , users are arbitrary connect to NAS1,NAS2,NAS3 ,,,, for this Scenario i need to keep identical copy of AAA (freeradius) server on each POP-NAS Location ,,,, anyone already have like experience ,,,, Thanks in Advance ,,,

1 0

Reply-message stripped from access-reject response
by sbcsgjmbbz＠snkmail.com 15 May '11

15 May '11

Hi, Using freeradius 1.1.3. Im trying to get freeradius to return a helpful reply-message in access-rejects to the NAS but the reply-message seems to get stripped from the access-reject packet. Ive configured the reply-message as below in /etc/raddb/sites-enabled/default post-auth { sql exec Post-Auth-Type REJECT { # Login failed update reply { Reply-Message = "Login Failure" } sql attr_filter.access_reject } } Using wireshark on the radius server, I can see the correct reply-message AVP as below Radius Protocol Code: Access-Reject (3) Packet identifier: 0xda (218) Length: 35 Authenticator: a6208196777dac6e68b45f647a46bc44 [This is a response to a request in frame 1] [Time from request: 1.000227000 seconds] Attribute Value Pairs AVP: l=15 t=Reply-Message(18): Login Failure Reply-Message: Login Failure However, on the receiving NAS, using wireshark, there is no reply-message AVP! Radius Protocol Code: Access-Reject (3) Packet identifier: 0xda (218) Length: 20 Authenticator: 30636716e333da33ac25c8253097b608 [This is a response to a request in frame 1] [Time from request: 1.107899000 seconds] Any ideas on what I could be doing wrong, It would be much appreciated!

3 6

Radius proxy implementation
by doqb＠hotmail.com 14 May '11

14 May '11

Hello... I am new to freeradius and I am hoping someone can give me some help with a little project. The architecture is as follows: RADIUS SERVER -----------------freeRadius-----------------Radius client The radius client is sending Authentications and accounting requests to freeRadius. For Authentication, the freeRadius must receive the access_requests, add a couple of AVPs to it, and then send it to the RADIUS SERVER, this server will respond with either accept/reject and the freeRadius must forward that to the client. Once authentication is done, the Radius client will start sending accounting messages to freeRadius. The freeRadius must count the number of octets sent and received (information which is inside the accounting message) and once a certain number of packets are reached it should trigger and access_reject to the Radius client. I this possible with freeRadius? I would appreciate some help on this. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Radius-proxy-implementation-tp43662… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 8

ldap
by Maurice James 14 May '11

14 May '11

How do I deny access based on the ldap attribute nsAccountLock = true? <http://g.bfbcs.com/175/pc_Lt%20Loooootz.png> Description: pc_Lt Loooootz

1 0

Compiling from source
by Tim McNabb 14 May '11

14 May '11

Has anyone been successful in installing FreeRADIUS 2.1.10 from src on CentOS or RHEL? I'd prefer not to use the package manager for installation as I'm attempting to install a custom module and the directory tree from the repo install doesn't match the source module setup. I know this is normal for using Yum, just wondering if anyone has been successful installing from src on CentOS and what worked and what didn't. Chkconfig doesn't seem to working on a src install either and I want radiusd to run as a service. Thanks in advance, Timothy McNabb Network Administrator Velociter Wireless, Inc (209)838-1221

5 7

Authentication issues from Apple devices
by stentofon 14 May '11

14 May '11

Hello. I have configured a Wireless Hotspot using the EasyHotSpot system, that uses FreeRadius for authentication. I am having problems only when Apple devices (iphone, ipad, macbooks) attempt to connect to the hotspot. This is confusing, as all other devices and software (Winxp, Vista, 7, Symbian, Blackberry, Android etc) authenticate perfectly. As a test case, and while running debugging, I attempted to connect with my Blackberry and an Iphone using the same username and password. I have attached the results. As you will see, using the same username and password, the blackberry authenticates while the iphone fails. I cannot see any reason for this in the log. Can anyone please assist? Failed log: Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 60277, id=0, length=216 User-Name = "sandra" CHAP-Challenge = 0x0571777ec7661c411af641e8952291b9 CHAP-Password = 0x00120c16a8ff125a7a348459a0f40a86a9 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.10 Calling-Station-Id = "DC-2B-61-9C-92-E6" Called-Station-Id = "00-0D-56-9C-AC-F6" NAS-Identifier = "nas01" Acct-Session-Id = "4dcde5a500000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0x35f8e8bc299636c4cd468b533de65f78 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "sandra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> sandra [sql] sql_set_user escaped user --> 'sandra' rlm_sql (sql): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sandra' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sandra' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sandra' ORDER BY priority rlm_sql (sql): Released sql socket id: 4 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[max_all_mb] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop [expiration] Checking Expiration time: 'September 11 2011 24:00:00' ++[expiration] returns ok ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "sandra" with CHAP password [chap] Using clear text password "sandra" for user sandra authentication. [chap] Password check failed ++[chap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} expand: %{User-Name} -> sandra attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 60277 Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +36 Ready to process requests. Sucessful Log: rad_recv: Access-Request packet from host 127.0.0.1 port 44107, id=0, length=216 User-Name = "sandra" CHAP-Challenge = 0x97824e8524637118ae2cf716a0362b97 CHAP-Password = 0x00f729a50979c25ef7d9d9e5e4cc1b2907 NAS-IP-Address = 0.0.0.0 Service-Type = Login-User Framed-IP-Address = 192.168.182.8 Calling-Station-Id = "CC-55-AD-93-77-E6" Called-Station-Id = "00-0D-56-9C-AC-F6" NAS-Identifier = "nas01" Acct-Session-Id = "4dcde8c300000001" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Message-Authenticator = 0xf30387317dabf479ce7642e776e0295e WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" +- entering group authorize {...} ++[preprocess] returns ok [chap] Setting 'Auth-Type := CHAP' ++[chap] returns ok ++[mschap] returns noop [suffix] No '@' in User-Name = "sandra", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop expand: %{User-Name} -> sandra [sql] sql_set_user escaped user --> 'sandra' rlm_sql (sql): Reserving sql socket id: 3 expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'sandra' ORDER BY id [sql] User found in radcheck table expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'sandra' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = 'sandra' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[max_all_mb] returns noop rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair ++[noresetcounter] returns noop [expiration] Checking Expiration time: 'September 11 2011 24:00:00' ++[expiration] returns ok ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = CHAP +- entering group CHAP {...} [chap] login attempt by "sandra" with CHAP password [chap] Using clear text password "sandra" for user sandra authentication. [chap] chap user sandra authenticated succesfully ++[chap] returns ok +- entering group session {...} expand: /var/log/freeradius/radutmp -> /var/log/freeradius/radutmp expand: %{User-Name} -> sandra ++[radutmp] returns ok +- entering group post-auth {...} expand: %{User-Name} -> sandra [sql] sql_set_user escaped user --> 'sandra' expand: %{User-Password} -> expand: %{Chap-Password} -> 0x00f729a50979c25ef7d9d9e5e4cc1b2907 expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( '%{User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S') -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'sandra', '0x00f729a50979c25ef7d9d9e5e4cc1b2907', 'Access-Accept', '2011-05-14 12:28:43') rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ( 'sandra', '0x00f729a50979c25ef7d9d9e5e4cc1b2907', 'Access-Accept', '2011-05-14 12:28:43') rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 ++[sql] returns ok ++[exec] returns noop Sending Access-Accept of id 0 to 127.0.0.1 port 44107 WISPr-Bandwidth-Max-Down := 256000 Idle-Timeout := 600 WISPr-Session-Terminate-Time := "2011-9-11T24:00:00" Acct-Interim-Interval := 120 Session-Timeout = 10409477 Finished request 1. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Authentication-issues-from-Apple-de… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 6

Renaming during Machine Authentication
by Mark Jones 14 May '11

14 May '11

Hi all i have freeradius 2.1.10 setup on a SLES server. When the workstation boots it sends an mschapv2 request in the form host/machinename. What is the best way to convert this to machinename$ ? Sorry if this has been asked before Im stumped and cannot find the answer. Here is part of the log: Ready to process requests. rad_recv: Access-Request packet from host 10.152.0.100 port 32819, id=79, length=203 NAS-IP-Address = 10.152.0.100 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "host/TECH-11501" Calling-Station-Id = "00265EE9B2CA" Called-Station-Id = "000B86611894" MS-CHAP-Challenge = 0x0568442cb1608fce03cb2662dcf52694 MS-CHAP2-Response = 0x07007e63e9fa7fb503e4cfff2a2c00568698000000000000000057f0c5ece05913c5eeaf48096b25dcbd01f39d20a71404e1 Service-Type = Login-User Aruba-Essid-Name = "HPSD_RAD2" Aruba-Location-Id = "Tech 01" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "host/TECH-11501", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for host/TECH-11501 [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=TECH-11501$) [ldap] expand: o=hpsd_48 -> o=hpsd_48 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=hpsd_48, with filter (uid=TECH-11501$) [ldap] Added the eDirectory password xxxxx in check items as Cleartext-Password [ldap] No default NMAS login sequence [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user host/TECH-11501 authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: host/TECH-11501 [mschap] Told to do MS-CHAPv2 for host/TECH-11501 with NT-Password [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/TECH-11501 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 13 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 13 Sending Access-Reject of id 79 to 10.152.0.100 port 32819 Waking up in 4.9 seconds. Cleaning up request 13 ID 79 with timestamp +926 Ready to process requests. Here is the log from same machine after logging in: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.152.0.100 port 32819, id=82, length=194 NAS-IP-Address = 10.152.0.100 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 User-Name = "mjones" Calling-Station-Id = "00265EE9B2CA" Called-Station-Id = "000B86611894" MS-CHAP-Challenge = 0xe744e26bd3741ff3a339f931e5d541cc MS-CHAP2-Response = 0x070001ee52a851770be78f667189c6bdec3b000000000000000050e99570745eb5a68f290dfe79879837d3997b7aa9b7b3cc Service-Type = Login-User Aruba-Essid-Name = "HPSD_RAD2" Aruba-Location-Id = "Tech 01" # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop [mschap] Found MS-CHAP attributes. Setting 'Auth-Type = mschap' ++[mschap] returns ok ++[digest] returns noop [suffix] No '@' in User-Name = "mjones", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [ldap] performing user authorization for mjones [ldap] expand: (uid=%{mschap:User-Name:-%{User-Name}}) -> (uid=mjones) [ldap] expand: o=hpsd_48 -> o=hpsd_48 [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in o=hpsd_48, with filter (uid=mjones) [ldap] Added the eDirectory password xxxx in check items as Cleartext-Password [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user mjones authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = MSCHAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group MS-CHAP {...} [mschap] Creating challenge hash with username: mjones [mschap] Told to do MS-CHAPv2 for mjones with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 82 to 10.152.0.100 port 32819 MS-CHAP2-Success = 0x07533d41344438423931334434454244384437463634353436353933374137343737324136433138463139 MS-MPPE-Recv-Key = 0x263a0e89b5a8a78aa7e728c79ea3844f MS-MPPE-Send-Key = 0xfef0768ff8ca7d3a76d43ce8feb4189b MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 16. Going to the next request Waking up in 3.7 seconds. Cleaning up request 15 ID 81 with timestamp +1049 Waking up in 1.2 seconds. Cleaning up request 16 ID 82 with timestamp +1051 Ready to process requests. Thanks all Mark This communication is intended for the use of the recipient to which it is addressed and may contain confidential, personal and/or privileged information. If you received this e-mail in error, please advise me (by return e-mail or otherwise) immediately.

2 3