- Freeradius-Users - lists.freeradius.org

Freeradius proxy caching users
by Ivan Luska 11 Apr '11

11 Apr '11

Hello, I use Freeradius as proxy server. Is it possible to cache authenticated users on the proxy and resend access-accept to these users, if home server fails? Ivan Luska

3 2

FR and AD with ntlm and Users group
by Raheel Itrat 11 Apr '11

11 Apr '11

Hi, I am authenticating my Cisco devices by integrating FreeRadius with Active Directory. Not using LDAP but ntlm_auth. Now If I make a group on my AD server for example Router Admins and put some users in it. Now, where would I define in the FreeRadius that only users from Router Admin group are permitted. Do I need to define it in the smb.conf? BR, Raheel

1 0

problem in assigning Tunnel-Private-Group-ID
by syharash 11 Apr '11

11 Apr '11

Hi, My freeradius is set and working fine, the authentication is successful on a windows XP machine on the wireless network. I am using Cisco Switches and Ruckus Zone Director 1000 with Ruckus AP's. They are connected to the switches on the trunk ports with all vlans allowed. I get the following PEAP output; [peap] Got tunneled reply code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "18" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x4f6c9d87690bee0a58553bc0511d5d8b MS-MPPE-Recv-Key = 0x3a8d8e6495f46657b8eb7fd7de5414ca EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" [peap] Got tunneled reply RADIUS code 2 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Framed-User Tunnel-Private-Group-Id:0 = "18" MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 MS-MPPE-Send-Key = 0x4f6c9d87690bee0a58553bc0511d5d8b MS-MPPE-Recv-Key = 0x3a8d8e6495f46657b8eb7fd7de5414ca EAP-Message = 0x030a0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" [peap] Tunneled authentication was successful. but the machine does not get the IP address from the vlan id assigned to it, i get this output; [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 182 to 10.73.93.151 port 1036 EAP-Message = 0x010b00261900170301001b02e15cc2abe26c501fdcd17fcd4f071c3f8a537b5dd5b0ebb210e9 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x5b2c3d415227240db5e9ddff32a6a83d Finished request 9. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 10.73.93.151 port 1036, id=183, length=231 User-Name = "abdul" Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-CB-0D" Service-Type = Framed-User Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-CB-0D" Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020b00261900170301001bbb6ec9c29da3419792e34574056635e11eee7834778d5fad460595 State = 0x5b2c3d415227240db5e9ddff32a6a83d Vendor-25053-Attr-3 = 0x55464f4d6f7669657a Message-Authenticator = 0x4263907cbffb8eec9f8b93a9138037dd # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "abdul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 11 length 38 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Peap state send tlv success [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok Login OK: [abdul] (from client UFO-Network port 1 cli 00-1F-3C-E1-17-A9) # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 183 to 10.73.93.151 port 1036 MS-MPPE-Recv-Key = 0x2427d16802fc1cc49ddea287efb9c9d5ba0f8698cc2a9ea300c43d46d720a4d5 MS-MPPE-Send-Key = 0xc3d215b48856c14b29eb75f29b0fbeb6c3a3c83ed5d657259df03cb3759c4d9f EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "abdul" Finished request 10. Going to the next request Waking up in 4.5 seconds. Cleaning up request 0 ID 173 with timestamp +8 Waking up in 0.3 seconds. Cleaning up request 1 ID 174 with timestamp +9 Cleaning up request 2 ID 175 with timestamp +9 Cleaning up request 3 ID 176 with timestamp +9 Cleaning up request 4 ID 177 with timestamp +9 Cleaning up request 5 ID 178 with timestamp +9 Cleaning up request 6 ID 179 with timestamp +9 Cleaning up request 7 ID 180 with timestamp +9 Cleaning up request 8 ID 181 with timestamp +9 Cleaning up request 9 ID 182 with timestamp +9 Cleaning up request 10 ID 183 with timestamp +9 Ready to process requests. rad_recv: Accounting-Request packet from host 10.73.93.151 port 1044, id=184, length=213 User-Name = "abdul" Acct-Status-Type = Start Acct-Authentic = RADIUS Framed-IP-Address = 169.254.67.194 Calling-Station-Id = "00-1F-3C-E1-17-A9" NAS-IP-Address = 10.73.93.151 NAS-Port = 1 Called-Station-Id = "AC-67-06-39-CB-0D" NAS-Port-Type = Wireless-802.11 NAS-Identifier = "AC-67-06-39-CB-0D" Connect-Info = "AC-67-06-39-CB-0D" Acct-Session-Id = "4D9EBE6D-00000037" Acct-Multi-Session-Id = "ac670639cb0d001f3ce117a94d9f077c00d2" Vendor-25053-Attr-3 = 0x55464f4d6f7669657a # Executing section preacct from file /etc/raddb/sites-enabled/default +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 1,Client-IP-Address = 10.73.93.151,NAS-IP-Address = 10.73.93.151,Acct-Session-Id = "4D9EBE6D-00000037",User-Name = "abdul"' [acct_unique] Acct-Unique-Session-ID = "c55f8220b641e9bd". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "abdul", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop # Executing section accounting from file /etc/raddb/sites-enabled/default +- entering group accounting {...} [detail] expand: /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radius/radacct/10.73.93.151/detail-20110408 [detail] /var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radius/radacct/10.73.93.151/detail-20110408 [detail] expand: %t -> Fri Apr 8 18:38:10 2011 ++[detail] returns ok ++[unix] returns ok [radutmp] expand: /var/log/radius/radutmp -> /var/log/radius/radutmp [radutmp] expand: %{User-Name} -> abdul ++[radutmp] returns ok ++[exec] returns noop [attr_filter.accounting_response] expand: %{User-Name} -> abdul attr_filter: Matched entry DEFAULT at line 12 ++[attr_filter.accounting_response] returns updated Sending Accounting-Response of id 184 to 10.73.93.151 port 1044 Finished request 11. Cleaning up request 11 ID 184 with timestamp +68 Going to the next request Ready to process requests. I have checked the /etc/raddb/users, which looks like this; DEFAULT Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Service-Type = Framed-User, Fall-Through = Yes abdul Cleartext-Password := "test123" Tunnel-Private-Group-ID = 18 Is there anything that I need to do on the FreeRadius or is it my switches or the Zone Director which is the culprit. Please help. Syed -- View this message in context: http://freeradius.1045715.n5.nabble.com/problem-in-assigning-Tunnel-Private… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

Simple "Guest user" web front end for FreeRADIUS
by up＠3.am 11 Apr '11

11 Apr '11

On my client's wifi network, we are authenticating staff users via FreeRADIUS against the corporate LDAP database. I've created a new SSID/WLAN with an IP pool that I've restricted through router ACLs that we want to deploy for temporary "guest" users. I can set up a new FreeRADIUS server (I've done many of those) backend for this, but am unfamiliar with 2 things that will be different here, which are: 1) A Web front end for a clerical type to enter in temporary accounts to FreeRADIUS. I imagine there must be a simple php interface for some sort of "Internet cafe" type of use. I'd prefer as simple as possible (ie, flat file), but would be fine if MySQL is the way to go for account info storage. I know I COULD put together a FreeRADIUS and OpenLDAP server with something like a webmin front end, but that seems overkill to me. 2) Some sort of automatic password generator for above...not absolutely necessary, but would be nice. I would imagine this wheel has already been invented, so if anybody could point me in the right direction, it would be appreciated. Thanks!

4 4

Something about the commonName of client certificate
by xuyu 10 Apr '11

10 Apr '11

Hi! I want to build eap/tls so i need to produce a client certificate. in the certs catalog there are ca.pem and server.pem,but not client.pem.so I should use command "make client.pem". in the README file there are some words:"Be sure that the commonName field here is the User-Name that will be used for logins!" Does it mean ommonName must the same with the login name in the eapol_test ? thank you for your help ,best regards.

1 0

associating mac addresses with usernames
by Stephen Vigus 10 Apr '11

10 Apr '11

Hi all First post to the list ;) I want to use both mac authentication and username authentication. I have both working fine separately from mysql, but I want associate certain mac addresses to certain usernames and have it authenticate with the username. I thought I could use the following to authenticate mac addresses: if("%{sql:SELECT radusergroup.username FROM authorized_macs LEFT JOIN radusergroup ON ( authorized_macs.username = radusergroup.username ) WHERE authorized_macs.macaddr = ''%{User-Name}'}" > 0){ ok } else{ reject } In mysql this query would display the username associated to the mac (eg, user1@realm1), although it seems freeradius does not like this. Can anyone point me in the right direction so freeradius would think its "user1@realm1" authenticating when it receives the mac address? thanks Stephen

2 3

how to radtest from another client
by 徐宇 09 Apr '11

09 Apr '11

I install freeradius in the server its ip is 192.168.1.1. In the server I have already do the radtest ,and the result is OK rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=11, length=20 I want to add a test authenticator host client. So I add something at the end of my clients.conf and assign a shared-secret. client 192.168.1.100 { secret = testing123 shortname = 192.168.1.100 } Should I do other things to finish it? I need to do the radtest in the client(192.168.1.100) right? But there isn't a radtest command in the client, Need I install some softwares in the client? thank you for your help ,best regards.

3 5

rlm_sql_unixodbc ?
by Jim Rice 08 Apr '11

08 Apr '11

Quick question: I am looking into adding an ACT! Plugin to populate the Radius MySQL database through unix ODBC. Found rlm_sql_unixodbc and wondered if this is already provided for this purpose, or something else? Looks like it needs to be run through "make"... (not installed by default). Otherwise, I can go through the steps for installing mysql-connector-odbc and friends. Thanks, Jim

4 11

Restrict access per NAS
by Sergio Belkin 08 Apr '11

08 Apr '11

Hi, Is there a way to restrict an LDAP user to be authorized only from an specific NAS (Access Point)? I'm using FreeRADIUS Version 2.1.1 Thanks in advance! -- -- Sergio Belkin http://www.sergiobelkin.com Watch More TV http://sebelk.blogspot.com LPIC-2 Certified - http://www.lpi.org

2 1

PC XP SP2 with 802.1x/PEAP authenticate problem
by irena grubnic 08 Apr '11

08 Apr '11

Hi, maybe somebody can help me in my attempt to authenticate supplicant PC (WinXP SP2 with enabled 802.1x authentication using PEAP and Authentication Mehtod "Secured password EAP-MSCHAP v2") using Free RADIUS Version 2.1.10. RADIUS client is ONT (GPON, 802.1x enabled on it's Ethernet port). I have modified 3 RADIUS configuration files: *********** 1.eap.conf* *********** deafault_eap_type = peap *************** 2.clients.conf* *************** Added new client (PC is connected to ONT which further forwards requests to BLM acting as client). client 10.223.0.131 { ipaddr = 10.223.0.131 secret = hello123 require_message_authenticator = no nastype = other # localhost isn't usually a NAS... } Secret password "hello123" is also configured on related client (ONT): RADIUS proxy address | 100.1.1.1 RADIUS proxy secret | ont343 RADIUS auth server 1 | 10.223.0.13 RADIUS auth secret 1 | hello123 RADIUS auth port 1 | 1812 RADIUS auth server 2 | 0.0.0.0 RADIUS auth secret 2 | - RADIUS auth port 2 | 0 RADIUS auth server 3 | 0.0.0.0 RADIUS auth secret 3 | - RADIUS auth port 3 | 0 ******** 3.users* ******** Added new entry for PC using its MAC address for credentials: 00:02:a5:f8:70:29 Cleartext-Password := "00:02:a5:f8:70:29" When I try to authenticate PC by entering its MAC address as user name/password RADIUS Access-Reject message is generated by Free RADIUS and in debug window following output is obtained: rad_recv: Access-Request packet from host 10.223.0.131 port 65534, id=71, length=142 NAS-IP-Address = 100.1.1.1 NAS-Port-Id = "1.2" Framed-MTU = 1024 User-Name = "00-02-A5-F8-70-29" Calling-Station-Id = "00-02-A5-F8-70-29" Message-Authenticator = 0xe990ef46d4eaddc9760eff3924f3613e EAP-Message = 0x025200160130303a30323a61353a66383a37303a3239 NAS-Identifier = "PENKALA" Ericsson-Attr-101 = 0x4552494353534f4e # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "00-02-A5-F8-70-29", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 82 length 22 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Identity does not match User-Name, setting from EAP Identity. [eap] Failed in handler ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 00-02-A5-F8-70-29 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 71 to 10.223.0.131 port 65534 Waking up in 4.9 seconds. Cleaning up request 0 ID 71 with timestamp +160 Ready to process requests. Please can you help me with this issue, I assume I missed something related to configuration.. BR, Irena ---------------------- T - C o m - - W e b m a i l ---------------------- Ova poruka poslana je upotrebom T-Com Webmail usluge Uzivajte u shoppingu ne napustajuci udobnost svoga doma! http://shopping.tportal.hr

4 3