- Freeradius-Users - lists.freeradius.org

Eduroam with a Local Radius Config?
by Nathan McDavit-Van Fleet 18 Feb '11

18 Feb '11

I'm trying to get Eduroam working on our existing Freeradius service. There are myriad instructions for getting Eduroam working. Unfortunately a majority of them assume you are configuring it to only do Eduroam and nothing else. Currently I am proxying Successfully to Eduroam with the following setup: realm concordia.ca { } realm LOCAL { nostrip } realm NULL { nostrip } realm DEFAULT { pool = EDUROAM-FTLR nostrip } I won't show the pool config for the "DEFAULT" realm. But suffice to say that's working. Also, our legacy users who are authenticating with no realm are working as well. What isn't working are local connections using our local real (user(a)concordia.ca) and distant AAA requests from Eduroam. The Eduroam cookbook provides some configs that appear to be helpful. But unfortunately they're so broken I can't even put them in my configuration. What the below configs appear to do is check if they are of realm domain.tld and then switch the Proxy-Realm. But the configs are too broken to work. >From what I understand at the first "if" is missing a double quote, and the second one isn't even evaluating and I can't fix it enough to get the server to restart. I have included my fixes, but as I said the preacct if statement still does not allow the server to restart after the config is included. ORIGINAL authorize { auth_log suffix if (("%{control:Proxy-To-Realm} == "DEFAULT") && (User-Name =~ /.*@.*.domain.tld$/)) { update control { Proxy-To-Realm := NULL } } preacct { detail suffix if ((Proxy-To-Realm = DEFAULT) && (User-Name =~ /.*@.*.domain.tld$/)) update control { Proxy-To-Realm := NULL } } FIXED (???) authorize { auth_log suffix if (("%{control:Proxy-To-Realm}" == "DEFAULT") && (User-Name =~ /.*@.*.domain.tld$/)) { update control { Proxy-To-Realm := NULL } } preacct { detail suffix if ((Proxy-To-Realm == "DEFAULT") && (User-Name =~ /.*@.*.domain.tld$/)) update control { Proxy-To-Realm := NULL } } Nathan Van Fleet Telecommunications Analyst Network Assessment and Integration IITS Concordia University (514) 848-2424 Extension:5434

5 6

Corrupted Secret with squid_radius_auth
by Robert Dunkley 18 Feb '11

18 Feb '11

I was wondering if anyone knew of a fix for the corrupted secret issue with squid_radius_auth under 64bit OS? I have the exact same issue as the user in the link below but am using Radiator (Works fine with other Radius clients): http://freeradius.1045715.n5.nabble.com/Issues-with-squid-radius-auth-td 2788947.html TIA Rob The SAQ Group Registered Office: 18 Chapel Street, Petersfield, Hampshire GU32 3DZ SAQ is the trading name of SEMTEC Limited. Registered in England & Wales Company Number: 06481952 http://www.saqnet.co.uk AS29219 SAQ Group Delivers high quality, honestly priced communication and I.T. services to UK Business. Broadband : Domains : Email : Hosting : CoLo : Servers : Racks : Transit : Backups : Managed Networks : Remote Support. ISPA Member

2 5

Parallel running RADIUS servers
by Brian Candler 18 Feb '11

18 Feb '11

I wonder if anyone has implemented anything like the following, and if so, if they can share their experiences of how they did it. When rolling out a new RADIUS config, I would like to be able to run both the current and new configs side by side, processing the same packets in real time in both servers, and highlight if and where the responses differ. This would give a very high confidence level that the new config didn't break things in unexpected ways. (I already have an off-line test suite, which uses radclient to send a number of test cases to the development RADIUS server, but there is a lot of legacy traffic and I can never be sure that it the suite completely captures all possible cases) I can think of a few ways of implementing this: * Using bpf (like radsniff) to capture the live requests and responses. Forward a copy of the request to a second process, which would somehow be jailed to a loopback interface, and then compare the responses. * Have some sort of forking proxy, which takes one input packet and sends it to two places, A and B. It would take either the A or B response and return it to the client. It could even vote on them (e.g. Access-Accept takes precedence over Access-Reject) Some of the existing logic I work with makes use of the source IP address of the packet (i.e. Client-IP-Address), so a simple proxy which resends the packet would be a problem. I suppose I could put Client-IP-Address into a real AV. Anybody doing anything like this today, or know of any projects which do this? Thanks, Brian.

4 4

get a list of connected users
by Jordi Casas 18 Feb '11

18 Feb '11

Hi all! I am using freeradius 2.1.6 on a testing environment that it's openSUSE 11.2 based. It's configured to provide LDAP Authentication and works well with a WiFi "Enterprise RADIUS" capable router. Now I need to get a list of connected users, I see that there is a radutmp accounting database but I don't know if my kind of NAS supports this feature. Is it necessary for the NAS to use the accounting protocol? Is it a common feature of standard WiFi routers with "Enterprise RADIUS" capability? Is the user accounting the only way to maintain a list of freeradius accepted users? Thanks you very much for your time! Jordi "Txor" Casas Ríos openTrends Solucions i Sistemes S.L phone: +34 93 320 84 14 fax: +34 93 300 35 27 Barcelona - SPAIN

2 1

FR 2.1.6 add realm to User-Name before Proxy by listening port
by Mika 17 Feb '11

17 Feb '11

Hello. How would i go about configuring the following with FreeRadius 2.1.6? I need to change the User-Name attribute by adding a realm to it based on incoming listening port, before the Access-Request is proxied (Proxy-To-Realm) to backend server. Googled and found a way to do this with the hints file and one listening port, but i need to do this for many ports. We are talking about 100-200 ports. One port per customer/realm. User-Name "david" from Customer 1 connects: AAA client (groupname auth) -> FR, Port 21812 (FR converts username to david@customer1) -> Access-Request to Backend OTP-server with "User-Name = david@customer1" User-Name "david" from Customer 2 connects: AAA client (groupname auth) -> FR, Port 21813 (FR converts username to david@customer2) -> Access-Request to Backend OTP-server with "User-Name = david@customer2" This is what i would like FR to do. Is virtual servers the best way? I have not used that before, so i am thankful for any configuration examples you can give me. The AAA client (NAS-IP-Address) is _usually_ the same for all customers. My hints-file: DEFAULT User-Name !~ ".*@", NAS-IP-Address == "x.x.x.x" User-Name := "%{User-Name}@customer1" Thanks in advance. Regards Mika -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-bef… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 14

why my client fail to authentication failure when I run radlogin
by Jenny Liew 17 Feb '11

17 Feb '11

Hello, I'm new in Radius, I have read through and follow to all the messages and documents. Here is my setup, I have run server and client on the same linux machine. I able to run 'radtest' and 'radclient' command, and I did successfully received correct response. However, when I tried to run radlogin command, i kept getting this output on my client side; Radius: authentication failure local: authentication failure when I run radexample, I did get successful authentication with the username and password. However, when i tried to run radacct, my client seems that stop working until i press on "Ctrl+C". Any idea? what is causing the problem? Anybody can help me, please?? Many thanks. -- Best Regards, Jenny

2 1

wiki question
by Raymond Norton 17 Feb '11

17 Feb '11

I am working through the following wiki: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO#Se… I'm good till I get to this area: Configuration of radiusd.conf Open this file and proceed to the section: # Microsoft CHAP authentication Make sure that the following lines are uncommented and that the value is the same as indicated here. authtype = MS-CHAP with_ntdomain_hack = yes, etc.......................... I don't have any of this info in radiusd.conf, so do I add all of it, or is this info contained elsewhere? Raymond

3 5

Freeradius2.1.3 + Fedora9 + PEAP + AD = problem
by Lukas Hofrichtr 17 Feb '11

17 Feb '11

Hello everyone, is there any progress resolving this issue? I have samba 3.5.6 on FC14 and have the SAME problem like I've had with FC9/10, Freeradius2 and samba included with distribution. The problem is I cant rollback to older Samba version as it does not support Windows 2008R2 domain.... Also I've got one point....I am running Fedora 8 with freeradius 1, with Samba 3.5.3 and radius is working fine for my wireless clients but I wanted to use freeradius 2 on newer Fedora distros - cant make it working, spent a loooot of time with this and still stucked on same issue like described above. Anyone has a suggestion pls? (Yes I have included the XP extensions - same certificate working OK with freeradius 1 and samba 3.5.3 on MS clients) Thanks! Lukas MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x01f700331a03f6002e533d363346434138453641313741443238314644303643423431 30373237353139413233364537433744 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f3b45522ecc5ffaf0daaa4d5068ce69 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x01f700331a03f6002e533d363346434138453641313741443238314644303643423431 30373237353139413233364537433744 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f3b45522ecc5ffaf0daaa4d5068ce69 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 122 to 172.31.183.1 port 2048 EAP-Message = 0x01f7005b190017030100509b7087b2a112825ea5aa08f802b90731b5f46e59349a2cde dc81a89f4103967283ba2f8990331ecb9ec7535a4f77b110e189f58f6162dbdc9a713a14 d562f0f4fa52f6838fccc6a9be5003515e0b1263 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e4eb3ac29b9aa99635005e47464e6cc Finished request 12. Going to the next request Waking up in 1.4 seconds. Cleaning up request 0 ID 110 with timestamp +9 Cleaning up request 1 ID 111 with timestamp +9 Cleaning up request 2 ID 112 with timestamp +9 Cleaning up request 3 ID 113 with timestamp +9 Cleaning up request 4 ID 114 with timestamp +9 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xbed60aebbaf213e9 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius2-1-3-Fedora9-PEAP-AD- problem-tp2780544p3384416.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 10

Multiple authentication methods at the same time?
by Thomas A. Fine 17 Feb '11

17 Feb '11

Hi, I thought this would be easy but now I'm wondering if it will be possible at all. We are transitioning to a DMZ for all ssh logins. During phase one, people will use a standard (but different than internal) password which will be obtained either through LDAP or the passwd module (we just haven't picked one yet, either should be fine). But eventually the DMZ ssh will need to be OTP. So I wanted to be able to offer OTP as an option during transition for people to try out and get used to while still being able to use their other traditional password. So fallback in the case of one method (e.g. LDAP) being unavailable is pretty easy. But in this case both methods would be available, and I'd want to test the password against both methods. Is this even possible? It seems like once it has found a working module in authorize, it can only use that one module in authenticate. What's the solution? tom tom

5 8

eappeap_postproxy() - set fake->proxy_reply
by Ken-ichirou MATSUZAWA 17 Feb '11

17 Feb '11

Hello, I can't think I understand what went wrong but it works. just escaping from first NULL check in eap_post_proxy() or commit: add0068afc3b732c27c9cc116d7ec331f9a32735 says I misconfigured PEAP proxy? --- src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c index 0d9a031..36c012b 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c @@ -571,7 +571,7 @@ static int eappeap_postproxy(EAP_HANDLER *handler, void *data) request->proxy = NULL; rad_assert(fake->reply == NULL); - fake->reply = request->proxy_reply; + fake->reply = fake->proxy_reply = request->proxy_reply; request->proxy_reply = NULL; if ((debug_flag > 0) && fr_log_fp) { @@ -585,7 +585,7 @@ static int eappeap_postproxy(EAP_HANDLER *handler, void *data) fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP; RDEBUG2("Passing reply back for EAP-MS-CHAP-V2"); module_post_proxy(0, fake); + fake->proxy_reply = NULL; /* * FIXME: If rcode returns fail, do something -- 1.7.2.3

2 2