- Freeradius-Users - lists.freeradius.org

EAP transaction benchmark
by Waqas Toor 14 Feb '11

14 Feb '11

Hi community, I need to benchmark the eap transactions in the case of EAP-TLS auth. I mean how many transactions per second of eap a system can handle ( test bed is a multi core intel based system with 36 GB of ram ) also if there are any tools available the we can use to benchmark eap process ( some type of eap radclient ) so that we build some threaded process upon that tool to check these transactions for our environment. Also if there are any benchmarks that are already done by community/testers can be useful too. I am using 2 phase auth 1 is EAP-TLS and then MAC based auth. Thanks. Waqas Toor

2 1

freeradius +mpd
by Edgars 13 Feb '11

13 Feb '11

Hello, I'm running freebsd 8.1 with mpd 5.5, authenticating users against freeradius. After some seccon uptime pppoe link is dropped. In radius.log i see this Auth: Login OK: [test/test] (from client mpd port 2 cli 000c2906911e) Error: Received Accounting-Request packet from 10.10.10.2 with invalid signature! (Shared secret is incorrect.) Dropping packet without response. Found in forums about "options RADIX_MPATH" for kernel but that didn't give me any result. DEBUG: rad_recv: Access-Request packet from host 10.10.10.2 port 19490, id=151, length=183 NAS-Identifier = "mpd.mydomain.tld" NAS-IP-Address = 10.10.10.2 Message-Authenticator = 0xd52aa007f6772e3745cc6209e99aef8d Acct-Session-Id = "7596900-em1_0-2" NAS-Port = 2 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000c2906911e" Called-Station-Id = "z" NAS-Port-Id = "em1" Vendor-12341-Attr-12 = 0x656d315f302d32 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:0c:29:06:91:1e" User-Name = "test" User-Password = "test" +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/10.10.10.2/auth-detail-20110213 [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/10.10.10.2/auth-detail-20110213 [auth_log] expand: %t -> Sun Feb 13 10:00:27 2011 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 172 ++[files] returns ok [sql] expand: %{User-Name} -> test [sql] sql_set_user escaped user --> 'test' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attri bute, value, op FROM radcheck WHERE username = 'test' ORDER BY id [sql] User found in radcheck table [sql] expand: SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attri bute, value, op FROM radreply WHERE username = 'test' ORDER BY id [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergr oup WHERE username = 'test' ORDER BY priority rlm_sql (sql): Released sql socket id: 3 ++[sql] returns ok ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns updated Found Auth-Type = PAP +- entering group PAP {...} [pap] login attempt with password "test" [pap] Using CRYPT encryption. [pap] User authenticated successfully ++[pap] returns ok Login OK: [test/test] (from client mpd port 2 cli 000c2906911e) +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 151 to 10.10.10.2 port 19490 Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Finished request 23. Going to the next request Waking up in 0.5 seconds. rad_recv: Accounting-Request packet from host 10.10.10.2 port 26224, id=172, length=218 NAS-Identifier = "mpd.mydomain.tld" NAS-IP-Address = 10.10.10.2 Acct-Session-Id = "7596900-em1_0-2" NAS-Port = 2 NAS-Port-Type = Ethernet Service-Type = Framed-User Framed-Protocol = PPP Calling-Station-Id = "000c2906911e" Called-Station-Id = "z" NAS-Port-Id = "em1" Vendor-12341-Attr-12 = 0x656d315f302d32 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Client-Endpoint:0 = "00:0c:29:06:91:1e" Acct-Status-Type = Start Framed-IP-Address = 20.20.20.2 User-Name = "test" Acct-Multi-Session-Id = "7596900-B-1" Vendor-12341-Attr-13 = 0x422d31 Vendor-12341-Attr-14 = 0x6e6730 Vendor-12341-Attr-15 = 0x00000004 Acct-Link-Count = 1 Acct-Authentic = RADIUS +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 2,Client-IP-Address = 10.10.10.2,NAS-IP-Address = 10.10.10.2,Acct-Session-Id = "7596900-em1_0-2",User-Name = "test"' [acct_unique] Acct-Unique-Session-ID = "026e7c5b94c4dd87". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/radacct/10.10.10.2/detail-20110213 [detail] /var/log/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/radacct/10.10.10.2/detail-20110213 [detail] expand: %t -> Sun Feb 13 10:00:27 2011 ++[detail] returns ok ++[unix] returns fail Finished request 24. Cleaning up request 24 ID 172 with timestamp +12 Going to the next request Waking up in 0.5 seconds.

2 1

help with proper responses?
by Christ Schlacta 13 Feb '11

13 Feb '11

so uh.. I locked myself out of my radius enabled switch (for some stupid reason the switch thinks it's a good idea to use radius for the admin user as well...) and now I can sign in to my switch, but can't change anything, because I don't know what radius responses to send. if anyone knows the right answer, it'd be a big help. I know this probably isn't the best place to ask, but it is currently the only.

2 1

Second SSH with Freeradius based authentication
by Jaikanth Krishnaswamy 12 Feb '11

12 Feb '11

Hi All, I am a newbie to freeradus. I am planning to run a second SSHD on a higher port on my server which will allow me to authenticate separately from my existing SSHD. Can somebody help me by telling me what are the steps I need to take to perform this . The Server I will be using is a RHEL5. Thanks in advance. JK

3 3

Freeradius + LDAP for WPA-Enterprise
by Max Schröder 12 Feb '11

12 Feb '11

Hello to all, I would like to use Freeradius to authenticate my wireless network using OpenWRT and Freeradius + LDAP. What I've done: First Authenticated Users in WLan using EAP-TTLS and files in Freeradius. WORKED! Then I've configured ldap-Modul + added "ldap" in the authorize- and "Auth-Type LDAP { ldap }" in the authenticate-section. The test via radtest succeeded. But now the authentication using OpenWRT (EAP-TTLS) like the first try with files - now with ldap did not work. I do noticed the following comment # Note that this means "check plain-text password against # the ldap database", which means that EAP won't work, # as it does not supply a plain-text password. Auth-Type LDAP { ldap } but I don't know what to change that it worked like my first try with the difference the users are in LDAP instead of a file. Hope to get any hints Best regards. MS

5 11

Verschlüsselte Übertragung von Passwörtern
by Marius.Meisner 11 Feb '11

11 Feb '11

Hello, I'am searching for a good way to secure the transmission of passwords with decryption between clients and a radius-server (there is no NAS between) without client zertificates. At the moment I use default PAP configuration. Which ways are possible? Any hind, how I get this working or could find solutions? In the dokumentation I haven't found something like that with PAP? Is there a posiblity to get this work with PAP or should I change form PAP to EAP or something else? thx & greets MM

2 5

rlm_python and the Tunnel-Private-Group-Id attribute
by Bob Brandt 11 Feb '11

11 Feb '11

Not sure if there isn't another forum or mailing list for rlm_python specifically, but... I have been using freeradius for a while now with great results, thanks! We are using a very simple configuration to authenticate users against LDAP (eDirectory) and that part works great! I am trying to add a component that will return the necessary attributes to allow for dynamic VLANs I was able to get this working using the /etc/raddb/users file, however do to the size of the organization, this is very messy. I have started using python to extract this information from another database and return the information. All my testing seems to indicate it should work, but it is not. I believe the problem is in how rlm_python returns the "Tunnel-Private-Group-Id" attribute. My users file (which works) looks like this: # Generic LDAP return attributes DEFAULT Auth-Type == "LDAP" Class = "Staff", Service-Type = Login, Tunnel-Medium-Type = IEEE-802, Tunnel-Type = VLAN, Tunnel-Private-Group-ID = 99, Fall-Through = Yes brandtb Reply-Message += "You are a member of the IT Group", Class := "CACS:0/ebf42/ac8c8e6/administrator", Tunnel-Private-Group-ID := 150, Alcatel-Lucent-Asa-Access = "all", Fall-Through = No Below are the two snipets of the debugs. The first is from the old(working) system which uses the users file and the second is from the new system using the rlm_python module: Sending Access-Challenge of id 172 to 10.200.113.99 port 18699 Class := 0x434143533a302f65626634322f616338633865362f61646d696e6973747261746f72 Service-Type = Login-User Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 := "150" Reply-Message += "You are a member of the IT Group" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xc146d1a4c144c80f46bec9bc87d3208b Finished request 0. ----- Sending Access-Challenge of id 130 to 10.200.113.99 port 18673 Reply-Message = "You are a member of the IT Group" Tunnel-Type:0 = VLAN Class = 0x4f50575374616666 Class = 0x434143533a302f65626634322f616338633865362f61646d696e6973747261746f72 Tunnel-Medium-Type:0 = IEEE-802 Service-Type = Login-User Tunnel-Private-Group-Id:0 = "150" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8cd4aac48cd6b3a6430ea766ccfa9b91 Finished request 0. The debug output looks for the most part identical! Now, initially when using the users file, I had the same problem I am having now, where the wireless access point was getting the attributes but was not putting me in the correct VLAN. The problem turned out that I was passing a string to the "Tunnel-Private-Group-Id" attribute instead of an integer. Once I removed the quotes from the VLAN ID everything was working perfectly. Thinking that the problem was that within Python I was storing the "Tunnel-Private-Group-Id" attribute as a string I changed it to an integer, however I got immediately got the error: return tuple must be (str,str) I don't know who to get around this and I have not been able to find too many examples of how to use the rlm_python module. Any help would be greatly appreciated. Thanks Bob Brandt -- What's the point of having a rapier wit if I can't use it to stab people? - Jeph Jacques

3 5

EAP and Accounting
by David Peterson 11 Feb '11

11 Feb '11

I am working with a NAS that only sends accounting packets with the EAP style username. Other than matching up =7Bam=3D1=7Df717cc32fff26ff29ca0baac5833f8fc(a)WiMax.com with "Bob(a)WiMax.com" manually in the database are there other methods for achieving this? David

2 1

Framed-IP-Address AVP missing
by Rajkumar R 11 Feb '11

11 Feb '11

Hi, This query is related to Cisco-7206 equipment behavior. We have a Cisco 7206(IOS12.2(33)) equipment associated with freeRadius server2.1.10. Upon PPPOE client start, dynamic IP is assigned from the IP-Pool to the PPPOE client. However this IP address, is not included in the Frame-IP-Address AVP sent in the Access-Request message from the NAS. Request to provide your inputs on this, as this is reported across other forums(unfortunately, no answers available there :)) I have enabled this AVP inclusion with the NAS command, radius-server attribute 8 include-in-access-req Also find the configuration which I have used for your info: Current configuration : 3420 bytes ! version 12.2 no service pad service timestamps debug datetime msec service timestamps log datetime msec no service password-encryption ! hostname CISCOBRAS ! boot-start-marker boot-end-marker ! enable secret 5 $1$NS9k$AMTl8utX2OqwQbWtVsNQX0 enable password abcd ! aaa new-model ! ! aaa group server radius bsnl server 172.31.113.137 auth-port 1812 acct-port 1813 ! aaa group server radius gsds server 172.31.113.135 auth-port 1812 acct-port 1813 ! aaa authentication ppp default group radius aaa authorization network default group radius aaa authorization subscriber-service default local aaa accounting network default start-stop broadcast group bsnl group gsds ! ! ! ! aaa server radius dynamic-author client 172.31.113.135 server-key testing123 server-key testing123 auth-type any ignore session-key ! aaa session-id common ip subnet-zero ! ! ! ip cef ip host gsds 172.31.113.135 ip host bsnl 172.31.113.137 ip host isp 172.31.113.137 ip address-pool local ! ! service-policy type control L2_ACCESS redirect server-group GSDS_SRV server ip 172.31.113.135 port 80 ! redirect server-group ISP_SRV server ip 172.31.113.136 port 80 ! multilink bundle-name authenticated no call rsvp-sync ! ! ! ! ! ! ! username abcd password 0 abcd ! class-map type traffic match-any PPP_SESSION_TRAFFIC_GRAS match access-group input name ACL_GRAS_USER ! class-map type traffic match-any PPP_SESSION_TRAFFIC match access-group input name ACL_BSNL_USER ! class-map type control match-all GRASBERG match unauthenticated-domain gsds ! class-map type control match-all PPP_SESSION match protocol ppp ! policy-map type service SVC_GSDS service local class type traffic PPP_SESSION_TRAFFIC_GRAS redirect to group GSDS_SRV ! ! policy-map type service SVC_GSDS_TO_INTERNET service local class type traffic PPP_SESSION_TRAFFIC_GRAS redirect to group ISP_SRV ! ! policy-map type control L2_ACCESS class type control PPP_SESSION event session-start 1 collect identifier unauthenticated-domain 2 service-policy type control DOMAIN_BASED_ACCESS ! ! policy-map type control DOMAIN_BASED_ACCESS class type control GRASBERG event session-start 1 authenticate aaa list default 2 service-policy type service name SVC_GSDS ! ! ! ! ! ! ! bba-group pppoe BSNL_BBA_GROUP virtual-template 1 ! ! interface FastEthernet1/0 ip address 172.31.113.150 255.255.255.0 no ip route-cache cef no ip route-cache duplex full ! interface FastEthernet1/1 description PPPoE ip address 10.10.10.4 255.255.255.0 no ip route-cache cef no ip route-cache duplex full pppoe enable group BSNL_BBA_GROUP ! interface Virtual-Template1 ip unnumbered FastEthernet1/1 peer default ip address pool GRAS_IP_POOL ppp authentication chap callin ! ip local pool GRAS_IP_POOL 10.10.10.20 ip default-gateway 10.10.10.4 ip classless ! ! no ip http server no ip http secure-server ! ip access-list standard ACL_GRAS_USER permit 10.10.10.0 0.0.0.255 ! ! ! radius-server attribute 8 include-in-access-req radius-server attribute 11 default direction in radius-server host 172.31.113.137 auth-port 1812 acct-port 1813 radius-server host 172.31.113.135 auth-port 1812 acct-port 1813 radius-server key testing123 radius-server vsa send accounting radius-server vsa send authentication ! control-plane ! ! dial-peer cor custom ! ! ! ! gatekeeper shutdown ! ! line con 0 stopbits 1 line aux 0 stopbits 1 line vty 0 4 password cisco ! end thanks, Raj ________________________________ "DISCLAIMER: This message is proprietary to Aricent and is intended solely for the use of the individual to whom it is addressed. It may contain privileged or confidential information and should not be circulated or used for any purpose other than for what it is intended. If you have received this message in error, please notify the originator immediately. If you are not the intended recipient, you are notified that you are strictly prohibited from using, copying, altering, or disclosing the contents of this message. Aricent accepts no responsibility for loss or damage arising from the use of the information transmitted by this email including damage from virus."

2 1

Re: How to get fractions of seconds?
by Alan DeKok 10 Feb '11

10 Feb '11

Stefan A. wrote: > Best would be to have something like '%l', but in a resolution of > milliseconds. This is impossible. The dates and elapsed times in RADIUS have a resolution down to one second, but no more. It's possible to "fake" adding milliseconds, but they will bear little relation to the actual session times. Network delays, processing delays, etc. will all affect the results. Alan DeKok.

3 3