- Freeradius-Users - lists.freeradius.org

Parallel running RADIUS servers
by Brian Candler 18 Feb '11

18 Feb '11

I wonder if anyone has implemented anything like the following, and if so, if they can share their experiences of how they did it. When rolling out a new RADIUS config, I would like to be able to run both the current and new configs side by side, processing the same packets in real time in both servers, and highlight if and where the responses differ. This would give a very high confidence level that the new config didn't break things in unexpected ways. (I already have an off-line test suite, which uses radclient to send a number of test cases to the development RADIUS server, but there is a lot of legacy traffic and I can never be sure that it the suite completely captures all possible cases) I can think of a few ways of implementing this: * Using bpf (like radsniff) to capture the live requests and responses. Forward a copy of the request to a second process, which would somehow be jailed to a loopback interface, and then compare the responses. * Have some sort of forking proxy, which takes one input packet and sends it to two places, A and B. It would take either the A or B response and return it to the client. It could even vote on them (e.g. Access-Accept takes precedence over Access-Reject) Some of the existing logic I work with makes use of the source IP address of the packet (i.e. Client-IP-Address), so a simple proxy which resends the packet would be a problem. I suppose I could put Client-IP-Address into a real AV. Anybody doing anything like this today, or know of any projects which do this? Thanks, Brian.

4 4

get a list of connected users
by Jordi Casas 18 Feb '11

18 Feb '11

Hi all! I am using freeradius 2.1.6 on a testing environment that it's openSUSE 11.2 based. It's configured to provide LDAP Authentication and works well with a WiFi "Enterprise RADIUS" capable router. Now I need to get a list of connected users, I see that there is a radutmp accounting database but I don't know if my kind of NAS supports this feature. Is it necessary for the NAS to use the accounting protocol? Is it a common feature of standard WiFi routers with "Enterprise RADIUS" capability? Is the user accounting the only way to maintain a list of freeradius accepted users? Thanks you very much for your time! Jordi "Txor" Casas Ríos openTrends Solucions i Sistemes S.L phone: +34 93 320 84 14 fax: +34 93 300 35 27 Barcelona - SPAIN

2 1

FR 2.1.6 add realm to User-Name before Proxy by listening port
by Mika 17 Feb '11

17 Feb '11

Hello. How would i go about configuring the following with FreeRadius 2.1.6? I need to change the User-Name attribute by adding a realm to it based on incoming listening port, before the Access-Request is proxied (Proxy-To-Realm) to backend server. Googled and found a way to do this with the hints file and one listening port, but i need to do this for many ports. We are talking about 100-200 ports. One port per customer/realm. User-Name "david" from Customer 1 connects: AAA client (groupname auth) -> FR, Port 21812 (FR converts username to david@customer1) -> Access-Request to Backend OTP-server with "User-Name = david@customer1" User-Name "david" from Customer 2 connects: AAA client (groupname auth) -> FR, Port 21813 (FR converts username to david@customer2) -> Access-Request to Backend OTP-server with "User-Name = david@customer2" This is what i would like FR to do. Is virtual servers the best way? I have not used that before, so i am thankful for any configuration examples you can give me. The AAA client (NAS-IP-Address) is _usually_ the same for all customers. My hints-file: DEFAULT User-Name !~ ".*@", NAS-IP-Address == "x.x.x.x" User-Name := "%{User-Name}@customer1" Thanks in advance. Regards Mika -- View this message in context: http://freeradius.1045715.n5.nabble.com/FR-2-1-6-add-realm-to-User-Name-bef… Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 14

why my client fail to authentication failure when I run radlogin
by Jenny Liew 17 Feb '11

17 Feb '11

Hello, I'm new in Radius, I have read through and follow to all the messages and documents. Here is my setup, I have run server and client on the same linux machine. I able to run 'radtest' and 'radclient' command, and I did successfully received correct response. However, when I tried to run radlogin command, i kept getting this output on my client side; Radius: authentication failure local: authentication failure when I run radexample, I did get successful authentication with the username and password. However, when i tried to run radacct, my client seems that stop working until i press on "Ctrl+C". Any idea? what is causing the problem? Anybody can help me, please?? Many thanks. -- Best Regards, Jenny

2 1

wiki question
by Raymond Norton 17 Feb '11

17 Feb '11

I am working through the following wiki: http://wiki.freeradius.org/FreeRADIUS_Active_Directory_Integration_HOWTO#Se… I'm good till I get to this area: Configuration of radiusd.conf Open this file and proceed to the section: # Microsoft CHAP authentication Make sure that the following lines are uncommented and that the value is the same as indicated here. authtype = MS-CHAP with_ntdomain_hack = yes, etc.......................... I don't have any of this info in radiusd.conf, so do I add all of it, or is this info contained elsewhere? Raymond

3 5

Freeradius2.1.3 + Fedora9 + PEAP + AD = problem
by Lukas Hofrichtr 17 Feb '11

17 Feb '11

Hello everyone, is there any progress resolving this issue? I have samba 3.5.6 on FC14 and have the SAME problem like I've had with FC9/10, Freeradius2 and samba included with distribution. The problem is I cant rollback to older Samba version as it does not support Windows 2008R2 domain.... Also I've got one point....I am running Fedora 8 with freeradius 1, with Samba 3.5.3 and radius is working fine for my wireless clients but I wanted to use freeradius 2 on newer Fedora distros - cant make it working, spent a loooot of time with this and still stucked on same issue like described above. Anyone has a suggestion pls? (Yes I have included the XP extensions - same certificate working OK with freeradius 1 and samba 3.5.3 on MS clients) Thanks! Lukas MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = 0x01f700331a03f6002e533d363346434138453641313741443238314644303643423431 30373237353139413233364537433744 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f3b45522ecc5ffaf0daaa4d5068ce69 [peap] Got tunneled reply RADIUS code 11 EAP-Message = 0x01f700331a03f6002e533d363346434138453641313741443238314644303643423431 30373237353139413233364537433744 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2f3b45522ecc5ffaf0daaa4d5068ce69 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 122 to 172.31.183.1 port 2048 EAP-Message = 0x01f7005b190017030100509b7087b2a112825ea5aa08f802b90731b5f46e59349a2cde dc81a89f4103967283ba2f8990331ecb9ec7535a4f77b110e189f58f6162dbdc9a713a14 d562f0f4fa52f6838fccc6a9be5003515e0b1263 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2e4eb3ac29b9aa99635005e47464e6cc Finished request 12. Going to the next request Waking up in 1.4 seconds. Cleaning up request 0 ID 110 with timestamp +9 Cleaning up request 1 ID 111 with timestamp +9 Cleaning up request 2 ID 112 with timestamp +9 Cleaning up request 3 ID 113 with timestamp +9 Cleaning up request 4 ID 114 with timestamp +9 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xbed60aebbaf213e9 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! -- View this message in context: http://freeradius.1045715.n5.nabble.com/Freeradius2-1-3-Fedora9-PEAP-AD- problem-tp2780544p3384416.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 10

Multiple authentication methods at the same time?
by Thomas A. Fine 17 Feb '11

17 Feb '11

Hi, I thought this would be easy but now I'm wondering if it will be possible at all. We are transitioning to a DMZ for all ssh logins. During phase one, people will use a standard (but different than internal) password which will be obtained either through LDAP or the passwd module (we just haven't picked one yet, either should be fine). But eventually the DMZ ssh will need to be OTP. So I wanted to be able to offer OTP as an option during transition for people to try out and get used to while still being able to use their other traditional password. So fallback in the case of one method (e.g. LDAP) being unavailable is pretty easy. But in this case both methods would be available, and I'd want to test the password against both methods. Is this even possible? It seems like once it has found a working module in authorize, it can only use that one module in authenticate. What's the solution? tom tom

5 8

eappeap_postproxy() - set fake->proxy_reply
by Ken-ichirou MATSUZAWA 17 Feb '11

17 Feb '11

Hello, I can't think I understand what went wrong but it works. just escaping from first NULL check in eap_post_proxy() or commit: add0068afc3b732c27c9cc116d7ec331f9a32735 says I misconfigured PEAP proxy? --- src/modules/rlm_eap/types/rlm_eap_peap/peap.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c index 0d9a031..36c012b 100644 --- a/src/modules/rlm_eap/types/rlm_eap_peap/peap.c +++ b/src/modules/rlm_eap/types/rlm_eap_peap/peap.c @@ -571,7 +571,7 @@ static int eappeap_postproxy(EAP_HANDLER *handler, void *data) request->proxy = NULL; rad_assert(fake->reply == NULL); - fake->reply = request->proxy_reply; + fake->reply = fake->proxy_reply = request->proxy_reply; request->proxy_reply = NULL; if ((debug_flag > 0) && fr_log_fp) { @@ -585,7 +585,7 @@ static int eappeap_postproxy(EAP_HANDLER *handler, void *data) fake->options &= ~RAD_REQUEST_OPTION_PROXY_EAP; RDEBUG2("Passing reply back for EAP-MS-CHAP-V2"); module_post_proxy(0, fake); + fake->proxy_reply = NULL; /* * FIXME: If rcode returns fail, do something -- 1.7.2.3

2 2

freeradius User/Group ACL
by vikki 17 Feb '11

17 Feb '11

I have a radius server with just one NAS on RHEL 5 using rpm based freeradius. I requires the following. 1. After authenticating User1 User2 & User 3 can connect to 192.168.1.0 network but rest users User4 User5 User6 wont be able to connect 192.168.1.0 & 2. User4 User5 User6 will be denied connecting to network 192.168.2.0 after authenticating but rest users which are not specified can connect. These User1, User2... User6 are system users of the machine. Thanks -- View this message in context: http://freeradius.1045715.n5.nabble.com/freeradius-User-Group-ACL-tp3388926… Sent from the FreeRadius - User mailing list archive at Nabble.com.

1 0

How do you pass Cleartext-Password from CHAP to another module
by paul smith 16 Feb '11

16 Feb '11

Hi, I want to authenticate a CHAP request against my sql database, but then pass the Cleartext-Password to the next module. I've got the CHAP working fine, but can't work out how to pass the password on. Is this possible? I have an exec module like this: exec authz { wait = yes program = "authz -u %{User-Name} -p %{Cleartext-Password}" input_pairs = request output_pairs = reply } Then in my authorize section I have: authorize { chap sql authz } The chap authentication works from the debug I get: Wed Feb 16 01:45:29 2011 : Info: Found Auth-Type = CHAP Wed Feb 16 01:45:29 2011 : Info: +- entering group CHAP {...} Wed Feb 16 01:45:29 2011 : Info: [chap] login attempt by "a" with CHAP password Wed Feb 16 01:45:29 2011 : Info: [chap] Using clear text password "a" for user a authentication. Wed Feb 16 01:45:29 2011 : Info: [chap] chap user a authenticated succesfully Wed Feb 16 01:45:29 2011 : Info: ++[chap] returns ok But when it runs my other module I get: Wed Feb 16 01:45:29 2011 : Info: [authz] expand: %{User-Name} -> a Wed Feb 16 01:45:29 2011 : Info: [authz] expand: %{Cleartext-Password} -> The Cleartext-Password isn't set. Does anyone know what I need to set to make this happen? thanks,

3 6