- Freeradius-Users - lists.freeradius.org

Rejecting EAP-TLS based on cert Subject field
by Matt Garretson 28 Jan '11

28 Jan '11

For years, we've been doing simple EAP-TLS with various versions of FreeRADIUS. Now, a new requirement has come down to me such that radius will have to reject certain valid client certs based on a string in the Subject field of the client cert. I've met this need (using 2.1.11 from git) with a simple bit of unlang in post-auth{}: if ( "%{TLS-Client-Cert-Subject}" =~ /OU=Evil/ ) { reject } It works, but there are two non-ideal things about the way it works: 1) Windows XP doesn't seem to notice the rejection and keeps retrying for a minute or two, ultimately failing to show any failure/error message to the user. 2) The rejection is not logged in radiusd.log; rather, three "Auth: Login OK" lines are logged (the repetition is due to XP's retries) Is there any way I can address these two issues? I did try putting the above unlang into eap.conf's tls{} section (where check_cert_issuer and check_cert_cn would be), in hopes that the rejection would occur during the auth rather than after it, but the code doesn't seem to have any effect there. Thanks in advance for any clues... -Matt

4 10

freeradius data encryption modes
by mcabh＠gmx.de 28 Jan '11

28 Jan '11

Hi @all, I have installed a freeradius server succesfully. I can login with all my clients using WPA2 (AES-CCMP) PEAP with mschapv2. Last week I got a new notebook that don´t support the data ecryption AES-CCMP. The data encryption that I can specify (in WPA2 with PEAP/mschapv2) only is AES, AES MFP, TKIP and TKIP MFP. Here´s my question, can I configure my freeradius server to support logins with AES/AES MFP/TKIP/TKIP MFP? Thanks for help... Greetings Gustav -- Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir belohnen Sie mit bis zu 50,- Euro! https://freundschaftswerbung.gmx.de

3 2

SQL Logging
by Kristoffer Milligan 28 Jan '11

28 Jan '11

Hello again, I'm still fighting my little battle in copying attributes from the inner to the outer tunnel etc. I have now gotten as far that logging access-accepts is working as I want, but I'm now struggling logging access-rejects. Here's my SQL from dialup.conf: postauth_query = "INSERT INTO ${postauth_table} \ (username, pass, reply, authdate) VALUES \ ('%{reply:SQL-User-Name}', '%{reply:Packet-Type}', \ '%{reply:Calling-Station-Id}', '%S');" From a rejected session, I get this: Fri Jan 28 09:48:05 2011 : Info: (5) [ttls] Got tunneled reply code 3 Filter-Id = "OBFUSCATED" SQL-User-Name = "OBFUSCATED" Calling-Station-Id = "OBFUSCATED" MS-CHAP-Error = "\226E=691 R=1" .... Fri Jan 28 09:48:05 2011 : Info: (5) +- entering group REJECT {...} Fri Jan 28 09:48:05 2011 : Info: (5) [sql] expand: %{Stripped-User-Name} -> {am=1}OBFUSCATED Fri Jan 28 09:48:05 2011 : Info: (5) [sql] expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> {am=1}OBFUSCATED Fri Jan 28 09:48:05 2011 : Info: (5) [sql] sql_set_user escaped user --> '{am=1}OBFUSCATED' Fri Jan 28 09:48:05 2011 : Info: (5) [sql] expand: INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('%{reply:SQL-User-Name}', '%{reply:Packet-Type}', '%{reply:Calling-Station-Id}', '%S'); -> INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('', 'Access-Reject', '', '2011-01-28 09:48:05'); Fri Jan 28 09:48:05 2011 : Debug: rlm_sql (sql) in sql_postauth: query is INSERT INTO radpostauth (username, pass, reply, authdate) VALUES ('', 'Access-Reject', '', '2011-01-28 09:48:05'); From an accepted session, everything works fine and the SQL-User-Name and Calling-Station-Id are logged as expected. How come the attributes are empty, even though they are in the reply, only when an access-reject is given? - Kristoffer

2 3

Re: Freeradius-Users Digest, Vol 69, Issue 93
by vijay s sheelavantar 28 Jan '11

28 Jan '11

Hello Alan,there was some problem with my firewall. I disabled it. and now it is working fine. Thank you. :) On Thu, 27 Jan 2011 16:41:20 , freeradius-users-request(a)lists.freeradius.org wrote Send Freeradius-Users mailing list submissions to    freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit    http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to    freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at    freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics:   1. Re: Python module/program (Terry Simons)   2. Radius authentication problem. (vijay s sheelavantar)   3. reset sql counter every 30 minute (piston)   4. Re: reset sql counter every 30 minute (Bishal Pun)   5. Re: Radius authentication problem. (Alan Buxey) ---------------------------------------------------------------------- Message: 1 Date: Wed, 26 Jan 2011 15:06:58 -0800 From: Terry Simons <terry.simons(a)gmail.com> Subject: Re: Python module/program To: FreeRadius users mailing list    <freeradius-users(a)lists.freeradius.org> Message-ID:    <AANLkTi=pjYQ7Uk2QxrHGy4X5z-NRZOrb0NB=uf=cVr9-(a)mail.gmail.com> Content-Type: text/plain; charset="iso-8859-1" Is the python module catching all exceptions? You need to make sure you don't mask out the KeyboardInterrupt exception... otherwise, you may prevent Control-C from being passed up the stack. I'm not sure if that's your issue, but it sounds like it could be.  It's considered a Python best practice to explicitly catch the exact exceptions that you know how to handle, and let exceptions that you're not going to handle directly trickle up. That is to say that you should never do something like: try:    <some code> except:   <some code> because you *will* end up masking things like KeyboardInterrupt. You should always do something like: try:    <some code> except TheExceptionClass:    <some code> HTH, - Terry On Wed, Jan 26, 2011 at 2:47 PM, McCann, Brian <bmccann(a)andmore.com> wrote: > Hi all.  I've got freeradius working using a python library for auth, but > something interesting happened when I did.  When I run "radius -X", and > press  CRTL+C, it no longer exits.  It just returns "Ready to process > requests.".  The PID doesn't change, so it's not like its exiting and > restarting. > > I looked at http://wiki.freeradius.org/Rlm_perl (yes...I know...perl != > python, but as the python page doesn't say much, I'm going on the perl page > for a starting point) and it doesn't look like the script has to do anything > to handle exits.  Does anyone know what I'm missing? > > Thanks, > --Brian > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

4 5

reset sql counter every 30 minute
by piston 27 Jan '11

27 Jan '11

Hi Is that possible to reset the sql counter every 30 minute? Basically, i need to get user free access of 20 minutes, after 20 minutes NAS will logout the user. And the user is allow to login again after 30 minute. Thanks

3 2

radius.log records individual client IP. Possible??
by Difan Zhao 27 Jan '11

27 Jan '11

Hi experts, I'm wondering if it's possible for the radius.log file to show the NAS IP instead of the "client" name (which is IP range in my case). Currently the log looks like: Thu Jan 27 11:53:15 2011 : Auth: Login incorrect: [08000f513f60/08000f513f60] (from client 10.143.115.0/24 port 50303 cli 08-00-0F-51-3F-60) It'd be ideal if it can show the IP of the NAS where the request is coming from. I know I could configure the client file to have individual IP for each client instead of entire subnet. However just wondering if there is easy "switch" to turn it on lol Thanks! Difan Zhao, M.Eng Network Engineer Guest-Tek Interactive Entertainment Inc. Email: difan.zhao(a)guest-tek.com<mailto:difan.zhao@guest-tek.com> Office: +1 (403) 509 1010 ext 3048 Cell: +1 (403) 689 7514 www.guest-tek.com<http://www.guest-tek.com> [http://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/Logo.jpg] INTERNET | MEDIA | VOICE [http://www.guest-tek.com/images/Guest-Tek%20-%20Formal_files/image004.jpg] The contents of this email are confidential and intended for the recipient only. If you have received this email in error, please notify us, and destroy all copies.

2 1

Python module/program
by McCann, Brian 27 Jan '11

27 Jan '11

Hi all. I've got freeradius working using a python library for auth, but something interesting happened when I did. When I run "radius -X", and press CRTL+C, it no longer exits. It just returns "Ready to process requests.". The PID doesn't change, so it's not like its exiting and restarting. I looked at http://wiki.freeradius.org/Rlm_perl (yes...I know...perl != python, but as the python page doesn't say much, I'm going on the perl page for a starting point) and it doesn't look like the script has to do anything to handle exits. Does anyone know what I'm missing? Thanks, --Brian

3 3

Radius authentication problem.
by vijay s sheelavantar 27 Jan '11

27 Jan '11

Hello Friends,I have intalled RADIUS server on one machine which has fedora 10. I have installed freeradius-server-2.1.10 on it(server machine IP 10.150.110.42). I have one more machine with redhat linux on which i have installed pam_radius-1.3.17(client machine IP 10.150.113.4). I have done the follwoing configuration at both sides SERVER SIDE. users file "vijay"    Auth-Type := Local, Cleartext-Password == "123qwe", NAS-IP-Address == "10.150.113.4"           Reply-Message = "Hello, %u" clients.confclient 127.0.0.1 {secret          = testing123shortname       = localhostnastype     = other}client 10.150.113.4/24 {        secret          = testing123        shortname       = private-network-1} client 10.150.110.42/24 {        secret          = testing123        shortname       = private-network-1} I have not changed anything in radiusd.conf. CLIENT SIDE/etc/pam.d/sshdauth       sufficient   pam_radius_auth.so /etc/raddb/server# server[:port] shared_secret      timeout (s)127.0.0.1       testing123              110.150.110.42   testing123              3other-server    other-secret            3 /etc/ssh/sshd_configUsePAM yes Above mentioned is my configuration. when i try to connect client with SSH it is not sending a request for authenticating user to RADIUS server. kindly let me know what else configuration i have to do, or if there are any mistakes in my configuration plz help to correcr it. Thank you. Regards, VIJAY S.

2 1

Question on Virtual Servers and inner-tunnel
by Brett Littrell 26 Jan '11

26 Jan '11

Hi All, Hope this is not to stupid of a question but I have been checking out the inner-tunnel virtual server under sites-enabled. I read up a little on virtual servers and it looks like the inner-tunnel virtual server is just a regular old virtual server yet in the comments is says it specifically handles inner tunnel requests. I went through the default config for the inner-tunnel and did not see any commands that were un-commented that seemed to specify that the server exclusively dealt with inner-tunnel requests. So my question is wether naming the server inner-tunnel causes it to exclusively handle inner-tunnel requests, in other word is inner-tunnel a hard coded name that has to be used for handling inner-tunnel requests? Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE

4 5

Trying to strip the Windows Domain name from a login
by Brett Littrell 26 Jan '11

26 Jan '11

Hi All, I am trying to strip the domain name from a userid in the most efficient way possible, I am using version 2.1.1. I have tried using the hints file with regular expressions. ex. DEFAULT User-Name =~ "([A-Za-z1-9]+)" User-Name := "%{2}" In regexbuddy it is showing that it shows two matches, I specify the second match and in the debug output it fails and does not show any username. I then found another reference to strip the domain from the LDAP module as shown below: filter = "(cn=%{mschap:User-Name:-%{User-Name}} # filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" I am using MSChapV2 and it seems to pass the correct username to the LDAP server it looks like there is some other place I need to strip the domain besides the ldap lookup, that or the replies are using the stripped name and it is failing that way as well. Either way it still is not working. If I un-comment the stripped-user-name and use a supplicant that strips the domain prior to sending it, it does work so Radius is working, just now with standard windows supplicant on XP. Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 172.17.17.66port 1645, id=198, length=157 User-Name = "LPDOT1XTEST\\dotxuser" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1C-B1-5A-8E-05" Calling-Station-Id = "64-31-50-6E-DA-7A" EAP-Message = 0x0202001a014c50444f543158544553545c626c69747472656c6c Message-Authenticator = 0x7041a9eaea23f1896725936e06e3f1dc NAS-Port-Type = Ethernet NAS-Port = 50005 NAS-IP-Address = 10.20.90.37 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "LPDOT1XTEST\dotxuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 26 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop [ldap] performing user authorization for LPDOT1XTEST\dotxuser [ldap] expand: (cn=%{mschap:User-Name:-%{User-Name}} -> (cn=dotxuser [ldap] expand: ou=users,o=musd -> ou=users,o=musd rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 172.17.17.1:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/rootder2.b64 rlm_ldap: bind as cn=ldproxy,ou=somecx,o=cx/password! to 172.17.17.1:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,o=musd, with filter (cn=dotxuser rlm_ldap: ldap_search() failed: Bad search filter: (cn=dotxuser [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns fail Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> LPDOT1XTEST\dotxuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 172.17.17.66port 1645 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +20 Ready to process requests. An yes I am pretty new to freeradius. Brett Littrell Network Manager MUSD CISSP, CCSP, CCVP, MCNE

2 3