- Freeradius-Users - lists.freeradius.org

want to set up something a little more complex, not sure how to start. (hosts authenticated against openldap server)
by Christ Schlacta 19 Nov '10

19 Nov '10

I've currently got a single host configured to have a certificate, the certificate is issued on a per-host basis. I want to somehow link a specific machine to a specific ssl certificate. it's my understanding that openldap or mysql can do this. I'd prefer not to use mysql as the mysql authentication server is already running on a separate server from my radius server, and I want the radius server to be self-sufficient. the load is low enough to sustain this, but I'd also prefer not to maintain 2 mysql servers separately. ergo, mysql is a last resort solution. that leaves openldap. I should say now I'm authenticating wireless clients over wpa2 + eap-tls. I'm still looking for a fairly simple "install a keypair+cacert on a client and it just works from then on", but I'd like to register in openldap that a given host (identified by some combination of name, mac address) is permanently tied to a given certificate. If the host and certificate don't match, I'd want to get some sort of notification in the logs or an e-mail alert or similar. what I don't want is for users to have to maintain any sort of "password" or "username" to connect to the wireless network. we're not using passwords now, we don't want to add complexity to the user side. I'm not really sure how to accomplish authorizing a certificate that's already passed tls authentication, but if it's possible, I know you folks will be able to point me to a guide or provide some input as to how to accomplish this.

2 1

configure output summary
by Stefan Winter 19 Nov '10

19 Nov '10

Hi, when running configure, lots of somewhat important messages scroll by, like "silently disabling something you need" :-) An untrained eye may miss these easily, leading to confusion afterwards (I'm currently running a lecture on RADIUS, and pretty much all of my students took their time figuring out that they need openssl-devel for PEAP to work etc.). I think it would generally make sense to put a summary output of configure at the end of its run, so that one can easily see which modules will be disabled. In an acute case of bash script fiddling, I created the attached proof of concept "test.sh" script, which recursively goes through all config.log files and a) greps all lines with WARNING b) greps all lines with "silently not building" and puts these out in massaged human-readable form. Would something like this have any chances of getting included into the tarball? It could run as the very last thing in configure... Greetings, Stefan Winter -- Stefan WINTER Ingenieur de Recherche Fondation RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg Tel: +352 424409 1 Fax: +352 422473

6 11

Re: Re: LDAP auth success / User reject
by Michael Arndt 19 Nov '10

19 Nov '10

Hello *, Problem solved thx to Alans help -Find out what part of the configuration is setting "Auth-Type := Reject" -Look in the "files" configuration, and in the data in LDAP. The reject was the last default statement in the users file My problem was, that the patterns for both entries before failed. I resolved the reason, It was a Bug in the LDAP Tree of customer for this site, not noticed by me before. Michael

1 0

Dynamic VLAN assignment on NAS
by Attou eric 19 Nov '10

19 Nov '10

Hi the list I'm sure this is NAS question, not Freeradius' question. But perhaps somebody on the list had experienced this issue. Here is my problem. I setup : - A Freeradius configuration EAP/PEAP with user credentials stored in LDAP directory. - A NAS zcomax ag3621 wireless access point with VLAN 802.1q support. on this access point, i have one SSID associated by default with guest VLAN 30. meaning if a user failed authentication, he will still connected but on this VLAN with reduced privileges. However radius return the following Access-accept packet to my NAS, Sending Access-Accept of id 81 to 192.168.32.88 port 1032 Tunnel-Private-Group-Id:0 = "60" Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN User-Name = "user1" The access point just put user1 on VLAN 30. My NAS ignore the VLAN ID 60 (Tunnel-Private-Group-Id:0 = "60") contained in the Access-Accept. I try with two different models of Access point (zcomax and cisco) My question: Is there a particular config to do to ask the NAS to consider the VLAN ID contained in the Access-Accept packet ? Thanks for your answers

2 1

Accounting data and NULL sessions
by Natr Brazell 19 Nov '10

19 Nov '10

I have two questions if I may. One I think I've asked before but just getting around to trying to tackle it again. 1. I am using mysql for radacct data to keep track of sessions. The accounting data is going into flat files on each radius server. Is there a way to get the accounting data to go directly to into a mysql table? I don't want the accounting data in radacct. 2. I have multiple NULL sessions in my radacct file??? What causes these and how do folks deal with them? Thanks, N

2 1

Crypt Passwords in SQL
by William 18 Nov '10

18 Nov '10

Greetings, First, Thanks Alan DeKok. That was exactly what I needed for NAS_Showt_Name. Second, I just discovered a new issue. Not sure if this is a radius or a MySQL issue. When I crypt a password (MySQL CRYPT command) the password matches anything and everything that matches the first 8 characters of the password. Is this a limitation of Radius crypt or is it a Mysql crypt ? I need 16+ character password that match. Wm

2 4

Re: Re: LDAP auth success / User reject
by Michael Arndt 18 Nov '10

18 Nov '10

Alan, >Use "-X". You've added an additional "-x", which makes the output harder to read. ok, understood, attached below > Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Found Auth-Type Reject > Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Auth-Type = Reject, rejecting user Well... something is setting that. Go find out what, and fix it. any hints, how to proceed to debug from where the "Reject" for rad_check_passwd is caused ? I checked ldap atributes and verified correctness of user passwd for simple bind with ldapsearch So i at last have exluded trivial errors like testing with a dn or wrong user password But now i d not see how to trace why the radius request comes back with reject lm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in l=Stadt,dc=de,o=Organisation, with filter (uid=test1) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user test11 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 4 modcall[authorize]: module "files" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. Login incorrect: [test1/testpass] (from client wlanhsp port 0 cli 00:1e:c2:a3:4d:b3) TIA Micha

2 1

LDAP auth success / User reject
by Michael Arndt 18 Nov '10

18 Nov '10

hello * Szenario: freeradius auth via LDAP simple bind with user passwd / user name for a hot spot Used config works with two other setups of same environment Problem: simple bind returns ok then another module rejects the user Any hints where i should look ? Used Freeradius Version: FreeRADIUS Version 1.1.6 below debug output hu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from suffix (rlm_realm) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "suffix" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling ldap (rlm_ldap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: - authorize Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: performing user authorization for test1 Thu Nov 18 11:20:52 2010 : Debug: radius_xlat: '(uid=test1)' Thu Nov 18 11:20:52 2010 : Debug: radius_xlat: 'l=Stadt,dc=de,o=Organisationr' Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_get_conn: Checking Id: 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_get_conn: Got Id: 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: attempting LDAP reconnection Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: bind as cn=LDAPADMIN,o=Customer/sharedsecret to 127.0.0.1:389 Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: waiting for bind result ... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: Bind was successful Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: performing search in l=Stadt,dc=de,o=Organisation, with filter (uid=test1) Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: looking for check items in directory... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: looking for reply items in directory... Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: Setting Auth-Type = ldap Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: user test1 authorized to use remote access Thu Nov 18 11:20:52 2010 : Debug: rlm_ldap: ldap_release_conn: Release Id: 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from ldap (rlm_ldap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "ldap" returns ok for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling eap (rlm_eap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_eap: No EAP-Message, not doing EAP Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from eap (rlm_eap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "eap" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling files (rlm_files) for request 0 Thu Nov 18 11:20:52 2010 : Debug: users: Matched entry DEFAULT at line 3 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from files (rlm_files) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "files" returns ok for request 0 Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: calling pap (rlm_pap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rlm_pap: Found existing Auth-Type, not changing it. Thu Nov 18 11:20:52 2010 : Debug: modsingle[authorize]: returned from pap (rlm_pap) for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall[authorize]: module "pap" returns noop for request 0 Thu Nov 18 11:20:52 2010 : Debug: modcall: leaving group authorize (returns ok) for request 0 Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Found Auth-Type Reject Thu Nov 18 11:20:52 2010 : Debug: rad_check_password: Auth-Type = Reject, rejecting user Thu Nov 18 11:20:52 2010 : Debug: auth: Failed to validate the user. Thu Nov 18 11:20:52 2010 : Auth: Login incorrect: [test1/testpasswd] (from client wlanhsp port 0 cli 00:1e:c2:a3:4d:b line from users DEFAULT Called-Station-Id =~ ".*:LIBRARY" , Ldap-group == "cn=city,cn=Groups,l=Stadt,dc=de,o=Organisation" thx for any hints :-) I have anonymized the ldap Attributes Michael

2 1

Help: 802.1x with freeRadius and mySql database
by Xuan Sun 18 Nov '10

18 Nov '10

Hi Everyone I have set up a freeRadius in Ubuntu server 10.0.4. I also set up a Cisco switch as a NAS and enable 802.1x in the switch port. I used the configuration first (clients.conf, users). The 802.1x authentication just works fine. Then I start to use mySql database, instead of clients.conf and users. I followed the instructions from this link http://wiki.freeradius.org/SQL_HOWTO. I use the "radtest" command to test the username/password. It works fine. Then I use the Cisco switch to test the username/password and NAS, it also works fine. But the 802.1x authentication does not work. Here is the output from "freeradius -X" Ready to process requests. rad_recv: Access-Request packet from host 10.5.84.14 port 1645, id=213, length=265 User-Name = "anonymous" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-1A-6C-79-7F-89" Calling-Station-Id = "00-18-8B-B2-74-CE" EAP-Message = 0x0207006b190017030100603436ac7bdf2130158ce653dea69c9c5c155d4a677f8bf6a3330838e2ca749c29c00d7fef558443728826479cb9dbd75b4e3fc4e62b27ecc64a942b06784ae85df1499325a9c927f9e0de86a9989d7349874019e3a286ebb4ab95347d704aaf79 Message-Authenticator = 0x8a020beb0674cb778f3feb2400792a88 NAS-Port-Type = Ethernet NAS-Port = 50107 NAS-Port-Id = "FastEthernet1/0/7" State = 0xc7b0e155c2nt (0018.8bb2.74ce) on Interface Fa1/0/7 AuditSessionID 0A05540E0000005E17970995b7f81cdb855c0280b00b4a NAS-IP-Address = 10.5.84.14 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "anonymous", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 107 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020700401a0207003b31c49dddfb7a41c1b1af6d0248706af94e0000000000000000d2f582ba4490575f7f0c78eb1e81b3dc81c41b0cb19cfc81003833303038 server { PEAP: Setting User-Name to 83008 Sending tunneled r 020358: Nov 17 11:41:28.199 PST: %AUTHMGR-5-FAIL: Authorization failed for client (0018.8bb2.74ce) on Interface Fa1/0/7 AuditSessionID 0equest EAP-Message = 0x020700401a0207003b31c49dddfb7a41c1b1af6d0248706af94e0000000000000000d2f582ba4490575f7f0c78eb1e81b3dc81c41b0cb19cfc81003833303038 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "83008" State = 0xe741fb76e746e148ba5c58c22edbac30 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "83008", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop [eap] EAP packet type response id 7 length 64 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- enA05540E0000005E17970995tering group MS-CHAP {...} [mschap] No Cleartext-Password configured. Cannot create LM-Password. [mschap] No Cleartext-Password configured. Cannot create NT-Password. [mschap] Told to do MS-CHAPv2 for 83008 with NT-Password [mschap] FAILED: No NT/LM-Password. Cannot perform authentication. [mschap] FAILED: MS-CHAP2-Response is incorrect ++[mschap] returns reject [eap] Freeing handler ++[eap] returns reject Failed to authenticate the user. 83008 is my user id. Why it tries to use MSCHAP module and use NT-Password ? Here is the fradius database information in mySql. mysql> show tables; +-------------------+ | Tables_in_fradius | +-------------------+ | nas | | radacct | | radcheck | | radgroupcheck | | radgroupreply | | radpostauth | | radreply | | radusergroup | +-------------------+ 8 rows in set (0.00 sec) mysql> select * from nas; +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ | id | nasname | shortname | type | ports | secret | community | description | +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ | 2 | 10.5.84.14 | lab-3750b | cisco | NULL | spl00t | NULL | RADIUS Client | +----+------------+------------------+-----------------+-------+--------+-----------+---------------+ 1 row in set (0.00 sec) mysql> select * from radcheck; +----+----------+--------------------+----+------------+ | id | username | attribute | op | value | +----+----------+--------------------+----+------------+ | 1 | sqltest | Password | == | testpwd | | 2 | 83008 | Cleartext-Password | := | testing123 | +----+----------+--------------------+----+------------+ 2 rows in set (0.00 sec) mysql> select * from radreply; +----+----------+--------------+----+-------------------+ | id | username | attribute | op | value | +----+----------+--------------+----+-------------------+ | 2 | 83008 | cisco-avpair | = | shell:priv-lvl=15 | +----+----------+--------------+----+-------------------+ 1 row in set (0.00 sec) The other tables is empty. Thank to take a lootk

2 1

freeradius on ubuntu
by Jia Fang (Matthew) 17 Nov '10

17 Nov '10

Hello I am lost in Freeradius on Ubuntu.... I want to use peap authentication in ubuntu platform, but it seems that the rlm_eap_tls.so has license problem and not built in the ubuntu freeradius, then I try to build the source code and find that in hardy 8.04, it need the debhelper version >=6.04. Then i donwload the debhelpler 8.00 and try to make it a deb package by using: matt@radius:~/debhelper$ dpkg-buildpackage -rfakeroot dpkg-buildpackage: set CPPFLAGS to default value: dpkg-buildpackage: set CFLAGS to default value: -g -O2 dpkg-buildpackage: set CXXFLAGS to default value: -g -O2 dpkg-buildpackage: set FFLAGS to default value: -g -O2 dpkg-buildpackage: set LDFLAGS to default value: -Wl,-Bsymbolic-functions dpkg-buildpackage: source package debhelper dpkg-buildpackage: source version 8.0.0 dpkg-buildpackage: source changed by Joey Hess <joeyh(a)debian.org> dpkg-buildpackage: host architecture i386 fakeroot debian/rules clean ./run dh clean Undefined subroutine &Getopt::Long::GetOptionsFromArray called at /home/matt/debhelper/Debian/Debhelper/Dh_Getopt.pm line 156. make: *** [clean] Error 255 dpkg-buildpackage: failure: fakeroot debian/rules clean gave error exit status 2 How can I have rlm_eap_tls.so on Ubuntu platform? thanks!!!!! ------------------ Best Regards Matthew (方嘉)

2 1