- Freeradius-Users - lists.freeradius.org

Assign VLANS based on AD groups.
by Johnson, Neil M 28 Oct '10

28 Oct '10

Now that I have authentication working. I would like to assign users to VLANS based on AD group membership. Google searches haven't produced any examples, but I'm assuming that I need to do something with LDAP ? Any examples would be appreciated. Thanks. -Neil -- Neil Johnson Network Engineer Information Technology Services The University of Iowa 319 384-0938 neil-johnson(a)uiowa.edu

2 1

Wireless WPA2 enterprise Radius authentication
by midnightsteel 28 Oct '10

28 Oct '10

Has anyone gotten Freeradius 2.x and LDAP (OpenLDAP, FDS, etc...) to properly authenticate users? I get the following in my radius log Auth: Login incorrect: [wii/<via Auth-Type = EAP>] (from client access port 0 via TLS tunnel) Auth: Login incorrect: [wii/<via Auth-Type = EAP>] (from client access port 14 cli 78e400881f19) This is driving me crazy. I can authenticate users from the radius serve to ldap but not from the access point to radius to ldap If anyone has gotten it to work please post the example config files that you used. Im open to answer any questions that you may have about my configs. Access point using WPA2-Enterprise >> Freeradius 2.x >> 389-DS(Fedora LDAP) -- View this message in context: http://freeradius.1045715.n5.nabble.com/Wireless-WPA2-enterprise-Radius-aut… Sent from the FreeRadius - User mailing list archive at Nabble.com.

5 21

WPA2 Enterprise, Freeradius/Mysql Test Data
by Dirk Leas 28 Oct '10

28 Oct '10

Is there a reference for test data given default Ubuntu freeradius/freeradius-mysql packages modified to mysql back end (successfully verified with trivial radtest test case)? Any other config changes required to demonstrate WPA2 Entrprise authentication? TIA, D

2 1

vlan assignment in radius reply when using eap/peap
by Josh Hiner 28 Oct '10

28 Oct '10

Hello, I have working setups of mac authentication where I use mysql and use radgroupreply to hand out the appropriate vlans to my hp procurve switches based on what mac address is authenticating. I also have working setups for eap/peap where I use the mschapv2 module to auth off a samba server via ntlm_auth. What I'd like to do is hand out vlans in my eap/peap setup similar to how Im doing via mysql and mac-auth. How are others out there handing out vlans in your eap-peap setups? Thanks for any help and ideas! I use freeradius versions from 2.1.6 to 2.1.9. -Josh

1 0

Controlling Proxying behavior from rlm_perl
by Murray Long 28 Oct '10

28 Oct '10

Hi All, Would it be possible to control which realm freeradius proxies to, from within the rlm_perl module? -Murray

2 1

ippool and disconnection
by Michele Petrazzo - Unipex 28 Oct '10

28 Oct '10

Hi list, I have an installation with freeradius 2.1.9, postgresql like db and pppoe server more than one mikrotik routerboards. Like now I'm making some test and, a part that all seem to work well (users can connected to the chain pppoe-server mikrotik -> freeradius -> db), I see a strange thing inside the radacct table: I have a session that aren't "closed" (acctstoptime field are NULL) and I have another session, with the _same_ framedipaddress, opened after the previous one. The nas value are different. Looking into both nas, the first that as into the db the session opened, haven't the pppoe session active and radwho say me that there is no session for that framedipaddress. I thought that "someone", before open a session with a specific framedipaddress see if it's already assigned, but it's not the truth. I think that I'm in wrong in somewhere, but I don't know. The question: who forgot to close the session? Or better, do I have to say to freeradius to close it after a "timeout" or something other? Thanks, Michele

2 1

Info: Exiting normally.
by Aldo Zavala 28 Oct '10

28 Oct '10

Hi, I compiled the FreeRADIUS according to http://git.freeradius.org procedure. It has been working for production like a charm for about 19 days, and today suddenly stop working, there are no debug messages that I could see, process were still alive but as I said it stop processing/accepting requests. I don't see any possible cause, do you think it could be a memory leak or something?. here the log message says: sudo tail -5000 /usr/local/freeradius/var/log/radius/radius.log | grep 'Wed Oct 27 17:15' Wed Oct 27 17:15:34 2010 : Info: Exiting normally. Wed Oct 27 17:15:34 2010 : Info: rlm_sql (sql): Closing sqlsocket 4 Wed Oct 27 17:15:34 2010 : Info: rlm_sql (sql): Closing sqlsocket 3 Wed Oct 27 17:15:34 2010 : Info: rlm_sql (sql): Closing sqlsocket 2 Wed Oct 27 17:15:34 2010 : Info: rlm_sql (sql): Closing sqlsocket 1 Wed Oct 27 17:15:34 2010 : Info: rlm_sql (sql): Closing sqlsocket 0 Here some information about the box environment that could be useful: radiusd -v radiusd: FreeRADIUS Version 2.1.10, for host i386-unknown-freebsd8.1, built on Oct 5 2010 at 15:51:51 ulimit -a cpu time (seconds, -t) unlimited file size (512-blocks, -f) unlimited data seg size (kbytes, -d) 524288 stack size (kbytes, -s) 65536 core file size (512-blocks, -c) unlimited max memory size (kbytes, -m) unlimited locked memory (kbytes, -l) unlimited max user processes (-u) 5547 open files (-n) 11095 virtual mem size (kbytes, -v) unlimited swap limit (kbytes, -w) unlimited sbsize (bytes, -b) unlimited pseudo-terminals (-p) unlimited Thanks so much for your time reading this post. Aldo Zavala

1 0

Re: a lot of memory inuse
by James J J Hooper 27 Oct '10

27 Oct '10

--On 14 September 2010 17:01 +1000 "Strong, Mark" <mstrong(a)tnsi.com> wrote: > Hi Guys, > I have free radius 2.1.6, and it has quite a chunk of memory inuse at > the moment, are there any known issues with this version and memory leaks? > > It's running on CentOS 4.7 32 bit, compiled with this version of MySQL > 5.0.20a-0.rhel4 (which isn't standard on CentOS 4.7). > > I started with this source rpm freeradius-2.1.6-2.fc10.src.rpm > > And has handled 430,000 requests since it started approx one month ago. Hi Mark, * You haven't told us how much "a lot" of memory is. * Upgrade to 2.1.10 (release imminent) * All I can offer is a comparison based on probably totally different configurations: FreeRADIUS-Total-Access-Requests = 194758 FreeRADIUS-Total-Accounting-Requests = 48158 FreeRADIUS-Stats-Start-Time = "Sep 12 2010 11:16:30 UTC" Total memory usage = 23MB Regards, James -- James J J Hooper Network Specialist Information Services University of Bristol http://www.wireless.bristol.ac.uk --

3 4

EAP-TTLS with PAP inner tunnel for Cisco 1100 series AP
by James Smallacombe 27 Oct '10

27 Oct '10

I actually had this working last night on a different server running an older (2.1.6) version of FreeRADIUS with a pretty basic (unix/pap auth) setup. However, I need to get this working with a newer, more complex setup that's using Pam, Ldap, ippools, groups, etc. I just installed 2.1.10 with OpenSSL support (had to run ldconfig afterwards, though). It's able to authenticate Pam and LDAP for apache and PPTP users fine. However, I need to be able to auth users from a Cisco 1142N Controller based LW AP. The test user (Macbook) is configured to do 802.1X TTLS auth only with PAP as the inner tunnel. Worked ok with the old server, as mentioned. However, on the new one, this is the debugging info I get (I'll try to keep it to what's relevant): This is with Auth-type set to "Pam", although I've tried "Ldap" and even "Pap" and "Eap" with no luck: Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 2048 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/usr/etc/raddb/certs/server.pem" certificate_file = "/usr/etc/raddb/certs/server.pem" CA_file = "/usr/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/usr/etc/raddb/certs/dh" random_file = "/usr/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/usr/etc/raddb/certs/bootstrap" } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } ---- server { # from file /usr/etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pam Module: Instantiating module "pam" from file /usr/etc/raddb/radiusd.conf pam { pam_auth = "radiusd-auth" } Module: Checking authorize {...} for more modules to load <snip bunch of ippools modules stuff> Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 32769, id=15, length=154 User-Name = "testuser" Calling-Station-Id = "00-1e-HWADDR" Called-Station-Id = "68-bd-abTEST" NAS-Port = 8 NAS-IP-Address = 192.168.200.9 NAS-Identifier = "Cisco" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0202000a016a616d6573 Message-Authenticator = 0x4903d9a30f5a20b3e3b881815af6ee13 # Executing section authorize from file /usr/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 10 [eap] No EAP Start, assuming it's an on-going EAP conversation (Now here I see what looks like a successfuly ldap conversation, even though I do not have auth-type set to ldap) ++[eap] returns updated ++[unix] returns updated [files] users: Matched entry DEFAULT at line 208 ++[files] returns ok [ldap] performing user authorization for testuser [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] ... expanding second conditional [ldap] expand: %{User-Name} -> testuser [ldap] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=testuser) [ldap] expand: dc=foo,dc=com -> dc=foo,dc=com [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=foo,dc=com, with filter (uid=testuser) [ldap] looking for check items in directory... [ldap] looking for reply items in directory... [ldap] user testuser authorized to use remote access [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/ttls [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 16 to 10.1.1.1 port 32769 Framed-Protocol == PPP Framed-Compression = Van-Jacobson-TCP-IP EAP-Message = 0x010400061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0cc158170dc54d3eb30f385d7ffdd9a0 Finished request 1. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 10.1.1.1 port 32769, id=17, length=274 User-Name = "testuser" Calling-Station-Id = "00-1e-cSNIP" Called-Station-Id = "68-bd-abTEST" NAS-Port = 8 NAS-IP-Address = 192.168.200.9 NAS-Identifier = "Cisco" Airespace-Wlan-Id = 1 Service-Type = Framed-User Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0204007015800000006616030100610100005d03014cc70f09b240f6530b566e57515e4ffc48f1e899ff14d65310b81fe0060711b8000036002f000500040035000a000900030008000600320033003800390016001500140013001200110034003a0018001b001a0017001900010100 State = 0x0cc158170dc54d3eb30f385d7ffdd9a0 Message-Authenticator = 0x0aec0b8b08f23742d3abc4eaa3d5325f # Executing section authorize from file /usr/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 112 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP # Executing group from file /usr/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/ttls [eap] processing type ttls [ttls] Authenticate [ttls] processing EAP-TLS TLS Length 102 [ttls] Length Included [ttls] eaptls_verify returned 11 [ttls] (other): before/accept initialization [ttls] TLS_accept: before/accept initialization [ttls] <<< TLS 1.0 Handshake [length 0061], ClientHello [ttls] TLS_accept: SSLv3 read client hello A [ttls] >>> TLS 1.0 Handshake [length 002a], ServerHello [ttls] TLS_accept: SSLv3 write server hello A [ttls] >>> TLS 1.0 Handshake [length 084e], Certificate [ttls] TLS_accept: SSLv3 write certificate A [ttls] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [ttls] TLS_accept: SSLv3 write server done A [ttls] TLS_accept: SSLv3 flush data [ttls] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [ttls] eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 17 to 10.1.1.1 port 32769 EAP-Message = 0x0105040015c00000088b160301002a0200002603014cc70f08c2957fc17d52950000314bb2 b78631fa66ac72b4a6c59148dbe89e00002f00160301084e0b00084a0008470003 <snip> EAP-Message = 0x973082037fa0030201020201 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0cc158170ec44d3eb30f385d7ffdd9a0 Finished request 2. Going to the next request Waking up in 4.3 seconds <you get the picture> It goes through the cycle above a few times and then: Failed to authenticate the user. Login incorrect: [testuser] (from client foo port 0 via TLS tunnel) } # server inner-tunnel [ttls] Got tunneled reply code 3 Framed-Protocol == PPP Framed-Compression = Van-Jacobson-TCP-IP [ttls] Got tunneled Access-Reject [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Login incorrect: [testuser] (from client foo port 8 cli 00-1e-cSNIP) Using Post-Auth-Type Reject # Executing group from file /usr/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 6 for 5 seconds Going to the next request ----- Clues gratefully accepted! James Smallacombe PlantageNet, Inc. CEO and Janitor up(a)3.am http://3.am =========================================================================

2 2

SQL and Proxy acct in a virtual server
by Frank Bollet 27 Oct '10

27 Oct '10

Hi all, I'm using Freeradius 1.x for a few years now and I'd like to switch to Freeradius 2.1.10. I have 11 realms: - 7 are managed by this server, using an SQL database - 4 are proxied to different partners, but accountings are saved in the SQL database. Virtual servers seems to be great for this purpose, but I have a few issues with the configuration. I defined realms, home server pools and home server. For locally managed realms, I defined a virtual server for each realm (in sites-available/) and the home server refers to that virtual server. Here is an example for the realm "@foo": ### server vs_foo { authorize { [...] sql_foo [...] } [...] }home_server hs_vs_foo { virtual_server = vs_foo } home_server_pool hsp_vs_foo { home_server = hs_vs_foo } realm foo { pool = hsp_vs_foo } ### It's working like I want to for the locally managed realms, but how could I define different virtual servers for the proxied realms ? I could just define the server to proxy the request to in proxy.conf and do accounting in the default virtual server, just like I was doing with Freeradius 1, but I'd like to define virtual servers in order to separate each realms in virtual servers. If I define home servers and a virtual server in a home server pool, the virtual server is only used for pre/post proxy. "accounting {}" is used from sites-enabled/default. How could I define a specific accounting for a given realm ? Here is what I'm doing for proxied realms: ### server vs_bar { accounting { sql_bar } } home_server hs_bar { type = auth+acct ipaddr = [...] [...] } home_server_pool hsp_bar { type = fail-over home_server = hs_bar virtual_server = vs_bar } realm bar { pool = hsp_bar nostrip } ### The request is proxied but the accounting section is taken from default and not from vs_bar. What am I doing wrong? Thank you, Frank.

3 6