- Freeradius-Users - lists.freeradius.org

Proxy Issue
by Garber, Neal 17 Oct '10

17 Oct '10

I'm testing proxying of authentications (it's not something I've done before so this could be my problem). I have a pool with 2 home servers defined in proxy.conf. For now, both servers are unreachable (blocked by a firewall). I'm using git head 2.1.x branch and I'm testing using eapol_test. The failure is repeatable, while the server is performing no other work, and occurs after the client retries twice (so three Access-Requests are sent to FR) and after the 3rd request, it wakes up from sleeping and dies: Wed Oct 13 14:44:17 2010 : Debug: Waking up in 11.3 seconds. Wed Oct 13 14:44:28 2010 : Error: ASSERT FAILED event.c[1175]: "We do not have threads, but the request is marked as queued or running in a child thread" == NULL [1]+ Abort trap: 6 radiusd -X (wd: /usr/local/etc/raddb) Any ideas? I can post complete debug output if needed and/or parts of my config.

2 6

Toggle Calling-Station-Id check item based on Framed-Protocol?
by William Burnett 16 Oct '10

16 Oct '10

Hello all.. I'm trying to setup my Radius server so that it will map MAC addresses to TTLS user/pass for 802.1x. I have that part working fine. The problem is, the same user/pass pair I'm also using for the clients PPPoE authentication. I want the Calling-Station-Id to be verified when an EAP/TTLS session is being authenticated, but I don't want to check the Calling-Station-Id when the PPPoE session is authenticating. This is because the TTLS device is known and controlled by me, the PPPoE device may be any MAC address that I don't want to have to maintain a list of. My question is, using unlang is there an option do delete a check item attribute based on another attribute? IE: if (Framed-Protocol == PPP) { update-control { Calling-Station-Id !* # Not sure if I'm using the !* operator properly here } } That code just yields errors, but thats essentially what I'm trying to do... Sincerely, William Burnett burnett.w(a)gmail.com

1 1

radtest issue
by Sujith Paily K 15 Oct '10

15 Oct '10

I have installed freeradius2 & freeradius2-utils on centos5.5 using yum. I did the basic configuration and test with radtest ----------------------------------------------------------------- radtest testing password 127.0.0.1 10 testing123 Sending Access-Request of id 221 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "password" NAS-IP-Address = 216.34.94.184 NAS-Port = 10 rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=221, length=2 ----------------------------------------------------------------------------------------------------- I dont understand "NAS-IP-Address = 216.34.94.184" my hostname is node3.localhost. So expected NAS-IP-Address is node3.localhos right? What is wrong?I dont find an the ip 216.34.94.184 in my machine -- Thanks and Regards, Sujith Paily K http://SparkSupport.com<http://www.google.com/url?sa=D&q=http://SparkSupport.com&usg=AFQjCNEs6_09Bz…>| http://migrate2cloud.com<http://www.google.com/url?sa=D&q=http://migrate2cloud.com&usg=AFQjCNHfkXv1L…>

2 1

Combining ntlm_auth and mac address verification in freeradius
by Langen Mike 15 Oct '10

15 Oct '10

Hi there. I've got the problem that I want to combine active directory authentication with mac address verification. So only user can log in which hardware is listed in a text file or similar. In the whole world wide web I didn't find a hint how to combine multiple authentication methods in serial. One possibility, but there I didn't find anything at all, seems to be using the perl module. Is it possible to run a perl script before ntlm_auth will take place ? Thanks for your answer. Greetings from Switzerland. Mike

2 4

RE: Service-Logon
by Jay Kuhne (jkuhne) 15 Oct '10

15 Oct '10

Hello, I am attempting to "COA Service-Logon" with Radclient and cisco av-pair attributes. I can perform other COA like tagged ACL or Named but so far not service-logon Local ACL "IN_ACL_NAMED_v4_2" is on my ISG gateway (Cisco ASR1k). Have this cmd which I understand allows radius to define the policy. aaa authorization subscriber-service default group RADIUS_GROUP Syntax I am using for Radclient/coa to existing session: (Have tried without Outbound-User as well) Acct-Session-Id="000003EE" Service-Type += Outbound-User cisco-avpair="subscriber:command=activate-service" cisco-avpair="subscriber:service-name=v4_POLICY" cisco-avpair="ip:inacl=IN_ACL_NAMED_v4_2" Am seeing the following on the gateway: "COA: Message Authenticator missing or failed decode" Could someone verify my syntax and give any suggestions? Do I need to actually define/configure "v4_POLICY" anywhere? Jay

2 7

Merging authentication log messages
by Harry Hoffman 14 Oct '10

14 Oct '10

Hi, I'm trying to figure out how to merge log messages when T(T)LS is in use. Right now both the outer (anonymous) identity and the inner (real) identity are logged: Oct 14 09:35:14 siteone.some.edu: radiusd[28928]: Login OK: [hhoffman] (from client wifi-ap port 0 via TLS tunnel) Oct 14 09:35:15 siteone.some.edu: radiusd[28928]: Login OK: [anonymous] (from client wifi-ap port 0 cli 02-00-00-00-00-01) So, the hhoffman is the actual user name and the 02-00-00-00-00-01 is the mac address that is passed along from the ap. I'd like to be able to combine this as I don't need to know the outer (anonymous) id. I'm looking at modules/{linelog,detail.lgo} but neither look like they produce what is being logging via syslog to the file. radiusd.conf contains a logging section that point to log_* but I don't see how to configure the auth messages in a different way. Cheers, Harry

2 1

Tying radius to mysql...
by rktechie 14 Oct '10

14 Oct '10

I'm sure I am missing something simple and probably obvious. Now that I have installed freeradius (2.1.9-1.fc13.i686) and imported the mysql schema and populated it with a test user, I would like to know if there are some basic config instructions for telling freeradius to actually use the users from the db rather than the /etc/raddb/users file? radtest testing1 guest 127.0.0.1 0 testing123 results in rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=27, length=20 but if I put my "testing1" user in /etc/raddb/users it accepts the login ok. I'm not real clear on what data I need in the db. What is the minimum to create a valid test? NAS info? I tried following http://wiki.freeradius.org/SQL_HOWTO but the radius server doesn't seem to be talking to mysql. In my troubleshooting, I added "sql" at the bottom of the "instantiate" section in the /etc/raddb/radiusd.conf file (Is this the proper way to get them talking?), and now radiusd does seem to communicate with mysql, but although it successfully logs in it doesn't seem to interact with the user data to authorize anything. It seems there is something else I need to add to the config files to make radius look to mysql rather than a users file for the data. (I would like to have freeradius log all the authorization info to mysql as well, but first things first...) My `radcheck` table contains: INSERT INTO `radcheck` (`id`, `username`, `attribute`, `op`, `value`) VALUES (1, 'testing1', 'Cleartext-Password', ':=', 'guest'); Some of the output from radiusd -X ... including configuration file /etc/raddb/sql.conf including configuration file /etc/raddb/sql/mysql/dialup.conf including configuration file /etc/raddb/sql/mysql/counter.conf ... radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } Module: Linked to module rlm_sql Module: Instantiating sql sql { driver = "rlm_sql_mysql" server = "localhost" port = "" login = "rad1" password = "rad1" radius_db = "rad1" read_groups = yes sqltrace = no sqltracefile = "/var/log/radius/sqltrace.sql" readclients = no deletestalesessions = yes num_sql_socks = 5 lifetime = 0 max_queries = 0 sql_user_name = "%{User-Name}" default_user_profile = "" nas_query = "SELECT id, nasname, shortname, type, secret, server FROM nas" ... } rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to rad1@localhost:/rad1 rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 } radiusd: #### Loading Virtual Servers #### ... radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Ready to process requests. ... Running radtest from the terminal: radtest testing1 guest 127.0.0.1 0 testing123 Sending Access-Request of id 66 to 127.0.0.1 port 1812 User-Name = "testing1" User-Password = "guest" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=66, length=20 ... rad_recv: Access-Request packet from host 127.0.0.1 port 41218, id=66, length=60 User-Name = "testing1" User-Password = "guest" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "testing1", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testing1 attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 66 to 127.0.0.1 port 41218 Waking up in 4.9 seconds. Cleaning up request 1 ID 66 with timestamp +360 Ready to process requests. -- View this message in context: http://freeradius.1045715.n5.nabble.com/Tying-radius-to-mysql-tp3212438p321… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 2

DEFAULT policy order in Users file
by Jevos, Peter 14 Oct '10

14 Oct '10

Hi I have at the end of Users file two DEFAULTS statements: DEFAULT Auth-Type := ntlm_auth_vpn_comp NAS-IP-Address == 10.1.1.1, Service-Type = Framed-User, Framed-Protocol = PPP, DEFAULT Auth-Type := vpn_auth_name Service-Type = Framed-User, Framed-Protocol = PPP, So it means, when access request comes from the address 10.1.1.1 use authentication type ntlm_auth_vpn_comp. If access request comes from the other address use Auth-Type vpn_auth_name which is default for everybody The point is that I have more VPN gates and I can decide which authentication will be used for them However it doesn't work, cause every request match only the first DEFAULT statement, despite of that it comes from different NAS-IP-Address then 10.1.1.1 Do you know why it is happen ? Thanks pet

3 3

Re: Unfinished Request no Database
by João Romariz 14 Oct '10

14 Oct '10

Hi Alan, Thanks for your help. In fact the IPPool is using the db.ippool and db.ipindex files on the freeradius directory. Regards, Jromariz.

1 0

Proxying question for Eduroam
by Peter Kruppa 14 Oct '10

14 Oct '10

Hi all, We use a freeradius proxy for proxying wireless PEAP requests to one of our two domains (via IAS and NPS in the near future) or to the next Eduroam proxy. Visa versa PEAP requests send by our students at other schools are forwarded to our freeradius proxy. Everything seems to work when we use the wireless clients of Windows, Mac OS 10, Linux, smartphones, etc...), but there is one scenario where it won't work and what some schools use for testing. I managed to reproduce that situation by using eapol_test, in that case requests to IAS aren't logged and it never replies with a Access-Challenge. The versions of the software are: FreeRADIUS 2.1.8+dfsg-1ubuntu1 OpenSSL 0.9.8k-7ubuntu8.3 Eapol_test from wpa_supplicant 0.7.3 The configuration is simple and transparant, we have some clients and some proxies, on the base of the realm the request is proxied to the next radius server, without termination of EAP at freeradius. If EAP is the problem, I could terminate the EAP tunnel for our 2 domain on freeradius, how should I do that? Do I need to use the inner-tunnel? Or proxy-inner-tunnel (what about Proxy-To-Realm than because we have 2 domains)? In any case I would like to use a method without using winbind. Hope someone will give me a hint... Best regards, Peter Kruppa

3 2