- Freeradius-Users - lists.freeradius.org

Re: FreeRadius + AD + Realms
by Matthew P 03 Jul '10

03 Jul '10

>> realm mydomain.com { >> auth_pool = active_directory > > You'll need a line: > > nostrip > > To avoid EAP identity issues. This worked, thanks. Preprocess doesn't strip the username in the default server and EAP works. Although, now a new problem arrised - I can't seem to get the (stripped) username in the inner-tunnel with preprocess. So the username stays in the form - "user(a)mydomain.com", but that isn't usable for a LDAP search (on the AD). (btw. if I test without the realm portion of the scenario, like AD is the only source of authentication, it works) > i.e. it doesn't proxy it. > > This *does* work in 2.1.9. So which version are you running? I'm sorry, it was my mistake. I configured proxy_requests = no, because I thought it was ment for a server when it was only proxying requests from other sources (since this option opens a special proxy-ing listening port). Fixed now, proxying to virtual server works. > And why are you creating this complicated configuration? The > "inner-tunnel" virtual server is set up *precisely* for this kind of > authentication. You do EAP in the "default" server. Then, the > "inner-tunnel" server gets the PAP password, and you can configure it to > look the user up in AD there. Because there are realms involved in the scenario. If the realm is "mydomain.com" then radius needs to lookup a user in AD. If the realm is "mydomain2.com" then it needs to consult sql. Otherwise it should proxy the request to a home server. What would be a proper way to do this? I thought setting up a virtual server for every scenario is the way to go? TIA! _________________________________________________________________ Your E-mail and More On-the-Go. Get Windows Live Hotmail Free. https://signup.live.com/signup.aspx?id=60969

2 1

FW: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user
by Cesar Ortega 02 Jul '10

02 Jul '10

Hi Alan, I tried using the default users file and the other one that works on the other server but I could not make it. BTW, the working users file is the same, but include DEFAULT Auth-Type := ntlm_auth at the beginning. However, the Freeradius log said: /etc/freeradius/users[3]: Parse error (check) for entry DEFAULT: Unknown value ntlm_auth for attribute Auth-Type Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/innet-tunnel-default[111]: Failed to find module "files". /etc/freeradius/sites-enabled/innet-tunnel-default[34]: Errors parsing authorize section. Cesar > Message: 5 > Date: Fri, 02 Jul 2010 17:20:28 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4C2E03BC.6050104(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Cesar Ortega wrote: > > I managed to install Freeradius with OpenSSL under Debian Lenny and it > > did work like a charm for a while. However, after I did the same process > > of installation in another virtualbox machine, it has not worked > > anymore. The console log report the following error: > > > > [pap] WARNING! No "known good" password found for the user. > > Authentication may fail because of this. > > You did not follow the same installation process. The *other* machine > looks up users in a database, or in the "users" file. This machine is > not configured to look in any database. > > Alan DeKok. Discover the new Windows Vista Learn more! _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 1

warnings under cygwin
by tangfu 02 Jul '10

02 Jul '10

Hi,guys.I try to complie freeradius 2.19 under cygwin this afternoon,but i get some warning when i execute "./configure ..." ./configure --without-snmp --disable-shared --with-system-libtool --without-rlm_krb5 --without-rlm_pam --without-rlm_sql_oracle --without-rlm_perl --with-mysql-lib-dir=/usr/lib/mysql --without-rlm_eap_ikev2 --without-rlm_eap_tnc --prefix=C:/123 2>C:/warning ################################################################ configure: WARNING: snmpget not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: snmpwalk not found - Simultaneous-Use and checkrad.pl may not work configure: WARNING: ****** BSD-style gethostbyaddr might NOT be thread-safe! ****** configure: WARNING: ****** BSD-style gethostbyname might NOT be thread-safe! ****** configure: WARNING: Static linking with libldap will probably result in unresolved symbols. configure: WARNING: silently not building rlm_sql_iodbc. configure: WARNING: FAILURE: rlm_sql_iodbc requires: libiodbc isql.h. configure: WARNING: MySQL libraries not found. Use --with-mysql-lib-dir=<path>. configure: WARNING: silently not building rlm_sql_mysql. configure: WARNING: FAILURE: rlm_sql_mysql requires: libmysqlclient_r. configure: WARNING: silently not building rlm_sql_unixodbc. configure: WARNING: FAILURE: rlm_sql_unixodbc requires: libodbc sql.h. ################################################################ I don't have installed net-snmp,but i add "--without-snmp" to configure.I am confused why these warnings about snmp occur. Additionally,iodbc and unixodbc seem merely to support non-windows platform.I always don't get build succeeded. Much to my puzzlement,libmysqlclient_r.a and libmysqlclient_r.la exsit in /lib/mysql,as well as files related to mysql,but warnings don't be removed.Even if i use --with-mysql-lib-dir=<path>,it doesn't work all the same. Any proposal will be appreciated. _________________________________________________________________ 想知道明天天气如何？必应告诉你！ http://cn.bing.com/search?q=%E5%A4%A9%E6%B0%94%E9%A2%84%E6%8A%A5&form=MICHJ2

3 5

My question again (was: Netmask HOWTO)
by loki 02 Jul '10

02 Jul '10

Hello all. I need some kind of solution very urgent. My question was - is it possible to set Framed-IP-Netmask, together with IPs through sqlippool, somehow by default, via groupreply or something, or to change sqlippool somewhow to achive this. Or is this only possible through ippool (txt - version in /etc). I tried through groupreply but it didn't work. Regards.... __________ Information from ESET Mail Security, version of virus signature database 5245 (20100702) __________ The message was checked by ESET Mail Security. http://www.eset.com

3 4

Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user
by Cesar Ortega 02 Jul '10

02 Jul '10

Hi Alan, I try using the default user file and the other one that works on the other server but I could not make it. BTW, the working users file is the same, but include DEFAULT Auth-Type := ntlm_auth at the beginning. However, the Freeradius log said: > Message: 5 > Date: Fri, 02 Jul 2010 17:20:28 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this) > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4C2E03BC.6050104(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Cesar Ortega wrote: > > I managed to install Freeradius with OpenSSL under Debian Lenny and it > > did work like a charm for a while. However, after I did the same process > > of installation in another virtualbox machine, it has not worked > > anymore. The console log report the following error: > > > > [pap] WARNING! No "known good" password found for the user. > > Authentication may fail because of this. > > You did not follow the same installation process. The *other* machine > looks up users in a database, or in the "users" file. This machine is > not configured to look in any database. > > Alan DeKok. _________________________________________________________________ Discover the new Windows Vista http://search.msn.com/results.aspx?q=windows+vista&mkt=en-US&form=QBRE

1 0

Freeradius 2.1.8+Windows AD+MS-CHAP with ntlm_auth ( [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this)
by Cesar Ortega 02 Jul '10

02 Jul '10

Hi everyone, I managed to install Freeradius with OpenSSL under Debian Lenny and it did work like a charm for a while. However, after I did the same process of installation in another virtualbox machine, it has not worked anymore. The console log report the following error: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. The complete log is: xmobileb155ce:~# freeradius -X FreeRADIUS Version 2.1.8, for host i486-pc-linux-gnu, built on Mar 18 2010 at 04:07:54 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/001mschap-default including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/001ntlm_auth-default including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/innet-tunnel-default including configuration file /etc/freeradius/sites-enabled/inner-tunnel including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/default-default main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = no zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } client WiFi Network/24 { require_message_authenticator = no secret = "alejandro" shortname = "N1P2" } client AP's IP_ADD { require_message_authenticator = no secret = "alejandro" shortname = "mw-ltqFreeradius-N1-P2-01" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating chap Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MI_DOMINIO} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } Module: Linked to module rlm_unix Module: Instantiating unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating eap eap { default_eap_type = "peap" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/freeradius/certs/privkey.pem" certificate_file = "/etc/freeradius/certs/cert.pem" CA_file = "/etc/freeradius/certs/cacert.pem" private_key_password = "alejandro" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating suffix realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating attr_filter.access_reject attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server inner-tunnel { modules { Module: Checking authenticate {...} for more modules to load Module: Instantiating ntlm_auth exec ntlm_auth { wait = yes program = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-MI_DOMINIO} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" input_pairs = "request" shell_escape = yes } Module: Checking authorize {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server server { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating attr_filter.accounting_response attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=0, length=211 Message-Authenticator = 0x93930a64fe55679bbf166346dd01c8ee Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x02000017015044565341323030305c4f52544547414341 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 0 length 23 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to AP's IP_ADD port 1044 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03f0e72e0b3955098d1e297ca Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=1, length=286 Message-Authenticator = 0xe90497c13c690e16d5485c28de3e9496 Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 State = 0x3f0f6ba03f0e72e0b3955098d1e297ca Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0201005019800000004616030100410100003d03014c2df82b1aaab762c4848152fd27fc2bf58bd616a171819685cdabc06742c01900001600040005000a000900640062000300060013001200630100 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 06da], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 1 to AP's IP_ADD port 1044 EAP-Message = 0x0102040019c000000717160301002a0200002603014c2db8e16be0183427bbf13d7b13f051b0c5aa8b01478646849427c5da4b1bb80000040016030106da0b0006d60006d30003143082031030820279a003020102020101300d06092a864886f70d0101040500308199310b30090603550406130256453110300e060355040813074d6972616e6461311330110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f7274656761636140706476 EAP-Message = 0x73612e636f6d301e170d3130303632393135343231355a170d3131303632393135343231355a308184310b30090603550406130256453110300e060355040813074d6972616e64613110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f727465676163614070647673612e636f6d30819f300d06092a864886f70d010101050003818d0030818902818100d961f1c2b91f0d141af24b8159c77c896af5826680a71f1958da4fee26ae2daf2b6873b24b4f5f62983a394e00a12f34c1782b EAP-Message = 0xe32a821e8de6d8d6b93c4a2f56ebdb794505c286e8cf90afd49fa4ed7f2884c71c05fa433c8bc1eeb82047282ee632a335704d981f9abbd72db1e9c2651a41f7bb617b431b96e625160d5a7b250203010001a37b307930090603551d1304023000302c06096086480186f842010d041f161d4f70656e53534c2047656e657261746564204365727469666963617465301d0603551d0e04160414f5e48dd3f3f7c9d2f8d1d238d806dc2d373b3f75301f0603551d230418301680148f5fef5cc045862dacaacab2743ac1b5e6004da4300d06092a864886f70d010104050003818100793f45a2857d4dd39a792ae4c3be4af073f884512cbc4df80e8ad6 EAP-Message = 0x9c1ab61196c6eb92f4ee31ddd0d2159085f44a602649ab1e8e99ada8964486e988554386b0a6447678b49ff53ddb06b964f737560fa2731cdb362a75d0894bd7c7f7d980b3100785eb9443172b2bb03fb26ca801099053e7c9e991a8de7447789db233077c0003b9308203b53082031ea003020102020900e41bd88320212e1b300d06092a864886f70d0101050500308199310b30090603550406130256453110300e060355040813074d6972616e6461311330110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434 EAP-Message = 0x312e70647673612e636f6d31 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03e0d72e0b3955098d1e297ca Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=2, length=212 Message-Authenticator = 0xf5bf8d910858176aa660a0b84bb59a47 Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 State = 0x3f0f6ba03e0d72e0b3955098d1e297ca Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020200061900 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to AP's IP_ADD port 1044 EAP-Message = 0x01030327190021301f06092a864886f70d01090116126f727465676163614070647673612e636f6d301e170d3130303632393135323433335a170d3135303632383135323433335a308199310b30090603550406130256453110300e060355040813074d6972616e6461311330110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f727465676163614070647673612e636f6d30819f300d06092a864886f70d010101050003818d00308189 EAP-Message = 0x02818100a1693e448c170a87ee7d3b25c570586058f1959e06ec4871faa592d4ba57f20402a53573d38770fcf4f78005e7655ad2569559de834ce0c5c7e12d9c764ac1ab9c39413656a0111bb850f70581faf2578ba579741b85eea4367879957da5a230d889c991ca32c2a1bc5cbe565119859281b2620074f3decd5ad97947ace7ebe30203010001a38201013081fe301d0603551d0e041604148f5fef5cc045862dacaacab2743ac1b5e6004da43081ce0603551d230481c63081c380148f5fef5cc045862dacaacab2743ac1b5e6004da4a1819fa4819c308199310b30090603550406130256453110300e060355040813074d6972616e64613113 EAP-Message = 0x30110603550407130a4c6f73205465717565733110300e060355040a1307496e7465766570310c300a060355040b13034149543120301e06035504031317786d6f62696c656662663434312e70647673612e636f6d3121301f06092a864886f70d01090116126f727465676163614070647673612e636f6d820900e41bd88320212e1b300c0603551d13040530030101ff300d06092a864886f70d010105050003818100688cfdd5d90a010be714a0fe80a81214e8ec426cba6d9097c95b35bc8e170a3274db611b780393957b0a2fec6baaea321947061b5ab0b5935f980664bc8123826866430b3a66876e4b36d9f3029b5870baeb78a933fdbdb323 EAP-Message = 0xe0f8ab382e453520b31f1571471622b3b167ad75a49437a3155d091693e09f027deedc3d875a9d16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03d0c72e0b3955098d1e297ca Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host AP's IP_ADD port 1044, id=3, length=212 Message-Authenticator = 0x816e317a044a6cc3f91a7f579f6126d5 Service-Type = Framed-User User-Name = "MI_DOMINIO\\ORTEGACA" Framed-MTU = 1488 State = 0x3f0f6ba03d0c72e0b3955098d1e297ca Called-Station-Id = "00-18-39-1B-B3-F1:freeradiusg" Calling-Station-Id = "00-1F-3C-2D-62-C1" NAS-Identifier = "WAP55AG" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x020300061900 NAS-IP-Address = AP's IP_ADD NAS-Port = 1 NAS-Port-Id = "STA port # 1" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "MI_DOMINIO\ORTEGACA", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to AP's IP_ADD port 1044 EAP-Message = 0x010400061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3f0f6ba03c0b72e0b3955098d1e297ca Finished request 3. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 0 with timestamp +0 Cleaning up request 1 ID 1 with timestamp +0 Cleaning up request 2 ID 2 with timestamp +0 Cleaning up request 3 ID 3 with timestamp +0 Ready to process requests. ^C xmobileb155ce:~# Some help is appreciate. Regards, Cesar Invite your mail contacts to join your friends list with Windows Live Spaces. It's easy! Try it! _________________________________________________________________ Explore the seven wonders of the world http://search.msn.com/results.aspx?q=7+wonders+world&mkt=en-US&form=QBRE

2 1

Failed disabling Core Dumps on RHEL - SELinux Updates
by Ben Wiechman 02 Jul '10

02 Jul '10

A note for those that may run into this as well. When updating FR to 2.1.9 on RHEL/CentOS with SELinux enabled FreeRADIUS would log the following when it was started: Wed Jun 2 16:19:57 2010 : Error: Failed disabling core dumps: Permission denied To resolve I had to install the following modifications to the default SELinux policy # cat freeradius2.te module freeradius2 1.0; require { type radiusd_t; class process setrlimit; } #============= radiusd_t ============== allow radiusd_t self:process setrlimit; This allowed the daemon to properly disable core dumps. Ben Wiechman Wisper High Speed Internet

4 7

Authentication delegation
by Maria Sanchez 02 Jul '10

02 Jul '10

In the operational environment there is a RADIUS server that is already configured to handle authentication and has all the corresponding accounts. I would like to make use of the Authorization part of RADIUS and install my own server for this purpose. However I need to configure it to pass the authentication messages to the "main" RADIUS server. Is there a way to do this? A secondary radius server configured to pass authentication onto another server? The authorization rules are defined in the secondary server. Thanks for any help.....

1 0

Starent NAS dictionary
by JOE 02 Jul '10

02 Jul '10

Hi all Freeradius can't parse this dictionary. Fails with ' invalid keyword "MACRO"': ############################################################################## # Starent Networks Dictionary for ST16 ############################################################################## # # Use the Radius specification attributes in lieu of the starent ones # #(a)radius.dct # # Define additional starent parameters # (add starent specific attributes below) MACRO SN-VSA(t,v) 26 [vid=8164 type2=%t% len2=+4 data=%v%] ATTRIBUTE SN-VPN-ID SN-VSA(1, integer) r ATTRIBUTE SN-VPN-Name SN-VSA(2, string) r ATTRIBUTE SN-Disconnect-Reason SN-VSA(3, integer) VALUE SN-Disconnect-Reason Not-Defined 0 VALUE SN-Disconnect-Reason Admin-Disconnect 1 VALUE SN-Disconnect-Reason Remote-Disconnect 2 VALUE SN-Disconnect-Reason Local-Disconnect 3 VALUE SN-Disconnect-Reason Disc-No-Resource 4 VALUE SN-Disconnect-Reason Disc-Excd-Service-Limit 5 VALUE SN-Disconnect-Reason PPP-LCP-Neg-Failed 6 VALUE SN-Disconnect-Reason PPP-LCP-No-Response 7 VALUE SN-Disconnect-Reason PPP-LCP-Loopback 8 VALUE SN-Disconnect-Reason PPP-LCP-Max-Retry 9 VALUE SN-Disconnect-Reason PPP-Echo-Failed 10 VALUE SN-Disconnect-Reason PPP-Auth-Failed 11 VALUE SN-Disconnect-Reason PPP-Auth-Failed-No-AAA-Resp 12 VALUE SN-Disconnect-Reason PPP-Auth-No-Response 13 VALUE SN-Disconnect-Reason PPP-Auth-Max-Retry 14 VALUE SN-Disconnect-Reason Invalid-AAA-Attr 15 VALUE SN-Disconnect-Reason Failed-User-Filter 16 VALUE SN-Disconnect-Reason Failed-Provide-Service 17 VALUE SN-Disconnect-Reason Invalid-IP-Address-AAA 18 VALUE SN-Disconnect-Reason Invalid-IP-Pool-AAA 19 VALUE SN-Disconnect-Reason PPP-IPCP-Neg-Failed 20 VALUE SN-Disconnect-Reason PPP-IPCP-No-Response 21 VALUE SN-Disconnect-Reason PPP-IPCP-Max-Retry 22 VALUE SN-Disconnect-Reason PPP-No-Rem-IP-Address 23 VALUE SN-Disconnect-Reason Inactivity-Timeout 24 VALUE SN-Disconnect-Reason Session-Timeout 25 VALUE SN-Disconnect-Reason Max-Data-Excd 26 VALUE SN-Disconnect-Reason Invalid-IP-Source-Address 27 VALUE SN-Disconnect-Reason MSID-Auth-Failed 28 VALUE SN-Disconnect-Reason MSID-Auth-Fauiled-No-AAA-Resp 29 VALUE SN-Disconnect-Reason A11-Max-Retry 30 VALUE SN-Disconnect-Reason A11-Lifetime-Expired 31 VALUE SN-Disconnect-Reason A11-Message-Integrity-Failure 32 VALUE SN-Disconnect-Reason PPP-lcp-remote-disc 33 VALUE SN-Disconnect-Reason Session-setup-timeout 34 VALUE SN-Disconnect-Reason PPP-keepalive-failure 35 VALUE SN-Disconnect-Reason Flow-add-failed 36 VALUE SN-Disconnect-Reason Call-type-detection-failed 37 VALUE SN-Disconnect-Reason Wrong-ipcp-params 38 VALUE SN-Disconnect-Reason MIP-remote-dereg 39 VALUE SN-Disconnect-Reason MIP-lifetime-expiry 40 VALUE SN-Disconnect-Reason MIP-proto-error 41 VALUE SN-Disconnect-Reason MIP-auth-failure 42 VALUE SN-Disconnect-Reason MIP-reg-timeout 43 VALUE SN-Disconnect-Reason Invalid-dest-context 44 VALUE SN-Disconnect-Reason Source-context-removed 45 VALUE SN-Disconnect-Reason Destination-context-removed 46 VALUE SN-Disconnect-Reason Req-service-addr-unavailable 47 VALUE SN-Disconnect-Reason Demux-mgr-failed 48 VALUE SN-Disconnect-Reason Internal-error 49 ATTRIBUTE SN-PPP-Progress-Code SN-VSA(4, integer) VALUE SN-PPP-Progress-Code Not-Defined 0 VALUE SN-PPP-Progress-Code Call-Lcp-Down 1 VALUE SN-PPP-Progress-Code Call-Disconnecting 2 VALUE SN-PPP-Progress-Code Call-Ppp-Renegotiating 3 VALUE SN-PPP-Progress-Code Call-Arrived 11 VALUE SN-PPP-Progress-Code Call-Lcp-Up 12 VALUE SN-PPP-Progress-Code Call-Authenticating 13 VALUE SN-PPP-Progress-Code Call-Authenticated 14 VALUE SN-PPP-Progress-Code Call-Ipcp-Up 15 VALUE SN-PPP-Progress-Code Call-Simple-IP-Connected 16 VALUE SN-PPP-Progress-Code Call-Mobile-IP-Connected 17 ATTRIBUTE SN-Primary-DNS-Server SN-VSA(5, ipaddr) r ATTRIBUTE SN-Secondary-DNS-Server SN-VSA(6, ipaddr) r ATTRIBUTE SN-Re-CHAP-Interval SN-VSA(7, integer) r ATTRIBUTE SN-IP-Pool-Name SN-VSA(8, string) R ATTRIBUTE SN-PPP-Data-Compression SN-VSA(9, integer) r VALUE SN-PPP-Data-Compression None 0 VALUE SN-PPP-Data-Compression Stac-LZS 1 VALUE SN-PPP-Data-Compression MPPC 2 VALUE SN-PPP-Data-Compression MPCC-Stac-LZS 3 VALUE SN-PPP-Data-Compression Deflate 4 VALUE SN-PPP-Data-Compression Deflate-Stac-LZS 5 VALUE SN-PPP-Data-Compression Deflate-MPCC 6 VALUE SN-PPP-Data-Compression Deflate-MPCC-Stac-LZS 7 ATTRIBUTE SN-IP-Filter-In SN-VSA(10, stringnz) RO ATTRIBUTE SN-IP-Filter-Out SN-VSA(11, string) R ATTRIBUTE SN-Local-IP-Address SN-VSA(13, ipaddr) cr ATTRIBUTE SN-IP-Source-Validation SN-VSA(14, integer) r VALUE SN-IP-Source-Validation No 0 VALUE SN-IP-Source-Validation Yes 1 ATTRIBUTE SN-PPP-Outbound-Password SN-VSA(15, string) r ATTRIBUTE SN-PPP-Keepalive SN-VSA(16, integer) r ATTRIBUTE SN-IP-In-ACL SN-VSA(17, stringnz) CR ATTRIBUTE SN-IP-Out-ACL SN-VSA(18, stringnz) CR ATTRIBUTE SN-PPP-Data-Compression-Mode SN-VSA(19, integer) r ATTRIBUTE SN-Subscriber-Permission SN-VSA(20, integer) r VALUE SN-Subscriber-Permission None 0 VALUE SN-Subscriber-Permission Simple-IP 1 VALUE SN-Subscriber-Permission Mobile-IP 2 VALUE SN-Subscriber-Permission Simple-IP-Mobile-IP 3 VALUE SN-Subscriber-Permission HA-Mobile-IP 4 VALUE SN-Subscriber-Permission Simple-IP-HA-Mobile-IP 5 VALUE SN-Subscriber-Permission Mobile-IP-HA-Mobile-IP 6 VALUE SN-Subscriber-Permission All 7 ATTRIBUTE SN-Admin-Permission SN-VSA(21, integer) r VALUE SN-Admin-Permission None 0 VALUE SN-Admin-Permission CLI 1 VALUE SN-Admin-Permission FTP 2 ATTRIBUTE SN-Simultaneous-SIP-MIP SN-VSA(22, integer) r VALUE SN-Simultaneous-SIP-MIP Disabled 0 VALUE SN-Simultaneous-SIP-MIP Enabled 1 ATTRIBUTE SN-Min-Compress-Size SN-VSA(23, integer) r VALUE SN-PPP-Data-Compression-Mode Normal 0 VALUE SN-PPP-Data-Compression-Mode Stateless 1 ATTRIBUTE SN-Tunnel-Load-Balancing SN-VSA(27, integer) rt VALUE SN-Tunnel-Load-Balancing random 1 VALUE SN-Tunnel-Load-Balancing balanced 2 VALUE SN-Tunnel-Load-Balancing prioritized 3 ATTRIBUTE SN-Rad-APN-Name SN-VSA(162, stringnz) Cr ATTRIBUTE SNA-PPP-Unfr-data-In-Oct SN-VSA(200, integer) ATTRIBUTE SNA-PPP-Unfr-data-Out-Oct SN-VSA(201, integer) ATTRIBUTE SNA-PPP-Ctrl-Input-Octets SN-VSA(1001, integer) ATTRIBUTE SNA-PPP-Ctrl-Output-Octets SN-VSA(1002, integer) ATTRIBUTE SNA-PPP-Ctrl-Input-Packets SN-VSA(1003, integer) ATTRIBUTE SNA-PPP-Ctrl-Output-Packets SN-VSA(1004, integer) ATTRIBUTE SNA-PPP-Framed-Input-Octets SN-VSA(1005, integer) ATTRIBUTE SNA-PPP-Framed-Output-Octets SN-VSA(1006, integer) ATTRIBUTE SNA-PPP-Discards-Input SN-VSA(1007, integer) ATTRIBUTE SNA-PPP-Discards-Output SN-VSA(1008, integer) ATTRIBUTE SNA-PPP-Errors-Input SN-VSA(1009, integer) ATTRIBUTE SNA-PPP-Errors-Output SN-VSA(1010, integer) ATTRIBUTE SNA-PPP-Bad-Addr SN-VSA(1011, integer) ATTRIBUTE SNA-PPP-Bad-Ctrl SN-VSA(1012, integer) ATTRIBUTE SNA-PPP-Packet-Too-Long SN-VSA(1013, integer) ATTRIBUTE SNA-PPP-Bad-FCS SN-VSA(1014, integer) ATTRIBUTE SNA-PPP-Echo-Req-Input SN-VSA(1015, integer) ATTRIBUTE SNA-PPP-Echo-Req-Output SN-VSA(1016, integer) ATTRIBUTE SNA-PPP-Echo-Rsp-Input SN-VSA(1017, integer) ATTRIBUTE SNA-PPP-Echo-Rsp-Output SN-VSA(1018, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Total SN-VSA(1019, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Acc-Reg SN-VSA(1020, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Acc-Dereg SN-VSA(1021, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Msg-Auth-Fail SN-VSA(1022, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Mis-ID SN-VSA(1023, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-Badly-Formed SN-VSA(1024, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-VID-Unsupported SN-VSA(1025, integer) ATTRIBUTE SNA-RPRRQ-Rcvd-T-Bit-Not-Set SN-VSA(1026, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Total SN-VSA(1027, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Acc-Ack SN-VSA(1028, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Msg-Auth-Fail SN-VSA(1029, integer) ATTRIBUTE SNA-RPRAK-Rcvd-Mis-ID SN-VSA(1030, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Total SN-VSA(1031, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Acc-Reg SN-VSA(1032, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Acc-Dereg SN-VSA(1033, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Bad-Req SN-VSA(1034, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Denied SN-VSA(1035, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Mis-ID SN-VSA(1036, integer) ATTRIBUTE SNA-RP-Reg-Reply-Sent-Send-Err SN-VSA(1037, integer) ATTRIBUTE SNA-RP-Reg-Upd-Sent SN-VSA(1038, integer) ATTRIBUTE SNA-RP-Reg-Upd-Re-Sent SN-VSA(1039, integer) ATTRIBUTE SNA-RP-Reg-Upd-Send-Err SN-VSA(1040, integer) ATTRIBUTE SN-Rulebase SN-VSA(250,stringnz) RO I will try to replace the macro with the actual value Regards

2 3

radius proxy authentication problem with realm stripping for EAP
by Alex Myself 01 Jul '10

01 Jul '10

Hi, I'm trying to configure free radius server as a proxy radius server with realm defined and strip option enabled. Authentication fails on external radius server when EAP is used. Without EAP authentication is fine. Any configuration option required for EAP to work (with realm stripping)? Thanks, Alex

2 2