- Freeradius-Users - lists.freeradius.org

EAP-MSCHAP v2 + LDAP: Identity does not match User-Name, setting from EAP Identity.
by Andras Dosztal 02 Jun '10

02 Jun '10

Hi, I've configured FreeRADIUS (version 1.1.7, supplied with SLES10) to authenticate from Novell eDirectory with LDAP. The problem is that I can't connect to the network when I check the "Automatically use my Windows logon name and password" on a WinXP client's PEAP properties. This is the output of radiusd -A -X: rad_recv: Access-Request packet from host 10.128.128.3:1812, id=15, length=194 User-Name = "E00\\user1" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-26-CA-8D-A7-85" Calling-Station-Id = "00-0B-CD-04-75-8C" Attr-102 = 0x NAS-Port-Type = Ethernet NAS-Port = 50005 NAS-Port-Id = "FastEthernet0/5" NAS-IP-Address = 10.128.128.1 EAP-Message = 0x0201000e014530305c7573657231 Proxy-State = 0x280000000000000646010000400900000000000000000000a74212c6bb2daec4f3110aa90d1af235 Message-Authenticator = 0x928d46624aad188e71d3c6bbd88af6f1 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "user1", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 1 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry user1 at line 88 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for user1 radius_xlat: '(uid=user1)' radius_xlat: 'o=snac' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.128.128.5:636, authentication 0 rlm_ldap: setting TLS mode to 1 rlm_ldap: setting TLS CACert File to /etc/raddb/certs/ip_cert.b64 rlm_ldap: bind as cn=admin,o=snac/xxx to 10.128.128.5:636 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=snac, with filter (uid=user1) rlm_ldap: checking if remote access for user1 is allowed by dialupAccess rlm_ldap: Added the eDirectory password in check items rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user user1 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Login incorrect: [user1/<no User-Password attribute>] (from client lan port 50005 cli 00-0B-CD-04-75-8C) Found Post-Auth-Type Processing the post-auth section of radiusd.conf modcall: entering group REJECT for request 0 modcall[post-auth]: module "ldap" returns noop for request 0 modcall: leaving group REJECT (returns noop) for request 0 Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 15 to 10.128.128.3 port 1812 Proxy-State = 0x280000000000000646010000400900000000000000000000a74212c6bb2daec4f3110aa90d1af235 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 15 with timestamp 4c06337d Nothing to do. Sleeping until we see a request. The with_ntdomain_hack directive is set to "yes" in the preprocess and mschap modules of radiusd.conf. When I set it to "no" and uncheck the "Automatically use my Windows..." and enter the user's credentials in a pop-up box, it's working fine. Could you guys help me with this problem? Thanks in advance. Regards, Andras

3 8

2x authorize_check_query
by Maciej Drobniuch 02 Jun '10

02 Jun '10

Hi All! It's a situation in which i have two authorize_check_query. I'm using pppoe+sql and I also want to implement dhcp. But the thing is that when dhcp nas asks freeradius it uses mac address as username. So i want sth like two sql { } sections with two different authorize_check_query for two different auth types. Sorry for my lame eng. Big thanks! -- Pozdrawiam! Maciej Drobniuch

1 0

Freeradius, custom vars and sql queries in sites-enabled/dhcp
by Wingman 02 Jun '10

02 Jun '10

Hello I'm using freeradius 2.1.9 Trying to setup dhcp server. There is no problem with dhcp + rlm_perl. But i want to speed up the server - do all the things with dhcp+rlm_sql. But i'm complicated doing this. For example, i need to parse several conditions, regarding to sql queries results. I'm confusing in how to use custom vars and custom sql queries in sites-enabled/dhcp ? i.e. i need somthing like this pseudocode: dhcp DHCP-Discover { ......... sql MYVAR := "%{sql: select blahblahblah}" ......... if(myvar >= xxx) { MYVAR2 := "%{sql:select blah blah2 blah3}" } } My question is how to do all this correct? =) Thx for help -- BRGS, Ilya A. Masandilov IP-Home.Net

2 2

EAP + LDAP
by Juergen Koller 02 Jun '10

02 Jun '10

Hi, I am trying to set up freeradius 2.1.8 to authorize an user using LDAP and to authenticate him using EAP. Every user in the LDAP-database and a valid EAP-certificate should get access. If not in the LDAP-database the user should be rejected. If I only use EAP for authentication and authorazation every thing is ok. I am trying this by using a DEFAULT Autz-Type := LDAP1 in the users file. freeradius checks now for authorization against the LDAP-database and gets back if the user exists or not (according to the debug output). But the user will not be rejected, if not in the LDAP-database. Perhaps I did not read the right document file right now. Perhaps Autz-Type is the totaly wrong approach. Any hints? Thanks, Juergen -- email: koller(a)idmt.fraunhofer.de gilb: Fraunhofer-IDMT, Ehrenbergstrasse 31, 98693 Ilmenau Tel.: +49 3677 467-340 Fax: +49 3677 467-4340 GSM: +49 175 183 5160

2 2

Re: Freeradius, custom vars and sql queries in sites-enabled/dhcp
by Wingman 02 Jun '10

02 Jun '10

Great, thx, Alan! I've allready written most functionality with rlm_perl, now will try to move it to native freeradius. > Wingman wrote: >> For example, i need to parse several conditions, regarding to sql queries results. I'm confusing in how to use custom vars and custom sql queries in sites-enabled/dhcp ? >> i.e. i need somthing like this pseudocode: >> >> dhcp DHCP-Discover { >> >> ......... >> sql >> MYVAR := "%{sql: select blahblahblah}" > See "man unlang". You need to put the attribute into an "update" section. > And you can't specify random names for "variables". They aren't > variables, they are attributes with pre-defined types. See > raddb/dictionary. > Alan DeKok. BRGS, Ilya A. Masandilov IP-Home.Net

1 0

Qugestion about Vendor-Specific Attr in EAP TTLS
by WWF 02 Jun '10

02 Jun '10

Hello, all! I use fr 2.1.9 on ubuntu 10.04, installed from source code. Use mysql as database. Now I add a VSA in radreply, then, if a user passes the auth, the VSA will be returned back to NAS. I find that for other auth types like PAP/EAPMD5/EAPTLS, this VSA VALUE is returned in ACCESS-ACCEPT packet. But when I use EAPTTLS, the VSA value is returned in the two ACCESS-CHALLENGE but not in the ACCESS-ACCEPT packet. I don't know if it is ok?

2 1

Time based usage
by tyllerd 01 Jun '10

01 Jun '10

Hi My company has purchased a radius server for our hotpspot solution. What I am trying to in my free time is put together freeradius to do what out current server does plus small things here and there that would make our lives a little better. What I am struggling with are time based cards. I have used the sqlcounters in freeradius and have tried to use the noresetcounter counter and would set it to, lets say 3600 seconds, this works except it leaves me with two issues. 1 being that when the user logs in and has Max-All-Session set to 3600, he can continue to surf until he logs off, if he tries to log in again (assuming he has reached or passed 3600 seconds) he cannot log in. My question is, is it possible to actaully disconnect him once he has reached his Max-All-Session? 2 is how would I go about checking how much time a user has used or still has available to him? I apologies if it sounds like I am trying to be spoon fed, I just need some sort of point in the correct direction as I think this is completely the incorrect way to go about doing this. Regards, T -- View this message in context: http://old.nabble.com/Time-based-usage-tp28745711p28745711.html Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 1

Checking ldap-group in post-auth instead of users file ?
by Fred MAISON 01 Jun '10

01 Jun '10

Hello all, I encounter difficulties to check for a radiusgroupname via LDAP by not using file /etc/raddb/users, as this seems to be difficult to avoid ldap checks for anonymous identities if default config is modified. I must service eap-peap and eap-ttls with mschapv2. How can i make checks on ldap radiusgroupnale without using the user file ? I have not been able to place somthing like this in the post-auth section of inner-tunnel ... if ( "%{control:Ldap-Group}" == "wireless" ) { noop } else { reject } I trie to replace this in users : # for proxy.conf to work : DEFAULT Realm == "myreal.com" reply-Message += "real is %{Realm}" DEFAULT Auth-Type == EAP, EAP-Type == Cisco-LEAP, Ldap-Group == wireless reply-Message = "Cisco-LEAP match in users : EAP-Type%{EAP-Type}" DEFAULT Auth-Type == EAP, EAP-Type == Generic-Token-Card, Ldap-Group == wireless reply-Message = "match in users : EAP-Type:%{EAP-Type}" DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Ldap-Group == wireless reply-Message += "in %{Virtual-Server}, proxy %{FreeRADIUS-proxied-To}, EAP-Type:%{EAP-Type}" DEFAULT Auth-Type == EAP reply-Message += "in users : EAP-Type:%{EAP-Type}" DEFAULT Auth-Type := Reject Reply-Message += "Please call the helpdesk."

3 5

Re: Your maximum never usage time has been reached
by freeradius＠moorhouse.net.nz 01 Jun '10

01 Jun '10

Thanks Alan >the easyhotsort people have leveraged, from what i can see, chillispot >and FreeRADIUS for their solution. as such, they are the ones who are >first in line to fix things....I dont see why the volunteers in FreeRADIUS >should deal with the random logic and code from a 3rd party solution. Fair call. >> This only occurs for users where the check-name attribute is >> "Max-All-MB". If there is no check for this attribute then the user can >are you checking the the attribute EXISTS - in which case it will always >be the case unless is only exists if another system make it so (from reading >accounting) or is is supposed to be a comparison with a value. If I create a user where the attribute does NOT exist then I can authenticate but cannot keep the user to the total data allowance (see below as why this is required). If I create a user where the attribute does exist then after the accounting record is created in the radacct table then subsequent attempts to authenticate fail. Maybe it's time to read the source code for the counter module :( >sorry, dont care for captive portals - I'm all about 802.1X and proper systems >and dont beleive that customers should be limited to small amounts of data >allowance - its 2010.... 1998 have called and want their business model back. Yeah - I'd rather provide an unlimited data allowance too but in this case it is not possible. I've taken on the task (as a volunteer) to provide a hotspot for a community group's conference and the only broadband access we have at the venue is via a 3G mobile service (limited to 3GB in a month) :( Additional data is priced at $100/GB !! David

3 3

Active Directory as PKI
by Nikita Koshikov 01 Jun '10

01 Jun '10

Hello freeradius users/admins, I'm trying to implement EAP-TLS authorization with freeradius and Active Directory Certificates Service, but I'm stuck here... With keys/certificates, generated with freeradius makefile(/etc/raddb/certs) everything is working fine. Here is the hierarchy of keys generated by freeradius: Ca.crt(+ca.key) || server.crt(+servers.key) //issuer ca.crt || client1.crt client2.crt ..... //issuer server.crt Apart from this scheme, Active Directory stores certificates in a way: Ca.crt(key in AD and cannot used by freeradius) || sub_ca.crt(key in AD and cannot used by freeradius) //issuer ca.crt || server.crt(+key) //issuer sub_ca.crt (this is for private_key_file and certificate_file in freeradius config) || client1.crt client2.crt ..... //issuer sub_ca.crt I'm concatenate ca.crt file with sub_ca.crt, openssl verify produces "OK". # openssl verify -CAfile ca.crt clent.crt clent.crt: OK But trying to authenticate from client I got error - unknown_ca. I have attached full debug log. client(wpa_supplient) -> wifi-access(linksys with dd-wrt) -> server(freeradius-2.1.7) wpa_supplient.conf: network={ ssid="work" proto=RSN key_mgmt=WPA-EAP pairwise=CCMP eap=TLS identity="radius" ca_cert="/home/work/ca.crt" client_cert="/home/work/wifi_client.crt" private_key="/home/work/wifi_client.key" private_key_passwd="" priority=1 } freeradius relevant section: tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 pem_file_type = yes private_key_file = "/etc/raddb/certs/win/server.key" //generated from sub_ca certificate_file = "/etc/raddb/certs/win/server.crt" //generated from sub_ca CA_file = "/etc/raddb/certs/win/ca.crt" //concatenated ca.crt + sub_ca.crt from windows store dh_file = "/etc/raddb/certs/dh" //generated by makefile random_file = "/etc/raddb/certs/random" //generated by makefile fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" } Note: Server.crt and client.crt has all necessary extensions(OIDs) - TLS Web Server Authentication and TLS Web Client Authentication My question - is it able to organize such scheme - freeradius + windows certificate center? Is client.crt MUST be issued by server.crt or they both MAY be issued by higher level ca, like Active Directory does? If this has been discussed before - please, point me in right direction.

1 1