- Freeradius-Users - lists.freeradius.org

MAC authentication bypass --- How am I supposed to edit the users file to include multiple MAC addresses??
by Difan Zhao 05 Jan '10

05 Jan '10

Hey experts!! I am having another dilemma here. I am trying to configure MAC authentication bypass feature on my Cisco 3750 switch to authenticate some devices which don't support 802.1x. The way how it works is that (I figured it out by running debug on the switch and by using wireshark), if the supplicant device doesn't support 802.1x, the switch (172.17.254.100) sends a access request to the freeradius server (172.17.1.1) with username and password both are the MAC address of the device! That brings my dilemma! I have like 200 devices like this. I don't want to edit my users file with each of the MAC address as the UN/PW. Is there an easy way to write a script like thing to include all of them? The mac addresses are all start with "00:a0:08". I want a logic like: If a request is for a user with first 3 octets like the above one, use its MAC address (in this case will be also its username) as the password and grant the access. Is it possible to do it in FreeRadius 2.1.6?? I have attached the output of a success authentication for a device with MAC: 00a0080806bd. Of course I manually added this user in my users file. My users file looks like: 00a0080806bd Cleartext-Password := "00a0080806bd" I appreciate any advice!! Thank you guys!! Difan Zhao, CCNP Network Engineer difan.zhao(a)guest-tek.com www.guest-tek.com <http://www.guest-tek.com/> Office: 403-509-1010 ext 3048 Cell: 403-689-7514

5 23

how to use RSA instead of DH?
by kachin Agarwal 05 Jan '10

05 Jan '10

Hi, I m using freeradius-server 2.1.7. I ve created an openssl engine for doing all the RSA calculations and it is quite fast. But when i use the try to authenticate something it uses DH algorithm also. so how can i make use of only RSA so that my authentication rate is high. What part of the code should i change? Thanks & Regards, Kachin The INTERNET now has a personality. YOURS! See your Yahoo! Homepage. http://in.yahoo.com/

2 1

Proxy-Accounting problems
by Phil Pierotti 05 Jan '10

05 Jan '10

I've configured Freradius (2.1.7) to proxy certain realms to another box, and generally things are working as expected. Running TCPDUMP, I see: 11:54:26.205736 IP (tos 0x0, ttl 64, id 19359, offset 0, flags [none], proto UDP (17), length 518) blah.blah.blah.foo.1814 > blah.blah.blah.bar.1813: RADIUS, length: 490 Accounting Request (4), id: 0xa0, Authenticator: 01340e6ef70c9e34963da801985fba40 Accounting Session ID Attribute (44), length: 10, Value: 0003AA7A 0x0000: 3030 3033 4141 3741 Tunnel Type Attribute (64), length: 6, Value: Tag[Unused]L2TP 0x0000: 0000 0003 Tunnel Medium Attribute (65), length: 6, Value: Tag[Unused]IPv4 0x0000: 0000 0001 Tunnel Server End Attribute (67), length: 14, Value: [|radius] 0x0000: 3131 392e 3136 312e 3932 [|radius] 11:54:26.206751 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto UDP (17), length 52) blah.blah.blah.bar.1813 > blah.blah.blah.foo.1814: [udp sum ok] RADIUS, length: 24 Accounting Response (5), id: 0xa0, Authenticator: 0087779312270cdff8c88a995db9c098 Proxy State Attribute (33), length: 4, Value: 90 0x0000: 3930 Accounting request proxied to foreign server, Accounting response received from foreign server. Response packet was received, was not firewalled or otherwise blocked. However, when I issue status requests to my freeradius server, it clearly claims there are zero proxy accounting responses. FreeRADIUS-Total-Proxy-Accounting-Requests = 2302 FreeRADIUS-Total-Proxy-Accounting-Responses = 0 Regards, Phil P

2 1

Freeradius and memory usage part deux
by Roy Kartadinata 04 Jan '10

04 Jan '10

Greetings, I started this email few months back but due to other projects that took priority, I had to put this troubleshooting on hold. To recap: 1. Our radius servers are having some memory issue where its memory usage would increase by 1% every 30 - 45 minutes until it crashes and restarts. 2. I created a script that will temporarily fix the issue by monitoring its memory usage and restart after it reaches the threshold. 3. Changed detail log configuration so that it creates a new one every hour but memory usage still increasing but at a slower rate. 4. Upgraded to 2.1.6 from 2.1.5 but the problem still exist. I recently tested the latest 2.1.8 as well but still have the same issue. Our server spec is as follow: OS: CentOS (5.4) Freeradius version: 2.1.6 CPU: single quad core Xeon Memory: 4GB HD: FC drives on EMC Database: MySQL on a dedicated MySQL server We also have a simple perl module script that takes IMSI passes by our PDSN and checks it against the username. I did ran valgrind yesterday and the output is below: ==17709== Memcheck, a memory error detector. ==17709== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al. ==17709== Using LibVEX rev 1658, a library for dynamic binary translation. ==17709== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP. ==17709== Using valgrind-3.2.1, a dynamic binary instrumentation framework. ==17709== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al. ==17709== For more details, rerun with: -v ==17709== ==17709== ==17709== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 78 from 1) ==17709== malloc/free: in use at exit: 3,013,615 bytes in 35,591 blocks. ==17709== malloc/free: 45,091 allocs, 9,500 frees, 3,698,764 bytes allocated. ==17709== For counts of detected errors, rerun with: -v ==17709== searching for pointers to 35,591 not-freed blocks. ==17709== checked 2,451,476 bytes. ==17709== ==17709== 5 bytes in 1 blocks are definitely lost in loss record 1 of 36 ==17709== at 0x40053C0: malloc (vg_replace_malloc.c:149) ==17709== by 0x561B2E: Perl_safesysmalloc (in /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so) ==17709== by 0x5647E7: Perl_savepvn (in /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so) ==17709== by 0x51CE15: Perl_gv_fetchpv (in /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so) ==17709== by 0x51481F: (within /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so) ==17709== by 0x518608: perl_parse (in /usr/lib/perl5/5.8.8/i386-linux-thread-multi/CORE/libperl.so) ==17709== by 0x435E393: perl_instantiate (rlm_perl.c:463) ==17709== by 0x805E8EB: find_module_instance (modules.c:501) ==17709== by 0x805FC2E: do_compile_modsingle (modcall.c:1777) ==17709== by 0x806096E: do_compile_modgroup (modcall.c:1997) ==17709== by 0x805DA21: load_component_section (modules.c:666) ==17709== by 0x805DEC4: load_byserver (modules.c:987) ==17709== ==17709== LEAK SUMMARY: ==17709== definitely lost: 5 bytes in 1 blocks. ==17709== possibly lost: 0 bytes in 0 blocks. ==17709== still reachable: 3,013,610 bytes in 35,590 blocks. ==17709== suppressed: 0 bytes in 0 blocks. ==17709== Reachable blocks (those to which a pointer was found) are not shown. ==17709== To see them, rerun with: --show-reachable=yes I hope those information helps. We also have two freeradius servers in our remote datacenter still running 2.1.2 without any issue but I don't see a point rolling back to the older version so hopefully we can fix this issue with the current version if possible. Cheers, Roy Kartadinata

2 1

2.1.8 proxy zombie/dead/alive loops
by Craig Campbell 04 Jan '10

04 Jan '10

In testing the new 2.1.8 for accounting packets I have discovered the following strange situation, There are 2 radius servers (radius-a and radius-b). Each server will relay packets it receives to the other server. (Currently only accounting packets are being received) The packets are collected in detail-relay file. The packets are then relayed via the sites/enabled/copy-acct-to-home-server config. What I observe is a single packet being read from the detail-relay.work file on radius-b and being sent radius-a. I do not see any response from radius-a being returned to radius-b. After what seems to be about 30 seconds the packet is resent from radius-b to radius-a. Again and again... On radius-b the following messages are logged (status_check = status-server).... Mon Jan 4 10:10:15 2010 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Jan 4 10:10:15 2010 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:/radius Mon Jan 4 10:10:15 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jan 4 10:10:15 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jan 4 10:10:15 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jan 4 10:10:15 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jan 4 10:10:15 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jan 4 10:10:15 2010 : Info: Loaded virtual server inner-tunnel Mon Jan 4 10:10:15 2010 : Info: Loaded virtual server copy-acct-to-home-server Mon Jan 4 10:10:15 2010 : Info: Loaded virtual server <default> Mon Jan 4 10:10:15 2010 : Info: Ready to process requests. Mon Jan 4 10:10:42 2010 : Proxy: Marking home server 192.168.1.225 port 1813 as zombie (it looks like it is dead). Mon Jan 4 10:10:42 2010 : Proxy: Received response to status check 5938 (1 in current sequence) Mon Jan 4 10:11:11 2010 : Proxy: Received response to status check 6013 (2 in current sequence) Mon Jan 4 10:11:40 2010 : Proxy: Received response to status check 6048 (3 in current sequence) Mon Jan 4 10:11:40 2010 : Proxy: Marking home server 192.168.1.225 port 1813 alive Mon Jan 4 10:11:43 2010 : Proxy: Marking home server 192.168.1.225 port 1813 as zombie (it looks like it is dead). Mon Jan 4 10:11:43 2010 : Proxy: Received response to status check 6051 (4 in current sequence) Mon Jan 4 10:11:43 2010 : Proxy: Marking home server 192.168.1.225 port 1813 alive Mon Jan 4 10:12:13 2010 : Proxy: Marking home server 192.168.1.225 port 1813 as zombie (it looks like it is dead). Mon Jan 4 10:12:13 2010 : Proxy: Received response to status check 6086 (5 in current sequence) Mon Jan 4 10:12:13 2010 : Proxy: Marking home server 192.168.1.225 port 1813 alive Mon Jan 4 10:12:44 2010 : Proxy: Marking home server 192.168.1.225 port 1813 as zombie (it looks like it is dead). Mon Jan 4 10:12:44 2010 : Proxy: Received response to status check 6118 (6 in current sequence) Mon Jan 4 10:12:44 2010 : Proxy: Marking home server 192.168.1.225 port 1813 alive Mon Jan 4 10:13:14 2010 : Proxy: Marking home server 192.168.1.225 port 1813 as zombie (it looks like it is dead). Mon Jan 4 10:13:14 2010 : Proxy: Received response to status check 6153 (7 in current sequence) Mon Jan 4 10:13:14 2010 : Proxy: Marking home server 192.168.1.225 port 1813 alive On radius-a for the same time frame... Mon Jan 4 10:11:55 2010 : Proxy: Marking home server 192.168.1.226 port 1813 as zombie (it looks like it is dead). Mon Jan 4 10:11:55 2010 : Proxy: Received response to status check 669399 (6 in current sequence) Mon Jan 4 10:11:55 2010 : Proxy: Marking home server 192.168.1.226 port 1813 alive I then tried using the alternate "status_check = request " method, but I think I have it configured incorrectly since it is also not receiving a reply... Mon Jan 4 11:52:16 2010 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Mon Jan 4 11:52:16 2010 : Info: rlm_sql (sql): Attempting to connect to radiusd@localhost:/radius Mon Jan 4 11:52:16 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Mon Jan 4 11:52:16 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #1 Mon Jan 4 11:52:16 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #2 Mon Jan 4 11:52:16 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3 Mon Jan 4 11:52:16 2010 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4 Mon Jan 4 11:52:16 2010 : Info: Loaded virtual server inner-tunnel Mon Jan 4 11:52:16 2010 : Info: Loaded virtual server copy-acct-to-home-server Mon Jan 4 11:52:16 2010 : Info: Loaded virtual server <default> Mon Jan 4 11:52:16 2010 : Info: Ready to process requests. Mon Jan 4 11:52:43 2010 : Proxy: Marking home server 192.168.1.225 port 1813 as zombie (it looks like it is dead). Mon Jan 4 11:52:44 2010 : Info: [sql] stop packet with zero session length. [user 'test_user_please_reject_me', nas '192.168.1.226'] Mon Jan 4 11:52:47 2010 : Error: No response to status check 5969 for home server 192.168.1.225 port 1813 Mon Jan 4 11:53:13 2010 : Info: [sql] stop packet with zero session length. [user 'test_user_please_reject_me', nas '192.168.1.226'] Mon Jan 4 11:53:16 2010 : Error: No response to status check 6007 for home server 192.168.1.225 port 1813 Mon Jan 4 11:53:43 2010 : Proxy: Marking home server 192.168.1.225 port 1813 as dead. Mon Jan 4 11:53:46 2010 : Info: [sql] stop packet with zero session length. [user 'test_user_please_reject_me', nas '192.168.1.226'] on radius-a, for status_check=request I added to acct_user, test_user_please_reject_me Auth-Type := Reject Reply-Message = "Status check only", Fall-Through = No I suspect I SHOULD be using status_check=status-server. Which then leads to why my server keeps getting marked as zombie/dead/alive.... It seems like the accounting stop packet being sent is not generating a reply...? Below is the only packet being sent... again and again.... Mon Jan 4 11:53:45 2010 Acct-Status-Type = Stop User-Name = "not_real_id@somerealm" Event-Timestamp = "Dec 31 2009 15:41:36 DST" Acct-Delay-Time = 331887 NAS-Identifier = "ERX-2" Acct-Session-Id = "0378168264" NAS-IP-Address = 192.168.1.101 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = None ERX-Pppoe-Description = "pppoe 00:1d:68:ec:ee:64" Framed-IP-Address = 66.247.201.49 Framed-IP-Netmask = 255.255.255.255 ERX-Ingress-Policy-Name = "SOMEREALM_UP" ERX-Egress-Policy-Name = "SOMEREALM_DOWN" Calling-Station-Id = "ERX-08000000283" Acct-Input-Gigawords = 0 Acct-Input-Octets = 96 Acct-Output-Gigawords = 0 Acct-Output-Octets = 60 ERX-Input-Gigapkts = 0 Acct-Input-Packets = 0 ERX-Output-Gigapkts = 0 Acct-Output-Packets = 0 NAS-Port-Type = Ethernet NAS-Port = 2147483931 NAS-Port-Id = "GigabitEthernet 8/0.283:283" Acct-Authentic = RADIUS Acct-Session-Time = 0 Acct-Terminate-Cause = User-Request Proxy-State = 0x3534313734 Acct-Unique-Session-Id = "038113f04620fe75" Timestamp = 1262620425 Request-Authenticator = Verified I'm not certain what additional info would be helpful at this point. Thanks, -craig -------------------------------------------------------------------------------- Craig Campbell craig.campbell(a)ccraft.ca CampbellCraft Consulting Inc 2 Kenny Court Whitby, Ontario Canada L1R 2L8 905 922-2789 __________ Information from ESET Smart Security, version of virus signature database 4743 (20100104) __________ The message was checked by ESET Smart Security. http://www.eset.com

2 1

Re: Default reply for username incorrect-s
by Alex M 04 Jan '10

04 Jan '10

Ok I think i got the idea, will no go and try it out! thank you! as to 2nd reply, yes my NAS supports Reply-Messages 2010/1/4 Charles (KOL-Goma) <charles(a)goma.kivu-online.com> > Does your NAS support the option? > > ----- Original Message ----- > *From:* EasyHorpak.com <info(a)easyhorpak.com> > *To:* FreeRadius users mailing list<freeradius-users(a)lists.freeradius.org> > *Sent:* Monday, January 04, 2010 6:27 AM > *Subject:* Re: Default reply for username incorrect-s > > Alex M wrote: > > Happy New Year to you all! > I have quick question: How can I send default reply to all users that have > incorrect username / password combination, right now FR just rejects them > w/o any message. > I use MySQL i tried to add DEFAULT as user name in rad reply but that did > not help :( > Hope some one can help me? > > TNX > > ------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > try this man http://www.easyzonecorp.net/network/view.php?ID=1038 > it 's only accept not found username. > > for wrong password you must use unlang > > try this > > http://www.easyzonecorp.net/network/view.php?ID=1042 > > > > > -- > http://www.EasyHorpak.com - > แหล่งค้นหาหอพัก,อพาร์ทเมนท์,แมนชั่น,คอนโด,โรงแรม > http://www.EasyZoneCorp.net - ซอฟแวร์จัดการ internet คุณภาพสูง Hotpsot และ > PPPoE ,Anti NetCut, Mac spoof > http://www.thai-school.net - เว็บไซต์โรงเรียน,ศิษย์เก่า สำเร็จรูป > EasyZone SuperLink <http://www.easyhorpak.com/superlink>- > แลกหมื่นลิ้งคืในคลิ๊กเดียว > > ________________________________________________________________ > > 5 free Domains with Select Hosting Plans. Get yours! > com net org info us name biz cc tv ws mobi > > ------------------------------ > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > __________________________________________________ > Buy a domain : http://www.1and1.com/?k_id=25085883 > > ________________________________________________________________ > > 5 free Domains with Select Hosting Plans. Get yours! > com net org info us name biz cc tv ws mobi > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

two user authentication groups for one AS
by Eric 04 Jan '10

04 Jan '10

My users differ in ldap attributes and all come from one AS. I want session-timeout of some users to be the value of counter and for others the session-timeout that I define in freeradius for them. How should I distinct them?

1 0

Dear Freeradius-Users, If you can't find it anywhere, try JUSTDIAL.COM
by Duraivelanc 04 Jan '10

04 Jan '10

Dear Freeradius-Users,I strongly recommend this website www.justdial.com. It's a world class local search service & I've always found anything I've ever wanted.You can find info on any company, product, or service in over 240 cities in India.You can also call them up 24x7, on phone (69999999), a local call in 240 Indian cities.Ask for anything, you'll get the info on the phone and/or by SMS within 30 secs, and this service is at no cost!For a change, it's an original Indian idea and an Indian company with world class service, and with a vision to spread all over the world.Be a proud Indian and forward this to every Indian you know.Best Wishes,DuraivelancClick Here to unsubscribe.

2 1

Default reply for username incorrect-s
by Alex M 04 Jan '10

04 Jan '10

Happy New Year to you all! I have quick question: How can I send default reply to all users that have incorrect username / password combination, right now FR just rejects them w/o any message. I use MySQL i tried to add DEFAULT as user name in rad reply but that did not help :( Hope some one can help me? TNX

2 1

two user authentication groups for one AS
by Eric 02 Jan '10

02 Jan '10

Hi There is one VPN server that I want to authenticate some of its users with ldap-1 and others with ldap-2. how should I differ them? I defined: DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-1, Autz-Type := Vpn DEFAULT Client-IP-Address == 192.168.200.21, Auth-Type := ldap-2, Autz-Type := Vpn but it only sees first line.

3 8