- Freeradius-Users - lists.freeradius.org

PEAP + EAP-TLS: client certificates
by Vieri 22 Oct '09

22 Oct '09

Hi, Sorry for the trivial questions but here I go: I think I configured freeradius correctly for EAP-TLS and PEAP with ms-chap with authenticates using the ntlm_auth helper application. If I try to connect from a Windows client via a wireless AP "WIFIAP1" with Active Directory "user1" I see this in the log: Thu Oct 22 10:05:49 2009 : Auth: Login OK: [user1/<via Auth-Type = EAP>] (from client WIFIAP1 port 0 via TLS tunnel) Thu Oct 22 10:05:49 2009 : Auth: Login OK: [user1/<via Auth-Type = EAP>] (from client WIFIAP1 port 48 cli 001a73f7f0f7) Dumb question: does this mean the client used PEAP to connect? Can I deduce this from "Auth-Type = EAP" and from "via TLS tunnel"? If connected via PEAP, authentication is "secure". However, I'd like to know if the data exchanged between the clients and the rest of the LAN via the Access Point is also encrypted and "cannot be sniffed". Does this "data encryption" depend only on the AP's encryption settings (eg. AES) and does FreeRadius get out of this equation after authentication? If I install a self-signed certificate on another Windows client and connect via EAP-TLS then I can connect without having to use an Active Directory user, as expected. I'm wondering if I can *require* both a certificate on the client machine AND an AD user authentication. In other words, how can I *require* PEAP-EAP-TLS? (currently, my freeradius configuration seems to require PEAP OR EAP-TLS) Freeradius version: 2.0.5 Thanks, Vieri

2 5

problem with default configuration in 2.0.4-3 version
by Ana Gallardo 22 Oct '09

22 Oct '09

Hello, I have installed debian lenny with freeradius 2.0.4-3: /etc/freeradius# dpkg -l | grep freeradius hi freeradius 2.0.4-3 a high-performance and highly configurable RADIUS server hi freeradius-common 2.0.4-3 FreeRadius common files hi freeradius-ldap 2.0.4-3 LDAP module for FreeRADIUS server hi freeradius-mysql 2.0.4-3 MySQL module for FreeRADIUS server hi freeradius-utils 2.0.4-3 FreeRadius client utilities hi libfreeradius-dev 2.0.4-3 FreeRADIUS shared library development files hi libfreeradius2 2.0.4-3 FreeRADIUS shared library and I can't run the default configuration following this instructions http://deployingradius.com/documents/configuration/pap.html Here is my debug information: /etc/freeradius# freeradius -X FreeRADIUS Version 2.0.4, for host x86_64-pc-linux-gnu, built on Oct 20 2009 at 11:45:11 Copyright (C) 1999-2008 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including configuration file /etc/freeradius/proxy.conf including configuration file /etc/freeradius/clients.conf including configuration file /etc/freeradius/snmp.conf including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 allow_core_dumps = no pidfile = "/var/run/freeradius/freeradius.pid" user = "freerad" group = "freerad" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes security { max_attributes = 200 reject_delay = 1 status_server = yes } } client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 zombie_period = 40 status_check = "status-server" ping_check = "none" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating exec exec { wait = yes input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating expr Module: Linked to module rlm_expiration Module: Instantiating expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server { modules { } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 53599, id=186, length=55 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Login incorrect: [bob/hello] (from client localhost port 0) Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 186 to 127.0.0.1 port 53599 Waking up in 4.9 seconds. Cleaning up request 0 ID 186 with timestamp +4 Ready to process requests. My request: $ radtest bob hello localhost 0 testing123 Sending Access-Request of id 186 to 127.0.0.1 port 1812 User-Name = "bob" User-Password = "hello" NAS-IP-Address = 127.0.1.1 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=186, length=20 Thankyou very much and sorry for my english -- ____________________ Ana Gallardo Gómez ____________________

2 2

mschap problem
by Paolo Barbato 22 Oct '09

22 Oct '09

I've configured freeradius to authenticate local users with our AD. When I use simple username "barbato" it works perfectly, but if I use barbato(a)igi.cnr.it it fails. From log it seems that it's not stripped the realm/domain part after @: [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for barbato(a)igi.cnr.it with NT-Password [mschap] expand: --username=%{mschap:User-Name} -> --username=barbato(a)igi.cnr.it [mschap] mschap2: b9 [mschap] expand: --challenge=%{mschap:Challenge:-00} -> -- challenge=4e0cb755e2e70d10 [mschap] expand: --nt-response=%{mschap:NT-Response:-00} -> --nt- response=a0e03bda2615311436749b892e3a741d7a8605a1037fcce1 Exec-Program output: Logon failure (0xc000006d) I use this line for radius.conf : ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=% {mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=% {mschap:NT-Response:-00}" and in proxy.conf realm igi.cnr.it { type = radius authhost = LOCAL accthost = LOCAL strip } Regards, Paolo. ------------------------------------------------------------------------------------------------ Paolo Barbato email: mailto:paolo.barbato@igi.cnr.it Network Administrator phone: (39-049)-829-5097 (39-049)-829-5000 Corso Stati Uniti,4 www: http://www.igi.cnr.it 35127 Camin-Padova PGP: http://www.igi.cnr.it/wwwpgp/rfx_paolo_barbato.pgp ITALY JabberID: rfx_paolo_barbato(a)messenger.efda.org ------------------------------------------------------------------------------------------------

2 3

how to call an external script once the users is expired?
by aangles 22 Oct '09

22 Oct '09

hello, please i need to know how to call an external script one the users is expired. I got radius call an external script once the user is authenticated with success by using the echo module, but now I need to call another script when the user tries to connect after expiration date. Any ideas? thanks a lot -- View this message in context: http://www.nabble.com/how-to-call-an-external-script-once-the-users-is-expi… Sent from the FreeRadius - User mailing list archive at Nabble.com.

2 3

Re:
by INACIO ALVES 22 Oct '09

22 Oct '09

Thanks Alan DeKok, but I have some questions. > So, how I said in the last post, > the HOW_TO about SQL is out-of-date. The tables has name/schema changed. > But I will have success. All of this is documented in the config files. I search in the config files but I don't find nothing about this changes. In the sql directory have only the schemas to databases, and in the sql.conf file have only the configurations to access the database. See raddb/sites-available/dhcp, and modules/mac2ip Don't have problems in use this options? I read that it is in experimental stage. I think that this can break my server. No more, thanks Inácio Alves http://www.polluxweb.com/inacioalves/site

2 1

Re: Counting Packets
by Alan DeKok 22 Oct '09

22 Oct '09

Stefan A. wrote: > Is there a function available to report the number of packets the RADIUS > Server handles at a given time? SNMP, statistics via radius (raddb/sites-available/status), or radmin. See also scripts/freeradius* for Munin plugins that can do graphing. Alan DeKok.

1 0

RE: Building a test tool
by Vinit Karandikar 22 Oct '09

22 Oct '09

Not sure how radclient will help, Tim. Based on my limited exposure, I get the impression that I can use radclient to simulate 1 network element (like the PDSN). I'm trying to simulate 10 different ones simultaneously. As mentioned in my initial email, I need the tool to simulate the PDSN, the Pre-Paid Server and hosts of other network elements (possibly 10 such like the Foreign AAA, the Carrier Exchange and so on...) Am I underestimating what the radclient can do ? > Message: 2 > Date: Mon, 1 Jun 2009 11:34:19 -0700 > From: "Tim Sylvester" <tim.sylvester(a)networkradius.com> > Subject: RE: Building a test tool > To: "'FreeRadius users mailing list'" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4a241f34.16538c0a.1328.ffffa6b7(a)mx.google.com> > Content-Type: text/plain; charset="us-ascii" > > Use the radclient tool. You can create test files that have the attributes > for the radius packets and feed them to radclient. > > NAME > radclient - send packets to a RADIUS server, show reply > > SYNOPSIS > radclient [-d raddb_directory] [-c count] [-f file] [-i id] [-n > num_requests_per_second] > [-p num_requests_in_parallel] [-r num_retries] [-s] [-S > shared_secret_file] [-t timeout] > [-qvx] server {acct|auth|status|disconnect|auto} secret > > DESCRIPTION > radclient is a radius client program. It can send arbitrary radius > packets to a radius > server, then shows the reply. It can be used to test changes you made > in the configura- > tion of the radius server, or it can be used to monitor if a radius > server is up. > > radclient reads radius attribute/value pairs from it standard input, > or from a file spec- > ified on the command line. It then encodes these attribute/value > pairs using the dictio- > nary, and sends them to the remote server. > > The User-Password and CHAP-Password attributes are automatically > encrypted before the > packet is sent to the server. > > Tim > > >> -----Original Message----- >> From: freeradius-users- >> bounces+tim.sylvester=networkradius.com(a)lists.freeradius.org >> [mailto:freeradius-users- >> bounces+tim.sylvester=networkradius.com(a)lists.freeradius.org] On Behalf >> Of Vinit Karandikar >> Sent: Monday, June 01, 2009 11:25 AM >> To: freeradius-users(a)lists.freeradius.org >> Subject: Building a test tool >> >> Hello folks, >> >> I'm new to Free Radius and would like to use it to build a test tool >> for >> testing a AAA server. >> >> I'd like the test tool to simulate (say) 10 network elements that talk >> to a AAA server >> - using threads on different ports that are controlled by the main >> thread. >> >> Some of these will initiate traffic to the AAA server (like the one >> simulating the PDSN). >> Others will receive traffic and talk back to the AAA server (like the >> one simulating the Pre-paid Server). >> >> I'm sure I'm not going to find something like this in the wild. So I'm >> planning to write code to do the above. >> >> I was wondering if there are bits of code that I can shamelessly pilfer >> from or use as a starting point. >> >> Any tips are plenty welcome... >> >> Thanks in advance to all, >> -Vinit >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > >

3 2

rlm_python and post-auth manipulation.
by phil lemelin 21 Oct '09

21 Oct '09

Good day Freeradius users, I am trying to use the rlm_python module to do additional actions after an user has been authenticated. To learn, I'm using the radiusd_test.py which is in the python path. I haven't found an indication that says it is impossible to do, correct me if I'm wrong off-course. I did the following ( by the way, i made sure rlm_python was compiled with the server ) : Created a python module under "modules" : python { > > mod_instantiate = radiusd_test > func_instantiate = instantiate > > mod_authorize = radiusd_test > func_authorize = authorize > > mod_accounting = radiusd_test > func_accounting = accounting > > mod_preproxy = radiusd_test > func_preproxy = preproxy > > mod_postproxy = radiusd_test > func_postproxy = postproxy > > mod_postauth = radiusd_test > func_postauth = postauth > > mod_detach = radiusd_test > func_detach = detach > } > Added "python" in the site-enabled/default "post-auth" section Now, in the radiusd -X log, I can see the following : Module: Instantiating python > python_init done > python { > mod_instantiate = "radiusd_test" > func_instantiate = "instantiate" > mod_authorize = "radiusd_test" > func_authorize = "authorize" > mod_accounting = "radiusd_test" > func_accounting = "accounting" > mod_detach = "radiusd_test" > func_detach = "detach" > } > *** instantiate *** > *Ok, i'm missing the postauth, why ?* The radiusd_test.py file has a postauth function which I think should be linked by my python modules declaration. Finnaly, in the log, I have the following : /usr/local/etc/raddb/sites-enabled/default[422]: "python" modules aren't > allowed in 'post-auth' sections -- they have no such method. > /usr/local/etc/raddb/sites-enabled/default[380]: Errors parsing post-auth > section. > Is this caused because I can't use python modules in post-auth sections, or I can't use THAT python module because it is missing the post-auth method ? Feel free to point me in the right documentation section that I MUST have missed. -- Philippe-Alexandre Lemelin

3 9

RE:
by INACIO ALVES 21 Oct '09

21 Oct '09

> But, how I said, I don't need proxy, Then I have commented the line proxy > proxy_requests = no > #$INCLUDE proxy.conf ... and broke the server (inner-tunnel processing). Well done! Now put it back the way it was. I read in the radiusd.conf # The server has proxying turned on by default. If your system is NOT # set up to proxy requests to another server, then you can turn proxying # off here. This will save a small amount of resources on the server. then I disable the proxy. But in the next line have # If you have proxying turned off, and your configuration files say # to proxy a request, then an error message will be logged. How I can turn off the proxy and my config file say proxy request? I think was this that broke my server. P.S. I have returned to default donfiguration proxy_requests = yes $INCLUDE proxy.conf Inácio Alves http://www.polluxweb.com/inacioalves/site

1 0

Invitation to connect on LinkedIn
by Nelson Acero Fino 21 Oct '09

21 Oct '09

LinkedIn ------------ Nelson Acero Fino requested to add you as a connection on LinkedIn: ------------------------------------------ Glen, I'd like to add you to my professional network on LinkedIn. - Nelson Accept invitation from Nelson Acero Fino http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… View invitation from Nelson Acero Fino http://www.linkedin.com/e/ABSVWpZ1_sZ_yf9BG_W25ECMqsoijRbBG-E27EnW_z6-V09s3… ------------------------------------------ Why might connecting with Nelson Acero Fino be a good idea? People Nelson Acero Fino knows can discover your profile: Connecting to Nelson Acero Fino will attract the attention of LinkedIn users. See who's been viewing your profile: http://www.linkedin.com/e/wvp/inv18_wvmp/ ------ (c) 2009, LinkedIn Corporation

1 0