- Freeradius-Users - lists.freeradius.org

Re: Freeradius-Users Digest, Vol 51, Issue 30
by gayathri reddy 09 Jul '09

09 Jul '09

Hi Kalik, Thanks for your help... Now i can send two Qos profiles and it's working fine. Thanks, Gayathri On Wed, Jul 8, 2009 at 3:30 PM, < freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: freeradius active directory integration fails with "no > such realm" (Andrei-Florian Staicu) > 2. Re: want to authorise but not authenticate (Arran Cudbard-Bell) > 3. Re: want to authorise but not authenticate (Ivan Kalik) > 4. Re: How to configure 2 wimax qos profiles for the user in > users file (Ivan Kalik) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Wed, 08 Jul 2009 12:31:21 +0300 > From: Andrei-Florian Staicu <andrei.staicu(a)gmail.com> > Subject: Re: freeradius active directory integration fails with "no > such realm" > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A546769.8020709(a)googlemail.com> > Content-Type: text/plain; charset=ISO-8859-2; format=flowed > > Alan DeKok wrote: > > Andrei-Florian Staicu wrote: > > > >> Hello again. I've reached the output from here: > >> http://pastebin.com/d19f28a24 , and i still don't understand why it > >> doesen't call the ntlm_auth line > >> > > > > It looks like you are adding a "Proxy-To-Realm := LOCAL". > > > > ... > > > >> PEAP: Sending tunneled request > >> EAP-Message = > >> 0x02060018014950534f305c616e647265692e737461696375 > >> FreeRADIUS-Proxied-To = 127.0.0.1 > >> User-Name = "IPSO0\\andrei.staicu" > >> server inner-tunnel { > >> +- entering group authorize > >> rlm_realm: Looking up realm "IPSO0" for User-Name = > >> "IPSO0\andrei.staicu" > >> rlm_realm: Found realm "IPSO0" > >> rlm_realm: Adding Stripped-User-Name = "andrei.staicu" > >> rlm_realm: Adding Realm = "IPSO0" > >> rlm_realm: Authentication realm is LOCAL. > >> ++[ntdomain] returns noop > >> ++[mschap] returns noop > >> ++[control] returns noop > >> > > > > Why is that "update control" section there? What is in it? > > > > > > > >> rlm_eap: Request is supposed to be proxied to Realm LOCAL. Not doing > >> > > EAP. > > > > It's being proxied to realm LOCAL. You have added a LOCAL realm. > > Don't do that. > > > > > >> ++[eap] returns noop > >> WARNING: You set Proxy-To-Realm = LOCAL, but the realm does not > >> exist! Cancelling invalid proxy request. > >> > > > > Even more proof. The IPSO0 realm above is added because it exists. > > The server does NOT add a "Proxy-To-Realm := LOCAL". You have done > > that. Delete it from your configuration. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > It works now. Thank you very much for clearing thing up for me. > > > ------------------------------ > > Message: 2 > Date: Wed, 08 Jul 2009 10:33:22 +0100 > From: Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk> > Subject: Re: want to authorise but not authenticate > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A5467E2.5040309(a)sussex.ac.uk> > Content-Type: text/plain; charset=UTF-8; format=flowed > > On 8/7/09 10:19, A.L.M.Buxey(a)lboro.ac.uk wrote: > > hi, > > > > heres one for a wednesday morning. > > > > > > we have a system that we've been done plain authorizations > > via FreeRADIUS - the device sends the following RADIUS request > > > > username: userid > > password: userid > > > > (ie the system sends the username and makes the password the same) > > > > okay. fair enough....a bit of unlang and a check that if the username = > password > > then set the Auth-Type to something false et voila. all okay. > > > > > > it has now been decided to also do authentication via RADIUS > > and this is where things get messy. > > > > > > by removing the Auth-Type kludge, we can successfully authenticate > > a real user with their real password.... however, the authorization > > now fails because the device still sends username/password with > > the password the same as the username - this now hits the > > FreeRADIUS server which cannot find a valid Auth-Type for the user > > and thus fails authentication and therefore sends back a 'blurgh' > > to the box requesting authorization. > > authorize { > if((User-Name == User-Password) && %{ldap:etc...}){ > update control { > Auth-Type := 'NULL' > } > } > else { > // Authentication modules > } > } > > > Auth-Type NULL { > ok > } > > > > > this is to be expected because there is nothing in the request to > > distoniguish between an authorization request and an authentication > > request. > > > > so the question is, how do we handle this so that the system can > > send a username=password for authorization AND a proper authentication > > can happen WITHOUT (hers a gotcha) the user doing something cute > > like putting their username in as their password! ;-) > > Slightly confused as to what you want... Try again without the caffeine ? > > Arran > > -- > Arran Cudbard-Bell <A.Cudbard-Bell(a)sussex.ac.uk>, > Systems Administrator (AAA), > Infrastructure Services (IT Services), > E1-1-08, Engineering 1, University Of Sussex, Brighton, BN1 9QT > DDI+FAX: +44 1273 873900 | INT: 3900 > GPG: 86FF A285 1AA1 EE40 D228 7C2E 71A9 25BB 1E68 54A2 > > > ------------------------------ > > Message: 3 > Date: Wed, 8 Jul 2009 10:35:04 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: want to authorise but not authenticate > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <10825.194.176.105.43.1247045704.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > > > we have a system that we've been done plain authorizations > > via FreeRADIUS - the device sends the following RADIUS request > > > > username: userid > > password: userid > > > > (ie the system sends the username and makes the password the same) > > > > okay. fair enough....a bit of unlang and a check that if the username = > > password > > then set the Auth-Type to something false et voila. all okay. > > > > > > it has now been decided to also do authentication via RADIUS > > and this is where things get messy. > > > > > > by removing the Auth-Type kludge, we can successfully authenticate > > a real user with their real password.... however, the authorization > > now fails because the device still sends username/password with > > the password the same as the username - this now hits the > > FreeRADIUS server which cannot find a valid Auth-Type for the user > > and thus fails authentication and therefore sends back a 'blurgh' > > to the box requesting authorization. > > > > this is to be expected because there is nothing in the request to > > distoniguish between an authorization request and an authentication > > request. > > > > so the question is, how do we handle this so that the system can > > send a username=password for authorization AND a proper authentication > > can happen WITHOUT (hers a gotcha) the user doing something cute > > like putting their username in as their password! ;-) > > Send Service-Type = Authorize-Only in authorization request. Then you can > distinguish between the requsts. Or do authorization in the same time as > authentication. > > Without opening a major security hole. You can set Auth-Type to Accept if > User-Name = User-Password in the request but that would enable anyone to > log in knowing just username. > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > Message: 4 > Date: Wed, 8 Jul 2009 10:39:48 +0100 (BST) > From: "Ivan Kalik" <tnt(a)kalik.net> > Subject: Re: How to configure 2 wimax qos profiles for the user in > users file > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <59554.194.176.105.43.1247045988.squirrel(a)webmail.kalik.net> > Content-Type: text/plain;charset=utf-8 > > > I am trying to configure the two wimax qos profiles for the single user > as > > one for uplink and another for downlink. > > If i configure the same attributes two times, in the Access-Accept > message > > the first configured wimax attribute value only is sending but its not > > sending the same attribute again which has different value. is there any > > way > > to do this and make it work? > > http://wiki.freeradius.org/Operators > > += > > Ivan Kalik > Kalik Informatika ISP > > > > ------------------------------ > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > End of Freeradius-Users Digest, Vol 51, Issue 30 > ************************************************ >

1 0

Session-Timeout in Access-Challenge (that contains EAP-Message)
by Gong Cheng 09 Jul '09

09 Jul '09

Hi, I wonder if there is a way - not to include "Session-Timeout" value intended for Access-Accept in Access-Challenge messages? - or to configure a different Session-Timeout value for Access-Challenges (which contain EAP-Message)? This is about the following section in RFC3579 where Session-Timeout in Access-Challenge is used to influence EAP retransmission behavior. http://tools.ietf.org/html/rfc3579#section-2.3 thanks! -gong -- View this message in context: http://www.nabble.com/Session-Timeout-in-Access-Challenge-%28that-contains-… Sent from the FreeRadius - User mailing list archive at Nabble.com.

3 4

How to control a wpa_supplicant client request can only send to a hostapd NAS?
by DJ HENRY 09 Jul '09

09 Jul '09

How to control a wpa_supplicant client request can only send to a hostapd NAS? My network struct was following: RADIUS(freeradius) | | SWITCH(cisco) | | ------------------------------------------------ | | NAS1(hostapd) NAS2(hostapd) | | CLIENT1(wpa_supplicant) CLIENT2(wpa_supplicant) If the network only has the NAS1 device, the CLIENT1 can pass the authentication. When the network have two NAS device, which one is NAS1 and the other is NAS2, the CLIENT1 request can send to NAS1 and NAS2, then NAS1 and NAS2 all send the request to radius. I don't know whether CLIENT1 under NAS1 or NAS2 in radius. How to control a wpa_supplicant client request can only send to a hostapd NAS? Thank you very much! The CLIENT1 MAC: 00:0F:1E:34:28:B4 The NAS1 MAC: 00:0F:1E:34:26:50 The NAS2 MAC: 00:0f:1e:00:00:83 The CLIENT1 log -------------------------- EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:34:26:50* RX EAPOL - hexdump(len=14): 02 00 00 0a 01 00 00 0a 01 68 65 6c 6c 6f EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=1 id=0 EAP: EAP entering state RETRANSMIT EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:00:00:83* RX EAPOL - hexdump(len=46): 02 00 00 16 01 01 00 16 04 10 e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: EAP entering state GET_METHOD EAP: initialize selected EAP method (4, MD5) CTRL-EVENT-EAP-METHOD EAP method 4 (MD5) selected EAP: EAP entering state METHOD EAP-MD5: Challenge - hexdump(len=16): e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb EAP-MD5: generating Challenge Response EAP-MD5: Response - hexdump(len=16): 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 01 00 16 04 10 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=26): 02 00 00 16 01 01 00 16 04 10 02 c8 6c 9b 31 7d 34 bc 09 6a 0f f2 c3 a8 01 54 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: AS used the same Id again, but EAP packets were not identical EAP: workaround - assume this is not a duplicate packet EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=8): 02 00 00 04 04 01 00 04 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:00:00:83 RX EAPOL - hexdump(len=46): 02 00 00 04 03 01 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS The NAS1 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.03 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 44 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: authentication failed The NAS2 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.02 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 63 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.01 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: old identity '00:0F:1E:34:28:B4' updated with User-Name from Access-Accept '00:0F:1E:34:28:B4' br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=3 id=1 len=4) from RADIUS server: EAP Success The RADIUS log -------------------------- rad_recv: Access-Request packet from host 192.168.1.45 port 1024, id=0, length=168 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.45 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-34-26-50:*" Calling-Station-Id = "*00-0F-1E-34-28-B4*" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000160130303a30463a31453a33343a32383a4234 Message-Authenticator = 0xdfe32c5308f652199fc3f87459b2f8b8 +- entering group authorize {...} rad_recv: Access-Request packet from host 192.168.1.44 port 1024, id=1, length=186 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.44 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-00-00-83:*" Calling-Station-Id = "*00-0F-1E-34-28-B4"* Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604107d5ea6ea11c7d9aded44a4b961b5ab41 State = 0x532668a453276c3283f462034e3542a3 Message-Authenticator = 0x98ac376bdacceb01003f6f6bb9604f9c +- entering group authorize {...} Sending Access-Accept of id 1 to 192.168.1.44 port 1024 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00:0F:1E:34:28:B4"

1 0

How to control a wpa_supplicant client request can only send to a hostapd NAS?
by DJ HENRY 09 Jul '09

09 Jul '09

How to control a wpa_supplicant client request can only send to a hostapd NAS? My network struct was following: RADIUS(freeradius) | | SWITCH(cisco) | | ------------------------------------------------ | | NAS1(hostapd) NAS2(hostapd) | | CLIENT1(wpa_supplicant) CLIENT2(wpa_supplicant) If the network only has the NAS1 device, the CLIENT1 can pass the authentication. When the network have two NAS device, which one is NAS1 and the other is NAS2, the CLIENT1 request can send to NAS1 and NAS2, then NAS1 and NAS2 all send the request to radius. I don't know whether CLIENT1 under NAS1 or NAS2 in radius. How to control a wpa_supplicant client request can only send to a hostapd NAS? Thank you very much! The CLIENT1 MAC: 00:0F:1E:34:28:B4 The NAS1 MAC: 00:0F:1E:34:26:50 The NAS2 MAC: 00:0f:1e:00:00:83 The CLIENT1 log -------------------------- EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:34:26:50* RX EAPOL - hexdump(len=14): 02 00 00 0a 01 00 00 0a 01 68 65 6c 6c 6f EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=1 id=0 EAP: EAP entering state RETRANSMIT EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:00:00:83* RX EAPOL - hexdump(len=46): 02 00 00 16 01 01 00 16 04 10 e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: EAP entering state GET_METHOD EAP: initialize selected EAP method (4, MD5) CTRL-EVENT-EAP-METHOD EAP method 4 (MD5) selected EAP: EAP entering state METHOD EAP-MD5: Challenge - hexdump(len=16): e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb EAP-MD5: generating Challenge Response EAP-MD5: Response - hexdump(len=16): 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 01 00 16 04 10 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=26): 02 00 00 16 01 01 00 16 04 10 02 c8 6c 9b 31 7d 34 bc 09 6a 0f f2 c3 a8 01 54 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: AS used the same Id again, but EAP packets were not identical EAP: workaround - assume this is not a duplicate packet EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=8): 02 00 00 04 04 01 00 04 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:00:00:83 RX EAPOL - hexdump(len=46): 02 00 00 04 03 01 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS The NAS1 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.03 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 44 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: authentication failed The NAS2 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.02 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 63 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.01 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: old identity '00:0F:1E:34:28:B4' updated with User-Name from Access-Accept '00:0F:1E:34:28:B4' br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=3 id=1 len=4) from RADIUS server: EAP Success The RADIUS log -------------------------- rad_recv: Access-Request packet from host 192.168.1.45 port 1024, id=0, length=168 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.45 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-34-26-50:*" Calling-Station-Id = "*00-0F-1E-34-28-B4*" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000160130303a30463a31453a33343a32383a4234 Message-Authenticator = 0xdfe32c5308f652199fc3f87459b2f8b8 +- entering group authorize {...} rad_recv: Access-Request packet from host 192.168.1.44 port 1024, id=1, length=186 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.44 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-00-00-83:*" Calling-Station-Id = "*00-0F-1E-34-28-B4"* Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604107d5ea6ea11c7d9aded44a4b961b5ab41 State = 0x532668a453276c3283f462034e3542a3 Message-Authenticator = 0x98ac376bdacceb01003f6f6bb9604f9c +- entering group authorize {...} Sending Access-Accept of id 1 to 192.168.1.44 port 1024 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00:0F:1E:34:28:B4"

1 0

pam_radius_auth for big endian
by maxim maxim 08 Jul '09

08 Jul '09

I try to authenticate on sshd through pam by the pam_radius_auth, my platform is based on PowerPc(big endian). After changes in md5 file i accepted authentication is ok on the radius server, but my side of sshd is failed( i don't succeed to accept the session when i try to connect to sshd ) with log error of password or shared secret is wrong.Any suggestions to solve this problem? Thanks, Maxim 2009/7/7 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > ------------------------------ > > Message: 5 > Date: Tue, 07 Jul 2009 16:57:31 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: pam_radius_auth for big endian > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A53625B.2040909(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > maxim maxim wrote: > > How i can to fix pam_radius_auth for big endian platform? > > The module works (or should) on big endian systems. See md5.c for > sparc/mips configuration. > > Alan DeKok. > > > ------------------------------ > > >

1 0

realm in User-Name stripped in accounting data?
by ST Wong (ITSC) 08 Jul '09

08 Jul '09

Hi all, We setup proxy (on freeradius 2.1.3) by putting following lines in users and acct_users: DEFAULT Huntgroup-Name == Aruba, Aruba-Essid-Name == "Univ WiFi", Realm != "localream.mydomain", Proxy-to-realm := "remoteRealm" Authentication works properly while User-Name in accounting data, the @realm part is removed. However, there is no problem for other 'simple' proxy settings (only define realm in proxy.conf, without Proxy-to-realm). We're using LDAP as authentication backend. Would anyone please advise if we can keep the @realm part in all accounting data? Thanks a lot. /ST Wong

2 2

Fallback LDAP Attribute Value
by Steven Carr 08 Jul '09

08 Jul '09

Hi list, I have the following line in my ldap.attrmap file to pull back a users VLAN assignment: > replyItem Tunnel-Private-Group-ID destinationIndicator The users file contains the following: > DEFAULT Ldap-Group == "allowed-access" > Service-Type = Framed-User, > Tunnel-Type = "VLAN", > Tunnel-Medium-Type = "IEEE-802" For the users which are in the "allowed-access" group those which have a value in the destinationIndicator attribute in LDAP work OK and are flipped into the appropriate VLAN. How do I specify a fallback so that if the user does not have this attribute set or it is empty then they are put into VLAN 666 for example. Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953

3 19

Re: Re: Session-Timeout in Access-Challenge (that contains EAP-Message)
by David Mitton 08 Jul '09

08 Jul '09

Alan, They most certainly do! I just debugged a case where the Cisco 1200 takes the 30s Session-Timeout that the Microsoft IAS server sends and treats it as a response timeout. (It then aborts the authentication, which I believe is wrong, but that's another story) When doing a SecurID authentication with user input of a 60s token OTP, the default 30s is "inadequate". Cisco does document the way to extend or override this behavior. The Session-Timeout on Access-Challenges for EAP should be a separate "design" somehow. In the older MS RasEap API, it was crudely based on on the type of Send action the EAP server used. In the newer MS EAPHost API, the EAP server code has direct control. I don't know how your EAP modules interface to the RADIUS server proper, but a method that is expecting interactive user control _will_ want to create some slack here. Not all EAP methods complete in short time. Dave. On Jul 8, 2009, aland(a)deployingradius.com wrote: Gong Cheng wrote: > Hi, > I wonder if there is a way > - not to include "Session-Timeout" value intended for Access-Accept in > Access-Challenge messages? In 2.1.7, see raddb/sites-available/default. Look for Access-Challenge. There is sample configuration. > - or to configure a different Session-Timeout value for Access-Challenges > (which contain EAP-Message)? > > This is about the following section in RFC3579 where Session-Timeout in > Access-Challenge is used to influence EAP retransmission behavior. I'm not sure any AP supports that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

ubuntu / debian rlm_python issues using mysqldb module
by Michael da Silva Pereira 08 Jul '09

08 Jul '09

Hi All, I am sure i'm not the only person experiencing this problem. It seems when using the python module to handle auth/acct. If you include the MySQLdb module in the python script freeradius then dies and is unable to load the pythong module. I am using the latest stable freeradius version 2.1.6, built for ubuntu as per http://wiki.freeradius.org/Build using fakeroot. The python script being used is the "prepaid.py" script renamed to "radiusd_test.py" in the example below. I am using the standard scripts and config from freeradius, I found a similar article regarding this and apparently has something to do with statically linking the module ? Are there any solutions for this ? Thanks, Michael Please see the log below from freeradius: Wed Jul 8 12:10:51 2009 : Info: FreeRADIUS Version 2.1.6, for host i486-pc-linux-gnu, built on Jul 7 2009 at 19:08:38 Wed Jul 8 12:10:51 2009 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Wed Jul 8 12:10:51 2009 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed Jul 8 12:10:51 2009 : Info: PARTICULAR PURPOSE. Wed Jul 8 12:10:51 2009 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed Jul 8 12:10:51 2009 : Info: GNU General Public License v2. Wed Jul 8 12:10:51 2009 : Info: Starting - reading configuration files ... Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/radiusd.conf Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/proxy.conf Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/clients.conf Wed Jul 8 12:10:51 2009 : Debug: including files in directory /etc/freeradius/modules/ Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/realm Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/radutmp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/logintime Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/counter Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/chap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/unix Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/pap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/acct_unique Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/expiration Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/digest Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/policy Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/linelog Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/checkval Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/sradutmp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/files Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/detail Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/smsotp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/preprocess Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/expr Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/sql_log Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/python Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/pam Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/attr_filter Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/ippool Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/passwd Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/mschap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/detail.log Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/inner-eap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/always Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/mac2ip Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/etc_group Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/ldap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/echo Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/wimax Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/otp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/exec Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/perl Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/krb5 Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/eap.conf Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/policy.conf Wed Jul 8 12:10:51 2009 : Debug: including files in directory /etc/freeradius/sites-enabled/ Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/control-socket Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/iburst-prepaid Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Wed Jul 8 12:10:51 2009 : Debug: group = freerad Wed Jul 8 12:10:51 2009 : Debug: user = freerad Wed Jul 8 12:10:51 2009 : Debug: including dictionary file /etc/freeradius/dictionary Wed Jul 8 12:10:51 2009 : Debug: main { Wed Jul 8 12:10:51 2009 : Debug: prefix = "/usr" Wed Jul 8 12:10:51 2009 : Debug: localstatedir = "/var" Wed Jul 8 12:10:51 2009 : Debug: logdir = "/var/log/freeradius" Wed Jul 8 12:10:51 2009 : Debug: libdir = "/usr/lib/freeradius" Wed Jul 8 12:10:51 2009 : Debug: radacctdir = "/var/log/freeradius/radacct" Wed Jul 8 12:10:51 2009 : Debug: hostname_lookups = no Wed Jul 8 12:10:51 2009 : Debug: max_request_time = 30 Wed Jul 8 12:10:51 2009 : Debug: cleanup_delay = 5 Wed Jul 8 12:10:51 2009 : Debug: max_requests = 1024 Wed Jul 8 12:10:51 2009 : Debug: allow_core_dumps = no Wed Jul 8 12:10:51 2009 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Wed Jul 8 12:10:51 2009 : Debug: checkrad = "/usr/sbin/checkrad" Wed Jul 8 12:10:51 2009 : Debug: debug_level = 0 Wed Jul 8 12:10:51 2009 : Debug: proxy_requests = yes Wed Jul 8 12:10:51 2009 : Debug: log { Wed Jul 8 12:10:51 2009 : Debug: stripped_names = no Wed Jul 8 12:10:51 2009 : Debug: auth = no Wed Jul 8 12:10:51 2009 : Debug: auth_badpass = no Wed Jul 8 12:10:51 2009 : Debug: auth_goodpass = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: security { Wed Jul 8 12:10:51 2009 : Debug: max_attributes = 200 Wed Jul 8 12:10:51 2009 : Debug: reject_delay = 1 Wed Jul 8 12:10:51 2009 : Debug: status_server = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Loading Realms and Home Servers #### Wed Jul 8 12:10:51 2009 : Debug: proxy server { Wed Jul 8 12:10:51 2009 : Debug: retry_delay = 5 Wed Jul 8 12:10:51 2009 : Debug: retry_count = 3 Wed Jul 8 12:10:51 2009 : Debug: default_fallback = no Wed Jul 8 12:10:51 2009 : Debug: dead_time = 120 Wed Jul 8 12:10:51 2009 : Debug: wake_all_if_all_dead = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: home_server localhost { Wed Jul 8 12:10:51 2009 : Debug: ipaddr = 127.0.0.1 Wed Jul 8 12:10:51 2009 : Debug: port = 1812 Wed Jul 8 12:10:51 2009 : Debug: type = "auth" Wed Jul 8 12:10:51 2009 : Debug: secret = "testing123" Wed Jul 8 12:10:51 2009 : Debug: response_window = 20 Wed Jul 8 12:10:51 2009 : Debug: max_outstanding = 65536 Wed Jul 8 12:10:51 2009 : Debug: require_message_authenticator = no Wed Jul 8 12:10:51 2009 : Debug: zombie_period = 40 Wed Jul 8 12:10:51 2009 : Debug: status_check = "status-server" Wed Jul 8 12:10:51 2009 : Debug: ping_interval = 30 Wed Jul 8 12:10:51 2009 : Debug: check_interval = 30 Wed Jul 8 12:10:51 2009 : Debug: num_answers_to_alive = 3 Wed Jul 8 12:10:51 2009 : Debug: num_pings_to_alive = 3 Wed Jul 8 12:10:51 2009 : Debug: revive_interval = 120 Wed Jul 8 12:10:51 2009 : Debug: status_check_timeout = 4 Wed Jul 8 12:10:51 2009 : Debug: irt = 2 Wed Jul 8 12:10:51 2009 : Debug: mrt = 16 Wed Jul 8 12:10:51 2009 : Debug: mrc = 5 Wed Jul 8 12:10:51 2009 : Debug: mrd = 30 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: home_server_pool my_auth_failover { Wed Jul 8 12:10:51 2009 : Debug: type = fail-over Wed Jul 8 12:10:51 2009 : Debug: home_server = localhost Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: realm example.com { Wed Jul 8 12:10:51 2009 : Debug: auth_pool = my_auth_failover Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: realm LOCAL { Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Loading Clients #### Wed Jul 8 12:10:51 2009 : Debug: client localhost { Wed Jul 8 12:10:51 2009 : Debug: ipaddr = 127.0.0.1 Wed Jul 8 12:10:51 2009 : Debug: require_message_authenticator = no Wed Jul 8 12:10:51 2009 : Debug: secret = "testing123" Wed Jul 8 12:10:51 2009 : Debug: nastype = "other" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Instantiating modules #### Wed Jul 8 12:10:51 2009 : Debug: instantiate { Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_exec Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating exec Wed Jul 8 12:10:51 2009 : Debug: exec { Wed Jul 8 12:10:51 2009 : Debug: wait = no Wed Jul 8 12:10:51 2009 : Debug: input_pairs = "request" Wed Jul 8 12:10:51 2009 : Debug: shell_escape = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_expr, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_expr Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating expr Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_expiration, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_expiration Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating expiration Wed Jul 8 12:10:51 2009 : Debug: expiration { Wed Jul 8 12:10:51 2009 : Debug: reply-message = "Password Has Expired " Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_logintime, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_logintime Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating logintime Wed Jul 8 12:10:51 2009 : Debug: logintime { Wed Jul 8 12:10:51 2009 : Debug: reply-message = "You are calling outside your allowed timespan " Wed Jul 8 12:10:51 2009 : Debug: minimum-timeout = 60 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Loading Virtual Servers #### Wed Jul 8 12:10:51 2009 : Debug: server inner-tunnel { Wed Jul 8 12:10:51 2009 : Debug: modules { Wed Jul 8 12:10:51 2009 : Debug: Module: Checking authenticate {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_pap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_pap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating pap Wed Jul 8 12:10:51 2009 : Debug: pap { Wed Jul 8 12:10:51 2009 : Debug: encryption_scheme = "auto" Wed Jul 8 12:10:51 2009 : Debug: auto_header = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_chap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_chap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating chap Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_mschap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_mschap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating mschap Wed Jul 8 12:10:51 2009 : Debug: mschap { Wed Jul 8 12:10:51 2009 : Debug: use_mppe = yes Wed Jul 8 12:10:51 2009 : Debug: require_encryption = no Wed Jul 8 12:10:51 2009 : Debug: require_strong = no Wed Jul 8 12:10:51 2009 : Debug: with_ntdomain_hack = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_unix, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_unix Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating unix Wed Jul 8 12:10:51 2009 : Debug: unix { Wed Jul 8 12:10:51 2009 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_eap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_eap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap Wed Jul 8 12:10:51 2009 : Debug: eap { Wed Jul 8 12:10:51 2009 : Debug: default_eap_type = "md5" Wed Jul 8 12:10:51 2009 : Debug: timer_expire = 60 Wed Jul 8 12:10:51 2009 : Debug: ignore_unknown_eap_types = no Wed Jul 8 12:10:51 2009 : Debug: cisco_accounting_username_bug = no Wed Jul 8 12:10:51 2009 : Debug: max_sessions = 2048 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_md5 Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-md5 Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_leap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-leap Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_gtc Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-gtc Wed Jul 8 12:10:51 2009 : Debug: gtc { Wed Jul 8 12:10:51 2009 : Debug: challenge = "Password: " Wed Jul 8 12:10:51 2009 : Debug: auth_type = "PAP" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_tls Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-tls Wed Jul 8 12:10:51 2009 : Debug: tls { Wed Jul 8 12:10:51 2009 : Debug: rsa_key_exchange = no Wed Jul 8 12:10:51 2009 : Debug: dh_key_exchange = yes Wed Jul 8 12:10:51 2009 : Debug: rsa_key_length = 512 Wed Jul 8 12:10:51 2009 : Debug: dh_key_length = 512 Wed Jul 8 12:10:51 2009 : Debug: verify_depth = 0 Wed Jul 8 12:10:51 2009 : Debug: pem_file_type = yes Wed Jul 8 12:10:51 2009 : Debug: private_key_file = "/etc/freeradius/certs/server.pem" Wed Jul 8 12:10:51 2009 : Debug: certificate_file = "/etc/freeradius/certs/server.pem" Wed Jul 8 12:10:51 2009 : Debug: CA_file = "/etc/freeradius/certs/ca.pem" Wed Jul 8 12:10:51 2009 : Debug: private_key_password = "whatever" Wed Jul 8 12:10:51 2009 : Debug: dh_file = "/etc/freeradius/certs/dh" Wed Jul 8 12:10:51 2009 : Debug: random_file = "/etc/freeradius/certs/random" Wed Jul 8 12:10:51 2009 : Debug: fragment_size = 1024 Wed Jul 8 12:10:51 2009 : Debug: include_length = yes Wed Jul 8 12:10:51 2009 : Debug: check_crl = no Wed Jul 8 12:10:51 2009 : Debug: cipher_list = "DEFAULT" Wed Jul 8 12:10:51 2009 : Debug: make_cert_command = "/etc/freeradius/certs/bootstrap" Wed Jul 8 12:10:51 2009 : Debug: cache { Wed Jul 8 12:10:51 2009 : Debug: enable = no Wed Jul 8 12:10:51 2009 : Debug: lifetime = 24 Wed Jul 8 12:10:51 2009 : Debug: max_entries = 255 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_ttls Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-ttls Wed Jul 8 12:10:51 2009 : Debug: ttls { Wed Jul 8 12:10:51 2009 : Debug: default_eap_type = "md5" Wed Jul 8 12:10:51 2009 : Debug: copy_request_to_tunnel = no Wed Jul 8 12:10:51 2009 : Debug: use_tunneled_reply = no Wed Jul 8 12:10:51 2009 : Debug: virtual_server = "inner-tunnel" Wed Jul 8 12:10:51 2009 : Debug: include_length = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_peap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-peap Wed Jul 8 12:10:51 2009 : Debug: peap { Wed Jul 8 12:10:51 2009 : Debug: default_eap_type = "mschapv2" Wed Jul 8 12:10:51 2009 : Debug: copy_request_to_tunnel = no Wed Jul 8 12:10:51 2009 : Debug: use_tunneled_reply = no Wed Jul 8 12:10:51 2009 : Debug: proxy_tunneled_request_as_eap = yes Wed Jul 8 12:10:51 2009 : Debug: virtual_server = "inner-tunnel" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-mschapv2 Wed Jul 8 12:10:51 2009 : Debug: mschapv2 { Wed Jul 8 12:10:51 2009 : Debug: with_ntdomain_hack = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Checking authorize {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_realm, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_realm Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating suffix Wed Jul 8 12:10:51 2009 : Debug: realm suffix { Wed Jul 8 12:10:51 2009 : Debug: format = "suffix" Wed Jul 8 12:10:51 2009 : Debug: delimiter = "@" Wed Jul 8 12:10:51 2009 : Debug: ignore_default = no Wed Jul 8 12:10:51 2009 : Debug: ignore_null = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_files, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_files Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating files Wed Jul 8 12:10:51 2009 : Debug: files { Wed Jul 8 12:10:51 2009 : Debug: usersfile = "/etc/freeradius/users" Wed Jul 8 12:10:51 2009 : Debug: acctusersfile = "/etc/freeradius/acct_users" Wed Jul 8 12:10:51 2009 : Debug: preproxy_usersfile = "/etc/freeradius/preproxy_users" Wed Jul 8 12:10:51 2009 : Debug: compat = "no" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Checking session {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_radutmp, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_radutmp Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating radutmp Wed Jul 8 12:10:51 2009 : Debug: radutmp { Wed Jul 8 12:10:51 2009 : Debug: filename = "/var/log/freeradius/radutmp" Wed Jul 8 12:10:51 2009 : Debug: username = "%{User-Name}" Wed Jul 8 12:10:51 2009 : Debug: case_sensitive = yes Wed Jul 8 12:10:51 2009 : Debug: check_with_nas = yes Wed Jul 8 12:10:51 2009 : Debug: perm = 384 Wed Jul 8 12:10:51 2009 : Debug: callerid = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: Module: Checking post-auth {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_attr_filter Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating attr_filter.access_reject Wed Jul 8 12:10:51 2009 : Debug: attr_filter attr_filter.access_reject { Wed Jul 8 12:10:51 2009 : Debug: attrsfile = "/etc/freeradius/attrs.access_reject" Wed Jul 8 12:10:51 2009 : Debug: key = "%{User-Name}" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } # modules Wed Jul 8 12:10:51 2009 : Debug: } # server Wed Jul 8 12:10:51 2009 : Debug: server { Wed Jul 8 12:10:51 2009 : Debug: modules { Wed Jul 8 12:10:51 2009 : Debug: Module: Checking authenticate {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_python, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_python Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating python Wed Jul 8 12:10:51 2009 : Debug: python_init done Wed Jul 8 12:10:51 2009 : Debug: python { Wed Jul 8 12:10:51 2009 : Debug: mod_instantiate = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_instantiate = "instantiate" Wed Jul 8 12:10:51 2009 : Debug: mod_authorize = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_authorize = "authorize" Wed Jul 8 12:10:51 2009 : Debug: mod_authenticate = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_authenticate = "authenticate" Wed Jul 8 12:10:51 2009 : Debug: mod_preacct = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_preacct = "accounting" Wed Jul 8 12:10:51 2009 : Debug: mod_detach = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_detach = "detach" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Error: rlm_python:python_load_function: module 'radiusd_test' is not found Wed Jul 8 12:10:51 2009 : Error: rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /var/lib/python-support/python2.6/_mysql.so: undefined symbol: PyExc_ImportError Wed Jul 8 12:10:51 2009 : Error: rlm_python:python_load_function: failed to import python function 'radiusd_test.instantiate' Wed Jul 8 12:10:51 2009 : Error: /etc/freeradius/modules/python[1]: Instantiation failed for module "python" Wed Jul 8 12:10:51 2009 : Error: /etc/freeradius/sites-enabled/iburst-prepaid[30]: Failed to find module "python". Wed Jul 8 12:10:51 2009 : Error: /etc/freeradius/sites-enabled/iburst-prepaid[30]: Failed to parse "python" entry. Wed Jul 8 12:10:51 2009 : Error: Errors initializing modules

3 3

want to authorise but not authenticate
by A.L.M.Buxey＠lboro.ac.uk 08 Jul '09

08 Jul '09

hi, heres one for a wednesday morning. we have a system that we've been done plain authorizations via FreeRADIUS - the device sends the following RADIUS request username: userid password: userid (ie the system sends the username and makes the password the same) okay. fair enough....a bit of unlang and a check that if the username = password then set the Auth-Type to something false et voila. all okay. it has now been decided to also do authentication via RADIUS and this is where things get messy. by removing the Auth-Type kludge, we can successfully authenticate a real user with their real password.... however, the authorization now fails because the device still sends username/password with the password the same as the username - this now hits the FreeRADIUS server which cannot find a valid Auth-Type for the user and thus fails authentication and therefore sends back a 'blurgh' to the box requesting authorization. this is to be expected because there is nothing in the request to distoniguish between an authorization request and an authentication request. so the question is, how do we handle this so that the system can send a username=password for authorization AND a proper authentication can happen WITHOUT (hers a gotcha) the user doing something cute like putting their username in as their password! ;-) alan

4 7