- Freeradius-Users - lists.freeradius.org

How to control a wpa_supplicant client request can only send to a hostapd NAS?
by DJ HENRY 09 Jul '09

09 Jul '09

How to control a wpa_supplicant client request can only send to a hostapd NAS? My network struct was following: RADIUS(freeradius) | | SWITCH(cisco) | | ------------------------------------------------ | | NAS1(hostapd) NAS2(hostapd) | | CLIENT1(wpa_supplicant) CLIENT2(wpa_supplicant) If the network only has the NAS1 device, the CLIENT1 can pass the authentication. When the network have two NAS device, which one is NAS1 and the other is NAS2, the CLIENT1 request can send to NAS1 and NAS2, then NAS1 and NAS2 all send the request to radius. I don't know whether CLIENT1 under NAS1 or NAS2 in radius. How to control a wpa_supplicant client request can only send to a hostapd NAS? Thank you very much! The CLIENT1 MAC: 00:0F:1E:34:28:B4 The NAS1 MAC: 00:0F:1E:34:26:50 The NAS2 MAC: 00:0f:1e:00:00:83 The CLIENT1 log -------------------------- EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:34:26:50* RX EAPOL - hexdump(len=14): 02 00 00 0a 01 00 00 0a 01 68 65 6c 6c 6f EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=1 id=0 EAP: EAP entering state RETRANSMIT EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:00:00:83* RX EAPOL - hexdump(len=46): 02 00 00 16 01 01 00 16 04 10 e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: EAP entering state GET_METHOD EAP: initialize selected EAP method (4, MD5) CTRL-EVENT-EAP-METHOD EAP method 4 (MD5) selected EAP: EAP entering state METHOD EAP-MD5: Challenge - hexdump(len=16): e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb EAP-MD5: generating Challenge Response EAP-MD5: Response - hexdump(len=16): 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 01 00 16 04 10 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=26): 02 00 00 16 01 01 00 16 04 10 02 c8 6c 9b 31 7d 34 bc 09 6a 0f f2 c3 a8 01 54 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: AS used the same Id again, but EAP packets were not identical EAP: workaround - assume this is not a duplicate packet EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=8): 02 00 00 04 04 01 00 04 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:00:00:83 RX EAPOL - hexdump(len=46): 02 00 00 04 03 01 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS The NAS1 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.03 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 44 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: authentication failed The NAS2 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.02 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 63 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.01 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: old identity '00:0F:1E:34:28:B4' updated with User-Name from Access-Accept '00:0F:1E:34:28:B4' br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=3 id=1 len=4) from RADIUS server: EAP Success The RADIUS log -------------------------- rad_recv: Access-Request packet from host 192.168.1.45 port 1024, id=0, length=168 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.45 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-34-26-50:*" Calling-Station-Id = "*00-0F-1E-34-28-B4*" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000160130303a30463a31453a33343a32383a4234 Message-Authenticator = 0xdfe32c5308f652199fc3f87459b2f8b8 +- entering group authorize {...} rad_recv: Access-Request packet from host 192.168.1.44 port 1024, id=1, length=186 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.44 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-00-00-83:*" Calling-Station-Id = "*00-0F-1E-34-28-B4"* Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604107d5ea6ea11c7d9aded44a4b961b5ab41 State = 0x532668a453276c3283f462034e3542a3 Message-Authenticator = 0x98ac376bdacceb01003f6f6bb9604f9c +- entering group authorize {...} Sending Access-Accept of id 1 to 192.168.1.44 port 1024 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00:0F:1E:34:28:B4"

1 0

How to control a wpa_supplicant client request can only send to a hostapd NAS?
by DJ HENRY 09 Jul '09

09 Jul '09

How to control a wpa_supplicant client request can only send to a hostapd NAS? My network struct was following: RADIUS(freeradius) | | SWITCH(cisco) | | ------------------------------------------------ | | NAS1(hostapd) NAS2(hostapd) | | CLIENT1(wpa_supplicant) CLIENT2(wpa_supplicant) If the network only has the NAS1 device, the CLIENT1 can pass the authentication. When the network have two NAS device, which one is NAS1 and the other is NAS2, the CLIENT1 request can send to NAS1 and NAS2, then NAS1 and NAS2 all send the request to radius. I don't know whether CLIENT1 under NAS1 or NAS2 in radius. How to control a wpa_supplicant client request can only send to a hostapd NAS? Thank you very much! The CLIENT1 MAC: 00:0F:1E:34:28:B4 The NAS1 MAC: 00:0F:1E:34:26:50 The NAS2 MAC: 00:0f:1e:00:00:83 The CLIENT1 log -------------------------- EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:34:26:50* RX EAPOL - hexdump(len=14): 02 00 00 0a 01 00 00 0a 01 68 65 6c 6c 6f EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=1 id=0 EAP: EAP entering state RETRANSMIT EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 00 00 16 01 30 30 3a 30 46 3a 31 45 3a 33 34 3a 32 38 3a 42 34 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from *00:0f:1e:00:00:83* RX EAPOL - hexdump(len=46): 02 00 00 16 01 01 00 16 04 10 e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: EAP entering state GET_METHOD EAP: initialize selected EAP method (4, MD5) CTRL-EVENT-EAP-METHOD EAP method 4 (MD5) selected EAP: EAP entering state METHOD EAP-MD5: Challenge - hexdump(len=16): e3 1f ff 34 85 47 cd 3c d7 14 60 22 fc 2a 24 fb EAP-MD5: generating Challenge Response EAP-MD5: Response - hexdump(len=16): 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAP: method process -> ignore=FALSE methodState=DONE decision=UNCOND_SUCC EAP: EAP entering state SEND_RESPONSE EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RESPONSE EAPOL: txSuppRsp TX EAPOL - hexdump(len=26): 01 00 00 16 02 01 00 16 04 10 7d 5e a6 ea 11 c7 d9 ad ed 44 a4 b9 61 b5 ab 41 EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=26): 02 00 00 16 01 01 00 16 04 10 02 c8 6c 9b 31 7d 34 bc 09 6a 0f f2 c3 a8 01 54 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Request method=4 id=1 EAP: AS used the same Id again, but EAP packets were not identical EAP: workaround - assume this is not a duplicate packet EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:34:26:50 RX EAPOL - hexdump(len=8): 02 00 00 04 04 01 00 04 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Failure EAP: EAP entering state DISCARD EAP: EAP entering state IDLE EAPOL: SUPP_BE entering state RECEIVE RX EAPOL from 00:0f:1e:00:00:83 RX EAPOL - hexdump(len=46): 02 00 00 04 03 01 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 EAPOL: Received EAP-Packet frame EAPOL: SUPP_BE entering state REQUEST EAPOL: getSuppRsp EAP: EAP entering state RECEIVED EAP: Received EAP-Success EAP: EAP entering state SUCCESS The NAS1 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.03 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 44 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=4 id=1 len=4) from RADIUS server: EAP Failure br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: authentication failed The NAS2 log -------------------------- Deauthenticate all stations br0: STA *00:0f:1e:34:28:b4* IEEE 802.1X: start authentication br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAPOL-Start from STA br0: STA 00:0f:1e:34:28:b4 WPA: event 5 notification br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: unauthorizing port br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: STA identity '00:0F:1E:34:28:B4' br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 80 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.02 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: using EAP timeout of 30 seconds br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=22) from RADIUS server: EAP-Request-MD5-Challenge (4) br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: EAP Identifier of the Response-Identity does not match (was 0, expected 1) - ignored br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: received EAP packet (code=2 id=1 len=22) from STA: EAP Response-MD5-Challenge (4) br0: RADIUS Sending RADIUS message to authentication server br0: RADIUS Next RADIUS client retransmit in 3 seconds br0: RADIUS Received 63 bytes from RADIUS server br0: RADIUS Received RADIUS message br0: STA 00:0f:1e:34:28:b4 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.01 sec br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: old identity '00:0F:1E:34:28:B4' updated with User-Name from Access-Accept '00:0F:1E:34:28:B4' br0: STA 00:0f:1e:34:28:b4 IEEE 802.1X: decapsulated EAP packet (code=3 id=1 len=4) from RADIUS server: EAP Success The RADIUS log -------------------------- rad_recv: Access-Request packet from host 192.168.1.45 port 1024, id=0, length=168 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.45 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-34-26-50:*" Calling-Station-Id = "*00-0F-1E-34-28-B4*" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000160130303a30463a31453a33343a32383a4234 Message-Authenticator = 0xdfe32c5308f652199fc3f87459b2f8b8 +- entering group authorize {...} rad_recv: Access-Request packet from host 192.168.1.44 port 1024, id=1, length=186 User-Name = "00:0F:1E:34:28:B4" NAS-IP-Address = 192.168.1.44 NAS-Port = 0 Called-Station-Id = "*00-0F-1E-00-00-83:*" Calling-Station-Id = "*00-0F-1E-34-28-B4"* Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0201001604107d5ea6ea11c7d9aded44a4b961b5ab41 State = 0x532668a453276c3283f462034e3542a3 Message-Authenticator = 0x98ac376bdacceb01003f6f6bb9604f9c +- entering group authorize {...} Sending Access-Accept of id 1 to 192.168.1.44 port 1024 EAP-Message = 0x03010004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "00:0F:1E:34:28:B4"

1 0

pam_radius_auth for big endian
by maxim maxim 08 Jul '09

08 Jul '09

I try to authenticate on sshd through pam by the pam_radius_auth, my platform is based on PowerPc(big endian). After changes in md5 file i accepted authentication is ok on the radius server, but my side of sshd is failed( i don't succeed to accept the session when i try to connect to sshd ) with log error of password or shared secret is wrong.Any suggestions to solve this problem? Thanks, Maxim 2009/7/7 <freeradius-users-request(a)lists.freeradius.org> > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > ------------------------------ > > Message: 5 > Date: Tue, 07 Jul 2009 16:57:31 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: pam_radius_auth for big endian > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <4A53625B.2040909(a)deployingradius.com> > Content-Type: text/plain; charset=UTF-8 > > maxim maxim wrote: > > How i can to fix pam_radius_auth for big endian platform? > > The module works (or should) on big endian systems. See md5.c for > sparc/mips configuration. > > Alan DeKok. > > > ------------------------------ > > >

1 0

realm in User-Name stripped in accounting data?
by ST Wong (ITSC) 08 Jul '09

08 Jul '09

Hi all, We setup proxy (on freeradius 2.1.3) by putting following lines in users and acct_users: DEFAULT Huntgroup-Name == Aruba, Aruba-Essid-Name == "Univ WiFi", Realm != "localream.mydomain", Proxy-to-realm := "remoteRealm" Authentication works properly while User-Name in accounting data, the @realm part is removed. However, there is no problem for other 'simple' proxy settings (only define realm in proxy.conf, without Proxy-to-realm). We're using LDAP as authentication backend. Would anyone please advise if we can keep the @realm part in all accounting data? Thanks a lot. /ST Wong

2 2

Fallback LDAP Attribute Value
by Steven Carr 08 Jul '09

08 Jul '09

Hi list, I have the following line in my ldap.attrmap file to pull back a users VLAN assignment: > replyItem Tunnel-Private-Group-ID destinationIndicator The users file contains the following: > DEFAULT Ldap-Group == "allowed-access" > Service-Type = Framed-User, > Tunnel-Type = "VLAN", > Tunnel-Medium-Type = "IEEE-802" For the users which are in the "allowed-access" group those which have a value in the destinationIndicator attribute in LDAP work OK and are flipped into the appropriate VLAN. How do I specify a fallback so that if the user does not have this attribute set or it is empty then they are put into VLAN 666 for example. Thanks Steve -- Steven Carr Systems Development Officer SLS/ITS/Systems - (0191) 515 3953

3 19

Re: Re: Session-Timeout in Access-Challenge (that contains EAP-Message)
by David Mitton 08 Jul '09

08 Jul '09

Alan, They most certainly do! I just debugged a case where the Cisco 1200 takes the 30s Session-Timeout that the Microsoft IAS server sends and treats it as a response timeout. (It then aborts the authentication, which I believe is wrong, but that's another story) When doing a SecurID authentication with user input of a 60s token OTP, the default 30s is "inadequate". Cisco does document the way to extend or override this behavior. The Session-Timeout on Access-Challenges for EAP should be a separate "design" somehow. In the older MS RasEap API, it was crudely based on on the type of Send action the EAP server used. In the newer MS EAPHost API, the EAP server code has direct control. I don't know how your EAP modules interface to the RADIUS server proper, but a method that is expecting interactive user control _will_ want to create some slack here. Not all EAP methods complete in short time. Dave. On Jul 8, 2009, aland(a)deployingradius.com wrote: Gong Cheng wrote: > Hi, > I wonder if there is a way > - not to include "Session-Timeout" value intended for Access-Accept in > Access-Challenge messages? In 2.1.7, see raddb/sites-available/default. Look for Access-Challenge. There is sample configuration. > - or to configure a different Session-Timeout value for Access-Challenges > (which contain EAP-Message)? > > This is about the following section in RFC3579 where Session-Timeout in > Access-Challenge is used to influence EAP retransmission behavior. I'm not sure any AP supports that. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

ubuntu / debian rlm_python issues using mysqldb module
by Michael da Silva Pereira 08 Jul '09

08 Jul '09

Hi All, I am sure i'm not the only person experiencing this problem. It seems when using the python module to handle auth/acct. If you include the MySQLdb module in the python script freeradius then dies and is unable to load the pythong module. I am using the latest stable freeradius version 2.1.6, built for ubuntu as per http://wiki.freeradius.org/Build using fakeroot. The python script being used is the "prepaid.py" script renamed to "radiusd_test.py" in the example below. I am using the standard scripts and config from freeradius, I found a similar article regarding this and apparently has something to do with statically linking the module ? Are there any solutions for this ? Thanks, Michael Please see the log below from freeradius: Wed Jul 8 12:10:51 2009 : Info: FreeRADIUS Version 2.1.6, for host i486-pc-linux-gnu, built on Jul 7 2009 at 19:08:38 Wed Jul 8 12:10:51 2009 : Info: Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. Wed Jul 8 12:10:51 2009 : Info: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Wed Jul 8 12:10:51 2009 : Info: PARTICULAR PURPOSE. Wed Jul 8 12:10:51 2009 : Info: You may redistribute copies of FreeRADIUS under the terms of the Wed Jul 8 12:10:51 2009 : Info: GNU General Public License v2. Wed Jul 8 12:10:51 2009 : Info: Starting - reading configuration files ... Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/radiusd.conf Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/proxy.conf Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/clients.conf Wed Jul 8 12:10:51 2009 : Debug: including files in directory /etc/freeradius/modules/ Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/realm Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/radutmp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/logintime Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/counter Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/chap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/unix Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/pap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/acct_unique Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/expiration Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/digest Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/policy Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/linelog Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/checkval Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/sradutmp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/files Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/detail Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/smsotp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/preprocess Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/expr Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/sql_log Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/python Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/pam Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/attr_filter Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/ippool Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/mac2vlan Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/passwd Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/mschap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/detail.log Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/inner-eap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/always Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/mac2ip Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/detail.example.com Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/etc_group Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/ldap Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/smbpasswd Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/echo Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/wimax Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/otp Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/attr_rewrite Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/exec Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/perl Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/modules/krb5 Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/eap.conf Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/policy.conf Wed Jul 8 12:10:51 2009 : Debug: including files in directory /etc/freeradius/sites-enabled/ Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/control-socket Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/iburst-prepaid Wed Jul 8 12:10:51 2009 : Debug: including configuration file /etc/freeradius/sites-enabled/inner-tunnel Wed Jul 8 12:10:51 2009 : Debug: group = freerad Wed Jul 8 12:10:51 2009 : Debug: user = freerad Wed Jul 8 12:10:51 2009 : Debug: including dictionary file /etc/freeradius/dictionary Wed Jul 8 12:10:51 2009 : Debug: main { Wed Jul 8 12:10:51 2009 : Debug: prefix = "/usr" Wed Jul 8 12:10:51 2009 : Debug: localstatedir = "/var" Wed Jul 8 12:10:51 2009 : Debug: logdir = "/var/log/freeradius" Wed Jul 8 12:10:51 2009 : Debug: libdir = "/usr/lib/freeradius" Wed Jul 8 12:10:51 2009 : Debug: radacctdir = "/var/log/freeradius/radacct" Wed Jul 8 12:10:51 2009 : Debug: hostname_lookups = no Wed Jul 8 12:10:51 2009 : Debug: max_request_time = 30 Wed Jul 8 12:10:51 2009 : Debug: cleanup_delay = 5 Wed Jul 8 12:10:51 2009 : Debug: max_requests = 1024 Wed Jul 8 12:10:51 2009 : Debug: allow_core_dumps = no Wed Jul 8 12:10:51 2009 : Debug: pidfile = "/var/run/freeradius/freeradius.pid" Wed Jul 8 12:10:51 2009 : Debug: checkrad = "/usr/sbin/checkrad" Wed Jul 8 12:10:51 2009 : Debug: debug_level = 0 Wed Jul 8 12:10:51 2009 : Debug: proxy_requests = yes Wed Jul 8 12:10:51 2009 : Debug: log { Wed Jul 8 12:10:51 2009 : Debug: stripped_names = no Wed Jul 8 12:10:51 2009 : Debug: auth = no Wed Jul 8 12:10:51 2009 : Debug: auth_badpass = no Wed Jul 8 12:10:51 2009 : Debug: auth_goodpass = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: security { Wed Jul 8 12:10:51 2009 : Debug: max_attributes = 200 Wed Jul 8 12:10:51 2009 : Debug: reject_delay = 1 Wed Jul 8 12:10:51 2009 : Debug: status_server = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Loading Realms and Home Servers #### Wed Jul 8 12:10:51 2009 : Debug: proxy server { Wed Jul 8 12:10:51 2009 : Debug: retry_delay = 5 Wed Jul 8 12:10:51 2009 : Debug: retry_count = 3 Wed Jul 8 12:10:51 2009 : Debug: default_fallback = no Wed Jul 8 12:10:51 2009 : Debug: dead_time = 120 Wed Jul 8 12:10:51 2009 : Debug: wake_all_if_all_dead = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: home_server localhost { Wed Jul 8 12:10:51 2009 : Debug: ipaddr = 127.0.0.1 Wed Jul 8 12:10:51 2009 : Debug: port = 1812 Wed Jul 8 12:10:51 2009 : Debug: type = "auth" Wed Jul 8 12:10:51 2009 : Debug: secret = "testing123" Wed Jul 8 12:10:51 2009 : Debug: response_window = 20 Wed Jul 8 12:10:51 2009 : Debug: max_outstanding = 65536 Wed Jul 8 12:10:51 2009 : Debug: require_message_authenticator = no Wed Jul 8 12:10:51 2009 : Debug: zombie_period = 40 Wed Jul 8 12:10:51 2009 : Debug: status_check = "status-server" Wed Jul 8 12:10:51 2009 : Debug: ping_interval = 30 Wed Jul 8 12:10:51 2009 : Debug: check_interval = 30 Wed Jul 8 12:10:51 2009 : Debug: num_answers_to_alive = 3 Wed Jul 8 12:10:51 2009 : Debug: num_pings_to_alive = 3 Wed Jul 8 12:10:51 2009 : Debug: revive_interval = 120 Wed Jul 8 12:10:51 2009 : Debug: status_check_timeout = 4 Wed Jul 8 12:10:51 2009 : Debug: irt = 2 Wed Jul 8 12:10:51 2009 : Debug: mrt = 16 Wed Jul 8 12:10:51 2009 : Debug: mrc = 5 Wed Jul 8 12:10:51 2009 : Debug: mrd = 30 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: home_server_pool my_auth_failover { Wed Jul 8 12:10:51 2009 : Debug: type = fail-over Wed Jul 8 12:10:51 2009 : Debug: home_server = localhost Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: realm example.com { Wed Jul 8 12:10:51 2009 : Debug: auth_pool = my_auth_failover Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: realm LOCAL { Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Loading Clients #### Wed Jul 8 12:10:51 2009 : Debug: client localhost { Wed Jul 8 12:10:51 2009 : Debug: ipaddr = 127.0.0.1 Wed Jul 8 12:10:51 2009 : Debug: require_message_authenticator = no Wed Jul 8 12:10:51 2009 : Debug: secret = "testing123" Wed Jul 8 12:10:51 2009 : Debug: nastype = "other" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Instantiating modules #### Wed Jul 8 12:10:51 2009 : Debug: instantiate { Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_exec, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_exec Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating exec Wed Jul 8 12:10:51 2009 : Debug: exec { Wed Jul 8 12:10:51 2009 : Debug: wait = no Wed Jul 8 12:10:51 2009 : Debug: input_pairs = "request" Wed Jul 8 12:10:51 2009 : Debug: shell_escape = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_expr, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_expr Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating expr Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_expiration, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_expiration Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating expiration Wed Jul 8 12:10:51 2009 : Debug: expiration { Wed Jul 8 12:10:51 2009 : Debug: reply-message = "Password Has Expired " Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_logintime, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_logintime Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating logintime Wed Jul 8 12:10:51 2009 : Debug: logintime { Wed Jul 8 12:10:51 2009 : Debug: reply-message = "You are calling outside your allowed timespan " Wed Jul 8 12:10:51 2009 : Debug: minimum-timeout = 60 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: radiusd: #### Loading Virtual Servers #### Wed Jul 8 12:10:51 2009 : Debug: server inner-tunnel { Wed Jul 8 12:10:51 2009 : Debug: modules { Wed Jul 8 12:10:51 2009 : Debug: Module: Checking authenticate {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_pap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_pap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating pap Wed Jul 8 12:10:51 2009 : Debug: pap { Wed Jul 8 12:10:51 2009 : Debug: encryption_scheme = "auto" Wed Jul 8 12:10:51 2009 : Debug: auto_header = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_chap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_chap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating chap Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_mschap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_mschap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating mschap Wed Jul 8 12:10:51 2009 : Debug: mschap { Wed Jul 8 12:10:51 2009 : Debug: use_mppe = yes Wed Jul 8 12:10:51 2009 : Debug: require_encryption = no Wed Jul 8 12:10:51 2009 : Debug: require_strong = no Wed Jul 8 12:10:51 2009 : Debug: with_ntdomain_hack = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_unix, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_unix Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating unix Wed Jul 8 12:10:51 2009 : Debug: unix { Wed Jul 8 12:10:51 2009 : Debug: radwtmp = "/var/log/freeradius/radwtmp" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_eap, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_eap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap Wed Jul 8 12:10:51 2009 : Debug: eap { Wed Jul 8 12:10:51 2009 : Debug: default_eap_type = "md5" Wed Jul 8 12:10:51 2009 : Debug: timer_expire = 60 Wed Jul 8 12:10:51 2009 : Debug: ignore_unknown_eap_types = no Wed Jul 8 12:10:51 2009 : Debug: cisco_accounting_username_bug = no Wed Jul 8 12:10:51 2009 : Debug: max_sessions = 2048 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_md5 Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-md5 Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_leap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-leap Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_gtc Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-gtc Wed Jul 8 12:10:51 2009 : Debug: gtc { Wed Jul 8 12:10:51 2009 : Debug: challenge = "Password: " Wed Jul 8 12:10:51 2009 : Debug: auth_type = "PAP" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_tls Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-tls Wed Jul 8 12:10:51 2009 : Debug: tls { Wed Jul 8 12:10:51 2009 : Debug: rsa_key_exchange = no Wed Jul 8 12:10:51 2009 : Debug: dh_key_exchange = yes Wed Jul 8 12:10:51 2009 : Debug: rsa_key_length = 512 Wed Jul 8 12:10:51 2009 : Debug: dh_key_length = 512 Wed Jul 8 12:10:51 2009 : Debug: verify_depth = 0 Wed Jul 8 12:10:51 2009 : Debug: pem_file_type = yes Wed Jul 8 12:10:51 2009 : Debug: private_key_file = "/etc/freeradius/certs/server.pem" Wed Jul 8 12:10:51 2009 : Debug: certificate_file = "/etc/freeradius/certs/server.pem" Wed Jul 8 12:10:51 2009 : Debug: CA_file = "/etc/freeradius/certs/ca.pem" Wed Jul 8 12:10:51 2009 : Debug: private_key_password = "whatever" Wed Jul 8 12:10:51 2009 : Debug: dh_file = "/etc/freeradius/certs/dh" Wed Jul 8 12:10:51 2009 : Debug: random_file = "/etc/freeradius/certs/random" Wed Jul 8 12:10:51 2009 : Debug: fragment_size = 1024 Wed Jul 8 12:10:51 2009 : Debug: include_length = yes Wed Jul 8 12:10:51 2009 : Debug: check_crl = no Wed Jul 8 12:10:51 2009 : Debug: cipher_list = "DEFAULT" Wed Jul 8 12:10:51 2009 : Debug: make_cert_command = "/etc/freeradius/certs/bootstrap" Wed Jul 8 12:10:51 2009 : Debug: cache { Wed Jul 8 12:10:51 2009 : Debug: enable = no Wed Jul 8 12:10:51 2009 : Debug: lifetime = 24 Wed Jul 8 12:10:51 2009 : Debug: max_entries = 255 Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_ttls Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-ttls Wed Jul 8 12:10:51 2009 : Debug: ttls { Wed Jul 8 12:10:51 2009 : Debug: default_eap_type = "md5" Wed Jul 8 12:10:51 2009 : Debug: copy_request_to_tunnel = no Wed Jul 8 12:10:51 2009 : Debug: use_tunneled_reply = no Wed Jul 8 12:10:51 2009 : Debug: virtual_server = "inner-tunnel" Wed Jul 8 12:10:51 2009 : Debug: include_length = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_peap Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-peap Wed Jul 8 12:10:51 2009 : Debug: peap { Wed Jul 8 12:10:51 2009 : Debug: default_eap_type = "mschapv2" Wed Jul 8 12:10:51 2009 : Debug: copy_request_to_tunnel = no Wed Jul 8 12:10:51 2009 : Debug: use_tunneled_reply = no Wed Jul 8 12:10:51 2009 : Debug: proxy_tunneled_request_as_eap = yes Wed Jul 8 12:10:51 2009 : Debug: virtual_server = "inner-tunnel" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to sub-module rlm_eap_mschapv2 Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating eap-mschapv2 Wed Jul 8 12:10:51 2009 : Debug: mschapv2 { Wed Jul 8 12:10:51 2009 : Debug: with_ntdomain_hack = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Checking authorize {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_realm, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_realm Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating suffix Wed Jul 8 12:10:51 2009 : Debug: realm suffix { Wed Jul 8 12:10:51 2009 : Debug: format = "suffix" Wed Jul 8 12:10:51 2009 : Debug: delimiter = "@" Wed Jul 8 12:10:51 2009 : Debug: ignore_default = no Wed Jul 8 12:10:51 2009 : Debug: ignore_null = no Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_files, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_files Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating files Wed Jul 8 12:10:51 2009 : Debug: files { Wed Jul 8 12:10:51 2009 : Debug: usersfile = "/etc/freeradius/users" Wed Jul 8 12:10:51 2009 : Debug: acctusersfile = "/etc/freeradius/acct_users" Wed Jul 8 12:10:51 2009 : Debug: preproxy_usersfile = "/etc/freeradius/preproxy_users" Wed Jul 8 12:10:51 2009 : Debug: compat = "no" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Checking session {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_radutmp, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_radutmp Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating radutmp Wed Jul 8 12:10:51 2009 : Debug: radutmp { Wed Jul 8 12:10:51 2009 : Debug: filename = "/var/log/freeradius/radutmp" Wed Jul 8 12:10:51 2009 : Debug: username = "%{User-Name}" Wed Jul 8 12:10:51 2009 : Debug: case_sensitive = yes Wed Jul 8 12:10:51 2009 : Debug: check_with_nas = yes Wed Jul 8 12:10:51 2009 : Debug: perm = 384 Wed Jul 8 12:10:51 2009 : Debug: callerid = yes Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: Module: Checking post-proxy {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: Module: Checking post-auth {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_attr_filter, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_attr_filter Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating attr_filter.access_reject Wed Jul 8 12:10:51 2009 : Debug: attr_filter attr_filter.access_reject { Wed Jul 8 12:10:51 2009 : Debug: attrsfile = "/etc/freeradius/attrs.access_reject" Wed Jul 8 12:10:51 2009 : Debug: key = "%{User-Name}" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Debug: } # modules Wed Jul 8 12:10:51 2009 : Debug: } # server Wed Jul 8 12:10:51 2009 : Debug: server { Wed Jul 8 12:10:51 2009 : Debug: modules { Wed Jul 8 12:10:51 2009 : Debug: Module: Checking authenticate {...} for more modules to load Wed Jul 8 12:10:51 2009 : Debug: (Loaded rlm_python, checking if it's valid) Wed Jul 8 12:10:51 2009 : Debug: Module: Linked to module rlm_python Wed Jul 8 12:10:51 2009 : Debug: Module: Instantiating python Wed Jul 8 12:10:51 2009 : Debug: python_init done Wed Jul 8 12:10:51 2009 : Debug: python { Wed Jul 8 12:10:51 2009 : Debug: mod_instantiate = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_instantiate = "instantiate" Wed Jul 8 12:10:51 2009 : Debug: mod_authorize = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_authorize = "authorize" Wed Jul 8 12:10:51 2009 : Debug: mod_authenticate = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_authenticate = "authenticate" Wed Jul 8 12:10:51 2009 : Debug: mod_preacct = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_preacct = "accounting" Wed Jul 8 12:10:51 2009 : Debug: mod_detach = "radiusd_test" Wed Jul 8 12:10:51 2009 : Debug: func_detach = "detach" Wed Jul 8 12:10:51 2009 : Debug: } Wed Jul 8 12:10:51 2009 : Error: rlm_python:python_load_function: module 'radiusd_test' is not found Wed Jul 8 12:10:51 2009 : Error: rlm_python:EXCEPT:<type 'exceptions.ImportError'>: /var/lib/python-support/python2.6/_mysql.so: undefined symbol: PyExc_ImportError Wed Jul 8 12:10:51 2009 : Error: rlm_python:python_load_function: failed to import python function 'radiusd_test.instantiate' Wed Jul 8 12:10:51 2009 : Error: /etc/freeradius/modules/python[1]: Instantiation failed for module "python" Wed Jul 8 12:10:51 2009 : Error: /etc/freeradius/sites-enabled/iburst-prepaid[30]: Failed to find module "python". Wed Jul 8 12:10:51 2009 : Error: /etc/freeradius/sites-enabled/iburst-prepaid[30]: Failed to parse "python" entry. Wed Jul 8 12:10:51 2009 : Error: Errors initializing modules

3 3

want to authorise but not authenticate
by A.L.M.Buxey＠lboro.ac.uk 08 Jul '09

08 Jul '09

hi, heres one for a wednesday morning. we have a system that we've been done plain authorizations via FreeRADIUS - the device sends the following RADIUS request username: userid password: userid (ie the system sends the username and makes the password the same) okay. fair enough....a bit of unlang and a check that if the username = password then set the Auth-Type to something false et voila. all okay. it has now been decided to also do authentication via RADIUS and this is where things get messy. by removing the Auth-Type kludge, we can successfully authenticate a real user with their real password.... however, the authorization now fails because the device still sends username/password with the password the same as the username - this now hits the FreeRADIUS server which cannot find a valid Auth-Type for the user and thus fails authentication and therefore sends back a 'blurgh' to the box requesting authorization. this is to be expected because there is nothing in the request to distoniguish between an authorization request and an authentication request. so the question is, how do we handle this so that the system can send a username=password for authorization AND a proper authentication can happen WITHOUT (hers a gotcha) the user doing something cute like putting their username in as their password! ;-) alan

4 7

matching on nas entry/shortname
by liran tal 08 Jul '09

08 Jul '09

Hey, Matching an entry based on the NAS's IP Address value in the request is doable via DEFAULT NAS-IP-Address == "1.2.3.4" ... How about if I wouldn't want to count on that attribute and I'd rather just want to match based on the NAS entry itself (which is read from mysql) or the shortname assigned to the NAS in that mysql database. Regards, Liran.

2 1

Re: receives 1 request --> proxy 2 requests?
by Torsten Förster 08 Jul '09

08 Jul '09

ok, next try to explain the problem: if i start radtest everything looks fine: radtest 111111@test 111111@test localhost:1645 0 *secret* Sending Access-Request of id 176 to 127.0.0.1 port 1645 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 rad_recv: Access-Accept packet from host 127.0.0.1 port 1645, id=176, length=20 if i look in freeradius-debug: rad_recv: Access-Request packet from host 127.0.0.1 port 58236, id=177, length=64 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090708 [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/127.0.0.1/auth-detail-20090708 expand: %t -> Wed Jul 8 13:07:36 2009 ++[auth_log] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm \"test\" for User-Name = \"111111@test\" [suffix] Found realm \"test\" [suffix] Adding Realm = \"test\" [suffix] Proxying request from user 111111 to realm test [suffix] Preparing to proxy authentication request to realm \"test\" ++[suffix] returns updated [prefix] Request already proxied. Ignoring. ++[prefix] returns ok [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop ++[pap] returns noop ------------------until here ok------------------------- Sending Access-Request of id 207 to 172.y.y.y port 1812 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 Proxy-State = 0x313737 Proxying request 34 to home server 172.y.y.y port 1812 Sending Access-Request of id 207 to 172.y.y.y port 1812 User-Name = \"111111@test\" User-Password = \"111111@test\" NAS-IP-Address = 172.x.x.x NAS-Port = 0 Proxy-State = 0x313737 -----------------why a second identical request?-------------------- Going to the next request Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 172.y.y.y port 1812, id=207, length=25 Proxy-State = 0x313737 +- entering group post-proxy {...} [eap] No pre-existing handler found ++[eap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [111111@test/111111@test] (from client localhost port 0) Sending Access-Accept of id 177 to 127.0.0.1 port 58236 Finished request 34. Going to the next request Waking up in 2.9 seconds. Cleaning up request 34 ID 177 with timestamp +4454 Ready to process requests. ------------------------------End------------------------------------- So, i get an access-accept. But freeradius generates a second request. #adBox3 {display:none;}

2 1