- Freeradius-Users - lists.freeradius.org

XP Home SP3 WPA2 Enterprise oddity
by Seann Clark 12 Jun '09

12 Jun '09

All, I know this is an old(ish) issue, but one I have been playing with a lot lately. I have a Vista Ultimate box that works perfectly, but an XP SP3 box that stopped working after SP3 was applied. What I am seeing is the inital challenge come in from the XP box, the freeRadius box responding, an additional response from the XP system, and the final challenge from the Radius box goes out and never gets an answer. This repeats indefinitely until the WLAN is shut off on the XP box. It seems to be failing only on this last challenge response section, the XP box just never responds back. I am stumped as to what changed, and what else I can hammer on, without mindlessly breaking a working Radius server. My EAP.conf section is : # # Whatever you do, do NOT set 'Auth-Type := EAP'. The server # is smart enough to figure this out on its own. The most # common side effect of setting 'Auth-Type := EAP' is that the # users then cannot use ANY other authentication method. # # $Id: eap.conf,v 1.4 2004/04/15 18:34:41 aland Exp $ # eap { # Invoke the default supported EAP type when # EAP-Identity response is received. # # The incoming EAP messages DO NOT specify which EAP # type they will be using, so it MUST be set here. # # For now, only one default EAP type may be used at a time. # # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. # default_eap_type = peap # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 60 # There are many EAP types, but the server has support # for only a limited subset. If the server receives # a request for an EAP type it does not support, then # it normally rejects the request. By setting this # configuration to "yes", you can tell the server to # instead keep processing the request. Another module # MUST then be configured to proxy the request to # another RADIUS server which supports that EAP type. # # If another module is NOT configured to handle the # request, then the request will still end up being # rejected. ignore_unknown_eap_types = no # Cisco AP1230B firmware 12.2(13)JA1 has a bug. When given # a User-Name attribute in an Access-Accept, it copies one # more byte than it should. # # We can work around it by configurably adding an extra # zero byte. cisco_accounting_username_bug = yes # Supported EAP-types # # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } # Cisco LEAP # # We do not recommend using LEAP in new deployments. See: # http://www.securiteam.com/tools/5TP012ACKE.html # # Cisco LEAP uses the MS-CHAP algorithm (but not # the MS-CHAP attributes) to perform it's authentication. # # As a result, LEAP *requires* access to the plain-text # User-Password, or the NT-Password attributes. # 'System' authentication is impossible with LEAP. # leap { } # Generic Token Card. # # Currently, this is only permitted inside of EAP-TTLS, # or EAP-PEAP. The module "challenges" the user with # text, and the response from the user is taken to be # the User-Password. # # Proxying the tunneled EAP-GTC session is a bad idea, # the users password will go over the wire in plain-text, # for anyone to see. # gtc { # The default challenge, which many clients # ignore.. #challenge = "Password: " # The plain-text response which comes back # is put into a User-Password attribute, # and passed to another module for # authentication. This allows the EAP-GTC # response to be checked against plain-text, # or crypt'd passwords. # # If you say "Local" instead of "PAP", then # the module will look for a User-Password # configured for the request, and do the # authentication itself. # auth_type = PAP } ## EAP-TLS # # To generate ctest certificates, run the script # # ../scripts/certs.sh # # The documents on http://www.freeradius.org/doc # are old, but may be helpful. # # See also: # # http://www.dslreports.com/forum/remark,9286052~mode=flat # tls { #private_key_password = zaq1ZAQ!zaq1ZAQ #private_key_file = ${raddbdir}/certs/haruhi.pem private_key_file = /etc/pki/tls/private/haruhi.tsukinokage.net.key # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. #certificate_file = ${raddbdir}/certs/haruhi.crt certificate_file = /etc/pki/tls/certs/haruhi.tsukinokage.net.crt # Trusted Root CA list #CA_file = ${raddbdir}/certs/CA/ca.cer CA_file = /etc/pki/tls/certs/CA/ca.cer dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random random_file = /dev/random # # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # fragment_size = 1024 # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes # Check the Certificate Revocation List # # 1) Copy CA certificates and CRLs to same directory. # 2) Execute 'c_rehash <CA certs&CRLs Directory>'. # 'c_rehash' is OpenSSL's command. # 3) Add 'CA_path=<CA certs&CRLs directory>' # to radiusd.conf's tls section. # 4) uncomment the line below. # 5) Restart radiusd # check_crl = yes # # If check_cert_cn is set, the value will # be xlat'ed and checked against the CN # in the client certificate. If the values # do not match, the certificate verification # will fail rejecting the user. # # check_cert_cn = %{User-Name} } # The TTLS module implements the EAP-TTLS protocol, # which can be described as EAP inside of Diameter, # inside of TLS, inside of EAP, inside of RADIUS... # # Surprisingly, it works quite well. # # The TTLS module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-TTLS does not # require a client certificate. # ttls { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # TTLS tunnel, we recommend using EAP-MD5. # If the request does not contain an EAP # conversation, then this configuration entry # is ignored. default_eap_type = md5 # The tunneled authentication request does # not usually contain useful attributes # like 'Calling-Station-Id', etc. These # attributes are outside of the tunnel, # and normally unavailable to the tunneled # authentication request. # # By setting this configuration entry to # 'yes', any attribute which NOT in the # tunneled authentication request, but # which IS available outside of the tunnel, # is copied to the tunneled request. # # allowed values: {no, yes} # copy_request_to_tunnel = no # The reply attributes sent to the NAS are # usually based on the name of the user # 'outside' of the tunnel (usually # 'anonymous'). If you want to send the # reply attributes based on the user name # inside of the tunnel, then set this # configuration entry to 'yes', and the reply # to the NAS will be taken from the reply to # the tunneled request. # # allowed values: {no, yes} # use_tunneled_reply = no } # # The tunneled EAP session needs a default EAP type # which is separate from the one for the non-tunneled # EAP module. Inside of the TLS/PEAP tunnel, we # recommend using EAP-MS-CHAPv2. # # The PEAP module needs the TLS module to be installed # and configured, in order to use the TLS tunnel # inside of the EAP packet. You will still need to # configure the TLS module, even if you do not want # to deploy EAP-TLS in your network. Users will not # be able to request EAP-TLS, as it requires them to # have a client certificate. EAP-PEAP does not # require a client certificate. # peap { # The tunneled EAP session needs a default # EAP type which is separate from the one for # the non-tunneled EAP module. Inside of the # PEAP tunnel, we recommend using MS-CHAPv2, # as that is the default type supported by # Windows clients. default_eap_type = mschapv2 } # # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. # mschapv2 { } } If anyone knows what needs done to get this working please assist. Thanks, Seann

2 1

Logical "or not" operator in users file?
by Donnelly, Michael (OFT) 12 Jun '09

12 Jun '09

I have a check to verify that a user is allowed to use radius at all, simply by checking if they are in the "radius" group. DEFAULT Group != "radius", Auth-Type == Reject Reply-Message == " Not in radius group" I would like to expand this to check against TWO groups. If user is in either one then pass , if user is in neither then generate the Reply-Message == " Not in radius group(s)" Its likely a simple tweak, but its escaping me. Is this where !* would serve? Thank You! ________________________________ This e-mail, including any attachments, may be confidential, privileged or otherwise legally protected. It is intended only for the addressee. If you received this e-mail in error or from someone who was not authorized to send it to you, do not disseminate, copy or otherwise use this e-mail or its attachments. Please notify the sender immediately by reply e-mail and delete the e-mail from your system.

2 2

Re: MAC Authentication
by Steve Wu 12 Jun '09

12 Jun '09

OK, it took a server reboot for FR to see the change in the users file. Case does count. Brain dead, thanks for giving me the nudge... it's all good now, onto MySQL and Daloradius... ----- Original Message ----- From: "Kenneth Grady" <klg(a)lanl.gov> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Thursday, June 11, 2009 12:50:26 PM GMT -05:00 US/Canada Eastern Subject: Re: MAC Authentication case counts, try adding the entry in your users file with lowercase. Steve Wu wrote: > Everyone - > > I'm being a bit brain dead most likely. I have been tinkering with > Freeradius and MAC authentication successfully. Now I have a real > server to build FR on so I proceeded to build the new server. After > going through the *same* steps to build FR, duplicating the > clients.conf and users file, I can't get the auth to work again. In my > notes these were the two files I touched to get it going, but I'm > hoping I missed something simple. > > My -Xy output looks like this: > > --- Walking the entire request list --- > Waking up in 1 seconds... > rad_recv: Access-Request packet from host 10.10.18.208:1030, id=16, > length=53 > User-Name = "000e35-84610a" > User-Password = "000e35-84610a" > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 1 > modcall[authorize]: module "preprocess" returns ok for request 1 > modcall[authorize]: module "chap" returns noop for request 1 > modcall[authorize]: module "mschap" returns noop for request 1 > rlm_realm: No '@' in User-Name = "000e35-84610a", looking up realm > NULL > rlm_realm: No such realm "NULL" > modcall[authorize]: module "suffix" returns noop for request 1 > rlm_eap: No EAP-Message, not doing EAP > modcall[authorize]: module "eap" returns noop for request 1 > modcall[authorize]: module "files" returns notfound for request 1 > rlm_pap: WARNING! No "known good" password found for the user. > Authentication may fail because of this. > modcall[authorize]: module "pap" returns noop for request 1 > modcall: leaving group authorize (returns ok) for request 1 > auth: No authenticate method (Auth-Type) configuration found for the > request: Rejecting the user > auth: Failed to validate the user. > Delaying request 1 for 1 seconds > Finished request 1 > Going to the next request > Waking up in 1 seconds... > > My users file: > > 000E35-84610A Cleartext-Password := "000E35-84610A" > > > Any help to recover from my brain lapse would be greatly appreciated. > Did I miss some other config tweak so it's looking at the user file? > > Thx in advance! > > > > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Logical "or not" operator in users file?
by Ivan Kalik 12 Jun '09

12 Jun '09

> I have a check to verify that a user is allowed to use radius at all, > simply > by checking if they are in the "radius" group. > > DEFAULT Group != "radius", Auth-Type == Reject > Reply-Message == " Not in radius group" > > I would like to expand this to check against TWO groups. If user is in > either one then pass , > if user is in neither then generate the Reply-Message == " Not in > radius group(s)" > > Its likely a simple tweak, but its escaping me. Is this where !* would > serve? DEFAULT Group == "group1" DEFAULT Group == "group2" DEFAULT Auth-Type == Reject Reply-Message == " Not in radius group" Ivan Kalik Kalik Informatika ISP

1 0

multiple radiusVSA in ldap.attrmap
by François Mehault 12 Jun '09

12 Jun '09

Hi, I would like to have a profil administrator on my openldap wich allows administrator to authenticate on cisco and foundry equipment and enters directly in Privileged EXEC level. So I read VSA attribute in dictionary.foundry and dictionary.cisco. I created my profile in OpenLDAP and I am logging on my cisco and see the reply log to see what is reply. With this profil : dn: cn=administrateur,ou=Profiles,dc=netplus,dc=fr objectClass: radiusObjectProfile objectClass: top objectClass: radiusprofile radiusServiceType: NAS-Prompt-User cn: administrateur radiusVSA: shell:priv-lvl=15 radiusReplyItem: "Foundry-Privilege-Level = 0" radiusReplyItem: "Foundry-Command-String = *" radiusReplyItem: "Foundry-Command-Exception-Flag = 0" radiusReplyItem: "Foundry-INM-Privilege = 15" + in ldap.attrmap I add replyItem $GENERIC$ radiusReplyItem [...] replyItem Cisco-AVPair radiusVSA I see in my log : Fri Jun 12 12:01:07 2009 Packet-Type = Access-Accept Reply-Message = "Utilisateur: fmehault, group: Administrateur" Cisco-AVPair = "shell:priv-lvl=15" Service-Type = NAS-Prompt-User With this profil : dn: cn=administrateur,ou=Profiles,dc=netplus,dc=fr objectClass: radiusObjectProfile objectClass: top objectClass: radiusprofile radiusServiceType: NAS-Prompt-User cn: administrateur radiusVSA: shell:priv-lvl=15 radiusVSA: 0 radiusVSA: 15 + in ldap.attrmap I add replyItem Cisco-AVPair radiusVSA replyItem Foundry-Privilege-Level radiusVSA replyItem Foundry-INM-Privilege radiusVSA I see in my log : Fri Jun 12 12:14:49 2009 Packet-Type = Access-Accept Reply-Message = "Utilisateur: fmehault, group: Administrateur" Foundry-INM-Privilege = AAA_pri_15 Foundry-Privilege-Level = 15 Cisco-AVPair = "shell:priv-lvl=15" Service-Type = NAS-Prompt-User I don't succeed to give good value for each attribute with OpenLDAP, ldapattrmap, radiusVSA ... In addition, I can't to have two radiusVSA attributes with the same value in OpenLDAP. So I woul like to know if it is possible to have just one profil with several attributes for different constructor (foundry, cisco, fortinet ...). Or I have to do a profil administratorCisco, administratorFoundry, ... Thanks for your help in advance Regards, François Mehault

3 3

Robust proxy accounting
by Chris Howley 12 Jun '09

12 Jun '09

Ivan, I doubled the value of cleanup delay in radiusd.conf. This change didn't fix the problem (see below). Thanks for your help, Chris ++[exec] returns noop Sending Access-Accept of id 88 to 10.12.80.109 port 32769 User-Name = "isschug" MS-MPPE-Recv-Key = 0x529e91a0004dce6a6ba2d81c79eeeb98aa3bc7c08880c37d95236064ef786280 MS-MPPE-Send-Key = 0x59005da107574a481d3a7d580821be64872d65153f9767789e79a51f84880994 EAP-Message = 0x030b0004 Message-Authenticator = 0x00000000000000000000000000000000 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3021," Reply-Message = "Welcome isschug - student" Finished request 9. Going to the next request Waking up in 0.9 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" +- entering group preacct {...} ++[preprocess] returns ok [acct_unique] Hashing 'NAS-Port = 29,Client-IP-Address = 10.12.80.109,NAS-IP-Address = 10.12.80.109,Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49",User-Name = "isschug"' [acct_unique] Acct-Unique-Session-ID = "829905a4bf02a129". ++[acct_unique] returns ok [suffix] No '@' in User-Name = "isschug", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[files] returns noop +- entering group accounting {...} [detail] expand: /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 -> /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-11:00 [detail] /usr/local/var/log/radius/radacct/%Y-%m-%d/accounting-detail-%H:00 expands to /usr/local/var/log/radius/radacct/2009-06-12/accounting-detail-11:00 [detail] expand: %{Packet-Src-IP-Address} - %t -> 10.12.80.109 - Fri Jun 12 11:51:48 2009 ++[detail] returns ok ++? if ("%{Client-IP-Address}" != "129.11.162.17") expand: %{Client-IP-Address} -> 10.12.80.109 ? Evaluating ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++? if ("%{Client-IP-Address}" != "129.11.162.17") -> TRUE ++- entering if ("%{Client-IP-Address}" != "129.11.162.17") {...} +++[control] returns ok ++- if ("%{Client-IP-Address}" != "129.11.162.17") returns ok ++[unix] returns ok [radutmp] expand: /usr/local/var/log/radius/radutmp -> /usr/local/var/log/radius/radutmp [radutmp] expand: %{User-Name} -> isschug ++[radutmp] returns ok [attr_filter.accounting_response] expand: %{User-Name} -> isschug attr_filter: Matched entry DEFAULT at line 1 ++[attr_filter.accounting_response] returns updated server home.example.com { } Sending Accounting-Request of id 167 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313337 Proxying request 10 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 167 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Proxy-State = 0x313337 Going to the next request Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.9 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 137 due to unfinished request 10 Waking up in 0.2 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.3 seconds. Cleaning up request 0 ID 79 with timestamp +1750 Cleaning up request 1 ID 80 with timestamp +1750 Cleaning up request 2 ID 81 with timestamp +1750 Cleaning up request 3 ID 82 with timestamp +1750 Cleaning up request 4 ID 83 with timestamp +1750 Cleaning up request 5 ID 84 with timestamp +1750 Cleaning up request 6 ID 85 with timestamp +1750 Waking up in 0.2 seconds. Cleaning up request 7 ID 86 with timestamp +1750 Cleaning up request 8 ID 87 with timestamp +1751 Cleaning up request 9 ID 88 with timestamp +1751 Waking up in 0.1 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 137 due to unfinished request 10 Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 0.4 seconds. rad_recv: Accounting-Request packet from host 10.12.80.109 port 32769, id=137, length=156 Discarding duplicate request from client wism07-1 port 32769 - ID: 137 due to unfinished request 10 Rejecting request 10 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] expand: /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H -> /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:11 [detail.example.com] /usr/local/var/log/radius/radacct/detail.example.com/detail-%Y%m%d:%H expands to /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:11 [detail.example.com] expand: %t -> Fri Jun 12 11:51:48 2009 [detail.example.com] Freeradius-Proxied-To = 129.11.162.17 ++[detail.example.com] returns ok } Sending Accounting-Response of id 137 to 10.12.80.109 port 32769 Finished request 10. Cleaning up request 10 ID 137 with timestamp +1758 Going to the next request PROXY: Marking home server 129.11.162.17 port 1813 as zombie (it looks like it is dead). Sending Status-Server of id 86 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 0.7 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* detail_recv: Renaming /usr/local/var/log/radius/radacct/detail.example.com/detail-20090612:11 -> /usr/local/var/log/radius/radacct/detail.example.com/detail.work detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "829905a4bf02a129" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 11:51:48 BST" Acct-Delay-Time = 7 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 179 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3339353133 Proxying request 12 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 179 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 7 Proxy-State = 0x3339353133 Going to the next request Waking up in 0.8 seconds. Waking up in 0.1 seconds. Waking up in 0.6 seconds. Waking up in 1.0 seconds. Waking up in 0.5 seconds. Waking up in 0.6 seconds. Waking up in 0.8 seconds. Waking up in 0.9 seconds. Waking up in 0.3 seconds. Rejecting request 12 due to lack of any response from home server 129.11.162.17 port 1813 Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 12. Cleaning up request 12 ID 39513 with timestamp +1765 Going to the next request Waking up in 0.7 seconds. Waking up in 26.6 seconds. Sending Status-Server of id 141 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.3 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "829905a4bf02a129" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 11:51:48 BST" Acct-Delay-Time = 43 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } Sending Accounting-Request of id 210 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3232383630 Proxying request 14 to home server 129.11.162.17 port 1813 Sending Accounting-Request of id 210 to 129.11.162.17 port 1813 User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" FreeRADIUS-Proxied-To = 129.11.162.17 Acct-Delay-Time = 43 Proxy-State = 0x3232383630 Going to the next request Waking up in 0.6 seconds. Waking up in 0.3 seconds. Waking up in 1.1 seconds. Waking up in 1.0 seconds. Waking up in 0.8 seconds. Waking up in 0.7 seconds. Waking up in 1.1 seconds. Rejecting request 14 due to lack of any response from home server 129.11.162.17 port 1813 PROXY: Marking home server 129.11.162.17 port 1813 as dead. Found Post-Proxy-Type server home.example.com { +- entering group Fail {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } server home.example.com { } # server home.example.com Finished request 14. Cleaning up request 14 ID 22860 with timestamp +1801 Going to the next request Waking up in 25.5 seconds. Sending Status-Server of id 186 to 129.11.162.17 port 1813 Message-Authenticator := 0x00000000000000000000000000000000 NAS-Identifier := "Status Check. Are you alive?" Waking up in 3.9 seconds. Waking up in 0.4 seconds. detail_recv: Read packet from /usr/local/var/log/radius/radacct/detail.example.com/detail.work User-Name = "isschug" NAS-Port = 29 NAS-IP-Address = 10.12.80.109 Framed-IP-Address = 129.11.1.138 NAS-Identifier = "WM07-1" Airespace-Wlan-Id = 1 Acct-Session-Id = "4a323344/00:13:02:8d:f3:1f/49" Acct-Authentic = RADIUS Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "3022" Acct-Status-Type = Start Calling-Station-Id = "129.11.1.138" Called-Station-Id = "10.12.80.109" Acct-Unique-Session-Id = "829905a4bf02a129" Realm = "acct_realm.example.com" FreeRADIUS-Proxied-To = 129.11.162.17 Packet-Original-Timestamp = "Jun 12 2009 11:51:48 BST" Acct-Delay-Time = 79 server home.example.com { +- entering group accounting {...} ++[control] returns noop } # server home.example.com server home.example.com { } >>> Sending proxied request internally to virtual server. server acct_detail.example.com { +- entering group accounting {...} [detail.example.com] Suppressing writes to detail file as the request was just read from a detail file. ++[detail.example.com] returns noop } # server acct_detail.example.com Going to the next request <<< Received proxied response from internal virtual server. server home.example.com { } server home.example.com { } # server home.example.com Finished request 16. Cleaning up request 16 ID 56874 with timestamp +1837 Going to the next request Waking up in 0.8 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:* Waking up in 1.0 seconds. Polling for detail file /usr/local/var/log/radius/radacct/detail.example.com/detail-*:*

2 1

my freeradius-2.1.6 is not auth with PIN only.
by Goke M Aruna 12 Jun '09

12 Jun '09

I will be glad, if anyone can direct me to whare The log below is the part of the debug for the new test freeradius server 2.1.6 am testing with. However, the hotspotlogin,cgi is able to pass the param username to the radius but when the query is run against the database the "Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031" the value of the username sent is changed. I have disabled the chap in the /usr/local/etc/raddb/sites-enabled/default. kindly advise on what to do. ################### my radcheck has the info below. mysql> select * from radcheck; +-----+------------+--------------------+----+------------+ | id | username | attribute | op | value | +-----+------------+--------------------+----+------------+ | 5 | 2345678901 | Auth-Type | := | Accept | | 201 | 1234567890 | Cleartext-Password | := | 1234567890 | +-----+------------+--------------------+----+------------+ 4 rows in set (0.00 sec) ######################radiusd -XX (part of the debug) rad_recv: Access-Request packet from host 127.0.0.1 port 44600, id=0, length=189 ChilliSpot-Max-Input-Octets = 0x32333435363738393031 ChilliSpot-Max-Output-Octets = 0 NAS-IP-Address = 127.0.0.1 Service-Type = Login-User Framed-IP-Address = 192.168.182.2 Calling-Station-Id = "00-1F-29-80-62-F3" Called-Station-Id = "00-50-DA-0C-C9-B0" NAS-Identifier = "nas01" Acct-Session-Id = "4a2e6a7700000000" NAS-Port-Type = Wireless-802.11 NAS-Port = 0 Message-Authenticator = 0xf2ee6add34820fb96dcceef08c07bbc5 WISPr-Logoff-URL = "http://192.168.182.1:3990/logoff" Tue Jun 9 14:59:48 2009 : Info: +- entering group authorize {...} Tue Jun 9 14:59:48 2009 : Info: ++[preprocess] returns ok Tue Jun 9 14:59:48 2009 : Info: ++[mschap] returns noop Tue Jun 9 14:59:48 2009 : Info: [suffix] No '@' in User-Name = "2345678901", looking up realm NULL Tue Jun 9 14:59:48 2009 : Info: [suffix] No such realm "NULL" Tue Jun 9 14:59:48 2009 : Info: ++[suffix] returns noop Tue Jun 9 14:59:48 2009 : Info: [eap] No EAP-Message, not doing EAP Tue Jun 9 14:59:48 2009 : Info: ++[eap] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[unix] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[files] returns noop Tue Jun 9 14:59:48 2009 : Info: [sql] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Info: [sql] sql_set_user escaped user --> '0x32333435363738393031' Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Reserving sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id -> SELECT id, username, attribute, value, op FROM radcheck WHERE username = '0x32333435363738393031' ORDER BY id Tue Jun 9 14:59:48 2009 : Info: [sql] expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergroup WHERE username = '0x32333435363738393031' ORDER BY priority Tue Jun 9 14:59:48 2009 : Debug: rlm_sql (sql): Released sql socket id: 4 Tue Jun 9 14:59:48 2009 : Info: [sql] User 0x32333435363738393031 not found Tue Jun 9 14:59:48 2009 : Info: ++[sql] returns notfound Tue Jun 9 14:59:48 2009 : Info: ++[expiration] returns noop Tue Jun 9 14:59:48 2009 : Info: ++[logintime] returns noop Tue Jun 9 14:59:48 2009 : Info: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. Tue Jun 9 14:59:48 2009 : Info: ++[pap] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[validity] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[noresetcounter] returns noop Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Entering module authorize code Tue Jun 9 14:59:48 2009 : Debug: rlm_sqlcounter: Could not find Check item value pair Tue Jun 9 14:59:48 2009 : Info: ++[hotspotcontrol] returns noop Tue Jun 9 14:59:48 2009 : Info: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Tue Jun 9 14:59:48 2009 : Info: Failed to authenticate the user. Tue Jun 9 14:59:48 2009 : Info: Using Post-Auth-Type Reject Tue Jun 9 14:59:48 2009 : Info: +- entering group REJECT {...} Tue Jun 9 14:59:48 2009 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 0x32333435363738393031 Tue Jun 9 14:59:48 2009 : Debug: attr_filter: Matched entry DEFAULT at line 11 Tue Jun 9 14:59:48 2009 : Info: ++[attr_filter.access_reject] returns updated Tue Jun 9 14:59:48 2009 : Info: Delaying reject of request 0 for 1 seconds Tue Jun 9 14:59:48 2009 : Debug: Going to the next request Tue Jun 9 14:59:48 2009 : Debug: Waking up in 0.9 seconds. Tue Jun 9 14:59:49 2009 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 0 to 127.0.0.1 port 44600 Tue Jun 9 14:59:49 2009 : Debug: Waking up in 4.9 seconds. Tue Jun 9 14:59:54 2009 : Info: Cleaning up request 0 ID 0 with timestamp +187 Tue Jun 9 14:59:54 2009 : Debug: Ready to process requests.

2 2

refresh variable after exec module
by bLn 12 Jun '09

12 Jun '09

Good morning, I back with the same problem. I've seeing past post for last week but I have any wrong because those solutions don't work for me. I have a script in exec module which set 2 values: Session-Timeout if everything is correct for each user and it calculate his remaining time to connect, and Reply-Message if there is any problem, to show this message to the user I've seen these values are cached before when mysql runs the queries to radcheck, radgroupchek, radreply, etc...in authtorize section and when I execute my script in post-auth module the new values aren't replaced and sent together with Access-Accept or Access-Reject I've done an update in post-auth section, like you said in last posts, in two different modes: first example: Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "%{reply:Reply-Message}" } sql reply_log } Second example: Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log } I've set Reply-Message := "pepe" to try without a variable but unsuccessfully because I'm not sure if I've set the variable correctly but if I put the value of variable and this is not send neither it is because my value is not replaced by the before one, ok? why? Post-Auth section post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. reply_log # # After authenticating the user, do another SQL query. # # See "Authentication Logging Queries" in sql.conf sql # # Instead of sending the query to the SQL server, # write it into a log file. # sql_log # # Un-comment the following if you have set # 'edir_account_policy_check = yes' in the ldap module sub-section of # the 'modules' section. # # ldap exec update outer.reply { Session-Timeout:="%{reply:Session-Timeout}" } # # Access-Reject packets are sent through the REJECT sub-section of the # post-auth section. # # Add the ldap module name (or instance) if you have set # 'edir_account_policy_check = yes' in the ldap module configuration # Post-Auth-Type REJECT { attr_filter.access_reject update outer.reply { Reply-Message := "pepe" } sql reply_log } } I try with "update reply" too. I don't understand the different between both modes. Can you say me where I can read the neccesary doc to find this difference? thanks in advance and I'm sorry to repeat this issue again

3 9

MAC Authentication
by Steve Wu 11 Jun '09

11 Jun '09

Everyone - I'm being a bit brain dead most likely. I have been tinkering with Freeradius and MAC authentication successfully. Now I have a real server to build FR on so I proceeded to build the new server. After going through the *same* steps to build FR, duplicating the clients.conf and users file, I can't get the auth to work again. In my notes these were the two files I touched to get it going, but I'm hoping I missed something simple. My -Xy output looks like this: --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Request packet from host 10.10.18.208:1030, id=16, length=53 User-Name = "000e35-84610a" User-Password = "000e35-84610a" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "000e35-84610a", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 1 modcall[authorize]: module "files" returns notfound for request 1 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 1 modcall: leaving group authorize (returns ok) for request 1 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 1 for 1 seconds Finished request 1 Going to the next request Waking up in 1 seconds... My users file: 000E35-84610A Cleartext-Password := "000E35-84610A" Any help to recover from my brain lapse would be greatly appreciated. Did I miss some other config tweak so it's looking at the user file? Thx in advance!

3 3

Change of Authorization (RFC 3576 / 5176)
by Alan DeKok 11 Jun '09

11 Jun '09

I have just committed *full* support for CoA to the "stable" and "master" branches on git.freeradius.org. I'd like to thank the sponsor of this work, who wishes to remain anonymous. In 2.1.6, the server could *originate* CoA packets. e.g. If the users bandwidth consumption is over a quota, send a packet to disconnect them. In the current "git" code, it can now *receive* CoA packets. This also means full proxying of CoA packets. It is now possible to implement functionality such as: "disconnect user bob" This can be done by sending a CoA packet to the server, with User-Name of "bob". The policies on the server can then look up in the accounting database to see where that user has logged in, and fill in the rest of the CoA packet with NAS IP, port, etc. The resulting packet can then be sent to the NAS. The only caveat is that none of these policies have been written. The functionality works, and has been tested with switches from at least one major networking vendor. We now need help to create the policies, schemas, etc. to implement the required functionality. Alan DeKok.

5 8