- Freeradius-Users - lists.freeradius.org

Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, Maybe im not started this post clearly. So i try open again what i want to do. I have a computer certificates. I also have openldap and that ldap includes my computer accounts. Now I want to use those certificates to authenticate computers and get authorization information inside my ldap. If computers dont have account in my ldap it's rejected. But if i put only ldap in my authorization section radius gives: "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" If i put also eap in authorization section, the radius uses eap for authorization and give access-accept. Even if user not found in ldap. Br, Ville >Here is some other logs if i use only ldap for authorize section: > >You have butchered the configuration and now you are wondering why it's >not working? If you don't know what you are doing - don't do it. If >you feel the urge to disable something (disbling unused modules is >hardly going to make any impact on preformance) get things working first >- than remove things you feel you must one by one. If you remove >something vital you will know what it was and will be able to put it >back. >Use default configuration. Configure *only* ldap module. Don't make >*any* changes to virtual servers (authorize, authenticate etc.). And it >will work. >Ivan Kalik >Kalik Informatika ISP

1 0

Re: Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, I read that, but what if user not found in ldap? Radius seems to need some auth-type. How i can force auth-type using ldap? My radius gives this message -> "No authenticate method (Auth-Type) configuration found for the request: Rejecting the user" Here is some other logs if i use only ldap for authorize section: rad_recv: Access-Request packet from host 10.10.1.100 port 1024, id=198, length=224 Framed-MTU = 1466 NAS-IP-Address = 10.10.1.100 NAS-Identifier = "8021x" User-Name = "lnx01.demo.local" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 37 NAS-Port-Type = Ethernet NAS-Port-Id = "37" Called-Station-Id = "00-16-b9-55-48-c0" Calling-Station-Id = "00-e0-00-1c-1e-c1" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "1" EAP-Message = 0x02330016017375736530312e64656d6f2e6c6f63616c Message-Authenticator = 0x5c313918e00d0d385d435e3194c284ed +- entering group authorize {...} ++[preprocess] returns ok [suffix] No '@' in User-Name = "lnx01.demo.local", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [files] users: Matched entry DEFAULT at line 190 ++[files] returns ok [ldap] performing user authorization for lnx01.demo.local [ldap] expand: (cn=%u) -> (cn=lnx01.demo.local) [ldap] expand: ou=8021x,dc=demo,dc=local -> ou=8021x,dc=demo,dc=local rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 10.10.101.31:389, authentication 0 rlm_ldap: setting TLS CACert Directory to /path/to/ca/dir/ rlm_ldap: bind as cn=Directory Manager/ to 10.10.101.31:389 rlm_ldap: waiting for bind result ... request done: ld 0x9ba2480 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in ou=8021x,dc=demo,dc=local, with filter (cn=lnx01.demo.local) request done: ld 0x9ba2480 msgid 2 [ldap] looking for check items in directory... [ldap] looking for reply items in directory... WARNING: No "known good" password was found in LDAP. Are you sure that the user is configured correctly? [ldap] user suse01.demo.local authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop No authenticate method (Auth-Type) configuration found for the request: Rejecting the user Failed to authenticate the user. Login incorrect: [suse01.demo.local/<no User-Password attribute>] (from client 8021x port 37 cli 00-e0-00-1c-1e-c1) Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> suse01.demo.local attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 198 to 10.10.1.100 port 1024 Waking up in 4.9 seconds. Cleaning up request 0 ID 198 with timestamp +6 Ready to process requests. Br, Ville >We have openldap which includes our machine accounts. We >have also computer certificates. Now what i want to do that freeradius, >checks authorization against ldap and authenticate against certificates. > >I have tested to put ldap to authorization section and eap to authentication >section, but this wont work. I have also tested to put both ldap and eap to >authorization section, but ldap wont return reject if user's noot found. > >Is there any method to return reject for authorization section if user not >found in ldap and stop processing there? Or is there any other method to do this? > >Read doc/rlm_ldap about access_attr. >Ivan Kalik >Kalik Informatika ISP

2 1

Freeradius 2.1.5 and LDAP+EAP-TLS problem.
by Ville Leinonen 30 Mar '09

30 Mar '09

Hi, We have openldap which includes our machine accounts. We have also computer certificates. Now what i want to do that freeradius, checks authorization against ldap and authenticate against certificates. I have tested to put ldap to authorization section and eap to authentication section, but this wont work. I have also tested to put both ldap and eap to authorization section, but ldap wont return reject if user's noot found. Is there any method to return reject for authorization section if user not found in ldap and stop processing there? Or is there any other method to do this? We also have printers, which uses 802.1x mac-auth. Br, Ville Leinonen

2 1

about VSA attribute
by Tseveendorj 30 Mar '09

30 Mar '09

Hello, I'm trying to implement ADSL service via cisco router by NAS, FreeRADIUS 2.1.3 by AAA server and daloRADIUS. On the cisco router I defined some policy-map for traffic shape. In the radgroupreply table contains following attribute with value. "cisco-avpair", ":= ", "ip:sub-policy-Out=512Kbps" Question is How to define 2 difference policy-map on the one user in FreeRADIUS Databse. example: "cisco-avpair", ":= ", "ip:sub-policy-Out=512Kbps" "cisco-avpair", ":= ", "ip:sub-policy-Out=1Mbps" Really appreciate any help. Sincerely, Tseveen

2 4

help
by William Esteves 29 Mar '09

29 Mar '09

I have one answer, maybe its cause im newba in freeradius =] the situation is, sometimes my bd in mysql (that run on another computer) crash or have problems, how can i autenticate all users with any password or any usernames? Then i let my clients coneccted and can fix my db server how can i do this? thanks 4all William Esteves _________________________________________________________________ Confira vídeos com notícias do NY Times, gols direto do Lance, videocassetadas e muito mais no MSN Video! http://video.msn.com/?mkt=pt-br

2 1

running freeradius with eap/tls :(
by Wiem Tounsi 29 Mar '09

29 Mar '09

hello; I have to run freeradius with 802.1X protocol : EAP/TLS. i did all my possible but i had no chance to connect my client (wpa_supplicant with the server).. My AP is also well configured.. here i'll send you the debug I have from freeradius and the client... freeradius detect a signal but there is no connection with EAP/TLS.. please, help me to now the problem.. i'm too late.. thank you . *the outpu of freeradius when trying to connect the client:* root@xxxxt:/usr/local/etc/raddb# radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" pap: auto_header = yes Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = no mschap: require_strong = no mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/serveur.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "%{User-Name}" tls: cipher_list = "(null)" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no preprocess: with_alvarion_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Accounting-Request packet from host 192.168.0.228:2159, id=12, length=156 Acct-Session-Id = "00000019-00000043" Acct-Status-Type = Start Acct-Authentic = Local User-Name = "001b770fdb97" NAS-IP-Address = 127.0.0.1 NAS-Port = 2 Called-Station-Id = "00-1E-2A-C6-61-58:xxxx" Calling-Station-Id = "00-1B-77-0F-DB-97" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" Processing the preacct section of radiusd.conf modcall: entering group preacct for request 0 modcall[preacct]: module "preprocess" returns noop for request 0 rlm_acct_unique: Hashing 'NAS-Port = 2,Client-IP-Address = 192.168.0.228,NAS-IP-Address = 127.0.0.1,Acct-Session-Id = "00000019-00000043",User-Name = "001b770fdb97"' rlm_acct_unique: Acct-Unique-Session-ID = "2454d13eda8ab416". modcall[preacct]: module "acct_unique" returns ok for request 0 rlm_realm: No '@' in User-Name = "001b770fdb97", looking up realm NULL rlm_realm: No such realm "NULL" modcall[preacct]: module "suffix" returns noop for request 0 modcall[preacct]: module "files" returns noop for request 0 modcall: leaving group preacct (returns ok) for request 0 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 0 radius_xlat: '/usr/local/var/log/radius/radacct/ 192.168.0.228/detail-20090321' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/192.168.0.228/detail-20090321 modcall[accounting]: module "detail" returns ok for request 0 modcall[accounting]: module "unix" returns ok for request 0 radius_xlat: '/usr/local/var/log/radius/radutmp' radius_xlat: '001b770fdb97' modcall[accounting]: module "radutmp" returns ok for request 0 modcall: leaving group accounting (returns ok) for request 0 Sending Accounting-Response of id 12 to 192.168.0.228 port 2159 Finished request 0 Going to the next request --- Walking the entire request list --- Cleaning up request 0 ID 12 with timestamp 49c53da1 Nothing to do. Sleeping until we see a request. *the output of client:* phare@phare:~$ sudo wpa_supplicant -Dwext -iwlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf Associated with 00:1e:2a:c6:61:58 Authentication with 00:1e:2a:c6:61:58 timed out. CTRL-EVENT-SCAN-RESULTS CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys ioctl[SIOCSIWENCODEEXT]: No such file or directory CTRL-EVENT-SCAN-RESULTS CTRL-EVENT-SCAN-RESULTS

2 3

Authentication Digest
by Varadharajan Seshadri 28 Mar '09

28 Mar '09

Hi, I would like to have my SIP clients authenticate with Active Directory (AD). I am using RADIUS in the middle to do the digest based authentication between by sip client and AD. SIP Client ---> RADIUS Client ---> RADIUS Server (IAS of windows server) ----> Activer Directory is my setup. I downloaded RADIUS Client version 1.1.6 (which is the latest i find in freeradius.org) to do the digest based Auth. Following is the AV pair i used to form my Request packet, as per RFC 4590/5090 PW_USER_NAME PW_SERVICE_TYPE PW_DIGEST_REALM PW_DIGEST_METHOD PW_DIGEST_ALGORITHM PW_DIGEST_URI RADIUS server (IAS of Windows) complains of malformed packets. If any of you have used digest based authentication, using Freeradius client, i would like you to help me with this. Also, i am not sure how to add message autehnticator to this request message, which i understand is mandatory. Not sure if this is THE issue. Thanks Varad Windows Live Messenger. Multitasking at its finest. _________________________________________________________________ Twice the fun—Share photos while you chat with Windows Live Messenger. http://www.microsoft.com/india/windows/windowslive/messenger.aspx

2 3

Filtering reply attributes for certain NAS devices
by Paul Hanson 28 Mar '09

28 Mar '09

Quick question (I hope)... What options do I have to limit or mask certain attributes depending upon the NAS device? I have approx 14 devices that need specific attributes but other devices have issues with some optional reply attributes. My current setup uses two LDAP instances, PostgreSQL database, exec scripts for attribute rewrites and I'm using default_profile for global attributes via LDAP and optional per user attributes in LDAP too. As usual, freeradius generally has a multitude of ways to achieve the same task....what options/alternatives/combinations do I have??? Regards ***Disclaimer*** This email and any attachments may contain confidential and/or privileged material; it is for the intended addressee(s) only. If you are not a named addressee, you must not use, retain or disclose such information. The Waterdale Group (3477263), comprising of CPiO Limited (2488682), Ardent Solutions Limited (4807328), eSpida Limited (4021203), Advanced Digital Technology Limited (1750478) and Intellisell (6070355) whilst taking all reasonable precautions against email or attachment viruses, cannot guarantee the safety of this email. The views expressed in this email are those of the originator and do not necessarily represent the views of The Waterdale Group Nothing in this email shall bind The Waterdale Group in any contract or obligation. For further information visit www.waterdalegroup.co.uk

2 1

Exec-Program-Wait w/ FreeRADIUS 2.1.3
by Jeremiah Millay 28 Mar '09

28 Mar '09

I'm having trouble getting FreeRADIUS to run programs called by Exec-Program-Wait in the newest version of FreeRADIUS (version 2.1.3). I'm using a custom C script that used to work with all versions of FreeRADIUS prior to version 2. I have an entry like this in the users file which is matching my access-requests: DEFAULT Suffix == "@test.net", Auth-Type := Accept Exec-Program-Wait = "/usr/local/sbin/checkradacct %{Stripped-User-Name} %{Password}", Ascend-Data-Filter += "ip in forward tcp est", Ascend-Data-Filter += "ip in forward dstip 10.0.0.0/24 tcp", Ascend-Data-Filter += "ip in drop tcp dstport = 25", Ascend-Data-Filter += "ip in forward", Fall-Through = No Here is my debugging output when I attempt to authenticate (doesn't appear to execute my program): Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.1.1.1 port 49411, id=74, length=76 User-Name = "jmillay(a)test.net" User-Password = "blah" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Framed-Protocol = PPP +- entering group authorize {...} ++[preprocess] returns ok [auth_log] expand: /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/radacct/10.1.1.1/auth-detail-20090317 [auth_log] /var/log/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/radacct/10.1.1.1/auth-detail-20090317 [auth_log] expand: %t -> Tue Mar 17 13:58:23 2009 ++[auth_log] returns ok [suffix] Looking up realm "test.net" for User-Name = "jmillay(a)test.net" [suffix] Found realm "test.net" [suffix] Adding Stripped-User-Name = "jmillay" [suffix] Adding Realm = "test.net" [suffix] Authentication realm is LOCAL. ++[suffix] returns ok [files] users: Matched entry DEFAULT at line 26 [files] expand: /usr/local/sbin/checkradacct %{Stripped-User-Name} %{Password} -> /usr/local/sbin/checkradacct jmillay blah ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Accept Auth-Type = Accept, accepting the user Login OK: [jmillay(a)test.net] (from client 10.1.1.1 port 0) Sending Access-Accept of id 74 to 10.1.1.1 port 49411 Ascend-Data-Filter += "ip in forward tcp est" Ascend-Data-Filter += "ip in forward dstip 10.0.0.0/24 tcp" Ascend-Data-Filter += "ip in drop tcp dstport = 25" Ascend-Data-Filter += "ip in forward 0" Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 74 with timestamp +21 Any suggestions? I read in the docs that Exec-Program and Exec-Program-Wait are deprecated but I haven't found any clear documentation on how to configure rlm_exec to duplicate what I am trying to do. Thanks in advance, Jeremiah

4 4

EAP/TLS -- FreeRadius -- 802.1x
by phil lemelin 27 Mar '09

27 Mar '09

Good morning FreeRadius users. I'm going forward with my attempt to configure freeradius and 802.1x to try to secure part of a wired network. I have been reading about FreeRadius, 802.1x, EAP/TLS and XSupplicant. I came accross a link that doesnt work in the freeradius wiki about exactly those subject but I found something on the linux documentation project ( http://tldp.org/HOWTO/html_single/8021X-HOWTO/ ) which seems to cover this subject. I was wondering if users here have experience with this subject and have more documentation on the subject. My main concern being that most documents on the subject date back to 2004 and I dont know if they are still valid with the freeradius version i'm using ( 1.1.3 -> CentOS install ). Thank you in advance. -- Philippe-Alexandre Lemelin

3 11