- Freeradius-Users - lists.freeradius.org

calling-station-id replace and md5 problem
by hege 28 Jan '09

28 Jan '09

Hi I have a problem: 1. The ldap don't replace(expand) the calling-station-id to the mac address, just one time(first) first time: [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=0000.a8bb.4444)) next time: [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=)) no mac address expanded I have tried %i, but not worked (expanded it to macAddress=_ ??? 2. If i use EAP-PEAP + LDAP(cleartext password) works everything. (def_eap_type=peap) but I want to store the password md5 format in the ldap, what have to change, what is the solution? Really thank you! Gabor here is the debug: rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=186, length=128 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x062b1cef262b3e644dc7ccf73c2 EAP-Message = 0x0202000174657374 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for test [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=0000.a8bb.4444)) [ldap] expand: ou=users,ou=wireless,dc=test,dc=hu -> ou=users,ou=wireless,dc=test,dc=hu rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=admin,dc=test,dc=hu to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=users,ou=wireless,dc=test,dc=hu, with filter (&(employeeType=TRUE)(cn=test)(macAddress=0000.a8bb.4444)) [ldap] Added User-Password = test in check items [ldap] looking for check items in directory... rlm_ldap: macAddress -> Calling-Station-Id == "0000.a8bb.4444" [ldap] looking for reply items in directory... [ldap] user test authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Replacing User-Password in config items with Cleartext-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!! Please update your configuration so that the "known good" !!! !!! clear text password is in Cleartext-Password, and not in User-Password. !!! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 186 to 192.168.1.22 port 1645 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb21eed7bf189571f209151db8 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=187, length=217 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x34321379ca3695c51b5ebd770 EAP-Message = 0x0203005019800000004616030100410d030149804ef1e846e0c547f88e3054cbee268ce2b4178c7bc8134b949771a2debdae00001600040005000a0009640062000300060013001200630100 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb21eed7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 70 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0041], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 002a], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 085e], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 187 to 192.168.1.22 port 1645 EAP-Message = 0x0104040019c00000089b160301002a02000026030149804eb2858d10f17f4191308ec2be88f30915e2fcd1a2e391f4914c7c6d10ff000004001603010b00085a0008570003a6308203a23082028aa003020102020101300d06092a864886f70d0101040500308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c457861706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479 EAP-Message = 0x301e170d3039303132373136323631305a170d3130303132373136323631305a307c310b3009060355040613024652310f300d06035504081306526164697573311530130655040a130c4578616d706c6520496e632e312330210603550403131a4578616d706c652053657276657220436576669636174653120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100a2dd30f783fedc0ebb06606a9b8ae089768200bf67c5bf9c11f4cb6ceb75e791b149f370e491be2231ad424449e2c78bdb8d38c1159f78dedfb3507346b9 EAP-Message = 0x2072ee1914779b5c41ef3e1655241282fcb585ceb610d2805cf17cf804618d5817af59bebd15600037f728a8ee77bb037f86ef8ee833fc752992dae041cc7ccceef1c68fe577273ab4890ba75b1cc5a681609187ea3d0adb654c5ca4651af30c925cadb2efb859f696f8e53969b8f30379fe1095bfcb6713d750b9fc3a775b0f2531e6a9705400d00ec85e690fe7a7682290c5588ba15bc3da2a4b4ff8141c168c98ab79615734eb0e2e1e26769c0e22581f4eda365fba7701caadd6a5bbbe73490203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d01010405000382010100cf12958cc07c7de95c EAP-Message = 0xd176d4d452bdd684a169b50b57a247bdf802a7ff11955f409c7668f5565e369af83ea738359a3bb15e5a40dc7794084cddab8743d7cbe7f0ad93e6672279c25640a575482b5591366cac64e3ec424c2679a0a4d59d2727f3bc4bf68b113d4e4edfee756b077fc7e51222fb4d7e6be43cb2b306ff561e69075a3d70560c90ece9970cc1bb230c450e77db5e0c1c164aa0b4be10c3f7226361f491b7171fc2dd07948d0c634751d2d3700ac600be9969e3f6a05c8bef043cd2035410ad4a96fcd7dfd46f70b803907c8c976b39a01f8c7eb961b4015415b533b749ee5e7c711192f06506190eedcd6c46d08bc062ee9ed071c50004ab308204 EAP-Message = 0xa73082038fa0030201020209 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb20e9d7bf189571f209151db8 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=188, length=143 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x6bb7e77a4ec227c2822c42f2b1e6fb EAP-Message = 0x02040061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb20e9d7b9571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 188 to 192.168.1.22 port 1645 EAP-Message = 0x010503fc194000e9429c938605a22c300d06092a864886f70d0101050500308193310b3009060355040613024652310f300d06035504081306526164697573311230106035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274696669636174417574686f72697479301e170d3039303132373136323631305a170d3130303132373136323631305a308193310b3009060355040613024652310f300d060355040813065261646975733112301006035504 EAP-Message = 0x071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706636f6d312630240603550403131d4578616d706c6520436572746966696361746520417574686f7269747930820122300d06092a64886f70d01010105000382010f003082010a0282010100f2747f57bce4bf59d6cc942ac7387d2f81376ad5816d04c8d1ab6091430e895910745313f01c53f4720d43c05ac1287ea26d475826eac158d43a21767296fdd0349d9de9ada5083ff3ee31a254b1f993b21d1e1bed840b241b803bc13546c1789cab52f5865ca4084b74bffe5c1de3 EAP-Message = 0xa3dd190a240f1d1f2104a24e12cb39294ff54a637067da075784279d43072f8e2fe418393ac9f88027076446e612a7dccf08d7cc5d94b9a66ba49d2adb50d1535e6a2389170972f6e66aa09171c47628b409efbe0b0bfcccf8046847b789d80e1f5e1138b7392298b137e6cbb6c8f56952763ce06db19da6cca226cf535352b098764f6ee6bd59ac4ed1ac77909a370203010001a381fb3081f8301d0603551d0e041604140f3428d285dfc3e4e181d546dd066bd5453011b83081c80603551d230481c03081bd80140f3428d285dfc3e4e181d546dd066bd5453011b8a18199a48196308193310b3009060355040613024652310f300d06035504 EAP-Message = 0x0813065261646975733112301006035504071309536f6d65776865726531153013060355040a130c4578616d706c6520496e632e3120301e06092a864886f70d010901161161646d696e406578616d706c652e636f6d312630240603550403131d4578616d706c652043657274696669636146520417574686f72697479820900e9429c938605a22c300c0603551d13040530030101ff300d06092a864886f70d010105050003820106c25ddea16db6b8d5117091ec64bd79f6c19096eade754cd0d43e34b4883ff7b82b90e9eaf308ed2e362c077a2578f101f024417255592904c8e8111c05e663eb76192d39e9b28facdef1e303f846edd7901 EAP-Message = 0x0b07e3d810b8d8c2 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb23e8d7bf189571f209151db8 Finished request 2. Going to the next request Waking up in 4.8 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=189, length=143 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0x226fc7ada2d285c32d24f720d407d7e EAP-Message = 0x02050001900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb23e8d7bf189571209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "*******" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 5 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 189 to 192.168.1.22 port 1645 EAP-Message = 0x010600b519003c537c032bb8e8953323bf2374ab386acf14170329724c3d9d72cf93b571123a19fa0b46a87f35e95604131e43eb082e5c7c546f948a8ef904f192ad2d93a6b5dabf5ff168241cdc993ad54d976fac81ac947960a16e88ec141447d5dcd5c79a79b0d2ab3104d3362b2c5f8ff3ce42b764d8a9ca3afa2eb0428df7f12202e89964afc55771f78990d0064be81a844c38d19802bdacc6c5dbfd07bad558ab25778082a5216030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb22ebd7bf189571f209151db8 Finished request 3. Going to the next request Waking up in 4.6 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=190, length=459 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0xcfe5abdbf0680775672a33a6bef960df EAP-Message = 0x020601401980000001361603010106100001020100436c901d963c492c7126dcf2905925f1f95b5603f7f35425d54e4ae49498269e741de850e38fceedd56d39f39be7c801b9da1b4b1a5f9659e5cb8c38bd22386b370bd7ee0129d83f8e292d576e00ea268bd316e4dcc26e7350f7ca207518e587a006c7f02c57f5d45a3322d1864861e09f489809447afd3a64318438e28700d3ef5fdbe0c41d2e5b66d97bbb398c8fd96919c622e7838f471be47afe0246e3bffbfdc47729dc02d48fbe954a3da20c8f9aecba1911ce290f9edcbd2222cc95437e988ef47ada57df84d30d6a9612475633e0a69626f5ea77fbec9fac499a82b3d7f5d7c731538 EAP-Message = 0x101284b8f3ca2a43d3211ade7b0df34add279c4f1ebc8514030100010116030100203292e0157ed35685cc9b7f7171db2186455072f09696152447fd775064ef5c75 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb22ebd7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-C1231G" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 6 length 253 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 310 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0106], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 190 to 192.168.1.22 port 1645 EAP-Message = 0x01070031190014030100010116030100208216893c34c5a181fba86ab16939b371b832cdbcc9790fc9a323e8b7b831d205 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x21edcefb25ead7bf189571f209151db8 Finished request 4. Going to the next request Waking up in 4.5 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=191, length=143 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0xef924dab21994165f9c7f26bcc9c74 EAP-Message = 0x0207061900 NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb25ead7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-C1231G" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 7 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake is finished [peap] eaptls_verify returned 3 [peap] eaptls_process returned 3 [peap] EAPTLS_SUCCESS ++[eap] returns handled Sending Access-Challenge of id 191 to 192.168.1.22 port 1645 EAP-Message = 0x01080020190003010015411f57ba89d6fd6a04a64468de35f449bfb3723b9d Message-Authenticator = 0x000000000000000000000000000000 State = 0x21edcefb24e5d7bf189571f209151db8 Finished request 5. Going to the next request Waking up in 4.4 seconds. rad_recv: Access-Request packet from host 192.168.1.22 port 1645, id=192, length=169 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0000.a8bb.4444" Calling-Station-Id = "0000.a8bb.4444" Service-Type = Login-User Message-Authenticator = 0xc06d4852b31e35efeba025235c053 EAP-Message = 0x0208002019001703311c3baa66e04048fec693e9893f1a7e211aaa805a NAS-Port-Type = Wireless-802.11 NAS-Port = 1341 State = 0x21edcefb24e5d7bf189571f209151db8 NAS-IP-Address = 192.168.1.22 NAS-Identifier = "AP-C1231G" +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 32 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - test [peap] Got tunneled request EAP-Message = 0x020800090174657374 server { PEAP: Got tunneled identity of test PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to test Sending tunneled request EAP-Message = 0x020800090174657374 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "test" server { +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "test", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 8 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [ldap] performing user authorization for test [ldap] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [ldap] expand: (&(employeeType=TRUE)(cn=%{Stripped-User-Name:-%{User-Name}})(macAddress=%{Calling-Station-Id})) -> (&(employeeType=TRUE)(cn=test)(macAddress=)) [ldap] expand: ou=users,ou=wireless,dc=test,dc=hu -> ou=users,ou=wireless,dc=test,dc=hu rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=users,ou=wireless,dc=test,dc=hu, with filter (&(employeeType=TRUE)(cn=test)(macAddress=)) rlm_ldap: object not found or got ambiguous search result [ldap] search failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop

3 4

Is it possible to have eap-peapv0 connect before xp shows logon box?
by Josh Hiner 28 Jan '09

28 Jan '09

So, I was going to use eap-tls to have the windows xp workstations sign into the wireless network before the user logs on (by assigning a cert to the machine account) but tls is not working for users or machines and I would like to have a backup. I have eap-peopv0 and eap-ttls working fine but they require a client username and password to connect and those are not supplied until the user logs in. We have many clients here on roaming profiles, so their profiles time out if I set them to peap or ttls since the wireless doesnt fire up in time after they log in. Is there a way to get peap or ttls (with ttls I use the SecureW2 client) to connect before the user logs on? I know that sounds lame because peap and ttls need a username and password... but maybe we can assign it statically in the background to the machine account or something? What are others doing? I really dont want wpa2-aes with a psk. Thanks for any ideas. Hopefully I can get the eap-tls thing sorted out with help but would like a backup plan. -Josh

1 0

sql insert via unlang
by Flamur Rogova 28 Jan '09

28 Jan '09

Hi, I have a couple of modules in this order, and I need to log only rejects(from each module) to sql, - check_password, "a1 User-Password := "a1" - check_maxoctets, "a1 Max-All-Octets := 100000" in my authorize section, I have this, ... check_password if(notfound) { # log notfound to sql, the line below gives error... "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" } check_maxoctets if(reject) { # log to sql... } ... When I start radiusd, it gives: ... rlm_fastusers: Loaded 3 users and 1 defaults /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to find module "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }". /home/radius205/etc/raddb/sites-enabled/default[99]: Failed to parse "%{sql: INSERT INTO test.logs SET test.logs.user='%{User-Name}', test.description='user not found' }" entry. /home/radius205/etc/raddb/sites-enabled/default[62]: Errors parsing authorize section. } } Errors initializing modules ... man unlang says it is possible to obtain results from db, but I need to execute only sql INSERT, is my syntax wrong ? Thanks, Flamur

7 10

Re: Rules in policy.conf
by Martin Silvero 28 Jan '09

28 Jan '09

for example in the policy file type: permit_only_eap { if (Calling-Station-Id==001f.3c22.674a) { ... here, depending on the mac, is due to the user a VLAN } this would be after the auntenticacion for PEAP-MSCHAPv2 with username and password. the idea is to authenticate users with LDAP, but once authenticated check your Calling-Station-Id, and depends on the mac is due to a specified VLAN

2 1

Copying Attributes Between Proxy-Reply and Reply Messages
by Mike Loosbrock 28 Jan '09

28 Jan '09

Hello, I'm running 2.0.4 on Debian testing. I have a test setup in which I'm proxying access requests between two virtual servers running inside the same daemon: radtest <---> [ virtual server A <---(proxy)---> virtual server B ] Proxing is triggered using the rlm_realm module and all attr_filter module instances in radiusd.conf have been commented out. Authentication works fine, but reply attributes created by B are not being returned to radtest unless I configure the following in A: post-auth { update reply { Attribute1 := "%{proxy-reply:Attribute1}" Attribute2 := "%{proxy-reply:Attribute2}" Attribute3 := "%{proxy-reply:Attribute3}" ... } } My understanding is that without any attribute filters in place, the proxy-reply list in virtual server A is supposed to be automatically copied to its reply list. Is this correct, or is there an option that needs to be set somewhere? Also, it seems that this scenario is functionally similar to how the peap and ttls modules proxy tunneled EAP exchanges to another virtual server using the 'virtual_server' option. Those modules use a 'use_tunneled_reply' option which seems to force the behavior I'm trying to achieve. Or am I way off the mark? I've attached what I think is just the relevant debug output. If more is needed, please let me know. Thanks! ### START DEBUG OUTPUT ### ... server monitor { modules { Module: Checking authenticate {...} for more modules to load Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating vpn_realm realm vpn_realm { format = "prefix" delimiter = "." ignore_default = yes ignore_null = yes } Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } } server vpn { modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating pap pap { encryption_scheme = "auto" auto_header = no } Module: Checking authorize {...} for more modules to load Module: Checking preacct {...} for more modules to load Module: Checking accounting {...} for more modules to load Module: Checking session {...} for more modules to load Module: Checking pre-proxy {...} for more modules to load Module: Checking post-proxy {...} for more modules to load } } server { modules { } } radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "proxy" ipaddr = * port = 0 } main { snmp = no smux_password = "" snmp_write_access = no } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on proxy address * port 4041 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1 port 4030, id=27, length=76 User-Name = "vpn_realm.mloosbro" User-Password = "password" NAS-IP-Address = 10.0.1.200 NAS-Port = 1 Framed-Protocol = PPP server monitor { +- entering group authorize rlm_realm: Looking up realm "vpn_realm" for User-Name = "vpn_realm.mloosbro" rlm_realm: Found realm "vpn_realm" rlm_realm: Adding Stripped-User-Name = "mloosbro" rlm_realm: Adding Realm = "vpn_realm" rlm_realm: Proxying request from user mloosbro to realm vpn_realm rlm_realm: Preparing to proxy authentication request to realm "vpn_realm" ++[vpn_realm] returns updated } # server monitor +- entering group pre-proxy ++[noop] returns noop >>> Sending proxied request internally to virtual server. server vpn { +- entering group authorize expand: %{control:NS-Override-User} -> expand: %{Stripped-User-Name} -> mloosbro expand: %{%{Stripped-User-Name}:-%{%{User-Name}:-DEFAULT}} -> mloosbro expand: %{%{control:NS-Override-User}:-%{%{Stripped-User- Name}:-%{%{User-Name}:-DEFAULT}}} -> mloosbro rlm_sql (ns-sql-vpn): sql_set_user escaped user --> 'mloosbro' rlm_sql (ns-sql-vpn): Reserving sql socket id: 4 expand: SELECT id, username, attribute, value, op FROM radcheck_asa WHERE username = '%{SQL-User- Name}' ORDER BY id -> SELECT id, username, a WHERE username = 'mloosbro' ORDER BY id expand: SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority -> SELECT groupname FROM radusergr BY priority expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupcheck_asa WHERE groupname = 'its- network' ORDER BY id rlm_sql (ns-sql-vpn): User found in group its-network expand: SELECT id, groupname, attribute, value, op FROM radgroupreply_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupreply_asa WHERE groupname = 'its- network' ORDER BY id expand: SELECT id, groupname, attribute, Value, op FROM radgroupcheck_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupcheck_asa WHERE groupname = 'employee' ORDER BY id rlm_sql (ns-sql-vpn): User found in group employee expand: SELECT id, groupname, attribute, value, op FROM radgroupreply_asa WHERE groupname = '%{Sql- Group}' ORDER BY id -> SELECT id M radgroupreply_asa WHERE groupname = 'employee' ORDER BY id rlm_sql (ns-sql-vpn): Released sql socket id: 4 ++[ns-sql-vpn] returns ok ++[control] returns ok rad_check_password: Found Auth-Type Kerberos auth: type "Kerberos" +- entering group Kerberos rlm_krb5: verify_krb_v5_tgt: host key not found : No such file or directory ++[krb5] returns ok Login OK: [mloosbro/password] (from client monitor port 1 via TLS tunnel) } # server vpn Going to the next request <<< Received proxied response from internal virtual server. +- entering group authorize rlm_realm: Proxy reply, or no User-Name. Ignoring. ++[vpn_realm] returns noop rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Login OK: [vpn_realm.mloosbro/password] (from client monitor port 1) +- entering group post-auth ++[noop] returns noop Sending Access-Accept of id 27 to 127.0.0.1 port 4030 Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 4030, id=27, length=76 Sending duplicate reply to client monitor port 4030 - ID: 27 Sending Access-Accept of id 27 to 127.0.0.1 port 4030 Waking up in 4.9 seconds. Cleaning up request 0 ID 27 with timestamp +3 Ready to process requests. ### END DEBUG OUTPUT ### Mike Loosbrock Bethel University Network Services 651-638-6723

2 1

including freeRADIUS
by rosect190＠yahoo.com 28 Jan '09

28 Jan '09

Does anyone have experience in including freeRADIUS in their project, just like including openSSL in a project?

2 1

MAC address restriction with EAP-TLS
by John T. Guthrie III 27 Jan '09

27 Jan '09

Hello all, We are currently using EAP-TLS authentication with FreeRADIUS at the place where I work right now. Management would like to be able to restrict the use of a given certificate for this authentication to specific MAC addresses. In other words, for each certificate, the desire is to tie that certificate to one or a couple MAC addresses, and to say that that certificate may only be used if it is coming from those specific MAC addresses. If the certificate is used from a different MAC address, then authentication should fail. I have tried to look for info on this on the web to no avail. I also understand that EAP-TLS authentication generally needs to be left out of the users file. But the only way that I can think of to restrict MAC addresses would be to place some kind of line involving a Calling-Station-ID in the users file. So I am at a loss. Does anyone have any suggstions? We are currently using 1.1.3. Thank you very much. John Guthrie guthrie(a)counterexample.org

2 5

Rules in policy.conf
by Martin Silvero 27 Jan '09

27 Jan '09

Hi list. I want to know if I can handle VLAN's on file policies and create a conditions with Calling-Station-Id this should be make after the authentication with user and pass.

2 1

Affect IP with script perl into freeradius
by Phibee Network Operation Center 27 Jan '09

27 Jan '09

Hi i use the perl example supplied with freeradius for authenticate my user. modules { perl { module = "/etc/raddb/Test-Auth.pl" func_accounting = accounting func_authenticate = authenticate func_authorize = authorize func_preacct = preacct func_checksimul = checksimul func_xlat = xlat } If i want add a IP Address for one specific user, what is the process ? sample: All user => Use Pool of the NAS One specific user => use 192.168.50.1 (static IP) Thanks jerome

2 7

eap-ttls failing
by Josh Hiner 27 Jan '09

27 Jan '09

I have a Ruckus ZoneDirector 1025 with waps that I just installed. Testing out different EAP types I can use. I am using FreeRadius 2.1.3. I have eap-ttls and eap-peapv0 working perfectly (I am using windows to control the wireless card for peap and it works great). Was going to try eap-tls by assigning client certificate to the machine account so the computer account authenticates on the wireless and then the user can log into the domain. I did this and get errors. It kind-of looks to me that the Zone Director is not sending the correct eap message for eap-tls. Maybe someone could point me in the right direction. Also, something is putting host/ in front of the User-Name field. In the certificate, I have the common name as joshhiner not host/joshhiner. Wonder if the zone director is mangling eap? Also, the wireless card is a mini-pci broadcom in a compaq 6710b. Thanks -Josh Error: Ready to process requests. rad_recv: Access-Request packet from host 172.17.10.108 port 1027, id=186, length=192 User-Name = "host/joshhiner" NAS-IP-Address = 172.17.10.108 NAS-Identifier = "00:1f:41:3a:82:f9" NAS-Port = 2 Called-Station-Id = "00-1F-41-3A-82-F9:CCISD-REMC1" Calling-Station-Id = "00-21-00-41-AE-4F" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200001301686f73742f6a6f736868696e6572 Message-Authenticator = 0x5a46b20a893c5d940dfacf2c35c1bd83 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "host/joshhiner", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [ntdomain] No '\' in User-Name = "host/joshhiner", looking up realm NULL [ntdomain] No such realm "NULL" ++[ntdomain] returns noop [eap] EAP packet type response id 0 length 19 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound [files] users: Matched entry DEFAULT at line 226 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = Reject Auth-Type = Reject, rejecting user Failed to authenticate the user. Using Post-Auth-Type Reject +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> host/joshhiner attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 186 to 172.17.10.108 port 1027 Waking up in 4.9 seconds. Cleaning up request 2 ID 186 with timestamp +373 Ready to process requests.

2 10