- Freeradius-Users - lists.freeradius.org

Group Authorization with FreeRadius
by Mike Diggins 26 Nov '08

26 Nov '08

I would like to not only authenticate my users via FreeRadius, but also authorize them by creating some local groups, and running a program to do the authorization check, then pass that back to radius as an attribute (I think). I would have to write the program myself obviously, but is this even possible using the latest FreeRadius software? I'm not sure where to start looking. -Mike

2 1

My error:
by Martin Silvero 26 Nov '08

26 Nov '08

rad_recv: Access-Request packet from host 10.0.16.4 port 1645, id=6, length=136 User-Name = "test" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9d00" Calling-Station-Id = "001f.3c22.44c5" Service-Type = Login-User Message-Authenticator = 0x8185244a1739d905761d97635ccde126 EAP-Message = 0x020100090163657274 NAS-Port-Type = Wireless-802.11 NAS-Port = 262 NAS-IP-Address = 10.0.16.4 NAS-Identifier = "ap" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 6 to 10.0.16.4 port 1645 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xb7c9adf3b7cba0f54e6f2b406f75dfd7 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 6 with timestamp +5 Ready to process requests. -------- this error is with the supplicant "wire1" but... when the supplicant is "Intel PROset wireless" the error is this: rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=2, length=136 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.674a" Service-Type = Login-User Message-Authenticator = 0xba5587f920826e2bd4beb4695b9be3de EAP-Message = 0x020100090163657274 NAS-Port-Type = Wireless-802.11 NAS-Port = 259 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Requiring client certificate rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 2 to 10.0.31.40 port 1645 EAP-Message = 0x010200060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x45047f1b45067264424db5b65333fec0 Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.31.40 port 1645, id=3, length=255 User-Name = "cert" Framed-MTU = 1400 Called-Station-Id = "0019.2fdb.9e00" Calling-Station-Id = "001f.3c22.674a" Service-Type = Login-User Message-Authenticator = 0x565fba63fe92ec25bb27dc9b7cd35351 EAP-Message = 0x0202006e0d8000000064160301005f0100005b0301492d8813d8442284e62309c1463f24d6bd6dff31a5a199dee31582cbb9fa140400003400390038003500160013000a00330032002f006600050004006500640063006200610060001500120009001400110008000600030100 NAS-Port-Type = Wireless-802.11 NAS-Port = 259 State = 0x45047f1b45067264424db5b65333fec0 NAS-IP-Address = 10.0.31.40 NAS-Identifier = "ap-Reconquista-31" +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "cert", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: EAP packet type response id 2 length 110 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound users: Matched entry cert at line 76 ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop rlm_pap: Found existing Auth-Type, not changing it. ++[pap] returns noop rad_check_password: Found Auth-Type EAP auth: type "EAP" +- entering group authenticate rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS TLS Length 100 rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 005f], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0849], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange TLS_accept: SSLv3 write key exchange A rlm_eap_tls: >>> TLS 1.0 Handshake [length 00a3], CertificateRequest TLS_accept: SSLv3 write certificate request A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 ++[eap] returns handled Sending Access-Challenge of id 3 to 10.0.31.40 port 1645 EAP-Message = 0x010304000dc000000b57160301004a020000460301492d88149171a0d9fd6597a004574b6ff645784cfb233487f6a1178e983db8b9202849854d8af6a3dea84919340635e06d602786b93c1fe23e19cdfced138f4ce100390016030108490b00084500084200039d3082039930820281a003020102020101300d06092a864886f70d010104050030818f310b3009060355040613024152311530130603550408130c4275656e6f73204169726573311430120603550407130b5265636f6e717569737461310e300c060355040a130549504c414e3124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e6172311d30 EAP-Message = 0x1b06035504031314436572746966696361646f205261646975734954301e170d3038313131383139303732335a170d3039313131383139303732335a3077310b3009060355040613024152311530130603550408130c4275656e6f73204169726573310e300c060355040a130549504c414e311b3019060355040313125365727665722043657274696669636174653124302206092a864886f70d01090116156d73696c7665726f4069706c616e2e636f6d2e617230820122300d06092a864886f70d01010105000382010f003082010a0282010100a3214e2a03be37b3b6da8eff4fae6c7842f472aeb12bba75eb5562cddb7952a6ae61663f628df1 EAP-Message = 0x2d1991b857f64a16e911276e3d6bcda584cbedf6869c19b871e9d8885955316739815ffee397c766ef9dd324f5eab40e761981f957447f775aa6fbb54d3524b76c08619fc3ebb786fa8347e080fd1512f9e04f4a0233cbe0c8a43efc96df5ac94f8a5270d4ff7fab98d04e464d1db1c53e62d412b0aca7f5a93e1e7386f65279b8dced42895115acecb76d0c619308bf79489223bdf468c6dff08d3ed46c2ed01398ee13207a187e36c82aa3b67679ce0278a9d89ec043ad8500eee052d4b5376a1d1c26153ccda064fdcf7bb2f6a1ad60fb34419705b89e650203010001a317301530130603551d25040c300a06082b06010505070301300d06092a86 EAP-Message = 0x4886f70d0101040500038201010098f1873453c3f3d52defa937a6a5ef9582a20758059e5aa37c451910b3b1a1823338a62070943b943c1f14aff489d62b163dccf164d7d60392a72d689778f6487087c8bc71ef77630065e987ec37c7fcccb2df32c6ca508a1f5a244c26a6b2e4d2ffbc6b9caa8b0676aace623b008ca88a0a1bc790e20110afca82544e136e9f6b748dcfa422a59fc780f9e59c29aba4163fe428b6a5090afb244d0d66ae5908f53ceaf6f4f21344372513726077ba93bafe985a2dd3107983de3ad686dfec2d78ef34c76148f6329cd5d00c8543803f27fe221df19d90465e602e4e0e1909d38cd03b108b5bb0f7bdc402f6cddfbf EAP-Message = 0xb7420732d3d7b3e2232b37fd Message-Authenticator = 0x00000000000000000000000000000000 State = 0x45047f1b44077264424db5b65333fec0 Finished request 2. Going to the next request Waking up in 4.3 seconds. ----------------------------- any suggestions? many thanks!

2 1

Re: Group Authorization with FreeRadius
by Mike Diggins 26 Nov '08

26 Nov '08

I'm using the NTLM_AUTH authenticator currently, if that helps. -Mike On Wed, 26 Nov 2008, Mike Diggins wrote: > > I would like to not only authenticate my users via FreeRadius, but also > authorize them by creating some local groups, and running a program to do the > authorization check, then pass that back to radius as an attribute (I think). > I would have to write the program myself obviously, but is this even possible > using the latest FreeRadius software? I'm not sure where to start looking. > > -Mike

1 0

Supported Acesspoints
by M.K. ten Napel 26 Nov '08

26 Nov '08

Hi, Previously I asked if anyone had trouble with the Linksys WAP54G, Like I did. I'm think about trying another type of Accesspoint. Before buying one, I would like to know what AP's are being used with FreeRadius. Any tips/suggestions on buying an AP that works wel in WPA-enterprise (EAP-TLS) with FreeRadius? Thanks! :) Mariourk

4 4

Read radius client from database
by Saeed Akhtar 26 Nov '08

26 Nov '08

Hi all, I am having problem to configure Radius to read client information from mysql database table "nas". I found an option at last line of sql.conf readclients = yes i uncommented it ... then added record in nas table... then tried to send request from newly added client but it says unknown client.... Can anyone help me in this regard??? Thank you Regards, Saeed Akhtar

3 9

authentication delay in virtual servers
by Oguzhan Kayhan 26 Nov '08

26 Nov '08

Hello, I have two virtual servers on my freeradius installation with one is made via mysql and other is via a perl script which is checking an xml page for user/pass control. What i noticed is, when the xml server is down if somebody tries to login from this virtual server, the other virtual server hangs up too before it gets a reply from the previous virtual server. Is it smthing suppose to happen?

2 1

Re: Re: RSASecurid and PEAP
by David Mitton 26 Nov '08

26 Nov '08

I should know better to ask "what are you thinking?" but let me attempt to explain. The RSA SecurID RADIUS server can authenticate plain text OTPs inside of PEAP (or if you load our EAP client, use SecurID-EAP or Protected-OTP) FreeRADIUS should have no problem proxying that. But as Alan points out, EAP & RADIUS don't work the way you want. The EAP authentication end-to-end. The RADIUS server itself doesn't know how the EAP method did it's thing. It relays EAP messages as opaque blobs, and gets a success/failure indication (and the encryption keys) when it's done. To a certain extent so does the access point. APs should be able to support any EAP method that follows RFC 3748 message formats. So you cannot alter this conversation without changing the EAP method protocol. What piece of software on the client is going to respond to this challenge out of thin air? PEAP on the client doesn't work that way. Dave. On Nov 26, 2008, aland(a)deployingradius.com wrote: Paul TAVERNIER wrote: > 1) i want to authorize/authenticate a user with a couple > username/OTPpassword (RSASecurid) through a Freeradius server (i proxy > the acces-request to a RSARadius-Securid server). It's ok. What do you mean "It's OK"? Have you tested this with cleartext-passwords, MS-CHAP, PEAP, or ...? > 2) (then, if i get an Access-Accept) (in a post-proxy section?) i want > to initiate an EAP Challenge between my XP-Wireless-supplicant client > and FREERADIUS (not the RSA radius)... That's not how EAP works. The supplicant and NAS control how the protocol works, and you can't change things on the RADIUS server. > Can i configure something like that No. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Re: Can FreeRadius server as AAA for MMSC and EVDO as well?
by Aldo 26 Nov '08

26 Nov '08

Well, you are right I shouldn't post about the MMSC if I know that dont support RADIUS, but as I wrote in the input, the NAS (Huawei PDSN 9660) support RADIUS, and I need to set it up the headsets to being authorized with FreeRADIUS to use EVDO, I think I have a very basic idea, please correct me and give some guidance if you can, -In FreeRADIUS I have to connect it with sql database server (such as mysql), then create a database, then I dont know how to interconnect it with the NAS (my PDSN) -For the PDSN, I think I must enable a interface which connects to the RADIUS server and then authenticate them with a shared secret and then setup a ip pool in the PDSN, please tell me what steps i miss. Thanks again, Aldo > ---------------------------------------------------------------------- > > Date: Wed, 26 Nov 2008 01:02:00 -0800 > From: Aldo <aldo(a)cleartalk.net> > Subject: Re: Re: Can FreeRadius server as AAA for MMSC and EVDO as > well? > > Well, the my NAS (Huawei PDSN 9660) does support RADIUS actually, the > MMSC is a older Huawei MMSC (based on Sun) and documentation doesn't say > nothing about RAIUS. > I know HLR can handle the Phone authorization for data usage, but that > will enable/disable MMSC and EVDO in bundle, lets say I configure the > PDSN with the FreeRADIUS for the EVDO, what do you recommend me to > authenticate MMSC? > > Thanks again. > > >> ---------------------------------------------------------------------- >> >> Date: Wed, 26 Nov 2008 08:30:38 +0100 >> From: Alan DeKok <aland(a)deployingradius.com> >> Subject: Re: Can FreeRadius server as AAA for MMSC and EVDO as well? >> >> Aldo Zavala wrote: >> >> >>> Hello, I in our network we have two data services: >>> 1.- MMSC (Multimedia Message Service Center) >>> 2.- EVDO (Evolution-Data Optimized) >>> >>> I just downloaded and installed the FreeRADIUS in a FreeBSD server, this is my first time trying to configure it, but first of all I would like to know if mine is a common usage of FreeRADIUS, the MMSC is served trough a Solaris based server and EVDO is served trough a propietary PDSN appliance. >>> >>> Are there more people who figured out how to make possible this configuration-like? >>> >>> >> If those services use RADIUS for authentication, then it's possible. >> See their documentation for the list of features that they support. >> >> Alan DeKok. >> >> >> > > ------------------------------ > > > Date: Wed, 26 Nov 2008 11:14:19 +0100 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Can FreeRadius server as AAA for MMSC and EVDO as well? > > Aldo wrote: > >> Well, the my NAS (Huawei PDSN 9660) does support RADIUS actually, the >> MMSC is a older Huawei MMSC (based on Sun) and documentation doesn't say >> nothing about RAIUS. >> I know HLR can handle the Phone authorization for data usage, but that >> will enable/disable MMSC and EVDO in bundle, lets say I configure the >> PDSN with the FreeRADIUS for the EVDO, what do you recommend me to >> authenticate MMSC? >> > > If your MMSC doesn't support RADIUS, then you can't do RADIUS. > > If you're not using RADIUS, there's no point asking questions on this > list. > > Alan DeKok. > >

2 1

re:Re: Read radius client from database
by mj mailing lists user 26 Nov '08

26 Nov '08

Hi seems to me you are missing rlm_sql, when I start radiusd -X I get the following lines: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked .. rlm_sql_mysql: query: SELECT id, nasname, shortname, type, secret FROM nas this last line is then followed by rlm_sql (sql): Read entry nasname=127.0.0.1,shortname=localhost,secret=secretpw .. Maybe you didn't configure sql right. In freeradius2 Uncomment sql in raddb/sites-enabled/default Check you raddb/sql.conf file in freeradius1 uncomment sql (authorize section) in radiusd.conf and adapt sql.conf Michel >Debug Trace: > >Starting - reading configuration files ... >reread_config: reading radiusd.conf >Config: including file: /usr/local/etc/raddb/proxy.conf >Config: including file: /usr/local/etc/raddb/clients.conf >Config: including file: /usr/local/etc/raddb/snmp.conf >Config: including file: /usr/local/etc/raddb/jradius.conf >Config: including file: /usr/local/etc/raddb/eap.conf >Config: including file: /usr/local/etc/raddb/sql.conf > main: prefix = "/usr/local" > main: localstatedir = "/usr/local/var" > main: logdir = "/usr/local/var/log/radius" > main: libdir = "/usr/local/lib" > main: radacctdir = "/usr/local/var/log/radius/radacct" > main: hostname_lookups = no > main: snmp = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = no > main: log_file = "/usr/local/var/log/radius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" > main: user = "(null)" > main: group = "(null)" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/local/sbin/checkrad" > main: proxy_requests = yes > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 >read_config_files: reading dictionary >read_config_files: reading naslist >Using deprecated naslist file. Support for this will go away soon. >read_config_files: reading clients >read_config_files: reading realms >radiusd: entering modules setup >Module: Library search path is /usr/local/lib >Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" >rlm_exec: Wait=yes but no output defined. Did you mean output=none? >Module: Instantiated exec (exec) >Module: Loaded expr >Module: Instantiated expr (expr) >Module: Loaded PAP > pap: encryption_scheme = "crypt" >Module: Instantiated pap (pap) >Module: Loaded CHAP >Module: Instantiated chap (chap) >Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = no > mschap: require_strong = no > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" >Module: Instantiated mschap (mschap) >Module: Loaded System > unix: cache = no > unix: passwd = "(null)" > unix: shadow = "(null)" > unix: group = "(null)" > unix: radwtmp = "/usr/local/var/log/radius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 >Module: Instantiated unix (unix) >Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no >rlm_eap: Loaded and initialized type md5 >rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" >rlm_eap: Loaded and initialized type gtc > mschapv2: with_ntdomain_hack = no >rlm_eap: Loaded and initialized type mschapv2 >Module: Instantiated eap (eap) >Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no >Module: Instantiated realm (suffix) >Module: Loaded files > files: usersfile = "/usr/local/etc/raddb/users" > files: acctusersfile = "/usr/local/etc/raddb/acct_users" > files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" > files: compat = "no" >Module: Instantiated files (files) >Module: Loaded jradius > jradius: name = "example" > jradius: primary = "127.0.0.1" > jradius: secondary = "192.168.1.2:1815" > jradius: tertiary = "192.168.1.2:1816" > jradius: timeout = 1 > jradius: onfail = "NOOP" > jradius: keepalive = yes > jradius: connections = 8 >rlm_jradius: configuring jradius server 127.0.0.1:1814 >rlm_jradius: configuring jradius server 192.168.1.2:1815 >rlm_jradius: configuring jradius server 192.168.1.2:1816 >rlm_jradius: starting JRadius connection 0 >rlm_jradius: starting JRadius connection 1 >rlm_jradius: starting JRadius connection 2 >rlm_jradius: starting JRadius connection 3 >rlm_jradius: starting JRadius connection 4 >rlm_jradius: starting JRadius connection 5 >rlm_jradius: starting JRadius connection 6 >rlm_jradius: starting JRadius connection 7 >Module: Instantiated jradius (jradius) >Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, >Client-IP-Address, NAS-Port" >Module: Instantiated acct_unique (acct_unique) >Module: Loaded detail > detail: detailfile = >"/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no >Module: Instantiated detail (detail) >Module: Loaded radutmp > radutmp: filename = "/usr/local/var/log/radius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes >Module: Instantiated radutmp (radutmp) >Listening on authentication *:1812 >Listening on accounting *:1813 >Ready to process requests. > > >Regards, > >Saeed Akhtar > > > >2008/11/26 <tnt(a)kalik.net> > >> Post the debug of the server startup. >> >> Ivan Kalik >> Kalik Informatika ISP >> >> >> Dana 26/11/2008, "Saeed Akhtar" <saeedakhtar.484(a)gmail.com> pi¹e: >> >> >Hi all, >> > >> > I am having problem to configure Radius to read client information from >> >mysql database table "nas". I found an option at last line of sql.conf >> > >> >readclients = yes >> > >> >i uncommented it ... then added record in nas table... then tried to send >> >request from newly added client but it says unknown client.... Can anyone >> >help me in this regard??? Thank you >> >Regards, >> > >> >Saeed Akhtar >> > >> > >> >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > >

1 0

EAP2 configuration
by Fernando 26 Nov '08

26 Nov '08

Hi all, What do I need to do for use eap2 module? I want to use GPSK or PSK. Can anybody help me with the configuration? Thanks.

2 13