- Freeradius-Users - lists.freeradius.org

EAP MSK: how is it transported between server and authenticator
by Richard Chan 10 Oct '08

10 Oct '08

Hi all, After an EAP authentication which supports key derivation (MSK) how does freeradius transport the MSK to an NAS(authenticator)? I.e., what kind of attribute is used? (I am assuming that the EAP Server (freeradius) is a separate entity to the NAS; NAS talks to freeradius using RADIUS and acts as EAP proxy between EAP client and freeradius). There is an IETF draft on encrypted RADIUS attributes (which specifically mentions "EAP MSK"): http://www.ietf.org/internet-drafts/draft-zorn-radius-encattr-14.txt but this seems too recent to be actually used in the field (besides including undefined magic numbers). Browsing another RADIUS server document (Cisco Secure ACS), there is a "RADIUS Key Wrap" secret that can be configured. Presumably this is used to send MSKs between server and authenticator, but once again there are no details on how it is actually done. I couldn't find a similar configuration parameter in the freeradius config files, either radiusd.conf ( http://wiki.freeradius.org/Radiusd.conf) or the client side ( http://wiki.freeradius.org/Clients.conf) Googling 'radius key wrap' etc doesn't lead to further enlightenment. Tks! -richard-

4 11

Please Help!
by niel m 10 Oct '08

10 Oct '08

Hello Guys Im new in radius, I am using CentOS 5 in my radius server. Where I can find the scripts in generating various Certificates? This is for my Server-(Access Point)-Client connections. Any help would be appreciated. Thanks, Niel

2 3

Radius reply multivalue VSA question.
by Eric Martell 10 Oct '08

10 Oct '08

Hi, We are defining custom VSA's for our company. We have ldap configured in freeradius which returns back the VSA's. I defined custom VSA in $freeradius/share/freeradius/dictionary.abc ATTRIBUTE rEntitlements 113 string entitlements is multivalue attribute (vARRAY) in LDAP. In the ldap.attrmap it is defined as replyItem rEntitlements entitlements == So after the successful authentication, I am getting the rEntitlements back as Sending Access-Accept of id 50 to 69.74.69.31 port 1814 Session-Timeout = 7200 rEntitlements == "ADMALL" rEntitlements == "STORE" rEntitlements == "WEPG" rEntitlements == "WADM" rEntitlements == "SDNLD" rEntitlements == "WIFILOC1" BUT I am looking for ONLY WIFILOC1 for the NAS. NAS will redirect if WIFILOC1 exists. Can I do regex in the rEntitlements so freeradius ONLY returns rEntitlements = "WIFILOC1" and ignore the rest? Please let me know. Thanks in advance.

2 9

Error in the negotiations
by Martin Silvero 09 Oct '08

09 Oct '08

Is this the issue that you say?: Re: CA.all and CA.certs in Freeradius 2.x<https://lists.freeradius.org/pipermail/freeradius-users/2008-October/msg002…>

2 1

FreeRADIUS and EDUROAM timeout issues
by Peter Eriksson 09 Oct '08

09 Oct '08

How have other EDUROAM sites configured their EDUROAM servers with regard to timeout issues? The default setting seems to be less than optimal since if a remote site have problems with their home RADIUS servers then we risk having our local servers mark the upstream servers as "dead" since it's not receiving answers for a specific 'realm'... I've been using the default values so far: response_window = 20 zombie_period = 40 revive_interval = 120 status_check = status-server check_interval = 30 num_answers_to_alive = 3 But I wonder if these can be tuned a bit to better work in the EDUROAM environment. Perhaps increase the 'response_window', and lower 'zombie_period' and 'revive_interval' and 'check_interval' values... Best would probably be if FreeRadius kept a separate timeout for each 'server/realm' tuple... What have other sites done? - Peter

4 10

Error in the negotiations
by Martin Silvero 09 Oct '08

09 Oct '08

Any suggestions for this topic guys? thanks!!!

2 1

Ldap group
by Bert Beaudin 09 Oct '08

09 Oct '08

Hello I have ldap working to authencate users to a cisci switch. I now want to limit it to group membership. Any help would be great. Here is what I have in my ldap config for the groups. # Group membership checking. Disabled by default. # groupname_attribute = "cn" groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(object Class=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" groupmembership_attribute = "radius" #compare_check_items = yes # do_xlat = yes #access_attr_used_for_allow = yes Here is waht I see in my logs with radiusd -X Ready to process requests. rad_recv: Access-Request packet from host 10.12.8.230 port 1645, id=35, length=86 User-Name = "bbeaudin" User-Password = "xxxxxxx^" NAS-Port = 194 NAS-Port-Id = "tty194" NAS-Port-Type = Virtual Calling-Station-Id = "10.12.8.71" NAS-IP-Address = 10.12.8.230 +- entering group authorize ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop rlm_realm: No '@' in User-Name = "bbeaudin", looking up realm NULL rlm_realm: No such realm "NULL" ++[suffix] returns noop rlm_eap: No EAP-Message, not doing EAP ++[eap] returns noop ++[unix] returns updated rlm_ldap: Entering ldap_groupcmp() expand: OU=Employees,DC=yipes,DC=com -> OU=Employees,DC=yipes,DC=com expand: (&(samaccountname=%{user-name})) -> (&(samaccountname=bbeaudin)) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to dendc1.yipes.com:389, authentication 0 rlm_ldap: bind as bbeaudin(a)yipes.com/xxxxxxxx to dendc1.yipes.com:389 rlm_ldap: waiting for bind result ... request done: ld 0x121a6760 msgid 1 rlm_ldap: Bind was successful rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter (&(samaccountname=bbeaudin)) request done: ld 0x121a6760 msgid 2 rlm_ldap: ldap_release_conn: Release Id: 0 expand: (|(&(objectClass=GroupOfNames)(member=%{control:Ldap-UserDn}))(&(objectC lass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn}))) -> (|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn iqueNames)(uniquemember=))) rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in cn=radius,dc=yipes,dc=com, with filter (|(&(objectClass=GroupOfNames)(member=CN\3dBert Beaudin\2cOU\3dIT Staff\2cOU\3dEmployees\2cDC\3dyipes\2cDC\3dcom))(&(objectClass=GroupOfUn iqueNames)(uniquemember=))) request done: ld 0x121a6760 msgid 3 rlm_ldap: object not found or got ambiguous search result rlm_ldap: ldap_release_conn: Release Id: 0 rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in CN=Bert Beaudin,OU=IT Staff,OU=Employees,DC=yipes,DC=com, with filter (objectclass=*) request done: ld 0x121a6760 msgid 4 rlm_ldap::ldap_groupcmp: ldap_get_values() failed rlm_ldap: ldap_release_conn: Release Id: 0 ++[files] returns noop rlm_ldap: - authorize rlm_ldap: performing user authorization for bbeaudin expand: (&(samaccountname=%{user-name})) -> (&(samaccountname=bbeaudin)) expand: OU=Employees,DC=yipes,DC=com -> OU=Employees,DC=yipes,DC=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in OU=Employees,DC=yipes,DC=com, with filter (&(samaccountname=bbeaudin)) request done: ld 0x121a6760 msgid 5 rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: Pairs do not match. Rejecting user. rlm_ldap: ldap_release_conn: Release Id: 0 ++[ldap] returns reject Found Post-Auth-Type Reject +- entering group REJECT expand: %{User-Name} -> bbeaudin attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Sending Access-Reject of id 35 to 10.12.8.230 port 1645 Finished request 0. Going to the next request Waking up in 4.9 seconds. Cleaning up request 0 ID 35 with timestamp +9 Ready to process requests. Thanks, Bert Beaudin Systems Administrator RelianceGlobalcom Services, Inc. Office:303-785-6641 Cell:303-478-7789 Fax:415-677-9534 bbeaudin(a)relianceglobalcom.com <mailto:bbeaudin@relianceglobalcom.com> www.relianceglobalcom.com <blocked::http://www.yipes.com/>

2 2

Problem with ntlm_auth
by Frederik.Niedernolte＠Bertelsmann.de 09 Oct '08

09 Oct '08

I have finished all steps till "user Auth-Type := ntlm_auth" from http://deployingradius.com/documents/configuration/active_directory.html . With this command I get this error message at the end of "/usr/sbin/freeradius -X": /etc/freeradius/users[1]: Parse error (check) for entry MyUser: Unknown value ntlm_auth for attribute Auth-Type Errors reading /etc/freeradius/users /etc/freeradius/modules/files[7]: Instantiation failed for module "files" /etc/freeradius/sites-enabled/inner-tunnel[111]: Failed to find module "files". /etc/freeradius/sites-enabled/inner-tunnel[34]: Errors parsing authorize section. } } Errors initializing modules The authenticate section in the /etc/freeradius/sites-enabled/default looks like this (only important part): authenticate { # # NTML_AUTH authentication. Auth-Type ntlm_auth { ntlm_auth } What is wrong and what can I do to solve the problem? Thanks in advance. Best regards, F. Niedernolte

6 23

Proxy when database value is set
by Laar, Johan van de 09 Oct '08

09 Oct '08

I've achieved the following: - A user with a username which contains a realm logs in. - Freeradius checks some radius request values like calling-station-id etc. - Freeradius will give a reject or accept depending on the above query. What I cannot achieve is: - Freeradius must proxy to request to a token server but only when it authenticated the user successfully. Any ideas? Thank you in advance. Regards, Johan van de Laar

2 1

RE: EAP-TLS & computer account(not user)
by Guk Victor 09 Oct '08

09 Oct '08

2 1