- Freeradius-Users - lists.freeradius.org

RE: Cisco Mac-Auth-Bypass with Freeradius 2.0.4
by MONTFORD, AUSTIN 19 May '08

19 May '08

Frank & Ivan, Just wanted to thank yall for the advice and let you know this worked like a charm. Just had to change Fall-Through = True to Fall-Through = Yes which was simple enough using the debug output. Version thing with the syntax I guess... Thanks again! Austin -----Original Message----- Message: 5 Date: Fri, 16 May 2008 10:27:06 +1000 From: "Ranner, Frank MR" <Frank.Ranner(a)defence.gov.au> Subject: RE: Cisco Mac-Auth-Bypass with Freeradius 2.0.4 [SEC=UNCLASSIFIED] To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> ______________________________ From: freeradius-users-bounces+frank.ranner=defence.gov.au(a)lists.freeradius.or g [mailto:freeradius-users-bounces+frank.ranner=defence.gov.au@lists.freer adius.org] On Behalf Of MONTFORD, AUSTIN Sent: Friday, 16 May 2008 07:31 To: freeradius-users(a)lists.freeradius.org Subject: Cisco Mac-Auth-Bypass with Freeradius 2.0.4 Hey, I just got this working on a test server finally using the users file and have a quick question. I was wondering is there a way where I don't have to type the last 3 lines of this everytime in my users file? I was thinking of using some kind of setup with a seperate file for each vlan containing only the first statement (with the mac address as the user/pass). Then $include each vlanfile in the users file with freeradius appending the correct tunnel statements depending on what vlanfile the mac address was in. Anyways I haven't quite wrapped my head around the syntax to do this or am sure this is the best way. If someone has any advice that would be great. 123400000000 Cleartext-Password := "123400000000" Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-Id = "Students" By the way Freeradius rocks! Thanks, Austin There is a couple of ways to do this. 1. Use groups. 2. Use Fall-Through and group you users file. Example: # Set boilerplate text DEFAULT Tunnel-Type = "VLAN", Tunnel-Medium-Type = "IEEE-802", Fall-Through = True # Staff systems DEFAULT Tunnel-Private-Group-Id := "Staff", Fall-Through = True $INCLUDE staff.users # Student systems DEFAULT Tunnel-Private-Group-Id := "Students", Fall-Through = True $INCLUDE student.users ... DEFAULT Auth-Type:=reject Student.users would have lines like: 123400000000 Cleartext-Password := "123400000000" 123500000000 Cleartext-Password := "123500000000" and could be generated by a script. Regards, Frank Ranner

1 0

2 server radius (same configuration), different log messages
by Enrico Fanti 19 May '08

19 May '08

Hi all. I have 2 server radius and 1 "AP Cisco" configured to use EAP Authentication. I have 2 server radius with freeradius 1.1.7 (fedora 8), configured in the same way (PEAP) (I haad configured my first server radius and then I copied my configuration files , and the certificates in second server radius) Then by my linux laptop, with wpa_supplicant I try to connect to my wireless ntwork. 1) If my AP is configured to require the authentication on first server radius 1, I obtain this log messages: *Mon May 19 08:51:20 2008 : Error: TLS_accept:error in SSLv3 read client certificate A Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message Mon May 19 08:51:20 2008 : Info: (other): SSL negotiation finished successfully Mon May 19 08:51:20 2008 : Info: rlm_eap_tls: Received EAP-TLS ACK message* Mon May 19 08:51:20 2008 : Info: rlm_eap_mschapv2: Issuing Challenge *Mon May 19 08:51:20 2008 : Auth: Login OK: [fanti/<no User-Password attribute>] (from client localhost port 3686 cli 001e.4c00.dade) Mon May 19 08:51:20 2008 : Auth: Login OK: [fanti/<no User-Password attribute>] (from client ap-alternet port 3686 cli 001e.4c00.dade)* ############################################################## If I start with radius -X: rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: group authenticate returns ok for request 9 *Login OK: [fanti/<no User-Password attribute>] (from client ap-alternet port 3687 cli 001e.4c00.dade)* ################################################################## 2) In my second server radius I obtain: Mon May 19 08:50:38 2008 : Info: rlm_eap_mschapv2: Issuing Challenge *Mon May 19 08:50:38 2008 : Auth: Login OK: [fanti] (from client localhost port 3689 cli 001e.4c00.dade) Mon May 19 08:50:38 2008 : Auth: Login OK: [fanti] (from client ap-alternet port 3689 cli 001e.4c00.dade)* ##################### If I start with radius -X: rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 9 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 9 modcall: leaving group authenticate (returns ok) for request 9 *Login OK: [fanti] (from client ap-alternet port 3690 cli 001e.4c00.dade *I don't understand why I have differences in this 2 logs (In rows where I have Login OK). Can you help me please ? Thank you enrico

2 2

Problem in testing Radius server
by youness hsina 19 May '08

19 May '08

Hi all sorry for my english. i'm running a freeradius server.and i wanted to test it but it doesn't work and i don't know why. i have tried this command : *radtest yhsina yhsina @IPserver 1 testing123.* ** *yhsina *is a user who is located in a LDAP server. it give me this thing : *radclient: no reponse from server for ID 107* thank for your help in advance. Uness -- HSINA Youness Etudiant R&T - IUT--Velizy 78140 Tél : 06.28.73.76.75 -- HSINA Youness Etudiant R&T - IUT--Velizy 78140 Tél : 06.28.73.76.75

1 0

Problem with CHAP, rlm_ldap, edir
by Lothar.Haeger＠steria-mummert.de 19 May '08

19 May '08

stupid me! wasn't the freeradius config, that's just fine with ldap being edirectory. Only I had "overconfigured" my testaccount by setting Auth-Type=LDAP on it, so all other types were rejected ;-( Removed that ldap attribute and see, it works :-) Cheers, Lothar

1 0

Facing problem is configuring freeradius for eap-ts
by smita P 19 May '08

19 May '08

3 2

Re : howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 18 May '08

18 May '08

So i really wonder where is the problem !!! maybe it is due to the hardware i use... my switch is wireless controller -all AP rceive their config (RF, SSID, channels, Power Radio, security styuffs, etc..) from the switch. so when RADIUS authentication is set-up, every AP have to be authenticated by Freeradius before receiving the correct parameters by FR, using its @MAC as login and the word NOPASSWORD as password (that the theoroy said. cause i had to set Auth-Type := Accept to make it work). at this stage, authenticator is the wireless switch. it works with or without 802.1x ON. it work fine, and the AP are well manged by a centralpoint. no RADIUS problem with AP authetication. - step2: when an AP is recognized, end-users have to be autneticated too by RADIUS. this step, like the documentation says, the managed AP becomes "Authenticator". -so an entry exist for every AP in clients.conf too) during the connection attempts, Radius receive acess request, and the correct certificate is chosen -he give me the correcte commonnameof certificate- but i think the supplicant (end-user on xp) never receive the access-challenge, even if it is sent by RADIUS Server. i don't know if i am well understood or if I "do" misundertood something but it works like that at me now. i installed, reinstalled and formated so much time that i am convincedthat i won't success alone. Hey Ivan, won't you try to help me to fix this stone? i have definitely nodelay anymore, and no solution too. Freeradius is your own and i ma pretty sure that we could both fix the problem between a quarter or a half if you take fulll remote control of my computer and network, assisting you and telling my purpose. thanx for help. ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Lundi, 19 Mai 2008, 0h37mn 23s Objet : RE: Re : Re : Re : howto EAP-TLS on freeradius 2.0.2-3 ?? >Ok, we assume my certificates are corrects. > >So i have some more questions: > > >- Certificate should be import for user accounts or for computer account ? Who/what ever is you supplicant trying to authenticate. If the supplicant can't find the correct certificate it will give up. > >- i use the file "users" as database for my accounts; when using eap-tls >when trying eap-peap my accounts looks like that: > >>> johndoe Auth-Type: = EAP, User-Password == Ă˘ďż˝ďż˝test1234" >>> Tunnel-Type = 13, >>> Tunnel-Medium-Type = 6, > >or >>> johndoe User-Password == Ă˘ďż˝ďż˝test1234" >>> Tunnel-Type = 13, >>> Tunnel-Medium-Type = 6, No, don't use Auth-Type. Use Cleartext-Password or NT-Password (names clearly suugest are they encrypted and how) with mschap. > > >- when i use eap-tls, it looks like that: > >>> johndoe >>> Tunnel-Type = 13, >>> Tunnel-Medium-Type = 6, >----- > >and sometimes, i add add the assignment of Vlan by using the attribute ' Tunnel-Private-Group-ID = 100" -vlan 100 is affected to the ssid i am interested in- > >is it correct? It will work, but it's more common to use "human" values (VLAN and IEEE-802). Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0

Re : Re : Re : howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 18 May '08

18 May '08

Ok, we assume my certificates are corrects. So i have some more questions: - Certificate should be import for user accounts or for computer account ? - i use the file "users" as database for my accounts; when using eap-tls when trying eap-peap my accounts looks like that: >> johndoe Auth-Type: = EAP, User-Password == â��test1234" >> Tunnel-Type = 13, >> Tunnel-Medium-Type = 6, or >> johndoe User-Password == â��test1234" >> Tunnel-Type = 13, >> Tunnel-Medium-Type = 6, - when i use eap-tls, it looks like that: >> johndoe >> Tunnel-Type = 13, >> Tunnel-Medium-Type = 6, ----- and sometimes, i add add the assignment of Vlan by using the attribute ' Tunnel-Private-Group-ID = 100" -vlan 100 is affected to the ssid i am interested in- is it correct? Yes! it is in the personal store! - so problem is not with certificate ?? in this case, wht should be checked? - config? - hardware? i'd like to use eap-tls and/or eap-peap MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Dimanche, 18 Mai 2008, 17h00mn 59s Objet : Re: Re : howto EAP-TLS on freeradius 2.0.2-3 ?? >you can view screenshots of the certificate here: > >- CA Certificate that i imported on XP with DER format: >http://img357.imageshack.us/img357/2264/cacertificate1wj4.jpg > >- Client Certificate with p12 format: >http://img164.imageshack.us/img164/2894/certifclient1kf1.jpg >http://img164.imageshack.us/img164/7527/certifclient2rv3.jpg > Those certificates are fine. Where did you import the client certificate? Is it in the Personal store? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

2 1

accounting_onoff_query and acctsessiontime = 0
by Tuc at T-B-O-H.NET 18 May '08

18 May '08

Hi, For the following : accounting_onoff_query = "\ UPDATE ${acct_table1} \ SET \ acctstoptime = '%S', \ acctsessiontime = unix_timestamp('%S') - \ unix_timestamp(acctstarttime), \ acctterminatecause = '%{Acct-Terminate-Cause}', \ acctstopdelay = %{%{Acct-Delay-Time}:-0} \ WHERE acctsessiontime = 0 \ AND acctstoptime = NULL \ AND nasipaddress = '%{NAS-IP-Address}' \ AND acctstarttime <= '%S'" Why is "acctsessiontime = 0" ? If the unit has been rebooted, the sessions left hanging, why do you search only for zero'd acctsessiontime? Thanks, Tuc

4 7

append avpair to proxied packet
by Jules Desforges 18 May '08

18 May '08

Hi, I receive DSL service from Supplier A, and provide DSL service to Customers A and B Supplier A ------ My Radius Server ------- Customer A | _Customer B Supplier A proxies the realms for Customer A,B to my server, I then proxy on the requests to the customers. This works fine, however I would like to append an AV-Pair to each respective customer, so they are given separate VRF's on the Cisco NAS. I need to append the following :- Cisco-AVPair = "lcp:interface-config#1=ip vrf forwarding vrf1\nip unnumbered lo100", I'm a bit confused as to where I add this, pre_proxy, post_proxy, and if the location of the vrf AVPair matters in the packet. If anyone has done something similar, or can give me some pointers please let me know. I'm running Freeradius 2.0.1 on OpenBSD sparc64 Thanks, Jules

2 1

Re : Re : howto EAP-TLS on freeradius 2.0.2-3 ??
by Joel MBA OYONE 18 May '08

18 May '08

Yes! it is in the personal store! - so problem is not with certificate ?? in this case, wht should be checked? - config? - hardware? i'd like to use eap-tls and/or eap-peap MBA OYONE Joël Lot. El Firdaous Bât GH20, Porte A 204, Appt 8 20000 Oulfa Casablanca - Maroc Tél. : +212 69 25 85 70 ----- Message d'origine ---- De : Ivan Kalik <tnt(a)kalik.net> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Dimanche, 18 Mai 2008, 17h00mn 59s Objet : Re: Re : howto EAP-TLS on freeradius 2.0.2-3 ?? >you can view screenshots of the certificate here: > >- CA Certificate that i imported on XP with DER format: >http://img357.imageshack.us/img357/2264/cacertificate1wj4.jpg > >- Client Certificate with p12 format: >http://img164.imageshack.us/img164/2894/certifclient1kf1.jpg >http://img164.imageshack.us/img164/7527/certifclient2rv3.jpg > Those certificates are fine. Where did you import the client certificate? Is it in the Personal store? Ivan Kalik Kalik Informatika ISP - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html __________________________________________________ Do You Yahoo!? En finir avec le spam? Yahoo! Mail vous offre la meilleure protection possible contre les messages non sollicités http://mail.yahoo.fr Yahoo! Mail

1 0