- Freeradius-Users - lists.freeradius.org

802.1x+WLAN and radtest
by Dr.Peer-Joachim Koch 23 Apr '08

23 Apr '08

Hi, we are using one radius server for external users to get access to a 802.1x WLAN. The radius server is configured to look for the domain and only answer local request or form our domain. Everything else is forwareded to central instance (using the proxy.conf). Now I have a strange problem: When I use our local domain "radtest" and the WLAN is working fine. When I try to use an external domain account, radtest tells OK, but using the same account for the WLAN will fail. How can I debug this error ? -- Bye, Peer _________________________________________________________ Max-Planck-Institut fuer Biogeochemie Dr. Peer-Joachim Koch Hans-Knöll Str.10 Telefon: ++49 3641 57-6705 D-07745 Jena Telefax: ++49 3641 57-7705

2 5

FW: is okay
by alberto beas castañeda 23 Apr '08

23 Apr '08

> From: freeradius-users-confirm+207f898fd4ffaa48bbe50ae10f48767ca4f802a7(a)lists.freeradius.org> To: beas_abc(a)hotmail.com> Subject: Your confirmation is required to join the Freeradius-Users mailing list> Date: Wed, 23 Apr 2008 17:25:45 +0200> > Mailing list subscription confirmation notice for mailing list> Freeradius-Users> > We have received a request from 200.0.112.129 for subscription of your> email address, "beas_abc(a)hotmail.com", to the> freeradius-users(a)lists.freeradius.org mailing list. To confirm that> you want to be added to this mailing list, simply reply to this> message, keeping the Subject: header intact. Or visit this web page:> > http://lists.freeradius.org/mailman/confirm/freeradius-users/207f898fd4ffaa…> > > Or include the following line -- and only the following line -- in a> message to freeradius-users-request(a)lists.freeradius.org:> > confirm 207f898fd4ffaa48bbe50ae10f48767ca4f802a7> > Note that simply sending a `reply' to this message should work from> most mail readers, since that usually leaves the Subject: line in the> right form (additional "Re:" text in the Subject: is okay).> > If you do not wish to be subscribed to this list, please simply> disregard this message. If you think you are being maliciously> subscribed to the list, or have any other questions, send them to> freeradius-users-owner(a)lists.freeradius.org. _________________________________________________________________ Juega y gana, tenemos 3 Xbox a la semana. http://club.prodigymsn.com/

1 0

the problem about the session key
by xiningtom_1986 23 Apr '08

23 Apr '08

Hello,I learn that there is a MK that need to pass to the AP after the auth is complete.Do you know how to generate the key? Are they generated differently in different way of auth? Xingtom

1 0

Multiple instances of attribute in tunnelled reply
by Arran Cudbard-Bell 23 Apr '08

23 Apr '08

Hi, We formulate our reply inside of the virtual server dealing with EAP and send it back to the outer server. This is the only way I could think of to insert the Inner identity into the Access-Accept. It all works fine... however it seems there's a bug when dealing with multiple instances of the same attribute. For example: users / sql DEFAULT Service-Type == Framed-User, Realm == 'local', SS-Flags =~ "^.1........$" Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-ID = 603, Reply-Message = "User %{%{Stripped-User-Name}:-%{User-Name}} authenticated for ResNet access on NAS:%{%{NAS-Identifier}:-Uknown NAS} SSID:%{%{Called-Station-SSID}:-none}.", HP-IP-FILTER-RAW = 'deny in 41 from any to any', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.1', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.2', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.3', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.4', HP-IP-FILTER-RAW += 'permit in ip from any to 10.0.8.5', Fall-Through = no Ends up being sent as the response: # server default-inner PEAP: Got tunneled reply RADIUS code 2 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User ac221 authenticated for ResNet access on NAS:hp-e-engg1-1-dev-8021x-sw1 SSID:none." HP-Ip-Filter-Raw = "deny in 41 from any to any" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.1" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.2" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.3" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.4" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.5" EAP-Message = 0x03490004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ac221" PEAP: Processing from tunneled session code 0x845cb10 2 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" Reply-Message = "User ac221 authenticated for ResNet access on NAS:hp-e-engg1-1-dev-8021x-sw1 SSID:none." HP-Ip-Filter-Raw = "deny in 41 from any to any" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.1" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.2" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.3" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.4" HP-Ip-Filter-Raw = "permit in ip from any to 10.0.8.5" EAP-Message = 0x03490004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "ac221" PEAP: Tunneled authentication was successful. rlm_eap_peap: SUCCESS Saving tunneled attributes for later So when it's actually used in the Access-Accept packet it appears as: Sending Access-Accept of id 173 to 139.184.8.16 port 1024 Service-Type = Framed-User Framed-MTU = 1480 Framed-Routing = None Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "603" HP-Ip-Filter-Raw = "deny in 41 from any to any" User-Name = "ac221(a)sussex.ac.uk" MS-MPPE-Recv-Key = 0xdec383f4a269cb3d8fcf59cd9e351971c3a9a3683a7c245144a0b852634c7a03 MS-MPPE-Send-Key = 0xb9f49bba9f9020deaa745c6ea0e8f5b92e72e2fc5b6465aed4a9231f10edd696 EAP-Message = 0x034a0004 Message-Authenticator = 0x00000000000000000000000000000000 Finished request 9. What's really weird is in the previous rounds of EAP, the attributes retain the += operator, it's only in the one where the EAP-Success message is returned where all the operators are stripped out. Relevant EAP bits: eap { ... ttls { ... copy_request_to_tunnel = yes use_tunneled_reply = yes virtual_server = "default-inner" } } Thanks, Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 3

reference packet code in unlang?
by Stefan Winter 23 Apr '08

23 Apr '08

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi list, we sometimes get Accounting-On/Off tickets that are not meant for us (don't ask... bugyy NASes). I have a filter criterion: the NAS sends in Acct-Session-Id a unique string. When it's meant for us it has a certain value, wehen not, the string is different. I would like to match the packets in unlang in preacct and ACK the packets while not actually processing them (empty accounting{} section). Using the following in preacct threw a parser error. Maybe I'm just blind. I don't see the syntax error: if (Acct-Status-Type == "Accounting-Off" && !(Acct-Session-Id =~ "restena.*")) update control { ~ Proxy-To-Realm := testrealm.lu ~ } (first and second line wrapped) I'm sort of lost... Greetings, Stefan Winter -----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.4-svn0 (GNU/Linux) Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org iD8DBQFIDdpE+jm90f8eFWYRAgUkAJ9ivmuZk+W50wXkEV2PeMeSH/sJVgCfQBSO 6UK49D6t2Fk1UPagntYa10I= =CSEz -----END PGP SIGNATURE-----

3 6

EAP SSL certificates - how to?
by matthew zeier 22 Apr '08

22 Apr '08

I'm having problems figuring out how to create an SSL certificate for WPA Enterprise authentication. Self-signed ones cause "unknown root" errors on OS X clients which I'd expect. I took a GeoTrust certificate off a webserver and now get "unknown trust" errors. I'm looking for something that doesn't require end-user interaction. I generated a test certificate using the bootstrap script in the src dist. The server.crt appears to have the same x509 fields GeoTrust has (GeoTrust has more) so I'm not sure what I'm missing. I'm also entirely unclear what he CN should be. Any pointers? -- matthew zeier | Network Engineer | Mozilla Corp. | (650)903-0800 x219

2 1

Freeradius performance settings or bug?
by Jeremiah Millay 22 Apr '08

22 Apr '08

Hi, I'm seeing some odd behavior running freeradius-1.1.7 in a freebsd 6.3 environment. I see a lot of these in the radius log: Tue Apr 22 09:27:44 2008 : Error: Discarding duplicate request from client arc3.wnskvtao.sover.net:1645 - ID: 208 due to unfinished request 1267 Tue Apr 22 09:27:44 2008 : Error: Discarding duplicate request from client arc3.wnskvtao.sover.net:1645 - ID: 209 due to unfinished request 1268 as well as the cputime constantly increasing the longer I leave radiusd running: last pid: 34247; load averages: 0.29, 0.32, 0.39 up 4+22:29:48 09:27:05 30 processes: 2 running, 28 sleeping CPU states: 2.6% user, 0.0% nice, 10.5% system, 0.0% interrupt, 86.8% idle Mem: 17M Active, 447M Inact, 173M Wired, 20K Cache, 112M Buf, 2618M Free Swap: 4096M Total, 4096M Free PID USERNAME PRI NICE SIZE RES STATE C TIME WCPU COMMAND 34011 root 20 0 9852K 6904K kserel 2 8:09 1.61% radiusd 34011 root 96 0 9852K 6904K select 0 8:09 0.00% radiusd 34011 root 20 0 9852K 6904K kserel 2 8:09 0.00% radiusd 34011 root 20 0 9852K 6904K kserel 2 8:09 0.00% radiusd 34011 root 20 0 9852K 6904K ksesig 0 8:09 0.00% radiusd 34011 root 98 0 9852K 6904K CPU0 0 8:09 0.00% radiusd Looking at older messages posted to the list, I see Alan suggests that the duplicate requests are related to radiusd not replying quickly enough due to either having hostname lookups enabled or due to sql backend slowness. I'm not using sql in my configuration and do not have hostname lookups enabled. Are there any settings I could tweak in radiusd.conf to help? Maybe there is a bug I am not aware of relating to running freeradius under freebsd (I know there are some SMP related issues). Here are some configuration snippets that may be relevant: cleanup_delay = 2 max_requests = 10240 hostname_lookups = no thread pool { start_servers = 20 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } Any help or suggestions would be greatly appreciated. Jeremiah

3 4

Re: Freeradius-Users Digest, Vol 36, Issue 130
by Jack Murgia 22 Apr '08

22 Apr '08

Phil, on 4/21/08 3:00 AM, freeradius-users-request(a)lists.freeradius.org at freeradius-users-request(a)lists.freeradius.org wrote: > Date: Mon, 21 Apr 2008 10:38:24 +0100 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > Subject: Re: NAS with dynamic IP > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <480C6090.2070005(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Jack Murgia wrote: >> Alex, >> >> Is there a command I can run periodically that would flush the dns cache? > > pkill radiusd; /usr/sbin/radiusd > > i.e. restart the server. Otherwise, no. > >> >> I use the NAS table in MySQL rather than clients.conf to register my NAS >> devices. The only problem with NAS devices on PPOE ADSL links is that a >> restart of Freeradius server is required in order to pick up the new IP >> address from DYNDNS.org. >> >> Would this problem be solved by a rlm_nsupdate module (scheduled for future >> release)? I would be willing to donate to the creation of this module. > > How does that help? Not sure what the intention of that module is, but in the roadmap it says " New module: rlm_nsupdate (dyndns). Because dynamic addresses are cruel." Which made me think it might relate to this issue. > > The problem is that the server might have outstanding requests for a > given client record when it's removed. It's a hard problem. > Right- chillispot is web-based- so user's browser will hang for as long as the TCP timeout takes, I think- will have to test. > Does re-starting the server *really* take so long it's a problem for you? Oh it's very fast at restarting. But I'd have to decide how much "downtime" for the authorization process due to NAS ip changes I am willing to tolerate (10 minutes? 5 minutes?) and set my restart intervals accordingly, which seems a bit messy. Especially if someone is trying to login, as noted above. And does it affect open sessions on other NASs (force them to login again, creating simultaneous use issues with orphaned accounting records in MySQL)? Will have to test that as well. I suppose restarting freeradius would be an acceptable workaround for the time being if those two issues above aren't barriers. Jack Murgia

2 1

Re: Possible to limit user access to different types of authentication?
by Ryan 22 Apr '08

22 Apr '08

Hi Alan, Thanks for the update. I have read through "man unlang" as well. Overlooked on the part on the additional "Cisco-AVPair" attribute as it was only available after authentication is done. I have worked around it using the proxy-inner-tunnel method to terminal the EAP on the front radius and then proxy MS-CHAP to an internal radius that will do an LDAP bind with an additional attribute. As the front radius will also handle EAP requests that will not be handled by the internal radius, will it just proxy the EAP request based on the domain or it will terminate and forward to my internal radius instead? Thanks/Regards, Ryan On Fri, Apr 18, 2008 at 4:44 PM, <freeradius-users-request(a)lists.freeradius.org> wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > Date: Fri, 18 Apr 2008 07:55:42 +0200 > From: Alan DeKok <aland(a)deployingradius.com> > Subject: Re: Possible to limit user access to different types of > authentication? > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Message-ID: <480837DE.5010400(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Ryan wrote: > > Did some further searching on the listing and noticed that it is > > possible to do a string compared in the authorize and authenticate > > sections. > > $ man unlang > > > However running radius in debug mode will return the following error. > > > > (Attribute Cisco-AVPair was not found) > > Because the attribute isn't in the request. Go look at the packet > that the server received. There is no such attribute in it. > > > I know that it is possible to match the Cisco-AVPair in the users > > file. Can we do the same in the authorize/authenticate sections as > > well? > > Yes. This is documented in the "unlang" man page. But if the > attribute isn't in the request, you can't compare it to anything. > > Alan DeKok.

2 1

Can't get the value of 'Digest-User-name', 'Digest-Realm', 'Digest-Method', 'Digest-Uri', 'Digest-Nonce', 'Digest-Response'
by johnson elangbam 22 Apr '08

22 Apr '08

hi, I am using free Radius 2.0.3. I m configured my AAA through rlm_perl. I need to do the authorization by using the following attributes. Digest-Realm Digest-Method Digest-Uri Digest-Nonce Digest-Nonce Digest-Response Unfortunately i did not get any value from these attributes when i called using $RAD_REQUEST. Please tell me any idea to get these values. Here is the piece of authorization code that i've used. sub authorize { my $nasuser1; my $nasuser; my $naspass; my $dUserName; my $dRealm; my $dMethod; my $dUri; my $dNonce; my $nameindex; my $dResponse; $nasuser = $RAD_REQUEST{'User-Name'}; $naspass = $RAD_REQUEST{'User-Password'}; $dUserName= $RAD_REQUEST{'Digest-User-Name'}; $dRealm= $RAD_REQUEST{'Digest-Realm'}; $dMethod = $RAD_REQUEST{'Digest-Method'}; $dUri= $RAD_REQUEST{'Digest-URI'}; $dNonce=$RAD_REQUEST{'Digest-Nonce'}; $dResponse=$RAD_REQUEST{'Digest-Response'}; my $dPassword; my $ha1; my $ha2; my $a1; my $a2; my $a; my $sqltest; my $sthtest; my $user = "user"; my $password = "password"; my $dbhtest=DBI->connect('dbi:ODBC:MSSQLDSN',$user,$password,{PrintError=>0,RaiseError=>0}); my $dbh = DBI-> connect('dbi:ODBC:MSSQLDSN', $user, $password, {PrintError =>0, RaiseError =>0}); my $sql = qq/select * from testing where UserName = '$nasuser'/; my $sth=$dbh->prepare($sql); if($dbh) { $sth->execute(); if(my $row = $sth->fetchrow_hashref) { #password from database against the username $dPassword=$row->{UserPassword}; $a1=$dUserName.':'.$dRealm.':'.$dPassword; #first part of the hash calculated. $ha1=md5($a1); $a2=$dMethod.':'.$dUri; #second part of the hash calculated. $ha2=md5($a2); #final string to be hashed. $a=$ha1.':'.$dNonce.':'.$ha2; #final response to be checked with the digest-response $a=md5($a); if($a eq $dResponse) { $RAD_REPLY{'Reply-Message'} = "Accepting Users"; return RLM_MODULE_OK; } else { $RAD_REPLY{'Reply-Message'} = "Incorrect Password"; return RLM_MODULE_REJECT; } }#End of row fetch else { $RAD_REPLY{'Reply-Message'} = "Incorrect Username"; #$RAD_REPLY{'Reply-Message'} = $nasuser; return RLM_MODULE_REJECT; }#End of else }#end of if database connection else { $RAD_REPLY{'Reply-Message'} = "Cannot connect to database"; } }#End of authorization subsection With Regards Elangbam Johnson

1 0