- Freeradius-Users - lists.freeradius.org

rlm_eap: No EAP-Message, not doing EAP?
by secrookie＠mac.com 01 Apr '08

01 Apr '08

My setup is as follows and I am trying to do WPA2 EAP-TLS authentication on an Apple Airport WLAN: Fedora 8 Freeradius (192.168.1.26) Airport Express (192.168.1.23) - WPA2 I do not seem to be seeing eap messages in debug mode. Would appreciate some assistance if possible. --REJECTED USER rad_recv: Access-Request packet from host 192.168.1.23:1812, id=88, length=73 User-Password = "testing123" User-Name = "0019w3-h9a056" NAS-Identifier = "192.168.1.23" NAS-IP-Address = 192.168.1.23 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 153 users: Matched entry DEFAULT at line 229 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Reject rad_check_password: Auth-Type = Reject, rejecting user auth: Failed to validate the user. --clients.conf client 192.168.1.23 { secret = testing123 shortname = wireless_ap1 nastype = other } -eap.conf eap { default_eap_type = tls timer_expire = 60 ignore_unknown_eap_types = no md5 { } tls { private_key_password = secret private_key_file = /etc/raddb/certs/CA/RADIUS-key.pem certificate_file = /etc/raddb/certs/CA/RADIUS-cert.pem CA_file = /etc/raddb/certs/CA/cacert.pem dh_file = /etc/wireless/dh random_file = /etc/wireless/random fragment_size = 1024 include_length = yes cipher_list = "DEFAULT" } -users Left as default, as EAP-TLS authentication are done automatically? --DEBUG [root@localhost raddb]# radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 1812 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/etc/raddb/certs/CA/RADIUS-key.pem" tls: certificate_file = "/etc/raddb/certs/CA/RADIUS-cert.pem" tls: CA_file = "/etc/raddb/certs/CA/cacert.pem" tls: private_key_password = "secret" tls: dh_file = "/etc/wireless/dh" tls: random_file = "/etc/wireless/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" tls: cipher_list = "DEFAULT" tls: check_cert_issuer = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls ttls: default_eap_type = "md5" ttls: copy_request_to_tunnel = no ttls: use_tunneled_reply = no rlm_eap: Loaded and initialized type ttls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. Regards secrookie

4 4

Mission in morocco
by A.Dupont 31 Mar '08

31 Mar '08

Hello, is there any expert of freeradius who can come to morocco for auditing a freeradius installation? Thanks in advance, _____________________________________________________________________________ Envoyez avec Yahoo! Mail. Plus de moyens pour rester en contact. http://mail.yahoo.fr

3 2

check MAC Adress with freeradius via openldap
by Andreas Viehhauser 31 Mar '08

31 Mar '08

hi, i need help to configurate the MAC based authentication. I use freeradius 1.0.1 and openldap 2.0.27-17. The config from the HP Switch to the Radius is ok. In the LDAP there are the MAC Adresses from all my Laptops like "macAdress". LDAP: ldapsearch -LL -x -H ldap://atmacldapsr01 -D cn=Manager,o=wuestenrot,c=at -w secret -b ou=workstation,o=wuestenrot,c=at macAddress=00:1E:37:1C:5F:D4 wueroRechnername: ATTSBGVARR40 macAddress: 00:06:1B:CA:53:64 I only want that radius check at the LDAP, if the MAC Address exists. IF the MAC exists go to VLAN 5 else go to VLAN 10. Have anyone an idea were my problem is??? or an good Howto?? Is it right to make this with the checkval? users File? Have anyone an example? Next step, I want to make checks over an extern script? Where to I activate this feature? Please help me. thanks a lot andi RADIUS: [root@atmacradsr01 raddb]# radiusd -Xf Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "yes" main: lower_pass = "yes" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "atmacldapsr01" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=Manager,o=wuestenrot,c=at" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "secret" ldap: basedn = "ou=workstation,o=wuestenrot,c=at" ldap: filter = "(macAddress=%{User-Name})" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "(null)" ldap: password_attribute = "(null)" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames) (member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames) (uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP macAddress mapped to RADIUS User-Name rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP sambaLMPassword mapped to RADIUS LM-Password rlm_ldap: LDAP sambaNTPassword mapped to RADIUS NT-Password rlm_ldap: LDAP sambaAcctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed- AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed- AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed- AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x8bb05a8 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/etc/raddb/huntgroups" preprocess: hints = "/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded checkval checkval: item-name = "User-Name" checkval: check-name = "macAddress" checkval: data-type = "string" checkval: notfound-reject = no rlm_checkval: Registered name macAddress for attribute 1671 Module: Instantiated checkval (checkval) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/etc/raddb/users" files: acctusersfile = "/etc/raddb/acct_users" files: preproxy_usersfile = "/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) detail: detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/ detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Module: Loaded eap eap: default_eap_type = "md5" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. Now I connect an Laptop on the switch and this is shown on the radius: rad_recv: Access-Request packet from host 192.168.10.1:1024, id=241,length=183 Framed-MTU = 9178 NAS-IP-Address = 192.168.10.1 NAS-Identifier = "MAC-VAR" User-Name = "00:06:1b:ca:53:64" Service-Type = Framed-User Framed-Protocol = PPP NAS-Port = 17 NAS-Port-Type = Ethernet NAS-Port-Id = "17" Called-Station-Id = "00-18-fe-e6-36-ef" Calling-Station-Id = "00-06-1b-ca-53-64" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" CHAP-Password = 0x50eec0218f3e8b36308a4c070b9eca0267 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 radius_xlat: '/var/log/radius/radacct/192.168.10.1/auth-detail-20080328' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/auth- detail-%Y%m%d expands to /var/log/radius/radacct/192.168.10.1/auth- detail-20080328 modcall[authorize]: module "auth_log" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for 00:06:1b:ca:53:64 radius_xlat: '(macAddress=00:06:1b:ca:53:64)' radius_xlat: 'ou=workstation,o=wuestenrot,c=at' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to atmacldapsr01:389, authentication 0 rlm_ldap: bind as cn=Manager,o=wuestenrot,c=at/secret to atmacldapsr01:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=workstation,o=wuestenrot,c=at, with filter (macAddress=00:06:1b:ca:53:64) rlm_ldap: looking for check items in directory... rlm_ldap: Adding macAddress as User-Name, value 00:06:1B:CA:53:64 & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user 00:06:1b:ca:53:64 authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_checkval: Item Name: User-Name, Value: 00:06:1b:ca:53:64 rlm_checkval: Could not find attribute named macAddress in check pairs modcall[authorize]: module "checkval" returns notfound for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. Cannot use "CHAP-Password". modcall[authenticate]: module "ldap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Login incorrect: [00:06:1b:ca:53:64] (from client private-network-1 port 17 cli 00-06-1b-ca-53-64) Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 241 to 192.168.10.1:1024 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 241 with timestamp 47eca277 Nothing to do. Sleeping until we see a request. This are my config Files: cat ldap.attrmap checkItem $GENERIC$ radiusCheckItem replyItem $GENERIC$ radiusReplyItem checkItem User-Name macAddress checkItem Auth-Type radiusAuthType checkItem Simultaneous-Use radiusSimultaneousUse checkItem Called-Station-Id radiusCalledStationId checkItem Calling-Station-Id radiusCallingStationId checkItem LM-Password sambaLMPassword checkItem NT-Password sambaNTPassword checkItem SMB-Account-CTRL-TEXT sambaAcctFlags checkItem Expiration radiusExpiration replyItem Service-Type radiusServiceType replyItem Framed-Protocol radiusFramedProtocol replyItem Framed-IP-Address radiusFramedIPAddress replyItem Framed-IP-Netmask radiusFramedIPNetmask replyItem Framed-Route radiusFramedRoute replyItem Framed-Routing radiusFramedRouting replyItem Filter-Id radiusFilterId replyItem Framed-MTU radiusFramedMTU replyItem Framed-Compression radiusFramedCompression replyItem Login-IP-Host radiusLoginIPHost replyItem Login-Service radiusLoginService replyItem Login-TCP-Port radiusLoginTCPPort replyItem Callback-Number radiusCallbackNumber replyItem Callback-Id radiusCallbackId replyItem Framed-IPX-Network radiusFramedIPXNetwork replyItem Class radiusClass replyItem Session-Timeout radiusSessionTimeout replyItem Idle-Timeout radiusIdleTimeout replyItem Termination-Action radiusTerminationAction replyItem Login-LAT-Service radiusLoginLATService replyItem Login-LAT-Node radiusLoginLATNode replyItem Login-LAT-Group radiusLoginLATGroup replyItem Framed-AppleTalk-Link radiusFramedAppleTalkLink replyItem Framed-AppleTalk-Network radiusFramedAppleTalkNetwork replyItem Framed-AppleTalk-Zone radiusFramedAppleTalkZone replyItem Port-Limit radiusPortLimit replyItem Login-LAT-Port radiusLoginLATPort file: clients.conf: only add my segment client 192.168.10.0/24 { secret = testing123-1 shortname = private-network-1 } file: users: only add LDAP as Auth-Type # First setup all accounts to be checked against the UNIX /etc/passwd. # (Unless a password was already given earlier in this file). # DEFAULT Auth-Type = LDAP Fall-Through = 1 # # Set up different IP address pools for the terminal servers. # Note that the "+" behind the IP address means that this is the "base" # IP address. The Port-Id (S0, S1 etc) will be added to it. file: radius.conf prefix = /usr exec_prefix = /usr sysconfdir = /etc localstatedir = /var sbindir = /usr/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = /usr/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 #listen { # IP address on which to listen. # Allowed values are: # dotted quad (1.2.3.4) # hostname (radius.example.com) # wildcard (*) # ipaddr = * # Port on which to listen. # Allowed values are: # integer port number (1812) # 0 means "use /etc/services for the proper port" # port = 0 # Type of packets to listen for. # Allowed values are: # auth listen for authentication packets # acct listen for accounting packets # # type = auth #} # hostname_lookups: Log the names of clients or just their IP addresses # allowed values: {no, yes} # hostname_lookups = no # Core dumps are a bad thing. This should only be set to 'yes' # if you're debugging a problem with the server. # allowed values: {no, yes} allow_core_dumps = no regular_expressions = yes extended_expressions = yes # Log the full User-Name attribute, as it was found in the request. # # allowed values: {no, yes} # log_stripped_names = no # Log authentication requests to the log file. # # allowed values: {no, yes} # log_auth = yes # Log passwords with the authentication requests. # log_auth_badpass - logs password if it's rejected # log_auth_goodpass - logs password if it's correct # # allowed values: {no, yes} # log_auth_badpass = no log_auth_goodpass = no # usercollide: Turn "username collision" code on and off. See the # "doc/duplicate-users" file usercollide = no # Default is 'no' (don't lowercase values) # Valid values = "before" / "after" / "no" # #lower_user = no #lower_pass = no lower_user = yes lower_pass = yes # nospace_user / nospace_pass: # Some users like to enter spaces in their username or password # incorrectly. To save yourself the tech support call, you can # eliminate those spaces here: # Default is 'no' (don't remove spaces) # Valid values = "before" / "after" / "no" (explanation above) nospace_user = no nospace_pass = no # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad # SECURITY CONFIGURATION # security { # max_attributes = 200 reject_delay = 1 status_server = no } # PROXY CONFIGURATION # proxy_requests: Turns proxying of RADIUS requests on or off. # allowed values: {no, yes} proxy_requests = yes $INCLUDE ${confdir}/proxy.conf # CLIENTS CONFIGURATION # The 'clients.conf' file contains all of the information from the old # 'clients' and 'naslist' configuration files. We recommend that you # do NOT use 'client's or 'naslist', although they are still # supported. # Anything listed in 'clients.conf' will take precedence over the # information from the old-style configuration files. $INCLUDE ${confdir}/clients.conf # SNMP CONFIGURATION # 'snmp' attribute to 'yes' snmp = no $INCLUDE ${confdir}/snmp.conf # THREAD POOL CONFIGURATION # The thread pool is a long-lived group of threads which # take turns (round-robin) handling any incoming requests. # thread pool { # Number of servers to start initially --- should be a reasonable # ballpark figure. start_servers = 5 # Limit on the total number of servers running. # max_servers = 32 # Server-pool size regulation. Rather than making you guess min_spare_servers = 3 max_spare_servers = 10 # '0' is a special value meaning 'infinity', or 'the servers never # exit' max_requests_per_server = 0 } # MODULE CONFIGURATION # modules { # # Each module has a configuration as follows: # # name [ instance ] { # config_item = value # ... # } # # The 'name' is used to load the 'rlm_name' library # which implements the functionality of the module. # # Supports multiple encryption schemes # clear: Clear text # crypt: Unix crypt # md5: MD5 ecnryption # sha1: SHA1 encryption. # DEFAULT: crypt #auskommentiert #pap { # encryption_scheme = crypt #} # CHAP module # # To authenticate requests containing a CHAP-Password attribute. # #aukommentiert #chap { # authtype = CHAP #} # Pluggable Authentication Modules # # For Linux, see: # http://www.kernel.org/pub/linux/libs/pam/index.html # # WARNING: On many systems, the system PAM libraries have # memory leaks! We STRONGLY SUGGEST that you do not # use PAM for authentication, due to those memory leaks. # #pam { # #} # $INCLUDE ${confdir}/eap.conf # Lightweight Directory Access Protocol (LDAP) # # This module definition allows you to use LDAP for # authorization and authentication (Auth-Type := LDAP) # # See doc/rlm_ldap for description of configuration options # and sample authorize{} and authenticate{} blocks ldap { server = "atmacldapsr01" identity = "cn=Manager,o=wuestenrot,c=at" password = secret basedn = "ou=workstation,o=wuestenrot,c=at" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" filter = "(macAddress=%{User-Name})" #filter = "(macAddress=%{Stripped-User-Name:-%{User-Name}})" # base_filter = "(objectclass=radiusprofile)" # set this to 'yes' to use TLS encrypted connections # to the LDAP database by using the StartTLS extended # operation. # The StartTLS operation is supposed to be used with normal # ldap connections instead of using ldaps (port 689) connections start_tls = no # tls_cacertfile = /path/to/cacert.pem # tls_cacertdir = /path/to/ca/dir/ # tls_certfile = /path/to/radius.crt # tls_keyfile = /path/to/radius.key # tls_randfile = /path/to/rnd # tls_require_cert = "demand" # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #aukommendiert #access_attr = "dialupAccess" # Mapping of RADIUS dictionary attributes to LDAP # directory attributes. dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 # # password_attribute = userPassword # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames) (member=%{Ldap-UserDn}))(&(objectClass=GroupOfUniqueNames) (uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 # compare_check_items = yes # do_xlat = yes # access_attr_used_for_allow = yes } # 'realm/username' # # Using this entry, IPASS users have their realm set to "IPASS". realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } # 'username@realm' # realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } # 'username%realm' # realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } # # 'domain\user' # realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } # A simple value checking module # # # Regular expressions in the check attribute value are allowed # as long as the operator is '=~' # checkval { # The attribute to look for in the request #item-name = Calling-Station-Id item-name = User-Name # The attribute to look for in check items. Can be multi valued #check-name = Calling-Station-Id check-name = macAddress # The data type. Can be # string,integer,ipaddr,date,abinary,octets data-type = string # If set to yes and we dont find the item-name attribute in the # request then we send back a reject # DEFAULT is no #notfound-reject = no #notfound-reject = no } # rewrite arbitrary packets. Useful in accounting and authorization. # Backreferences are supported: %{0} will contain the string the whole match # and %{1} to %{8} will contain the contents of the 1st to the 8th parentheses # # If max_matches is greater than one the backreferences will correspond to the # first match # #attr_rewrite sanecallerid { # attribute = Called-Station-Id # may be "packet", "reply", "proxy", "proxy_reply" or "config" # searchin = packet # searchfor = "[+ ]" # replacewith = "" # ignore_case = no # new_attribute = no # max_matches = 10 # ## If set to yes then the replace string will be appended to the original string # append = no #} # Preprocess the incoming RADIUS request, before handing it off # to other modules. # preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints # This hack changes Ascend's wierd port numberings # to standard 0-??? port numbers so that the "+" works # for IP address assignments. with_ascend_hack = no ascend_channels_per_line = 23 # Windows NT machines often authenticate themselves as with_ntdomain_hack = no # # If you're not running a Cisco NAS, you don't need # this hack. with_cisco_vsa_hack = no } # Livingston-style 'users' file # files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users # If you want to use the old Cistron 'users' file # with FreeRADIUS, you should change the next line # to 'compat = cistron'. You can the copy your 'users' # file from Cistron. compat = no } # Write a detailed log of all accounting records received. # detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } detail auth_log { detailfile = ${radacctdir}/%{Client-IP-Address}/auth-detail-%Y%m%d # # This MUST be 0600, otherwise anyone can read # the users passwords! # detailperm = 0600 } # Create a unique accounting session Id. Many NASes re-use or # repeat values for Acct-Session-Id, causing no end of # confusion. acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP- Address, NAS-Port" } radutmp { # Where the file is stored. It's not a log file, # so it doesn't need rotating. # filename = ${logdir}/radutmp # # You may want instead: %{Stripped-User-Name:-%{User-Name}} username = %{User-Name} # case_sensitive = yes # check_with_nas = yes # Set the file permissions, as the contents of this file # are usually private. perm = 0600 callerid = "yes" } # "Safe" radutmp - does not contain caller ID, so it can be # world-readable, and radwho can work for normal users, without # exposing any information that isn't already exposed by who(1). # # This is another 'instance' of the radutmp module, but it is given # then name "sradutmp" to identify it later in the "accounting" # section. radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } # attr_filter - filters the attributes received in replies from # proxied servers, to make sure we send back to our RADIUS client # only allowed attributes. attr_filter { attrsfile = ${confdir}/attrs } # counter module: # DEFAULT Max-Daily-Session := 36000 # Fall-Through = 1 # # 'check-name' attribute. # counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } # The "ALways" module is here for debugging purposes. Each # instance simply returns the same result, always, without # doing anything. always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } # # The 'expression' module currently has no configuration. # # Attribute-Name = `%{expr:2 + 3 + %{exec: uid -u}}` # # The value of the attribute will be replaced with the output # of the program which is executed. Due to RADIUS protocol # limitations, any output over 253 bytes will be ignored. expr { } # # The 'digest' module currently has no configuration. # # "Digest" authentication against a Cisco SIP server. # See 'doc/rfc/draft-sterman-aaa-sip-00.txt' for details # on performing digest authentication for Cisco SIP servers. # digest { } # # Execute external programs # exec { wait = yes programm = "/bin/echo %{User-Name}" input_pairs = request } execok { rcode = ok } # # This is a more general example of the execute module. # exec echo { # # Wait for the program to finish. # # If we do NOT wait, then the program is "fire and # forget", and any output attributes from it are ignored. # # If we are looking for the program to output # attributes, and want to add those attributes to the # request, then we MUST wait for the program to # finish, and therefore set 'wait=yes' # # allowed values: {no, yes} wait = yes # # The name of the program to execute, and it's # arguments. Dynamic translation is done on this # field, so things like the following example will # work. # program = "/bin/echo %{User-Name}" # # The attributes which are placed into the # environment variables for the program. # input_pairs = request # # Where to place the output attributes (if any) from # output_pairs = reply # # #packet_type = Access-Accept } # Do server side ip pool management. Should be added in post-auth and # accounting sections. ********* # ippool main_pool { # range-start,range-stop: The start and end ip # addresses for the ip pool range-start = 192.168.1.1 range-stop = 192.168.3.254 # netmask: The network mask used for the ip's netmask = 255.255.255.0 # cache-size: The gdbm cache size for the db # files. Should be equal to the number of ip's # available in the ip pool cache-size = 800 # session-db: The main db file used to allocate ip's to clients session-db = ${raddbdir}/db.ippool # ip-index: Helper db index file used in multilink ip-index = ${raddbdir}/db.ipindex # override: Will this ippool override a Framed-IP-Address already set override = no # maximum-timeout: If not zero specifies the maximum time in seconds an # entry may be active. Default: 0 maximum-timeout = 0 } # ANSI X9.9 token support. Not included by default. # $INCLUDE ${confdir}/x99.conf } # Instantiation # # This section orders the loading of the modules. Modules # listed here will get loaded BEFORE the later sections like # authorize, authenticate, etc. get examined. # instantiate { # # Allows the execution of external scripts. # The entire command line (and output) must fit into 253 bytes. # # e.g. Framed-Pool = `%{exec:/bin/echo foo}` exec # # The expression module doesn't do authorization, # authentication, or accounting. It only does dynamic # translation, of the form: # # Session-Timeout = `%{expr:2 + 3}` # # expr # # We add the counter module here so that it registers # the check-name attribute before any module which sets # it # daily } # Authorization. First preprocess (hints and huntgroups files), # then realms, and finally look in the "users" file. authorize { # # The preprocess module takes care of sanitizing some bizarre # attributes in the request, and turning them into attributes # which are more standard. # # It takes care of processing the 'raddb/hints' and the # 'raddb/huntgroups' files. # # It also adds the %{Client-IP-Address} attribute to the request. preprocess # # If you want to have a log of authentication requests, # un-comment the following line, and the 'detail auth_log' # section, above. auth_log # attr_filter # # The chap module will set 'Auth-Type := CHAP' if we are # handling a CHAP request and Auth-Type has not already been set #chap # # If the users are logging in with an MS-CHAP-Challenge #mschap # # If you have a Cisco SIP server authenticating against # FreeRADIUS, uncomment the following line, and the 'digest' # line in the 'authenticate' section. # digest # # Look for IPASS style 'realm/', and if not found, look for # '@realm', and decide whether or not to proxy, based on # that. # IPASS # # If you are using multiple kinds of realms, you probably # want to set "ignore_null = yes" for all of them. # Otherwise, when the first style of realm doesn't match, # the other styles won't be checked. # # suffIx # ntdomain # # This module takes care of EAP-MD5, EAP-TLS, and EAP-LEAP # authentication. # # It also sets the EAP-Type attribute in the request # attribute list to the EAP type from the packet. #auskommentiert #eap # # Read the 'users' file #auskommentiert #files # # The ldap module will set Auth-Type to LDAP if it has not # already been set ldap # # Enforce daily limits on time spent logged in. # daily # # Use the checkval module ##auskommentiert checkval } # Authentication. # # The common reasons to set the Auth-Type attribute by hand # is to either forcibly reject the user, or forcibly accept him. # authenticate { Auth-Type LDAP { #exec ldap } } # # Pre-accounting. Decide which accounting type to use. # preacct { preprocess # # Ensure that we have a semi-unique identifier for every # request, and many NAS boxes are broken. acct_unique # IPASS suffix # ntdomain # # Read the 'acct_users' file files } # # Accounting. Log the accounting data. # accounting { # detail # daily radutmp # sradutmp # Return an address to the IP Pool when we see a stop record. # main_pool # Cisco VoIP specific bulk accounting # pgsql-voip } # Session database, used for checking Simultaneous-Use. Either the radutmp # The rlm_sql module is *much* faster session { radutmp # # See "Simultaneous Use Checking Querie" in sql.conf # sql } # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # Get an address from the IP Pool. # main_pool # # If you want to have a log of authentication replies, # un-comment the following line, and the 'detail reply_log' # section, above. # reply_log # # After authenticating the user, do another SQL qeury. # # See "Authentication Logging Queries" in sql.conf # sql # # Access-Reject packets are sent through the REJECT sub-section # of the post-auth section. # # Post-Auth-Type REJECT { # insert-module-name-here # } } # # # Only a few modules currently have this method. # pre-proxy { # attr_rewrite # pre_proxy_log } # post-proxy { # post_proxy_log # attr_rewrite # Uncomment the following line if you want to filter replies from # remote proxies based on the rules defined in the 'attrs' file. # attr_filter # # If you are proxying LEAP, you MUST configure the EAP # module, and you MUST list it here, in the post-proxy # eap }

1 0

EAP-TTLS platform
by amarquez001＠ikasle.ehu.es 31 Mar '08

31 Mar '08

Goodmoorning to everybody: I want to mount a EAP-TTLS authentication platform, with a LDAP directory in the autentication&autorization server. I have read that having a LDAP directory for autenticating users could determine the autentication methods to use. So can't I use EAP-MD5 inside a EAP-TTLS tunnel ?? Only PAP, CHAP, MSCHAP methods should be used inside the tunnel?? Which are the differences between them?? I have beeing searching and I haven't found information. Could anyone give me some information about please?? Lots of thanks.

2 1

how to check module return codes?
by Papadopoulos Georgios 31 Mar '08

31 Mar '08

Hello all, I am a newbie with freeradius and I have a very newbie question. How do I check the return code of a module? What I am trying to do is the following: sql { ok = 1 fail = 1 } if (sql returned ok) { detail_success ... } elsif (sql returned fail) { detail_fail ... } else { detail_error ... } I cannot figure out how to check what sql returned. Thank you for any help. George Disclaimer The information in this e-mail and any attachments is confidential. It is intended solely for the attention and use of the named addressee(s). If you are not the intended recipient, or person responsible for delivering this information to the intended recipient, please notify the sender immediately. Unless you are the intended recipient or his/her representative you are not authorized to, and must not, read, copy, distribute, use or retain this message or any part of it. E-mail transmission cannot be guaranteed to be secure or error-free as information could be intercepted, corrupted, lost, destroyed, arrive late or incomplete, or contain viruses.

2 1

Re: how-to freeradius + aes
by Mateus Luvison 31 Mar '08

31 Mar '08

I'm try to configure a freeradius with wpa2, and I would like to make all the client configuration in the AP, without make configuration in the machine. What configuration I have to use? thanks for the patience. mateus Alan DeKok wrote: Mateus Lpi wrote: I'm looking for a how-to to configure a freeradius+aes What is that? under linux (debian). At moment I just found a ttls guide, that's not my intention. TTLS is an EAP authentication protocol. AES is a cryptographic stream cipher. They are two very different things. Perhaps you could explain what you mean. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 4

freeradius and database
by Asaad 30 Mar '08

30 Mar '08

Hi All which database is better with freeradius : postgres or mysql thanks for suggestion _________________________________________________________________ Test your Star IQ http://club.live.com/red_carpet_reveal.aspx?icid=redcarpet_HMTAGMAR

2 1

Prepaid Cards Setup
by Alex M 30 Mar '08

30 Mar '08

Hey all, I think it was asked once but I can't find anything in archives. How can I setup prepaid cards scenario? Basically I want my users to allow to get access lets say for 30 min in total and then I also want to have expiration date on the account. Can some help me on setting this thing up? Is there any module that I have to install? Tnx for help!

3 3

1.1.x branch versus the 2.x branch
by Info 29 Mar '08

29 Mar '08

Greetings, just a simple question for the developers: Why is the 1.1.x version still around? I ask because I'm working on porting submissions for MacPorts and the maintainers are asking-- 1) why the change in name to freeradius-server and, 2) should the 2.x replace the 1.1.x version all together, or is there reason to keep a port of 1.1.x around? Thanks for your insights! ___________________________________________________ James H. Graham II, Creative Director • Spark Media Group 6511 Allegheny Avenue • Takoma Park, MD 20912-4737 Tel: 301.270.4810 • Fax: 301.270.4812 • www.sparkmediagroup.com

2 1

Re: Freeradius and poprelayd - any ideas please (fwd)
by Bill Brunton 29 Mar '08

29 Mar '08

That worked perfectly... I have added both the setting of the address when someone logs in, and again removing the address when someone logs out. -- Bill bbrunton(a)icu.net http://www.brunton.net http://www.video-records.com http://www.icu.net KA0SEP NNN0HQA/OK ATP CFII BE200 BE300 BE300F BE1900 BE2000 BE2000S CE500 SIC CE525 HS125 LR45 LRJET The Internet... The place to be! ---------- Forwarded message ---------- Date: Fri, 28 Mar 2008 10:40:46 -0500 (CDT) From: Bill Brunton <bbrunton(a)icu.net> Reply-To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius and poprelayd - any ideas please Thank you... I will look into that. On Fri, 28 Mar 2008, Richard Siddall wrote: > Date: Fri, 28 Mar 2008 08:33:36 -0400 > From: Richard Siddall <richard.siddall(a)elirion.net> > Reply-To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius and poprelayd - any ideas please > > Bill Brunton wrote: > > So - if I could have freeradius add the IP to the popip database when > > they > > log in, it would make everyone much happier, especially me. > > > > I think it should be an easy thing to do... > > > > I think we did something like that in the lab about 6 years ago and never > deployed it. IIRC, we ran a command line script out of acct_users (see > /etc/raddb/acct_users; look for Exec-Program). I believe the > pop-before-relay server we were using had a command line interface to let us > update the database, and I think we set the expiration time to about 15 > minutes. > > Regards, > > Richard Siddall > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > -- Bill bbrunton(a)icu.net http: //www.brunton.net http: //www.video-records.com http: //www.icu.net KA0SEP NNN0HQA/OK ATP CFII BE200 BE300 BE300F BE1900 BE2000 BE2000S CE500 SIC CE525 HS125 LR45 LRJET The Internet... The place to be! - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0