- Freeradius-Users - lists.freeradius.org

Two networks: WEP+MAC Filtering and WPA(PEAP)
by Era 28 Feb '08

28 Feb '08

Hello, I would like to setup two WLAN networks on one AP with different VLAN. >From Radius I need MAC authorization for network #1 and WPA(PEAP) authorization for network #2. I have successfully setup both types of authorization separately. Could you please correct me about mac authorization. In my debug log I see mac authorization request : rad_recv: Access-Request packet from host 10.10.10.139:6001, id=7, length=115 User-Name = "00-18-de-4e-8f-1d" User-Password = "secret" NAS-IP-Address = x.x.x.139 Called-Station-Id = "00-20-a6-64-66-a3:A" Calling-Station-Id = "00-18-de-4e-8f-1d" NAS-Port = 2 NAS-Port-Type = Wireless-802.11 I have this entry in my users file : 00-18-de-4e-8f-1d Auth-Type:=Local, User-Password == "secret" Is this correct(right) way to control MAC addresses thought radius? Another question is : what is correct way to separate two types(MAC&PEAP) of requests to radius server? At this moment I have situation when my MAC request tries to authorize thought LDAP and only afterward looks in users file. rad_recv: Access-Request packet from host 89.113.128.139:6001, id=7, length=115 User-Name = "00-18-de-4e-8f-1d" User-Password = "secret" NAS-IP-Address = 89.113.128.139 Called-Station-Id = "00-20-a6-64-66-a3:A" Calling-Station-Id = "00-18-de-4e-8f-1d" NAS-Port = 2 NAS-Port-Type = Wireless-802.11 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00-18-de-4e-8f-1d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_realm: No '\' in User-Name = "00-18-de-4e-8f-1d", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "ntdomain" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00-18-de-4e-8f-1d at line 2 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for 00-18-de-4e-8f-1d radius_xlat: '(&(uid=00-18-de-4e-8f-1d)(objectClass=posixAccount))' radius_xlat: 'dc=x,dc=xxx,dc=com' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to localhost:389, authentication 0 rlm_ldap: bind as / to localhost:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=x,dc=xxx,dc=com, with filter (&(uid=00-18-de-4e-8f-1d)(objectClass=posixAccount)) rlm_ldap: object not found or got ambiguous search result rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 7 to xx.xx.xx.139 port 6001 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 7 with timestamp 47c698d Thank a lot Era

1 0

Re: header enrichment
by mauro 28 Feb '08

28 Feb '08

please have a look inline thanks > Normally in a mobile services there's no specification into the header > about connection type. *Which header? You are assuming that everyone here is familiar with 3g *terminology. You were already told we were not. i didn't mention anything about 3G, i spoke about mobile services, i think you know perfectly wich kind of services I'm talkig about, anyway I can try to support you: Mobile Services: means all the services that a mobile Operator can give to the customers, from SMS to WAP connections, normally when the user connect to Mobile Operator network infrastructure the connection ( mainly if we are talking about WAP connection) is treathed as an internet connection and the mobile browser request contain http header as well as common internet header. Now using some infrastructure is possible to add more parameters to the header......>>>> > many sniffing were done but only specific equipment allows to enrich the > header with this inofrmation, *Could you describe what you mean in more words? It is meaningless to *say "enrich the header". We have no idea what you mean by that. enrich the header as for google search is a particular feature of a system to add specific tag to the header and it's a common way to describe procedure. here below in attach and example of mobile header and the voice Nokia-bearer is that one that gives info about connection type: we need to determinate the type of of the connection to add to the header the needed parameters normally into a mobile operator some particualr equipment are used as well as radius server to get network parameters as connection type ( i mean connection established by7 the user) this is why I asked for i hope is everything clear now! thanks ------header example--- GET /wap/ HTTP/1.0 If-None-Match: "0-6f-3e6cf51a" Accept: image/gif, text/x-vCalendar, image/vnd.wap.wbmp, application/vnd.wap.wmlscriptc, text/x-vCard, application/vnd.wap.wmlc, application/vnd.wap.wbxml, text/vnd.wap.wml, text/vnd.wap.wmlscript, text/plain Accept-Language: en Accept-Charset: US-ASCII, ISO-8859-1, UTF-8, ISO-10646-UCS-2 profile: http://wap.sonyericssonmobile.com/UAprof/T200.xml User-Agent: SonyEricssonT200/R101 bearer-indication: 0 accept-application: 1,2 X-Nokia-CONNECTION_MODE: CMODE X-Nokia-BEARER: GPRS <-- PARAMETER NEEDED----FRRERADIUS CAN HELP?? X-Nokia-gateway-id: NAWG/3.1/Build52 Via: WTP/1.1 Vodafone wap FTC (Nokia WAP Gateway 3.1/ECD9/3.1.52), 1.1 vlsp1:9010 (squid/2.5.STABLE3) X-Forwarded-For: 172.27.9.3 Host: redsox.tcs.auckland.ac.nz -------------------------------------------- L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

3 2

RE: EAP-PEAP with LDAP for 802.1x authentication
by Ryan 28 Feb '08

28 Feb '08

I have installed smbldap-tools and tried to modify existing LDAP records using smbldap-usermod after updating the smbldap.conf and smbldap_bind.conf to connect to the LDAP but I keep getting an error that user cannot be found. Using ldapsearch, syslog shows Feb 28 17:54:42 advert slapd[5679]: connection_get(10) Feb 28 17:54:42 advert slapd[5679]: ==> bdb_bind: dn: cn=admin,o=com Feb 28 17:54:42 advert slapd[5679]: send_ldap_result: err=0 matched="" text="" Feb 28 17:54:42 advert slapd[5679]: connection_get(10) Feb 28 17:54:42 advert slapd[5679]: SRCH "o=com" 2 0 Feb 28 17:54:42 advert slapd[5679]: 0 0 0 Feb 28 17:54:42 advert slapd[5679]: filter: (&(objectClass=advert-account)(uid=samba_servers)) Feb 28 17:54:42 advert slapd[5679]: attrs: But using smbldap-usermod, syslog shows Feb 28 17:57:25 advert slapd[5679]: connection_get(10) Feb 28 17:57:25 advert slapd[5679]: ==> bdb_bind: dn: cn=admin,o=com Feb 28 17:57:25 advert slapd[5679]: send_ldap_result: err=0 matched="" text="" Feb 28 17:57:25 advert slapd[5679]: connection_get(10) Feb 28 17:57:25 advert slapd[5679]: SRCH "o=com" 2 2 Feb 28 17:57:25 advert slapd[5679]: 0 0 0 Feb 28 17:57:25 advert slapd[5679]: filter: (&(?=undefined)(uid=samba_servers)) Feb 28 17:57:25 advert slapd[5679]: attrs: Feb 28 17:57:25 advert slapd[5679]: Feb 28 17:57:25 advert slapd[5679]: bdb_idl_fetch_key: [b49d1940] Feb 28 17:57:25 advert slapd[5679]: send_ldap_result: err=0 matched="" text="" Feb 28 17:57:25 advert slapd[5679]: connection_get(10) This is not a freeradius issue but can someone advise what could be the problem? Regards, Ryan

1 0

Re: Consuming card code
by Juraj Bilic 28 Feb '08

28 Feb '08

> >> Can i implement user login, consuming of card codes, etc. with only packets (acct) >> or im missing some crucial points? > > No idea. What "card codes" are you talking about? > The problem: There is a host that controls internet access for 25 different machines. For having internet access machine user must type prepaid code. (there are 1000 generated prepaid valid codes) With one prepaid code user can use the internet for 1h. If user used only 20min of his current prepaid code he can use it again. on another machine (this code now gives 40min of internet access) My naive solution: Use freeradius on host and special .net app on every user machine to control everything. >> I hope that i (user, client) can make an behaviour of communicating with freeradius every 10sec >> and consuming 10sec of currently selected card code. > > You don't want to send accounting packets to the server every 10s. > It's a very bad idea. > > If you need 10s granularity on accounting, use a local database. ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

3 2

can't get radtest/radclient to work
by Dan Gahlinger 28 Feb '08

28 Feb '08

I'm having a really stupid problem. I created a "dummy" user for testing: useradd -m testing passwd testing (set password to "testing"). not secure, but who cares - it's just for testing. left share secret as default, tried to login locally with this: echo "User-Name = testing,password=testing" | /usr/bin/radclient localhost:1812 auth testing123 I enabled bad password logging, and get this error in the log: Wed Feb 27 15:13:18 2008 : Auth: rlm_unix: [testing]: invalid password Wed Feb 27 15:13:18 2008 : Auth: Login incorrect: [testing/testing] (from client localhost port 0) I also tried this way: radtest testing testing 127.0.0.1:1812 0 testing123 and this was the result: Sending Access-Request of id 92 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Re-sending Access-Request of id 92 to 127.0.0.1 port 1812 User-Name = "testing" User-Password = "testing" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 rad_recv: Access-Reject packet from host 127.0.0.1:1812, id=92, length=20 All the radius.conf defaults are left the same except the extra bad password logging. I have no idea why that's failing. I know it's something really stupid like the "system" login fall-through bypass not being high up enough in the config or something. Can anyone jog my memory again? thanks! Dan. _________________________________________________________________

5 8

Help With Cisco Configuration
by Joseph.Corrado＠nc4.us 27 Feb '08

27 Feb '08

I am trying to get a freeradius implementation rolled out for the first time and am running into a few issues that I cannot seem to resolve. I have a Cisco 2960 in a test lab with a Linux server running freeradius 2.0.0 for authentication. There are 2 problems I am running into. 1. I cannot seem to get the radius server to authenticate a user and place them at the privilege exec prompt, even thought I have configured the 'users' file to place all users at the privilege exec prompt when logging in by default (I did this just to test, ultimately I would like to create groups with different privilege levels). 2. I cannot seem to get the Cisco 2960 to accept the radius servers authentication response when logging in the device via a VTY session using SSH. When running the server in debug mode, you can see the request coming in and the server sending the authentication response back to the switch, but the authentication will still fail at the switch. The only authentication I get is at the console level. Any help would be greatly appreciated. Thank you. Joe Disclaimer: This message is intended only for the use of the individual or entity to which it is addressed and may contain information which is privileged, confidential, proprietary, or exempt from disclosure under applicable law. If you are not the intended recipient or the person responsible for delivering the message to the intended recipient, you are strictly prohibited from disclosing, distributing, copying, or in any way using this message. If you have received this communication in error, please notify the sender and destroy and delete any copies you may have received.

2 2

Re: header enrichment
by mauro 27 Feb '08

27 Feb '08

Normally in a mobile services there's no specification into the header about connection type. many sniffing were done but only specific equipment allows to enrich the header with this inofrmation, for example some particular charging proxy. We need to have this information cause from server side could be interesting to give to the user different services according to the user connections. now i asked, if freeradius can help us in this. regards Mauro ----- Messaggio originale ----- Da: Guy Davies <aguydavies(a)gmail.com> A: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Inviato: Mercoledì 27 febbraio 2008, 12:01:21 Oggetto: Re: header enrichment On 27/02/2008, Alan DeKok <aland(a)deployingradius.com> wrote: > mauro wrote: > > Hi all > > i would like to know if freeradius can help to enrich the user header > > for that mobile services that needs some particular params as for > > connection type ( 3g, gprs...). > > > What does that mean? > > I'm not a 3g expert. Maybe the 3g equipment you're using can use > RADIUS attributes. If so, see it's documentation for what RADIUS > attributes it uses. Alan is right. I would imagine that you'd need to use the 3GPP or 3GPP2 RADIUS dictionary to respond with attributes that could be used by the client to perform the header enrichment. As long as the information can be presented as a regular RADIUS attribute or VSA, then you can use FreeRADIUS to provide that information to the client (the device performing the header enrichment function). Rgds, Guy - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________ L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: http://it.docs.yahoo.com/nowyoucan.html

2 1

VMPS support
by Phil Mayers 27 Feb '08

27 Feb '08

All, I'm moving our legacy switches over to the VMPS support in FreeRadius 2 and I'm aware there are others on the list who have done this. I'm seeing several different formats of VMPS request. The "easy" ones are from older switches e.g. cisco 1900s: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 2207055872 VMPS-Client-IP-Address = 172.28.72.65 VMPS-Port-Name = "22" VMPS-VLAN-Name = "PROD" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:01:4a:f8:93:e5 However, newer switches e.g. Cisco 3500XL are sending Reconfirm-Request packets with no MAC (but with a cookie): VMPS-Packet-Type = VMPS-Reconfirm-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13320 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/1" VMPS-VLAN-Name = "PROD" VMPS-Unknown = 0x01 VMPS-Cookie = 00:1b:78:a5:96:e0 How do I need to respond to these? It seems that if I return a Join-Response it will simply be obeyed, but I'm worried it will explode later. Do I need to return a Reconfirm-Reponse with a Deny if the requested vlan is different to the desired on, or a permit otherwise? We're also seeing from the newer switches join packets with no MAC or cookie, but an ethernet header: VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 13329 VMPS-Client-IP-Address = 172.28.72.50 VMPS-Port-Name = "Fa0/3" VMPS-VLAN-Name = "--NONE--" VMPS-Unknown = 0x00 VMPS-Ethernet-Frame = 0xffffffffffff001636e46d1b08004500015... What's the easiest way to get the MAC address out of these?

2 4

RE: Radius MAC filtering with EAP-PEAP
by Ivan Kalik 27 Feb '08

27 Feb '08

1. Debug is a bit longer than that. You should post the whole thing. 2. This is not a mac authentication request. 3. That Calling-Station-Id is not going to get checked. Read instruction in users file where do check items go. Ivan Kalik Kalik Informatika ISP Dana 27/2/2008, "Era" <alexey.eronko(a)gmail.com> piše: >Hi! > >Could you please assist me to find my fault. I have test user with laptop. I >want to restrict access for this laptop. In users file I added wrong mac >address (00-18-de-4e-8f-11) but laptop still can connect with testuser/12345 >credentials. > >:( > >Here is my AP request : > >rad_recv: Access-Request packet from host 10.10.10.139:6001, id=65, >length=195 > User-Name = "testuser" > NAS-IP-Address = 89.10.10.139 > Called-Station-Id = "00-20-a6-64-66-a3:A" > Calling-Station-Id = "00-18-de-4e-8f-1d" > NAS-Identifier = "ORiNOCO-AP-700-64-66-a3" > State = 0x47e0330ad155ef064a62de62873e8690 > Framed-MTU = 1400 > NAS-Port = 2 > NAS-Port-Type = Wireless-802.11 > EAP-Message = 0x020900261900170301001b139845f4c8e9bcb46 > >Debug log: > >rlm_checkval: Item Name: Calling-Station-Id, Value: 00-18-de-4e-8f-1d >rlm_checkval: Could not find attribute named Calling-Station-Id in check >pairs > modcall[authorize]: module "checkval" returns notfound for request 8 > > > >Here is my users file: > >testuser User-Password == "12345" > Calling-Station-Id = "00-18-de-4e-8f-11" > >Here is my checkval config: > >checkval { > # The attribute to look for in the request > item-name = Calling-Station-Id > # The attribute to look for in check items. Can be multi >valued > check-name = Calling-Station-Id > # The data type. Can be > # string,integer,ipaddr,date,abinary,octets > data-type = string > # If set to yes and we dont find the item-name attribute in >the > # request then we send back a reject > # DEFAULT is no > notfound-reject = yes > } > >Era > >-----Original Message----- >From: freeradius-users-bounces+alexey.eronko=gmail.com(a)lists.freeradius.org >[mailto:freeradius-users-bounces+alexey.eronko=gmail.com@lists.freeradius.or >g] On Behalf Of Ivan Kalik >Sent: Wednesday, February 27, 2008 12:33 PM >To: FreeRadius users mailing list >Subject: Re: Radius MAC filtering with EAP-PEAP > >>Could you please suggest me how can I check MAC filter(via Radius) and >after >>that do EAP-PEAP authorization? >> > >Read your NAS documentation. > >Ivan Kalik >Kalik Informatika ISP > >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > >

1 0

Re: Radius MAC filtering with EAP-PEAP
by Liran Tal 27 Feb '08

27 Feb '08

On Wed, Feb 27, 2008 at 1:19 PM, Era <alexey.eronko(a)gmail.com> wrote: > Era wrote: > > > Could you please assist me to find my fault. I have test user with > laptop. > I > > want to restrict access for this laptop. In users file I added wrong mac > > address (00-18-de-4e-8f-11) but laptop still can connect with > testuser/12345 > > credentials. > > Did you read the documentation for the "users" file? > > [Era]: Yes I did. But no result. > > > Here is my users file: > > > > testuser User-Password == "12345" > > Calling-Station-Id = "00-18-de-4e-8f-11" > > What do you think this entry does? > > [Era:] I thought that this entry maps user with mac hardware address. > > No that lines means that the user tester/12345 will be granted access and freeradius will send a Calling-Station-Id attribute reply to the NAS in return, which is not what you wanted... I hope this makes more sense. Regards, Liran Tal.

1 0