- Freeradius-Users - lists.freeradius.org

Re: PEAP/EAP-TTLS acquires DEFAULT reply attributes via outer identity
by Gong Cheng 20 Feb '08

20 Feb '08

I found myself not knowing how to reply directly from the post, but here is a thank you to Ivan and Phil, that works for me! thanks. -gong ----- Original Message ---- From: Gong Cheng <chengg11(a)yahoo.com> To: freeradius-users(a)lists.freeradius.org Sent: Tuesday, February 19, 2008 3:14:13 PM Subject: PEAP/EAP-TTLS acquires DEFAULT reply attributes via outer identity Hi folks, I am working on an issue like this: In my users file, I have user1 attribute1=val1 user2 attribute2=val2 DEFAULT attribute1=def_val1 attribute2=def_val2 My intention is that - for individual users, like user1 and user2, I will get individual attributes I specified in their dedicated entries, - and for everybody else, I will get a default set of attributes. That has a problem with the 2-phase EAP methods like PEAP/EAP-TTLS. The reason is, in the first phase, the outer Identity, say "anonymous", is used and it hits the DEFAULT entry and acquires the default set of attributes, and then it proceeds to phase 2 and acquires the individual attributes. In the end, freeradius will combine the two together. So, for example, user1 will get attribute1=def_val1 attribute2=def_val2 attribute1=val1 Is there any way so that for the individual users won't acquire any attributes from DEFAULT when using methods like PEAP/EAP-TTLS? A naive solution is to put a check of DEFAULT User-Name != "anonymous" .... but it is not a reliable way since there is no guarantee that the outer id is "anonymous". I wonder if there is another way to check this in DEFAULT or if there is any other different trick to do this? thanks! -gong

1 0

PEAP/EAP-TTLS acquires DEFAULT reply attributes via outer identity
by Gong Cheng 19 Feb '08

19 Feb '08

Hi folks, I am working on an issue like this: In my users file, I have user1 attribute1=val1 user2 attribute2=val2 DEFAULT attribute1=def_val1 attribute2=def_val2 My intention is that - for individual users, like user1 and user2, I will get individual attributes I specified in their dedicated entries, - and for everybody else, I will get a default set of attributes. That has a problem with the 2-phase EAP methods like PEAP/EAP-TTLS. The reason is, in the first phase, the outer Identity, say "anonymous", is used and it hits the DEFAULT entry and acquires the default set of attributes, and then it proceeds to phase 2 and acquires the individual attributes. In the end, freeradius will combine the two together. So, for example, user1 will get attribute1=def_val1 attribute2=def_val2 attribute1=val1 Is there any way so that for the individual users won't acquire any attributes from DEFAULT when using methods like PEAP/EAP-TTLS? A naive solution is to put a check of DEFAULT User-Name != "anonymous" .... but it is not a reliable way since there is no guarantee that the outer id is "anonymous". I wonder if there is another way to check this in DEFAULT or if there is any other different trick to do this? thanks! -gong

3 2

how can I configure CHAP or PAP
by Sarp Kaya 19 Feb '08

19 Feb '08

Hello, how can I do it I don't know. I am using Antcor OS router and it has hotspot settings. I also have a pc which has ubuntu. and I installed Freeradius 1.1.6-2 but my router cannot connect to freeradius. How can I solve this?

2 3

radius and cisco
by Jim McIver 19 Feb '08

19 Feb '08

I'm a newbie and looking for instructions on how to setup FreeRADIUS Version 1.1.7 on a SLES 10 linux box to use for authenication and logging for a cisco 2801 router. I want to track users connecting from the outside world using Cisco's vpn client and cisco sayes radius is the answer. I'd like to start with just allowing users from the linux /etc/passwd access and then move onto authenication from my Netware 6.5 LDAP server. I've read all I can find on freeradius.org and cisco, but still don't understand....hard learner I guess. radiusd -xx gives: Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /etc/raddb/proxy.conf Config: including file: /etc/raddb/clients.conf Config: including file: /etc/raddb/snmp.conf Config: including file: /etc/raddb/eap.conf Config: including file: /etc/raddb/sql.conf main: prefix = "/usr" main: localstatedir = "/var" main: logdir = "/var/log/radius" main: libdir = "/usr/lib/freeradius" main: radacctdir = "/var/log/radius/radacct" main: hostname_lookups = no main: snmp = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = yes main: log_file = "/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/var/run/radiusd/radiusd.pid" main: user = "radiusd" main: group = "radiusd" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/lib/freeradius Initializing the thread pool... thread: start_servers = 5 thread: max_servers = 32 thread: min_spare_servers = 3 thread: max_spare_servers = 10 thread: max_requests_per_server = 0 thread: cleanup_delay = 5 Thread spawned new child 1. Total threads in pool: 1 Thread spawned new child 2. Total threads in pool: 2 Thread spawned new child 3. Total threads in pool: 3 Thread spawned new child 4. Total threads in pool: 4 Thread 1 waiting to be assigned a request Thread 2 waiting to be assigned a request Thread 3 waiting to be assigned a request Thread 4 waiting to be assigned a request Thread 5 waiting to be assigned a request Thread spawned new child 5. Total threads in pool: 5 Thread pool initialized Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. My radius.conf is what was installed as default. Q1? Do I need to add anything other than the below to client.conf? In my client.conf I've added: # Test on cisco 2801 router(internal ip of router) client 192.168.135.3 { secret =xxxxxxx shortname =myrouter nastype =cisco } I believe the relavent part of the users file is: DEFAULT Auth-Type = System Fall-Through = 1 and DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes Notes I've read say to change this to 255.255.255.255 ?? Q2? I believe I also need to add something similar to the below in the users file? youruser Cleartext-Password := "somepass" Service-Type = NAS-Prompt-User, cisco-avpair = "shell:priv-lvl=15" Q3? Does "youruser" and "somepass" need to be a valid user from /etc/passwd? I'm unclear if there is a link between users in this file and valid users in /etc/passwd of the linux box. My cisco 2801 currently has info like: aaa new-model ! ! aaa authentication login default local aaa authorization exec default local if-authenticated aaa authorization network default local ! aaa session-id common ! ! crypto isakmp policy 1 encr 3des authentication pre-share group 2 ! crypto isakmp client configuration group VPNCLIENTS key xxxxxxx dns 192.168.135.15 domain xxxxxxx.com pool CLIENTPOOL acl 150 netmask 255.255.255.0 crypto isakmp profile IKE1 match identity group VPNCLIENTS client authentication list default isakmp authorization list default client configuration address respond ! Q4? Do I need to remove any of this info, or just replace the stuff at the top with something like: aaa new-model aaa authentication login default group radius local aaa authentication login localauth local aaa authentication ppp default if-needed group radius local aaa authorization exec default group radius local aaa authorization network default group radius local aaa accounting delay-start aaa accounting exec default start-stop group radius aaa accounting network default start-stop group radius aaa processes 6 aaa accounting delay-start Q5? Do I also need a line similar to below on the cisco? radius-server host 192.168.135.3 radius-server key xxxx radius-server auth-port 1812 I guessing that my radius.log will then show when users login. thx in advance, -Jim McIver

3 2

SSL error
by Eduardo Lima 19 Feb '08

19 Feb '08

I'm trying to build a radius server with PEAP-mschap but it's not working because an ssl error: short Log below: modcall[authorize]: module "eap" returns updated for request 1 users: Matched entry teste at line 59 modcall[authorize]: module "files" returns ok for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0613], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept:error in SSLv3 read client certificate A rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0) In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 1 to 10.0.0.245 port 1056 Idle-Timeout = 10 Any ideas???? --------------------------------- Abra sua conta no Yahoo! Mail, o único sem limite de espaço para armazenamento!

3 2

FreeRadius question
by Harley Race 19 Feb '08

19 Feb '08

>> I am trying to find out how I can check what options >> the freeradius binary available for download was >> compiled with. I have STFW and RTFM, but still am >> not sure as to how to check. radiusd -X gives some >> information, but >> nothing about what freeradius was compiled with. I >> am interested in finding out if the binary was >> compiled with e-Directory support. Thanks for any >> help. > >WHICH binary available for download? > >alan Hello Alan, Thanks for the quick response. The binaries I was talking about are on the download page: http://www.freeradius.org/download.html I was interested in the Fedora one. ____________________________________________________________________________________ Looking for last minute shopping deals? Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping

1 0

How to get iphop attributes coming into cisco av-pairs?
by Khalukhin Alexander 19 Feb '08

19 Feb '08

Greetings! I'm using freeradius 1.1.6 on gentoo (2.6.15-gentoo-r5) to account sip calls via radius client on cisco 26xx and have a problem: I need to get iphop attributes from radius accounting packets, but I can't :( While running freeradius in debug mode (-X key), I see required attributes as shown below: Acct-Session-Id = "4D00000000005CBF" Calling-Station-Id = "1004603" Called-Station-Id = "1111#7495100" Cisco-AVPair = "call-id=ZDgxMWUwZDFlODQ5Yzc1MmViZTZmM2UyMmY1ZjdiNzc." -> Cisco-AVPair = "iphop=count:3" -> Cisco-AVPair = "iphop=hop1:213.248.63.122" -> Cisco-AVPair = "iphop=hop2:213.248.63.122" -> Cisco-AVPair = "iphop=hop3:213.248.12.121" h323-setup-time = "h323-setup-time=12:15:03.844 MSK Tue Feb 19 2008" h323-gw-id = "h323-gw-id=voice5.di-net.ru" h323-conf-id = "h323-conf-id=FD2F9C59 DE0111DC A013E229 E5B23AB5" h323-call-origin = "h323-call-origin=answer" h323-call-type = "h323-call-type=VoIP" Cisco-AVPair = "h323-incoming-conf-id=FD2F9C59 DE0111DC A013E229 E5B23AB5" Cisco-AVPair = "subscriber=Unknown" Cisco-AVPair = "session-protocol=sipv2" Cisco-AVPair = "gw-rxd-cdn=ton:0,npi:0,#:1111#7495100" Cisco-AVPair = "feature-vsa=fn:TWC,ft:02/19/2008 12:15:03.844,cgn:1004603,cdn:1111#7495100,frs:0,fid:3195,fcid:FD2F9C59DE0111DCA013E229E5B23AB5,legID:D05" User-Name = "1004603" Cisco-AVPair = "connect-progress=Call Up" Acct-Status-Type = Start Service-Type = Login-User NAS-IP-Address = 213.219.200.35 Acct-Delay-Time = 0 I'm using oracle freeradius driver of sql module to log all the packets into database. I can use all other atrributes in my sql queries (with using cisco_avpair_hack of course). All other, but not thouse ones - they're always comes empty. Here is one of the queries in oraclesql.conf: accounting_start_query = "INSERT INTO ACC (\"ACCT-STATUS-TYPE\", \"NAS-IP-ADDRESS\", \"H323-CALL-ORIGIN\", \"CALLED-STATION-ID\", \"CALLING-STATION-ID\", \"ACCT-SESSION-ID\", \"CALL-ID\", \"SIP-TO-TAG\", \"SIP-FROM-TAG\", \"SIP-TRANSLATED-REQUEST-URI\", \"USER-NAME\", \"SIP-SOURCE-IP-ADDRESS\", \"SIP-SOURCE-PORT\", \"ACCT-SESSION-TIME\", \"H323-CONNECT-TIME\", \"H323-SETUP-TIME\", \"H323-DISCONNECT-TIME\", \"H323-DISCONNECT-CAUSE\", \"PREV-HOP-VIA\", \"PREV-HOP-IP\", \"NEXT-HOP-IP\", \"NEXT-HOP-DN\") VALUES ('%{ACCT-STATUS-TYPE}', '%{NAS-IP-ADDRESS}', '%{H323-CALL-ORIGIN}', '%{CALLED-STATION-ID}', '%{CALLING-STATION-ID}', '%{ACCT-SESSION-ID}', '%{CALL-ID}', '%{SIP-TO-TAG}', '%{SIP-FROM-TAG}', '%{SIP-TRANSLATED-REQUEST-URI}', '%{USER-NAME}', '%{SIP-SOURCE-IP-ADDRESS}', '%{SIP-SOURCE-PORT}', '%{ACCT-SESSION-TIME}', '%{H323-CONNECT-TIME}', '%{H323-SETUP-TIME}', '%{H323-DISCONNECT-TIME}', '%{H323-DISCONNECT-CAUSE}', '%{PREV-HOP-VIA}', '%{PREV-HOP-IP}', '%{NEXT-HOP-IP}', '%{IPHOP}')"

1 0

one username and 2 NAS
by Enrico Fanti 19 Feb '08

19 Feb '08

Hi , I have freeradius configured with Mysql. I would like to have a user "pippo" can ssh login to 2 server linux wich uses pam_radius in /etc/pam.d/sshd (i.e. 2 NAS , same username). Freeradius must make the control if NAS-IP Address is ok for this user in the radcheck table.. I use the "==" operator end my radcheck table is: mysql> SELECT id, UserName, Attribute, Value, op from radcheck WHERE Username = 'pippo' order by id; +----+----------+----------------+---------------+----+ | id | UserName | Attribute | Value | op | +----+----------+----------------+---------------+----+ | 39 | pippo | NAS-IP-Address | 10.0.0.52 <http://10.0.0.52> | == | | 40 | pippo | NAS-IP-Address | 10.0.0.49 <http://10.0.0.49> | == | | 41 | pippo | Expiration | 1203325200 | == | | 42 | pippo | Crypt-Password | v7fawImvQUoXM | == | +----+----------+----------------+---------------+----+ It doesn't work...... Some ideas ??? Thank you Enrico

2 5

proxed EAP and eduroam project
by inverse 19 Feb '08

19 Feb '08

hi all, rather than a problem, this is a question. I assume you know what eduroam is, but just in case: What is eduroam eduroam which stands for Education Roaming, is a RADIUS-based infrastructure that uses 802.1X security technology to allow for inter-institutional roaming. Substitute institutional with 'university' and you get the picture. So basically this is a hierarchy of radius servers at european level. Implementing it from my side (that of a university) has been rather trivial. What happens is that the EAP conversation traverls in cleartext across the public internet (really the inter-university networks). I would assume that EAP-TLS is highly safe from this point of view, am I right? Bye Inverse -- "In a sea of glass shards, I hear you screaming" --icchan

4 5

EAP/PEAP inner identity and rlm_exec
by Kolbjørn Barmen 19 Feb '08

19 Feb '08

I'm trying to use a selfmade script to decide VLAN-attributes for EAP/PEAP users: DEFAULT Realm == realm.org Tunnel-Type = VLAN, Tunnel-Medium-Type = IEEE-802, Tunnel-Private-Group-Id = `%{exec:/usr/sbin/ldap2vlan %{User-Name}` However, it only works for the so called "outter" identity. Any tip on how to make it work for the "inner" identity instead? -- Kolbjørn Barmen UNINETT Driftsenter

2 1