- Freeradius-Users - lists.freeradius.org

RE: FreeRadius deployment
by pablo.cuesta＠bt.com 07 Feb '08

07 Feb '08

Me again. I feel pretty stupid now as the listen section was documented on the radiusd.conf file but i read over it.Anyway,I had checked the 1.1.7 i got installed and it has the "listen" section which seems to allow to use the same FreeRADIUS server to listen at different IPs and ports. However, would the radius listen to auth and acct packets or only to auth packets? I mean, *******************start config********************** listen { ipaddr = IP1.IP1.IP1.IP1 port = PORT1 type = auth } listen { ipaddr = IP1.IP1.IP1.IP1 port = PORT1+1 type = acct } listen { ipaddr = IP2.IP2.IP2.IP2 port = PORT2 type = auth } listen { ipaddr = IP2.IP2.IP2.IP2 port = PORT2+1 type = acct } *********************end config*********** Will work, listening to auth and acct packets? Anyway I will upgrade to version 2 but 1.1.7 is installed in our test machine right now. Thank you in advanced, Pablo Cuesta -----Mensaje original----- De: Cuesta Fernandez,P,Pablo,JPW32 R Enviado el: jueves, 07 de febrero de 2008 20:44 Para: 'ac221(a)sussex.ac.uk'; 'FreeRadius users mailing list' Asunto: RE: FreeRadius deployment > Has anyone try this? Use FreeRadius 2 , yo can instantiate two virtual servers and bind them to different ip addresses. Downloading it right now. Thanks. Pablo Cuesta

1 0

FreeRADIUS and RSA RADIUS Server
by Jakub Morávek 07 Feb '08

07 Feb '08

Hello, I have not many experiences with radius, so my question may be stupid. Has anybody experience with using freeradius (Version 1.1.3 in Debian Sarge) as proxy for RSA RADIUS Server included in RSA Authentication Manager 6.1? I need to solve following problem with the "Agent host" i.e. host which send authenticate request to RSA Auth Manager. When authentication request goest through freeradius proxy, RSA Manager thinks that Agent host is my freeradius proxy instead of original host which sent authenticate request. Below is pasted part of pre-proxy detail log and debug log. part of output from: freeradius -X: Sending Access-Request of id 0 to 10.100.25.2 port 1812 User-Name = "jakub" User-Password = "1234628665" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "ssh" NAS-Port = 21704 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.5.0.39" Proxy-State = 0x313039 output of /var/log/freeradius/radacct/10.5.0.31/pre-proxy-detail-20080204: Packet-Type = Access-Request Mon Feb 4 23:55:50 2008 User-Name = "jakub" User-Password = "1234628665" NAS-IP-Address = 127.0.1.1 NAS-Identifier = "ssh" NAS-Port = 21704 NAS-Port-Type = Virtual Service-Type = Authenticate-Only Calling-Station-Id = "10.5.0.39" Client-IP-Address = 10.5.0.31 Stripped-User-Name = "jakub" Realm = "NULL" Realm = "NULL" Proxy-State = 0x313039 Does this mean, that freeradius process all attributes from pre-proxy-detail-20080204 log, but sends only attributes, which are shown in extended debug mode? If so, can anybody give me any advice how can I configure freeradius to send more attributes? Jakub

5 9

attr rewrite issue
by Keith Dovale - HostworX.co.za 07 Feb '08

07 Feb '08

Hi Guys, some help please . I am trying to do a attr rewrite to change an Attribute value then do a check based on the attribute that is changed, if the check fails do another attrib rewrite to the next value and do another check, until either the check fails or passes. There is basically only 4 checks in the group statement in the authorise section which do Attrib rewrite Do check (If it fails do) Attrib rewrite Do check (If it fails do) Attrib check Do rewrite (If it fails do) Attrib check Do rewrite Reject Pass When it runs it checks the reply packet for an attribute Configuration-Token which is defined in the radgroupreply for the users but it seems it cannot find it and gives an error. As below rlm_sqlcounter: (Check item - counter) is less than zero rlm_sqlcounter: Rejected user keith, check_item=0, counter=0 modcall[authorize]: module "MonthlyUnShaped" returns reject for request 2 radius_xlat: 'UNSHAPED_NORMAL' rlm_attr_rewrite: No match found for attribute Configuration-Token with value 'SHAPED_NORMAL' radius_xlat: 'UNSHAPED_NORMAL' radius_xlat: 'SHAPED_NORMAL' rlm_attr_rewrite: Changed value for attribute Configuration-Token from 'UNSHAPED_NORMAL' to 'SHAPED_NORMAL' rlm_attr_rewrite: Could not find value pair for attribute Configuration-Token modcall[authorize]: module "AttrRewrite_MonthlyBlendedShaped" returns ok for request 2 can anyone help

1 0

PEAP mschapv2 Proxy not working.
by Andrew Olson 07 Feb '08

07 Feb '08

Hello, I'm having trouble getting freeradius-1.1.7 to proxy PEAP-mshcapv2 to another RADIUS server. My other server doesn't do EAP, so I'm just sending mschapv2 achieved with proxy_tunneled_request_as_eap = no in eap.conf. When I proxy to my other server, I get back an Access-Accept packet. Then, freeradius sends an Access Challenge to the client, receives a response and then things appear to break. I am able to successfully authenticate users with PEAP by defining them locally in the users file. Additionally, I have gotten TTLS to work by proxying to another server, it's just PEAP that I'm having problems with. The differing line in the debug seems to be: <proxied> eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 -vs- <non-proxied> eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. I'm running a pretty standard config, I think. I can send copies of it, if that would help. Thanks, Andrew Olson The complete proxied debug starting with the Access-Request is as follows: Sending Access-Request of id 0 to 198.82.247.36 port 1812 User-Name = "anolson" NAS-IP-Address := 198.82.245.57 MS-CHAP-Challenge = 0x85feba9cbed9e9191bf72a29f0f82312 MS-CHAP2-Response = 0x0700b776d1433b4d6dab43d5bde9163e8b450000000000000000ee7fcb070f3766e7e7b0f198b72754b44a9ef0255d712db1 Proxy-State = 0x3136 Service-Type := Framed-User Waking up in 6 seconds... rad_recv: Access-Accept packet from host 198.82.247.36:1812, id=0, length=189 Filter-Id = "CNS_NET1" MS-CHAP2-Success = 0x07533d43433041424443323542333046453444414131394238363737413941334136454631364134454634 MS-MPPE-Send-Key = 0x7b5fcacde0c3798261894df701a5cdd5 MS-MPPE-Recv-Key = 0x3900c03d5b5851da66e8fb27d90077f9 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x0000000e Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 PEAP: Passing reply from proxy back into the tunnel. PEAP: Passing reply back for EAP-MS-CHAP-V2 0x8170500 2 Processing the post-proxy section of radiusd.conf modcall: entering group post-proxy for request 6 rlm_eap_mschapv2: Passing reply from proxy back into the tunnel 0x8170500 2. rlm_eap_mschapv2: Authentication succeeded. MSCHAP Success modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 POST-PROXY 2 POST-AUTH 2 PEAP: Got reply 11 PEAP: Got tunneled Access-Challenge PEAP: Reply was handled modcall[post-proxy]: module "eap" returns ok for request 6 modcall: leaving group post-proxy (returns ok) for request 6 Sending Access-Challenge of id 16 to 128.173.10.131 port 56945 EAP-Message = 0x0107005b190017030100502c303c60e1337bcb4c17a281f71910d23777fd5f4a4d5aefab92a23ff28a993aa17ebc2d6bd7567b9386fec7c4e6f2f7ae4c4655a8492000e0e473fc7e8be63a1bf372449cba9f795dc6535b04648cdb Message-Authenticator = 0x00000000000000000000000000000000 State = 0x23a96486ec5dbd008e1eddcee31dfa93 Finished request 6 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56945, id=17, length=151 User-Name = "anolson" State = 0x23a96486ec5dbd008e1eddcee31dfa93 EAP-Message = 0x0207005419800000004e170301002050f4490743b89308d9bb84f411a1629e7b6f06dd6c02c2525747560f657f63d117030100209d0c853d82e17d05938ab49201447c135a90d068d1641a23db5fc04cfcc0dd08 Message-Authenticator = 0x3c828120c544cde1b5d4366b7e735350 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 84 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 modcall[authorize]: module "files" returns notfound for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: EAP type mschapv2 rlm_eap_peap: Tunneled data is valid. PEAP: Setting User-Name to anolson PEAP: Adding old state with dc 84 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "anolson", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 7 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry DEFAULT at line 57 modcall[authorize]: module "files" returns ok for request 7 modcall: leaving group authorize (returns updated) for request 7 PEAP: Calling authenticate in order to initiate tunneled EAP session. Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 PEAP: Can't handle the return code 4 rlm_eap: Handler failed in EAP/peap rlm_eap: Failed in EAP select modcall[authenticate]: module "eap" returns invalid for request 7 modcall: leaving group authenticate (returns invalid) for request 7 auth: Failed to validate the user. Delaying request 7 for 1 seconds Finished request 7 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 10 with timestamp 47a8d136 Cleaning up request 1 ID 11 with timestamp 47a8d136 Cleaning up request 2 ID 12 with timestamp 47a8d136 Cleaning up request 3 ID 13 with timestamp 47a8d136 Cleaning up request 4 ID 14 with timestamp 47a8d136 Cleaning up request 5 ID 15 with timestamp 47a8d136 Cleaning up request 6 ID 16 with timestamp 47a8d136 Sending Access-Reject of id 17 to 128.173.10.131 port 56945 EAP-Message = 0x04070004 Message-Authenticator = 0x00000000000000000000000000000000 Cleaning up request 7 ID 17 with timestamp 47a8d136 Nothing to do. Sleeping until we see a request. The complete non-proxied debug starting with the final Access-Challenge is as follows: Sending Access-Challenge of id 18 to 128.173.10.131 port 56939 EAP-Message = 0x0108002b190017030100206ae9bd54b7c0124979401818f662bec45aea2853b277e8dda897e8a645571887 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 Finished request 40 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 128.173.10.131:56939, id=19, length=166 User-Name = "andrew" State = 0x00e512dd6dbcc968bffd9f8b8dc13bc4 EAP-Message = 0x0208006419800000005e1703010020a0257f0df72e93adb495d9ab98f8e65ee4b526e563dd80bcdd464a3735f1d83417030100304c5de1fa016827d3181b8a26a7a31091f8f4474167c5424e0b51913e0ede50c14e04ec233670bd9888b1ea89ed510131 Message-Authenticator = 0xf3079323771a635bac1bdaa00b2e850f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 41 modcall[authorize]: module "preprocess" returns ok for request 41 modcall[authorize]: module "chap" returns noop for request 41 modcall[authorize]: module "mschap" returns noop for request 41 rlm_realm: No '@' in User-Name = "andrew", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 41 rlm_eap: EAP packet type response id 8 length 100 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 41 users: Matched entry andrew at line 53 modcall[authorize]: module "files" returns ok for request 41 modcall: leaving group authorize (returns updated) for request 41 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 41 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 eaptls_process returned 7 rlm_eap_peap: EAPTLS_OK rlm_eap_peap: Session established. Decoding tunneled attributes. rlm_eap_peap: Received EAP-TLV response. rlm_eap_peap: Tunneled data is valid. rlm_eap_peap: Success rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 41 modcall: leaving group authenticate (returns ok) for request 41 Sending Access-Accept of id 19 to 128.173.10.131 port 56939 MS-MPPE-Recv-Key = 0x1aa22f77848e2c89b4a6681bd67b45483d25b05232dd9e37748bba578fff2700 MS-MPPE-Send-Key = 0x62d67197e6bfbce385f1b6e2ccd03c183281bca70e810a79cd85e7d2a38d654d EAP-Message = 0x03080004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "andrew" Finished request 41 Going to the next request Waking up in 6 seconds...

3 5

EAP/TTLS on LDAP with freeradius 2.0.1
by Thierry CHICH 07 Feb '08

07 Feb '08

Hello, I know that my problem is so simple that I should be ashamed to ask help, but I have to say that I can't find a good way to do what I want to do. With the previous release of freeradius 1.1.7, I could do the following things: - people with a correct outer identity and inner identity (login/password) could be authorized and authenticate on a LDAP server, using an EAP-TTLS tunnel, obtained a WPA key. - with the same radius server, I could authenticate people with EAP-PEAP and mschapv2 on a sql database. It was nice, but I had a small problem: accounting was done using the outer identity. Since I was using the ldap to do the authorization, people who put an other valid identity didn't be correctly accounted. Then, I decided to use freeradius 2.0.1. And then I don't see how to obtain a basic configuration that is doing my first point. I always finished by : rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user If I put an Auth-Type := LDAP, it seems better in the first time, but it is worst: rad_check_password: Found Auth-Type LDAP auth: type "LDAP" +- entering group LDAP rlm_ldap: - authenticate rlm_ldap: Attribute "User-Password" is required for authentication. You seem to have set "Auth-Type := LDAP" somewhere. THAT CONFIGURATION IS WRONG. DELETE IT. YOU ARE PREVENTING THE SERVER FROM WORKING PROPERLY. ++[ldap] returns invalid auth: Failed to validate the user. At this point, I don't understand what freeradius want. I don't know how to say : authorize on waht you want, I don't care, and authenticate on my LDAP server. Is it a good configuration sample I can find anywhere ? Regards, -- Thierry CHICH

3 7

password failover
by jonr＠destar.net 07 Feb '08

07 Feb '08

Hello, How do I set up a freeradius server so that if the password fails for the primary radius server it tries the secondary for the password. In my scenario, the primary is up and servicing requests, but the password for the device is incorrect. Now the device looks to the secondary to get authorized and the secondary holds the correct secret for the device. I have looked at fail-over and load-balancing but am not sure if either of these are what I am looking for. Can someone tell me what I am looking for and I can do the rest. Thanks for any help, Jon

4 9

freeradius doesn't start at boot-time : mysql error
by mailinglists 07 Feb '08

07 Feb '08

Hello, I use freeradius-1.1.3-1.2.el5 and freeradius-mysql-1.1.3-1.2.el5. the mysql database (mysql-server-5.0.22-2.1.0.1) is hosted on a remote host (both centos5). When I use /etc/init.d/radiusd as root it starts up correctly. But when the service is launched at boot time, I get this error-log : Wed Feb 6 16:17:46 2008 : Info: Using deprecated naslist file. Support for this will go away soon. Wed Feb 6 16:17:46 2008 : Info: rlm_exec: Wait=yes but no output defined. Did you mean output=none? Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked Wed Feb 6 16:17:46 2008 : Info: rlm_sql (sql): Attempting to connect to radius@192.168.1.1:/radius Wed Feb 6 16:17:46 2008 : Info: rlm_sql_mysql: Starting connect to MySQL server for #0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Couldn't connect socket to MySQL server radius@192.168.1.1:radius Wed Feb 6 16:17:49 2008 : Error: rlm_sql_mysql: Mysql error 'Can't connect to MySQL server on '192.168.1.1' (113)' Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): Failed to connect DB handle #0 Wed Feb 6 16:17:49 2008 : Info: rlm_sql (sql): There are no DB handles to use! skipped 5, tried to connect 0 Wed Feb 6 16:17:49 2008 : Error: rlm_sql (sql): generate_sql_clients() returned error Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[14]: sql: Module instantiation failed. Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1844] Unknown module "sql". Wed Feb 6 16:17:49 2008 : Error: radiusd.conf[1773] Failed to parse authorize section. I look at tcpdump on the mysql-server host, and during the boot of my freeradius server, I see no traffic comming from freeradius host. There is no reject in the firewall. I've tried to put the radius rc.d script in S99 to start it as late as possible, but nothing changes. I also noticed that it doesen't seem to retry to connect to the database later. Or is it after a long time ? Is this a bug ? Where is the retry time configured (I cant try to set up to 5 seconds) ? Thanks for answers Laetitia.

1 0

weird error
by Joe Vieira 07 Feb '08

07 Feb '08

Wed Feb 6 10:43:44 2008 : Error: TLS Alert write:fatal:bad record mac Wed Feb 6 10:43:44 2008 : Error: rlm_eap: SSL error error:1408F119:SSL routines:SSL3_GET_RECORD:decryption failed or bad record mac Wed Feb 6 10:43:44 2008 : Error: rlm_eap_tls: SSL_read failed in a system call (-1), TLS session fails. could someone help me figure out what that means exactly? thanks, -- Joe Vieira UNIX Systems Administrator Clark University - ITS

3 4

Proxying VMPS requests
by Phil Mayers 06 Feb '08

06 Feb '08

I'm looking at using FreeRadius 2.0.1 to merge out old VMPS switches into the radius-based (SQL-backed) MAC auth. For various reasons, the easiest thing for me would be to proxy the VMPS requests as PAP to our existing mac auth servers. The comments in raddb/sites-available/vmps imply that the packets can be proxied, but I'm not seeing that: # VMPS server server vmps { listen { # FIXME: should be .202 for production ipaddr = 192.168.x.y port = 1589 type = vmps } # And the REAL contents. This section is just like the # "post-auth" section of radiusd.conf. In fact, it calls the # "post-auth" component of the modules that are listed here. # But it's called "vmps" to highlight that it's for VMPS. vmps { # we cheat, and proxy to the MACAUTH radius servers update control { Proxy-To-Realm := "MACAUTH" } } post-proxy { # FIXME: log to sql_log actually detail } } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on vmps address 155.198.63.122 port 1589 as server vmps Ready to process requests. VMPS-Packet-Type = VMPS-Join-Request VMPS-Error-Code = VMPS-No-Error VMPS-Sequence-Number = 234881024 VMPS-Client-IP-Address = 155.198.51.130 VMPS-Port-Name = "4 " VMPS-VLAN-Name = "--NONE--" VMPS-Domain-Name = "HOR-PG" VMPS-Unknown = 0x00 VMPS-MAC = 00:1b:24:a1:cf:2e server vmps { Doing VMPS Done VMPS } # server vmps Failed encoding packet: Failed to find VQP-Packet-Type in response packet Finished request 0. Going to the next request Waking up in 0.9 seconds. Waking up in 3.9 seconds. Cleaning up request 0 ID 234881024 with timestamp +1 Ready to process requests. Looking at the source code, it seems the vmps code only runs the post-auth section and doesn't check any control variables, so Proxy-To-Realm is unlikely to work. If this is intentional, could we remove the comments about proxying and pre/post proxy from sites-available/vmps? Is there any reason the code doesn't run: authorize then either post-auth or pre-proxy post-proxy post-auth ?

3 3

need help in using mySql for freeRadius server.
by johnson elangbam 06 Feb '08

06 Feb '08

hi, I am a new user in free radius with mysql, i've configure all the necessary .config files (viz., sql.conf and radiusd.conf) of the free radius for connecting to the mysql, but i wouldn't be able to connect to mysql database. Please tell me how to check that my free radius server is already connected to mysql and when i used the Unix username and password it receives access-accept packets. I've tried http://wiki.freeradius.org/SQL_HOWTO also but the instructions given there is slightly different from the one I am using. I am using free radius 2.0.0. Please help me in configuring this to connect to mysql. with regards Elangbam Johnson

3 3