- Freeradius-Users - lists.freeradius.org

Cisco 1200 AP
by John Melton 05 Feb '08

05 Feb '08

I have configured a Cisco 1200 AP for WPA2-PSK which is working with a wireless device able to connect OK. I have tried to add MAC authentication using the FreeRadius server, but have not been able to get it working. I can see from the FreeRadius log that the AP is sending the Access-Request packet and an Access-Accept response is being returned but the wireless device is unable to connect. Has anyone setup this configuration and got it working? Regards, John

3 4

Attributes sent to proxy servers ...
by Arran Cudbard-Bell 05 Feb '08

05 Feb '08

Hi, Noticed with CVS head that all attributes (including internal ones) appear to be getting proxied. Is this just a cosmetic thing ? Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221(a)loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x313035 Proxying request 60 to home server 194.82.174.185 port 1812 Sending Access-Request of id 11 to 194.82.174.185 port 1812 Framed-MTU = 1480 NAS-IP-Address = 139.184.8.16 NAS-Identifier = "hp-e-its-dev8021x-sw1" User-Name = "ac221(a)loopback.sussex.ac.uk" Event-Type = Framed-User Framed-Protocol = PPP NAS-Port = 1 NAS-Port-Type = Ethernet NAS-Port-Id = "1" Called-Station-Id = "001438fb9400" Calling-Station-Id = "001b63a3a8dd" Connect-Info = "CONNECT Ethernet 100Mbps Full duplex" Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "700" State = 0x00000000064419000000000000000000 EAP-Message = 0x0244002b19001703010020c006fdcd03d0e15b7001c3e94e1a45340325626fed36c7c97450769dc33c587f Message-Authenticator = 0x00000000000000000000000000000000 Stripped-User-Name = "ac221(a)loopback.sussex.ac.uk" Realm = "jrs" EAP-Type = PEAP Called-Station-SSID = "" Packet-Src-Ip-Address-Oct1 = 139 Packet-Src-Ip-Address-Oct2 = 184 Packet-Src-Ip-Address-Oct3 = 8 Packet-Src-Ip-Address-Oct4 = 16 SS-Flags = "0100000000" NAS-Flags = "010010110000000" Supplicant-Flags = "0001000000" SQL-User-Name = "ac221(a)loopback.sussex.ac.uk" Realm = "jrs" Proxy-State = 0x313035 Going to the next request Thanks Arran -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 8

Re: Quick question RE: FreeRADIUS Trusted Root CA List
by Cerney, Lawrence 05 Feb '08

05 Feb '08

Thanks Sebastian, Moving all the Trusted CA's into one file, as you suggested, fixed my problem. I still only use one server-cert. I have been testing with different sized user-certs signed by CA's of various sizes. That's the reason for the 8 different CA's. It would be the same if I wanted to authenticate user-certs signed by different commercial certificate vendors. Again thanks Larry To trust more than one CA, you simply have to copy all the root-certificates into one file: for example: CA_file = /etc/1x/trustedcas.pem I tested this with 3 CAs, and it works. Do you really need 8 different server-certificates? So, how should the server decide which certificate he must send the client? Sebastian -- Psssst! Schon vom neuen GMX MultiMessenger geh?rt? Der kann`s mit allen: http://www.gmx.net/de/go/multimessenger - This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

3 2

Error on radius
by Ackbar Joolia 05 Feb '08

05 Feb '08

Hi, I am getting this error in my radius log, do you know why this is so and how to get this resolved? 'The maximum number of threads (32) are active, cannot spawn new thread to handle request' Also, do people know what is the maximum simultaneous incoming authentication calls that the radius process can handle? Or what ways can be adopted to deal with this? Thanks Ackbar No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.5.516 / Virus Database: 269.17.13/1212 - Release Date: 06/01/2008 22:55

7 17

Quick question RE: FreeRADIUS Trusted Root CA List
by Cerney, Lawrence 04 Feb '08

04 Feb '08

I work in a test environment and need to test with certs created with different CA's. I haven't been able to get more than one CA at a time to work. I've got 8 CA's and I need to keep 7 commented out for the certs to authenticate. The question is can FreeRADIUS support more than one CA at a time, and if so how? FreeRADIUS 1.0.0-Pre3 tls { private_key_password = password private_key_file = /etc/1x/freeradius.pem #private_key_file = /etc/1x/server512.pem #private_key_file = /etc/1x/server1024.pem #private_key_file = /etc/1x/server1024v3.pem #private_key_file = /etc/1x/server1536.pem #private_key_file = /etc/1x/server2048.pem #private_key_file = /etc/1x/server4096.pem # If Private key & Certificate are located in # the same file, then private_key_file & # certificate_file must contain the same file # name. certificate_file = /etc/1x/freeradius.pem #certificate_file = /etc/1x/server512.pem #certificate_file = /etc/1x/server1024.pem #certificate_file = /etc/1x/server1024v3.pem #certificate_file = /etc/1x/server1536.pem #certificate_file = /etc/1x/server2048.pem #certificate_file = /etc/1x/server4096.pem # Trusted Root CA list CA_file = /etc/1x/FlukeNetWotter.pem #CA_file = /usr/local/etc/raddb/certs/PV_512_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_768_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1024_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1280_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1536_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_1792_CA.pem #CA_file = /usr/local/etc/raddb/certs/PV_2048_CA.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random thanks... Larry This message (including any attachments) contains confidential and/or proprietary information intended only for the addressee. Any unauthorized disclosure, copying, distribution or reliance on the contents of this information is strictly prohibited and may constitute a violation of law. If you are not the intended recipient, please notify the sender immediately by responding to this e-mail, and delete the message from your system. If you have any questions about this e-mail please notify the sender immediately.

3 2

Terminate EAP-PEAP client connection at FreeRadius Proxy and proxy(forward) request as PAP
by Joakim Lindgren 04 Feb '08

04 Feb '08

Hi again and thanks, EAP-TTLS/PAP is the defaultI tried configuring the TTLS-PAP inner and outer tunnel but it will not work. EAP-TTLS/PAP ended A. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "OTHER" (LOCAL) domain then the EAP-TTLS tunnel is ended and validated against the LDAP. PAP Tunneled (proxied) B. If an incoming user conn. against the FreeRadius Server (Nr1) is belonging to "SECURSERVER" domain then the EAP-TTLS tunnel is ended and PAP is proxied to other Radius (Nr 2) Sincerely Joakim

6 16

Monitoring Tool for Freeradius
by Julian Stöver 04 Feb '08

04 Feb '08

Hello, is there any monitoring tool for freeradius or another possibility to see how many people are logged in and to do some other stuff? like the monitoring tool for openvpn? Would be nice if there's something avaible! bye! julian

7 25

freeRADIUS and Cisco switch errors, the server replies but the switch does not seem to authorise the login
by David Bradley 04 Feb '08

04 Feb '08

Hi, I'm hoping you can help! I have a server running FreeRADIUS and I'm trying to authorize exec sessions. If I remove the authorize line in the cisco config the authentication works fine, but once it starts to authorise it fails. There are 4 sections here: relevant parts of the cisco switch The users file, the freeRADIUS log and the cisco switch log. The bit that seems to fail is where the cisco switch recieves the radius reply, it just doesn't act on the reply.... aaa new-model aaa authentication login default group radius local aaa authorization exec default group radius radius-server host 192.168.100.201 auth-port 1812 acct-port 1813 key 7 xxxxxxx radius-server source-ports 1645-1646 Users-file DEFAULT Service-Type = shell Cisco-AVPair = "shell:priv-lvl=15" ----------------------- rad_recv: Access-Request packet from host 192.168.100.254:1645, id=26, length=82 NAS-IP-Address = 192.168.100.254 NAS-Port = 2 NAS-Port-Type = Virtual User-Name = "dave" Calling-Station-Id = "192.168.100.109" User-Password = "password" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "dave", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched DEFAULT at 153 users: Matched DEFAULT at 228 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 modcall[authenticate]: module "unix" returns ok for request 0 modcall: group authenticate returns ok for request 0 Login OK: [djbrad2/password] (from client rafmh port 2 cli 192.168.100.109) Sending Access-Accept of id 26 to 192.168.100.254:1645 Cisco-AVPair = "shell:priv-lvl=15" Finished request 0 -------- *Mar 1 02:05:01.335: RADIUS(00000000): Send Access-Request to 192.168.100.201:1812 id 1645/26, len 82 *Mar 1 02:05:01.335: RADIUS: authenticator 90 85 F6 37 C3 2C A4 BE - 97 44 D1 81 A4 DD 0F 2D *Mar 1 02:05:01.335: RADIUS: NAS-IP-Address [4] 6 192.168.100.254 *Mar 1 02:05:01.335: RADIUS: NAS-Port [5] 6 2 *Mar 1 02:05:01.335: RADIUS: NAS-Port-Type [61] 6 Virtual [5] *Mar 1 02:05:01.335: RADIUS: User-Name [1] 9 "dave" *Mar 1 02:05:01.335: RADIUS: Calling-Station-Id [31] 17 "192.168.100.109" *Mar 1 02:05:01.335: RADIUS: User-Password [2] 18 * *Mar 1 02:05:01.339: RADIUS: Received from id 1645/26 192.168.100.201:1812, Access-Accept, len 45 *Mar 1 02:05:01.339: RADIUS: authenticator A7 47 9F 4C 58 BC CA A5 - E5 6B E4 9E 64 9F FB C9 *Mar 1 02:05:01.339: RADIUS: Vendor, Cisco [26] 25 *Mar 1 02:05:01.339: RADIUS: Cisco AVpair [1] 19 "shell:priv-lvl=15" *Mar 1 02:05:01.343: RADIUS: saved authorization data for user 1DF88C8 at 2238960 *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): Port='tty2' list='' service=EXEC *Mar 1 02:05:01.343: AAA/AUTHOR/EXEC: tty2 (606283324) user='djbrad2' *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): send AV service=shell *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): send AV cmd* *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): found list "default" *Mar 1 02:05:01.343: tty2 AAA/AUTHOR/EXEC (606283324): Method=radius (radius) *Mar 1 02:05:01.343: RADIUS: cisco AVPair "shell:priv-lvl=15" *Mar 1 02:05:01.343: RADIUS: no appropriate authorization type for user. *Mar 1 02:05:01.343: AAA/AUTHOR (606283324): Post authorization status = FAIL *Mar 1 02:05:01.343: AAA/AUTHOR/EXEC: Authorization FAILED

2 3

inner/outer Tunnel attributes of TTLS/MS-CHAPv2
by Vincent Magnin 04 Feb '08

04 Feb '08

Hello All, I've an issue with passing attributes from EAP TTLS MS-CHAPv2 to outer: My /etc/raddb/users contains: DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1 User-Name := `%{User-Name}`, Fall-Through = yes And my eap ttls module contains: > copy_request_to_tunnel = yes > use_tunneled_reply = yes The user-name and Tunnel-* are not rewiten/copied to the outer. This isssue is only with MS-CHAP, not PAP. Running version: freeradius-1.0.1-3.RHEL4.5 radius -X : rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 39 modcall: group Auth-Type returns ok for request 39 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 39 radius_xlat: '/var/log/radius/radacct/127.0.0.1/reply-detail-20080204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/127.0.0.1/reply-detail-20080204 modcall[post-auth]: module "reply_log" returns ok for request 39 modcall: group post-auth returns ok for request 39 TTLS: Got tunneled reply RADIUS code 2 User-Name := "vmagnin(a)unil.ch" Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "16" Tunnel-Medium-Type:0 = IEEE-802 MS-CHAP2-Success = 0x5b533d31464345343644464444343239353838433043363243464630463638363938363532333336314637 MS-MPPE-Recv-Key = 0xcf199064e5ce16501ad868646e8e7b3c MS-MPPE-Send-Key = 0x053e079625529879fe9f4f1cb9b7ad47 MS-MPPE-Encryption-Policy = 0x00000002 MS-MPPE-Encryption-Types = 0x00000004 TTLS: Got tunneled Access-Accept rlm_eap: Freeing handler modcall[authenticate]: module "eap" returns ok for request 39 modcall: group Auth-Type returns ok for request 39 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 39 radius_xlat: '/var/log/radius/radacct/130.223.222.60/reply-detail-20080204' rlm_detail: /var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/radius/radacct/130.223.222.60/reply-detail-20080204 modcall[post-auth]: module "reply_log" returns ok for request 39 modcall: group post-auth returns ok for request 39 Sending Access-Accept of id 60 to 130.223.222.60:1645 MS-MPPE-Recv-Key = 0xc9abc77f52aa954231989e3bc26c35b2b6f6578dec2fe6b1bf06e9fb1b75740f MS-MPPE-Send-Key = 0xe940dd6f47a1a7102d876dacf2f36385a5e717f96372d87256b5e6c1c3ba962b EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "anonymous" Finished request 39

3 3

RE: Freeradius-Users Digest, Vol 34, Issue 16
by aziz yucelen 04 Feb '08

04 Feb '08

---------------------------------------------------> > What do you want to do? What do you want to achieve? What authentication are> you planning to use ? ---------------------------------------------------< Hi. Principally sorry for my bad english.I am setup freeradius .I want chain all network client.My problem is - ı am setup freeradius server - I am setup layer2 switch - Iam configure switch and client pc - and start -but client pc sending access request to switch, switch request to server ,server message is "access challenge" what is this I dont know and what I do? ------------------------------------------------------------------------------------------------------------> rad_recv: Access-Request packet from host 10.1.254.38 port 49155, id=0, > length=73> Threads: total/active/spare threads = 5/0/5> Thread 2 got semaphore> Thread 2 handling request 0, (1 handled so far)> NAS-IP-Address = 10.1.254.38> NAS-Port-Type = Ethernet> NAS-Port = 17> User-Name = "test"> EAP-Message = 0x020100090174657374> Message-Authenticator = 0x40b01c65697a037c2aec79069d28d709> +- entering group authorize> ++[preprocess] returns ok> ++[chap] returns noop> ++[mschap] returns noop> Waking up in 0.9 seconds.> ++[unix] returns notfound> rlm_realm: No '@' in User-Name = "test", looking up realm NULL> rlm_realm: No such realm "NULL"> ++[suffix] returns noop> rlm_eap: EAP packet type response id 1 length 9> rlm_eap: No EAP Start, assuming it's an on-going EAP conversation> ++[eap] returns updated> users: Matched ! entry test at line 93> expand: Hello, %{User-Name} -> Hello, test> ++[files] returns ok> ++[expiration] returns noop> ++[logintime] returns noop> rlm_pap: Found existing Auth-Type, not changing it.> ++[pap] returns noop> rad_check_password: Found Auth-Type EAP> auth: type "EAP"> +- entering group authenticate> rlm_eap: EAP Identity> rlm_eap: processing type tls> rlm_eap_tls: Initiate> rlm_eap_tls: Start returned 1> ++[eap] returns handled> Sending Access-Challenge of id 0 to 10.1.254.38 port 49155> Reply-Message = "Hello, test"> EAP-Message = 0x010200061920> Message-Authenticator = 0x00000000000000000000000000000000> State = 0xf779e639f77bff0d3d2c202f1c7a8b9c> Finished request 0.> Going to the next request _________________________________________________________________ Helping your favorite cause is as easy as instant messaging. You IM, we give. http://im.live.com/Messenger/IM/Home/?source=text_hotmail_join

4 3