- Freeradius-Users - lists.freeradius.org

EAP-TLS - About username sent by supplicant
by OLIVER Patrice 14 Dec '07

14 Dec '07

Hello, I use EAP-TLS to authenticate the computers on my wlan. As the supplicants run on Windows XP, I had to store the certificates in the 'local computer' and 'user account' stores and create the register key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EAPOL\Parameters\General\Global\AuthMode with the value '1' (dword). You may ask me why. The reason is simple. Certificates stored in 'local computer' are used at boot time and certiticates store in 'user account' and used at login time. The value of the register key tells Windows to authenticate at boot time and after login time. So, if the WIFI card is removed and inserted, the authentication works fine. :) My question deals with the username sent by the supplicant when the authentication goes on. At boot time, the username sent is : host/user_name. After the login, the username sent is : user_name. So, I have to create 2 users. I want to cut 'host/' to make this task easier. It is possible ? How do I do this ? Regards, ---------------------------------------- Patrice OLIVER Chef du Projet Ville Hôpital Responsable Réseaux & Sécurité ---------------------------------------- HOSPICES CIVILS DE BEAUNE Service Informatique BP 104 21203 BEAUNE CEDEX Tél. 33 3 80 24 44 09 Fax 33 3 80 24 45 90 ----------------------------------------

2 2

Question about nt-domain.
by Hangjun He 14 Dec '07

14 Dec '07

Hi, FreeRADIUS 1.1.6. Use users file as user store. When I use username/password, It can work. When I user username/password/domain, It not work. I try to set preprocess module with_ntdomain_hack = yes. I get "rlm_eap: Identity does not match User-Name, setting from EAP Identity." I try to add with_ntdomain_hack = yes in mschap module, It does not work. Ready to process requests. rad_recv: Access-Request packet from host 10.155.20.84:1030, id=1, length=166 User-Name = "HH\\hhe123" NAS-IP-Address = 10.155.20.84 NAS-Identifier = "AH-000030" NAS-Port = 0 Called-Station-Id = "00-19-77-00-00-34:hhe" Calling-Station-Id = "00-19-E0-80-A5-5A" Framed-MTU = 1500 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0224000e0148485c686865313233 Message-Authenticator = 0xe02bcaa4c6065250f6dcd3ccd60386f6 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "hhe123", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Proxying request from user hhe123 to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 36 length 14 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry hhe123 at line 95 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: Identity does not match User-Name, setting from EAP Identity. rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 0 modcall: leaving group authenticate (returns invalid) for request 0 auth: Failed to validate the user. Sending Access-Reject of id 1 to 10.155.20.84 port 1030 Reply-Message = "Hello" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... John --------------------------------- 天生购物狂，狂抢购物券，你还等什么！

2 1

EAP-TLS authentication
by anoop_c＠sifycorp.com 14 Dec '07

14 Dec '07

HI I am using EAP_TLS authentication ie certificate based authentication with free radius.The setup is working fine . I have one query.Is there any way to lock the client certificate to a particular laptop MAC address so that the certificate cannot be used in another machine..Is there any config in Free radius for this purpose so that one certificate should not be used by another user Regards Anoop ********** DISCLAIMER ********** Information contained and transmitted by this E-MAIL is proprietary to Sify Limited and is intended for use only by the individual or entity to which it is addressed, and may contain information that is privileged, confidential or exempt from disclosure under applicable law. If this is a forwarded message, the content of this E-MAIL may not have been sent with the authority of the Company. If you are not the intended recipient, an agent of the intended recipient or a person responsible for delivering the information to the named recipient, you are notified that any use, distribution, transmission, printing, copying or dissemination of this information in any way or in any manner is strictly prohibited. If you have received this communication in error, please delete this mail & notify us immediately at admin(a)sifycorp.com Complete Coverage of the ICC World Cup '07! Log on to www.sify.com/khel for latest updates, expert columns, schedule, desktop scorecard, photo galleries and more! Watch the hottest videos from Bollywood, Fashion, News and more only on www.sifymax.com For the Expert view of the ICC World Cup log on to www.sify.com/khel. Read exclusive interviews with Sachin, Ganguly, Yuvraj, Sreesanth, Expert Columns by Gavaskar, Web chat with Dhoni and more! .

2 1

Command Authorization in freeradius
by ajay raut 14 Dec '07

14 Dec '07

Hi, I want to do a command authorization from a Freeradius server...like the way Tacacs+ have cmd-arg attribute specifies a specific commands the can be executed by a user. I am searching for the attribute in freeradius that can enable such kind of behaviour... Regards, Ajay --------------------------------- Never miss a thing. Make Yahoo your homepage.

3 2

Problem with authentication
by Pablo Lucchetti 14 Dec '07

14 Dec '07

Hi, I've a Freeradius on a Debian Etch with Mysql but when I'm triying to test with NTRadPing always got the same error. The user already exists in database rad_recv: Access-Request packet from host 192.168.1.109:4027, id=2, length=49 User-Name = "test-user" User-Password = "test-pass" rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): SQL query error; rejecting user rlm_sql (sql): Released sql socket id: 4 Sending Access-Reject of id 2 to 192.168.1.109 port 4027 Any help please? Thanks in advance, Pablo

3 14

Question about windowsXP(Odessey Client) + EAP-TLS with freeRADIUS
by Hangjun He 14 Dec '07

14 Dec '07

Hi, I am using freeRADIUS 1.1.6. And I use EAP-TLS and with correct certs. Even if I set wrong username in Odessey Client, freeRADIUS will return success.(check_cert_cn not set). Can I let freeRADIUS to check if username in the users file or other database? If not, reject user. Thanks! John --------------------------------- 天生购物狂，狂抢购物券，你还等什么！

4 4

sqlcounter, counting data and large amounts of it
by Russell Tester 13 Dec '07

13 Dec '07

Hi All, I am new to the freeradius list but have been running freeradius for some time. We are changing the way we do some of our accounting here and have a requirement to provide users with monthly prepaid cards for specific data values, namely 1,5 and 10GB. I have no problems making the pass timeout after the month, that bit is fine using the expiration check value. Where I am faced with a problem is telling the nas about (we use Mikrotik's) and counting above the hair pulling 4GB boundary. An example of my sqlcounter is below, this works perfectly fine anywhere up to 4GB, note that I run two of these one for up and one for downloaded data. Not 100% accurate in terms of the user could theoretically get the max amount of data up and down from their first session but accurate enough for us for now. I believe Mikrtoik v3 has a Total-Limit attribute which will fix this when its released. sqlcounter prepay-data-down { counter-name = Max-All-Session-Data check-name = Max-All-Data reply-name = Mikrotik-Recv-Limit sqlmod-inst = sql key = User-Name reset = never query = "SELECT SUM(AcctInputOctets) + SUM(AcctOutputOctets) FROM radacct WHERE UserName='%{%k}'" } Two problems exist with this setup: 1. When I specify a larger than 4GB value in radcheck I get an Access-Reject. 2. I have no way to send the equivalent gigawords attribute to the NAS as well, I believe I need to send both the Mikrotik-Recv-Limit and Mikrtoik-Recv-Limit-Gigawords values. I have spent some time playing myself and have managed to send the gigawords attribute by using another sqlcounter, and another radcheck attribute for gigawords, but get lost somewhere in the middle of checking both the gigawords and octets values against the radacct data and getting a sensible reply from them. The other question I have relates to the action the sqlcounter performs when the limit is reached. Is there any way to modify the reply attribute that gets passed to the nas when the limit is reached? Either by changing the reply message, or passing say a rate-limit value to the NAS to throttle the user. Any help to get this working, or examples of existing setups would be greatly appreciated. Cheers, Russell Tester

3 3

about Error: rlm_sql
by ann kok 13 Dec '07

13 Dec '07

Hi all As the debian upgrade, i also upgrade the freeradius version to from 1.0.2 to 1.1.3 in debian package the radius database is migrated to this new debian I use the NTRADping utiliy to tests the new freeradius login fine. When I put it in the production, the radius.log is showing Error: rlm_sql: Failed to create the pair: Unknown value Mysql for attribute Auth-Type and I can't see any "Auth: Login OK:" All are " Auth: Login incorrect" please help ____________________________________________________________________________________ Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now. http://mobile.yahoo.com/;_ylt=Ahu06i62sR8HDtDypao8Wcj9tAcJ

2 1

attribute assignment in post-auth?
by Norbert Wegener 13 Dec '07

13 Dec '07

With 1.1.7 I want to add attributes to an eap authenticated client. The rules for applying vlan are somewhat unusual, that I decided to use mysql and stored procedures to determine the values that have to be applied. When I call the corresponding sql module from the authorize section, I run into the problem described at: https://lists.freeradius.org/pipermail/freeradius-users/2007-September/0663… to which Alan already answered: > Ideally, the attributes in the reply should be sent ONLY on >Access-Accept. i.e. the configuration should NOT update the reply until >it has determined that the user has been authenticated. > This involves moving most of the policy from the "authorize" section >to the "post-auth" section. That is why I want to call the stored procedure in the post-auth section. Therefore in sql.conf I set : postauth_query = "call speap ('%{SQL-User-Name}', '%{NAS-IP-Address}','2')" radiusd -AX shows , that procedure is called, ..... rlm_sql (sp1): Processing sql_postauth radius_xlat: 'host/28tef003.ww006.mycompany.net' rlm_sql (sp1): sql_set_user escaped user --> 'host/28tef003.ww006.mycompany.net' radius_xlat: 'call speap ('host/28tef003.ww006.mycompany.net', '172.31.110.146','2')' rlm_sql (sp1) in sql_postauth: query is call speap ('host/28tef003.ww006.mycompany.net', '172.31.110.146','2') rlm_sql (sp1): Reserving sql socket id: 28 rlm_sql_mysql: SQL statement returned unexpected result .. unfortunately with an unexpected result. When I call that stored procedure directly from mysql I get the expected result: mysql> call speap ('host/28tef003.ww006.mycompany.net', '172.31.110.146','2') +---+-----------------------------------+--------------+-----+----+ | 0 | s_username | Fall-Through | Yes | += | +---+-----------------------------------+--------------+-----+----+ | 0 | HOST/28tef003.ww006.mycompany.net | Fall-Through | Yes | += | +---+-----------------------------------+--------------+-----+----+ what I would expect. So, what is unexpected with that result? Norbert Wegener

2 2

sqlippool issue
by hadi golestani 13 Dec '07

13 Dec '07

Hi, I'm using freeradius to assign ip to my vpn clients. so I've configured sqlippool to bind ips to my users and groups. and in pptpd.conf I choose not to assign ip in pptpd. but connections to pptpd fails ( from win xp ) with error: no assigned ip. what's wrong in my configurations? my DB state: insert into radcheck ( username , attribute , op , value ) values ( 'newuser3' , 'Cleartext-Password' , ':=' , 'newpass3'); insert into usergroup (username , groupname ) values ( 'newuser3' , 'offpart1'); insert into radgroupcheck ( groupname , attribute , op , value ) values ('offpart1' , 'Pool-Name' , ':=' , '1515'); insert into radippool ( 'pool_name' , 'framedipaddress' ) values ('1515',' 10.15.15.3'); it's the output of debug mod: rad_recv: Access-Request packet from host 127.0.0.1:34045, id=149, length=148 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "newuser3" MS-CHAP-Challenge = 0xc2af22b4941ad3a9f8ffba6ca9793eea MS-CHAP2-Response = 0x220069907d4b717d6e15a59053bead0f51900000000000000000283b13c9c3bd7f543ae7385f6b5749cb18330955aade9ea7 Calling-Station-Id = "xx.xx.xx.xx" NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 8 modcall[authorize]: module "preprocess" returns ok for request 8 modcall[authorize]: module "chap" returns noop for request 8 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = mschap' modcall[authorize]: module "mschap" returns ok for request 8 rlm_realm: No '@' in User-Name = "newuser3", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 8 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 8 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 8 radius_xlat: 'newuser3' rlm_sql (sql): sql_set_user escaped user --> 'newuser3' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'newuser3' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName, radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'newuser3' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'newuser3' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName, radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'newuser3' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 8 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 8 modcall: leaving group authorize (returns ok) for request 8 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 8 rlm_mschap: Told to do MS-CHAPv2 for newuser3 with NT-Password rlm_mschap: adding MS-CHAPv2 MPPE keys modcall[authenticate]: module "mschap" returns ok for request 8 modcall: leaving group MS-CHAP (returns ok) for request 8 Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 8 rlm_sqlippool: Framed-IP-Address already exists modcall[post-auth]: module "sqlippool" returns noop for request 8 rlm_sql (sql): Processing sql_postauth radius_xlat: 'newuser3' rlm_sql (sql): sql_set_user escaped user --> 'newuser3' radius_xlat: 'INSERT into radpostauth (user, pass, reply, date) values ('newuser3', 'Chap-Password', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (user, pass, reply, date) values ('newuser3', 'Chap-Password', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): Released sql socket id: 3 modcall[post-auth]: module "sql" returns ok for request 8 modcall: leaving group post-auth (returns ok) for request 8 Sending Access-Accept of id 149 to 127.0.0.1 port 34045 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Service-Type = Framed-User Framed-Protocol = PPP Framed-Compression = Van-Jacobson-TCP-IP MS-CHAP2-Success = 0x22533d36413732333834453141433843323544364432373245454244333734303038463238363630453439 MS-MPPE-Recv-Key = 0x0d42ffa8adfe8471a692876c86a6b26d MS-MPPE-Send-Key = 0x5110ed91d6d36bb4c9d44e2a0f6367e1 MS-MPPE-Encryption-Policy = 0x00000001 MS-MPPE-Encryption-Types = 0x00000006 Finished request 8 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 8 ID 149 with timestamp 4760fe8f Nothing to do. Sleeping until we see a request.

2 8