- Freeradius-Users - lists.freeradius.org

Sending username/password to radius-client
by roger fong 25 Sep '07

25 Sep '07

Hi! i would like to write a script file to send the username/pasword information to the Radius-Client (cisco switch) instead of using the Windows pop-up username/password interface. This script will go into a php file. Is this possible ? thanks _________________________________________________________________ Soyez parmi les premiers à essayer Windows Live Mail. http://ideas.live.com/programpage.aspx?versionId=5d21c51a-b161-4314-9b0e-49…

3 5

simultaneous login
by Michael Ziemann 25 Sep '07

25 Sep '07

Hi all! I have a problem with simultaneous login: I already described the problem and got following solution: --------------------------------- Michael Ziemann wrote: > > I have a problem with simultaneous login. > > The user connects to the RADIUS Server, then the user appears in the > > MySQL-DB in the table radacct. But if the user disconnect, the user > > doesn't disappear in the table. > The NAS isn't sending accounting STOP messages. Fix it. > > If I remove the entry by myself, the user can connect again. > See also "man radzap" > > In the table radreply i added an Idle-Timeout in the Attribut field with > > the value 5 and op = . > > I added also Idle-Timeout to radgroupreply to the group of user with the > > value 5. > FreeRADIUS doesn't enforce Idle-Timeout, or Session-Timeout. Only the NAS does. Alan DeKok. --------------------------------- The NAS is sending accounting STOP messages. I splitted raddact into radacct_start and radacct_stop. In the table raddact_start, i have an entry with the ACCtStartTime time (2007-09-25 08:30:03), but no ACCtStopTime (0000-00-00 00:00:00). When I disconnect, freeradius writes the ACCtStopTime to the table raddact_stop. So, in the table radacct_stop I have the ACCtStartTime (2007-09-25 08:30:03) and the ACCtStopTime (2007-09-25 08:40:53). (The NAS must send a STOP message.) The User can connect again, when I delete the entry in radacct_start with the ACCtStopTime (0000-00-00 00:00:00). There are no right-problems, because the freeradius connects to the MySQL-DB with the User root (and of course the right pwd) with the rights "ALL PRIVILEGES". Thanks for the good support (especially to Alan). regards Michael

3 2

Server instability
by Nathan Hay 24 Sep '07

24 Sep '07

I am a newbie, running 3 (for redundancy) FreeRadius servers (1.1.7) on SUSE 10 SP1 (32-bit) to authenticate our wireless clients (PEAP MSCHAPv2) to our eDirectory via LDAP. We average 800-900 simultaneous wireless clients (need to support a potential 4K in the future). The setup works well and authenticates users very quickly, but every couple days, the radiusd process will either blow up and start consuming 99% of the CPU or die altogether. More often it blows up. We had stability problems initially, even when the process was running, so I took everything out of the config that we didn't need and that seemed to help. Can anyone comment on our configuration and tell me if I'm doing something wrong? This is my first FreeRadius deployment and I don't consider myself a Linux guru, let alone claim to know much about Radius. Thanks in advance, Nathan Hay Network Engineer Cedarville University prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid user = radiusd group = radiusd max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 512000 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = yes log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = no $INCLUDE ${confdir}/clients.conf snmp = no thread pool { start_servers = 16 max_servers = 64 min_spare_servers = 8 max_spare_servers = 16 max_requests_per_server = 0 } modules { $INCLUDE ${confdir}/eap.conf mschap { authtype = MS-CHAP use_mppe = yes require_encryption = yes require_strong = yes } ldap { server = "XXX" identity = "cn=XXX,o=XXX" password = XXX basedn = "o=XXX" filter = "(cn=%{Stripped-User-Name:-%{User-Name}})" base_filter = "(objectclass=radiusprofile)" start_tls = yes tls_cacertfile = /usr/local/etc/raddb/certs/ldap.cer tls_cacertdir = /usr/local/etc/raddb/certs/ tls_require_cert = "demand" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 10 password_attribute = nspmPassword edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } } authorize { mschap eap ldap } authenticate { Auth-Type MS-CHAP { mschap } Auth-Type LDAP { ldap } eap } post-auth { ldap Post-Auth-Type REJECT { ldap } }

3 3

eap-ttls + windows xp
by Sergio Belkin 24 Sep '07

24 Sep '07

Hi community, I can't get Windows XP authenticate successfully against freeradius 1.1.7 :( I've created certificates with xpextensions in the same directory of openssl.cnf (issuing openssl ca -config ./openssl.cnf -policy policy_anything -out certificado_de_radius.pem -extensions xpserver_ext -extfile ./xpextensions -infiles ./pedido_para_radius.pem ) Erros when I run radiusd -X are as follow: # 16:19:54.187160 IP ap.palermo.edu.1030 > lala.palermo.edu.radius: RADIUS, Access Request (1), id: 0x45 length: 98 rad_recv: Access-Request packet from host 10.30.1.151:1030, id=69, length=98 User-Name = "test" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020100090174657374 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 Message-Authenticator = 0x620d0175629a6cde560f4ee4c40c7fe5 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 1 length 9 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry test at line 51 modcall[authorize]: module "files" returns ok for request 4 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 4 modcall: leaving group authorize (returns updated) for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 4 modcall: leaving group authenticate (returns handled) for request 4 Sending Access-Challenge of id 69 to 10.30.1.151 port 1030 EAP-Message = 0x0102001e1a01020019107c04d9d5a09c09a2ade61f9c65b3593d74657374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x0feb13a7c16734b7c9258d34abe8af07 Finished request 4 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... 16:19:54.188014 IP lala.palermo.edu.radius > ap.palermo.edu.1030: RADIUS, Access Challenge (11), id: 0x45 length: 88 16:19:54.232380 IP ap.palermo.edu.1030 > lala.palermo.edu.radius: RADIUS, Access Request (1), id: 0x46 length: 113 rad_recv: Access-Request packet from host 10.30.1.151:1030, id=70, length=113 User-Name = "test" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020200060319 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0x0feb13a7c16734b7c9258d34abe8af07 Message-Authenticator = 0x18453d73e2119833997ee07ed1d83aa7 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 modcall[authorize]: module "chap" returns noop for request 5 modcall[authorize]: module "mschap" returns noop for request 5 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 5 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 5 users: Matched entry test at line 51 modcall[authorize]: module "files" returns ok for request 5 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 5 modcall: leaving group authorize (returns updated) for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/peap rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 5 modcall: leaving group authenticate (returns handled) for request 5 Sending Access-Challenge of id 70 to 10.30.1.151 port 1030 EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x743e763892ef8def88c122b86125a743 Finished request 5 Going to the next request Waking up in 6 seconds... 16:19:54.233408 IP lala.palermo.edu.radius > ap.palermo.edu.1030: RADIUS, Access Challenge (11), id: 0x46 length: 64 rad_recv: Access-Request packet from host 10.30.1.151:1030, id=71, length=187 16:19:54.324947 IP ap.palermo.edu.1030 > lala.palermo.edu.radius: RADIUS, Access Request (1), id: 0x47 length: 187 User-Name = "test" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x0203005019800000004616030100410100003d030146f80d12c6043152d3de3a08135866564c49fe73417ce122ccbe8d9b841da19c00001600040005000a000900640062000300060013001200630100 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0x743e763892ef8def88c122b86125a743 Message-Authenticator = 0x01f489f169371e82546775c351b6c21d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 6 modcall[authorize]: module "preprocess" returns ok for request 6 modcall[authorize]: module "chap" returns noop for request 6 modcall[authorize]: module "mschap" returns noop for request 6 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 6 rlm_eap: EAP packet type response id 3 length 80 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 6 users: Matched entry test at line 51 modcall[authorize]: module "files" returns ok for request 6 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 6 modcall: leaving group authorize (returns updated) for request 6 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 6 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included eaptls_verify returned 11 (other): before/accept initialization TLS_accept: before/accept initialization rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello TLS_accept: SSLv3 read client hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello TLS_accept: SSLv3 write server hello A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0323], Certificate TLS_accept: SSLv3 write certificate A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone TLS_accept: SSLv3 write server done A TLS_accept: SSLv3 flush data TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 6 modcall: leaving group authenticate (returns handled) for request 6 Sending Access-Challenge of id 71 to 10.30.1.151 port 1030 EAP-Message = 0x010403861900160301004a02000046030146f80dda01273cf23c3155d8651f4c9e4b992c110437bd78225c7bc1c7b051cc202355ad2eec597b02d357bc65942cab8f7f3f4558390a5c76d4165e160e0fdd2c00040016030103230b00031f00031c000319308203153082027ea003020102020101300d06092a864886f70d01010405003081c3310b3009060355040613024152311530130603550408130c4275656e6f73204169726573312b302906035504070c2243697564616420417574c383c2b36e6f6d61206465204275656e6f73204169726573311f301d060355040a1316556e6976657273696461642064652050616c65726d6f3111300f06 EAP-Message = 0x0355040b1308496e7465726e657431193017060355040313106c616c612e70616c65726d6f2e6564753121301f06092a864886f70d01090116127362656c6b694070616c65726d6f2e656475301e170d3037303932343133343430355a170d3038303932333133343430355a3081c3310b3009060355040613024152311530130603550408130c4275656e6f73204169726573312b302906035504070c2243697564616420417574c383c2b36e6f6d61206465204275656e6f73204169726573311f301d060355040a1316556e6976657273696461642064652050616c65726d6f3111300f060355040b1308496e7465726e6574311930170603550403 EAP-Message = 0x13106c616c612e70616c65726d6f2e6564753121301f06092a864886f70d01090116127362656c6b694070616c65726d6f2e65647530819f300d06092a864886f70d010101050003818d0030818902818100a3b26b1be6a56057e2eeb5ee11b6b878b968c41e3855d54fe5c8f7afbc804387b4fc7b584cc984bdb53ade60ef5155d5b817db502c0f7795a5d704acfa1edb10d5437183f324bb8b81e7d63a303988475823ab74ff680830fe76c1e6a3bda7ec8627ada0cb544dffaaa11d28cf09972692a1850d91631ff4389da7a09ba1a8c50203010001a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d010104 EAP-Message = 0x050003818100dad5fef98af08eb802758d21bf9ac7f88972046fecf811c351d4eae41278fe21f57147628dcc3b01590225fd0b9d5259b9f33a620c353532eebbef62cd6bea03498eed6a1fbf211484a9d46105dfe8eaf2d7ad59ff246a3178d03c15fbbfd12696e18df18d9bc259f9716eecb8f7cf6445f903b448cbdcd723ded1bd6dcf28fb16030100040e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xd07fd57f7a01313819fd813c13a3828a Finished request 6 Going to the next request Waking up in 6 seconds... 16:19:54.326376 IP lala.palermo.edu.radius > ap.palermo.edu.1030: RADIUS, Access Challenge (11), id: 0x47 length: 966 16:19:54.384285 IP ap.palermo.edu.1030 > lala.palermo.edu.radius: RADIUS, Access Request (1), id: 0x48 length: 113 rad_recv: Access-Request packet from host 10.30.1.151:1030, id=72, length=113 User-Name = "test" Calling-Station-Id = "00-0e-35-bf-51-18" EAP-Message = 0x020400061900 Framed-MTU = 1287 NAS-IP-Address = 192.168.1.1 NAS-Port = 0 NAS-Port-Type = Wireless-802.11 State = 0xd07fd57f7a01313819fd813c13a3828a Message-Authenticator = 0x81c246f538666a85e685033433d8692d Processing the authorize section of radiusd.conf modcall: entering group authorize for request 7 modcall[authorize]: module "preprocess" returns ok for request 7 modcall[authorize]: module "chap" returns noop for request 7 modcall[authorize]: module "mschap" returns noop for request 7 rlm_realm: No '@' in User-Name = "test", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 7 rlm_eap: EAP packet type response id 4 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 7 users: Matched entry test at line 51 modcall[authorize]: module "files" returns ok for request 7 rlm_pap: Found existing Auth-Type, not changing it. modcall[authorize]: module "pap" returns noop for request 7 modcall: leaving group authorize (returns updated) for request 7 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 7 rlm_eap: Request found, released from the list rlm_eap: EAP/peap rlm_eap: processing type peap rlm_eap_peap: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 rlm_eap_peap: EAPTLS_HANDLED modcall[authenticate]: module "eap" returns handled for request 7 modcall: leaving group authenticate (returns handled) for request 7 Sending Access-Challenge of id 72 to 10.30.1.151 port 1030 EAP-Message = 0x010500061900 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xe1d2cf562457c1deb151bda70947e97d Finished request 7 Going to the next request Waking up in 6 seconds... 16:19:54.385346 IP lala.palermo.edu.radius > ap.palermo.edu.1030: RADIUS, Access Challenge (11), id: 0x48 length: 64 --- Walking the entire request list --- Cleaning up request 4 ID 69 with timestamp 46f80dda Cleaning up request 5 ID 70 with timestamp 46f80dda Cleaning up request 6 ID 71 with timestamp 46f80dda Cleaning up request 7 ID 72 with timestamp 46f80dda Nothing to do. Sleeping until we see a request. ------------------- radiusd.conf: ------------------- prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 1024 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf snmp = no $INCLUDE ${confdir}/snmp.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { pap { auto_header = yes } chap { authtype = CHAP } pam { pam_auth = radiusd } unix { cache = no cache_reload = 600 radwtmp = ${logdir}/radwtmp } $INCLUDE ${confdir}/eap.conf mschap { } ldap { server = "ldap.your.domain" basedn = "o=My Org,c=UA" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 edir_account_policy_check=no timeout = 4 timelimit = 3 net_timeout = 1 } realm IPASS { format = prefix delimiter = "/" ignore_default = no ignore_null = no } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } realm realmpercent { format = suffix delimiter = "%" ignore_default = no ignore_null = no } realm ntdomain { format = prefix delimiter = "\\" ignore_default = no ignore_null = no } checkval { item-name = Calling-Station-Id check-name = Calling-Station-Id data-type = string } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } detail { detailfile = ${radacctdir}/%{Client-IP-Address}/detail-%Y%m%d detailperm = 0600 } acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } $INCLUDE ${confdir}/sql.conf radutmp { filename = ${logdir}/radutmp username = %{User-Name} case_sensitive = yes check_with_nas = yes perm = 0600 callerid = "yes" } radutmp sradutmp { filename = ${logdir}/sradutmp perm = 0644 callerid = "no" } attr_filter { attrsfile = ${confdir}/attrs } counter daily { filename = ${raddbdir}/db.daily key = User-Name count-attribute = Acct-Session-Time reset = daily counter-name = Daily-Session-Time check-name = Max-Daily-Session allowed-servicetype = Framed-User cache-size = 5000 } sqlcounter dailycounter { counter-name = Daily-Session-Time check-name = Max-Daily-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = daily query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } sqlcounter monthlycounter { counter-name = Monthly-Session-Time check-name = Max-Monthly-Session reply-name = Session-Timeout sqlmod-inst = sql key = User-Name reset = monthly query = "SELECT SUM(AcctSessionTime - \ GREATEST((%b - UNIX_TIMESTAMP(AcctStartTime)), 0)) \ FROM radacct WHERE UserName='%{%k}' AND \ UNIX_TIMESTAMP(AcctStartTime) + AcctSessionTime > '%b'" } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } digest { } exec { wait = yes input_pairs = request } exec echo { wait = yes program = "/bin/echo %{User-Name}" input_pairs = request output_pairs = reply } ippool main_pool { range-start = 192.168.1.1 range-stop = 192.168.3.254 netmask = 255.255.255.0 cache-size = 800 session-db = ${raddbdir}/db.ippool ip-index = ${raddbdir}/db.ipindex override = no maximum-timeout = 0 } } instantiate { exec expr } authorize { preprocess chap mschap suffix eap files pap } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } Auth-Type MS-CHAP { mschap } unix eap } preacct { preprocess acct_unique suffix files } accounting { detail unix radutmp } session { radutmp } post-auth { } pre-proxy { } post-proxy { eap } ----------- users ----------- "test" User-Password == "test123" DEFAULT Auth-Type = System Fall-Through = 1 DEFAULT Service-Type == Framed-User Framed-IP-Address = 255.255.255.254, Framed-MTU = 576, Service-Type = Framed-User, Fall-Through = Yes DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP ----------------- clients.conf ---------------- client 127.0.0.1 { secret = testing123 shortname = localhost } client 10.30.1.100 { secret = qwerty123 shortname = lala } client 10.30.1.151 { secret = qwerty123 shortname = ap } Please, could you help me a bit, is something wrong in these files??? Thanks in advance -- -- Sergio Belkin -

2 2

(newbie) Same pre-shared key in different shapes?
by Piero Giobbi 24 Sep '07

24 Sep '07

Hi all. I have got freeradius to rock with some equipment here just to get stuck again. I couldn't get radius to auth with some of our APs (Old Apple ones, yes i know sux but i have like 7 of them online now so..) and in the debug i saw that the keys where different from the ones that work. One type of AP wants XX:XX:XX:XX, other xxxxxxx.. third xxxx-xxxx. I really dont want to put all my users (150) in three times and im sure freeradius has a fix for it but i can't really figure it out or less find it (don't really know what to search for on the webb). So, i would like to put xxxxxxxx and get XX:XX:XX:XX and xxxx-xxxx out of it aswell when asked, possible yes? Im only using textfile users for credentials. Anyone that points me to the right direction and throws in an example would make my day or night. : ) thx.

2 1

Is it possible to add custom user attributes?
by Terry Pelley 24 Sep '07

24 Sep '07

FreeRADIUS Version 1.1.3-r0.1.2 (Upgrade is Pending) Is there a way to add my own custom attributes to my users other that simply putting a "#" in front of the line? I would like to be able to add a Corporate asset tag number for my wireless users laptops. Thanks.

2 4

RE: FreeRADIUS and iODBC
by Josh Howlett 24 Sep '07

24 Sep '07

> What is the question? There was no question :-) If I find out how to do something that is poorly - or not - documented I post it to the mailing list so that it can be indexed by Google, for the benefit of other people in the future who might have the same problem. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

2 1

WPA-Enterprise with TTLS fails to authenticate (from Windows ok, but Linux fails).
by Janusz Syrytczyk 24 Sep '07

24 Sep '07

Hello, I'm running WPA-Enterprise with TTLS authentication and LDAP backend. Config was running fine since 1,5 year. Problem is that I cannot authenticate to my network with wpa_supplicant, although I could, and from Windows & Secure2w TTLS wrapper - I can. I use Gentoo and did some upgrades (but nothing special I guess, kernel is the same, and wpa_supplicant also) My eap.conf: eap { default_eap_type = mschapv2 timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no md5 { } tls { private_key_file = ${raddbdir}/certs/radius1.uni.opole.pl.key certificate_file = ${raddbdir}/certs/radius1.uni.opole.pl.pem CA_path = ${raddbdir}/certs/ CA_file = ${raddbdir}/certs/ca.uni.opole.pl.pem dh_file = ${raddbdir}/certs/dh random_file = ${raddbdir}/certs/random fragment_size = 1024 check_cert_cn = %{User-Name} #check_crl = yes crl_dir = /etc/raddb/certs proxy_tunneled_request_as_eap = yes } peap { default_eap_type = mschapv2 } ttls { default_eap_type = md5 copy_request_to_tunnel = yes use_tunneled_reply = yes } mschapv2 { } } My wpa_supplicant.conf ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=0 eapol_version=1 fast_reauth=1 update_config=0 network={ ssid="eduroam" scan_ssid=1 proto=WPA key_mgmt=WPA-EAP pairwise=TKIP eap=TTLS identity="jsyrytczyk(a)uni.opole.pl" password="mycorrectpassword" ca_cert="/etc/wpa_supplicant/ca.uni.opole.pl.pem" phase2="auth=PAP" } My error: Ready to process requests. rad_recv: Access-Request packet from host 217.173.193.40:4347, id=89, length=205 User-Name = "jsyrytczyk(a)uni.opole.pl" Framed-MTU = 1400 Called-Station-Id = "0019.a9b5.3a01" Calling-Station-Id = "0002.7258.7f14" Cisco-AVPair = "ssid=eduroam" Service-Type = Login-User Message-Authenticator = 0x2e72d462f1fb588c9674049e6b61e580 EAP-Message = 0x0201001c016a7379727974637a796b40756e692e6f706f6c652e706c NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "461" NAS-Port = 461 NAS-IP-Address = 10.59.223.247 NAS-Identifier = "AP1242_eduroam_CI" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: Looking up realm "uni.opole.pl" for User-Name = "jsyrytczyk(a)uni.opole.pl" rlm_realm: Found realm "uni.opole.pl" rlm_realm: Proxying request from user jsyrytczyk to realm uni.opole.pl rlm_realm: Adding Realm = "uni.opole.pl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 461,Client-IP-Address = 217.173.193.40,NAS-IP-Address = 10.59.223.247,,User-Name = "jsyrytczyk(a)uni.opole.pl"' rlm_acct_unique: Acct-Unique-Session-ID = "0e208dc42b670eee". modcall[authorize]: module "acct_unique" returns ok for request 0 radius_xlat: 'jsyrytczyk(a)uni.opole.pl' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'jsyrytczyk(a)uni.opole.pl' modcall[authorize]: module "copy.user-name" returns ok for request 0 radius_xlat: '@.*$' rlm_attr_rewrite: Changed value for attribute Stripped-User-Name from 'jsyrytczyk(a)uni.opole.pl' to 'jsyrytczyk' modcall[authorize]: module "strip.user-name" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for jsyrytczyk(a)uni.opole.pl radius_xlat: '(&(objectClass=VirtualMailAccount) (mail=jsyrytczyk(a)uni.opole.pl)(accountActive=TRUE)(delete=FALSE))' radius_xlat: 'o=hosting,dc=uo,dc=opole,dc=pl' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 217.173.193.3:389, authentication 0 rlm_ldap: bind as cn=dovecot,dc=uo,dc=opole,dc=pl/hereismyldapdatabasepass to 217.173.193.3:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in o=hosting,dc=uo,dc=opole,dc=pl, with filter (&(objectClass=VirtualMailAccount)(mail=jsyrytczyk(a)uni.opole.pl) (accountActive=TRUE)(delete=FALSE)) rlm_ldap: checking if remote access for jsyrytczyk(a)uni.opole.pl is allowed by dialupAccess rlm_ldap: Password header not found in password {CRYPT}hash for user jsyrytczyk(a)uni.opole.pl rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "{CRYPT}hash" rlm_ldap: looking for reply items in directory... rlm_ldap: user jsyrytczyk(a)uni.opole.pl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 rlm_eap: EAP packet type response id 1 length 28 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 0 modcall: leaving group authenticate (returns handled) for request 0 Sending Access-Challenge of id 89 to 217.173.193.40 port 4347 EAP-Message = 0x010200311a0102002c10124897b1c632a0dd9edec5d89e10c5bc6a7379727974637a796b40756e692e6f706f6c652e706c Message-Authenticator = 0x00000000000000000000000000000000 State = 0xcdc132917ef520c9537ed9cbb1481929 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 217.173.193.40:4347, id=90, length=201 User-Name = "jsyrytczyk(a)uni.opole.pl" Framed-MTU = 1400 Called-Station-Id = "0019.a9b5.3a01" Calling-Station-Id = "0002.7258.7f14" Cisco-AVPair = "ssid=eduroam" Service-Type = Login-User Message-Authenticator = 0x1290a4533963f73ed925dec295cbefdf EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "461" NAS-Port = 461 State = 0xcdc132917ef520c9537ed9cbb1481929 NAS-IP-Address = 10.59.223.247 NAS-Identifier = "AP1242_eduroam_CI" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 rlm_realm: Looking up realm "uni.opole.pl" for User-Name = "jsyrytczyk(a)uni.opole.pl" rlm_realm: Found realm "uni.opole.pl" rlm_realm: Proxying request from user jsyrytczyk to realm uni.opole.pl rlm_realm: Adding Realm = "uni.opole.pl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 1 rlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 461,Client-IP-Address = 217.173.193.40,NAS-IP-Address = 10.59.223.247,,User-Name = "jsyrytczyk(a)uni.opole.pl"' rlm_acct_unique: Acct-Unique-Session-ID = "0e208dc42b670eee". modcall[authorize]: module "acct_unique" returns ok for request 1 radius_xlat: 'jsyrytczyk(a)uni.opole.pl' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'jsyrytczyk(a)uni.opole.pl' modcall[authorize]: module "copy.user-name" returns ok for request 1 radius_xlat: '@.*$' rlm_attr_rewrite: Changed value for attribute Stripped-User-Name from 'jsyrytczyk(a)uni.opole.pl' to 'jsyrytczyk' modcall[authorize]: module "strip.user-name" returns ok for request 1 rlm_ldap: - authorize rlm_ldap: performing user authorization for jsyrytczyk(a)uni.opole.pl radius_xlat: '(&(objectClass=VirtualMailAccount) (mail=jsyrytczyk(a)uni.opole.pl)(accountActive=TRUE)(delete=FALSE))' radius_xlat: 'o=hosting,dc=uo,dc=opole,dc=pl' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=hosting,dc=uo,dc=opole,dc=pl, with filter (&(objectClass=VirtualMailAccount)(mail=jsyrytczyk(a)uni.opole.pl) (accountActive=TRUE)(delete=FALSE)) rlm_ldap: checking if remote access for jsyrytczyk(a)uni.opole.pl is allowed by dialupAccess rlm_ldap: Password header not found in password {CRYPT}hashed for user jsyrytczyk(a)uni.opole.pl rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "{CRYPT}hashed" rlm_ldap: looking for reply items in directory... rlm_ldap: user jsyrytczyk(a)uni.opole.pl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 1 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 modcall[authorize]: module "files" returns notfound for request 1 modcall: leaving group authorize (returns updated) for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: Request found, released from the list rlm_eap: EAP NAK rlm_eap: EAP-NAK asked for EAP-Type/ttls rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: leaving group authenticate (returns handled) for request 1 Sending Access-Challenge of id 90 to 217.173.193.40 port 4347 EAP-Message = 0x010300061520 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf7496deb8d0573d9ee6c13a2b51ba8bc Finished request 1 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 217.173.193.40:4347, id=91, length=201 User-Name = "jsyrytczyk(a)uni.opole.pl" Framed-MTU = 1400 Called-Station-Id = "0019.a9b5.3a01" Calling-Station-Id = "0002.7258.7f14" Cisco-AVPair = "ssid=eduroam" Service-Type = Login-User Message-Authenticator = 0xed18d300aabdabba014117f1b2bca527 EAP-Message = 0x020200060315 NAS-Port-Type = Wireless-802.11 Cisco-NAS-Port = "461" NAS-Port = 461 State = 0xf7496deb8d0573d9ee6c13a2b51ba8bc NAS-IP-Address = 10.59.223.247 NAS-Identifier = "AP1242_eduroam_CI" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 2 modcall[authorize]: module "preprocess" returns ok for request 2 rlm_realm: Looking up realm "uni.opole.pl" for User-Name = "jsyrytczyk(a)uni.opole.pl" rlm_realm: Found realm "uni.opole.pl" rlm_realm: Proxying request from user jsyrytczyk to realm uni.opole.pl rlm_realm: Adding Realm = "uni.opole.pl" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 2 rlm_acct_unique: WARNING: Attribute Acct-Session-Id was not found in request, unique ID MAY be inconsistent rlm_acct_unique: Hashing 'NAS-Port = 461,Client-IP-Address = 217.173.193.40,NAS-IP-Address = 10.59.223.247,,User-Name = "jsyrytczyk(a)uni.opole.pl"' rlm_acct_unique: Acct-Unique-Session-ID = "0e208dc42b670eee". modcall[authorize]: module "acct_unique" returns ok for request 2 radius_xlat: 'jsyrytczyk(a)uni.opole.pl' rlm_attr_rewrite: Added attribute Stripped-User-Name with value 'jsyrytczyk(a)uni.opole.pl' modcall[authorize]: module "copy.user-name" returns ok for request 2 radius_xlat: '@.*$' rlm_attr_rewrite: Changed value for attribute Stripped-User-Name from 'jsyrytczyk(a)uni.opole.pl' to 'jsyrytczyk' modcall[authorize]: module "strip.user-name" returns ok for request 2 rlm_ldap: - authorize rlm_ldap: performing user authorization for jsyrytczyk(a)uni.opole.pl radius_xlat: '(&(objectClass=VirtualMailAccount) (mail=jsyrytczyk(a)uni.opole.pl)(accountActive=TRUE)(delete=FALSE))' radius_xlat: 'o=hosting,dc=uo,dc=opole,dc=pl' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=hosting,dc=uo,dc=opole,dc=pl, with filter (&(objectClass=VirtualMailAccount)(mail=jsyrytczyk(a)uni.opole.pl) (accountActive=TRUE)(delete=FALSE)) rlm_ldap: checking if remote access for jsyrytczyk(a)uni.opole.pl is allowed by dialupAccess rlm_ldap: Password header not found in password {CRYPT}hashed for user jsyrytczyk(a)uni.opole.pl rlm_ldap: looking for check items in directory... rlm_ldap: Adding userPassword as User-Password == "{CRYPT}hashed" rlm_ldap: looking for reply items in directory... rlm_ldap: user jsyrytczyk(a)uni.opole.pl authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 2 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 2 modcall[authorize]: module "files" returns notfound for request 2 modcall: leaving group authorize (returns updated) for request 2 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 2 rlm_eap: Request not found in the list rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 2 modcall: leaving group authenticate (returns invalid) for request 2 auth: Failed to validate the user. Login incorrect: [jsyrytczyk(a)uni.opole.pl] (from client UniNet port 461 cli 0002.7258.7f14) Delaying request 2 for 1 seconds Finished request 2 Going to the next request Waking up in 6 seconds... Freeradius writes my password is incorrect, but of course it is correct. It also complains about bad {crypt} header, but it performs well with it when using Windows. Anyway, when I pass correct header or change it to any other in radiusd.conf it changes nothing. I substituted all passwords of course. -- Syrytczyk Janusz - Administrator serwerów Centrum Informatyczne Uniwersytetu Opolskiego Nr telefonu: +48 77 452-70-91 E-mail: jsyrytczyk(a)uni.opole.pl -- Syrytczyk Janusz - Administrator serwerów Centrum Informatyczne Uniwersytetu Opolskiego Nr telefonu: +48 77 452-70-91 E-mail: jsyrytczyk(a)uni.opole.pl

4 4

FreeRADIUS and iODBC
by Josh Howlett 24 Sep '07

24 Sep '07

You must use a DSN of 'radius' in odbc.ini when using the iodbc SQL module. You can't use any other name. I have this working against MSSQL. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

2 1

EAP fragment size clarification needed
by Stefan Winter 24 Sep '07

24 Sep '07

Hi, eap.conf states: # This can never exceed the size of a RADIUS # packet (4096 bytes), and is preferably half # that, to accomodate other attributes in # RADIUS packet. On most APs the MAX packet # length is configured between 1500 - 1600 # In these cases, fragment size should be # 1024 or less. # # fragment_size = 1024 I wonder what the sentence about MAX packet size on APs is about. Is it their maximum allowed length of a RADIUS packet? Frankly, that would be quite stupid because packets can legitimately be much larger than that. (-> RADIUS implementation problem on AP) If it is about fragmented and re-assembled UDP: that would mean those APs can't re-assemble UDP properly (-> again implementation problem) finally, if it's about the max layer-2 size for the EAP conversation: then a fragment size of 1500 would be okay on a 1500 MTU on layer 2 (and if one only authenticates 802.3 LANs and 802.11 WLANs, both of them handle 1500 just fine). So I wonder, why does anything impose specifically 1500-1600 on the AP side, and why does that imply 1024 is an upper bound for the fragment size? That question doesn't come from thin air: higher fragment size reduces amount of round-trips for an EAP auth (even though it generates more UDP packets on the wire, sure). And with EAP-TLS, there are supplicants that fill their 1500 on the layer 2 unconfigurably, and it appears to work well - if there's no firewall that discards the second fragment of the RADIUS message. So if the above holds true, I would much rather set fragment size to 1500, and fix any upcoming impl problems that have nothing to do with EAP frag size, rather than yield with my frag size. Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 2