- Freeradius-Users - lists.freeradius.org

RE: RFC 3579 and Access-Accepts
by Josh Howlett 19 Sep '07

19 Sep '07

Hi Stefan, > Whereas RFC 3579 , chapter 2.6.5 says: > "An EAP-Message/EAP-Request/Notification SHOULD NOT be > included within an Access-Accept or Access-Reject packet." I think this is a case of mis-reading the (confusing?) notation used by the RFC. What the RFC is saying is that you are not permitted to include a Notification within an EAP-Request within an EAP-Message within an Access-Accept. It's not saying you're not allowed to include an EAP-Message attribute _per se_. FWIW, I don't think it would be possible to implement a compliant EAP method without including an EAP-Message in the Access-Acccept; you need to return an EAP-Success or EAP-Failure, and IIRC you can't do that in an Access-Challenge. josh. JANET(UK) is a trading name of The JNT Association, a company limited by guarantee which is registered in England under No. 2881024 and whose Registered Office is at Lumen House, Library Avenue, Harwell Science and Innovation Campus, Didcot, Oxon OX11 0SG

1 0

RFC 3579 and Access-Accepts
by Stefan Winter 19 Sep '07

19 Sep '07

Hello, it seems that FreeRADIUS is sending an EAP-Message fragment along with its Access-Accepts, as in: Packet-Type = Access-Accept Wed Sep 19 11:59:25 2007 MS-MPPE-Recv-Key = stuff MS-MPPE-Send-Key = morestuff EAP-Message = 0x03070004 Message-Authenticator = 0x593773a711f50bd8b4ce98434a7e1590 User-Name = "anonymous(a)restena.lu" Proxy-State = 0x323039 Whereas RFC 3579 , chapter 2.6.5 says: "An EAP-Message/EAP-Request/Notification SHOULD NOT be included within an Access-Accept or Access-Reject packet." This is now the second RADIUS implementation I see that behaves like that - is there a reason for the EAP-Message and something wrong with 3579, or is that SHOULD NOT just ignored by most? Greetings, Stefan Winter -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 3

Re: Denying user from authentication
by anoop_c＠sifycorp.com 19 Sep '07

19 Sep '07

Hi Please explain brief about certificate revocation process as i am new to it.I have used openssl for creating certificates, Regards Anoop > Message: 3 > Date: Wed, 19 Sep 2007 10:36:18 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <QH9ZAN8X.1190194578.4188440.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > That won\'t work with EAP-TLS. As you found out. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 19/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> pi?e: > > >HI > > Thank you for the response.But as per users file configuration it > should deny the user if i include that user name-reject file.Do i need > to do any config for this to work. > > > >Regards > >Anoop > > > > > >> Message: 3 > >> Date: Tue, 18 Sep 2007 11:30:53 +0100 > >> From: <tnt(a)kalik.co.yu> > >> Subject: Re: Denying user from authentication > >> To: \"FreeRadius users mailing list\" > >> <freeradius-users(a)lists.freeradius.org> > >> Message-ID: <PsdtHepQ.1190111453.3996530.tnt(a)kalik.co.yu> > >> Content-Type: text/plain; charset=ISO-8859-2 > >> > >> Revoke the certificate. > >> > >> Ivan Kalik > >> Kalik Informatika ISP > >> > >> > >> Dana 18/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> > pi?e: > >> > >> >Hi > >> > I am using EAP_TLS authentication with free radius 1.1.7 .The > >> authentication is a certificate based one. > >> > > >> > I want to reject one user .I have done config in users file > >> > > >> > anoop07 Auth-Type := Reject > >> > Reply-Message = \"Your account has been disabled.\" > >> > > >> >Stll the user autheticates.How can i prevent user like this? > >> > > >> >Regards > >> >Anoop > >> > > >> > > >> > > >> > > >> > >> > >>

2 1

Denying user from authentication
by anoop_c＠sifycorp.com 19 Sep '07

19 Sep '07

HI Thank you for the response.But as per users file configuration it should deny the user if i include that user name-reject file.Do i need to do any config for this to work. Regards Anoop > Message: 3 > Date: Tue, 18 Sep 2007 11:30:53 +0100 > From: <tnt(a)kalik.co.yu> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: <PsdtHepQ.1190111453.3996530.tnt(a)kalik.co.yu> > Content-Type: text/plain; charset=ISO-8859-2 > > Revoke the certificate. > > Ivan Kalik > Kalik Informatika ISP > > > Dana 18/9/2007, \"anoop_c(a)sifycorp.com\" <anoop_c(a)sifycorp.com> pi?e: > > >Hi > > I am using EAP_TLS authentication with free radius 1.1.7 .The > authentication is a certificate based one. > > > > I want to reject one user .I have done config in users file > > > > anoop07 Auth-Type := Reject > > Reply-Message = \"Your account has been disabled.\" > > > >Stll the user autheticates.How can i prevent user like this? > > > >Regards > >Anoop > > > > > > > > > > > > ------------------------------ > > Message: 4 > Date: Tue, 18 Sep 2007 14:12:50 +0200 > From: inverse <inverse(a)ngi.it> > Subject: Re: Denying user from authentication > To: \"FreeRadius users mailing list\" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <32deb3e30709180512k2361fb99x10f3e4693930f899(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1 > > and make sure to use check_crl = yes in eap.conf > > On 9/18/07, tnt(a)kalik.co.yu <tnt(a)kalik.co.yu> wrote: > > Revoke the certificate. > > > ------------------------------ >

2 1

Controlling access to my Wireless network.
by Kent Thomas 19 Sep '07

19 Sep '07

Hello all, I'm looking for a simple way to protect access to my wireless network. I'm seeing a lot of old documentation on how to use EAP-TLS to protect the wireless network. I've found lots of old documentation on how to setup WPA Enterprise. I would like some updated docuentation on how to do this. I have a couple SonicWall SonicPoint devices that have the capability to do WPA Enterprise or WPA2 enterprise or both. I would like to be able to have a user attempt to join my wireless network, but be presented with the request for Username and Password. From there I would like to be able to have their connection authenticated and then allow them on. No authentication, no getting on. Securing the wireless signal is not the primary focus here. Securing the access to the network is. Is there a way to do this? I have FreeRadius 1.1.7 installed and working and currently will authenticate against my ldap server. Thank you for lending a hand to a newby here. Kent

5 8

Radrelay with multiple accounting files, radrelay via NFS
by Adam Bultman 19 Sep '07

19 Sep '07

Good morning, freeradius users. I have 2.5 questions. 1. Can radrelay be used with multiple accounting directories? I have multiple (7) directories with files I need to be watching with radrelay. I haven't been able to get radrelay to work properly when I use "-a /accounting-dir/" multiple times at the command line. 1.5: Can one use wildcards for the detailfile? I have two RADIUS servers, and each writes to it's own file (detail-radius1, detail-radius2) 2. On linux, radrelay doesn't appear to agree with NFS. I tried to host my detail files via NFS, and radrelay would 'run', but not actively process records. The radrelay debug would tell me it was "processing records", but would never send any packets. Meanwhile, the detail file it was supposed to be watching is ballooning with records. 2.5. Note: We have a solaris server where radrelay runs fine via NFS. I'm not too big a newbie to freeradius, but I'm trying to avoid running one process per NAS I need to monitor, and have my radius detail files split (some detail files via NFS, other detail files locally on the machine.) I've read man pages and googled, but haven't found answers. I *do* need to store my files via NFS, for accounting reasons, and doing copies to an NFS mount isn't really an option, either. Any help would is welcomed. Adam

2 1

Intel Proset Wireless Client does not process RFC3580 Attributes.
by Terry Pelley 18 Sep '07

18 Sep '07

FreeRADIUS Version 1.1.3-r0.1.2 (Upgrade to 1.1.7 is Pending) I am running FreeRADIUS to authenticate wireless users on a bunch of Cisco AP1231's. My wireless supplicants are running a combination of the standard Windows XP client which works fine and the Intel Proset Client which is causing problems. The Radius setup is for PEAP/MSChapv2 and each user has the following attributes assigned. Tunnel-Type = "VLAN" Tunnel-Medium-Type = "IEEE-802" Tunnel-Private-Group-ID = "X" (Where X is the assigned VLAN Number) The Proset Clients do manage to eventually authenticate, but the above attributes do not appear to get processed. I think this is happening because the Proset Client sends the User-Name as "anonymous" and as there is no "anonymous" user defined, the attributes do not get applied. How do I get the User-Name to be sent correctly? Thanks in advance. Terry Pelley Network Analyst Business and Learning Technologies Ottawa-Carleton District School Board terry.pelley(a)ocdsb.ca

2 2

Denying user from authentication
by anoop_c＠sifycorp.com 18 Sep '07

18 Sep '07

Hi I am using EAP_TLS authentication with free radius 1.1.7 .The authentication is a certificate based one. I want to reject one user .I have done config in users file anoop07 Auth-Type := Reject Reply-Message = \"Your account has been disabled.\" Stll the user autheticates.How can i prevent user like this? Regards Anoop

3 2

Authentication failure via PAP
by Thomas Schmitz 18 Sep '07

18 Sep '07

Hi, I'm using Freeradius 1.1.6 inside a Solaris 10 zone and compiled it from vanilla sources. I configured rlm_ldap since the usernames and cleartext-passwords are stored in an LDAP directory and it works just fine for applications like Cisco-VPN or 802.1X EAP-TTLS. Now I wanted to set up the Captive Portal of pfsense/m0n0wall to authenticate against radius, which is using PAP for password transmission but authentication always fails even if I triple-check the entered user credentials. The freeradius log always says: Auth: Login incorrect (rlm_ldap: Bind as user failed): [my_username] (from client pfsensebox port 1 cli 00:17:f2:xx:yy:zz) Of course I also checked if the radius client is using the correct secret. I set auto_headers to "yes" as it is suggested in the rlm_pap manpage and put pap at the end of the authorize section. I also included an excerpt of my radiusd.conf ---begin radiusd.conf--- modules { pap { auto_header = yes } ldap { server = "ldapserver.mydomain.com" basedn = "ou=people,o=my organization,c=de" filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" start_tls = no access_attr = "uid" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_attribute = userPassword timeout = 4 timelimit = 3 net_timeout = 1 } } authorize { auth_log chap mschap suffix eap ldap files daily pap } authenticate { pap chap mschap ldap eap } ---end radiusd.conf--- Here is an output of radiusd -X: ---begin radiusd -X output--- rad_recv: Access-Request packet from host 111.222.333.444:51087, id=255, length=131 NAS-IP-Address = 111.222.333.444 NAS-Identifier = "pfsense.local" User-Name = "my_username" User-Password = "\301q\202\355g\264g)N\265\315\311\374\205i" Service-Type = Login-User NAS-Port-Type = Ethernet NAS-Port = 1 Framed-IP-Address = 192.168.23.200 Called-Station-Id = "00:01:02:xx:yy:zz" Calling-Station-Id = "00:17:f2:aa:bb:cc" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 radius_xlat: '/opt/radiusd/var/log//radacct/auth-detail-200709' rlm_detail: /opt/radiusd/var/log//radacct/auth-detail-%Y%m expands to /opt/radiusd/var/log//radacct/auth-detail-200709 modcall[authorize]: module "auth_log" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "my_username", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "my_username" rlm_realm: Proxying request from user my_username to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for my_username radius_xlat: '(uid=my_username)' radius_xlat: 'ou=people,o=my organization,c=de' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to directory.fernuni-hagen.de:389, authentication 0 rlm_ldap: bind as / to directory.fernuni-hagen.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=people,o=my organization,c=de, with filter (uid=my_username) rlm_ldap: checking if remote access for my_username is allowed by uid rlm_ldap: looking for check items in directory... rlm_ldap: Adding uid as User-Name, value my_username & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Setting Auth-Type = ldap rlm_ldap: user my_username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "files" returns notfound for request 0 rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair modcall[authorize]: module "daily" returns noop for request 0 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type ldap auth: type "ldap" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "my_username" with password "Áq?íg ´g)NµÍÉü?i" rlm_ldap: user DN: uid=my_username,ou=People,o=my organization,c=de rlm_ldap: (re)connect to directory.fernuni-hagen.de:389, authentication 1 rlm_ldap: bind as uid=my_username,ou=People,o=my organization,c=de/Áq?íg´g)NµÍÉü?i to directory.fernuni-hagen.de:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap" returns reject for request 0 modcall: leaving group authenticate (returns reject) for request 0 auth: Failed to validate the user. Login incorrect (rlm_ldap: Bind as user failed): [my_username] (from client pfsensebox port 1 cli 00:17:f2:aa:bb:cc) WARNING: Unprintable characters in the password. ? Double-check the shared secret on the server and the NAS! ---end radiusd -X output--- What seems very curious to me is that my password, though delivered in cleartext, seems broken since the password in the following line is actually not the real password: rlm_ldap: login attempt by "my_username" with password "Áq?íg ´g)NµÍÉü?i" Is it the client that does those nasty things or is my freeradius just misconfigured? How can I get it to work? Thanks in advance, Thomas

2 1

Trouble configuring SQL data store for users (second attempt)
by Bill Shaver 18 Sep '07

18 Sep '07

Please forgive the duplicate post. I posted this a few days back and didn't see any response; thought I would give it just one more try. Thanks for any response. --Bill I have started to experiment with using mysql as the datastore for users and clients instead of the default file method for my relatively small installation. Right now my work is on a test system and all is working well, with one exception: a user that is a member of two or more groups. Based on all I have read, this last thing should be very basic. If I put the user in only groupA (in the usergroup table), the test works great. If I put user1 in only groupB, the test works great. When I put user1 in both groupA and groupB in the usergroup table it will only work against the first record of the two, the second record always returns a failure. I am sure this is probably something really stupid, but I just cannot see it. Any help would be appreciated. I have attatched table dumps, sample commands, and a debug trace. I hope it is helpful Thanks, --Bill FreeRadius version 1.0.1 MySQL version 4.1.20 vm # /usr/bin/radtest -d /etc/raddb kparr@cisi password \ localhost:1645 10 naspass will sucseed, while vm # /usr/bin/radtest -d /etc/raddb kparr@syst password \ localhost:1645 10 naspass fails, but should sucseed The following is a test data set to validate a variety of cases that we need to support in our environment. select * from radcheck into outfile '/tmp/f1'; -------------------------------------------------------- id username attribute op value -- -------- --------- -- ----- 1 bill Password == userpass 5 guest01 Auth-Type := Local 6 guest01 Password == password select * from radreply into outfile '/tmp/f4'; -------------------------------------------------------- id username attribute op value -- -------- --------- -- ----- 7 guest01 Class := OU=Wireless; 8 guest01 Fall-Through := No select * from radgroupcheck into outfile '/tmp/f2'; -------------------------------------------------------- id groupname attribute op value -- -------- --------- -- ----- 6 LocalUnix Auth-Type == System 7 LocalUnix Realm == Test 9 LdapCiscoAdm Password == password 10 LdapCiscoAdm Auth-Type == Local 11 LdapCiscoAdm Realm == cisi 12 LdapHpReho Realm == syst 13 LdapHpReho Auth-Type == Local 14 LdapHpReho Password == password 15 Rejected Auth-Type := Reject select * from radgroupreply into outfile '/tmp/f3'; -------------------------------------------------------- id groupname attribute op value -- -------- --------- -- ----- 8 LocalUnix Service-Type = Login 0 9 LdapCiscoAdm Cisco-AVPair = shell:priv-lvl=15 0 10 LdapCiscoAdm Class := OU=cis; 0 11 LdapCiscoAdm Fall-Through := Yes 0 12 LdapCiscoAdm Service-Type = 6 0 13 LdapHpReho Class := OU=Proj; 0 14 LdapHpReho Fall-Through := Yes 0 15 Rejected Fall-Through := No 0 17 Rejected Reply-Message := Account is locked out. 0 select * from usergroup into outfile '/tmp/f5'; -------------------------------------------------------- id username groupname -- -------- --------- 9 root LocalUnix 10 kparr LdapCiscoAdm 11 kchow LdapHpReho 12 jpage Rejected 13 kparr LdapHpReho 14 bshaver LdapCiscoAdm -------------------------------------------------------- vm # radiusd -x Starting - reading configuration files ... Module: Loaded exec Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP Module: Instantiated mschap (mschap) Module: Loaded System Module: Instantiated unix (unix) Module: Loaded eap rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap rlm_eap: Loaded and initialized type gtc rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess Module: Instantiated preprocess (preprocess) Module: Loaded realm Module: Instantiated realm (suffix) Module: Loaded files Module: Instantiated files (files) Module: Loaded SQL rlm_sql (sql): Driver rlm_sql_mysql (module rlm_sql_mysql) loaded and linked rlm_sql (sql): Attempting to connect to root@localhost:/radius rlm_sql (sql): starting 0 rlm_sql (sql): Attempting to connect rlm_sql_mysql #0 rlm_sql_mysql: Starting connect to MySQL server for #0 rlm_sql (sql): Connected new DB handle, #0 rlm_sql (sql): starting 1 rlm_sql (sql): Attempting to connect rlm_sql_mysql #1 rlm_sql_mysql: Starting connect to MySQL server for #1 rlm_sql (sql): Connected new DB handle, #1 rlm_sql (sql): starting 2 rlm_sql (sql): Attempting to connect rlm_sql_mysql #2 rlm_sql_mysql: Starting connect to MySQL server for #2 rlm_sql (sql): Connected new DB handle, #2 rlm_sql (sql): starting 3 rlm_sql (sql): Attempting to connect rlm_sql_mysql #3 rlm_sql_mysql: Starting connect to MySQL server for #3 rlm_sql (sql): Connected new DB handle, #3 rlm_sql (sql): starting 4 rlm_sql (sql): Attempting to connect rlm_sql_mysql #4 rlm_sql_mysql: Starting connect to MySQL server for #4 rlm_sql (sql): Connected new DB handle, #4 Module: Instantiated sql (sql) Module: Loaded Acct-Unique-Session-Id Module: Instantiated acct_unique (acct_unique) Module: Loaded detail Module: Instantiated detail (detail) Module: Loaded radutmp Module: Instantiated radutmp (radutmp) Initializing the thread pool... Listening on authentication *:1645 Listening on accounting *:1646 Listening on proxy *:1647 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32773, id=23, length=62 User-Name = "kparr@cisi" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): User kparr not found in radcheck rlm_sql (sql): Released sql socket id: 4 Sending Access-Accept of id 23 to 127.0.0.1:32773 Cisco-AVPair = "shell:priv-lvl=15" Class := 0x4f553d6369733b Service-Type = Administrative-User rad_recv: Access-Request packet from host 127.0.0.1:32773, id=27, length=62 User-Name = "kparr@syst" User-Password = "password" NAS-IP-Address = 255.255.255.255 NAS-Port = 10 rlm_sql (sql): Reserving sql socket id: 3 rlm_sql (sql): User kparr not found in radcheck rlm_sql (sql): No matching entry in the database for request from user [kparr] rlm_sql (sql): Released sql socket id: 3 rad_recv: Access-Request packet from host 127.0.0.1:32773, id=27, length=62 Sending Access-Reject of id 27 to 127.0.0.1:32773

2 1