- Freeradius-Users - lists.freeradius.org

1.1.7 sqlippool %{SQL-User-Name}
by Hugh Messenger 19 Jul '07

19 Jul '07

Peter . as per your postgres 1.1.7 sqlippool queries, I changed the MySQL ones to use %{SQL-User-Name} instead of %{User-Name} . only it doesn't seem to pick up a value, so the UserName is coming up blank in the radippool table. Example: sqlippool_expand: 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE NASIPAddress = '%{Nas-IP-Address}' AND pool_key = '%{Calling-Station-Id}' AND UserName = '%{SQL-User-Name}' AND CallingStationId = '%{Calling-Station-Id}' AND FramedIPAddress = '%{Framed-IP-Address}'' radius_xlat: 'UPDATE radippool SET expiry_time = NOW() + INTERVAL 3600 SECOND WHERE NASIPAddress = '216.108.219.36' AND pool_key = '00:14:6C:37:16:49' AND UserName = '' AND CallingStationId = '00:14:6C:37:16:49' AND FramedIPAddress = '172.168.124.120'' This happens on both 1.1.6 and 1.1.7. Should that be something like %{control:SQL-User-Name} ? My apologies - I don't know how I missed this when testing yesterday. I guess it returned an IP just fine, so I didn't actually look at what it was doing too closely! -- hugh

3 14

Re: Freeradius-Users Digest, Vol 27, Issue 121
by ashish verma 19 Jul '07

19 Jul '07

Hi, I read the document. I think i put my question in a wrong way. Let me put it in a different way. I dont want the user to go directly in priv mode. through priv level = 15 we can direclty go into priv level right. what i want is first the user get into user level and then with another password in level 2. (not with enable password)..it should be through RADIUS server. I hope it makes it easy. On 7/19/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: mod_auth_radius (Nick Owen) > 2. Re: Quirky question about rewriting usernames (Cliff Cole) > 3. "Time-out" Problem with Huntgroups in conjunction with MYSQL > Backend (thomas(a)buddybase.at) > 4. Level 2 authentication with RADIUS. (ashish verma) > 5. Re: Level 2 authentication with RADIUS. (Stefan Winter) > 6. Re: Level 2 authentication with RADIUS. (Stefan Winter) > 7. Re: TLS cant connect ldap+freeradius+novell > (Reimer Karlsen-Masur, DFN-CERT) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 19 Jul 2007 09:14:28 -0400 > From: "Nick Owen" <nowen(a)wikidsystems.com> > Subject: Re: mod_auth_radius > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <415a28910707190614v586aceb1re81767278eb9fccf(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 7/19/07, Rascher, Markus <markus.mr.rascher(a)siemens.com> wrote: > > > > > > Hi All, > > > > is there a tutorial how to install mod_auth_radius on an apache 2.xxserver? > > The howto on the freeradius webpage is a little bit deprecated i guess. > > i get an error when starting the apache server after installing > > mod_auth_radius: > > > > # service httpd start > > Starting httpd: httpd: Syntax error on line 205 of > > /etc/httpd/conf/httpd.conf: Cannot load > > /usr/lib/httpd/modules/mod_auth_radius-2.0.so into server: > > /usr/lib/httpd/modules/mod_auth_radius-2.0.so: undefined > > symbol: ap_snprintf > > [FAILED] > > You might try mod_auth_xradius. I have done a couple of apache + > radius + WiKID 2FA docs that might help: > > http://www.wikidsystems.com/documentation/howtos/how-to-add-two-factor-auth… > > http://www.howtoforge.com/apache_radius_two_factor_authentication > > The latter is more recent. > > HTH, > > nick > > -- > Nick Owen > WiKID Systems, Inc. > 404.962.8983 > http://www.wikidsystems.com > Commercial/Open Source Two-Factor Authentication > > > ------------------------------ > > Message: 2 > Date: Thu, 19 Jul 2007 09:35:13 -0400 > From: "Cliff Cole" <clifflcole(a)gmail.com> > Subject: Re: Quirky question about rewriting usernames > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Message-ID: > <5da254220707190635u50d33d86sb39bfbb7250c7a12(a)mail.gmail.com> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Thanks for the reply. I'm new to free radius and have been > overwhelmed with documentation the past few days. Let me explain in > some logic and maybe I can make some sense as to what I'm trying to > do. > > User authentication comes from "NAS A" > > IF the username does not have @domain.com and NAS = "NAS A" > THEN append @domain.com > > IF the username has @domain.com and NAS = "NAS A" > THEN continue with username as is. > > Hope this helps to clear up what I'm trying to do. I appologize for > not being very clear. > > Thanks > > Cliff > > > > On 7/19/07, Pshem Kowalczyk <pshem.k(a)gmail.com> wrote: > > Hi > > > > On 19/07/07, Cliff Cole <clifflcole(a)gmail.com> wrote: > > > Hello all. > > > > > > Here is my issue. This is very weird and would only affect one NAS. > > > I'm not sure freeradius is capable of this. I want a username that > > > comes in to check for an @domainname. If the domainname is there I > > > want it to be stripped and added back later. If the domainname is not > > > there I'd like it to continue and have to domainname added later in > > > the authentication process. I hope this makes sense and any help is > > > appreciated > > > > What do you mean by 'later' you can definitely check for the presence > > of domain, you can strip it and add it again. you just have to define > > the flow. rlm_attr will be of help to you (for both stripping and > > adding). > > > > kind regards > > Pshem > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > ------------------------------ > > Message: 3 > Date: Thu, 19 Jul 2007 15:38:54 +0200 > From: thomas(a)buddybase.at > Subject: "Time-out" Problem with Huntgroups in conjunction with MYSQL > Backend > To: freeradius-users(a)lists.freeradius.org > Message-ID: <20070719153854.9aj0e3hdesk04sw8(a)webmail.buddybase.at> > Content-Type: text/plain; charset=ISO-8859-1; DelSp="Yes"; > format="flowed" > > Hello FR users, > > I am running FreeRadius 1.1.3 together with MySQL 5.0.27 > I use huntgroups to allow access to specific devices only to certain users > belonging to a certain group (I use huntgroups since "I" didnt find a way > to do it via MySQL) > I have the following issue: > When for a longer period (e.g. over night) no one logs into one of the > devices (so the radius server sits idle), it happens that the first time > in > the morning someone tries to login he fails because FR rejects the Request > with "invalid user" - only after 3 or 4 tries the login-attempt is > successfull > The reason seems to be, that after such a "long" dormant period, when the > first RADIUS-request(s) arrive, FR has to re-connect to the MySQL DB to > query the user's group-membership > Since this re-connect takes "too long" the query returns "Not found" and > the user is rejected as "unknown" > > Here is what you see in the radius.log file: > Tue Jul 17 08:05:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #9 > Tue Jul 17 08:05:16 2007 : Error: rlm_sql (sql): failed after re-connect > Tue Jul 17 08:05:16 2007 : Auth: No huntgroup access: [xxx] (from client > ATWRE22e7601 port 1 cli 10.0.0.31) > Tue Jul 17 08:05:16 2007 : Auth: Invalid user: [xxx] (from client > ATWRE22e7601 port 1 cli 10.0.0.31) > Tue Jul 17 08:05:25 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #8 > Tue Jul 17 08:05:25 2007 : Error: rlm_sql (sql): failed after re-connect > Tue Jul 17 08:05:25 2007 : Auth: No huntgroup access: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:05:25 2007 : Auth: Invalid user: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:05:38 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #7 > Tue Jul 17 08:05:38 2007 : Error: rlm_sql (sql): failed after re-connect > Tue Jul 17 08:05:38 2007 : Auth: No huntgroup access: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:05:38 2007 : Auth: Invalid user: [xxx] (from client > ATWRE22e7601 port 0) > Tue Jul 17 08:06:00 2007 : Info: rlm_sql_mysql: Starting connect to MySQL > server for #6 > Tue Jul 17 08:06:00 2007 : Auth: Login OK: [xxx] (from client ATWRE22b7201 > port 2 cli 10.0.0.31) > > Hope the logfile is sufficient, otherwise I would have to let FR run in > debug-mode over night.... > > The funny thing is, that this problem doesn't occure when all entries in > the huntgroups file are "commented out" > > So my question is, is there a config parameter to tell FR to "wait" a bit > longer in the preprocess module (I assume) for the MYSQL query to deliver > its answer? > > thanks alot > regards > thomas pudil > > > > > > ------------------------------ > > Message: 4 > Date: Thu, 19 Jul 2007 19:11:35 +0530 > From: "ashish verma" <ashish.scit(a)gmail.com> > Subject: Level 2 authentication with RADIUS. > To: freeradius-users(a)lists.freeradius.org > Message-ID: > <11b554120707190641g6abce7b3o2535671040dc5327(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi all, > I am new to the list and for RADIUS too so i might ask some repetitive > questions. > > Here is my question: > Can we have level 2 (enable) authentication too with Radius server as we > have for level 1(user level)? > > If yes, can someone provide me some documentation. I tried to search for > it > but couldnt find any. > > Thanks in advance, > Ashish >

2 1

"Time-out" Problem with Huntgroups in conjunction with MYSQL Backend
by thomas＠buddybase.at 19 Jul '07

19 Jul '07

Hello FR users, I am running FreeRadius 1.1.3 together with MySQL 5.0.27 I use huntgroups to allow access to specific devices only to certain users belonging to a certain group (I use huntgroups since "I" didnt find a way to do it via MySQL) I have the following issue: When for a longer period (e.g. over night) no one logs into one of the devices (so the radius server sits idle), it happens that the first time in the morning someone tries to login he fails because FR rejects the Request with "invalid user" - only after 3 or 4 tries the login-attempt is successfull The reason seems to be, that after such a "long" dormant period, when the first RADIUS-request(s) arrive, FR has to re-connect to the MySQL DB to query the user's group-membership Since this re-connect takes "too long" the query returns "Not found" and the user is rejected as "unknown" Here is what you see in the radius.log file: Tue Jul 17 08:05:16 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #9 Tue Jul 17 08:05:16 2007 : Error: rlm_sql (sql): failed after re-connect Tue Jul 17 08:05:16 2007 : Auth: No huntgroup access: [xxx] (from client ATWRE22e7601 port 1 cli 10.0.0.31) Tue Jul 17 08:05:16 2007 : Auth: Invalid user: [xxx] (from client ATWRE22e7601 port 1 cli 10.0.0.31) Tue Jul 17 08:05:25 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #8 Tue Jul 17 08:05:25 2007 : Error: rlm_sql (sql): failed after re-connect Tue Jul 17 08:05:25 2007 : Auth: No huntgroup access: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:05:25 2007 : Auth: Invalid user: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:05:38 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #7 Tue Jul 17 08:05:38 2007 : Error: rlm_sql (sql): failed after re-connect Tue Jul 17 08:05:38 2007 : Auth: No huntgroup access: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:05:38 2007 : Auth: Invalid user: [xxx] (from client ATWRE22e7601 port 0) Tue Jul 17 08:06:00 2007 : Info: rlm_sql_mysql: Starting connect to MySQL server for #6 Tue Jul 17 08:06:00 2007 : Auth: Login OK: [xxx] (from client ATWRE22b7201 port 2 cli 10.0.0.31) Hope the logfile is sufficient, otherwise I would have to let FR run in debug-mode over night.... The funny thing is, that this problem doesn't occure when all entries in the huntgroups file are "commented out" So my question is, is there a config parameter to tell FR to "wait" a bit longer in the preprocess module (I assume) for the MYSQL query to deliver its answer? thanks alot regards thomas pudil

2 1

Level 2 authentication with RADIUS.
by ashish verma 19 Jul '07

19 Jul '07

Hi all, I am new to the list and for RADIUS too so i might ask some repetitive questions. Here is my question: Can we have level 2 (enable) authentication too with Radius server as we have for level 1(user level)? If yes, can someone provide me some documentation. I tried to search for it but couldnt find any. Thanks in advance, Ashish

2 2

Re: Freeradius-Users Digest, Vol 27, Issue 116
by ashish verma 19 Jul '07

19 Jul '07

Hi all, Thanks for the reply. i was just missing " ". Well another problem here.. i have defined a priv level 7 in the switch. ran the following commands. privilege configure level 7 snmp-server host privilege configure level 7 snmp-server enable privilege configure level 7 snmp-server privilege exec level 7 ping ! But still the user is able to run all the commands. here is my user file conf user Auth-Type :=Local, User-Password == "user" Service-Type = NAS-Prompt-User, Login-Service = ssh, Cisco-avpair = "Shell:priv-lvl=7" On 7/19/07, freeradius-users-request(a)lists.freeradius.org < freeradius-users-request(a)lists.freeradius.org> wrote: > > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Problem in EAP-TLS Authentication (Govardhana K N) > 2. Re: Quirky question about rewriting usernames (Pshem Kowalczyk) > 3. Support for Cisco (ashish verma) > 4. Re: Support for Cisco (tnt(a)kalik.co.yu) > 5. Re: Support for Cisco (Peter Nixon) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Thu, 19 Jul 2007 10:36:28 +0530 > From: "Govardhana K N" <govardhan.nagarajaiah(a)gmail.com> > Subject: Problem in EAP-TLS Authentication > To: FreeRadius <freeradius-users(a)lists.freeradius.org> > Message-ID: > <5f382300707182206k616c02f6ude7fb5e71976dbe9(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > > I was trying to configure EAP with TLS/TTlS. After enabling TLS/TTLS in " > eap.conf", I tried sending an Radius Access-Request with EAP-Identitye > response. The Server is crashing becoz of segmentation fault. The debug > lod > from the server is given below. > > > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > cheux301:/etc/freeradius# freeradius -X > Starting - reading configuration files ... > reread_config: reading radiusd.conf > Config: including file: /etc/freeradius/proxy.conf > Config: including file: /etc/freeradius/clients.conf > Config: including file: /etc/freeradius/snmp.conf > Config: including file: /etc/freeradius/eap.conf > Config: including file: /etc/freeradius/sql.conf > main: prefix = "/usr" > main: localstatedir = "/var" > main: logdir = "/var/log/freeradius" > main: libdir = "/usr/lib/freeradius:/usr/local/lib" > main: radacctdir = "/var/log/freeradius/radacct" > main: hostname_lookups = no > main: max_request_time = 30 > main: cleanup_delay = 5 > main: max_requests = 1024 > main: delete_blocked_requests = 0 > main: port = 0 > main: allow_core_dumps = no > main: log_stripped_names = yes > main: log_file = "/var/log/freeradius/radius.log" > main: log_auth = no > main: log_auth_badpass = no > main: log_auth_goodpass = no > main: pidfile = "/var/run/freeradius/freeradius.pid" > main: bind_address = 127.0.0.1 IP address [127.0.0.1] > main: user = "freerad" > main: group = "freerad" > main: usercollide = no > main: lower_user = "no" > main: lower_pass = "no" > main: nospace_user = "no" > main: nospace_pass = "no" > main: checkrad = "/usr/sbin/checkrad" > main: proxy_requests = no > proxy: retry_delay = 5 > proxy: retry_count = 3 > proxy: synchronous = no > proxy: default_fallback = yes > proxy: dead_time = 120 > proxy: post_proxy_authorize = no > proxy: wake_all_if_all_dead = no > security: max_attributes = 200 > security: reject_delay = 1 > security: status_server = no > main: debug_level = 0 > read_config_files: reading dictionary > read_config_files: reading naslist > Using deprecated naslist file. Support for this will go away soon. > read_config_files: reading clients > read_config_files: reading realms > radiusd: entering modules setup > Module: Library search path is /usr/lib/freeradius:/usr/local/lib > Module: Loaded exec > exec: wait = yes > exec: program = "(null)" > exec: input_pairs = "request" > exec: output_pairs = "(null)" > exec: packet_type = "(null)" > rlm_exec: Wait=yes but no output defined. Did you mean output=none? > Module: Instantiated exec (exec) > Module: Loaded expr > Module: Instantiated expr (expr) > Module: Loaded PAP > pap: encryption_scheme = "crypt" > Module: Instantiated pap (pap) > Module: Loaded CHAP > Module: Instantiated chap (chap) > Module: Loaded MS-CHAP > mschap: use_mppe = yes > mschap: require_encryption = yes > mschap: require_strong = yes > mschap: with_ntdomain_hack = no > mschap: passwd = "(null)" > mschap: ntlm_auth = "(null)" > Module: Instantiated mschap (mschap) > Module: Loaded System > unix: cache = no > unix: passwd = "/etc/passwd" > unix: shadow = "/etc/shadow" > unix: group = "/etc/group" > unix: radwtmp = "/var/log/freeradius/radwtmp" > unix: usegroup = no > unix: cache_reload = 600 > Module: Instantiated unix (unix) > Module: Loaded eap > eap: default_eap_type = "md5" > eap: timer_expire = 60 > eap: ignore_unknown_eap_types = no > eap: cisco_accounting_username_bug = no > rlm_eap: Loaded and initialized type md5 > rlm_eap: Loaded and initialized type leap > gtc: challenge = "Password: " > gtc: auth_type = "PAP" > rlm_eap: Loaded and initialized type gtc > tls: rsa_key_exchange = no > tls: dh_key_exchange = yes > tls: rsa_key_length = 512 > tls: dh_key_length = 512 > tls: verify_depth = 0 > tls: CA_path = "(null)" > tls: pem_file_type = yes > tls: private_key_file = "/etc/freeradius/certs/cert-srv.pem" > tls: certificate_file = "/etc/freeradius/certs/cert-srv.pem" > tls: CA_file = "/etc/freeradius/certs/demoCA/cacert.pem" > tls: private_key_password = "whatever" > tls: dh_file = "/etc/freeradius/certs/dh" > tls: random_file = "/etc/freeradius/certs/random" > tls: fragment_size = 1024 > tls: include_length = yes > tls: check_crl = yes > tls: check_cert_cn = "%{User-Name}" > tls: cipher_list = "DEFAULT" > tls: check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" > rlm_eap_tls: Loading the certificate file as a chain > rlm_eap: Loaded and initialized type tls > ttls: default_eap_type = "md5" > ttls: copy_request_to_tunnel = no > ttls: use_tunneled_reply = no > rlm_eap: Loaded and initialized type ttls > mschapv2: with_ntdomain_hack = no > rlm_eap: Loaded and initialized type mschapv2 > Module: Instantiated eap (eap) > Module: Loaded preprocess > preprocess: huntgroups = "/etc/freeradius/huntgroups" > preprocess: hints = "/etc/freeradius/hints" > preprocess: with_ascend_hack = no > preprocess: ascend_channels_per_line = 23 > preprocess: with_ntdomain_hack = no > preprocess: with_specialix_jetstream_hack = no > preprocess: with_cisco_vsa_hack = no > preprocess: with_alvarion_vsa_hack = no > Module: Instantiated preprocess (preprocess) > Module: Loaded realm > realm: format = "suffix" > realm: delimiter = "@" > realm: ignore_default = no > realm: ignore_null = no > Module: Instantiated realm (suffix) > Module: Loaded files > files: usersfile = "/etc/freeradius/users" > files: acctusersfile = "/etc/freeradius/acct_users" > files: preproxy_usersfile = "/etc/freeradius/preproxy_users" > files: compat = "no" > Module: Instantiated files (files) > Module: Loaded Acct-Unique-Session-Id > acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, > Client-IP-Address" > Module: Instantiated acct_unique (acct_unique) > Module: Loaded detail > detail: detailfile = > "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" > detail: detailperm = 384 > detail: dirperm = 493 > detail: locking = no > Module: Instantiated detail (detail) > Module: Loaded radutmp > radutmp: filename = "/var/log/freeradius/radutmp" > radutmp: username = "%{User-Name}" > radutmp: case_sensitive = yes > radutmp: check_with_nas = yes > radutmp: perm = 384 > radutmp: callerid = yes > Module: Instantiated radutmp (radutmp) > Listening on authentication 127.0.0.1:1812 > Listening on accounting 127.0.0.1:1813 > Ready to process requests. > rad_recv: Access-Request packet from host 127.0.0.1:32823, id=217, > length=95 > User-Name = "jrc" > NAS-Identifier = "jrcnas" > NAS-Port-Type = Ethernet > CUI = "0" > Service-Type = Framed-User > Framed-MTU = 1400 > Calling-Station-Id = "1:1:1:1:1:1" > Message-Authenticator = 0x2568987af6f31763f9199f8067fafee1 > EAP-Message = 0x02d20008016a7263 > Processing the authorize section of radiusd.conf > modcall: entering group authorize for request 0 > Segmentation fault > cheux301:/etc/freeradius# > > > > > ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- > > > -- > Thanks & Regards, > Govardhana K N >

1 0

Support for Cisco
by ashish verma 19 Jul '07

19 Jul '07

Hi all, I am trying to configure "free radius" for some Cisco devices. till now i am able to authenticate using the radius server and i am getting into user level or privilege level depending on the attribute i am defining. Now what i am looking for is authorization. There is something called "Cisco-AV priv" attribute through which one can define privilege level from 1 to 15. But i am not able to define it in "users file". Can anyone tell me how to define this or whether we can define this kind of attribute in freeradius or not? Thanks in advance, Ashish

3 4

Re: Support for WiMAX VSA
by Nitin Naveen 19 Jul '07

19 Jul '07

Hi Walter, We fixed the freeradius so that the WiMAX VSA may be downloaded to the ASNGW after EAP completion. We have not enhanced freeradius to be AAA server in a WiMAX network. We download the MSK from freeradius to our ASNGW. Based on the downloaded MSK our ASNGW generates the AK context and hence the required keys. Freeradius only provides the key material, generation is part of our ASNGW. Hope this explanation helps. We can work towards making freeradius a complete AAA server for the WiMAX network. Regards Nitin freeradius-users-request(a)lists.freeradius.org Sent by: freeradius-users-bounces+nitin.naveen=hsc.com(a)lists.freeradius.org 07/19/2007 09:27 AM Please respond to freeradius-users(a)lists.freeradius.org To freeradius-users(a)lists.freeradius.org cc Subject Freeradius-Users Digest, Vol 27, Issue 114 Send Freeradius-Users mailing list submissions to freeradius-users(a)lists.freeradius.org To subscribe or unsubscribe via the World Wide Web, visit http://lists.freeradius.org/mailman/listinfo/freeradius-users or, via email, send a message with subject or body 'help' to freeradius-users-request(a)lists.freeradius.org You can reach the person managing the list at freeradius-users-owner(a)lists.freeradius.org When replying, please edit your Subject line so it is more specific than "Re: Contents of Freeradius-Users digest..." Today's Topics: 1. RE: Mikrotik Accounting ON/OFF (Hugh Messenger) 2. Re: 1.1.7 sqlippool %{SQL-User-Name} (Peter Nixon) 3. Testing WAD via ntlm_auth (ken) 4. Re: Testing WAD via ntlm_auth (A.L.M.Buxey(a)lboro.ac.uk) 5. RE: Mikrotik Accounting ON/OFF (tnt(a)kalik.co.yu) 6. Re: Testing WAD via ntlm_auth (tnt(a)kalik.co.yu) 7. RE: Mikrotik Accounting ON/OFF (Hugh Messenger) 8. Support for WiMAX VSA (Nitin Naveen) 9.Support for WiMAX VSA(Walter Goulet) ---------------------------------------------------------------------- Message: 1 Date: Wed, 18 Jul 2007 14:47:22 -0500 From: "Hugh Messenger" <hugh(a)alaweb.com> Subject: RE: Mikrotik Accounting ON/OFF To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <00d301c7c974$76445ed0$010210ac@DELLBOY> Content-Type: text/plain; charset="us-ascii" tnt(a)kalik.co.yu said: > >, but if anyone on this list has a Beta 3 setup :-D > > Good old SETUP - missing or bug: > http://forum.mikrotik.com/viewtopic.php?f=1&t=16963 OK, I'll rephrase that ... "if anyone on this list has a 3.0beta10 install they can test with". :) > Ivan Kalik > Kalik Informatika ISP -- hugh ------------------------------ Message: 2 Date: Wed, 18 Jul 2007 23:03:46 +0300 From: Peter Nixon <listuser(a)peternixon.net> Subject: Re: 1.1.7 sqlippool %{SQL-User-Name} To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <200707182303.46430.listuser(a)peternixon.net> Content-Type: text/plain; charset="iso-8859-1" On Wed 18 Jul 2007, Hugh Messenger wrote: > Peter Nixon quoth: > > On Tue 17 Jul 2007, Hugh Messenger wrote: > > > Can we add sqlippool to the ./modules/stable list? > > > > It is in the stable list for 2.0 but its up to Alan whether we put it in > > for 1.1.7 > > It's been pretty darn stable for me in 1.1.6. And now we've gotten the > MySQL stuff whipped into shape and fixed a few other issues for 1.1.7, I'd > say it's ready for Prime Time. OK. Thats good enough for me. I have added it :-) -- Peter Nixon http://peternixon.net/ ------------------------------ Message: 3 Date: Wed, 18 Jul 2007 21:41:10 +0100 From: ken <k.brown(a)bbk.ac.uk> Subject: Testing WAD via ntlm_auth To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <469E7AE6.8060505(a)bbk.ac.uk> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Does anyone have actual examples of radclient (or other command-line tools) being used to test Freeradius using Windows Active Directory authentication via samba/ntlm_auth? I'd like to be able to test Radius authentication for various different categories of user on our Active Directory. Presumably this involves PEAP/MSCHAPv2 I can't work out how to do it without using a Windows client and a wireless infrastructure we don't have yet. (or even if it is doable) I can use radclient to test PAP and "straight" CHAP against locally defined users with cleartext passwords. Time to go one step further. ------------------------------ Message: 4 Date: Wed, 18 Jul 2007 21:55:08 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: Testing WAD via ntlm_auth To: k.brown(a)bbk.ac.uk, FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20070718205508.GA21505(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii Hi, > Presumably this involves PEAP/MSCHAPv2 I can't work out how to > do it without using a Windows client and a wireless > infrastructure we don't have yet. (or even if it is doable) you dont need wireless to do such testing - there are plenty of ethernet switches out there that do 802.1x and can throw the EAP authentication to your RADIUS box... ....with this in mind, you could use wpa_supplicant on linux - yes it does wired 802.1x nicely... eg have this in the config eap=PEAP identity="domain\username" password="secret_password" ca_cert="/etc/cert/ca.pem" phase1="peaplabel=0" phase2="auth=MSCHAPV2" or..since you're playing with wpa_supplicant..use its handy tool eapol_test - very useful. of course, with wired 802.1x you can also play with the windows client and get used to its quirks and foibles. alan ------------------------------ Message: 5 Date: Wed, 18 Jul 2007 22:05:01 +0100 From: <tnt(a)kalik.co.yu> Subject: RE: Mikrotik Accounting ON/OFF To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Message-ID: <b03pBwWK.1184792701.4799830.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 I have an idle routerboard waiting for a replacement wifi mini-pci. It has routeros 2.9 but somehow I am not tempted to try the upgrade: upgrade to 3beta & failed logins: http://forum.mikrotik.com/viewtopic.php?f=3&t=17128 On liked topic things go from bad to worse - it seems that the wireless package is working as well as setup command in beta: RB133c and 3.10b: http://forum.mikrotik.com/viewtopic.php?f=1&t=16502&p=80766 And since routerboard has flash memory and not HDD for storing OS I am not so sure what would happen to the licence after the upgrade/downgrade. Not particularly keen to find out :-( Ivan Kalik Kalik Informatika ISP Dana 18/7/2007, "Hugh Messenger" <hugh(a)alaweb.com> pi?e: >tnt(a)kalik.co.yu said: >> >, but if anyone on this list has a Beta 3 setup :-D >> >> Good old SETUP - missing or bug: >> http://forum.mikrotik.com/viewtopic.php?f=1&t=16963 > >OK, I'll rephrase that ... "if anyone on this list has a 3.0beta10 install >they can test with". :) > >> Ivan Kalik >> Kalik Informatika ISP > > -- hugh > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ------------------------------ Message: 6 Date: Wed, 18 Jul 2007 23:38:12 +0100 From: <tnt(a)kalik.co.yu> Subject: Re: Testing WAD via ntlm_auth To: freeradius-users(a)lists.freeradius.org Message-ID: <20aUZbvV.1184798292.9840090.tnt(a)kalik.co.yu> Content-Type: text/plain; charset=ISO-8859-2 http://www.nabble.com/MSCHAP-test-client--tf4069370.html You don't need to do PEAP to test ntlm_auth, just MSCHAP. Ivan Kalik Kalik Informatika ISP Dana 18/7/2007, "ken" <k.brown(a)bbk.ac.uk> pi?e: >Does anyone have actual examples of radclient (or other >command-line tools) being used to test Freeradius using Windows >Active Directory authentication via samba/ntlm_auth? > >I'd like to be able to test Radius authentication for various >different categories of user on our Active Directory. > >Presumably this involves PEAP/MSCHAPv2 I can't work out how to >do it without using a Windows client and a wireless >infrastructure we don't have yet. (or even if it is doable) > >I can use radclient to test PAP and "straight" CHAP against >locally defined users with cleartext passwords. Time to go one >step further. > > > > >- >List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html > > ------------------------------ Message: 7 Date: Wed, 18 Jul 2007 17:58:06 -0500 From: "Hugh Messenger" <hugh(a)alaweb.com> Subject: RE: Mikrotik Accounting ON/OFF To: "'FreeRadius users mailing list'" <freeradius-users(a)lists.freeradius.org> Message-ID: <00e401c7c98f$1b3a2450$010210ac@DELLBOY> Content-Type: text/plain; charset="us-ascii" I finally thought to look in the changelog http://www.mikrotik.com/download/CHANGELOG_beta > What's new in 3.0beta10: [blah blah] > *) added radius client to send Accounting-On packet on startup; [blah] -- hugh ------------------------------ Message: 8 Date: Thu, 19 Jul 2007 09:11:26 +0530 From: Nitin Naveen <Nitin.Naveen(a)hsc.com> Subject: Support for WiMAX VSA To: freeradius-users(a)lists.freeradius.org Cc: freeradius-users-bounces+nitin.naveen=hsc.com(a)lists.freeradius.org, freeradius-users(a)lists.freeradius.org Message-ID: <OF4AEE7966.C6FE6E61-ON6525731D.00137FC1-6525731D.00149CEF(a)hsc.com> Content-Type: text/plain; charset="us-ascii" Hello All, Hi I am Nitin Naveen working with HUGHES SYSTIQUE. We have been working to enhance freeradius to support WiMAX VSA (as per WiMAX NWG forum). WiMAX VSA are not the typical type-length-value rather they have type-length-controlinfo-value. We have enhanced the dictionary but we were not able to generate the attributes as per the WiMAX NWG format. For now we have developed our own rlm_hsc_wimax module. We like to contribute to freeradius so that the WiMAX VSA are supported as part of the standard distribution. To this end we can share our code. But before that we would like to follow the correct procedure for releasing the code. Your inputs and suggestion are awaited. Regards Nitin Naveen Principal Engineer HUGHES SYSTIQUE D-8, Infocity-11 Sector-33, Gugaon Haryana, India tel: +91-124-3045400 fax: +91-124-4039301 nitin.naveen(a)hsc.com www.hsc.com *****************************************************DISCLAIMER***************************************************** This message and/or attachment(s) contained here are confidential, proprietary to HUGHES SYSTIQUE and its customers. Contents may be privileged or otherwise protected by law. The information is solely intended for the entity it is addressed to. If you are not the intended recipient of this message, it is strictly prohibited to read, forward, print, retain, copy or disseminate this message or any part of it. If you have received this e-mail in error, please notify the sender immediately and delete the message. ********************************************************************************************************************

1 0

Mikrotik Accounting ON/OFF
by Hugh Messenger 18 Jul '07

18 Jul '07

I got a response from Mikrotik on this thread: http://forum.mikrotik.com/viewtopic.php?f=1&t=17171 . saying that "I think that following attribute is added at 3.0beta10." Unfortunately I don't have a spare Mtik at the moment I can test the v3 Beta OS on. I have a new one on order, so I should be able to test this myself in a week or so, but if anyone on this list has a Beta 3 setup they can test this with, maybe you could take a few minutes and give it a whirl. -- hugh

2 4

Freeradius 1.1.6 and Cisco 2000 Wirelss Controller
by Brian Ertel 18 Jul '07

18 Jul '07

Hi, I've gotten a bit further but am still getting stuck. I have the Cisco Wireless Controller configured to hit Freeradius for MAC Address Authentication. Freeradius sees the request from the controller and sends back the configure attributes from the users file but the controller doesn't seem to see it correctly (the desired VLAN tag) and I end up in the default VLAN as configured on the controller. Below is my users, clients.conf, and radiusd verbose data output. Any thoughts? Ready to process requests. rad_recv: Access-Request packet from host 148.85.34.82:32768, id=35, length=174 User-Name = "00:0e:35:1c:e0:52" Called-Station-Id = "00-1a-6d-6b-f0-80:2000test" Calling-Station-Id = "00-0e-35-1c-e0-52" NAS-Port = 1 NAS-IP-Address = 148.85.34.82 NAS-Identifier = "WLC-34-82" Airespace-Wlan-Id = 1 User-Password = "testing" Service-Type = Call-Check Framed-MTU = 1300 NAS-Port-Type = Wireless-802.11 Tunnel-Type:0 = VLAN Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Private-Group-Id:0 = "159" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "00:0e:35:1c:e0:52", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry 00:0e:35:1c:e0:52 at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type Local auth: type Local auth: user supplied User-Password matches local User-Password Sending Access-Accept of id 35 to 148.85.34.82 port 32768 Tunnel-Medium-Type:0 = IEEE-802 Tunnel-Type:0 = VLAN Tunnel-Private-Group-Id:0 = "157" Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 35 with timestamp 4697de6a Nothing to do. Sleeping until we see a request. ____________________________________________________________ 00:0e:35:1c:e0:52 Auth-Type := Local, User-Password == "testing" Tunnel-Medium-Type = "IEEE-802", Tunnel-Type = "VLAN", Tunnel-Private-Group-Id = "157", ______________________________________________________________ client 148.85.34.82 { # # The shared secret use to "encrypt" and "sign" packets between # the NAS and FreeRADIUS. You MUST change this secret from the # default, otherwise it's not a secret any more! # # The secret can be any string, up to 31 characters in length. # secret = xxxxxxx # # The short name is used as an alias for the fully qualified # domain name, or the IP address. # shortname = controller # # the following three fields are optional, but may be used by # checkrad.pl for simultaneous use checks # # # The nastype tells 'checkrad.pl' which NAS-specific method to # use to query the NAS for simultaneous use. # # Permitted NAS types are: # # cisco # computone # livingston # max40xx # multitech # netserver # pathras # patton # portslave # tc # usrhiper # other # for all other types # nastype = other # localhost isn't usually a NAS... _____________________ Brian Ertel Network Administrator Amherst College 413-542-8320 bsertel(a)amherst.edu _____________________

4 10

3COM sw4500 802.1x Problem
by Aydin KOÇAK 18 Jul '07

18 Jul '07

Hello; I implemented 802.1x on 3com 4500 switch but i receive an error on my FreeRadius server: rlm_ldap: - authorize rlm_ldap: performing user authorization for aydin radius_xlat: '(uid=aydin)' radius_xlat: 'ou=Kullanicilar,dc=kocak,dc=org,dc=tr' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=Kullanicilar,dc=kocak,dc=org,dc=tr, with filter (uid=aydin) --- Walking the entire request list --- Waking up in 5 seconds... Threads: total/active/spare threads = 5/1/4 rlm_ldap: checking if remote access for aydin is allowed by uid rlm_ldap: Added password 61714164102 in check items rlm_ldap: looking for check items in directory... rlm_ldap: Adding radiusHint as User-Password, value 1111 & op=21 rlm_ldap: Adding radiusAuthType as Auth-Type, value Local & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: Adding radiusTunnelPrivateGroupId as Tunnel-Private-Group-Id, value 2 & op=11 rlm_ldap: Adding radiusTunnelMediumType as Tunnel-Medium-Type, value 802 & op=11 rlm_ldap: Adding radiusTunnelType as Tunnel-Type, value VLAN & op=11 rlm_ldap: Adding radiusServiceType as Service-Type, value Framed-User & op=11 rlm_ldap: user aydin authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 8 modcall: leaving group authorize (returns updated) for request 8 rad_check_password: Found Auth-Type Local auth: type Local auth: No User-Password or CHAP-Password attribute in the request ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ auth: Failed to validate the user. My proablem is "No User-Password or CHAP-Password attribute in the request" message it is clear but my supplicant (XP and SecureW2) don't sent User-Password as is seen : [1 User-name ] [7 ] [aydin] *0.24948670 4500 RDS/8/DEBUG:- 1 - [79 EAP-Message ] [12] [0201000A01617964696E] [80 Message-Autheticator ] [18] [00000000000000000000000000000000] [4 NAS-IP-Address ] [6 ] [192.168.0.77] [32 NAS-Identifier ] [6 ] [4500] [5 NAS-Port ] [6 ] [268443649] [61 NAS-Port-Type ] [6 ] [15] *0.24949119 4500 RDS/8/DEBUG:- 1 - [6 Service-Type ] [6 ] [2] [7 Framed-Protocol ] [6 ] [1] [31 Caller-ID ] [16] [303030382D306435332D33623336] User-Password not in request. How am i sent User-Password ? I tried WinXP 802.1x (EAP-MD5) and SecureW2(EAP-MD5). My /etc/users file is following : --------------------------------- DEFAULT Auth-Type = LDAP Fall-Through = 1 --------------------------------- Thanks your relation. Aydin Kocak.

2 1