- Freeradius-Users - lists.freeradius.org

RE: [meta] admin tools and utilities
by Josh Howlett 29 Jun '07

29 Jun '07

> -----Original Message----- > From: > freeradius-users-bounces+josh.howlett=ja.net(a)lists.freeradius. > org > [mailto:freeradius-users-bounces+josh.howlett=ja.net@lists.fre eradius.org] On Behalf Of Phil Mayers > Sent: 29 June 2007 10:35 > To: FreeRadius users mailing list > Subject: Re: [meta] admin tools and utilities > > On Thu, 2007-06-28 at 12:16 -0500, Hugh Messenger wrote: > > Forgive me if meta-discussions are frowned upon. > > > > > > > > I was just wandering what tools and utilities (not shipped with > > freeradius) people find useful in day to day admin and testing. > > eapol_client from the wpa_supplicant distro was invaluable > for testing EAP I found I agree with Phil, this is an invaluable tool for testing EAP; although it's really called eapol_test :-) josh.

1 0

Wired Ethernet EAP-TLS
by Darren Maden 29 Jun '07

29 Jun '07

I'm having problems connecting a wired Ethernet machine authenticating with EAP-TLS, I'm connecting via a Lindy switch with 802.1x port authentication forced on the port that the machine is connecting to, that port is also on the same VLAN as the RADIUS server. This FreeRADIUS setup is working for wireless clients over 802.1x using EAP-TLS. My wpa_supplicant config is: ctrl_interface=/var/run/wpa_supplicant ctrl_interface_group=wheel ap_scan=0 network={ key_mgmt=IEEE8021X identity="hostname" eapol_flags=0 eap=TLS ca_cert="/etc/certs/cacert.pem" client_cert="/etc/certs/clientcert.pem" private_key="/etc/certs/clientkey.pem" private_key_passwd="password" } (Identity and Password changed for privacy) I'm initiating this with the following command: wpa_supplicant -Dwired -ieth1 -c/etc/wpa_supplicant.conf -d The RADIUS server is not receiving the request, here is an output from wpa_supplicant: State: DISCONNECTED -> ASSOCIATED Associated to a new BSS: BSSID=01:80:c2:00:00:03 No keys have been configured - skip key clearing Network configuration found for the current AP WPA: clearing AP WPA IE WPA: clearing AP RSN IE WPA: clearing own WPA/RSN IE EAPOL: External notification - portControl=Auto Associated with 01:80:c2:00:00:03 WPA: Association event - clear replay counter EAPOL: External notification - portEnabled=0 EAPOL: External notification - portValid=0 EAPOL: External notification - portEnabled=1 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_BE entering state IDLE EAP: EAP entering state INITIALIZE EAP: EAP entering state IDLE EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart EAPOL: startWhen --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: txStart EAPOL: idleWhile --> 0 EAP: EAP entering state FAILURE CTRL-EVENT-EAP-FAILURE EAP authentication failed EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 EAPOL: heldWhile --> 0 EAPOL: SUPP_PAE entering state CONNECTING EAPOL: SUPP_PAE entering state AUTHENTICATING EAPOL: SUPP_BE entering state FAIL EAPOL: SUPP_PAE entering state HELD EAPOL: SUPP_BE entering state IDLE EAPOL: startWhen --> 0 CTRL-EVENT-TERMINATING - signal 2 received Removing interface eth1 State: ASSOCIATED -> DISCONNECTED No keys have been configured - skip key clearing EAPOL: External notification - portEnabled=0 EAPOL: SUPP_PAE entering state DISCONNECTED EAPOL: SUPP_BE entering state INITIALIZE EAP: EAP entering state DISABLED EAPOL: External notification - portValid=0 No keys have been configured - skip key clearing Cancelling scan request Is there anything special I need to do in my FreeRADIUS config? Supporting Windows wired clients is not necessary but when trying with a Windows client, it didn't work either.

4 11

[meta] admin tools and utilities
by Hugh Messenger 29 Jun '07

29 Jun '07

Forgive me if meta-discussions are frowned upon. I was just wandering what tools and utilities (not shipped with freeradius) people find useful in day to day admin and testing. My vote goes to NTRadPing, a fully featured Windows take on the standard UN*X radping. Freebie, from http://www.dialways.com/download/. Very intuitive UI for creating, saving, loading and executing auth and accounting queries. Configurable dictionary file. I'd be lost without it. Something I'd really like to find is an 'unsolicited' test service, simulating a NAS listening on 1700, to help diagnose disconnect request issues. -- hugh

3 2

Banning users in a nice way...
by Arran Cudbard-Bell 29 Jun '07

29 Jun '07

Hi, Being a nice friendly openish institution, and not wanting to overload our helpdesk staff with hundreds of users trying to set up their laptops, we decided to make registration, a self service kind of affair. We decided to setup an unauthorised VLAN, on this VLAN there exists a support server , serving support pages. On wired connections, assigning users to this VLAN is fine .. our HP Procurve switches have a lovely feature called OpenVLAN which assigns users with broken supplicant software to an arbitrary VLAN. Unfortunately there is no such solution for the wireless access points.. *sigh*.. So we currently have to reject broken supplicants, failed authentication attempts etc ... Our solution to this is not as smooth as I would like ... and that is to create a second unauthenticated, unencrypted BSSID which is attached to our unauthorised VLAN. Users connect to this BSSID, register, setup their software, then connect to the 802.1x authenticated BSSID. What we really want to be able to do, is for users with broken software, force the wireless association to succeed, and put them on the unauthorised VLAN. Of course just sending a plain old Access-Accept packet isn't sufficient, as it requires the tunneled authentication to succeed as well... Has anyone got any ideas ? I'm assuming theres no way to do it.. Oh and by broken I mean windows XP type broken, as in will only attempt TLS authentication broken... and sends the username and password a user logged into the machine with by default broken... and so can never work out of the box broken. Theres no issues with Mac Users, everything works fine there. and were assuming people running linux are clever enough to setup x supplicant without support :) -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

3 3

RE: Sending CA certificate during EAP-TLS
by Josh Howlett 29 Jun '07

29 Jun '07

Hi Reimer, > How do you check if FreeRadius is actually sending the chain? I find Wireshark useful for this. It re-assembles the fragmented TLS handshake, which makes it much easier to understand... josh.

1 0

Sending CA certificate during EAP-TLS
by Rafa Marin 29 Jun '07

29 Jun '07

Hi all, Is there any way to configure free radius + eap-tls module to avoid to send CA certificate during EAP-TLS negotiation? As Free Radius is sending it right now EAP-TLS packets get fragmented and I would like to avoid it. Thanks in advance.

6 8

Re : Sending CA certificate during EAP-TLS
by Eshun Benjamin 29 Jun '07

29 Jun '07

Well in my current configuration I have the RADIUS server certificate in certificate_file and CA certificate in CA_file. But with that configuration , the radius server is still sending the CA certificate. The CA_path folder is empty and the CA_file is commented out. This should work for you. tls { # # These is used to simplify later configurations. # certdir = ${raddbdir}/certs cadir = ${raddbdir}/certs/trustedCA private_key_password = whatever private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem # Trusted Root CA list - CA_path folder is empty # CA_file = ${cadir}/ca.pem CA_path = ${raddbdir}/certs/trustedCA dh_file = ${certdir}/dh random_file = ${certdir}/random # fragment_size = 1024 # include_length = yes # check_crl = yes # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} # # Set this option to specify the allowed # TLS cipher suites. The format is listed # in "man 1 ciphers". cipher_list = "DEFAULT" #make_cert_command = "${certdir}/bootstrap" } ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Rafa Marín López <rafa.marinlopez(a)gmail.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Cc : Rafa Marin Lopez <rafa(a)dif.um.es> Envoyé le : Mercredi, 20 Juin 2007, 18h10mn 12s Objet : Re: Sending CA certificate during EAP-TLS Reimer Karlsen-Masur, DFN-CERT escribió: Hi Karlsen, thanks for the answer, please see inline... > > Argh, your misunderstanding is because of the inline > documentation/default setup of the eap config file. > > *Trusted* CAs for client auth are stored in > > CA_file > > or > > CA_path > > So there is no conflict here with certificate_file option. > > And IMO usually CA_file and certificate_file should *not* contain the > same CA certs Well in my current configuration I have the RADIUS server certificate in certificate_file and CA certificate in CA_file. But with that configuration , the radius server is still sending the CA certificate. Having said that , your proposal was to not include the CA certificate in the RADIUS server certificate (in certificate_file variable) My RADIUS server certificate does not have the CA certificate included. Even so, the RADIUS server is including the CA certificate :(... any alternative solution?. > because I guess in the majority of cases the RADIUS server cert is > issued by some (commercial) server CA where as the client certs are > mostly issued by some home grown user CA. > > Saying that there might be cases where the CA certificates from > CA_file are indeed the CA chain certs of the RADIUS server > certificate..... > > ------------------------------------------------------------------------ > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _____________________________________________________________________________ Ne gardez plus qu'une seule adresse mail ! Copiez vos mails vers Yahoo! Mail

2 1

radclient and radtest.
by Diana Robert 29 Jun '07

29 Jun '07

hi, when i m using the radtest command to test the server, eg: radtest Mahalakshmi test localhost 0 testing123 i got Access- Accept Packet from server. but when i m using raclient, echo "User-Name = Mahalakshmi" | radclient localhost auth testing123 i got Access-Reject packet . can anyone say wat am i missing for radclient, thank u. --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

2 1

Problems with multiple groups in rlm_sql
by Pshem Kowalczyk 29 Jun '07

29 Jun '07

Hi, I'm trying to set up rlm_sql for users that belong to multiple groups. (1.1.6, postgresql 8.1). If user belongs to only one group - everything works fine - i.e. user can auth, gets correct attributes back. If I add the user to another group - it stops working all together - ie the user gets rejected. Database scheme and sql queries are default from the 1.1.6 version. Content of the database for the relevant user: SELECT id, UserName, Attribute, Value, Op FROM radcheck WHERE Username = 'przem' ORDER BY id; id | username | attribute | value | op ---------+----------+-----------+----------+---- 1944943 | przem | Password | xxxyyyzz | == (1 row) SELECT id, UserName, Attribute, Value, Op FROM radreply WHERE Username = 'przem' ORDER BY id; id | username | attribute | value | op ----+----------+-----------+-------+---- (0 rows) SELECT radgroupcheck.id, radgroupcheck.GroupName, radgroupcheck.Attribute, radgroupcheck.Value,radgroupcheck.Op FROM radgroupcheck, usergroup WHERE usergroup.Username = 'przem' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id; id | groupname | attribute | value | op ----+-----------+----------------+--------+---- 27 | DIALUP | Huntgroup-Name | DIALUP | == 28 | ADSL | Huntgroup-Name | ADSL | == (2 rows) SELECT radgroupreply.id, radgroupreply.GroupName, radgroupreply.Attribute, radgroupreply.Value, radgroupreply.Op FROM radgroupreply,usergroup WHERE usergroup.Username = 'przem' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id; id | groupname | attribute | value | op ----+-----------+-----------------+-------------+---- 37 | DIALUP | Framed-Protocol | PPP | := 38 | DIALUP | Service-Type | Framed-User | := 39 | ADSL | Framed-Protocol | PPP | := 40 | ADSL | Service-Type | Framed-User | := (4 rows) huntgroups file: DIALUP Huawei-Domain-Name == "ihug-dialup" WIREDCOUNTRY Huawei-Domain-Name == "ihug-pppoe-wc" ADSL Huawei-Domain-Name == "ihug-ubs" ADSL Huawei-Domain-Name == "ihug-dsl-pppoe" Debug is in the attached file. What am I missing here? kind regards Pshem

1 0

radclient
by Diana Robert 29 Jun '07

29 Jun '07

hi, i m using radclient with "auth" option to send a request packet to the server, now i want to know wat wil the other options namely auto, status, discover,coa do. and wat information has to be sent to the server if the corresponding option is used. thank you. --------------------------------- Heres a new way to find what you're looking for - Yahoo! Answers

1 0