- Freeradius-Users - lists.freeradius.org

Re: terminating EAP tunnels, proxy and realms
by Josh Howlett 26 Jun '07

26 Jun '07

Gah, my message bounced owing to change of email address... Arran wrote: > Can you clear something up for me with inner/outer identity. > The outer identity is in the User-Name attribute , it's a standard > RADIUS attribute... Inner identity is encoded in the EAP message, and > is pulled out by the EAP module prior to internal proxying and set as > the User-Name attribute (which should overwrite the User-Name > attribute in the request) ? Correct. > And it's standard practice to leave the outer identity as anonymous, > as the only communication between the NAS and the Supplicant is EAP > based when using EAPOL, and so the NAS would have to understand EAP to > be able to extract the User-Name string and write it into the > Access-Request packet ? Nope; see RFC 3579 for the gory details: "the NAS MUST copy the contents of the Type-Data field of the EAP-Response/Identity received from the peer into the User-Name attribute" The use of "anonymous" is simply to preserve privacy; it's not a technical requirement of any EAP method (that I know of). An interesting tangent: note that "end-user identity hiding" is simply a "requirement" of RFC 4017 ("EAP Method Requirements for Wireless LANs"), which I think is a shame. > So although the NAS must send an EAP-Identity-Request when the client > connects it's not required to understand the EAP-Identity-Response ? For the reason given above, it *does* need to understand the EAP-Identity-Response. But that's about it! The NAS is a pretty dumb device. josh.

3 6

FreeRadius 1.1.6 Segmentation Fault with LDAP
by Robert E. Toense 26 Jun '07

26 Jun '07

I am attempting to setup FreeRadius 1.1.6 to do PEAP authentication to an LDAP backend on another server. PEAP is working just fine to local Radius passwords. However, I get a segmentation fault whenever I try to use LDAP. Output from radiusd -X follows (sensitive information sanitized). OpenLDAP 2.3.30 is also installed. This is a Fedora Core 5 system. I see no network traffic between the Radius server and the LDAP server. Any hints? Robert .... rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'ou=AAAA,dc=BBBB,dc=CCCC,dc=DDD' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to lappgen.nist.gov:636, authentication 0 Segmentation fault

2 1

XLAT Parsing error.
by Arran Cudbard-Bell 26 Jun '07

26 Jun '07

Hi, Another small xlat parsing error, alternate values arnt being parsed correctly in xlat strings involving modules. update request { Supplicant-Flags = "%{sql_clients:SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1:-null}" } expands to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1:-null when should expand to SELECT EXPORT_SET(master.supplicant_flags,'1','0','',10) FROM `master` WHERE master.hw_address = '%{Calling-Station-Id:-null}' LIMIT 0,1 What would be really cool is if one query returned a null string a second query could be executed as an alternate, but i'm not sure how hard that would be to do. -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 2

Assertion failed in conffile.c, line 109,Abort
by Arran Cudbard-Bell 26 Jun '07

26 Jun '07

Including separate configuration files in major stanza subsections results in. Assertion failed in conffile.c, line 109 Abort Post-Auth-Type REJECT { # * Uniform called station ID + SSID extraction # * Uniform calling station ID # * Correct NAS Port Type # * Rewrite loopback ips $INCLUDE ${confdir}/attrrewrite.conf # Log rejected attempts to help with debugging sql attr_filter.access_reject } Does the config parser not check in sub sections for files to be included ? Adding the relevant configuration lines contained in attrrewrite.conf does not result in the error. It's definitely the include statement. This happens in authorize, post-auth etc ... Sorry, last bug for today :) -- Arran Cudbard-Bell (A.Cudbard-Bell(a)sussex.ac.uk) Authentication, Authorisation and Accounting Officer Infrastructure Services | ENG1 E1-1-08 University Of Sussex, Brighton EXT:01273 873900 | INT: 3900

2 1

Re:users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

I used numbers (123456) and it seems to work.seems?? when i use user:akim passwd:willy everything is allwright (redirection authentication on radius and message response ok.) using browsing the net but when i try to use another user (carl passwd:aniam or all the several users i created ) i have an access-reject message with following result: modcall[authorize]: module "pap" returns noop for request 24 modcall: leaving group authorize (returns ok) for request 24 rad_check_password: Found Auth-Type System auth: type "System" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 24 modcall[authenticate]: module "unix" returns notfound for request 24 modcall: leaving group authenticate (returns notfound) for request 24 auth: Failed to validate the user. Delaying request 24 for 1 seconds Finished request 24 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 0 to 192.168.1.3 port 2051 Waking up in 4 seconds... --- Walking the entire request list --- Cleaning up request 24 ID 0 with timestamp 467fea7b what might be the fault -- -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ ANIAMBOSSOU Carl NIAMS TECHNOLOGIES tel: +229 90 04 08 58 +229 97 48 01 33 COTONOU REPUBLIC OF BENIN WEST AFRICA

2 1

RE: Freeradius-Users Digest, Vol 26, Issue 120
by Hugh Messenger 25 Jun '07

25 Jun '07

"Flavio Silvestrone" <drascii(a)gmail.com> said: > Subject: Re: "Clear text password not available" > The version of radius is "freeradius-1.0.1-3". All together now: "Upgrade to 1.1.6" I've kind of lost track of exactly what you are trying to do, but what the users file is seems to be set up to do is to authenticate 'massi' locally in the users file, and flavio against the UNIX passwd file. And UNIX is telling you it doesn't know anything about 'flavio'. I think. But definitely upgrade to 1.1.6, regardless!! -- hugh

3 2

RE: Simultaneous-Use problem.
by Josh Howlett 25 Jun '07

25 Jun '07

> On Monday 25 June 2007 11:42:08 Josh Howlett wrote: > > I have a feeling that the answer is blindingly obvious, but I can't > > figure it out... > > > > The 'users' file consists of: > > > > DEFAULT Auth-Type = Accept > > Simultaneous-Use := 1 > > Because Simultaneous-Use is in the wrong place. Make it a > check item and the session section should be processed. That fixed it. As I thought, blindingly obvious; a case of needing another pair of eyes... Thanks, josh.

1 0

Simultaneous-Use problem.
by Josh Howlett 25 Jun '07

25 Jun '07

I have a feeling that the answer is blindingly obvious, but I can't figure it out... The 'users' file consists of: DEFAULT Auth-Type = Accept Simultaneous-Use := 1 In radiusd.conf I also have: session { sql } authorize { radius-user-auth } 'radius-user-auth' is an rlm_exec instance that invokes a script used to authenticate users. It works fine, but the 'session' section never gets processed. Why? josh.

2 1

Re:users authentication failed
by Carl aniams 25 Jun '07

25 Jun '07

> > Carl aniams wrote: > ... > > please any suggestion > ... > > WARNING: Unprintable characters in the password. ? Double-check the > > shared secret on the server and the NAS! > > What part of that message is unclear? Be sure that i crossed check the shared secret on my server and on the nas (the AP) yet nothing i even changed them yet nothing Alan DeKok. > > > ------------------------------ > > > -- > -_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_ > > ANIAMBOSSOU Carl > NIAMS TECHNOLOGIES > tel: +229 90 04 08 58 +229 97 48 01 33 > COTONOU > REPUBLIC OF BENIN > WEST AFRICA

2 1

terminating EAP tunnels, proxy and realms
by Andreas Liebe 25 Jun '07

25 Jun '07

Hi all, we're using FreeRadius 1.1.6 to give access to our WLAN with EAP-TTLS. Worked great so far. No we want to participate in inter University roaming (eduroam) and thus have to proxy some requests a parent server. Everything works great except regarding the outer identity. If it's just "anonymous" everything is ok, but if it's "anonymous@<somerealm>" and <somerealm> is configured in proxy.conf the EAP-Request ist proxied instead of terminated. This is correct by configuration but not wanted. Is there a way to terminate the EAP regardless of the outer identity? Here's an example: User-Name = "anonymous(a)tu-darmstadt.de" Calling-Station-Id = "00-18-DE-B5-3A-E2" ... EAP-Message = 0x0201001e01616e6f6e796d6f75734074752d6461726d73746164742e 6465 Message-Authenticator = 0x7a211176339c3e2ee9f7a0fe56864b2a ... rlm_realm: Looking up realm "tu-darmstadt.de" for User-Name = "anonymous(a)tu-darmstadt.de" rlm_realm: Found realm "tu-darmstadt.de" rlm_realm: Adding Stripped-User-Name = "anonymous" rlm_realm: Proxying request from user anonymous to realm tu-darmstadt.de rlm_realm: Adding Realm = "tu-darmstadt.de" rlm_realm: Preparing to proxy authentication request to realm "tu-darmstadt. de" modcall[authorize]: module "suffix" returns updated for request 6 rlm_eap: Request is supposed to be proxied to Realm tu-darmstadt.de. Not doing EAP. modcall[authorize]: module "eap" returns noop for request 6 ... How can I bypass proxy authentication for EAP-Messages? This is the setup in users: ... # matches request without any realm (local) DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm !* "NULL", Proxy-To-Realm := MyRealm User-Name = `%{User-Name}`,Fall-Through = Yes # matches requests going explicitly to tu-darmstadt.de (local) DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm == "tu-darmstadt.de", Proxy-To-Realm := MyRealm User-Name = `%{User-Name}`,Fall-Through = Yes # matches requests going parent radius DEFAULT FreeRADIUS-Proxied-To == 127.0.0.1, Realm == DEFAULT, Proxy-To-Realm := Parent User-Name = `%{User-Name}`,Fall-Through = Yes ... Thanks a lot, -Andreas -- Andreas Liebe/Darmstadt University of Technology/+49 6151 16-3150/3050(FAX)

5 13