- Freeradius-Users - lists.freeradius.org

TTLS-PAP accounting bug
by Sam Schultz 23 Jun '07

23 Jun '07

I was just wondering if the bug from this post has been fixed since 1.1.6: "Re: EAP-TTLS outer identity & accounting" After alot of experimenting & researching, I still haven't found a solution to the TTL anonymous outer identity being used for accounting. I have set a DEFAULT entry that sets the User-Name attribute via ':=', but I still end up with two User-Name attributes (anonymous identity & real identity). This is especially strange, since use_tunneled_reply & copy_request_to_tunnel are both enabled as well. If I understand correctly, := should replace the anonymous (first) User-Name value with the real (second) value permitting they are in the same session. Upon looking back at the debug output, it looks like the tunneled request is actually handled as if it were a seperate request than the one containing it (request->eap module-(unpack)- >new request). This would explain why two User-Name attributes are showing up in the final response. Is there any way to discard the first (anonymous) entry via a module or other method without hacking FR code? Surely someone has this working. My setup is just basic TTLS-PAP auth'ing against LDAP.

3 2

EAP/TLS ,after access-challenge nothing happen
by stefek143 23 Jun '07

23 Jun '07

Hi I have a little problem with authenticate using EAP/TLS on freeradius. After Access Challenge freeradius not display Reject or Accept, only going to the begin and repeat the same operation. What`s wrong ?? as NAS i`m using CISCO catalyst 2950 and client supplicant WinXP. this is logs from tcpdump: 21:43:21.547329 IP 192.168.1.9.radius > 192.168.1.7.radius: RADIUS, Access Request (1), id: 0x7d length: 120 21:43:21.648845 IP 192.168.1.7.radius > 192.168.1.9.radius: RADIUS, Access Challenge (11), id: 0x7d length: 64 21:43:21.572693 IP 192.168.1.9.radius > 192.168.1.7.radius: RADIUS, Access Request (1), id: 0x7e length: 189 21:43:21.587661 IP 192.168.1.7.radius > 192.168.1.9.radius: RADIUS, Access Challenge (11), id: 0x7e length: 1100 21:43:21.602274 IP 192.168.1.9.radius > 192.168.1.7.radius: RADIUS, Access Request (1), id: 0x7f length: 115 21:43:21.604767 IP 192.168.1.7.radius > 192.168.1.9.radius: RADIUS, Access Challenge (11), id: 0x7f length: 976 21:43:21.620631 IP 192.168.1.9.radius > 192.168.1.7.radius: RADIUS, Access Request (1), id: 0x80 length: 115 21:43:21.629087 IP 192.168.1.7.radius > 192.168.1.9.radius: RADIUS, Access Challenge (11), id: 0x80 length: 68 and this is logs from freeradius debug mode: rad_recv: Access-Request packet from host 192.168.1.9:1812, id=207, length=115 NAS-IP-Address = 192.168.1.9 NAS-Port-Type = Async User-Name = "client" Service-Type = Framed-User Framed-MTU = 1500 Calling-Station-Id = "00-11-09-26-48-fa" State = 0xf4dbd9e74648ce65d56e471171d0e7f3 EAP-Message = 0x020200060d00 Message-Authenticator = 0x767944f13525d633320393682cb2403f Processing the authorize section of radiusd.conf modcall: entering group authorize for request 90 modcall[authorize]: module "preprocess" returns ok for request 90 modcall[authorize]: module "chap" returns noop for request 90 modcall[authorize]: module "mschap" returns noop for request 90 rlm_realm: No '@' in User-Name = "client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 90 rlm_eap: EAP packet type response id 2 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 90 modcall[authorize]: module "files" returns notfound for request 90 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 90 modcall: leaving group authorize (returns updated) for request 90 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 90 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 90 modcall: leaving group authenticate (returns handled) for request 90 Sending Access-Challenge of id 207 to 192.168.1.9 port 1812 EAP-Message = 0x010303900d8000000786310b300906035504061302504c311630140603550408130d7769656c6b6f706f6c736b6965311430120603550407130b6269616c6f736c69776965310f300d060355040a130670696f6e6172310f300d060355040b130670696f6e6172311e301c0603550403131546756e6e79626f6e6520576972656c657373204341311b301906092a864886f70d010901160c70696f6e61724077702e706c30819f300d06092a864886f70d010101050003818d0030818902818100ab728b302468bd3da758ecc16f15f289ae5c37adfac5899868d65302c0ee57926b30c6e450d5359222aa219ab45bb0e9dde0ff05f1435501f3331e19 EAP-Message = 0x88ba32d22d28818f980032dbc1f3da8223bb32cd29ae2c7ecbebd082539086f97fd226292ac4dcaa005767cd00ab6cd544325f19e2a19709b4db1df9952ede369656506b0203010001a38201023081ff301d0603551d0e041604143513a6ddabae787d49cc40b35d86cc53e716de263081cf0603551d230481c73081c480143513a6ddabae787d49cc40b35d86cc53e716de26a181a0a4819d30819a310b300906035504061302504c311630140603550408130d7769656c6b6f706f6c736b6965311430120603550407130b6269616c6f736c69776965310f300d060355040a130670696f6e6172310f300d060355040b130670696f6e6172311e301c EAP-Message = 0x0603550403131546756e6e79626f6e6520576972656c657373204341311b301906092a864886f70d010901160c70696f6e61724077702e706c820900f3854e49a9d8e78c300c0603551d13040530030101ff300d06092a864886f70d0101050500038181002961967ffb8fd7a6b2062b2d78880f2a61c84eb4b52dc6eeae4511192dee95d22e354171bdca060b84cf6b7c6646081bd7d20d3c38d70708a2eb2695a5180a527354cf7105af7cddb16c3a38bf4bed480b0a50fbbeb7c932a7aed302ff4065763ef1dc7abc1b7459cc3db095bea25cbf11f863d8db6220c62499d15b0cb3a3f216030100ac0d0000a4020102009f009d30819a310b300906 EAP-Message = 0x035504061302504c311630140603550408130d7769656c6b6f706f6c736b6965311430120603550407130b6269616c6f736c69776965310f300d060355040a130670696f6e6172310f300d060355040b130670696f6e6172311e301c0603550403131546756e6e79626f6e6520576972656c657373204341311b301906092a864886f70d010901160c70696f6e61724077702e706c0e000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8a37dd36bf1bbbf6747bb6c4216ea380 Finished request 90 Going to the next request Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.1.9:1812, id=208, length=115 NAS-IP-Address = 192.168.1.9 NAS-Port-Type = Async User-Name = "client" Service-Type = Framed-User Framed-MTU = 1500 Calling-Station-Id = "00-11-09-26-48-fa" State = 0x8a37dd36bf1bbbf6747bb6c4216ea380 EAP-Message = 0x020300060d00 Message-Authenticator = 0x6de0700bd6d131fc1cec8bec76fcea72 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 91 modcall[authorize]: module "preprocess" returns ok for request 91 modcall[authorize]: module "chap" returns noop for request 91 modcall[authorize]: module "mschap" returns noop for request 91 rlm_realm: No '@' in User-Name = "client", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 91 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 91 modcall[authorize]: module "files" returns notfound for request 91 rlm_pap: WARNING! No "known good" password found for the user. Authentication may fail because of this. modcall[authorize]: module "pap" returns noop for request 91 modcall: leaving group authorize (returns updated) for request 91 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 91 rlm_eap: Request found, released from the list rlm_eap: EAP/tls rlm_eap: processing type tls rlm_eap_tls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Received EAP-TLS ACK message rlm_eap_tls: ack handshake fragment handler eaptls_verify returned 1 eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 91 modcall: leaving group authenticate (returns handled) for request 91 Sending Access-Challenge of id 208 to 192.168.1.9 port 1812 EAP-Message = 0x0104000a0d8000000000 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x7b7eac5f542d1c6ec0abd77c3ce3c509 Finished request 91 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 88 ID 205 with timestamp 467ad8b7 Cleaning up request 89 ID 206 with timestamp 467ad8b7 Cleaning up request 90 ID 207 with timestamp 467ad8b7 Cleaning up request 91 ID 208 with timestamp 467ad8b7 Nothing to do. Sleeping until we see a request. ---------------------------------------------------- Nieważne, kim jesteś i jak wyglądasz. Jesteś wart tyle, ile ktoś chce zapłacić za twoją śmierć... Przerażający thriller HOSTEL 2 - w kinach od 22 czerwca! http://klik.wp.pl/?adr=http%3A%2F%2Fadv.reklama.wp.pl%2Fas%2Fhostel2.html&s…

3 2

Re : Re : Off-topic: DHCP server with radius support
by Eshun Benjamin 22 Jun '07

22 Jun '07

RADIUS was *originally* intented to assign IP's. It's been doing that since at least 1993. Do you mean radius servers has being doing DHCP since 1993 or IP pool stuff. What is is the difference? >> No i meant exactly what i wrote. RADIUS can assign IP's (that's why we >> have the rlm_pool/rlm_sqlpool modules and the Framed-IP-Address >> attribute). I need to forward some information to home radius servers >> first and based on their response decide on the ip pool to give out >> IP's. OK. http://publib.boulder.ibm.com/infocenter/pseries/v5r3/index.jsp?topic=/com.… ISC DHCP supports scripts? News to me... A DHCP >> request can be transformed to an Acesss-Request (with some default >> password), forwarded to a RADIUS server and the IP assigned by the >> radius server returned back to the user. Do you want to do that or "That RFC actually describes the opposite of what we are talking about. (ie. How a RADIUS server can ask a DHCP server to assign an IP instead of how a DHCP server can ask a RADIUS server to assign an IP) " ================================================== Benjamin K. Eshun ----- Message d'origine ---- De : Alan DeKok <aland(a)deployingradius.com> À : FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Envoyé le : Jeudi, 21 Juin 2007, 10h44mn 24s Objet : Re: Re : Off-topic: DHCP server with radius support Eshun Benjamin wrote: ... > A radius server assigning IPs .......that is not radius (!) . RADIUS was *originally* intented to assign IP's. It's been doing that since at least 1993. > May be > you mean the radius server authenticating (MACs and/or IPs) before the > dhcp assigns it; this you have to configure and write your own scripts > on the dhcp server to authenticate against the radius. Radius is for AAA ISC DHCP supports scripts? News to me... Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ___________________________________________________________________________ Découvrez une nouvelle façon d'obtenir des réponses à toutes vos questions ! Profitez des connaissances, des opinions et des expériences des internautes sur Yahoo! Questions/Réponses http://fr.answers.yahoo.com

3 2

RADIUS Authentication
by nguyenvinht 22 Jun '07

22 Jun '07

Can RADIUS policy file in the authentication step reject a few servers to authenticate and allow all others to authenticate? My understanding is that RADIUS can only use IP-Framed Protocol to allow a number of systems to authenticate and reject the rest but can't do the opposite. Any ideas about how to accomplish this would be appreciated. Thanks. Vinh -- View this message in context: http://www.nabble.com/RADIUS-Authentication-tf3918468.html#a11110867 Sent from the FreeRadius - User mailing list archive at Nabble.com.

4 8

radsqlrelay is rude
by Stefan Winter 22 Jun '07

22 Jun '07

Hi, attempting to kill a running radsql with ^C doesn't do anything, and kill'ing it with TERM doesn't impress it either on my system. I had to send KILL to get rid of it. Is this intentional? Then, on startup I see it instantiated but only the post-auth query is printed on startup with -X - leaving me with the question on whether the other queries are actually properly read or not (see below). That's not nice as well. I'm on 1.1.6. Module: Loaded sql_log sql_log: path = "/var/log/radius/radacct/sql-relay-main" sql_log: Post-Auth = "INSERT INTO radpostauth (id, user, pass, reply, date) VALUES ('', '%{User-Name}', '%{RESTENA-Service-Type}', '%{reply:Packet-Type}', '%S')" sql_log: sql_user_name = "" sql_log: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Module: Instantiated sql_log (sql_relay_main) (I'm very sure the config contains Start, Alive, Stop as well) Greetings, Stefan -- Stefan WINTER Stiftung RESTENA - Réseau Téléinformatique de l'Education Nationale et de la Recherche Ingenieur Forschung & Entwicklung 6, rue Richard Coudenhove-Kalergi L-1359 Luxembourg E-Mail: stefan.winter(a)restena.lu Tel.: +352 424409-1 http://www.restena.lu Fax: +352 422473

3 2

multilink
by Mahalakshmi Vijayakumar 22 Jun '07

22 Jun '07

hi, can u give me an instance where multilink is used thank you > > >

2 1

unsubscribe
by Emerson M. Borsatti 22 Jun '07

22 Jun '07

1 0

multilink attempt and double login
by Mahalakshmi Vijayakumar 22 Jun '07

22 Jun '07

hi, wats the difference between multilink attempt and double login..... thank you...

2 1

FreeRADIUS+VLANs
by Darren Maden 22 Jun '07

22 Jun '07

Hi, I found a few articles online about dynamically assigning VLAN IDs to users using RADIUS, this article was the most useful: http://searchsecurity.techtarget.com/general/0,295582,sid14_gci1169011,00.h… I tried setting up something like this from that page using my mysql tables in FreeRADIUS: Tunnel-Type=VLAN (13) Tunnel-Medium-Type=802 Tunnel-Private-Group-ID=VLANID But it doesn't seem to be working. Has anyone had any experience in doing this? It could just be that my NAS isn't compatible but I'd like to know if anyone has had any success doing this and any advice you could give. Thanks, Darren Maden

3 2

Re: Problem with OpenLDAP + FreeRADIUS
by gosha-necr 22 Jun '07

22 Jun '07

Thanks for answer, but this solution is first what i'm check. I'm set chmod -R 444 ./raddb chmod 555 ./raddb and nothing changes.

1 0