- Freeradius-Users - lists.freeradius.org

EAP-AKA patch for Freeradius 1.1.2
by awaneesh kumar 02 Apr '07

02 Apr '07

Hi All, I have downloaded patch from http://bugs.freeradius.org/show_bug.cgi?id=386. I have succesfully applied patch to Freeradius1.1.2. Few questions i have.. a) Does patch supports optional identity privacy support, optional result indications, and an optional fast re-authentication procedure. b) After receiving EAP-Request/AKA-Challenge from server, client should calculate AT_MAC and compares with the received one. If it matches it should send back the EAP-Response/AKA-Challenge with AT_RES and new AT_MAC. As per section 10.8 of RFC 4187, AT_RES should be encoded as follows. The value field of this attribute begins with the 2-byte RES Length,which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary Trace below is packet from client to server:- 0x024200301701000003050000d0d0d0d0d0d0d0d0d0d0d0d0d0d0d0d00b0500 000d6eb3a8082c9d2c0a031505b7a0fac0 c) As per section 3 (Figure 2) from RFC 4187, if server is unable to authenticate client if AT_MAC or AT_RES is incorrect, it should back the EAP-Request/AKA-Notification to client and client should respond back with EAP-Response/AKA-Notification. Then only server should send back EAP result as Failure. But Freeradius1.1.2 sends back the EAP Result (FAILURE) with Access-Reject. How ever success scenarion works perfectly. d) After receiving AKA-Challenge from Radius server, does patch supports the checking of Sequence No from AUTN parameter? Do we have any latest patch to support EAP-AKA? Thanks --------------------------------- Sucker-punch spam with award-winning protection. Try the free Yahoo! Mail Beta.

1 0

RE: Anyone using dd-wrt for AP?
by Aren Chua 02 Apr '07

02 Apr '07

Ian Truelsen you can try the hotspot(chillispot) under DD-WRT firmware to configure your AP to authenticate against the radius server. Regards, Aren Chua> Date: Sun, 1 Apr 2007 10:16:25 +0200> From: aland(a)deployingradius.com> To: freeradius-users(a)lists.freeradius.org> Subject: Re: Anyone using dd-wrt for AP?> > Ian Truelsen wrote:> >> > Hopefully that is not the case. The freeradius server is on an external> > machine. I am trying to get the AP to authenticate against that server,> > but I am having trouble sorting out how to get it to do this.> > There should be a RADIUS server configuration. But you'll have to> enable 802.1x authentication, too.> > Alan DeKok.> --> http://deployingradius.com - The web site of the book> http://deployingradius.com/blog/ - The blog> - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html _________________________________________________________________ Your friends are close to you. Keep them that way. http://spaces.live.com/signup.aspx

1 0

Attributes
by Shawn Mitchell 02 Apr '07

02 Apr '07

Ok, I've looked through the doc's, tried several different things, but I'm not able to figure this out. In my clients.conf file, I have listed several clients. But some of them, I need to pass some attributes that are not needed/wanted on others. Where can I say "If client is 'x', then also send these attributes to users being authenticated..."? Thanks in advance!

3 4

Re: Freeradius-Users Digest, Vol 24, Issue 2
by Arran Cudbard-Bell 01 Apr '07

01 Apr '07

>> Does anyone have a draft list of which clients actually support the >> Reply-Message and by which methods they can recieve them? >> > > All clients will accept it. Very few will do anything useful with it. > > >> The reason why I ask , it during initial tests (using chap) the built in >> windows CHAP supplicant would display the reply-messages being sent back >> from the server. >> Now we've moved on from CHAP to using EAP and the windows supplicant no >> longer displays the messages. >> > > Yes. > > >> Am I right in assuming that with EAP attributes from the access-accept >> packet only get to the NAS and that the NAS will strip out of the EAP >> message >> and pass it on to the supplicant and thats all the supplicant will ever get? >> > > Yes. > > >> In which case, although the Reply-Message attribute is also supported in >> PoD the client will never actually recieve it when using EAP ? >> > > Yes. > > Alan DeKok. > Ahh, Thanks for clearing that up ! Don't suppose EAP supports encoding the equivalent of a Reply-Message ? P.S Well done for understanding my poorly punctuated morning ramblings :) Arran

1 0

Multipls IP Pools
by Azher Amin 01 Apr '07

01 Apr '07

Hi, I have different Wireless Access Points across the students campus. Each of them support Radius Authentication for users. My question is: Based on Client (i.e. AP) IP address, can i assign different ip pools to them ?? Plz suggest. Regards -Azher -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Reply-Message in various clients & EAP vs CHAP.
by Arran Cudbard-Bell 01 Apr '07

01 Apr '07

Hi, Does anyone have a draft list of which clients actually support the Reply-Message and by which methods they can recieve them? The reason why I ask , it during initial tests (using chap) the built in windows CHAP supplicant would display the reply-messages being sent back from the server. Now we've moved on from CHAP to using EAP and the windows supplicant no longer displays the messages. Am I right in assuming that with EAP attributes from the access-accept packet only get to the NAS and that the NAS will strip out of the EAP message and pass it on to the supplicant and thats all the supplicant will ever get? In which case, although the Reply-Message attribute is also supported in PoD the client will never actually recieve it when using EAP ? Thanks, Arran

2 1

Anyone using dd-wrt for AP?
by Ian Truelsen 01 Apr '07

01 Apr '07

I am trying to set up dd-wrt to use freeradius for authentication with EAP-TLS, however, I have run into a problem: there doesn't seem to be an option under the WPA encryption system for entering the freeradius secret. If anyone has got this working, can you let me know the where and how? The dd-wrt forums have been pretty silent on the issue. -- Ian Truelsen s/v Sting Email: ian.truelsen(a)gmail.com AIM: ihtruelsen MSN: ihtruelsen(a)hotmail.com Google Talk: ian.truelsen(a)gmail.com

2 3

Authorization/SER problems
by Dariusz Dwornikowski 31 Mar '07

31 Mar '07

HI, I managed to do password checking for user, it works. Now i would like to return soem things in Access-Accept when SER sends packet : rad_recv: Access-Request packet from host 10.240.0.144:35694, id=160, length=64 User-Name = "foo(a)sip2.foo.pl" Service-Type = SIP-Caller-AVPs NAS-Port = 0 NAS-IP-Address = 10.240.0.144 but i get Access-Reject : modcall: leaving group authorize (returns ok) for request 3 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Login incorrect: [foo(a)sip2.foo.pl/<no User-Password attribute>] (from client openser2 port 0) I juest ant to return some parameters. -- Dariusz Dwornikowski tdi(a)vercom.pl

1 1

Joshua Borsman is out of the office.
by Joshua Borsman 30 Mar '07

30 Mar '07

I will be out of the office starting 03/30/2007 and will not return until 04/09/2007.

1 0

chap rlm_sql authentication problem
by Andrew Long 30 Mar '07

30 Mar '07

I am adding a new MSC to our list of clients and trying to verify the config with -X and ntradping. I keep getting rejected. I have the following in clients.conf: client 192.168.10.100 (MY LAPTOP IP FOR NOW) { secret = HIEg@l1er1a shortname = cn3200_hiegalleria nastype = other In NTRADPING, I am using: username: bufhiegall_cn3200 secret: HIEg@l1er1a password: password1 (same as in radius.radcheck) I note the "could not find clear text password" at bottom of reply, but am not sure why this is so; The password is present in radcheck. The -X out put is as follows: rad_recv: Access-Request packet from host 192.168.10.100:49424, id=11, length=58 User-Name = "bufhiegall_cn3200" CHAP-Password = 0x8f98ab538676182e04964979e34fbc0580 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "bufhiegall_cn3200", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 radius_xlat: 'bufhiegall_cn3200' rlm_sql (sql): sql_set_user escaped user --> 'bufhiegall_cn3200' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radcheck WHERE Username = 'bufhiegall_cn3200' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'bufhiegall_cn3200' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id, UserName, Attribute, Value, op FROM radreply WHERE Username = 'bufhiegall_cn3200' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'bufhiegall_cn3200' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 rlm_sql (sql): No matching entry in the database for request from user [bufhiegall_cn3200] modcall[authorize]: module "sql" returns notfound for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "noresetcounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "dailycounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "monthlycounter" returns noop for request 0 rlm_sqlcounter: Entering module authorize code rlm_sqlcounter: Could not find Check item value pair modcall[authorize]: module "daypasscounter" returns noop for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group CHAP for request 0 rlm_chap: login attempt by "bufhiegall_cn3200" with CHAP password rlm_chap: Could not find clear text password for user bufhiegall_cn3200 modcall[authenticate]: module "chap" returns invalid for request 0 modcall: leaving group CHAP (returns invalid) for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 11 to 1 I have run all the queries manually on the server, and they all return results as expected (except the query to radgroupreply, as there is nothing configured there). Regards, Andrew Long ****** CONFIDENTIALITY NOTICE ****** NOTICE: This e-mail message and all attachments transmitted with it may contain legally privileged and confidential information intended solely for the use of the addressee. If the reader of this message is not the intended recipient, you are hereby notified that any reading, dissemination, distribution, copying, or other use of this message or its attachments is strictly prohibited. If you have received this message in error, please notify the sender immediately and delete this message from your system. Thank you.

3 10