- Freeradius-Users - lists.freeradius.org

Re: Problems With EAP
by Arjuna Scagnetto 21 Feb '07

21 Feb '07

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I think the Auth-Type value is the problem, try to use an entry like "username" User-Password = "pass" without explicit the Auth-Type value. but if it works i do not realy understand why it works :) i'm a freeradius newbie too. arjuna -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.6 (GNU/Linux) iD8DBQFF3FZC7hNGJisFPxQRAuFqAJ9ebvcnj4Pe5c3dSnKRoKCkdp8JBwCdFJbU gLiRcofUX9yEk+k6AiCyrvc= =9QAG -----END PGP SIGNATURE----- -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.

2 1

Problems With EAP
by Anuj Tripathi 21 Feb '07

21 Feb '07

Hi All I am a newbie to freeradius. I am trying to use freeradius as an authentication server along with a WRT54G Linksys (Cisco) access point. On the client side i have a windows machine where i have enabled PEAP authentication, through which it asks me for user name and password. The problem i am facing is that the Radius server is not getting password, and hence not authenticating. Following is a snippet of the log i got : rad_recv: Access-Request packet from host 10.129.20.111:2863, id=0, length=169 --- Walking the entire request list --- Waking up in 31 seconds... Threads: total/active/spare threads = 5/0/5 Thread 1 got semaphore Thread 1 handling request 0, (1 handled so far) Message-Authenticator = 0xd75320cd909f5132bb834f1196e6f5b3 Service-Type = Framed-User User-Name = "steve" Framed-MTU = 1488 Called-Station-Id = "00-18-F8-64-80-D9:ANUJ" Calling-Station-Id = "00-17-9A-D1-9F-B7" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 54Mbps 802.11g" EAP-Message = 0x0200000a017374657665 NAS-IP-Address = 10.129.20.111 NAS-Port = 7 NAS-Port-Id = "STA port # 7" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "steve", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 0 length 10 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched entry steve at line 80 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns updated) for request 0 rad_check_password: Found Auth-Type Local auth: type Local *auth: No User-Password or CHAP-Password attribute in the request* *auth: Failed to validate the user.* *Login incorrect: [steve/<no User-Password attribute>] (from client localhost port 7 cli 00-17-9A-D1-9F-B7)* Delaying request 0 for 1 seconds Finished request 0 Going to the next request Thread 1 waiting to be assigned a request rad_recv: Access-Request packet from host 10.129.20.111:2863, id=0, length=169 Sending Access-Reject of id 0 to 10.129.20.111 port 2863 --- Walking the entire request list --- Waking up in 3 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 0 with timestamp 45dc2565 Nothing to do. Sleeping until we see a request. My Client file reads : steve Auth-Type := Local, User-Password == "testing" Service-Type = Framed-User, Framed-Protocol = PPP Am I missing out on something ? Kindly help me with this as soon as possible. Its a little urgent. regards, Anuj Tripathi

2 3

VPN and Group Policy
by Berndt Sevcik 21 Feb '07

21 Feb '07

We are using a Cisco ASA Firewall for VPN access (lika a VPN3000). The RADIUS server should authenticate our users and assign them a group policy. Somewhere I read that I have to send the CLASS attribute in the RADIUS reply to assign the grou policy to a user. When I look at the debug output from the firewall I can see that the attribut is sent to the firewall. Also the access accept packet is received by the firewall. Radius: Code = 2 (0x02) Radius: Identifier = 17 (0x11) Radius: Length = 88 (0x0058) Radius: Vector: 2B9061A9AA15E08DA2F1FACCFFD012F7 Radius: Type = 25 (0x19) Class Radius: Length = 16 (0x10) Radius: Value (String) = 4f 55 3d 49 54 2d 53 65 72 76 69 63 65 3b | OU=IT-Service; ,,,,, rad_procpkt: ACCEPT RADIUS_ACCESS_ACCEPT: normal termination RADIUS_DELETE remove_req 0xf6d9874 session 0x208 id 17 free_rip 0xf6d9874 radius: send queue empty Is there an other attribut so send back? Something special to know about freeRADIUS config? Has someone a working config ore some tipps for me? Thanks in advance. Berndt ----------------------------------------- TGM - Die Schule der Technik IT-Service A-1200 Wien, Wexstr. 19-23 Tel. +43(1)33126/316 Fax: +43(1)33126/154 E-Mail: berndt.sevcik(a)tgm.ac.at -----------------------------------------

1 0

EAP on Cisco Cat2960 & Aironet1200: TLS Fails
by Senandung Mendonan 21 Feb '07

21 Feb '07

Hi, I'm setting up a secure authenticated wired and wireless network for a client of mine, closely following the following HOWTO documents:- http://vuksan.com/linux/dot1x/802-1x-LDAP.html integrating latest FreeRADIUS 1.1.4 with recently purchased (end 2006) Cisco Catalyst 2960 and Cisco Aironet 1200. We're attempting to do PEAP authentication with a mix of WinXP and MacOS X as supplicants. Details of each component:- 1. FreeRADIUS v1.1.4 - Running on FreeBSD 6.2-RELEASE, compiled via FreeBSD ports. The raddb config diffs comparing to sample configs:- http://absolute-p.ath.cx/Debug/DIFFS.txt - Nothing out of the ordinary (i.e. standard EAP-PEAP config, using simple users file for now) - The certs in certs directory are recreated as per FAQ item (i.e. via CA.all script + xpextensions). 2. Cisco Catalyst 2960 (show ver):- Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)SEE2, RELEASE SOFTWARE (fc1) Copyright (c) 1986-2006 by Cisco Systems, Inc. Compiled Fri 28-Jul-06 04:33 by yenanh 3. Cisco Aironet 1200 (show ver):- Cisco Internetwork Operating System Software IOS ™ C1200 Software (C1200-K9W7-M), Version 12.3(2)JA6, RELEASE SOFTWARE (fc1) Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2006 by cisco Systems, Inc. Compiled Fri 31-Mar-06 13:44 by pwade The Cisco Aironet 1200 configs closely follow this PDF document:- http://blog.segfault.be/Documentation/Wireles%20802.1x%20+%20PEAP%20with%20… resulting in this config:- http://absolute-p.ath.cx/Debug/aironet1200-config.txt (The author of the above document shared his working Aironet IOS version: c1200-k9w7-mx.123-8.JEA : I am planning to get hold of this and repeat tests). Problem: EAP Fails (Doesn't even get to TLS negotiation). In both cases, we get perpetual "Access-Challenge" messages sent by FreeRADIUS, at a very early stage — even before / during the initial TLS negotiation in EAP. Some FreeRADIUS debugging logs (radiusd -X):- I. Problematic Authenticators:- 1. Aironet 1200:- http://absolute-p.ath.cx/Debug/freeradius1.1.4-users-aironet1200-c1200-k9w7… 2. Cisco Catalyst 2960:- (I will update this post once I get hold of Cisco Catalyst 2960 debug info, which is similar to what I'm seeing with Aironet 1200). II. Working Authenticators:- Meanwhile, I also tested the same environment with the following authenticators, and got it working with no changes:- 1. Linksys WRT54GS (firmware v4.71.1 + hyperwrt-2.1b1-thibor15c):- All works OK with WPA Enterprise, as shown here:- http://absolute-p.ath.cx/Debug/freeradius1.1.4-users-linksyswrt54gs-4.71.1-… 2. Older Cisco Catalyst 2950:- I managed to get hold of an older Cisco 2950 model, with an earlier IOS version, and tested the same environment on it, this time it works! (I will update this post once I get its details and debugging output). This leads to a conclusion that something might be up with latest Cisco IOS implementation i.e. not playing nice with FreeRADIUS. Aside from expressing this issue with our local Cisco support (which I feel will be like barking to the right (but apathetic) tree , since I would think they only support Cisco / MS RADIUS products) ;-) ), I would appreciate if anybody here with experience with such equipment can shed some light on this issue. Thanks in advance! :) p.s. longer and constantly updated version of this post is in my blog:- http://absolute-p.ath.cx/2007/02/12/freeradius-vs-certain-recent-cisco-ios-… --mendonan "Yang mimpikan secangkir kopi panas dengan selimut.." (Dreaming of a cup of hot coffee, and a blanket..")

3 3

Problem with PEAP authentication
by jonr＠destar.net 20 Feb '07

20 Feb '07

Hello, I have a strange problem. I have about 65 users using wpa+PEAP+FreeRadius with Linksys WAP4400n APs. I have 3 buildings with 19 AP's per building using POE and wired back to a switch and each switch in each building uses an ethernet cable to tie into the main switch connected to the server. I have no LDAP or mysql backend and am just using the users file. Here is one of my users in the users file that is having problems: username Calling-Station-Id != "00-0F-B5-B5-35-2E", Auth-Type := Reject username User-Password == "password" Now this user sometimes connects successfully and sometimes he gets this error: Mon Feb 19 17:06:42 2007 : Auth: Login incorrect: [username/<no User-Password attribute>] (from client ShmAp-12 port 0 cli 00-0F-B5-B5-35-2E) Mon Feb 19 17:07:44 2007 : Auth: Login OK: [username] (from client UNKNOWN-CLIENT port 0) Notice the timestamp, this is not the only user this happens to about 20 of about 70 people on this setup. Please let me know what information I could provide that would help isolate this problem. I have found a hotfix put out by Microsoft, hotfix# 885453-x86 and it seems promising but I want to do some more testing before I recommend it. Thanks for any help or ideas, Jon

1 0

check active threads
by Andrew Long 20 Feb '07

20 Feb '07

freeradius 1.4 on CentOS 4.4 How can I verify the number of threads? I only see one process with > ps aux | grep radiusd I could have sworn I used to see each thread with 0.9 and I am concerned that the threads are not starting correctly as defined in radiusd.conf: thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } -- Regards, Andrew Long

3 3

rlm_passwd and Class -attribute
by Lasse Karstensen 20 Feb '07

20 Feb '07

Hello. We're running freeradius 1.0.5 on SLES9, and are trying to set up FR to work against a cisco vpn concentrator. We're using rlm_passwd as backends, both crypt and mschapv2-hashes.(NT-Password) As we've got different groups in vpn, we need to set the Class -attribute in replies sent back to the NAS. This Class -attribute is based on with password file (rlm_passwd) that had the user in question. Previously I've just hacked this together with Exec-Program-Wait in the users -file and a shell script, but I'm now looking for a cleaner solution. Any help appriciated. -- Lasse

2 3

attr_rewrite
by Ben Butler 20 Feb '07

20 Feb '07

Hi, I am having some problems with attr_rewrite. What I want to do is the following at a pre authorisation phase: User-Name = username(a)somedomain.com To User-Name = somedomain.com I want to call by attr_rewrite function for each of the domains that I want to stip the username from prior to authorisation. This is what I have in radiusd.conf: attr_rewrite checkdomain1 { attribute = User-Name searchin = packet searchfor = ".(a)domain1.net" replacewith = "domain1.net" ignore_case = yes new_attribute = no max_matches = 10 append = no This is kind of working but =mMy problem is that I am not sure what to use in the regular expersion for the match query: I have tried .(a)domain1.com, ^$(a)domain1.com, ?(a)domain.com, \w.(a)domain.com I have read the list history and trawlled google and I guess I am just not bright enough to get these pesky (ir)regular expressions! Can someone please tell me what I need to put in here: searchfor = ".(a)domain1.net" To match: anything(a)domain1.net Why Am I doing this??? ---------------------- DSL Wholesale Layer2 Tunneling Switch - (LTS) 1 querries my Radius Server 1 for tunnel paramaters. Radius Server 1 will then for: user(a)mydomain.com into various Tunnels / groups swtiched based on full username to NAS1,2,3 etc domain1.com classify any users at this domain into tunnel1 and switch to LTS 2 domain2.com classify any users at this domain into tunnel2 and switch to LTS 2 Because I dont know the users in domain1&2, I cant authenticate using the fully qualified username, and for other reasons it is not possible to set LTS1 to athenticate its tunnels based on realm rather than username, it has to use username. So -tThis above is why I am trying to rewrite the user to be just a realm in radius server 1 for domain 1&2.net For those that are intersted, what happens next is... LTS 2 then looks up in another radius server (radius 2) for the tunnel ID where to switch the tunnel to for the terminating NAS for that partner/reseller. This NAS will then query its radius server (a third party) to handle the actual user authentication and PPP paramaters. For mydomain.com NAS1,2,3 will querry radius server 3 for the authentication of my own users and PPP paramaters. So: DSL Wholesale LTS -> In house NASes or In house LTS boxes In house LTS boxes -> Partner NASes Kind Regards Ben

3 6

Re: log to mysql?
by Phil Mayers 20 Feb '07

20 Feb '07

Arjuna Scagnetto wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > thanks for answering about the possibility to send the log to mysql > directly from radius. Please don't email me directly, I'm not a helpline. The mailing list is there for a reason. > > But :) could you send me some more infos plz. > > The logs are about everything concern freeradius and not only about > auth/acct on a mysql server. Is it realy possible? I'm sure there are a million ways of sending the non-accounting logs to SQL, but why would you want to - in normal (non-debugging) mode, the FreeRadius logs are basically useless.

2 1

Re: EAP-MD5 test
by Amin BEN ABDALLAH 20 Feb '07

20 Feb '07

Thanks, it works successfully now, but is it possible to choose different EAP Methods for different EAP users. Amin BEN ABDALLAH On Mon, 19 Feb 2007 23:22:44 +0000, Phil Mayers wrote > Amin BEN ABDALLAH wrote: > > > > I am a new user of Radius Server and I want to know > > how to test the authentification of an EAP-MD5 user > > using radtest, radclient or radeapclient. > > > > > > *users file :* > > ___________________________________________________________________ > > ali Auth-Type := EAP, User-Password == "ali" > > Reply-Message = "success" > > Auth-Type needs to die. I seriously think it should be replaced with > an attribute named: > > I-Should-Not-Be-Setting-Auth-Type-I-Acknowledge-What-I-Am-Doing-Is-Wrong > > * don't set Auth-Type > * use := for password > > That is: > > ali User-Password := "ali" > Reply-Message = "success" > > Try again with this. If it fails, repost and when showing debug > output, don't trim it. > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1