- Freeradius-Users - lists.freeradius.org

Authentication methods.
by Evan Vittitow 11 Jan '07

11 Jan '07

The issue is, I want a secure means of authenticating nodes to my WAP, but I don't want to degrade my traffic for things like Quake. The authentication can be encrypted, but not all the traffic. And I did look at pppd. pppd is launching in CHAP mode, and it shouldn't be.

2 1

Testing EAP-PEAP with freeradius
by Bin Chen 11 Jan '07

11 Jan '07

Hi, I want to deploy the EAP-PEAP in our WLAN hotspot, we are using EAP-TLS before and it works fine with our AP. But a PKI is very inconvenient so we want to migrate to EAP-PEAP. Any changes need to be done to radiusd.conf? The client will provide the user-name and password, the file 'users' will used to match the user-name and password? And is it enough? I mean, in EAP-TLS it also need user-name and password, just left the same as EAP-TLS? And, I also want to know when the AP or Windows client encounter obstacle to cooperate with this change, which client should I use to verify in freeradius side the configuration is work but not the windows client's problem? Can radclient be used and how can I do? I am newbie to this area and may be silly question, any help appreciated. Thanks in advance. Bin Chen

4 6

dictionary.3gpp2 suggested patch
by Alexander Serkin 11 Jan '07

11 Jan '07

Hi, freeradius-users. I'd suggest a small patch for dictionary.3gpp2. The corrections include some attributes described in latest 3gpp2 specifications, which are used in our environment. It corrects 3GPP2-R-P-Session-ID to be integer, and sets several attributes according to their description in http://www.3gpp2.org/Public_html/specs/X.S0011-005-C_v3.0_061030.pdf : 3GPP2-Always-On 3GPP2-MEID and http://www.3gpp2.org/Public_html/specs/A.S0008-B_v1.0_061019.pdf (Annex E): 3GPP2-HRPD-Access-Authentication 3GPP2-HRPD-AT-Hardware-Id The patch itself is: --- dictionary.3gpp2.orig 2005-12-01 01:17:18.000000000 +0300 +++ dictionary.3gpp2 2007-01-11 09:39:51.900975000 +0300 @@ -57,12 +57,12 @@ ATTRIBUTE 3GPP2-IP-QoS 36 integer # 37-38 ? ATTRIBUTE 3GPP2-Airlink-Priority 39 integer -ATTRIBUTE 3GPP2-Airlink-Record-Type 40 integer # ? -#ATTRIBUTE 3GPP2-R-P-Session-ID 41 string -ATTRIBUTE 3GPP2-Airlink-Sequence-Number 42 integer # ? +ATTRIBUTE 3GPP2-Airlink-Record-Type 40 integer +ATTRIBUTE 3GPP2-R-P-Session-ID 41 integer +ATTRIBUTE 3GPP2-Airlink-Sequence-Number 42 integer ATTRIBUTE 3GPP2-Received-HDLC-Octets 43 integer ATTRIBUTE 3GPP2-Correlation-Id 44 string -ATTRIBUTE 3GPP2-Module-Orig-Term-Indicator 45 octets # ? +ATTRIBUTE 3GPP2-Module-Orig-Term-Indicator 45 octets ATTRIBUTE 3GPP2-Inbound-Mobile-IP-Sig-Octets 46 integer ATTRIBUTE 3GPP2-Outbound-Mobile-IP-Sig-Octets 47 integer ATTRIBUTE 3GPP2-Session-Continue 48 integer @@ -80,7 +80,10 @@ # The next set of attributes contain sub-types ATTRIBUTE 3GPP2-Remote-IP-Address 59 octets -# 60 - 69 are marked "reserved" +ATTRIBUTE 3GPP2-HRPD-Access-Authentication 60 integer +ATTRIBUTE 3GPP2-HRPD-AT-Hardware-Id 61 octets + +# 62 - 69 are marked "reserved" ATTRIBUTE 3GPP2-Remote-IPv6-Address 70 octets ATTRIBUTE 3GPP2-Remote-Address-Table-Index 71 octets @@ -91,10 +94,7 @@ # the following don't contain subtypes ATTRIBUTE 3GPP2-DNS-Update-Required 75 integer -# Is this 76 or 78? Check... -#ATTRIBUTE 3GPP2-Always-On 76 integer -# 77 ? -#ATTRIBUTE 3GPP2-Always-On 78 integer +ATTRIBUTE 3GPP2-Always-On 78 integer ATTRIBUTE 3GPP2-Foreign-Agent-Address 79 ipaddr ATTRIBUTE 3GPP2-Last-User-Activity-Time 80 integer ATTRIBUTE 3GPP2-MN-AAA-Removal-Indication 81 integer @@ -123,5 +123,6 @@ # The next set of attributes contain sub-types ATTRIBUTE 3GPP2-Remote-IPv6-Octet-Count 97 octets ATTRIBUTE 3GPP2-PrePaid-Tariff-Switching 98 octets +ATTRIBUTE 3GPP2-MEID 116 string END-VENDOR 3GPP2 -- Sincerely Yours, Alexander

1 0

My PPTP+802.1X+MS-CHAP+EAP+OpenLDAP+MySQL Project.
by Evan Vittitow 11 Jan '07

11 Jan '07

I'm a hard core Linux User with a Linux infrastructure I am attempting to expand upon and include FreeRadius, with my existing Linux-only OpenLDAP, Kerberos, Samba, Bind Infrastructure. Here is my situation. I want to be able to create MS-CHAPv2 VPNs, that use pptpd, pppd and freeRadius. I want to secure my Wireless Access points using 802.1X and PEAP, or EAP-TLS that are operated by my Cisco Aironet 340. I'm not interested in encrypting traffic. I have UDP Protocols like Quake 3 that are degraded by WPA, WEP and IPSec. IPSec may get implemented in due time, but for now, thats not on the agenda. My current issue is securing the APs from unauthorized access. My Progess so far: The issue with the VPNs is that even through Client Side PPP uses MS-CHAP, FreeRadius is causing pppd to think its authenticating normal CHAP. Jan 9 03:09:00 kurama pppd[12373]: Peer User failed CHAP authentication rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request Now, The Server works fine when I turn off the Radius plugin and enter the and enter stuff in the chap-secrets. This is the output of radisd -fX rad_recv: Access-Request packet from host 127.0.0.1:35034, id=77, length=62 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "User" Calling-Station-Id = "192.168.0.3" NAS-IP-Address = 192.168.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for User radius_xlat: '(uid=User)' radius_xlat: 'dc=pukey' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to kurama.pukey:389, authentication 0 rlm_ldap: bind as cn=Manager,dc=pukey/password to kurama.pukey:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=pukey, with filter (uid=User) rlm_ldap: looking for check items in directory... rlm_ldap: Adding sambaAcctFlags as SMB-Account-CTRL-TEXT, value [U ] & op=21 rlm_ldap: Adding sambaNTPassword as NT-Password, value AA6D039ED308809C... & op=21 rlm_ldap: Adding sambaLMPassword as LM-Password, value AEC210AF99DB43C... & op=21 rlm_ldap: looking for reply items in directory... rlm_ldap: user User authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "User", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 54 modcall[authorize]: module "files" returns ok for request 0 modcall: leaving group authorize (returns ok) for request 0 rad_check_password: Found Auth-Type MS-CHAP auth: type "MS-CHAP" Processing the authenticate section of radiusd.conf modcall: entering group MS-CHAP for request 0 rlm_mschap: Found LM-Password rlm_mschap: Found NT-Password rlm_mschap: No MS-CHAP-Challenge in the request modcall[authenticate]: module "mschap" returns reject for request 0 modcall: leaving group MS-CHAP (returns reject) for request 0 auth: Failed to validate the user. Why is this happening? I haven't started on the AP security yet, because this is holding me back.

3 4

Return values for rlm_exec scripts
by Garry Glendown 11 Jan '07

11 Jan '07

Hi, I'm trying to configure dynamic values in the users-file, which works fine using the rlm_expr module. Anyway, due to some more complicated expressions that can not be formed using rlm_expr, I tried to set up an external script that will return the value I need ... only problem is: I can't seem to get the format right, and I can't seem to find any docs on what exactly to return so that the %{exec:...} entry will be used ... e.g, on a field that expects a numeric value, I tried something like this: Session-Timeout := `%{exec:/bin/echo 200}` But all I get is this in the loggfile: Mon Jan 8 16:05:24 2007 : Error: Exec-Program-Wait: /bin/echo 200: unparsable reply What do I have to do to get FreeRadius to understand the return value? Thanks!!!

2 4

which users are connected and when ?
by adreas Polyxronopoulos 11 Jan '07

11 Jan '07

Hello list, I have a wlan using freeradius for authentication. I want to create a user-managment application which will help me in monitoring the wlan. The main information i would like to provide with my application is the following : 1) How many users are connected on my wlan and how many are not connected ? 2) Which users are connected on my wlan and when did the connected ? As i have studied freeradius until now i can get this information from detail-file. But i would like to know if i could export detail-file in a mysql-format or if i could have info like detail-file provide in a mySql format. I am intersting in mySql because my application will be in php and the manipulation of mySql database is much easier. Any ideas would be useful....thanks Adreas Polyxronopoulos Send instant messages to your online friends http://uk.messenger.yahoo.com

2 1

Re: ldap { fail=1}
by jerrrry＠voila.fr 11 Jan '07

11 Jan '07

> Message du 10/01/07 à 15h38 > De : "Alan DeKok" > A : jerrrry(a)voila.fr, "FreeRadius users mailing list" > Copie à : > Objet : Re: ldap { fail=1} > > jerrrry(a)voila.fr wrote: > > > > i'm using freeradius 1.0.1 from Red Hat entreprise 4. > > You SHOULD upgrade: > > http://freeradius.org/security.html > > > I want the radius server to authenticate users thanks to the "users" > > file even if the ldap directory is not reachable and the radius server > > to start even if the DB is not reachable > > That's probably the way the server should work. Those issues probably > weren't though of when the server was written, as the SQL module works > the same way. > > > I tried with ldap { fail =1} in the authorize section and sql { fail > > = 1 } in the instantiate section without any success. > > > > "fail" doen't seem to be know. > > No, it doesn't work in the "instantiate" section. It could, though. > It's a good idea, and one I hadn't thought of. so there is no solution to backup my nas client list thanks to freeradius with somethng like instantiate{ redundant { sql1 sql2 } } Thomas > > An alternative would be to update the LDAP module to NOT bind at > startup, and do it only when a request came in. That would help, too. > > Alan DeKok. > -- > http://deployingradius.com - The web site of the book > http://deployingradius.com/blog/ - The blog > >

1 0

FreeRadius Project PEAP/MS-CHAP
by Evan Vittitow 11 Jan '07

11 Jan '07

Do you know why my pppd would launch inappropriately in CHAP Mode rather than MS-CHAP.

1 0

FreeRadius Project PEAP/MS-CHAP
by Evan Vittitow 11 Jan '07

11 Jan '07

Do you know why my pppd would launch inappropriately in CHAP Mode rather than pppd.

1 0

Authentication accept/deny based on realm
by Lisa Casey 11 Jan '07

11 Jan '07

Hi, I am using freeradius. I currently have two realms setup in mu users file with fallthrough=yes for both of them since the usernames/passwords are also in the users file and I need to be able to match on those. Currently, if username johndoe logs in as johndoe(a)realm1.com he gets accepted. If he then logs in as johndoe(a)realm2.com he will also get accepted since freeradius looks at the users file (and the realms file) finds the realm is valid, then goes on down the users file, finds the username/password valid, thus accepting the login. I'ld like to have it so that if johndoe logs in as johndoe(a)realm1.com he gets authenticated, but if he logs in as johndoe(a)realm2.com he does not. I'm not sure how to do that. I've googled a bit but didn't come up with anything that looked helpful. If someone could point me in the right direction, I'ld appreciate it. Lisa Casey

2 1