- Freeradius-Users - lists.freeradius.org

RE: Peap mschapv2 proxy early termination of EAP
by Yogesh Nagarkar 28 Oct '06

28 Oct '06

EAP-PEAP-MSCHAPv2 hack for FreeRADIUS 1.1.3 If anyone has been following the threads http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg30477.… http://www.mail-archive.com/freeradius-users@lists.freeradius.org/msg22903.… The solution was: Edit : freeradius-1.1.3/src/main/request_list.c Comment out line 321: ----------------------------------------- proxy_ipaddr = listener->ipaddr; change to /*proxy_ipaddr = listener->ipaddr;*/ ----------------------------------------- Comment out line 797: request->proxy->src_ipaddr = proxy_ipaddr; Change to /*request->proxy->src_ipaddr = proxy_ipaddr;*/ ---------------------------------------- Compile request_list.c make && make install and we have FreeRADIUS 1.1.3 successfully authenticating: Microsoft Windows Supplicant -------> Request--------> Proxy Server -------- MSCHAPv2------> Home Server (WPA1/TKIP/PEAP) (PEAP tunnel ends) (Access Accept) Microsoft Windows Supplicant <------- Response------ Proxy Server <--------- MSCHAPv2------ Home Server (success) (Copy to PEAP tunnel) -------------------------------------------------- /etc/raddb/users file (proxy server) DEFAULT User-Name =~ "@somerealm.net", FreeRADIUS-Proxied-To == 127.0.0.1, Proxy-To-Realm := inner-somerealm /etc/raddb/proxy.conf file (proxy server) realm somerealm.net { type = radius authhost = LOCAL accthost = LOCAL nostrip } realm inner- somerealm{ type = radius authhost = xxxxxxxxx:1645 accthost = xxxxxxxxx:1646 secret = xxxxxxxx ldflag = round_robin nostrip } ------------------------------------------------- /etc/raddb/users file (home server) kirkhammet(a)somerealm.net User-Password == xxxxxxxxxx Reply-Message = "Enter Sandman!" ------------------------------------------------- Good luck :) Yogesh Nagarkar ------------------- Related thread ---------------------------------- I have tried the examples in those postings as well as suggestions from other postings without any success. I have started with the default config and turned on the debug option. However, looking at the debug output yet I couldn't quite figure out what went wrong. What I got so far is as follow: 1) Send a PEAP/MSCHAPv2 request using Linux's Xsupplicant or Mac client to the proxy radius 2) Proxy radius terminated EAP locally and proxied request (MSCHAPv2 minus EAP) to home radius 3) Home radius responded with an access-accept packet to proxy radius 4) Proxy Radius sent access-reject to client. See error output below. Tue Oct 3 20:10:37 2006 : Debug: rlm_eap: Request not found in the list Tue Oct 3 20:10:37 2006 : Error: rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request Tue Oct 3 20:10:37 2006 : Debug: rlm_eap: Failed in handler I am running Freeradius 1.1.3 and have attached below my configuration files and an excerpt of the debug output hoping that the mistake would look obvious to some of you and that you could provide some helpful pointers or links. Thanks a lot for your help. -David In case, anyone is following this thread, the problem was solved by downgrading from Freeradius 1.1.2 and above running on Solaris 9 down to Freeradius 1.0.5 running on the same OS. Still tracing this issue through the debugger and will post to this thread if more information is available. Best, David ----------------------------------------------------------------------

1 0

Why is radiusd command not found?
by Chad Best 28 Oct '06

28 Oct '06

This is a total newbie question, but I can figure out the answer to it so I decided to post here. I have installed Freeradius-1.0.0(little behind the times, I know). After I finished configuring the radiusd.conf, eap.conf, and users files, I tried to start FreeRadius in debug mode. However, when I type "radiusd -X", I get command not found. What did I do wrong? When I installed the program, I just ran ./configure, make, make install so it should have installed properly. Any help would be greatly appreciated.

3 2

SQLIPPOOL problem
by Guilherme Franco 28 Oct '06

28 Oct '06

Hi, This is very important, please. In ippool module I can use two or more pools just by setting ippool POOL1{...} ippool POOL2{...} In SQLIPPOOL, I know that I can create as many pools as I wan't but I need to treat that pools differently, say, POOL1 assigns static IPs and POOL2 dynamic ones, or POOL1 is in databaseX and POOL2 in databaseY. So I did this sqlippool.conf: sqlippool POOL1{...} sqlippool POOL2{...} And then in radiusd.conf post-auth{ POOL1 POOL2 } But the user that have Pool-Name := POOL2 in radcheck receives the IP (because POOL2 exists in the database), but it's not treated by the POOL2 instance created in sqlippool.conf (radiusd -X shows that both module POOL1 and POOL2 are instantiated), it's being treated by the POOL1 instance. So, how can I tell that for users that belong to POOL2 use the POOL2 module, instead of POOL1 and vice-versa? Thank you.

2 2

RE: FR with AD authentication not working
by Karthik R 28 Oct '06

28 Oct '06

> -----Original Message----- > But while using radtest tool with the same logon credentials > as above it rejects the user and here is the log message. Please paste the entire debug log. It looks like you missed a few bits in the cut and paste. Mike, Here is the entire debug log. In the users file, auth-type =system has been commented out. Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = no proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = no mschap: with_ntdomain_hack = yes mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Respo nse:-00}" Module: Instantiated mschap (mschap) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap_tls: Loading the certificate file as a chain rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32772, id=101, length=61 User-Name = "<removed>" User-Password = "<removed>" NAS-IP-Address = 255.255.255.255 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "<removed>", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 modcall[authorize]: module "files" returns notfound for request 0 modcall: leaving group authorize (returns ok) for request 0 auth: No authenticate method (Auth-Type) configuration found for the request: Rejecting the user auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 101 to 127.0.0.1 port 32772 Waking up in 4 seconds... Kartthik

2 1

experienced FreeRadius users in Switzerland?
by Sean.Boran＠swisscom.com 27 Oct '06

27 Oct '06

Hi, I was wondering if there any Swiss based sysadmins or developers listening; I be interested in a physical meeting (BE,ZH,LS or GE) to exchange 802.1x experience and ideas. [I speak DE/FR too if that helps] Thanks in advance, Sean Boran [s e a n AT b o r a n. c o m]

1 0

RE: exec external script on successful proxy authentication
by Garber, Neal 27 Oct '06

27 Oct '06

> you are saying that it is possible to put the "exec" module into this > stage? Well, under the heading "I'd rather teach you to fish than give you a fish", you can determine this by looking at the source. If you look at the bottom of src/modules/rlm_exec.c, you'll find: module_t rlm_exec = { "exec", /* Name */ RLM_TYPE_THREAD_SAFE, /* type */ NULL, /* initialization */ exec_instantiate, /* instantiation */ { exec_dispatch, /* authentication */ exec_dispatch, /* authorization */ exec_dispatch, /* pre-accounting */ exec_dispatch, /* accounting */ NULL, /* check simul */ exec_dispatch, /* pre-proxy */ exec_dispatch, /* post-proxy */ exec_dispatch /* post-auth */ }, exec_detach, /* detach */ NULL, /* destroy */ }; This indicates that post-proxy and post-auth are valid for rlm_exec. If you do the same for rlm_files.c, you'll see NULL for post-proxy and post-auth. So, files does nothing in these stages. > If this is so, what is the syntax? In the other places exec > module was used from the users file with something like Read radiusd.conf. You would define the module and then use it in the post-proxy or post-auth section of that file.

1 0

RE: exec external script on successful proxy authentication
by Garber, Neal 27 Oct '06

27 Oct '06

> Is there a way to execute a script with the original request > attributes at the time of successul receipt of authentication reply > from a home server when FreeRADIUS is used as a proxy? We require to > execute an auxilary action on successful authentication, but currently > have only found ways to do this at the time of request. Have you looked at the post-proxy and/or post-auth stages in radiusd.conf? You could call a perl script during those stages. The request and reply attributes are available in hashes within the perl script.

2 1

Accountig-Response
by Vasea Marii 27 Oct '06

27 Oct '06

I need to configure freeradius to send specific attributes in accounting-response packet! I use a MySQL database that's why it would be nice to configure freeradius to send these attributes(in VSA ) from the database! In sql.conf there are auth_reply configuration queries but i couldn't find a way to make it for account-response! My NAS is absolutelly configurable so there is no problem with NAS understanding these new Attributes! Thanks! --------------------------------- Yahoo! Messenger with Voice. Make PC-to-Phone Calls to the US (and 30+ countries) for 2¢/min or less.

2 6

exec external script on successful proxy authentication
by Mike 27 Oct '06

27 Oct '06

Dear list, Is there a way to execute a script with the original request attributes at the time of successul receipt of authentication reply from a home server when FreeRADIUS is used as a proxy? We require to execute an auxilary action on successful authentication, but currently have only found ways to do this at the time of request. Also, is it possible to add arbitrary attributes to the proxied response? Something just like preproxy_users, but rather post_proxyusers?

1 0

Re: FR with AD authentication not working
by Karthik R 27 Oct '06

27 Oct '06

Message: 2 Date: Fri, 27 Oct 2006 09:22:39 +0100 From: A.L.M.Buxey(a)lboro.ac.uk Subject: Re: FR with AD authentication not working To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Message-ID: <20061027082239.GB29794(a)lboro.ac.uk> Content-Type: text/plain; charset=us-ascii hi, remove the System authentication line from your users file. alan Alan, I tried commenting that line, but no luck, Kartthik

1 0