- Freeradius-Users - lists.freeradius.org

Re: Transmitted packet
by Iandc Davies 22 Sep '05

22 Sep '05

> "Iandc Davies" <Iandc.Davies(a)Marconi.com> wrote: > The contents of the transmitted packet include an uint8_t *data. > > What exactly is this pointing to ? >> The transmitted packet. >> Your terminology is confused: Aaahhh, I think it is. OK. >> - RADIUS_PACKET = internal FreeRADIUS data structure holdin uint8_t *data >> - uint8_t *data = actual RADIUS packet sent via "sendto" >> Alan DeKok. So, if I was to sent a packet to the radius server what format would it be ? I was running under the understanding that I needed to populate the contents of the RADIUS_PACKET structure, therefore :- int sockfd - uint32_t src_ipaddr - uint32_t dst_ipaddr - u_short src_port - u_short dst_port - int id - to be populated by me unsigned int code - to be populated by me uint8_t vector[16] - to be populated by me time_t timestamp - int verified - uint8_t *data - int data_len - to be populated by me VALUE_PAIR *vps - to be populated by me Apart from the above is there anything else that needs filling in ? .... or am I completely wrong again ? Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

proxy EAP/PAP ?
by Tim Winders 22 Sep '05

22 Sep '05

Hello All - As I can't seem to get freeradius working on my Tru64 box and my box seems to be "broken" I thought I'd try to install freeradius on a RHEL box and use the fr proxy feature to proxy back to my Tru64 box running the Livinginston Radius server. My question, I want to be able to authenticate against the Tru64 passwd user database from a Windows client connected to a wireless AP running WPA. When I had a working fr on the Tru64 box, I was able to use the SecureW2 supplicant on XP with EAP/PAP to authenticate against passwd and it worked great. So, now, if I am running a non-EAP aware radius on the Tru64, and freeradius on a Linux box proxying to the Tru64 box, will I be able to do EAP/PAP authentication? I'm ready the proxy doc, but, I don't see anything about that, or if it's even applicable. --- Tim Winders Associate Dean of Information Technology South Plains College Levelland, TX 79336 Problem replying to my email? Click the "Sign" button in the OE toolbar or, better yet, get your own FREE Personal E-Mail Digital ID: http://www.thawte.com/email/index.html

3 4

Serializing database requests
by Mike Chamberlain 22 Sep '05

22 Sep '05

Hi there. We are using FreeRadius on a VoIP network, talking to a database holding account information. Consider the following sequence of SQL statements generated by FreeRadius, which in some cases are producing a problem for us: AUTHENTICATE EXEC Rad_Authenticate '1211170776', '0889810576', '', '34333239 66326330 65380031 34383800', 'h323-ivr-out=ACCESSCODE:4441', '', '211.26.139.42', '' AUTHORIZE EXEC Rad_Authenticate '1211170776', '0889810576', '00113162558045', '34333239 66326330 65380031 34383800', 'h323-ivr-out=ACCESSCODE:4441;h323-ivr-out=FOLLOW_ON_FLAG:0', '', '211.26.139.42', '' STOP ACCOUTNING EXEC Rad_Stop_Accounting '1211170776', '34333239 66326330 65380031 34383800', '34333239 66326330 65380031 34383800', 'answer', '0889810576', '4441', '10', '51', '211.26.139.42', 'au-syd-primus1' We are currently not using start accounting messages. In the above case, the authorize messages and stop accounting messages are generated almost simultaneously because the user has hung up immediately after dialling the number. But the authorize procedure takes longer to process than the stop accounting procedure, meaning that the stop procedure completes before the authorize. This means that in effect the two messages get processed back to front. In our scenario this leaves a call open in the database that will never be closed. How do other people cope with this? Is there some way of forcing FreeRadius to serialize requests from the same username so it won't issue a new one until it has received a response for an existing one? Thanks in advance for any help, Mike

2 1

Implementation advice needed.
by Daniel Corbe 22 Sep '05

22 Sep '05

Hello, I'm looking for a couple of suggestions as how to implement some specifics. I've set up a FreeRADIUS server to do AAA primarily in a SIP enviornment. I've got a B2BUA which attempts to authorize outgoing calls. I want to use this to do Least Cost Routing. Upon an INVITE packet, the B2BUA sends the following attributes User-Name = "1234" User-Password = "." NAS-IP-Address = 10.10.17.5 NAS-Port = 1000 Called-Station-Id = "5551212" Calling-Station-Id = "1234" This is enough information for me to authorize the phone call. Here are my questions 1) I have tariff tables stored in a back-end database. What would be the best way to go about looking up this information? Is there some way to execute a custom SQL lookup to pull this information back? Or should I be calling exec to say a custom script? 2) If exec is the best way to go about doing this, am I correct in reading the documentation that my script should be returning 0 (Access-Accept) or 1 (Access-Reject)? 3) I can customize my B2BUA so it accepts an IP address to forward a SIP request along. Is there a way either from exec or another method to add Radius attributes to the reply packet? That way I can do true LCR and tell the B2BUA which Gateway to forward the request. Thanks. -Daniel

1 0

WPA with freeradius
by poczta＠flashnet.pl 22 Sep '05

22 Sep '05

Hello i want to configure freeradius with hardware adsl router ... could you sugest me some? i've got linksys wag54g which doesnt support pure radius but WPA radius.. is it posible to make them work together with my freeradius server? any hints, links (!), anything... i've searchd faqs and lists but i haven't found anything special (or i didn't search enough) thanks wasyl

2 1

Transmitted data to radius server.
by Iandc Davies 22 Sep '05

22 Sep '05

Firstly, thanks to all of you with being this patient with me. I think I've got a handle on the method. Please correct me if I'm wrong in either terminology or content. For the purpose of this mail, please use the following meanings: Server = RADIUS Server Client = "The thing that sends information to the server." OK, To construct a message that is received by the sever from the client, I can create a structure of the following type: typedef struct radius_packet{ int id, unsigned int code, uint8_t vector[16], VALUE_PAIR *vps; }RADIUS_PACKET The VALUE_PAIR struct is as defined currently. The radius server will receive the transmitted packet by passing a file descriptor and a data array to a system function call recvfromto. Data then holds the received data in the following uint8_t format. data[0] - code data[1] - identifier data[2] - length (HSB) data[3] - length (LSB) data[4] - vector[0] (16 octect authenticator) data[5] ...... data[19] - vector[15] data[20] - start of value_pair sequence. ....... If that is correct so far, radius than re-alignes to evaluate the value_pairs. This is where, again my understanding of the code is a bit hazy. Any help appreciated. :-) Therefore data[20] is mapped to a pointer attr. attr[0] - holds vp->attribute attr[1] - holds vp->length The server sanity checks the sum of the lengths of the attributes against the data length of the mesage. Once this happens, the servers mem copies the data array to RADIUS_PACKET -> data and treats it as it will. Many thanks and a promise to buy you a drink or three if I see you ;-) Ian Davies {02476 564662} Internal (x740 4662) IMS-SIPAC Software Development Engineer

2 1

RE: cannot return access accept from proxy to client
by Wilson Lie 22 Sep '05

22 Sep '05

Hi , Thanks for your help. I'm not sure that I can tell the case clear enough. But I'm afraid that you misunderstood the question. Kindly help me again or correct me if I'm really wrong. >> No. FreeRADIUS doesn't care about User-Name's in Access-Accept. Yes, for normal Access-Accept if Host B act as server , the access-accept can be sent back to client But when access-accept is sent from host A -> Host B , from host B debug log, it can be seen that as user-name is missing, the [sql] module cannot be run , freeradius return failed in [sql] where [sql] refers to post-auth query in this case and the statement contains "User-name" attribute (e.g. update xxx set xxx where username=attribute ) So I would like to ask if any special handling by freeradius in this case ? As the post-auth [sql] section is configured in sql.conf and it should be same because only one post-auth query can be configured. Or "user-name" attribute can never be included in the post-auth query in this case ? ( i.e. Host B acts as both proxy and auth-server) Many thanks! ==================== Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 3 radius_xlat: '/usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/reply-detail-20050921' rlm_detail: /usr/local/var/log/radius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /usr/local/var/log/radius/radacct/xxx.xxx.xxx.xxx/reply-detail-20050921 modcall[post-auth]: module "reply_log" returns ok for request 3 rlm_sql (sql): Processing sql_postauth radius_xlat: '' modcall[post-auth]: module "sql" returns fail for request 3 modcall: group post-auth returns fail for request 3 Delaying request 3 for 1 seconds Finished request 3 ===================== -----Original Message----- From: Alan DeKok [mailto:aland@ox.org] Sent: 2005/9/22 [星期四] 下午 11:19 To: FreeRadius users mailing list Cc: Subject: Re: cannot return access accept from proxy to client "Wilson Lie" <wilson.lie(a)ithlgroup.com> wrote: > I suspect that the freeradius will return failed at once when > "username" attribute is not found and because the username attribute > won't be included in the "access-accept' packet . No. FreeRADIUS doesn't care about User-Name's in Access-Accept. > The "sql" can be executed successfully when host B acts as > authentication server.=20 Look at the differences between the two queries. They ARE different. > So maybe I should ask can freeradius be configured as both > authentication server and proxy server at the same host ? Yes. Many, many people have configured this successfully. If your site doesn't work, it's because something is going wrong in your local config, and debug mode will tell you. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html ____________________________________________________________ (c) 2005 Interactive Technology Holdings Limited Group. All rights reserved. CONFIDENTIALITY: This communication and any attachment(s) is intended solely for the person or organisation to which it is addressed and it may be confidential. This communication may contain confidential or legally privileged material and may not be copied, redistributed or published (in whole or in part) without our prior written consent. This communication may have been intercepted, partially destroyed, arrive late, incomplete or contain viruses and no liability is accepted by any member of the Interactive Technology Holdings Limited Group as a result. If you are not the intended recipient, employee or agent responsible for delivering the message to the intended recipient you must not copy, disclose, distribute or take any action in reliance on it. If you have received this communication in error, please immediately reply and highlight the error to the sender immediately and destroy the original from your computer.

2 1

Radattr not showing MPPE values
by John Horne 22 Sep '05

22 Sep '05

Hello, Slightly off-topic maybe: I have been testing out the radattr plugin we use with ppp/radius (ppp version 2.4.3), to see the values printed out. For some reason the values of MS-MPPE-Encryption-Policy and MS-MPPE-Encryption-Types are not shown (the variable name is shown but not their values). Anyone know why this is happening, suggestions? Thanks, John. -- --------------------------------------------------------------- John Horne, University of Plymouth, UK Tel: +44 (0)1752 233914 E-mail: John.Horne(a)plymouth.ac.uk Fax: +44 (0)1752 233839

1 0

EAP-TLS authentication problem
by park jeho 22 Sep '05

22 Sep '05

hi All ! i have one problem for wireless connection after authentication procedure using EAP-TLS authentication method through a radius server . i have not solved this problem for about two week .. :-) wondering is that after xsupplicant print out "AUTHENTICATED" message , my wireless card even can't connect to AP or other links i cant get a any ping reply from other host ! but during athentication prcedure, radius server sent "Access-Accept " message with MS-MPPE-Recv-Key and MS-MPPE-Send-Key to AP, then xsupplicant display authentication success message like below ->[ALL] Got EAP-Success! ->Authenticated! [ testbed ] WN(192.168.1.2) < -- wireless network -- > AP (192.168.1.1) <----- LAN -----> Authentication Server (192.168.1.3) - WN [hardware] : thinkpad R52 [OS]: debian3.1, kernel 2.6.11.11 [software] : xsupplicant 1.2pre and 1.2.1 configuration file -> openssl 0.9.7a ieee802 v1.0.3 ipw2200 v1.0.6 ( intel pro/wireless 2915ABG ) xsupplication configuration : http://jhpark.guideline.co.kr/project/mds/xsupplicant/xsupplicant-tls.conf - AP [hardware] : ASUS wl500g, firmware v 1.9.4 configuration info : http://jhpark.guideline.co.kr/project/mds/AP/ap_config_info.txt - Authentication Server [hardware] : toshiba tecra m3 [OS]: debian3.1, kernel 2.6.13 [software]: freeradius v1.0.4, openssl v0.9.7e ( /usr/lib is base install path ) freeradius configuration : radiud.conf -> http://jhpark.guideline.co.kr/project/mds/freeradius/radiusd.conf eap.conf -> http://jhpark.guideline.co.kr/project/mds/freeradius/eap.conf other config -> http://jhpark.guideline.co.kr/project/mds/freeradius/ 1. association command with iwconfig root@debian#iwconfig eth1 essid asus key [xxxxx: 26 hex key which was setup in AP wep key] open 2. xsupplicant exec command root@debian#/usr/local/sbin/xsupplicant -i eth1 -d 7 -f -c /root/xsupplicant-tls.conf 3. interface up root@debian#ifconfig eth1 92.168.1.3 netmask 255.255.255.0 up and as a result, i got this xsupplicant result message ---------------------snip ------------------------ Stats for Interface eth1 : EAPOL Frames RX : 8 EAPOL Frames TX : 8 EAPOL Starts TX : 1 EAPOL Logoff TX : 0 EAPOL Resp. ID TX : 1 EAPOL Resp. TX : 6 EAPOL Req. ID RX : 1 EAPOL Req. RX : 6 EAPOL Invalid Frame: 0 EAP Length Error : 0 Last EAPOL Version : 1 Last EAPOL Src. :00 11 D8 24 69 AA EAPOL Success : 1 EAPOL Failure : 0 [STATE] Backend State : RECEIVE -> SUCCESS [STATE] Backend State : SUCCESS -> IDLE [ALL] Got Frame : -------------------- snip --------------------------------- Processing EAPoL-Key! [INT] Key Descriptor = 1 [INT] Key Length = 13 [INT] Replay Counter = 83 AA 80 92 94 9F 62 2A [INT] Key IV = B9 11 F5 37 D3 57 75 DB C4 F7 F1 47 98 BB 55 58 [INT] Key Index (RAW) = 83 [INT] Key Signature = C2 76 90 CD 97 20 AA CF 8A EB 12 C8 DD 45 BC B9 [INT] EAPoL Key Processed: unicast [4] 13 bytes. [INT] Using peer key! *WARNING* This AP uses the key generated during the authentication process. If reauthentication doesn't happen frequently enough your connection may not be very secure! [INT] Successfully set WEP key [4] [INT] Successfully set the WEP transmit key [4] [INT] Got an RTM_NEWLINK! [INT] Wireless event: cmd=0x8b2a len=12 [INT] Encryption key set [STATE] AUTHENTICATING -> AUTHENTICATED [ALL] Canceled timer for 'authentication timer'! [INT] Got an RTM_NEWLINK! [INT] Wireless event: cmd=0x8b2a len=12 [INT] Encryption key set ------------------------------------------------------------------ Full xsupplicant message is this ( http://jhpark.guideline.co.kr/project/mds/xsupplicant/xsupplicant.result ) above all, i can't sure AP and WN (client) have successed in making a right pairwise transient key. if pairwise transient key was made perfectly, why Wn node can't connect other network links ? here is radiusd message during processing above client request. root@debian#radiusd -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf Config: including file: /usr/local/etc/raddb/snmp.conf Config: including file: /usr/local/etc/raddb/eap.conf Config: including file: /usr/local/etc/raddb/sql.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = yes main: log_auth_badpass = yes main: log_auth_goodpass = yes main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "root" main: group = "root" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAPv2" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded eap eap: default_eap_type = "tls" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = no tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: certificate_file = "/usr/local/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/etc/raddb/certs/root.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/etc/raddb/certs/dh" tls: random_file = "/usr/local/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded detail detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (auth_log) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = yes realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/etc/raddb/users" files: acctusersfile = "/usr/local/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded System unix: cache = no unix: passwd = "/etc/passwd" unix: shadow = "/etc/shadow" unix: group = "/etc/group" unix: radwtmp = "/usr/local/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded radutmp radutmp: filename = "/usr/local/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) detail: detailfile = "%A/%{Client-IP-Address}/detail" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (reply_log) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 192.168.1.1:2048, id=0, length=129 User-Name = "testUser" NAS-IP-Address = 192.168.1.1 Called-Station-Id = "0011d82469aa" Calling-Station-Id = "0012f0947701" NAS-Identifier = "0011d82469aa" NAS-Port = 34 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d017465737455736572 Message-Authenticator = 0x0a886b447e7581235a7974ecabcc0d92 ------------------ snip ---------------------------------------------------- modcall: group post-auth returns ok for request 6 Sending Access-Accept of id 0 to 192.168.1.1:2048 Session-Timeout := 900 MS-MPPE-Recv-Key = 0xb6eed12463e0d9089d372359a2ee586ef35c93293d0579ab053fe2fd617b8353 MS-MPPE-Send-Key = 0x79ae9d4df30ea49dbc6fe5884a20da515fd6b23b2cc9f0cfd44503e0fc2e6c9b EAP-Message = 0x03060004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "testUser" Finished request 6 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Cleaning up request 6 ID 0 with timestamp 43323914 Nothing to do. Sleeping until we see a request. ---------------------------------------------------------------------------------- Full radiusd result message is this ( http://jhpark.guideline.co.kr/project/mds/freeradius/radiusd.result Why i can't connect any other host after finishing EAP-TLS authenticaiton procedure ? and someone please explain to me why xsupplicant prints driver warning message previously Thanks ! --- http://jhpark.guideline.co.kr private mail : linuxpark(a)kernelproject.org

1 0

accounting analysis
by Marc-Henri Boisis-delavaud 22 Sep '05

22 Sep '05

Hello do you a free tool to generate analysis from freeradius accounting ? ----------------------------------- Marc

2 1