- Freeradius-Users - lists.freeradius.org

problem with Auth-Type DIGEST
by freeradius＠list.coretech.ro 01 Sep '05

01 Sep '05

hello, I am using digest auth and I want to upgrade from cvs version (2005-02-19) to cvs version (2005-09-01). everything seems to be ok except that the digest auth does not work anymore. I have noticed, in debug mode (radiusd -X), the following differences between the two versions: ===== cvs version (2005-09-01) ===== rad_check_password: Found Auth-Type DIGEST auth: type Local auth: No User-Password or CHAP-Password attribute in the request ===== cvs version (2005-09-01) ===== ===== cvs version (2005-02-19) ===== rad_check_password: Found Auth-Type DIGEST auth: type digest ===== cvs version (2005-02-19) ===== ===== relevant portions of radiusd.conf ===== modules { ..................... digest { } } authorize { preprocess auth_log chap digest sql } authenticate { Auth-Type PAP { pap } Auth-Type CHAP { chap } digest } ===== relevant portions of radiusd.conf ===== is something changed in configuration ? Thanks, Razvan Radu

2 1

RE: Freeradius and Linksys WRT54GS
by Guy Davies 01 Sep '05

01 Sep '05

Are you sure that the Linksys AP supports LEAP. LEAP is a somewhat proprietary Cisco method that places unusual requirements on the AP (unlike other EAP methods that are simply converted from EAP in EAPOL to EAP in RADIUS by the AP). I know that Linksys is now owned by Cisco but I am not sure that they've implemented LEAP capabilities. AFAIK, Apple is the only other vendor to support LEAP. LEAP isn't a particularly strong EAP method anyway. I'd recommend (and so would Cisco, now) using a different method (PEAP/MS-CHAPv2 if you must, EAP/TTLS if you can). So long as the Linksys can do EAP passthrough, you should be OK with these. Rgds, Guy > -----Original Message----- > From: freeradius-users-bounces(a)lists.freeradius.org > [mailto:freeradius-users-bounces@lists.freeradius.org] On > Behalf Of Thierry > Sent: 01 September 2005 10:25 > To: freeradius-users(a)lists.freeradius.org > Subject: Freeradius and Linksys WRT54GS > > > Hi, > > I got a freeradius configured to handle LEAP authentication. > > it works with a Cisco AP Cisco Airnet 1100: > client 10.0.0.1 { > secret = secret > shortname = apcisco > nastype = cisco > } > > But it fail for linksys WRT54GS: > > client 192.168.1.1 > { > secret = secret > shortname = linksys > nastype = cisco > } > > I tried different nastype : > With other or nastype commented, nothing happen after > identity frames. With cisco nastype, LEAP didn't finish, AP > does not send the last frame to respond to supplicant challenge. > > Is there a specific nastype for Linksys ot this AP is bugged > ? I tried with another RADIUS (SBR/Windows) with the same comportment. > > Do you know other AP than cisco ones that permit 802.1X > successfully with freeradius ? > > Cordialement, > > -- > Thierry mailto:freeradius@yar-glah.org > > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > This e-mail is private and may be confidential and is for the intended recipient only. If misdirected, please notify us by telephone and confirm that it has been deleted from your system and any copies destroyed. If you are not the intended recipient you are strictly prohibited from using, printing, copying, distributing or disseminating this e-mail or any information contained in it. We use reasonable endeavours to virus scan all e-mails leaving the Company but no warranty is given that this e-mail and any attachments are virus free. You should undertake your own virus checking. The right to monitor e-mail communications through our network is reserved by us.

2 1

Re: GPL
by Velikanov 01 Sep '05

01 Sep '05

I build a billing system based on FREERADIUS+ORACLE and want to install it for some of ISP. But I give them FREERADIUS with source, as is as on www.freeradius.org. Is this GPL violation ?? Thanks

2 1

Fw: copy from LDAP after map new attributes
by haizam 01 Sep '05

01 Sep '05

Dear all, How can i copy data from LDAP after mapping new attributes... as below:- thanks.. --haizam ----- Original Message ----- From: "haizam" <haizam(a)myjaring.net> To: "FreeRadius users mailing list" <freeradius-users(a)lists.freeradius.org> Sent: Monday, August 29, 2005 12:13 Subject: Re: usage of exec to get LDAP value.. > > I just add in /usr/local/etc/raddb/dictionary as below:- > > ATTRIBUTE Haizam-PSTN 3003 integer > ATTRIBUTE Haizam-ISDN 3004 integer > > and in ldap.attrmap > replyItem Haizam-PSTN TimeoutPSTN > replyItem Haizam-ISDN TimeoutISDN > > But problem with assigned those value to Session-Timeout... Is below users > entry correct? > > > DEFAULT NAS-Port-Type == "Sync", Autz-Type := DIALUP, > Auth-Type := DIALUP > Session-Timeout = %{Haizam-ISDN} > > --haizam > > > ----- Original Message ----- > From: "Alan DeKok" <aland(a)ox.org> > To: "FreeRadius users mailing list" > <freeradius-users(a)lists.freeradius.org> > Sent: Saturday, August 27, 2005 07:44 > Subject: Re: usage of exec to get LDAP value.. > > >> "haizam" <haizam(a)myjaring.net> wrote: >>> I've tried to map new attributes in ldap.attrmap but for every match in >>> users file.. it will return both new attributes but the sessiontimeout >>> still >>> ruturn no value.. >> >> Yes. Did you read the rest of my response? >> >> Alan DeKok. >> - >> List info/subscribe/unsubscribe? See >> http://www.freeradius.org/list/users.html >> > > > - List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html >

1 0

PEAP, Freeradius and Cisco AP 350
by J Zakhar 31 Aug '05

31 Aug '05

Having some trouble setting up PEAP with a windows XP workstation, a Cisco 350 AP (upgraded to IOS version 12.2), I am using the default XP Client to set things up. Many moons ago I had LEAP working great, the hard drive on this linux machine failed and it was time to reinstall. Not sure why i'm having such trouble with this. Mousing over the icon in my task bar Status: Validating Identity is all it ever says while trying to associate. I do however get prompted for my user name and password. Any advice/help would be much appreciated. ./radiusd -A -X Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/freeradius/etc/raddb/proxy.conf Config: including file: /usr/local/freeradius/etc/raddb/clients.conf Config: including file: /usr/local/freeradius/etc/raddb/snmp.conf Config: including file: /usr/local/freeradius/etc/raddb/eap.conf Config: including file: /usr/local/freeradius/etc/raddb/sql.conf main: prefix = "/usr/local/freeradius" main: localstatedir = "/usr/local/freeradius/var" main: logdir = "/usr/local/freeradius/var/log/radius" main: libdir = "/usr/local/freeradius/lib" main: radacctdir = "/usr/local/freeradius/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 1024 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/freeradius/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/freeradius/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/freeradius/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/freeradius/lib Module: Loaded exec exec: wait = yes exec: program = "(null)" exec: input_pairs = "request" exec: output_pairs = "(null)" exec: packet_type = "(null)" rlm_exec: Wait=yes but no output defined. Did you mean output=none? Module: Instantiated exec (exec) Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded PAP pap: encryption_scheme = "crypt" Module: Instantiated pap (pap) Module: Loaded CHAP Module: Instantiated chap (chap) Module: Loaded MS-CHAP mschap: use_mppe = yes mschap: require_encryption = yes mschap: require_strong = yes mschap: with_ntdomain_hack = no mschap: passwd = "(null)" mschap: authtype = "MS-CHAP" mschap: ntlm_auth = "(null)" Module: Instantiated mschap (mschap) Module: Loaded System unix: cache = no unix: passwd = "(null)" unix: shadow = "(null)" unix: group = "(null)" unix: radwtmp = "/usr/local/freeradius/var/log/radius/radwtmp" unix: usegroup = no unix: cache_reload = 600 Module: Instantiated unix (unix) Module: Loaded eap eap: default_eap_type = "peap" eap: timer_expire = 60 eap: ignore_unknown_eap_types = no eap: cisco_accounting_username_bug = yes rlm_eap: Loaded and initialized type md5 rlm_eap: Loaded and initialized type leap gtc: challenge = "Password: " gtc: auth_type = "PAP" rlm_eap: Loaded and initialized type gtc tls: rsa_key_exchange = no tls: dh_key_exchange = yes tls: rsa_key_length = 512 tls: dh_key_length = 512 tls: verify_depth = 0 tls: CA_path = "(null)" tls: pem_file_type = yes tls: private_key_file = "/usr/local/freeradius/etc/raddb/certs/cert- srv.pem " tls: certificate_file = "/usr/local/freeradius/etc/raddb/certs/cert-srv.pem" tls: CA_file = "/usr/local/freeradius/etc/raddb/certs/demoCA/cacert.pem" tls: private_key_password = "whatever" tls: dh_file = "/usr/local/freeradius/etc/raddb/certs/dh" tls: random_file = "/usr/local/freeradius/etc/raddb/certs/random" tls: fragment_size = 1024 tls: include_length = yes tls: check_crl = no tls: check_cert_cn = "(null)" rlm_eap: Loaded and initialized type tls peap: default_eap_type = "mschapv2" peap: copy_request_to_tunnel = no peap: use_tunneled_reply = no peap: proxy_tunneled_request_as_eap = yes rlm_eap: Loaded and initialized type peap mschapv2: with_ntdomain_hack = no rlm_eap: Loaded and initialized type mschapv2 Module: Instantiated eap (eap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/freeradius/etc/raddb/huntgroups" preprocess: hints = "/usr/local/freeradius/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Module: Loaded files files: usersfile = "/usr/local/freeradius/etc/raddb/users" files: acctusersfile = "/usr/local/freeradius/etc/raddb/acct_users" files: preproxy_usersfile = "/usr/local/freeradius/etc/raddb/preproxy_users" files: compat = "no" Module: Instantiated files (files) Module: Loaded Acct-Unique-Session-Id acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" Module: Instantiated acct_unique (acct_unique) Module: Loaded detail detail: detailfile = "/usr/local/freeradius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" detail: detailperm = 384 detail: dirperm = 493 detail: locking = no Module: Instantiated detail (detail) Module: Loaded radutmp radutmp: filename = "/usr/local/freeradius/var/log/radius/radutmp" radutmp: username = "%{User-Name}" radutmp: case_sensitive = yes radutmp: check_with_nas = yes radutmp: perm = 384 radutmp: callerid = yes Module: Instantiated radutmp (radutmp) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 172.28.42.253:21646<http://172.28.42.253:21646/>, id=35, length=132 User-Name = "jzakhar" Framed-MTU = 1400 Called-Station-Id = "0040.9647.f2d6" Calling-Station-Id = "000e.9b2e.179a" Message-Authenticator = 0x657f7e3dee2731c4e91f25c395ef47d7 EAP-Message = 0x0202000c016a7a616b686172 NAS-Port-Type = Wireless-802.11 NAS-Port = 312 Service-Type = Framed-User NAS-IP-Address = 172.28.42.253 <http://172.28.42.253/> NAS-Identifier = "apcisco" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "chap" returns noop for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "jzakhar", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 0 users: Matched jzakhar at 53 modcall[authorize]: module "files" returns ok for request 0 modcall: group authorize returns updated for request 0 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 0 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 0 modcall: group authenticate returns handled for request 0 Sending Access-Challenge of id 35 to 172.28.42.253:21646 <http://172.28.42.253:21646/> EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf730c83b331f347cf002f96adbba538e Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 172.28.42.253:21646<http://172.28.42.253:21646/>, id=35, length=132 Sending duplicate reply to client EAP:21646 - ID: 35 Re-sending Access-Challenge of id 35 to 172.28.42.253:21646<http://172.28.42.253:21646/> --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 35 with timestamp 4315dbd4 Nothing to do. Sleeping until we see a request. rad_recv: Access-Request packet from host 172.28.42.253:21646<http://172.28.42.253:21646/>, id=36, length=132 User-Name = "jzakhar" Framed-MTU = 1400 Called-Station-Id = "0040.9647.f2d6" Calling-Station-Id = "000e.9b2e.179a" Message-Authenticator = 0x843b8ca357e3281d250307dff3caa9e6 EAP-Message = 0x0202000c016a7a616b686172 NAS-Port-Type = Wireless-802.11 NAS-Port = 313 Service-Type = Framed-User NAS-IP-Address = 172.28.42.253 <http://172.28.42.253/> NAS-Identifier = "apcisco" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 1 modcall[authorize]: module "preprocess" returns ok for request 1 modcall[authorize]: module "chap" returns noop for request 1 modcall[authorize]: module "mschap" returns noop for request 1 rlm_realm: No '@' in User-Name = "jzakhar", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 1 rlm_eap: EAP packet type response id 2 length 12 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 1 users: Matched jzakhar at 53 modcall[authorize]: module "files" returns ok for request 1 modcall: group authorize returns updated for request 1 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 1 rlm_eap: EAP Identity rlm_eap: processing type tls rlm_eap_tls: Initiate rlm_eap_tls: Start returned 1 modcall[authenticate]: module "eap" returns handled for request 1 modcall: group authenticate returns handled for request 1 Sending Access-Challenge of id 36 to 172.28.42.253:21646<http://172.28.42.253:21646/> EAP-Message = 0x010300061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x479ac19253ee20dc4d21810846227fc5 Finished request 1 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds...

2 2

concurrent TTLS and PEAP usage
by Artur Hecker 31 Aug '05

31 Aug '05

hi we have a Wifi 802.1X network with both TTLS and PEAP users (TTLS/PAP mostly for non-windows machines, PEAP/MSCHAPv2 for windows machines). (we also have TLS users, but that's out of scope). both work like a charm. however, we'd like to prevent PEAP accounts to log in with TTLS and vice-versa (that's a pure policy decision - one user profile should specify exactly one auth method). this works mainly because we store clear text passwords for both MSCHAPv2 and PAP. assuming e.g. two users user_peap with PEAP/MS-CHAPv2 and user_ttls with TTLS/CHAP, we would like to modify the profile of the user user_peap so he can't change the exterior method to TTLS/PAP and vs. note that we don't necessarily use exterior names (since e.g. MS Windows machines do not permit to specify an alternative user name for the exterior EAP tunnel). we naively try to specify EAP-Type == PEAP for user_peap and == TTLS for user_ttls but that breaks both methods (which seems normal since this EAP-Type definition is not correct for the internal EAP method which however uses the same user name). i thought about specifying tunneled attributes as check items. it turns out that FR does not show them in the log and I believe that these are not the same for the PEAP and TTLS anyway. thus the question to the list: how can I specify an "PEAP/MS-CHAPv2 only" user profile? how can i specify a "TTLS/PAP only" user profile? thanks artur

3 5

FreeRadius different authorization and authentication methods
by Jason Carr 31 Aug '05

31 Aug '05

Hello, I'm attempting to use a FreeRadius server for authentication of wireless using 802.1x. I would also like to use a SQL database for authorization. I've done some limited testing without success. It looks like the authorization method also is the authentication method, for example if I use sql for the authorization and eap for the authentication, the authentication request fails: modcall[authorize]: module "sql" returns ok for request 1 modcall: group authorize returns ok for request 1 auth: type Local auth: No User-Password or CHAP-Password attribute in the request auth: Failed to validate the user. Even though the config file states: ... authorize { preprocess sql } authenticate { eap } ... Any assistance would be greatly appreciated. -- Jason Carr Carnegie Mellon University Network Development

2 6

using AND logic instead of OR logic with authorization?
by Michael Hare 31 Aug '05

31 Aug '05

Hello- I'd like to authorize users based on their Calling-Station-Id via a local users file and authenticate/authorize (simple access allowed flag) via an ldap server. The reason I need to double authorize is because I do not have rights to add/edit any data in the remote ldap server. I need the authorization to essentially be an "AND" (ie, I need both authorizations to return true in order to accept the user). Is this possible? I've tried doing this within a single radius instance, and I've also tried having the ldap interaction happen via a radius proxy without success. Here is my users file DEFAULT Calling-Station-Id =~ "^144\.92\." Service-Type = NAS-Prompt-User Here is what a debug looks like rad_recv: Access-Request packet from host 144.92.44.114:4447, id=30, length=123 User-Name = "mdhare" User-Password = "mypass" NAS-Port = 2905 Service-Type = Framed-User Framed-Protocol = PPP Called-Station-Id = "144.92.44.114" Calling-Station-Id = "128.104.19.106" Tunnel-Client-Endpoint:0 = "128.104.19.106" NAS-IP-Address = 144.92.44.114 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 modcall[authorize]: module "attr_filter" returns noop for request 0 rlm_realm: No '@' in User-Name = "mdhare", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "mdhare" rlm_realm: Proxying request from user mdhare to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Preparing to proxy authentication request to realm "NULL" modcall[authorize]: module "suffix" returns updated for request 0 modcall[authorize]: module "files" returns notfound for request 0 it as at this point I'd like authorization to stop, but it continues. What am I doing wrong? modcall: group authorize returns updated for request 0 Sending Access-Request of id 0 to 144.92.254.243:1812 ... ... rad_recv: Access-Accept packet from host 144.92.254.243:1812, id=0, length=30 Service-Type = NAS-Prompt-User Proxy-State = 0x3330 I'd be happy to provide configuration and output that I have now for testing, but there's no sense in being verbose if this isn't possible in general. Thanks- -Michael -- =======================W=== Michael Hare UW-Madison + WiscNet Network Engineering Desk: 608-262-5236 24 Hr Noc: 608-263-4188

1 0

krb5 documentation
by Joachim Selke 31 Aug '05

31 Aug '05

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hi, I want to do user authentication by Kerberos 5. Therefore I was happy to see that FreeRADIUS contains the krb5 module. But I wasn't able to find the documentation for this module. Can somebody give me a link or an example on how to use this module? Thanks, Joachim - -- B. Sc. Joachim Selke Universität Hannover, Fachgebiet Theoretische Informatik Appelstraße 4, 30167 Hannover, Germany Web: <http://www.thi.uni-hannover.de/> -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.1 (GNU/Linux) iD8DBQFDFbdiq7fYj4TsIUwRAlgaAKC0ES/ZQodcsti6rVH17bSGHP3hRgCgt9Ji a3CQ0y4yfff4Wc8LW/W0kxg= =fUZH -----END PGP SIGNATURE-----

2 1

GPL
by Velikanov 31 Aug '05

31 Aug '05

I told my colleagues about the advantages of FREERADIUS+ORACLE. BUT, they say, that it is GPL violation. IS that true? Thanks.

2 1