- Freeradius-Users - lists.freeradius.org

FR with MySQL. Proxying and repeated entries
by Paolo Rotela 19 Aug '05

19 Aug '05

Hi. Sorry if this is a dumb thing, but I've searched a lot and din't find any solution to this problem. I'm using freeradius (versions 0.9.3, 1.0.0 and 1.0.4) with MySQL 3.23 and 4.1.7 (different mappings between FR and My) I have some clients to wich I'm proxying requests to some realms. All works OK but there is one client wich is using Cisco Secure ACS, wich is giving me some headaches. With this one, Access-* packets go OK, but when the NAS (Cisco AS5300) sends an Accounting-Request to that realm and I proxy it to the home server, it sends me an Accounting-Response with an (I think) irregular attribute: Message-Authenticator (Ext. Attr. 80), wich I think is not permitted in the RFC for accounting packets. So, my FR, discards it as supposed thus leading my NAS to re-send accounting request a lot of times until it gives up. This leads me to three main questions: 1) Am I reading OK the RFC? I mean ¿Is it right that Attribute 80 is NOT permitted in Accounting-* packets? 2) Each time the NAS re-sends packets, FR handles it as it were a new packet, for a new call/connection. This way, I have each call for this specific realm n times, with n being the times I configure the NAS to re-send the packet. Every time the NAS re-sends an Accounting-start, the SQL query in sql.conf says "INSERT blah blah blah", wich leads to a new record be inserted into the database, and every time the NAS re-sends an Accounting-stop, the SQL query says "UPDATE blah blah blah", so it leads to calls being recorded many times. The question is ¿is there any way to solve this through configuration, and I didn't find it because I'm a dumb? ¿Or I have to "touch" the code for the radius to verify if the packet is a repeated one or not? 3) Is there any known bug or propietary feature from Cisco wich causes this incompatibility thing? I've searched about it and didn't find anything. I know that "3" is not at all about freeradius, but perhaps some of you came accross this at any time. Any help will be very appreciated.

2 1

Issues authenticating vs 2003 AD
by Tim P 19 Aug '05

19 Aug '05

I am handing off a qurest from pppd to radius and am failing with a valid user in the domain. Here is the output of radiusd -X -A Ready to process requests. rad_recv: Access-Request packet from host 127.0.0.1:32769, id=39, length=72 Service-Type = Framed-User Framed-Protocol = PPP User-Name = "ppptest" CHAP-Password = 0xa3de2596eae8f89f46e35d612d8858ac55 NAS-IP-Address = 127.0.0.1 NAS-Port = 0 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_chap: Setting 'Auth-Type := CHAP' modcall[authorize]: module "chap" returns ok for request 0 modcall[authorize]: module "mschap" returns noop for request 0 rlm_realm: No '@' in User-Name = "ppptest", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 0 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 0 users: Matched entry DEFAULT at line 155 users: Matched entry DEFAULT at line 173 users: Matched entry DEFAULT at line 185 modcall[authorize]: module "files" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for ppptest radius_xlat: '(sAMAccountName=ppptest)' radius_xlat: 'dc=company,dc=org' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to domcon.company.org:389, authentication 0 rlm_ldap: bind as cn=administrator,cn=Users,dc=company,dc=org/password to domcon.company.org:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=company,dc=org, with filter (sAMAccountName=ppptest) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user ppptest authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type CHAP auth: type "CHAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_chap: login attempt by "ppptest" with CHAP password rlm_chap: Could not find clear text password for user ppptest modcall[authenticate]: module "chap" returns invalid for request 0 modcall: group Auth-Type returns invalid for request 0 auth: Failed to validate the user. Delaying request 0 for 1 seconds Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 39 to 127.0.0.1:32769 Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 39 with timestamp 4303762d Nothing to do. Sleeping until we see a request. Any ideas? Both mschap and chap are enabled in the radiusd.conf

2 11

freeradius 1.0.4 and Cisco WLSE
by jck-freeradius＠southwestern.edu 19 Aug '05

19 Aug '05

I am trying to speak between my Freeradius server and a Cisco WLSE. I am seeing EAP timeouts while WLSE is trying to authenticate through Freeradius. I have setup the AAA details (server,port,username,password,eap protocol) in the WLSE, and enabled fault tracking, so that polling is able to take place. The WDS Master router has no problems authenticating, it is the WLSE that I am having problems getting authenticated. AP-70#show wlccp wnm status WNM IP Address : 192.168.254.5 Status : NOT AUTHENTICATED AP-70#show wlccp wds MAC: 0014.6a77.1604, IP-ADDR: 192.168.254.70 , Priority: 254 Interface BVI1, State: Administratively StandAlone - ACTIVE AP Count: 43 , MN Count: 9 == The WLSE is speaking with freeradius: (output from tcpdump) 17:40:36.415982 IP wlse.southwestern.edu.32815 > radius.southwestern.edu.radius: rad-access-req 132 [id 3] Attr[ User{wlseacct} NAS_ipaddr{wlse.southwestern.edu} Called_station{ABBAABBAABBA} [|radius] 17:40:36.422513 IP radius.southwestern.edu.radius > wlse.southwestern.edu.32815: rad-access-cha 92 [id 3] Attr[ [|radius] 17:40:36.423393 IP wlse.southwestern.edu.32815 > radius.southwestern.edu.radius: rad-access-req 125 [id 3] Attr[ User{wlseacct} NAS_ipaddr{wlse.southwestern.edu} Called_station{ABBAABBAABBA} [|radius] 17:40:42.433507 IP radius.southwestern.edu.radius > wlse.southwestern.edu.32815: rad-access-reject 20 [id 3] == == ...and the output from Freeradius rad_recv: Access-Request packet from host 192.168.254.10:32815, id=3, length=132 User-Name = "wlseacct" NAS-IP-Address = 192.168.254.10 Called-Station-Id = "ABBAABBAABBA" Calling-Station-Id = "ABBAABBAABBA" NAS-Identifier = "Cisco Secure II" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x0200000d01776c736561636374 Message-Authenticator = 0x586aa1b877caeafd3956095cf718be31 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 180 rlm_eap: EAP packet type response id 0 length 13 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 180 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 0 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 0 modcall[authorize]: module "sql" returns ok for request 180 modcall: group authorize returns updated for request 180 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 180 rlm_eap: EAP Identity rlm_eap: processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge modcall[authenticate]: module "eap" returns handled for request 180 modcall: group authenticate returns handled for request 180 Sending Access-Challenge of id 3 to 192.168.254.10:32815 EAP-Message = 0x010100221a0101001d10b063da2c8f5c52273cd537b0c09d69e5776c736561636374 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x8c90735921dd51b22bc8ef97379845b8 Finished request 180 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 192.168.254.10:32815, id=3, length=125 User-Name = "wlseacct" NAS-IP-Address = 192.168.254.10 Called-Station-Id = "ABBAABBAABBA" Calling-Station-Id = "ABBAABBAABBA" NAS-Identifier = "Cisco Secure II" NAS-Port = 29 Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 EAP-Message = 0x020300060311 Message-Authenticator = 0x070f8a208866000f797e64be5bd48f48 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 181 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 181 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 4 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 4 modcall[authorize]: module "sql" returns ok for request 181 modcall: group authorize returns updated for request 181 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 181 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 181 modcall: group authenticate returns invalid for request 181 auth: Failed to validate the user. rad_lowerpair: User-Name now 'wlseacct' rad_rmspace_pair: User-Name now 'wlseacct' Processing the authorize section of radiusd.conf modcall: entering group authorize for request 181 rlm_eap: EAP packet type response id 3 length 6 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 181 radius_xlat: 'wlseacct' rlm_sql (sql): sql_set_user escaped user --> 'wlseacct' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radcheck WHERE Username = 'wlseacct' ORDER BY id' rlm_sql (sql): Reserving sql socket id: 3 radius_xlat: 'SELECT radgroupcheck.id,radgroupcheck.GroupName,radgroupcheck.Attribute,radgroupcheck.Value,radgroupcheck.op FROM radgroupcheck,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupcheck.GroupName ORDER BY radgroupcheck.id' radius_xlat: 'SELECT id,UserName,Attribute,Value,op FROM radreply WHERE Username = 'wlseacct' ORDER BY id' radius_xlat: 'SELECT radgroupreply.id,radgroupreply.GroupName,radgroupreply.Attribute,radgroupreply.Value,radgroupreply.op FROM radgroupreply,usergroup WHERE usergroup.Username = 'wlseacct' AND usergroup.GroupName = radgroupreply.GroupName ORDER BY radgroupreply.id' rlm_sql (sql): Released sql socket id: 3 modcall[authorize]: module "sql" returns ok for request 181 modcall: group authorize returns updated for request 181 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 181 rlm_eap: Either EAP-request timed out OR EAP-response to an unknown EAP-request rlm_eap: Failed in handler modcall[authenticate]: module "eap" returns invalid for request 181 modcall: group authenticate returns invalid for request 181 auth: Failed to validate the user. Delaying request 181 for 1 seconds Finished request 181 Going to the next request Waking up in 6 seconds... --- Walking the entire request list --- Sending Access-Reject of id 3 to 192.168.254.10:32815 Cleaning up request 181 ID 3 with timestamp 42fa8264 Nothing to do. Sleeping until we see a request. == I have read in places that there are patches, that may fix my issue. Are these patches my solution, and where can I get the most recent version? --johnk

2 3

radius cache?
by Tariq Rashid 19 Aug '05

19 Aug '05

hi - i wonder what people's thoughts are on a radius cache that sits in frotn of a set of real radius servers and responds quickly with a set of cached reply attributes from a previous query? this may even be worthwhile even if the caching only applies to rejected queries - so that bad requests don't waste the backend resources. tariq

2 1

RE: mod_auth_radius values
by Ayres G.J. 19 Aug '05

19 Aug '05

Hi, I have written a php script that lists the request and response headers, the result of which is below: Request Headers Accept: */* Accept-Language: en-gb Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) Host: xxxxxx Connection: Keep-Alive Authorization: Basic bHNreVJlZ2o6ZnSpZGF5Mw== Cookie: foo=bar Response Headers Set-Cookie: RADIUS=51f673efff8c5h235410d95289666de85305b928; path=/; X-Powered-By: PHP/4.4.0 After the cookie is set the 'Set-Cookie' header appears in the Request Header as 'Cookie: foo=bar; RADIUS=51f673efff8c5h235410d95289666de85305b928;'. (I have modified the values above slightly incase I am inadvertently sending a username/password to the list ;) Ive read through mod_auth_radius-2.0.c and it appears the cookie is a MD5 hash of the users information. So, is it possible to get the information from the cookie? Gareth. -----Original Message----- From: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org] On Behalf Of Alan DeKok Sent: 18 August 2005 16:25 To: FreeRadius users mailing list Subject: Re: mod_auth_radius values "Ayres G.J." <G.J.Ayres(a)swansea.ac.uk> wrote: > I am developing a web system that authenticates users to a web site > through free radius using the mod_auth_radius module for apache. It all > works fine, but I would like to get the username of the user that has > authenticated for use on pages once they have authenticated. It's in the HTTP headers. The username & password are sent in every request. > I am not sure how to go about this. I guess that the values are set in a > cookie or in the HTTP Headers by mod_auth_radius? Does anyone know a way I > could retrieve the values, either through HTML or PHP? Not HTML. Maybe PHP, if it allows you to get HTTP headers. See the module source code for where the headers are, and the PHP docs for how to get at them. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Required Clarification
by raghavendra.sadaramachandra＠wipro.com 19 Aug '05

19 Aug '05

Hi All, As I am using freeRADIUS I would like to know few of the following things. 1) What is the maximum length of username and password allowed in freeRADIUS ? 2) What is the maximum number of users allowed to authenticate? I mean, how many users does it maintains in its database? 3) How does it maintains database does it uses SQL, if so ? whether it provides any alternative to maintain database of username and password ? for example like by using files..... etc. 4) Is there any necessity or possibility to use secondary RADIUS server ? Thanx in advance. Regards, Raghu Confidentiality Notice The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain confidential or privileged information. If you are not the intended recipient, please notify the sender at Wipro or Mailadmin(a)wipro.com immediately and destroy all copies of this message and any attachments.

2 1

MPPE/PEAP support not in anything but CVS snapshots?
by Bill Carr 19 Aug '05

19 Aug '05

I have a quick question, I ran across a note in a document about 0.97 stating that MPPE support was only in the nightly snapshots and not in the normal releases. (http://www.alphacore.net/contrib/nantes-wireless/eap-tls-HOWTO.html) If this changed since 2002, could someone let me know when? Otherwise I'm chasing my tail using a RHEL ES RPM which starts, runs but won't start the EAP piece, but a freshly compiled version works fine. I have a client who's a stickler for using the "vendor"-blessed versions and I've been trying to figure out why this has been more difficult to set up than most of my out-of-the-box configs. Thanks a bunch!

2 1

[solution] Received unexpected tunneled data after successful handshake
by Waba 18 Aug '05

18 Aug '05

Hello, I was stuck for a bit on this error message before finding the solution, so I thought I'd share and get it into the list archives for future reference. Context: Trying to get WindowsXP 802.1X supplicants to be authenticated on a FreeRADIUS server. After a successful TLS handshake, the rlm_eap_tls: Received unexpected tunneled data after successful handshake message would appear and abort the process. The solution is in http://www.freeradius.org/doc/EAPTLS.pdf - the client and server certificates must contain an Enhanced Key Usage. Look for "-extensions" in the generation script, and for the "OpenSSL extensions file" section. Taking this into account and regenerating the client & server certificates worked for me. I hope it helps, -Waba.

1 0

mod_auth_radius values
by Ayres G.J. 18 Aug '05

18 Aug '05

Hello all, I am developing a web system that authenticates users to a web site through free radius using the mod_auth_radius module for apache. It all works fine, but I would like to get the username of the user that has authenticated for use on pages once they have authenticated. I am not sure how to go about this. I guess that the values are set in a cookie or in the HTTP Headers by mod_auth_radius? Does anyone know a way I could retrieve the values, either through HTML or PHP? Thanks, Gareth. - - - - - - - - - - - - - - - - Gareth Ayres Wireless Network Officer Library & Information Services University of Wales Swansea, Singleton Park, Wales, UK SA2 8PP e-mail: g.j.ayres(a)swansea.ac.uk

3 3

General Question..
by Behzad Barzideh 18 Aug '05

18 Aug '05

Hello, I am new to Radius and Free Radius, so forgave me if this question has been asked or it is crazy. We are in process of change all our authentication and authorization. At the moment every "service" has it's own user-id/password database. Thus authentication/authorization per service is simple. want to deny access to a given user, disable his/her password or that service. As you can imagine this has a big overhead and users have to remember many user-id/password per. Can we use Radius/LDAP to do this. What I was hope we can do is as follow: everyone will get one user-id/password But for every service we will create a boolean attribute. All services, dialup/wireless/vpn/etc will use one radius server for both Auth(authenticate/authorize). The question is can FreeRadius(or any radius) be configured to as the LDAP for the correct service attribute and give access both base on the user-id/password and what the value of the services? Thank you all for your help.

3 2