- Freeradius-Users - lists.freeradius.org

IPv6
by gennaro amelio 08 Aug '05

08 Aug '05

Hi, can i send IPv6 packets to FreeRadius(i use 1.0.2)? Thanks in advance. Gennaro.

2 1

Message-Authenticator and Proxy
by Xavier 08 Aug '05

08 Aug '05

Hi All. We are experiencing a problem with our Radius proxy server which is running FreeRADIUS 1.0.2 : When FR poxies the request, it resets the Message-Authenticator attribute to zero in a Access-Request packet. therefore the radius server (third party) answers sometimes Accept and sometimes reject. We suppose that this server is buggy or does not support the Message-Authenticator attribute. I looked in the RFCs but none discuss about Message-Authenticator and proxy. I suppose the proxy should re-calculate the Message-Authenticator and rewrite it to the forwarded packet, but this is not the case of FreeRADIUS. In order to solve this problem I need to know if FreeRADIUS has the good behaviour. I tried also to suppress the Message-Authenticator attribute with the attr_rewrite module, but I didn't manage to. Below is the debug output of FreeRADIUS : Accepted Request : rad_recv: Access-Request packet from host 132.113.29.88:13165, id=211, length=181 Acct-Session-Id = "73a67d36" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x63f6f96ba2bf5891c93e86ba3438422c Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy authentication request to realm "wifi" modcall[authorize]: module "suffix" returns updated for request 12 modcall[authorize]: module "degrade" returns notfound for request 12 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "tempacc" returns ok for request 12 modcall: group authorize returns updated for request 12 Sending Access-Request of id 11 to 192.168.2.23:1812 Acct-Session-Id = "73a67d36" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x323131 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Accept packet from host 192.168.2.23:1812, id=11, length=49 Session-Timeout = 35666 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x323131 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 12 modcall[authorize]: module "preprocess" returns ok for request 12 modcall[authorize]: module "chap" returns noop for request 12 modcall[authorize]: module "mschap" returns noop for request 12 rlm_realm: Proxy reply, or no User-Name. Ignoring. modcall[authorize]: module "suffix" returns noop for request 12 modcall[authorize]: module "degrade" returns notfound for request 12 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "tempacc" returns ok for request 12 modcall: group authorize returns ok for request 12 rad_check_password: Found Auth-Type rad_check_password: Auth-Type = Accept, accepting the user Login OK: [JOHN@wifi] (from client Nomadix port 1 cli 00-0C-F1-38-14-AA) Processing the post-auth section of radiusd.conf modcall: entering group post-auth for request 12 rlm_sql (sql): Processing sql_postauth radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Accept', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Accept', NOW()) rlm_sql (sql): Reserving sql socket id: 2 rlm_sql (sql): Released sql socket id: 2 modcall[post-auth]: module "sql" returns ok for request 12 modcall: group post-auth returns ok for request 12 Sending Access-Accept of id 211 to 132.113.29.88:13165 Session-Timeout = 35666 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Framed-MTU = 576 Idle-Timeout = 60 Finished request 12 Going to the next request Waking up in 1 seconds... rad_recv: Accounting-Request packet from host 132.113.29.88:13165, id=0, length=150 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Start Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:15 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Framed-IP-Address = 10.0.0.10 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 13 modcall[preacct]: module "preprocess" returns noop for request 13 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 132.113.29.88,NAS-IP-Address = 192.168.1.250,Acct-Session-Id = "73a67d36",User-Name = "JOHN@wifi"' rlm_acct_unique: Acct-Unique-Session-ID = "876079519f963dc1". modcall[preacct]: module "acct_unique" returns ok for request 13 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy accounting request to realm "wifi" modcall[preacct]: module "suffix" returns updated for request 13 modcall: group preacct returns updated for request 13 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 13 radius_xlat: '/var/log/freeradius/radacct/132.113.29.88/detail-20050805' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/132.113.29.88/detail-20050805 rlm_detail: Freeradius-Proxied-To set to 192.168.2.23 modcall[accounting]: module "detail" returns ok for request 13 radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'INSERT into radacct (AcctSessionId, AcctUniqueId, UserName, Realm, NASIPAddress, NASPortId, NASPortType, AcctStartTime, AcctStopTime, AcctSessionTime, AcctAuthentic, ConnectInfo_start, ConnectInfo_stop, AcctInputOctets, AcctOutputOctets, CalledStationId, CallingStationId, AcctTerminateCause, ServiceType, FramedProtocol, FramedIPAddress, AcctStartDelay, AcctStopDelay) values('73a67d36', '876079519f963dc1', 'JOHN@wifi', 'wifi', '192.168.1.250', '1', 'Wireless-802.11', '2005-08-05 16:49:36', '0', '0', 'RADIUS', '', '', '0', '0', '00-03-52-01-8E-25', '00-0C-F1-38-14-AA', '', '', '', '10.0.0.10', '0', '0')' rlm_sql (sql): Reserving sql socket id: 1 rlm_sql (sql): Released sql socket id: 1 modcall[accounting]: module "sql" returns ok for request 13 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'JOHN@wifi' modcall[accounting]: module "radutmp" returns ok for request 13 modcall: group accounting returns ok for request 13 Sending Accounting-Request of id 1 to 192.168.2.23:1813 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Start Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:15 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Framed-IP-Address = 10.0.0.10 Proxy-State = 0x30 Waking up in 1 seconds... rad_recv: Accounting-Response packet from host 192.168.2.23:1813, id=1, length=41 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x30 Sending Accounting-Response of id 0 to 132.113.29.88:13165 Finished request 13 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 5 seconds... rad_recv: Accounting-Request packet from host 132.113.29.88:13165, id=115, length=198 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Stop Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:25 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Acct-Session-Time = 11 Acct-Input-Octets = 5342 Acct-Input-Gigawords = 0 Acct-Input-Packets = 8 Acct-Output-Octets = 682 Acct-Output-Gigawords = 0 Acct-Output-Packets = 7 Acct-Terminate-Cause = User-Request Framed-IP-Address = 10.0.0.10 Processing the preacct section of radiusd.conf modcall: entering group preacct for request 14 modcall[preacct]: module "preprocess" returns noop for request 14 rlm_acct_unique: Hashing 'NAS-Port = 1,Client-IP-Address = 132.113.29.88,NAS-IP-Address = 192.168.1.250,Acct-Session-Id = "73a67d36",User-Name = "JOHN@wifi"' rlm_acct_unique: Acct-Unique-Session-ID = "876079519f963dc1". modcall[preacct]: module "acct_unique" returns ok for request 14 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy accounting request to realm "wifi" modcall[preacct]: module "suffix" returns updated for request 14 modcall: group preacct returns updated for request 14 Processing the accounting section of radiusd.conf modcall: entering group accounting for request 14 radius_xlat: '/var/log/freeradius/radacct/132.113.29.88/detail-20050805' rlm_detail: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/132.113.29.88/detail-20050805 rlm_detail: Freeradius-Proxied-To set to 192.168.2.23 modcall[accounting]: module "detail" returns ok for request 14 radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'UPDATE radacct SET AcctStopTime = '2005-08-05 16:49:47', AcctSessionTime = '11', AcctInputOctets = '5342', AcctOutputOctets = '682', AcctTerminateCause = 'User-Request', AcctStopDelay = '0', ConnectInfo_stop = '' WHERE AcctSessionId = '73a67d36' AND UserName = 'JOHN@wifi' AND NASIPAddress = '192.168.1.250'' rlm_sql (sql): Reserving sql socket id: 0 rlm_sql (sql): Released sql socket id: 0 modcall[accounting]: module "sql" returns ok for request 14 radius_xlat: '/var/log/freeradius/radutmp' radius_xlat: 'JOHN@wifi' rlm_radutmp: Logout for NAS Nomadix port 1, but no Login record modcall[accounting]: module "radutmp" returns ok for request 14 modcall: group accounting returns ok for request 14 Sending Accounting-Request of id 2 to 192.168.2.23:1813 User-Name = "JOHN@wifi" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Acct-Status-Type = Stop Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Event-Timestamp = "Aug 5 2005 16:52:25 CEST" Acct-Delay-Time = 0 Acct-Session-Id = "73a67d36" Acct-Authentic = RADIUS Acct-Session-Time = 11 Acct-Input-Octets = 5342 Acct-Input-Gigawords = 0 Acct-Input-Packets = 8 Acct-Output-Octets = 682 Acct-Output-Gigawords = 0 Acct-Output-Packets = 7 Acct-Terminate-Cause = User-Request Framed-IP-Address = 10.0.0.10 Proxy-State = 0x313135 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Accounting-Response packet from host 192.168.2.23:1813, id=2, length=43 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x313135 Sending Accounting-Response of id 115 to 132.113.29.88:13165 Finished request 14 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 5 seconds... --- Walking the entire request list --- Cleaning up request 14 ID 115 with timestamp 42f37c8b Nothing to do. Rejected request : rad_recv: Access-Request packet from host 132.113.29.88:13165, id=1, length=181 Acct-Session-Id = "41705ece" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x97c0f2889372bfd63d04904e75dde9c9 Processing the authorize section of radiusd.conf modcall: entering group authorize for request 15 modcall[authorize]: module "preprocess" returns ok for request 15 modcall[authorize]: module "chap" returns noop for request 15 modcall[authorize]: module "mschap" returns noop for request 15 rlm_realm: Looking up realm "wifi" for User-Name = "JOHN@wifi" rlm_realm: Found realm "wifi" rlm_realm: Proxying request from user JOHN to realm wifi rlm_realm: Adding Realm = "wifi" rlm_realm: Preparing to proxy authentication request to realm "wifi" modcall[authorize]: module "suffix" returns updated for request 15 modcall[authorize]: module "degrade" returns notfound for request 15 users: Matched entry DEFAULT at line 152 users: Matched entry DEFAULT at line 171 modcall[authorize]: module "tempacc" returns ok for request 15 modcall: group authorize returns updated for request 15 Sending Access-Request of id 12 to 192.168.2.23:1812 Acct-Session-Id = "41705ece" NAS-Port = 1 NAS-Port-Type = Wireless-802.11 User-Name = "JOHN@wifi" Calling-Station-Id = "00-0C-F1-38-14-AA" Called-Station-Id = "00-03-52-01-8E-25" Framed-IP-Address = 10.0.0.10 User-Password = "mypass" NAS-Identifier = "COLUBRIS" NAS-IP-Address = 192.168.1.250 Framed-MTU = 1496 Connect-Info = "HTTPS" Service-Type = Framed-User Message-Authenticator = 0x00000000000000000000000000000000 Proxy-State = 0x31 --- Walking the entire request list --- Waking up in 1 seconds... rad_recv: Access-Reject packet from host 192.168.2.23:1812, id=12, length=41 Service-Type = Framed-User Framed-IP-Netmask = 255.255.255.0 Framed-IP-Address = 255.255.255.254 Proxy-State = 0x31 Login incorrect (Home Server says so): [JOHN@wifi/mypass] (from client Nomadix port 1 cli 00-0C-F1-38-14-AA) Processing the post-auth section of radiusd.conf modcall: entering group Post-Auth-Type for request 15 rlm_sql (sql): Processing sql_postauth radius_xlat: 'JOHN@wifi' rlm_sql (sql): sql_set_user escaped user --> 'JOHN@wifi' radius_xlat: 'INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Reject', NOW())' rlm_sql (sql) in sql_postauth: query is INSERT into radpostauth (id, user, pass, reply, date) values ('', 'JOHN@wifi', 'mypass', 'Access-Reject', NOW()) rlm_sql (sql): Reserving sql socket id: 4 rlm_sql (sql): Released sql socket id: 4 modcall[post-auth]: module "sql" returns ok for request 15 modcall: group Post-Auth-Type returns ok for request 15 Delaying request 15 for 1 seconds Finished request 15 Going to the next request Waking up in 1 seconds... --- Walking the entire request list --- Waking up in 1 seconds... --- Walking the entire request list --- Sending Access-Reject of id 1 to 132.113.29.88:13165 Waking up in 4 seconds. Regards, Xavier.

2 1

Re. Max-Daily-Session
by Shannon Sariman 06 Aug '05

06 Aug '05

Nick White wrote: "Can I set "Max-Daily-Session = 1800" in the radgroupcheck table (MySQL), and if so is the max of 1800 set for the entire group, or for each user in that group?" The max of 1800 will be set for the entire group. I you want to apply max of 1800 for certain users that don't belong to the group then use radcheck table. Cheers, Shannon "From the land of the unexpected".

2 1

rewriting the User-Name attr
by Matteo Faleschini 06 Aug '05

06 Aug '05

Hi, i'm looking for some help to rewrite the User-Name attribute. My problem is: my organisation has to proxy to two different realms on two different servers. one realm is students, the other is professors (some users are handled locally). The User-Name of professors is name@professors so it was easy to prepare a real in proxy.conf named professors The students realm is not explicetely found in the User-Name attributes but I can distinguish the students by the presence of a '.' point in the username. (I used this rule in the users file DEFAULT User-Name =~ "\\.", Proxy-To-Realm := encrypt) My problem is now that I want to change the User-Name attr for students only, to name.surname@students before proxying it to the other radius server. I was planning to use rlm_attr_rewrite and I see 2 ways to do it: 1) I recognaize the realm by the Proxy-To-Real attr, but I don't know haw to tell it to the attr_rewrite module attr_rewrite studenti { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = proxy searchfor = "$" replacewith = "@students" ignore_case = no new_attribute = no max_matches = 10 append = no } 2) I recognaize once again the packet by the presence of a '.' point in the name but I don't know if I can use a perlish/awkish expression like attr_rewrite studenti { attribute = User-Name # may be "packet", "reply", "proxy", "proxy_reply" or "config" searchin = proxy searchfor = "$*\\.*$" replacewith = "$1@students" ignore_case = no new_attribute = no max_matches = 10 append = no } Can you address me in the right direction? Thank you, matteo faleschini

3 4

Re: different eap/tls config for different interfaces
by ragan_davis＠colstate.edu 06 Aug '05

06 Aug '05

Oh...duh...that makes sense. Should have considered that. I have since tested the behavior of the scenario I described, and Alan's on target. Doesn't really seem to matter which interface I enter on, or which common-name I use. Seems to work either way. thanks for the help! ----- Original Message ----- From: Kris Benson <kbenson(a)sd57.bc.ca> Date: Friday, August 5, 2005 5:28 pm Subject: Re: different eap/tls config for different interfaces > >ragan_davis(a)colstate.edu wrote: > >> If so, is it possible to have 2 different tls sections that service > >> the 2 different interfaces? > > > > No. FreeRADIUS supports only 1 TLS module at a time. > > What Alan forgot to mention is a solution. > > If you run two copies of the Radius server, with one bound to > either a > different set of ports, or one to each IP, you could have separate > configs. > -kb > -- > Kris Benson, CCP, I.S.P. > Technical Analyst, District Projects > School District #57 (Prince George) > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Re: Multiple Password Prompts
by ragan_davis＠colstate.edu 06 Aug '05

06 Aug '05

----- Original Message ----- From: Alan DeKok <aland(a)ox.org> Date: Friday, August 5, 2005 5:30 pm Subject: Re: Multiple Password Prompts > ragan_davis(a)colstate.edu wrote: > > If the server get's an incomplete reply to it's challenge, or no > reply,> will it resend it's challenge? > > No. RADIUS is entirely driven by the clients. > Gotcha > > Or, will the client sense that the server didn't respond to it's > > challenge response and start a new session. > > The client *does* see the Access-Challenge, but it decides for some > reason to stop talking to the server. > Yep...that's sort of weird. > > Of course, because each vendor has their own radius server and > > 802.1x client solution, they want to blame freeradius so that I'll > > buy their product. > > FreeRADIUs is interoperable with pretty much everything out there. > Novell is dumping their proprietary server for FreeRADIUS. Zyxel is > selling a $500 FreeRADIUS box (with some question of possible GPL > violations), and I know of 2 other companies using FreeRADIUs as part > of their RADIUS server solutions. > I agree. In their argument, they even pointed me to a security web site that supposedly listed 42 freeradius vulnerabilities, most of which had still not been addressed (according to them). I visited the site, read the material, followed the links, and apparently they just typed "freeradius" and clicked "search", and didn't actually read the results, because half of the results were totally unrelated and the rest were describing things that were fixed in version 0.4 or something. > > I'm trying my hardest to fight this, because I'm a big freeradius > > fan. > > Thanks. > No prob. Just keep it up. > > The debug on the Odyssey Client shows that it believes it sent the > > response to the challenge. The debug on the WLAN switch shows > that it > > forwards both the challenge from freeradius and the challenge > response> from the client. Freeradius debug appears to get the > response from the > > client, sees the outer credentials (anonymous, etc.), but doesn't > > process the tunneled information for some reason. > > Hmm... I do know that the odyssey client does some very weird > things. In some cases, it's interoperable *only* with Funk's server, > which is a nice way for them to say "other servers are broken", rather > than "our client is broken". > Yep, I'm beginning to suspect as much. > > So, does this mean that I should interpret the above enum to have > > elements 0-13, or 1-14, and match the numbers 7 and 13 with it's > > position in the enum? > > 0-13 > thanks > > I'm curious why we can see the TLS stuff during the first try > (13), but > > not the second try (7). What is the difference? > > The client is behaving differently the second time around. > > FreeRADIUS treats the two TLS sessions as being 100% unique. It > responds in the same way to the same input every time. So if one > session fails and the other succeeds, it's because the client is doing > something different. > Gotcha. > > I performed a packet capture using ethereal, listening on the > interface> that freeradius is running on. Did this on the box, not > inline. I > > would rather not post it to the list, but I'd be glad to send it > to you > > if you'd be willing to look at it. Let me know. > > Put it on a web page and mail me the link. > Will do. I'll shoot for tomorrow (08/06). > On a plus, the latest version of Ethereal appears to have stolen the > FreeRADIUS dictionary files, so the radius packets it decodes should > make a lot more sense. > Yeh...I noticed that. Very nice. > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

FW: Freeradius - LDAP Authenication
by Simon Barnes 06 Aug '05

06 Aug '05

Forgot to add the version info etc, Freeradius 1.0.4 running on OPenBSD 3.6 for sparc The iplanet version is 5.2 Simon _____ From: Simon Barnes [mailto:simon.barnes@marymount.edu] Sent: Friday, August 05, 2005 11:12 AM To: Subject: Freeradius - LDAP Authenication Hi All, I'm rather new to radius and especially freeradius. I have the following need. Cisco VPN needs to authenticate users against a Radius server, which in turn needs to proxy the user authentication to our Sun One Iplanet LDAP server (running on another machine). I have the vpn talking successfully to freeradius, but I cannot get the onward connection to the LDAP to work. I have validated that the server running freeradius is able to talk to the ldap by using ldapsearch. The config I am using is based upon the ldap_howto.txt under /docs. I have searched the mailing list but to no avail. Many Thanks in advance Simon Barnes What follows is the radiusd output and the radius.conf Radiusd Output bash-3.00# /usr/local/sbin/radiusd -X -A Starting - reading configuration files ... reread_config: reading radiusd.conf Config: including file: /usr/local/etc/raddb/proxy.conf Config: including file: /usr/local/etc/raddb/clients.conf main: prefix = "/usr/local" main: localstatedir = "/usr/local/var" main: logdir = "/usr/local/var/log/radius" main: libdir = "/usr/local/lib" main: radacctdir = "/usr/local/var/log/radius/radacct" main: hostname_lookups = no main: max_request_time = 30 main: cleanup_delay = 5 main: max_requests = 512 main: delete_blocked_requests = 0 main: port = 0 main: allow_core_dumps = no main: log_stripped_names = no main: log_file = "/usr/local/var/log/radius/radius.log" main: log_auth = no main: log_auth_badpass = no main: log_auth_goodpass = no main: pidfile = "/usr/local/var/run/radiusd/radiusd.pid" main: user = "(null)" main: group = "(null)" main: usercollide = no main: lower_user = "no" main: lower_pass = "no" main: nospace_user = "no" main: nospace_pass = "no" main: checkrad = "/usr/local/sbin/checkrad" main: proxy_requests = yes proxy: retry_delay = 5 proxy: retry_count = 3 proxy: synchronous = no proxy: default_fallback = yes proxy: dead_time = 120 proxy: post_proxy_authorize = yes proxy: wake_all_if_all_dead = no security: max_attributes = 200 security: reject_delay = 1 security: status_server = no main: debug_level = 0 read_config_files: reading dictionary read_config_files: reading naslist Using deprecated naslist file. Support for this will go away soon. read_config_files: reading clients read_config_files: reading realms radiusd: entering modules setup Module: Library search path is /usr/local/lib Module: Loaded expr Module: Instantiated expr (expr) Module: Loaded LDAP ldap: server = "198.100.0.18" ldap: port = 389 ldap: net_timeout = 1 ldap: timeout = 4 ldap: timelimit = 3 ldap: identity = "cn=directory manager" ldap: tls_mode = no ldap: start_tls = no ldap: tls_cacertfile = "(null)" ldap: tls_cacertdir = "(null)" ldap: tls_certfile = "(null)" ldap: tls_keyfile = "(null)" ldap: tls_randfile = "(null)" ldap: tls_require_cert = "allow" ldap: password = "c0ntr01m3" ldap: basedn = "o=marymount.edu,o=marymount.edu" ldap: filter = "(&(objectClass=aRadiusAccount)(uid=%u))" ldap: base_filter = "(objectclass=radiusprofile)" ldap: default_profile = "(null)" ldap: profile_attribute = "(null)" ldap: password_header = "{clear}" ldap: password_attribute = "userPassword" ldap: access_attr = "(null)" ldap: groupname_attribute = "cn" ldap: groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(objectClass=GroupO fUniqueNames)(uniquemember=%{Ldap-UserDn})))" ldap: groupmembership_attribute = "(null)" ldap: dictionary_mapping = "/usr/local/etc/raddb/ldap.attrmap" ldap: ldap_debug = 0 ldap: ldap_connections_number = 5 ldap: compare_check_items = no ldap: access_attr_used_for_allow = yes ldap: do_xlat = yes rlm_ldap: Registering ldap_groupcmp for Ldap-Group rlm_ldap: Registering ldap_xlat with xlat_name ldap rlm_ldap: reading ldap<->radius mappings from file /usr/local/etc/raddb/ldap.attrmap rlm_ldap: LDAP radiusCheckItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusReplyItem mapped to RADIUS $GENERIC$ rlm_ldap: LDAP radiusAuthType mapped to RADIUS Auth-Type rlm_ldap: LDAP radiusSimultaneousUse mapped to RADIUS Simultaneous-Use rlm_ldap: LDAP radiusCalledStationId mapped to RADIUS Called-Station-Id rlm_ldap: LDAP radiusCallingStationId mapped to RADIUS Calling-Station-Id rlm_ldap: LDAP lmPassword mapped to RADIUS LM-Password rlm_ldap: LDAP ntPassword mapped to RADIUS NT-Password rlm_ldap: LDAP acctFlags mapped to RADIUS SMB-Account-CTRL-TEXT rlm_ldap: LDAP radiusExpiration mapped to RADIUS Expiration rlm_ldap: LDAP radiusServiceType mapped to RADIUS Service-Type rlm_ldap: LDAP radiusFramedProtocol mapped to RADIUS Framed-Protocol rlm_ldap: LDAP radiusFramedIPAddress mapped to RADIUS Framed-IP-Address rlm_ldap: LDAP radiusFramedIPNetmask mapped to RADIUS Framed-IP-Netmask rlm_ldap: LDAP radiusFramedRoute mapped to RADIUS Framed-Route rlm_ldap: LDAP radiusFramedRouting mapped to RADIUS Framed-Routing rlm_ldap: LDAP radiusFilterId mapped to RADIUS Filter-Id rlm_ldap: LDAP radiusFramedMTU mapped to RADIUS Framed-MTU rlm_ldap: LDAP radiusFramedCompression mapped to RADIUS Framed-Compression rlm_ldap: LDAP radiusLoginIPHost mapped to RADIUS Login-IP-Host rlm_ldap: LDAP radiusLoginService mapped to RADIUS Login-Service rlm_ldap: LDAP radiusLoginTCPPort mapped to RADIUS Login-TCP-Port rlm_ldap: LDAP radiusCallbackNumber mapped to RADIUS Callback-Number rlm_ldap: LDAP radiusCallbackId mapped to RADIUS Callback-Id rlm_ldap: LDAP radiusFramedIPXNetwork mapped to RADIUS Framed-IPX-Network rlm_ldap: LDAP radiusClass mapped to RADIUS Class rlm_ldap: LDAP radiusSessionTimeout mapped to RADIUS Session-Timeout rlm_ldap: LDAP radiusIdleTimeout mapped to RADIUS Idle-Timeout rlm_ldap: LDAP radiusTerminationAction mapped to RADIUS Termination-Action rlm_ldap: LDAP radiusLoginLATService mapped to RADIUS Login-LAT-Service rlm_ldap: LDAP radiusLoginLATNode mapped to RADIUS Login-LAT-Node rlm_ldap: LDAP radiusLoginLATGroup mapped to RADIUS Login-LAT-Group rlm_ldap: LDAP radiusFramedAppleTalkLink mapped to RADIUS Framed-AppleTalk-Link rlm_ldap: LDAP radiusFramedAppleTalkNetwork mapped to RADIUS Framed-AppleTalk-Network rlm_ldap: LDAP radiusFramedAppleTalkZone mapped to RADIUS Framed-AppleTalk-Zone rlm_ldap: LDAP radiusPortLimit mapped to RADIUS Port-Limit rlm_ldap: LDAP radiusLoginLATPort mapped to RADIUS Login-LAT-Port conns: 0x788780 Module: Instantiated ldap (ldap) Module: Loaded preprocess preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups" preprocess: hints = "/usr/local/etc/raddb/hints" preprocess: with_ascend_hack = no preprocess: ascend_channels_per_line = 23 preprocess: with_ntdomain_hack = no preprocess: with_specialix_jetstream_hack = no preprocess: with_cisco_vsa_hack = no Module: Instantiated preprocess (preprocess) Module: Loaded realm realm: format = "suffix" realm: delimiter = "@" realm: ignore_default = no realm: ignore_null = no Module: Instantiated realm (suffix) Listening on authentication *:1812 Listening on accounting *:1813 Listening on proxy *:1814 Ready to process requests. rad_recv: Access-Request packet from host 38.118.63.2:1158, id=44, length=71 User-Name = "testuser" User-Password = "******" Vendor-3076-Attr-32 = 0x00000004 NAS-IP-Address = 38.118.63.2 NAS-Port-Type = Virtual Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL rlm_realm: Found realm "NULL" rlm_realm: Adding Stripped-User-Name = "testuser" rlm_realm: Proxying request from user testuser to realm NULL rlm_realm: Adding Realm = "NULL" rlm_realm: Authentication realm is LOCAL. modcall[authorize]: module "suffix" returns noop for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for testuser radius_xlat: '(&(objectClass=aRadiusAccount)(uid=testuser))' radius_xlat: 'o=marymount.edu,o=marymount.edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 198.100.0.18:389, authentication 0 rlm_ldap: bind as cn=account mgr/********* to 198.100.0.18:389 rlm_ldap: cn=directory manager bind to 198.100.0.18:389 failed: Can't contact LDAP server rlm_ldap: (re)connection attempt failed rlm_ldap: search failed rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns fail for request 0 modcall: group authorize returns fail for request 0 Finished request 0 Going to the next request --- Walking the entire request list --- Waking up in 6 seconds... rad_recv: Access-Request packet from host 38.118.63.2:1158, id=44, length=71 Discarding duplicate request from client vpn:1158 - ID: 44 --- Walking the entire request list --- Waking up in 2 seconds... --- Walking the entire request list --- Cleaning up request 0 ID 44 with timestamp 42f37a00 Nothing to do. Sleeping until we see a request. Radius.conf prefix = /usr/local exec_prefix = ${prefix} sysconfdir = ${prefix}/etc localstatedir = ${prefix}/var sbindir = ${exec_prefix}/sbin logdir = ${localstatedir}/log/radius raddbdir = ${sysconfdir}/raddb radacctdir = ${logdir}/radacct # Location of config and logfiles. confdir = ${raddbdir} run_dir = ${localstatedir}/run/radiusd log_file = ${logdir}/radius.log libdir = ${exec_prefix}/lib pidfile = ${run_dir}/radiusd.pid #user = nobody #group = nobody max_request_time = 30 delete_blocked_requests = no cleanup_delay = 5 max_requests = 512 bind_address = * port = 0 hostname_lookups = no allow_core_dumps = no regular_expressions = yes extended_expressions = yes log_stripped_names = no log_auth = no log_auth_badpass = no log_auth_goodpass = no usercollide = no lower_user = no lower_pass = no nospace_user = no nospace_pass = no # The program to execute to do concurrency checks. checkrad = ${sbindir}/checkrad security { max_attributes = 200 reject_delay = 1 status_server = no } proxy_requests = yes $INCLUDE ${confdir}/proxy.conf $INCLUDE ${confdir}/clients.conf thread pool { start_servers = 5 max_servers = 32 min_spare_servers = 3 max_spare_servers = 10 max_requests_per_server = 0 } modules { ldap { server = "198.100.0.18" identity = "cn=account mgr" password = ********* basedn = "o=marymount.edu,o=marymount.edu" #filter = "(uid=%{Stripped-User-Name:-%{User-Name}})" #filter = "(posixAccount)(uid=%u))" filter = "(&(objectClass=aRadiusAccount)(uid=%u))" # base_filter = "(objectclass=radiusprofile)" start_tls = no # default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA" # profile_attribute = "radiusProfileDn" #access_attr = "dialupAccess" dictionary_mapping = ${raddbdir}/ldap.attrmap ldap_connections_number = 5 password_header = "{clear}" password_attribute = userPassword # groupname_attribute = cn # groupmembership_filter = "(|(&(objectClass=GroupOfNames)(member=%{Ldap-UserDn}))(&(obje ctClass=GroupOfUniqueNames)(uniquemember=%{Ldap-UserDn})))" # groupmembership_attribute = radiusGroupName timeout = 4 timelimit = 3 net_timeout = 1 compare_check_items = no # access_attr_used_for_allow = yes } realm suffix { format = suffix delimiter = "@" ignore_default = no ignore_null = no } preprocess { huntgroups = ${confdir}/huntgroups hints = ${confdir}/hints with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no } files { usersfile = ${confdir}/users acctusersfile = ${confdir}/acct_users preproxy_usersfile = ${confdir}/preproxy_users compat = no } always fail { rcode = fail } always reject { rcode = reject } always ok { rcode = ok simulcount = 0 mpp = no } expr { } } instantiate { expr } authorize { preprocess suffix ldap } authenticate { authtype LDAP { ldap } } preacct { preprocess suffix } accounting { #radutmp #sradutmp } Simon Barnes System Administrator Marymount University

3 4

Re: Multiple Password Prompts
by ragan_davis＠colstate.edu 05 Aug '05

05 Aug '05

Thanks for the response. See below: ----- Original Message ----- From: Alan DeKok <aland(a)ox.org> Date: Friday, August 5, 2005 11:03 am Subject: Re: Multiple Password Prompts > ragan_davis(a)colstate.edu wrote: > > As I'm troubleshooting this, I generated another question in my > head. > > This time I'll give some freeradius debug (see blocks > > between "*********"): > > > > Here's an exerpt from first try (failure): > ... > > Sending Access-Challenge of id 186 to 192.168.3.2:1024 > > That doesn't look like a failure to me. The supplicant may stop > talking to the server, and start a new session, but the server thinks > everything's OK. > Sorry...maybe I used the wrong word. By "failure", I meant that from the end user's perspective, the first attempt was a failure. If the server get's an incomplete reply to it's challenge, or no reply, will it resend it's challenge? Or, will the client sense that the server didn't respond to it's challenge response and start a new session. I ask because, in talking to the vendors, there is a question of which side is giving up, or which side isn't sending complete requests/responses. Of course, because each vendor has their own radius server and 802.1x client solution, they want to blame freeradius so that I'll buy their product. I'm trying my hardest to fight this, because I'm a big freeradius fan. The debug on the Odyssey Client shows that it believes it sent the response to the challenge. The debug on the WLAN switch shows that it forwards both the challenge from freeradius and the challenge response from the client. Freeradius debug appears to get the response from the client, sees the outer credentials (anonymous, etc.), but doesn't process the tunneled information for some reason. > > I looked back through some of the output, and it seems that each > time > > it fails I get "eaptls_process returned 13", but when it is > succeeds I > > get "eaptls_process returned 7". Anyone know what 7 and 13 > represent > > (please don't say 'sucess' or 'failure'...i'm hoping it more > > meaningful than that). > > From src/modules/rlm_eap/types/rlm_eap_tls.h: > > typedef enum { > EAPTLS_INVALID = 0, /* invalid, don't reply */ > EAPTLS_REQUEST, /* request, ok to send, > invalid to receive */ > EAPTLS_RESPONSE, /* response, ok to receive, > invalid to send */ > EAPTLS_SUCCESS, /* success, send success */ > EAPTLS_FAIL, /* fail, send fail */ > EAPTLS_NOOP, /* noop, continue */ > EAPTLS_START, /* start, ok to send, invalid > to receive */ > EAPTLS_OK, /* ok, continue */ > EAPTLS_ACK, /* acknowledge, continue */ > EAPTLS_FIRST_FRAGMENT, /* first fragment */ > EAPTLS_MORE_FRAGMENTS, /* more fragments, to > send/receive */ > EAPTLS_LENGTH_INCLUDED, /* length included */ > EAPTLS_MORE_FRAGMENTS_WITH_LENGTH, /* more fragments with > length */ > EAPTLS_HANDLED /* tls code has handled it */ > } eaptls_status_t; > > So I don't see any particular reason why one session would succeed > and the other would fail. > So, does this mean that I should interpret the above enum to have elements 0-13, or 1-14, and match the numbers 7 and 13 with it's position in the enum? > > Also, anyone know what the rlm_eap_tls messages mean that accompany > > the 'returned 13' block? > > Information about internal TLS stuff. There are a *lot* of TLS > packets that go back and forth. > I'm curious why we can see the TLS stuff during the first try (13), but not the second try (7). What is the difference? I agree...it seems like there should nothing different between what the client sends in the first try and the second. > At this point, the only thing I can suggest is to put a packet > capture on the net somewhere. That might give more information. > I performed a packet capture using ethereal, listening on the interface that freeradius is running on. Did this on the box, not inline. I would rather not post it to the list, but I'd be glad to send it to you if you'd be willing to look at it. Let me know. > Alan DeKok. > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

3 3

Removing Authentication
by Robin 05 Aug '05

05 Aug '05

Hi everyone, I have just started using freeradius and have managed to setup access by username/password to my hotspot controller with mysql as the backend. It works fine and even sends back the session-timeout (1 hour for testing) so my controller forces users to re-authenticate. I created a few perl scripts for managing my customers, removing users from the rad tables after their time expires or else people could just login again and get another hour. Is this a correct way to manage users, or is there a method using accounting modules to prevent people from logging in after their time has expired? Thank you for any assistance, Robin

1 0

different eap/tls config for different interfaces
by ragan_davis＠colstate.edu 05 Aug '05

05 Aug '05

I'm running freeradius on a linux box with 2 nics, eth0 and eth1. Let's say eth0 has an ip of 192.168.5.5, and eth1 has an ip of 192.168.6.6. And, eth0 is a member of vlan 5 and eth1 is a member of vlan 6. I bind freeradius to "*", so it's listening on both interfaces/ip's. I generated freeradius' tls certificate with a common name matching the ip of eth0 (192.168.5.5). Will this cause problems when a client tries to connect to freeradius via eth1 (192.168.6.6)? If so, is it possible to have 2 different tls sections that service the 2 different interfaces? Seems like I read somewhere that you can represent more than one IP in the common name of a certificate, but can't remember for sure as it's been a while. Anyone have any suggestions? thanks!

3 2