- Freeradius-Users - lists.freeradius.org

Coa and Disconnect Message
by gennaro amelio 05 Aug '05

05 Aug '05

>I have *no* idea why you would want both sqlcounter & disconnect >messages. To use sqlcounter & disconnect is probably more flexible because a prepaid user can buy more time and so the session 's length can dinamically change. What do you think? Thanks in advance Gennaro

2 1

Re: Multiple Password Prompts
by ragan_davis＠colstate.edu 05 Aug '05

05 Aug '05

As I'm troubleshooting this, I generated another question in my head. This time I'll give some freeradius debug (see blocks between "*********"): Here's an exerpt from first try (failure): rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'o=sometree' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=sometree, with filter (cn=anonymous) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user anonymous authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included ********* eaptls_verify returned 11 rlm_eap_tls: <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange TLS_accept: SSLv3 read client key exchange A rlm_eap_tls: <<< TLS 1.0 ChangeCipherSpec [length 0001] rlm_eap_tls: <<< TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 read finished A rlm_eap_tls: >>> TLS 1.0 ChangeCipherSpec [length 0001] TLS_accept: SSLv3 write change cipher spec A rlm_eap_tls: >>> TLS 1.0 Handshake [length 0010], Finished TLS_accept: SSLv3 write finished A TLS_accept: SSLv3 flush data (other): SSL negotiation finished successfully SSL Connection Established eaptls_process returned 13 ********** modcall[authenticate]: module "eap" returns handled for request 4 modcall: group authenticate returns handled for request 4 Sending Access-Challenge of id 186 to 192.168.3.2:1024 Here's an exerpt from the second attempt (success): rlm_ldap: - authorize rlm_ldap: performing user authorization for anonymous radius_xlat: '(cn=anonymous)' radius_xlat: 'o=sometree' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in o=sometree, with filter (cn=anonymous) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user anonymous authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap" returns ok for request 5 modcall: group authorize returns updated for request 5 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 5 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS rlm_eap_tls: Length Included *********** eaptls_verify returned 11 eaptls_process returned 7 *********** rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 5 modcall[authorize]: module "preprocess" returns ok for request 5 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 5 rlm_ldap: - authorize rlm_ldap: performing user authorization for doe_john I looked back through some of the output, and it seems that each time it fails I get "eaptls_process returned 13", but when it is succeeds I get "eaptls_process returned 7". Anyone know what 7 and 13 represent (please don't say 'sucess' or 'failure'...i'm hoping it more meaningful than that). Also, anyone know what the rlm_eap_tls messages mean that accompany the 'returned 13' block? Thanks for any help! ----- Original Message ----- From: ragan_davis(a)colstate.edu Date: Thursday, August 4, 2005 6:40 pm Subject: Multiple Password Prompts > Hi, > > The Odyssey Client prompts at least twice for the password. Once > connected, clients can roam across different AP's within the same > WLAN > with no problems. Has anyone else experienced this problem with a > similar configuration? > > Running Environment: > > -- Freeradius Server = Gentoo Linux running FreeRADIUS v1.0.2 > -- User DB = Novell NetWare 6.5 SP3 w/ eDirectory 8.7.3.5 (LDAP) > -- Wireless Switch = Cisco Airespace 4100 WLAN Switch with WLAN > configured for WPA-TKIP using dynamic key exchange > -- Wireless AP = Cisco 1000 Series AP's (was Airespace) > -- Wireless Client = Funk Odyssey Client v4.0.1 on Windows XP > configured for WPA-TKIP and EAP-TTLS > > > We have captured debug output on the Odyssey Client, on the > Airespace > WLAN switch, and on FreeRADIUS, as well as an ethereal sniff on > the > freeradius interface on the radius server. I can provide these as > well as freeradius configs if needed. > > Thanks! > > - > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html

2 1

Question about Freeradius for mobile device authentication
by Jasper Jans 05 Aug '05

05 Aug '05

Hi, I've been asked to setup a platform for mobile device authentication. I'm looking into setting up Freeradius with a MySQL backend for this. The request that has been been is to verify users on three items: - msisdn - username - password My question is - can this authentication be done in different ways for different groups of users. Say group A wants the unique combination of msisdn, username, password to grant them access - however group B wants a pool of msisdns that are valid for all of their username + password combinations. If someone could be so kind as to maybe give an example of how to do this it would be greatly appreciated. Thanks, - Jasper

3 3

Freeradius + TLS for Wifi networks
by Moonshi Mohsenruddin 05 Aug '05

05 Aug '05

Hello there, I am implementing freeradius with openssl to do authentication for Wifi Windows XP clients with Wireless Access Points which has support for WPA. I am using a CommGate Shield product which is based on Red Hat Linux 9.0 with the latest patches, with a custom-compiled freeradius-1.0.4 and openssl-0.98 as the base system. After the compilation and configuration, we did our testing with a Windows XP Pro SP2 client and the integration was successful. However, I noticed that we have had multiple dropped connections from Windows XP Pro with the Planet WAP-4000 and 3Com Office Connect Wireless Access Points every 30 to 45 minutes but the freeradius server logs does not show any errors. I don't think this is a freeradius issue but I need to verify with someone that this is not a radius related problem. My question: ----------- Is there any configuration parameters within freeradius that I can tweak to debug and check that radius is not the one causing this problem? Logically, I don't think it's a radius issue but I might be wrong. If there is anyone that would like to get a copy of our RADIUS + TLS HOWTO documentation with to find out how we did this integration, please send me a personal email and I will send the PDF copy over. -- Stay driven! Moonshi Mohsenruddin CommGate Inc.

2 2

Multiple Password Prompts
by ragan_davis＠colstate.edu 04 Aug '05

04 Aug '05

Hi, The Odyssey Client prompts at least twice for the password. Once connected, clients can roam across different AP's within the same WLAN with no problems. Has anyone else experienced this problem with a similar configuration? Running Environment: -- Freeradius Server = Gentoo Linux running FreeRADIUS v1.0.2 -- User DB = Novell NetWare 6.5 SP3 w/ eDirectory 8.7.3.5 (LDAP) -- Wireless Switch = Cisco Airespace 4100 WLAN Switch with WLAN configured for WPA-TKIP using dynamic key exchange -- Wireless AP = Cisco 1000 Series AP's (was Airespace) -- Wireless Client = Funk Odyssey Client v4.0.1 on Windows XP configured for WPA-TKIP and EAP-TTLS We have captured debug output on the Odyssey Client, on the Airespace WLAN switch, and on FreeRADIUS, as well as an ethereal sniff on the freeradius interface on the radius server. I can provide these as well as freeradius configs if needed. Thanks!

1 0

forcing client certificate authentication during EAP-PEAP and EAP-TTLS
by Michael Wang 04 Aug '05

04 Aug '05

Hi, I was wondering if there is a way to configure the radiusd to force the client to present his certificate during EAP-PEAP and EAP-TTLS. (I know this is not necessary, but I need to do it anyways....) I saw an interesting piece of code in eaptls_initiate() which indicates someone was thinking about it: /* * If we're TTLS or PEAP, then do NOT require a client * certificate. * * FIXME: This should be more configurable. */ if (handler->eap_type != PW_EAP_TLS) { vp = pairfind(handler->request->config_items, PW_EAP_TLS_REQUIRE_CLIENT_CERT); if (!vp) { client_cert = FALSE; } else { client_cert = vp->lvalue; } } So it seems like radiusd will force client certificate authentication during PEAP or TTLS if this particular value pair is set with lvalue==1. But I don't see any code where the PW_EAP_TLS_REQUIRE_CLIENT_CERT gets put into the config_items. Can someone "in the know" comment? I am looking at the source code from freeradius-1.0.4 Thanks, Michael

2 2

Need inbound CHAP authentication user profile examples
by RUCHIR MALHOTRA 04 Aug '05

04 Aug '05

Hi RADIUS gurus,I need some inbound CHAP authentication user profile examples for RADIUS testing with CHAP turned on. Please email me if you have some. Thanks in advance, Ruchir __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Cisco, DNIS and ISDN Problems
by Wilhelm Lehmann 04 Aug '05

04 Aug '05

Hi Everyone, I have been using Livingston Radius for a very long time, and decided it was time to upgrade to FreeRadius. We have various pop's authenticating to our radius server, and to make sure everything worked ok I first set only the lucent based pop's to authenticate on FreeRadius. This worked 100% and we decided to let the cisco boxes also authenticate on the new radius server. Suddenly we found the ISDN users can't authenticate. "tail -f radius.log Thu Aug 4 11:24:28 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as2 port 20012 cli 061xxx) Thu Aug 4 11:24:30 2005 : Auth: Login incorrect: [sonjapretorius/xxx] (from client Windhoek-as2 port 20012 cli 061xxx) Thu Aug 4 11:24:31 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as2 port 20330 cli 061xxx) Thu Aug 4 11:24:33 2005 : Auth: Login incorrect: [japhet/xxx] (from client Windhoek-as2 port 20330 cli 061xxx) Thu Aug 4 11:24:52 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Industria-as1 port 77 cli 061xxx) Thu Aug 4 11:24:58 2005 : Auth: Login OK: [lords/<CHAP-Password>] (from client Industria-as1 port 77 cli 061xxx) Thu Aug 4 11:25:05 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as1 port 20424 cli 061xxx) Thu Aug 4 11:25:10 2005 : Auth: Login incorrect: [japhet/xxx] (from client Windhoek-as1 port 20424 cli 061xxx) Thu Aug 4 11:25:51 2005 : Auth: Login incorrect: [dnis:1040/cisco] (from client Windhoek-as1 port 72 cli 061xxx) Thu Aug 4 11:25:56 2005 : Auth: Login OK: [kaysererongo/<CHAP-Password>] (from client Windhoek-as1 port 72 cli 061xxx) " The two Login OK's are Async users. I noticed the port numbers are very high on the ISDN users, 20000+ while the Async ports are < 200 Just something else, for example the same user "japhet" can connect fine as he should on the Lucent NAS on ISDN or Async. The moment he connects to the Cisco I get the Login incorrect. No changes done at all. (Async works fine on the Cisco) On the DNIS:1040 even on my Livingston radius I used to get the dnis:1040 user every time a user connects to the cisco nas's but this is just a minor irritation it didn't affect the users operation. How can I get rid of this ? The National Teleco (running the Cisco's) say there is nothing they can do, as they share the E1's and modems with all ISP's in our country, but determining who's customer it is by the number dialed, and this is where the dnis:1040 comes from and told me just to ignore it. Running radiusd -xx gives no info as to why it was rejected. Hope someone can assist. Thank you Wilhelm Lehmann

3 5

RES: Limiting the number of connections
by Jose Divino de Lima 04 Aug '05

04 Aug '05

Hi Alan, Thanks for your explanation. We´ve a shell script that do exactly what you sad. I´m trying to look for another way to do this. We´ve here a VoIP network and we need to restrict "N" connections to some groups. When i using a shell script it´s run properly, but it´s not fast. I thought that it can be did via mySQL in authorize_check query. It´s my scenario. Tks, Lima -----Mensagem original----- De: freeradius-users-bounces(a)lists.freeradius.org [mailto:freeradius-users-bounces@lists.freeradius.org]Em nome de Alan DeKok Enviada em: quarta-feira, 3 de agosto de 2005 13:32 Para: FreeRadius users mailing list Assunto: Re: Limiting the number of connections "Jose Divino de Lima" <jdlima(a)prolan.com.br> wrote: > I´ve a challenge now to limit thu number of simultaneous connections > (i.e: we can permit only ten connections at the same time). doc/Simultaneous-Use If you're limiting connections to 10 *different* people, you'll have to write some custom code. Even a shell script would do. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: ldap basedn assignment
by ggreen＠olemiss.edu 04 Aug '05

04 Aug '05

> How do you have this setup? Check out doc/configurable_failover. That > should show you how to do it. > I'm using configurable failover to get it to roll as it is. >From my radiusd.conf file: Authorize{ ldap1{ reject=1 } ldap2{ reject=1 ok=return } } Authenticate{ Auth-Type LDAP { ldap1{ reject=1 ok=return } ldap2{ reject=1 ok=return } } } The output I see when I try to authenticate with an openldap username/password where the username is also in AD rad_recv: Access-Request packet from host 130.74.186.38:17688, id=1, length=46 User-Name = "username" User-Password = "test123" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 0 modcall[authorize]: module "preprocess" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(sAMAccountName=username)' radius_xlat: 'cn=Users,dc=dept,dc=university,dc=edu' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to ad.dept.university.edu:389, authentication 0 rlm_ldap: bind as cn=aduser,cn=Users,dc=dept,dc=university,dc=edu/adpassword to ad.dept.university.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in cn=Users,dc=dept,dc=university,dc=edu, with filter (sAMAccountName=username) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap1" returns ok for request 0 rlm_ldap: - authorize rlm_ldap: performing user authorization for username radius_xlat: '(uid=username)' radius_xlat: 'dc=university,dc=edu,c=US' rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to openldap.university.edu:1744, authentication 0 rlm_ldap: bind as uid=ldapuser,ou=Special Users,dc=university,dc=edu,c=US/ldappassword to openldap.university.edu:1744 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in dc=university,dc=edu,c=US, with filter (uid=username) rlm_ldap: looking for check items in directory... rlm_ldap: looking for reply items in directory... rlm_ldap: user username authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 modcall[authorize]: module "ldap2" returns ok for request 0 modcall: group authorize returns ok for request 0 rad_check_password: Found Auth-Type LDAP auth: type "LDAP" Processing the authenticate section of radiusd.conf modcall: entering group Auth-Type for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "username" with password "test123" rlm_ldap: user DN: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu rlm_ldap: (re)connect to ad.dept.university.edu:389, authentication 1 rlm_ldap: bind as CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu/test123 to ad.dept.university.edu:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind failed with invalid credentials modcall[authenticate]: module "ldap1" returns reject for request 0 rlm_ldap: - authenticate rlm_ldap: login attempt by "username" with password "test123" rlm_ldap: user DN: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu rlm_ldap: (re)connect to openldap.university.edu:1744, authentication 1 (THIS LINE IS THE PROBLEM) rlm_ldap: bind as CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu/test123 to openldap.university.edu:1744 rlm_ldap: waiting for bind result ... rlm_ldap: CN=name\, user,CN=Users,DC=dept,DC=university,DC=edu bind to openldap.university.edu:1744 failed No such object rlm_ldap: ldap_connect() failed modcall[authenticate]: module "ldap2" returns fail for request 0 modcall: group Auth-Type returns fail for request 0 auth: Failed to validate the user. The above problem line should be: rlm_ldap: bind as uid=username, ou=People, dc=university,dc=edu,c=us/test123 to openldap.university.edu:1744 However, it is taking the userdn from the ad server which gave the first authorize ok. What I need is for it to attempt to authenticate with the appropriate userdn depending on which server it is authenticating to. So it would use the userdn from AD authenticating to the AD server and the openldap userdn when authenticating to the openldap server. Thanks

3 2