- Freeradius-Users - lists.freeradius.org

Freeradius with LNS & Provider BRAS
by Neil Morris 11 Sep '15

11 Sep '15

Folks, I am looking for some guidance. I am using the users file which contains x3 user accounts aswell as the domain suffix & the necessary authentication details for the providers RADIUS server. Under the user accounts I have a number of cisco avp with VRF & static address etc for the LNS Whoever The provider is telling me that I am passing all the LNS relate info to their RADIUS which is causing the tunnel build to fail. Is there something major that I am missing here in relation to my config? Kind Regards, Neil

2 1

Identity does not match User-Name, setting from EAP Identity. (Freeradius + EAP + MSCHAPv2 + NTLM + AD)
by aquilinux 10 Sep '15

10 Sep '15

Hi all, i'm configuring RADIUS authentication against MS Active Directory. So far i've successfully joined the server to the domain and ntlm_auth works flawlessly: */usr/bin/ntlm_auth --request-nt-key --domain=EA-MILANO --username=srv_backup2 --password=xxxxxxxx* *NT_STATUS_OK: Success (0x0)* but i'm going nuts with freeradius. I've read lots of posts in mailing list and howtos about my error: Thu Sep 10 15:05:46 2015 : Debug: (0) eap : *Identity does not match User-Name, setting from EAP Identity.* Thu Sep 10 15:05:46 2015 : Debug: (0) eap : *Failed to get handler, probably already removed, not inserting EAP-Failure* but still i can't get it working. so here i am, asking myself the mailing-list. here is my debug output: http://pastebin.com/cvsfxNUA and here is the radeapclient request: http://pastebin.com/v4Kwzj66 thanks in advance! -- "Madness, like small fish, runs in hosts, in vast numbers of instances." Nessuno mi pettina bene come il vento.

3 2

Freeradius and Kerberos
by Jürgen Obermeyer 10 Sep '15

10 Sep '15

Good afternoon! I'm a german teacher and responsible for the computer network at my school. I would like to authenticate users intending to connect with our WLAN by using their credentials stored in a Kerberos database. I read a lot of documentation, but due to the fact that I'm a teacher and not a professional system adminstrator, I'm not able to get things work and I hope for some help! What I have: - an Ubuntu box (14.04 server) with a running MIT-Kerberos infrastructure - freeradius 2.1.12 on this box - an AP with "WPA enterprise" (WPA-EAP) I've done a lot of configuration and if I try to connect to the WLAN via the AP, freeradius is presenting his certificate and prompts me for user credentials. The packet freeradius-krb5 is installed and configured properly (I hope). But the authentication doesn't work. There a so much config details that I don't know exactly what kind of information may be useful to solve my problem. Maybe there is a tutorial describing step by step what I have to do? And: I hope that it is possible to an authentication against Kerberos? Thanks a lot for your hints! Jürgen -- Ökumenisches Gymnasium Bremen Oberneulander Landstr. 143a 28355 Bremen Fon: +49 421 22312913 Fax: +49 421 22312910 Web: http://www.oegym.de/

2 1

Network ranges in users files
by Sophie Loewenthal 10 Sep '15

10 Sep '15

Hi, I'dl ike to add some addresses into /etc/raddb/users Currently I have this, DEFAULT NAS-IP-Address == 195.222.222.0, Pool-Name := vodafone-nas-m2m But I should change this to, 195.232.191.50 195.232.191.51 195.232.191.52 195.232.191.53 Maybe I could use 195.232.191.52/29 allowing 195.232.191.49 - 195.232.191.54 Would these ideas work? DEFAULT NAS-IP-Address == 195.232.191.52/29, Pool-Name := vodafone-nas-m2m Or, DEFAULT NAS-IP-Address == 195.232.191.50, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.51, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.52, Pool-Name := vodafone-nas-m2m DEFAULT NAS-IP-Address == 195.232.191.53, Pool-Name := vodafone-nas-m2m Kind regards, Sophie

2 3

freeradius X error "failed to load module "perl""
by John Estrella 10 Sep '15

10 Sep '15

Hi All, I have Ubunto 12.04.3 server and installed LinOTP and FreeRadius using the following website instructions. Not sure the versions of LinOTP and FreeRadius installed but I'm guessing the latest versions since I didn't specify a version during download. https://thenetworkcable.wordpress.com/2014/11/28/two-factor-authentication-… I followed each step and had no errors setting anything up. When running "radtest username OTPpassword 127.0.0.1 0 mypass", I receive an error saying "radclient: no response from server for ID 234 socket 3" Afterwards, I ran freeradius -X debug and got the following message: Radius: #### Loading Virtual Servers #### server { #from the file /etc/freeradius/radius.conf modules { Module: Creating Auth-Type = perl Module: Checking authenticate {...} for more modules to load /etc/freeradius/sites-enabled/linotp[13]: Failed to load module "perl". /etc/freeradius/sites-enabled/linotp[12]: Errors parsing authenticate section. I have searched plenty and haven't found any difinitive solutions. Your help is greatly appreciated. John The information in this e-mail message and any attachments may be legally privileged and confidential. If you are not an intended recipient, you are hereby notified that you have received this communication in error and that any review, use, distribution or copying of this message is strictly prohibited. If you have received this communication in error, please notify us immediately by return e-mail and delete this e-mail message, any copies thereof and any attachments thereto. This email is for informational purposes only and does not constitute an offer to sell or a solicitation of an offer to purchase any interest in any investment vehicles managed by Sandler Capital Management.

4 4

sql accounting
by Edwardo Garcia 09 Sep '15

09 Sep '15

Hi, in accounting {} There is -sql and -ldap can someone explain why they are exampled that way? Does it mean do not use sql and ldap? and it is written this way to specifically not use them, over a compile time default of use them? So if I want to use sql in accounting, I need change -sql to sql? thanks

3 4

Questions regarding trimming User-Name attribute via filter.
by Pro Green European 09 Sep '15

09 Sep '15

Hi. I'm having issues with migrating from 2.1.0 to 3.0.4 (Centos 7.x). In version 2.1.0 I have in /etc/freeradius/users: DEFAULT User-Name =~ ".{5}$" User-Name = `%{0}` This does not work anymore, and I am struggling to understand how to achieve the same thing in 3.0.4. What I want to achieve is, that anything that comes before the last five characters should be removed from the User-Name attribute, and only the last five characters should be left as User-Name. I understand that I have to do this in /etc/raddb/policy.d/filter somehow, but I fail to see how. Would somebody with better knowledge please assist. BR, /PGE

2 1

eapol_test from wpa_supplicat-2.4 fails with MPPE keys mismatch for TTLS:CHAP/MSCHAP/MSCHAPv2
by Patrik Kis 09 Sep '15

09 Sep '15

Hello, I executed eapol_test from wpa_supplicat-2.4 (that is using TLS-1.2) against freeradius-2.2.8 and the following cases are failing with " [ttls] Tunneled challenge is incorrect": EAP-TTLS/CHAP EAP-TTLS/MSCHAP EAP-TTLS/MSCHAPv2 Interestingly the same tests with eapol_test from wpa_supplicat-2.4 (that is using TLS-1.0) are fine. I would be surprised if I was the first who tried to run these tests. Does anybody experienced the same issue? For configuration and test results please refer to the attached file. radiusd in debug mode write this: ... [ttls] Authenticate [ttls] processing EAP-TLS [ttls] eaptls_verify returned 7 [ttls] Done initial handshake [ttls] eaptls_process returned 7 [ttls] Session established. Proceeding to decode tunneled attributes. [ttls] Tunneled challenge is incorrect [eap] Handler failed in EAP/ttls [eap] Failed in EAP select ++[eap] = invalid +} # group authenticate = invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +group REJECT { [eap] Reply already contained an EAP-Message, not inserting EAP-Failure ++[eap] = noop [attr_filter.access_reject] expand: %{User-Name} -> anonymous attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] = updated +} # group REJECT = updated Delaying reject of request 6 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 6 Sending Access-Reject of id 6 to 127.0.0.1 port 49816 EAP-Message = 0x04060004 Message-Authenticator = 0x00000000000000000000000000000000 The test configuration files looks like this: # cat EAP-TTLS_CHAP.conf ctrl_interface=wpa_supplicant.ctrl network={ ssid="QA test 802.1x network" key_mgmt=IEEE8021X eap=TTLS phase2="auth=CHAP" identity="testuser" anonymous_identity="anonymous" password="testpwd" ca_cert="/etc/raddb/certs/ca.pem" ca_cert2="/etc/raddb/certs/ca.pem" } The raiusd has the default configuration except: /etc/raddb/modules/mschap /etc/raddb/modules/pap /etc/raddb/eap.conf /etc/raddb/users and test certificates were created and added. For the details please see the attached file. The wpa_supplicant was built with the provided "defconfig" configuration. Regards, Patrik Kis

6 14

User authentication - users config file and MySQL databases
by Alexandre Vilarinho 09 Sep '15

09 Sep '15

Hello all I would like to transfer all the configured users in the user conf file to MySQL database, is it possible? I've configured Radius to work with MySQL and created a test user in radcheck database with a test password. Folllow the entry. username - testeattribute - cleartext-passwordop - :=value - teste I also created an entry in radreply database the following entry. username - testeattribute - fall-throughop - =value - yes For this test all others databases are empty. I've started freeradius in debug mode to see if there where any erros, but there wasn't. The log file output. Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #2Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #3Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Attempting to connect rlm_sql_mysql #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql_mysql: Starting connect to MySQL server for #4Tue Sep 8 23:53:00 2015 : Info: rlm_sql (sql): Connected new DB handle, #4Tue Sep 8 23:53:00 2015 : Info: Loaded virtual server inner-tunnelTue Sep 8 23:53:00 2015 : Info: ... adding new socket proxy address * port 52669Tue Sep 8 23:53:00 2015 : Info: Ready to process requests. After radius server was running I tested if the user, teste, was going to be authenticated, and it wasn't. I've received an Reject message. Sending Access-Request of id 147 to 127.0.0.1 port 1812 User-Name = "teste" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=147, length=20 Neither the debug or the log show if Freeradius was searching for this user to the user conf file or in MySQL databases. Since in radius documentation states that if the user is not found it is reject, I wonder where is it searching. Is not clear if it is only searching in the user conf file or if it also searching in radckeck database. Is it possible to add in the debug or in log file where Freeradius is searching for the user? When I test the authentication with an user, teste1, configured in the user conf file, it was accepted. root@Ubuntu-Radius-Server:~# radtest teste1 teste localhost 1812 testing123Sending Access-Request of id 210 to 127.0.0.1 port 1812 User-Name = "teste1" User-Password = "teste" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Message-Authenticator = 0x00000000000000000000000000000000rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=210, length=20 I didn't found in the radiusd.conf file or in the sql.conf file a way to configure Radius to force it to use the MySQL databases to authenticate the users. Is it possible to configure it? Thanks for the help. Regards Alex

6 9

reuse EAP-TLS client certificiate
by Matt Zagrabelny 09 Sep '15

09 Sep '15

Greetings, I've done a quick google and scan of the FR user mailing list archives and did not find a definitive answer to the following: With EAP-TLS, can one reuse the same client cert across multiple devices? I'm guessing "yes", but would appreciate confirmation. Tangentially, is there a way to "pin" a certificate to a client's MAC address? Thanks! -m

3 3