- Freeradius-Users - lists.freeradius.org

RE: Switch sends EAP-Fail after Radius Access-Accept
by Preyas Kamath 08 Aug '15

08 Aug '15

Thanks for the replies. I'm went back to using the default radiusd.conf, modified the client file to match my client IP subnet. However it seems that there is still a certificate mismatch. I built the cert in /etc/radddb/certs. Any ideas? I read that the certficate generated using the Makefile works with most OS'es. Client is running Windows 7. rad_recv: Access-Request packet from host 10.1.2.12 port 1645, id=211, length=156 User-Name = "testuser" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "24-B6-57-D3-2C-8C" Calling-Station-Id = "5C-B9-01-B2-4A-15" EAP-Message = 0x0201000d017465737475736572 Message-Authenticator = 0x991bd0b24878be987307b9720dd4c9ed NAS-Port-Type = Ethernet NAS-Port = 50112 NAS-Port-Id = "GigabitEthernet1/0/12" NAS-IP-Address = 10.1.2.12 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 1 length 13 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry testuser at line 93 [files] expand: Hello, %{User-Name} -> Hello, testuser ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 211 to 10.1.2.12 port 1645 Reply-Message = "Hello, testuser" EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xadf0c5e3adf2dcafb375283b0a488eb1 Finished request 6. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.2.12 port 1645, id=212, length=167 User-Name = "testuser" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "24-B6-57-D3-2C-8C" Calling-Station-Id = "5C-B9-01-B2-4A-15" EAP-Message = 0x020200060311 Message-Authenticator = 0x54788e58614c18954ae1c9fe3fdaa611 NAS-Port-Type = Ethernet NAS-Port = 50112 NAS-Port-Id = "GigabitEthernet1/0/12" State = 0xadf0c5e3adf2dcafb375283b0a488eb1 NAS-IP-Address = 10.1.2.12 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 2 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry testuser at line 93 [files] expand: Hello, %{User-Name} -> Hello, testuser ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/leap [eap] processing type leap rlm_eap_leap: Stage 2 rlm_eap_leap: Issuing AP Challenge rlm_eap_leap: Successfully initiated ++[eap] returns handled Sending Access-Challenge of id 212 to 10.1.2.12 port 1645 Reply-Message = "Hello, testuser" EAP-Message = 0x01030018110100087a19e6f0d4315cd47465737475736572 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xadf0c5e3acf3d4afb375283b0a488eb1 Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.1.2.12 port 1645, id=213, length=201 User-Name = "testuser" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "24-B6-57-D3-2C-8C" Calling-Station-Id = "5C-B9-01-B2-4A-15" EAP-Message = 0x020300281101001866e12f1d13159a30833646856e73271313b09d0bf85f645e7465737475 736572 Message-Authenticator = 0x22cf06518157775f54c2ecaa09311ee1 NAS-Port-Type = Ethernet NAS-Port = 50112 NAS-Port-Id = "GigabitEthernet1/0/12" State = 0xadf0c5e3acf3d4afb375283b0a488eb1 NAS-IP-Address = 10.1.2.12 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] EAP packet type response id 3 length 40 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated [files] users: Matched entry testuser at line 93 [files] expand: Hello, %{User-Name} -> Hello, testuser ++[files] returns ok ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING: Auth-Type already set. Not setting to PAP ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/leap [eap] processing type leap rlm_eap_leap: Stage 4 rlm_eap_leap: NtChallengeResponse from AP is valid [eap] Underlying EAP-Type set EAP ID to 4 ++[eap] returns ok # Executing section post-auth from file /etc/raddb/sites-enabled/default +- entering group post-auth {...} ++[exec] returns noop Sending Access-Challenge of id 213 to 10.1.2.12 port 1645 Reply-Message = "Hello, testuser" EAP-Message = 0x03040004 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xadf0c5e3aff4d4afb375283b0a488eb1 Finished request 8. Going to the next request Waking up in 4.9 seconds. Cleaning up request 6 ID 211 with timestamp +10517 Cleaning up request 7 ID 212 with timestamp +10517 Cleaning up request 8 ID 213 with timestamp +10517 WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0xadf0c5e3aff4d4af did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Ready to process requests. Regards Preyas -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+p.kamath=cornet.com@lists.freeradius.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: Thursday, August 06, 2015 9:29 AM To: FreeRadius users mailing list Subject: Re: Switch sends EAP-Fail after Radius Access-Accept Hi, > [preyask@localhost controller-ned]$ cat /etc/raddb/small.conf listen { > type = auth > ipaddr = * > port = 1812 > } > client 10.1.2.0/24 { # allow packets from 10.1.2.0/24 > secret = testing123 > shortname = 10.1.2.12 > } > modules { # We don't use any modules > } > authorize { # return Access-Accept for PAP and CHAP > update control { > Auth-Type := Accept > } > } yeh. that wont work....start with the default configuration and THEN start slimming it down big hints - you are using EAP thus you ARE using modules....in fact ALL work in FreeRADIUS uses modules. you are doing EAP - therefore the request needs to go into a virtual server that is called in the eap.conf configuration. default in virtual-server. I'll repeat. stop what you are currently doing, install the default config, add your client and THEN start work....once its working and you get to know what each module does and how the server works, THEN reduce the configuration alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

3 2

Migrating from pppoe server mikrotik to pppoe server juniper
by Marcos TP 07 Aug '15

07 Aug '15

Dear, I'm starting setting up a pppoe server juniper in place of a mikrotik. Today I have a freeradius server / mikrotik with fully operational postgresql database and would like to set up another for the same purpose with the Juniper MX80 Would you like to receive information and Juniper configuration examples using Freeradius to authenticate my pppoe clients. The principle just need to validate user and password as well as a limiter band. All help is welcome!

1 0

Error log message
by Peter Balsianok 07 Aug '15

07 Aug '15

Hi I use freeradius 3.0.x (accounting). I found strange error log message Normal log mode: Fri Aug 7 15:14:09 2015 : Error: Receive - Fri Aug 7 15:14:12 2015 : Error: Receive - Fri Aug 7 15:14:14 2015 : Error: Receive - Fri Aug 7 15:14:17 2015 : Error: Receive - Fri Aug 7 15:14:19 2015 : Error: Receive - When i run radiusd in the debug mode error messages look like: Debug log mode: Receive - Length field value too large, expected maximum of 4096 bytes, got 26209 bytes Receive - Length field value too large, expected maximum of 4096 bytes, got 26209 bytes Pcap is included in the attachment ( between F5 network element and radius instance). The network element is testing RADIUS availability. Thx.

2 3

WARNING: Unknown module "tolower" in string expansion "%"
by Юра Фролов 07 Aug '15

07 Aug '15

As an example for setting used http://wiki.freeradius.org/guide/Mac%20Auth (on FreeRADIUS 2.1.12 it configuration works very well) my policy.conf ....... mac-addr = ([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[ ^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2})[^0-9a-f]?([0-9a-f]{2}) rewrite.called_station_id { if((Called-Station-Id) && "%{Called-Station-Id}" =~ /^%{config:policy.mac-addr}(:(.+))?$/i) { update request { Called-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } if ("%{8}") { update request { Called-Station-Id := "%{Called-Station-Id}:%{8}" } } updated } else { noop } } rewrite.calling_station_id { if((Calling-Station-Id) && "%{Calling-Station-Id}" =~ /^%{config:policy.mac-addr}$/i) { update request { Calling-Station-Id := "%{tolower:%{1}-%{2}-%{3}-%{4}-%{5}-%{6}}" } updated } else { noop } } # host-name = host\/[0-9a-f]*\.ww[0-9]{3}\.siemens\.net rewrite.host_name { # if((User-Name) && "%{User-Name}" =~ /^%{config:policy.host-name}$/i) { update request { Tmp-String-0 := "%{tolower:%{User-Name}}" } # } # else { # noop # } } ........ section in conf. file virtual server ....... authorize { preprocess if (!EAP-Message) { rewrite.calling_station_id authorized_mac if ( ok ) { update control { Auth-Type := Accept } } else { reject } } elsif ( (User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) { eap } else { rewrite.host_name authorized_name if (ok) { eap } else { reject } } } authenticate { eap authorized_mac } session { } post-auth { if ( (User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) { update reply { Cisco-AVPair := "device-traffic-class=voice" } } Post-Auth-Type REJECT { attr_filter.access_reject } } } Add question: tolower this modul similarly rlm-eap or or the structure of the language of programming?

1 0

Switch sends EAP-Fail after Radius Access-Accept
by Preyas Kamath 06 Aug '15

06 Aug '15

When client connects to 802.1x enabled Cisco switch the EAP request, reply are fine, Radius server request, response seems ok. However even though Radius server response with Accept, the Cisco 2960-S send EAP fail to client. I'm using a fairly simple Radius conf file (see below). Setup Windows XP client 10.1.2.100 <--> (port 12) Catalyst switch 2960-S 10.1.2.12 (port 1) <--> Radius server 10.1.2.1 (freeRadius running on Centos 6.4). [preyask@localhost controller-ned]$ cat /etc/raddb/small.conf listen { type = auth ipaddr = * port = 1812 } client 10.1.2.0/24 { # allow packets from 10.1.2.0/24 secret = testing123 shortname = 10.1.2.12 } modules { # We don't use any modules } authorize { # return Access-Accept for PAP and CHAP update control { Auth-Type := Accept } } Wireshark shows Radius Access-Accept with code 2, see packet below, I have a feeling that the switch is looking for something else in the Radius Accept-Accept packet, it's not finding it so it sends EAP Fail to client. Packet No 17 is the Radius Access-Request, No 18 is the Radius Access-Accept No. Time Source Destination Protocol Length Info 17 5.943203000 10.1.2.12 10.1.2.1 RADIUS 200 Access-Request(1) (id=80, l=158) Frame 17: 200 bytes on wire (1600 bits), 200 bytes captured (1600 bits) on interface 0 Interface id: 0 WTAP_ENCAP: 1 Arrival Time: Aug 5, 2015 12:18:53.509276000 EDT [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1438791533.509276000 seconds [Time delta from previous captured frame: 0.708854000 seconds] [Time delta from previous displayed frame: 0.000000000 seconds] [Time since reference or first frame: 5.943203000 seconds] Frame Number: 17 Frame Length: 200 bytes (1600 bits) Capture Length: 200 bytes (1600 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius:eap] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0), Dst: HewlettP_74:43:55 (10:60:4b:74:43:55) Destination: HewlettP_74:43:55 (10:60:4b:74:43:55) Address: HewlettP_74:43:55 (10:60:4b:74:43:55) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) Address: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.1.2.12 (10.1.2.12), Dst: 10.1.2.1 (10.1.2.1) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 186 Identification: 0x0884 (2180) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 255 Protocol: UDP (17) Header checksum: 0x9aa0 [correct] [Good: True] [Bad: False] Source: 10.1.2.12 (10.1.2.12) Destination: 10.1.2.1 (10.1.2.1) User Datagram Protocol, Src Port: sightline (1645), Dst Port: radius (1812) Source port: sightline (1645) Destination port: radius (1812) Length: 166 Checksum: 0x52d4 [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Access-Request (1) Packet identifier: 0x50 (80) Length: 158 Authenticator: 974ac85da269d81595fd54db7effa738 [The response to this request is in frame 18] Attribute Value Pairs AVP: l=11 t=User-Name(1): anonymous User-Name: anonymous AVP: l=6 t=Service-Type(6): Framed(2) Service-Type: Framed (2) AVP: l=6 t=Framed-MTU(12): 1500 Framed-MTU: 1500 AVP: l=19 t=Called-Station-Id(30): 24-B6-57-D3-2C-8C Called-Station-Id: 24-B6-57-D3-2C-8C AVP: l=19 t=Calling-Station-Id(31): 5C-B9-01-B2-4A-15 Calling-Station-Id: 5C-B9-01-B2-4A-15 AVP: l=16 t=EAP-Message(79) Last Segment[1] EAP fragment Extensible Authentication Protocol Code: Response (2) Id: 1 Length: 14 Type: Identity (1) Identity: anonymous AVP: l=18 t=Message-Authenticator(80): 538bc16f555647f1d590468a82da13dc Message-Authenticator: 538bc16f555647f1d590468a82da13dc AVP: l=2 t=EAP-Key-Name(102): EAP-Key-Name: AVP: l=6 t=NAS-Port-Type(61): Ethernet(15) NAS-Port-Type: Ethernet (15) AVP: l=6 t=NAS-Port(5): 50112 NAS-Port: 50112 AVP: l=23 t=NAS-Port-Id(87): GigabitEthernet1/0/12 NAS-Port-Id: GigabitEthernet1/0/12 AVP: l=6 t=NAS-IP-Address(4): 10.1.2.12 NAS-IP-Address: 10.1.2.12 (10.1.2.12) No. Time Source Destination Protocol Length Info 18 5.943345000 10.1.2.1 10.1.2.12 RADIUS 62 Access-Accept(2) (id=80, l=20) Frame 18: 62 bytes on wire (496 bits), 62 bytes captured (496 bits) on interface 0 Interface id: 0 WTAP_ENCAP: 1 Arrival Time: Aug 5, 2015 12:18:53.509418000 EDT [Time shift for this packet: 0.000000000 seconds] Epoch Time: 1438791533.509418000 seconds [Time delta from previous captured frame: 0.000142000 seconds] [Time delta from previous displayed frame: 0.000142000 seconds] [Time since reference or first frame: 5.943345000 seconds] Frame Number: 18 Frame Length: 62 bytes (496 bits) Capture Length: 62 bytes (496 bits) [Frame is marked: True] [Frame is ignored: False] [Protocols in frame: eth:ip:udp:radius] [Coloring Rule Name: UDP] [Coloring Rule String: udp] Ethernet II, Src: HewlettP_74:43:55 (10:60:4b:74:43:55), Dst: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) Destination: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) Address: Cisco_d3:2c:c0 (24:b6:57:d3:2c:c0) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Source: HewlettP_74:43:55 (10:60:4b:74:43:55) Address: HewlettP_74:43:55 (10:60:4b:74:43:55) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default) .... ...0 .... .... .... .... = IG bit: Individual address (unicast) Type: IP (0x0800) Internet Protocol Version 4, Src: 10.1.2.1 (10.1.2.1), Dst: 10.1.2.12 (10.1.2.12) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport)) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00) Total Length: 48 Identification: 0xdc2b (56363) Flags: 0x00 0... .... = Reserved bit: Not set .0.. .... = Don't fragment: Not set ..0. .... = More fragments: Not set Fragment offset: 0 Time to live: 64 Protocol: UDP (17) Header checksum: 0x8683 [correct] [Good: True] [Bad: False] Source: 10.1.2.1 (10.1.2.1) Destination: 10.1.2.12 (10.1.2.12) User Datagram Protocol, Src Port: radius (1812), Dst Port: sightline (1645) Source port: radius (1812) Destination port: sightline (1645) Length: 28 Checksum: 0x183c [validation disabled] [Good Checksum: False] [Bad Checksum: False] Radius Protocol Code: Access-Accept (2) Packet identifier: 0x50 (80) Length: 20 Authenticator: 17e05e8768080f89322124ad63a1eb63 [This is a response to a request in frame 17] [Time from request: 0.000142000 seconds] No. Time Source Destination Protocol Length Info 536 229.314304000 10.1.2.12 10.1.2.1 RADIUS 97 Access-Request(1) (id=81, l=55)

4 4

radclient output
by Lightfoot, Maurice P. 06 Aug '15

06 Aug '15

Hi I am using the FreeRadius beginner's guide, I entered the following command: echo "User-Name=alice, User-Password=passme" | radclient 127.0.01 auth testing123 The following response is what was expected according to the guide: Received response ID 32, code 2, length = 40 Framed-IP-Address = 192.168.1.65 Reply-Message = "Hello, alice" However the message I received from the debugger was the following: Sending Access-Accept ID 85 from 127.0.01:1812 to 127.0.01:60048 Framed-IP-Address= 192.168.1.65 Reply-Message = 'Hello, alice' Is this the correct output because there is no code # to go off of as referenced in the guide???

2 3

WARNING: Unknown module "tolower" in string expansion "%"
by Юра Фролов 06 Aug '15

06 Aug '15

Hello! I installed freeradius version 2.2.5 on debian 8.1 (latest version in repository). For authentification users accept mix 802.1x and mab. List stored in the files: mac-address in mac_db, name users in name_db (no sql database accepted) I also copied all files (configuration files, files users authentification ) with a previously installed and successfully operates freeradius (debian 7.8 freeradius 2.1.12). But when a user tries to authenticate MAC address (or 802.1x) on an error occurs: "Invalid user". The logs present a strange record: "WARNING: Unknown module "tolower" in string expansion "%"" Log failed authentification: rad_recv: Access-Request packet from host 1.1.1.1 (not real) port 1645, id=66, length=209 User-Name = "host/user.mycompany.com" Service-Type = Framed-User Framed-MTU = 1500 Called-Station-Id = "00-21-56-D6-EA-9F" Calling-Station-Id = "8C-73-6E-D9-41-1D" EAP-Message = 0x0201002a01686f73742f5042333030303037303234384e422e77773630302e7369656d656e732e6e6574 Message-Authenticator = 0x2c614fd14a05671b890772dabf25d62f NAS-Port-Type = Ethernet NAS-Port = 50031 NAS-Port-Id = "FastEthernet0/31" NAS-IP-Address = 1.1.1.1 (not real) server snx-auth { # Executing section authorize from file /etc/freeradius/sites-enabled/snx-auth +group authorize { ++[preprocess] = ok ++? if (!EAP-Message) ? Evaluating !(EAP-Message) -> FALSE ++? if (!EAP-Message) -> FALSE ++? elsif ((User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) ?? Evaluating (User-Name == "OpenStagePhone") -> FALSE ?? Evaluating (User-Name =~ /^001a/) -> FALSE ?? Evaluating (User-Name =~ /^0004/) -> FALSE ++? elsif ((User-Name == "OpenStagePhone") || (User-Name =~ /^001a/) || (User-Name =~ /^0004/) ) -> FALSE ++else else { +++policy rewrite.host_name { ++++update request { *WARNING: Unknown module "tolower" in string expansion "%"* ++++} # update request = noop +++} # policy rewrite.host_name = noop [authorized_name] expand: %{Tmp-String-0} -> +++[authorized_name] = noop +++? if (ok) ? Evaluating (ok) -> FALSE +++? if (ok) -> FALSE +++else else { ++++[reject] = reject +++} # else else = reject ++} # else else = reject +} # group authorize = reject Invalid user: [host/user.mycompany.com/<no User-Password attribute>] (from client domain port 50031 cli 8C-73-6E-D9-41-1D) The problem is conversion (uppercase - lowercase)? Feature works freeradius version 2.2.5 (undocumented error)? Or something else?

2 1

AAA configuration
by Anisa Allahdadi 05 Aug '15

05 Aug '15

> Hi all, > > I installed FreeRADIUS on Ubuntu, configured the database (mysql), > performed radtest from the localhost and NTradPing from a remote WIN > machine. Now I want to make this process automatic, so that every > connection/disconnection to/from the Internet put a record in *radacct* > table. I realized that I should configure my AP and I found some guides > here: > http://wiki.freeradius.org/vendor/Cisco > > I have 2 specific questions: > > 1. How and where exactly I can run the AAA configuration commands? > 2. What if my NAS is not of Cisco family? Does that make any difference? > > Any help will be really appreciated. > > Thanks, > Anisa >

1 0

Re: Freeradius-Users Digest, Vol 124, Issue 3
by JCA 05 Aug '15

05 Aug '15

> On Aug 3, 2015, at 11:45 PM, JCA <1.41421(a)gmail.com> wrote: >>> What's with the one letter acronyms? It just makes things harder to understand. >> >> It's for conciseness - it's simpler to write R than "RADIUS server" >> every time. My apologies if this misled you. > > It doesn't mislead. It's confusing and broken. "l33t" speak isn't useful, and is discouraged on this list. It's not "l33t" speak; it's compact notation in order to keep things short and to the point. My apologies if that confuses you. > >>> What you want is impossible to do. PAM is designed to do authentication. You CANNOT set group membership with PAM. >> >> You can't, or you shouldn't? > > I distinctly recall writing CANNOT. > >> What prevents one from writing a PAM >> module (or modifying an existing one) so that it will receive group >> information from the RADIUS server and modify /etc/group accordingly >> before returning to the caller? > > Reality? > > Writing to /etc/group is forbidden. For very good reasons. > > Alan DeKok. Well, I have just tried (as root, in CentOS) to edit /etc/group by hand, and I had no problems. Is it not the case that if the RADIUS PAM module runs as root, it will also be able to do so?

3 2

EAP-TLS with server and client certificates by different CA
by Mikhail Gaidamaka 05 Aug '15

05 Aug '15

Good day We use FreeRADIUS 2.1.10 to authorize wi-fi clients. Step 1: many client's devices check server certificate, than we have Comodo EssentialSSL certificate for server. Its certificate chain: - radius_eltex_nsk_ru.crt - http://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt - http://crt.comodoca.com/COMODORSAAddTrustCA.crt - AddTrust External CA Root EAP-PEAP-mschapv2 works good with this certificate. Step 2: we want to authorize clients with EAP-TLS We create self-signed CA (/etc/ssl/eltex/eltex-ca.crt) and any clients certs (maria.crt, for example). eap.conf has this parameters eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 md5 { } leap { } gtc { #challenge = "Password: " auth_type = PAP } tls { certdir = ${confdir}/certs cadir = /etc/ssl/eltex private_key_password = 123456 private_key_file = ${certdir}/radius.eltex.nsk.ru.key certificate_file = ${certdir}/radius_eltex_nsk_ru.crt CA_file = ${cadir}/eltex-ca.crt \ ${certdir}/COMODORSADomainValidationSecureServerCA.crt \ ${certdir}/COMODORSAAddTrustCA.crt \ ${certdir}/AddTrustExternalCARoot.crt dh_file = ${certdir}/dh random_file = /dev/urandom # fragment_size = 1024 # include_length = yes # check_crl = yes CA_path = ${certdir} # check_cert_issuer = "/C=GB/ST=Berkshire/L=Newbury/O=My Company Ltd" # check_cert_cn = %{User-Name} cipher_list = "DEFAULT" make_cert_command = "${certdir}/bootstrap" cache { enable = no lifetime = 24 # hours max_entries = 255 } verify { tmpdir = /tmp/radiusd client = "/usr/bin/openssl verify -CApath ${..cadir} %{TLS-Client-Cert-Filename}" } } 'cadir' contains eltex-ca.crt, eltex-ca.key only And now we can't authorize with EAP-TLS Client's device sends 'alert unknown ca' (what CA - server or client I can't understand) It was OK, when server ant client certificate were both signed by eltex-ca. I get this error at /var/log/syslog wpa_supplicant[926]: TLS: Certificate verification failed, error 20 (unable to get local issuer certificate) depth 0 for '/OU=Domain Control Validated/OU=EssentialSSL/CN=radius.eltex.nsk.ru' wpa_supplicant[926]: OpenSSL: tls_connection_handshake - SSL_connect error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed I try to install all my server certs to system # sudo update-ca-certificates 4 added, 0 removed; done. Running hooks in /etc/ca-certificates/update.d.... updating keystore /etc/ssl/certs/java/cacerts... added: /etc/ssl/certs/AddTrustExternalCARoot.pem added: /etc/ssl/certs/COMODORSADomainValidationSecureServerCA.pem added: /etc/ssl/certs/radius_eltex_nsk_ru.pem added: /etc/ssl/certs/COMODORSAAddTrustCA.pem done. done. But it still not authorized with the same error Can we use server and client certificates signed by different CA at one server?

2 1