- Freeradius-Users - lists.freeradius.org

Authentication Problem
by Robert Graham 15 Jan '15

15 Jan '15

Im just about at the end of my rope... I have been searching and reading and reading, but cannot get this to work. I have a external ms sql database that has three columns only. member_id, HashedPassword, and Salt. I am trying to authenticate against this database. 1st question is: Do I have to use the schema that is inside freeradius, and if I do not, how do I get FR to auth without using all the tables that are preinstalled in the schema? Unfortunately I am not a sql database guy, im a network guy, and writing db is not my forte.. This is what I have but yet I know it is incorrect. I dont want to use any groups, it is strictly for someone to logon to our vpn and wireless connections. The passwords are stored in SHA-512 with Salt and unicoding. Is it even possible or am I wasting my time? I am running 3.0.6 of FR. These are the only columns in the database. recreating the database isnt likely to happen, having almost 19,000 rows in the table. authorize_check_query = "\ SELECT member_id, HashedPassword, Salt \ FROM ${dbo.vw_Main_table} \ WHERE UserName = '%{SQL-User-Name}'" Robert Graham Network Engineer U-Haul International 2727 N. Central Ave Phoenix, AZ 85004

4 4

Accounting response with attributes
by Chandan Kumar 14 Jan '15

14 Jan '15

Hello All, I am using FreeRADIUS Version 3.0.4 on Linux (CentOS 6). I have a question regarding how can I force radius server to add all attribute information into accounting response message. The accounting section of my site-available/default if as below. accounting { detail unix -sql exec } I have customized the pam_radius_auth.so module to send Accounting request messages to include more attributes such as Acct-Terminate-Cause,Acct-Link-Count,Acc-authentic etc and expecting response from server with attribute [with reason code] at the end of the accounting [at the STOP message]. However, in all cases I am only getting response message with code,identifier,length=20 and response-authenticator. I am wondering is there any configuration parameter that I missing or it is not supported at all in this version of FreeRADIUS as RFC does not make it mandatory. Quoting RFC "A RADIUS Accounting-Response is not required to have any attributes in it." Thanks Chandan

3 10

EAP-TLS - TLS 1.0 Alert [length 0002], fatal internal_error
by PENZ Robert 14 Jan '15

14 Jan '15

Hi! We're running openssl-1.0.1e-30.el6_6.4.x86_64 and freeradius-2.1.12-6.el6.x86_64 on a RHEL6. We're using EAP-TLS with Windows clients and IP phones with no problems. Now we want to add MFD systems from Canon also as clients and we get following openssl error, while running free radius in debug mode. The error happens already on the second packet the radius server gets from the MFD. First Packet: Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=212, length=143 User-Name = "jwf68365.mfp.tirol.local" EAP-Message = 0x0212001d016a776636383336352e6d66702e7469726f6c2e6c6f63616c NAS-IP-Address = 10.15.132.2 Service-Type = Login-User Calling-Station-Id = "F4-81-39-C8-00-CE" NAS-Port-Id = "1:3" NAS-Port = 1003 NAS-Port-Type = Ethernet Message-Authenticator = 0x46be9f4cbce0fb5c68c67280b8ff5784 .... Tue Jan 13 16:19:31 2015 : Info: [eap] EAP Identity Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls Tue Jan 13 16:19:31 2015 : Info: [tls] Requiring client certificate Tue Jan 13 16:19:31 2015 : Info: [tls] Initiate Tue Jan 13 16:19:31 2015 : Info: [tls] Start returned 1 .... Sending Access-Challenge of id 212 to 10.15.132.2 port 39460 EAP-Message = 0x011300060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xea9fd73aea8cdaa07914c31bfc979134 Second Packet: Tue Jan 13 16:19:31 2015 : Debug: Going to the next request Tue Jan 13 16:19:31 2015 : Debug: Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.15.132.2 port 39460, id=213, length=239 User-Name = "jwf68365.mfp.tirol.local" EAP-Message = 0x0213006b0d8000000061160301005c01000058030154b537821306fa9c57603eb40ab2f22a9b3cdcc496fa91589413aa835503a4d400001e002f0035000400050009000a00030008c013c014c009c00a00330039001601000011000a00080006001700180019000b000100 NAS-IP-Address = 10.15.132.2 Service-Type = Login-User Calling-Station-Id = "F4-81-39-C8-00-CE" NAS-Port-Id = "1:3" NAS-Port = 1003 NAS-Port-Type = Ethernet State = 0xea9fd73aea8cdaa07914c31bfc979134 Message-Authenticator = 0x2482cae69f6e75122c8a7fd7bbbf72a2 ....... Tue Jan 13 16:19:31 2015 : Info: [eap] EAP packet type response id 19 length 107 Tue Jan 13 16:19:31 2015 : Info: [eap] No EAP Start, assuming it's an on-going EAP conversation Tue Jan 13 16:19:31 2015 : Info: +++[eap] returns updated Tue Jan 13 16:19:31 2015 : Info: ++- else else returns updated Tue Jan 13 16:19:31 2015 : Info: Found Auth-Type = EAP Tue Jan 13 16:19:31 2015 : Info: # Executing group from file /etc/raddb//sites-enabled/default Tue Jan 13 16:19:31 2015 : Info: +- entering group EAP {...} Tue Jan 13 16:19:31 2015 : Info: [eap] Request found, released from the list Tue Jan 13 16:19:31 2015 : Info: [eap] EAP/tls Tue Jan 13 16:19:31 2015 : Info: [eap] processing type tls Tue Jan 13 16:19:31 2015 : Info: [tls] Authenticate Tue Jan 13 16:19:31 2015 : Info: [tls] processing EAP-TLS Tue Jan 13 16:19:31 2015 : Debug: TLS Length 97 Tue Jan 13 16:19:31 2015 : Info: [tls] Length Included Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_verify returned 11 Tue Jan 13 16:19:31 2015 : Info: [tls] (other): before/accept initialization Tue Jan 13 16:19:31 2015 : Info: [tls] TLS_accept: before/accept initialization Tue Jan 13 16:19:31 2015 : Info: [tls] <<< TLS 1.0 Handshake [length 005c], ClientHello Tue Jan 13 16:19:31 2015 : Info: [tls] >>> TLS 1.0 Alert [length 0002], fatal internal_error Tue Jan 13 16:19:31 2015 : Error: TLS Alert write:fatal:internal error Tue Jan 13 16:19:31 2015 : Error: TLS_accept: error in SSLv3 read client hello C Tue Jan 13 16:19:31 2015 : Error: rlm_eap: SSL error error:1408A0E3:SSL routines:SSL3_GET_CLIENT_HELLO:parse tlsext Tue Jan 13 16:19:31 2015 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Jan 13 16:19:31 2015 : Debug: TLS receive handshake failed during operation Tue Jan 13 16:19:31 2015 : Info: [tls] eaptls_process returned 4 Tue Jan 13 16:19:31 2015 : Info: [eap] Handler failed in EAP/tls Tue Jan 13 16:19:31 2015 : Info: [eap] Failed in EAP select .... Sending Access-Reject of id 213 to 10.15.132.2 port 39460 EAP-Message = 0x04130004 Message-Authenticator = 0x00000000000000000000000000000000 Regards, Robert Penz

3 3

Freeradius + Cisco WLC + Authorisation
by mail＠moult.com.au 14 Jan '15

14 Jan '15

Hi there, Hoping someone might be able to help, with what should be a simple problem.. I have a Cisco vWLC that is set up to autheticate against a freeradius server.. At this stage I am just wanting to use it to authenticate & authorise administrative users, so that they can use the GUI.. The users can succesfully log on, however they are not getting the correct authorisation.. What settings to I need to include in /etc/raddb/users to allow the correct Authorisation level? I am guessing it is some sort of "cisco-avpair = ???" command.. just not sure which one.. Any help is greatly appreciated!! Thanks!

2 1

Help with Cisco-AVPairs
by Arran Cudbard-Bell 14 Jan '15

14 Jan '15

Changes in master mean that we can now represent them in the Cisco vendor dictionary, and convert all Cisco-AVPair attributes to internal, correctly typed ones. This makes proper comparisons, and access much easier. So if anyone has a complete or semi-complete list of all the Cisco-AVPair attributes please send them over so the Cisco dictionary can be updated. Next step is to modify foreach to work correctly, providing references to actual attributes, instead of stringifying them. This will allow automatic re-encoding of attributes for proxying and replies. Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2

5 4

3.0.6 rlm_eap_gtc: Unknown Auth-Type perl
by Nick Rogers 13 Jan '15

13 Jan '15

Hello, In previous freeradius 2.2.x versions, I've been able to change the Auth-Type to perl within the gtc module. For example... eap { default_eap_type = peap timer_expire = 60 ignore_unknown_eap_types = no gtc { challenge = "Password: " auth_type = perl } This allowed rlm_eap_gtc to pass the password to rlm_perl via the User-Password attribute. Now when trying to upgrade to 3.0.x, it seems that an auth_type of perl is no longer allowed. I am wondering if this is a bug or intentional change? Should I be changing Auth-Type within eap_gtc via some other means? For example... gtc { challenge = "Password: " auth_type = perl update control { Auth-Type := Perl } } Thank you. -Nick

2 3

Re: Question about radcheck sql!
by Haviaras Kostas 13 Jan '15

13 Jan '15

Thanks for your response! I will consider it!

5 16

Can radius send COA notification to host/process and port other than the one that caused the change in one of the entries (radius is using mysql)
by Sourabh Pandit 13 Jan '15

13 Jan '15

Good morning all, I am a beginner user of freeradius so please bear with me if my question is too basic, but please do point me in the right direction. I am using freeradius 2.1.12. For this example consider the following scenario Radius 1. radius server is running on IP 192.168.48.76. 2. radius is using mysql for authentication. 3. A user UserA is in the blocked list when we begin. 4. Process Proc1 is running on 192.168.48.54 5. Process Proc2 is running on 192.168.48.59, listening on port 20000 6. Proc1 and Proc2 do not know about each other at all. I mean they do not even know if another process even exists. I would appreciate if some one could tell me the following. 1. If process Proc1 wants to remove the UserA form the blocked list by sending a request to the radius server. 1. Can the radius server generate a COA message that goes to Proc2 on port 2000 and not to the Proc1? 2. Is radclient the vehicle to be used by Proc1 to initiate the change in the user group for User A in this case? 2. If the above is not possible, let's say the process Proc1 removes the user UserA from the blocked list by manipulating the sql table directly. 1. Can the radius server generate a COA message that goes to Proc2 on port 2000 and not to the Proc1? If it is possible, please point me in the right direction. Thanks SP

2 1

Using FreeRadius as a relay for when external (Cloud) Radius servers go down?
by John Doe 13 Jan '15

13 Jan '15

Hi List! I am new to FreeRadius and am wondering: 1) If it is possible to set up FreeRadius as a relay for my external Radius service? 2) Is it possible to use this FreeRadius-server as a fallback when the external service goes down? 3) That would be a good start reading into how to set this up? I have seen "radrelay"[1], but this seems to be old. All help is greatly appreciated, Thanks, KL [1] http://linux.die.net/man/5/radrelay.conf

3 3

Fwd: 3.0.6 rlm_eap_gtc: Unknown Auth-Type perl
by Stefan Paetow 12 Jan '15

12 Jan '15

> On 12 Jan 2015, at 17:34, Nick Rogers <ncrogers(a)gmail.com> wrote: >> challenge = "Password: " >> auth_type = perl > > Change the auth_type to pap. Then in the authenticate section, modify the Auth-Type PAP { } stanza to call rlm_perl instead of pap. > > That will however also mean that EAP-TTLS/PAP and PAP itself will use the perl authenticator too. Stefan Paetow Moonshot Industry & Research Liaison Coordinator t: +44 (0)1235 822 125 gpg: 0x3FCE5142 xmpp: stefanp(a)jabber.dev.ja.net skype: stefan.paetow.janet Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG jisc.ac.uk Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under Company No. 5747339, VAT No. GB 197 0632 86. Jisc’s registered office is: One Castlepark, Tower Hill, Bristol, BS2 0JA. T 0203 697 5800. Jisc Collections and Janet Ltd. is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under Company No. number 2881024, VAT No. GB 197 0632 86. The registered office is: Lumen House, Library Avenue, Harwell, Didcot, Oxfordshire, OX11 0SG. T 01235 822200.

1 0