- Freeradius-Users - lists.freeradius.org

Realms based on called-station-id
by Tim King 25 Jul '14

25 Jul '14

I am trying to direct users on the same nas to different realms based on the called-station-id I have tried the following wtihout success. if ("%{Called-Station-Id}") == "6165551212" { update control{Proxy-To--Realm == myrealm}} Can anyone see what is wrong wtih the syntax in that?

3 2

EAP-TLS and user name
by Sven_Menschner＠drewag.de 25 Jul '14

25 Jul '14

Hi, we have setup a freeradius server for WLAN authentication. We have deployed a PKI to use EAP-TLS and everything runs fine so far. But I am wondering if the user name provided by the supplicant is used by freeradius at all when using this authentication method. I have tested these scenarios: 1. no entry in users file [files] module returns noop supplicant is authenticated via EAP 2. added plain user name to users file [files] module matches user and returns OK supplicant is authenticated via EAP 3. added user name with "Auth-Type := EAP" [files] module returns noop supplicant is authenticated via EAP If I provide a wrong user name in the supplicant configuration (it doesn't match the user name in client certificate), authentication still works. So is it checked at all? If so, does that imply that everyone is able get authenticated as soon as he gets the client certificate, even if he doesn't know the users identity? So some explanation about the relation between EAP-TLS and the user store would be great... Many thanks in advance. Best Regards, Sven Menschner ------------------------------------------------------------------------- DREWAG - Stadtwerke Dresden GmbH Sitz der Gesellschaft: Dresden Geschäftsführer: Reiner Zieschank (Sprecher), Dr. Reinhard Richter Vorsitzende des Aufsichtsrates: Helma Orosz, Oberbürgermeisterin Registergericht: Amtsgericht Dresden HRB 2626 ------------------------------------------------------------------------- DREWAG - das heißt für Sie: sehr guter Service und ein faires Preis-Leistungs-Verhältnis! 2013 wurde die DREWAG wiederholt vom Wirtschaftsmagazin FOCUS-Money als einer der fairsten Stromversorger Deutschlands ausgezeichnet.

3 2

Capturing a failure from EAP
by Franks Andy (RLZ) IT Systems Engineer 25 Jul '14

25 Jul '14

Hi All, Can someone just confirm whether I can override the module codes in the eap auth module? I'm trying Auth-Type eap { eap { reject = 1 invalid = 1 ok = 1 } if (!ok) { update control { Debug-RejectInformation := "%{Module-Failure-Message}" } ok } I know it looks odd, but I'm trying to override the reject packet with an accept but with attributes that force the client into a specific remuneration vlan / policy on the wireless controller. Maybe this is by design. I can override all the other modules ok just not eap. Thanks Andy

3 2

RE: Not rejecting rejected users
by Franks Andy (RLZ) IT Systems Engineer 25 Jul '14

25 Jul '14

Thanks Alan, I am toying with a nasty hacky way of making my own reject control variable, capturing the outputs of each of the modules and forcing them to be ok, then testing for the "reject" at the end and dealing with likewise. The extreme controller we're using allows pushing of roles with built in firewall rules via the filter-id attribute so I'm playing with that too. I'll find out I guess, but the peap thing - we tend to send mac auth alongside, so test whether a machine passes tests with that and push the vlan there. I was hoping I could test the output of the eap auth module and still force it to be ok but we'll see. Thanks again Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of A.L.M.Buxey(a)lboro.ac.uk Sent: 24 July 2014 21:54 To: FreeRadius users mailing list Subject: Re: Not rejecting rejected users Hi, > clients, when the radius sends a reject packet to the NAS, all is well and > the client gets rejected. On wireless however, especially with windows XP > machines, the machine will constantly retry connection to the SSID. whats the cause of the reject? incorrect password? you can use the MSCHAPv2 retry method if its PEAP - the client will geta prompt to reenter their credentials...otherwise the client will just keep on trying and trying and trying.... with wireless 802.1X you cannt reject and give them another vlan like you can with wired (*) the key required for the WPA2enterproise part is done in the access-accept . with wired you have guest/fail vlan options (not with MACSEC though). alan (*) some vendors have really interesting/nasty non-interopt kludges to get their APs to do some 'nasty things' in some cases. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Not rejecting rejected users
by Franks Andy (RLZ) IT Systems Engineer 24 Jul '14

24 Jul '14

Hi all, Possibly a ridiculous question, but I'll try anyway. We have freeradius running for wired and wireless clients. On wired clients, when the radius sends a reject packet to the NAS, all is well and the client gets rejected. On wireless however, especially with windows XP machines, the machine will constantly retry connection to the SSID. We've dealt with this in the past by hiding the SSID and hoping non-authenticated people try not to join it. This breaks the recommendations I believe, and causes certain issues with ipads and so on, so I wanted to do something different - i.e. dish out a dummy vlan or special role to the wireless controller. No problems there in concept, but we were very geared towards accepts and rejects and I now need to, at several points, do something else instead of outright reject the client. Rejects were nice because once auth-type is set to reject, anything else that could alter the auth-type would not be touched, and lots of extraneous processing is avoided. Ideally we'd be able to change the post-auth-type REJECT back into an accept, but that probably isn't going to work. Anyone any ideas? I'm sure this has been done before. I realise we can override the outcome of a specific module but it doesn't stop processing unless I keep checking an internal control variable or the like. Thanks Andy

2 1

sending additional attributes
by Ryan Milton 24 Jul '14

24 Jul '14

I have been asked to modify our existing radius deployment by adding an attribute that would be sent back to the NAS clients in order to improve traffic reporting. We want to be able to Change Interim-Update settings to 1 minutes. My Question is where would that be done? Does that mean simply changing this section: >raddb/attrs # #strictrealm # Reply-Message =* ANY, # Session-Timeout <= 86400, # Idle-Timeout <= 600, # Acct-Interim-Interval >= 300, # Acct-Interim-Interval <= 3600 Or is it more complex requiring an additional column for radreply? Thank you, Ryan

2 3

Regression in FreeRADIUS 3.0.3: unixODBC fails
by Eugene Grosbein 24 Jul '14

24 Jul '14

Hi! I'm trying to upgrade to 3.0.3 from FreeRADIUS 2.2.4 that works just fine here running its DHCP module with my custom Perl code that uses DBI and DBD::ODBC and unixODBC driver manager and freetds library to connect to MS SQL server. Version 2.2.4 works as expected. With 3.0.3 (we performed configuration upgrade) the same custom Perl code starts just fine but then DBI/DBD::ODBC/unixODBC fails to load freetds library with error message: [unixODBC][Driver Manager]Can't open lib '/usr/local/lib/libtdsodbc.so' : Invalid shared object handle 0x80851f7c0 (SQL-01000) Meantime, shell command "dltest /usr/local/lib/libtdsodbc.so" shows: SUCCESS: Loaded /usr/local/lib/libtdsodbc.so The command "dltest" comes from unixODBC-2.3.2 package. Kernel-level syscalls trace of radiusd process shows that, in fact, no attempt to access /usr/local/lib/libtdsodbc.so is made. If I move back to version 2.2.4 not changing perl, DBI, DBD::ODBC, unixODBC or custom perl code, the problem disappears. What direction should I take while debugging the problem? Eugene Grosbein

2 1

EAP-GTC configuration
by Levavi, Yariv 24 Jul '14

24 Jul '14

Hello, We are configuring EAP-GTC in our FreeRADIUS environment (please note that SAS is our authentication server): [cid:image003.png@01CFA747.9F2173C0] [cid:image004.png@01CFA747.9F2173C0] [cid:image006.png@01CFA747.9F2173C0] [cid:image008.png@01CFA747.9F2173C0] [cid:image010.png@01CFA747.9F2173C0] [cid:image012.png@01CFA747.9F2173C0] [cid:image010.png@01CFA747.9F2173C0] [cid:image014.png@01CFA747.9F2173C0] [cid:image016.png@01CFA747.9F2173C0] [cid:image019.png@01CFA747.9F2173C0] [cid:image021.png@01CFA747.9F2173C0] [cid:image023.png@01CFA747.9F2173C0] [cid:image025.png@01CFA747.9F2173C0] [cid:image027.png@01CFA747.9F2173C0] [cid:image029.png@01CFA747.9F2173C0] Our questions are: 1) Do you happen to know how do we obtain the plain password provided in the first Access Response message? Currently we attempt to access the active directory by running an external execution program. This means we need to get the password attribute via freeRadius attributes/environment. If we fail to find a way to get the password information from freeRadius environment then we would consider changing our design by writing a freeRadius code module. 2) The PEAP (which is actually a freeRadius instance) is currently configured is to work to proxy all access requests. This is done by setting the "users" configuration file redirect every incoming access request (DEFAULT FreeRADIUS-Proxied-to == 127.0.0.1, Proxy-to-Realm := DEFAULT). Do you know if there is way to apply redirection upon demand (in our case we would like to handle the first access request locally by verifying the username and password against the AD and redirect only the second access request, containing the user's OTP). 3) The OTP in the second access request is provided as a plain text (over ssl). Is there any way we proxy it to freeRadius agent in a secure way (e.g. MSCHAP2)? 4) Do you have any good references for freeRadius configuration docs? Regards, Yariv Levavi SafeNet's Integration Team The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

2 1

Problem with MySQL connection through load balancer
by Dean Goldhill 24 Jul '14

24 Jul '14

Hello, I am using Freeradius wioth MySQL backend. The SQL connection goes through a load balancer cluster which uses VRRP, furthermore these load balancers firewall the traffic. The problem occurs when the VRRP master goes down, and the other load balancer takes over the VRRP IP address. The problem is that Freeradius stops processing requests and I see erros in the log like: Error: WARNING: Unresponsive thread 7710 for request 0, in component <core> module <queue> Info: WARNING: Child is hung for request 7707 in component <core> module <queue>. I understand that this is not a Freeradius issue, but rather the fact that the VRRP master is now on a different device that does not know about the connection that Freeradius thinks is still established. But instead of trying to create a new connection, Freeradius just continuously drops requests and writes these message to the log. And never recovers. I have left it for up to 15 min, but stays In this state. If I restart radius, it recovers and starts processing as normal. But I don't want to have to do this. I have tried to use the 'lifetime = 120' option in the sql.conf Under normal operation, this will cause radius to close and re-establish the SQL connection every 120 seconds, so I hoped that when in this stuck state, it would do the same and re-establish the connection. But does not. Is there anything someone can suggest? I don't have the ability to sync the session table between the 2 load balancers. Thanks.

3 3

Machine authentications with proxy-inner-tunnel and NPS as backend
by Herwin Weststrate 23 Jul '14

23 Jul '14

This isn't really a problem with FreeRADIUS, but maybe someone else here has ever tried this. A short description of our setup: we're trying to use 802.1X on WLAN, with the access points using FreeRADIUS as backend, authenticating via PEAP. FreeRADIUS is configured to use the proxy-inner-tunnel virtual server for this requests, and uses Active Directory 2012R2 as a RADIUS backend (NPS). With user authentication, this works like a charm once you've changed the policy to accept MSCHAPv2 outside of PEAP too. When trying to use this same setup with a machine authentication, the backend replies that the username or password is incorrect. When we're acting as a normal proxy instead of an inner-tunnel-proxy, it just works without any changes on the client pc. Has anyone ever tried something like this and got the setup working? -- Herwin Weststrate

5 9