- Freeradius-Users - lists.freeradius.org

Stale sessions and mac auth problem
by Peter 13 Dec '13

13 Dec '13

Hi I'm using Coova and Freeradius and I have the entry below to clear stale sessions when a user logs in. I'm using freeradius version 2.1.10 and I got the code below from a previous email in this list. if(User-Name){ if("%{sql:UPDATE radacct set AcctStopTime=ADDDATE(AcctStartTime,INTERVAL AcctSessionTime SECOND), AcctTerminateCause='Clear-Stale Session' WHERE UserName='%{User-Name}' and CallingStationId='%{Calling-Station-Id}' and AcctStopTime is NULL}"){ reject } } The code above works perfectly for normal users signing in by clearing the stale session on the first attempt and the user tries again and can log in. My problem is when it's a mac auth request Coova sends the request at least twice. This causes the device to log in on the first request and then out on the second request. So how could I change the empty if statement "if(User-Name)" to only run this if the the username is not a mac address "if(User-Name != macaddress)"

2 1

LDAP no group
by Jean Carlos Coelho 13 Dec '13

13 Dec '13

Hi! Simple question, my client has configured the ldap database with no ou=groups, only with ou=people and all the users have some different object classes, some “students” and some “teachers”, the ldap database does not have the posixgroup or memberUid… my ldap configuration for search “group” is: groupname_attribute = ou groupmembership_filter = "(&(dc=domain,dc=org)(uid=%u))” I have tried many other options above.. :( This is some user example: Group? dn: ou=students,dc=domain,dc=org ou: students objectClass: organizationalUnit objectClass: top dn: ou=teachers,dc=domain,dc=org ou: teachers objectClass: organizationalUnit objectClass: top dn: ou=employees,dc=domain,dc=org ou: employees objectClass: organizationalUnit objectClass: top ——— User dn: uid=19221422470,ou=student,dc=ufsm,dc=br userPassword:: DDDDDDDDDDDDDDDDDD mail: fab(a)cpd.domain.org eduPersonPrincipalName: OJLADOIA-CXQLBAAA(a)domain.org uid: 19221422470 objectClass: person objectClass: inetOrgPerson objectClass: eduPerson objectClass: sambaSamAccount objectClass: brPerson sambaNTPassword: DDDDDDDDDDDDDDDDDD sambaLMPassword: DDDDDDDDDDDDDDDDDD cn: Student Name sn: Student Last Name sambaSID: 19221422470 dn: brEduAffiliation=1,uid=19221422470,ou=students,dc=domain,dc=org objectClass: brEduPerson brEduAffiliation: 1 brEntranceDate: 20120503 brEduAffiliationType: student ————————— Radius debug output (USER OK.. But can’t search “groups”)… radtest 42833582820 teste2013 200.132.39.49:1812 100 123456789 Sending Access-Request of id 124 to 200.132.39.49 port 1812 User-Name = "42833582820" User-Password = "teste2013" NAS-IP-Address = 200.132.39.49 NAS-Port = 100 Message-Authenticator = 0x00000000000000000000000000000000 rad_recv: Access-Accept packet from host 200.132.39.49 port 1812, id=124, length=20 # Executing section post-auth from file /etc/freeradius/sites-enabled/domain-ldap +- entering group post-auth {...} ++? if (LDAP-Group == “teachers") [ldap] Entering ldap_groupcmp() expand: dc=domain,dc=org -> dc=domain,dc=org expand: (&(dc=domain,dc=org)(uid=%u)) -> (&(dc=domain,dc=org)(uid=42833582820)) [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=domain,dc=org, with filter (&(ou=teachers)(&(dc=domain,dc=org)(uid=42833582820))) [ldap] object not found [ldap] ldap_release_conn: Release Id: 0 rlm_ldap::ldap_groupcmp: Group teachers not found or user is not a member. ? Evaluating (LDAP-Group == “teachers") -> FALSE ++? if (LDAP-Group == “teachers") -> FALSE } # server ldap So.. I don’t have a group, I have different object classes for separate users, is there some way to collect these informations from brEduAffiliationType with rlm_ldap group options? Or I will have to create groups and add users to these groups and populate the memberUid object for (I know) it work.. Thanks Atenciosamente, Jean Carlos Coelho Analista de Soluções Teltec Solutions Fone: 48 3031.3450 | DDR: 467 | Cel: 48 9179.6013 [http://suporte.teltecnetworks.com.br/images/Assinaturas/figura.jpg]<http://www.teltecsolutions.com.br/site2009/downloads/sign.html>

2 1

3.0 and 2.x parallel?
by JB 12 Dec '13

12 Dec '13

Hi! We would like to start testing 3.0 but don't want to replace our 2.x testing environment just yet. Before we botch up our installation we wanted to make sure if ".configure --prefix=/my/dir" suffices to completely isolate the 3.0 installation. Thanks! JB

5 6

PEAP 2nd phase none
by Maxim Shoustin 12 Dec '13

12 Dec '13

Hello, I use FreeRadius 2.2.0 I wonder if FreeRadius supports PEAP option without 2nd phase of authentication. Today as I know it has PEAP MSCHAPV2. However Android (Samsung 4) has option: EAP method: PEAP Phase 2 authentication: NONE Thank you and best regards, Maxim

2 1

EAP session didn't finish
by Kiril 12 Dec '13

12 Dec '13

Hello everyone our company is now challanging the problem in EAP PEAP when the connection between AP(wireless access point) and radius server is not established successfully in log we can see messages "EAP session for state 0x2d139b202f108299 did not finish!" ssl certs are generated during freeradius install, so the problem can't be in ssl who can tell in which case this message is shown? rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=159, length=199 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200001101353930303036343731363034 Message-Authenticator = 0x6064f207250243546f15c6bcf058e6cb Sending Access-Challenge of id 159 to 198.18.15.246 port 38170 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202d128299b748d2a13b260fd9 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=160, length=366 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020100a619800000009c1603010097010000930301528a15baac18e359da7efd7e5b0e1a36e8271123dc1741acebedfa98d2afbf8e00005800ffc024c023c00ac009c007c008c028c027c014c013c011c012c026c025c02ac029c004c005c002c003c00ec00fc00cc00d003d003c002f000500040035000a0067006b003300390016c006c010c001c00b003b0002000101000012000a00080006001700180019000b00020100 State = 0x2d139b202d128299b748d2a13b260fd9 Message-Authenticator = 0x9de35b4157dfe50a6450888ddeccb382 Sending Access-Challenge of id 160 to 198.18.15.246 port 38170 EAP-Message = 0x0102040019c0000013a216030100510200004d0301528a15bdaaa9e4e3170cce6a6c4ea14e2e03d0d1c7d4766f0dab8a0527d43e5e20970e12153ebebbc297638882aa00fd1f8b29251ba4f07a1aa3be72ed4bf2dd4f002f000005ff01000100160301133e0b00133a0013370005133082050f308203f7a0030201020210037b883b5ca7464ea5c48efb9f2cbbd2300d06092a864886f70d01010505003072310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564311830160603 EAP-Message = 0x550403130f457373656e7469616c53534c204341301e170d3133303932303030303030305a170d3133313231393233353935395a304e3121301f060355040b1318446f6d61696e20436f6e74726f6c2056616c6964617465643111300f060355040b1308467265652053534c311630140603550403130d776966692e646f6d72752e727530820122300d06092a864886f70d01010105000382010f003082010a0282010100c3002da01fce9e01e41edba766d47c1863d3610580ef7ec526847964d98f22892dfe933ce6bbc102834db59891dd64c3f2634528e00b311f492fbe836e3720df5dc3b3cebf9a09b0f9cb3444c75b99d7f9cbc0848e832309 EAP-Message = 0x0fd38bf14887505e674b004ae128375e6851e13397e84545d97ae8639cdc1b1ba69b461a128fef87fc0c784e0113793f3e9dff70d53700445c15f172a55003d4b8aa74ef9638e2500f540f7e286338d2f5462ef10d897776aed52ccf33c64826e46a5a64af3468de6b30bb22082ed5622e0a9b8c11175a36cdcad33942626b4fbe38c0514e243aa315f861100fb2fef361e89f89954cd5a732d95fc20e7e681362f9c4e290b165450203010001a38201c3308201bf301f0603551d23041830168014dacbeaad5b085dccfffc2654ce49e555c638f4f8301d0603551d0e0416041403d3fe4507eb155117eb12dad0992c4da36eacbe300e0603551d0f01 EAP-Message = 0x01ff0404030205a0300c0603551d130101ff0402300030340603551d25042d302b06082b0601050507030106082b06010505070302060a2b0601040182370a030306096086480186f8420401304f0603551d2004483046303a060b2b06010401b23101020207302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f4350533008060667810c010201303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f457373656e7469616c53534c43412e63726c306e06082b0601050507010104623060303806082b06010505073002862c687474703a EAP-Message = 0x2f2f6372742e636f6d6f646f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202c118299b748d2a13b260fd9 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=161, length=206 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020200061900 State = 0x2d139b202c118299b748d2a13b260fd9 Message-Authenticator = 0x54d34556c8cef6db245dbb45ea6d600e Sending Access-Challenge of id 161 to 198.18.15.246 port 38170 EAP-Message = 0x010303fc194063612e636f6d2f457373656e7469616c53534c43415f322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302b0603551d1104243022820d776966692e646f6d72752e727582117777772e776966692e646f6d72752e7275300d06092a864886f70d010105050003820101005276556d9ed745c3e02ababc09696109c199d6261339c4d3b63007e41cbe6002214125ed4d25808d5acc5a22548ae2cd15e7863e359e18a7e6cbb514f5260e6a890558f7bbe12e7fe202b3c4009834df873a836ec0bf22592c8a759fb82ebbdfcb86c14cdf50f074a70f387e089efe1eea93fd9309 EAP-Message = 0xe4c49c3fabe9824800a244ac9de49865c1ee3cb6b92063c3949c771c7cfb3cd0bc8e2a0657777c12d77ea3217f0ff247982fd9e98ac36a6325c39c937afcdb42a288e72d6233cf7fec6a2cf633547d975eb7ba72683c1ed30a0a470068d3bf7d1c413c7762ffedeab0171cb1529bde594f924fd046bc8ac1d42dba9a3a8e61d99ca7c59bbb77b92ef02cc300050730820503308203eba003020102021018b2cbbaa304f1a00fc1f2f326462a4a300d06092a864886f70d0101050500308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a EAP-Message = 0x3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f72697479301e170d3036313230313030303030305a170d3139313233313233353935395a3072310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564311830160603550403130f457373656e7469616c53534c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100adf008b072 EAP-Message = 0xc6ab83123117708985a92012d4986aed80d4d1dfe48e592dd396218d76d23f180b4619630bc720f3e50bdd801af15aa0bd1d76cdb7233a745e611b75aa9bd485f4e17891d32de1affc982e06d2793d5ac01f212d1cae2153c63aa7217ebeed676f751d1a9f6a5b06b36ae3b10baa6a0ee76d6cc3ca958c37ce211f35907ddbda1a5ca88814b20fc812205fc5d37fe8e138e0dbbcf91fa1aad61b900721fa4524505d272aa02841455b7dbca0a22faa9b7e5b53c5f10516577e11d73bb4d90176dcdf7d10cf51a9e538f27b14007559f9f059db173ef7afe6022da479c15da21cc39ac8a7a80b480a6a2e7f2d9765f6c5049c44c899967e7ea4dd2f0203 EAP-Message = 0x010001a382018330 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202f108299b748d2a13b260fd9 Waking up in 0.9 seconds. Waking up in 3.9 seconds. WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2d139b202f108299 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

2 1

Version 2.2.3 has been released
by Alan DeKok 11 Dec '13

11 Dec '13

We've just released version 2.2.3. This release fixes all known problems in the 2.2.x release series. Alan DeKok. ChangeLog: Feature improvements * Added dictionary.efficientip, dictionary.alcatel-lucent-aaa * Allow zero length DN strings in rlm_ldap. * If Password-With-Header has no header, assume it is Cleartext-Password. Bug fixes * Make the server build when DHCP is enabled * Don't crash if there's no Post-Proxy-Type Reject. * Use correct fields for X509 attributes in certificates * Install threads.h making it possible to link against the installed headers again. * Initialize SSL once in "main", instead of rlm_eap_tls. Some client libraries may need SSL.

1 0

cisco device enable authentication via radius/ldap
by Les Stott 10 Dec '13

10 Dec '13

Hi, I have a Freeradius Server in front of a FreeIPA backend configured to do LDAP Authentication via group. This works fine. I can login to my cisco switch as an ordinary user (who belongs to an ldap group cisco_admins) in user exec mode. Users in this group are assigned privilege level 15. /etc/raddb/users DEFAULT Ldap-Group == "cn=cisco_admins,cn=groups,cn=accounts,dc=mydomain,dc=com" Reply-Message="You have been authenticated", Auth-Type := System, Service-Type = "NAS-Prompt-User", Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = No I figured out that I'd need to rewrite $enab15$ to have enable passwords authenticated via ldap also. This is working fine too. /etc/raddb/modules/attr_rewrite # Rewrite Usernames for enable mode on Cisco attr_rewrite rewriteenablemodeuser { attribute = User-Name searchin = packet searchfor = ".enab15." replacewith = "admin" append = no However this means that, for this configuration, I need to use the "admin" user password in ldap to enter enable mode. While I can authenticate as admin to access enable mode I was hoping for a way to be able to authenticate via an ordinary user for enable mode. i.e. normal user uses the same password for user mode and enable mode. Is there a way that the attr_rewrite can be something like... Repalcewith = "current_id_of_user" Or is there another way? Thanks, Les

1 1

how to change the radius default "testing123" password
by Clint Petty 10 Dec '13

10 Dec '13

I changed all instances of the password "testing123", to a random password on both the StrongSwan server and the Radius server, and restarted the strongswan and radiusd services. However, this broke the connection to authenticate to the LDAP server, so I had to put it back to "testing123" to get it to work again. How can I change the radius default "testing123" password? Is there a command I need to run to do this? Thanks for any help with this.

8 29

freeradius like proxy radius
by JEAN-JACQUES SIQUET 09 Dec '13

09 Dec '13

3 3

sqlippool duplicated IP assignments
by Antonio Modesto Amaral Sousa 09 Dec '13

09 Dec '13

Hi everyone, I'm using freeradius-2.1.12_1 with MySQL 5.1 and sqlippool configured to assign IP's to my PPPoE clients, I redistribute these routes with iBGP, until yesterday it was working fine, the problem started after a blackout that happened last night. I have a lot of clients that are being assigned duplicated IP addresses and I just don't know why, I've configured a long lease time for each assignment so that the NAS has a good time frame to transmit the interim updates, my radippool table is using the engine InnoDB and I think the select lock should be working fine. Any suggestions?

3 3