- Freeradius-Users - lists.freeradius.org

12 Dec '13

Hi! We would like to start testing 3.0 but don't want to replace our 2.x testing environment just yet. Before we botch up our installation we wanted to make sure if ".configure --prefix=/my/dir" suffices to completely isolate the 3.0 installation. Thanks! JB

5 6

PEAP 2nd phase none
by Maxim Shoustin 12 Dec '13

12 Dec '13

Hello, I use FreeRadius 2.2.0 I wonder if FreeRadius supports PEAP option without 2nd phase of authentication. Today as I know it has PEAP MSCHAPV2. However Android (Samsung 4) has option: EAP method: PEAP Phase 2 authentication: NONE Thank you and best regards, Maxim

2 1

EAP session didn't finish
by Kiril 12 Dec '13

12 Dec '13

Hello everyone our company is now challanging the problem in EAP PEAP when the connection between AP(wireless access point) and radius server is not established successfully in log we can see messages "EAP session for state 0x2d139b202f108299 did not finish!" ssl certs are generated during freeradius install, so the problem can't be in ssl who can tell in which case this message is shown? rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=159, length=199 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x0200001101353930303036343731363034 Message-Authenticator = 0x6064f207250243546f15c6bcf058e6cb Sending Access-Challenge of id 159 to 198.18.15.246 port 38170 EAP-Message = 0x010100061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202d128299b748d2a13b260fd9 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=160, length=366 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020100a619800000009c1603010097010000930301528a15baac18e359da7efd7e5b0e1a36e8271123dc1741acebedfa98d2afbf8e00005800ffc024c023c00ac009c007c008c028c027c014c013c011c012c026c025c02ac029c004c005c002c003c00ec00fc00cc00d003d003c002f000500040035000a0067006b003300390016c006c010c001c00b003b0002000101000012000a00080006001700180019000b00020100 State = 0x2d139b202d128299b748d2a13b260fd9 Message-Authenticator = 0x9de35b4157dfe50a6450888ddeccb382 Sending Access-Challenge of id 160 to 198.18.15.246 port 38170 EAP-Message = 0x0102040019c0000013a216030100510200004d0301528a15bdaaa9e4e3170cce6a6c4ea14e2e03d0d1c7d4766f0dab8a0527d43e5e20970e12153ebebbc297638882aa00fd1f8b29251ba4f07a1aa3be72ed4bf2dd4f002f000005ff01000100160301133e0b00133a0013370005133082050f308203f7a0030201020210037b883b5ca7464ea5c48efb9f2cbbd2300d06092a864886f70d01010505003072310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564311830160603 EAP-Message = 0x550403130f457373656e7469616c53534c204341301e170d3133303932303030303030305a170d3133313231393233353935395a304e3121301f060355040b1318446f6d61696e20436f6e74726f6c2056616c6964617465643111300f060355040b1308467265652053534c311630140603550403130d776966692e646f6d72752e727530820122300d06092a864886f70d01010105000382010f003082010a0282010100c3002da01fce9e01e41edba766d47c1863d3610580ef7ec526847964d98f22892dfe933ce6bbc102834db59891dd64c3f2634528e00b311f492fbe836e3720df5dc3b3cebf9a09b0f9cb3444c75b99d7f9cbc0848e832309 EAP-Message = 0x0fd38bf14887505e674b004ae128375e6851e13397e84545d97ae8639cdc1b1ba69b461a128fef87fc0c784e0113793f3e9dff70d53700445c15f172a55003d4b8aa74ef9638e2500f540f7e286338d2f5462ef10d897776aed52ccf33c64826e46a5a64af3468de6b30bb22082ed5622e0a9b8c11175a36cdcad33942626b4fbe38c0514e243aa315f861100fb2fef361e89f89954cd5a732d95fc20e7e681362f9c4e290b165450203010001a38201c3308201bf301f0603551d23041830168014dacbeaad5b085dccfffc2654ce49e555c638f4f8301d0603551d0e0416041403d3fe4507eb155117eb12dad0992c4da36eacbe300e0603551d0f01 EAP-Message = 0x01ff0404030205a0300c0603551d130101ff0402300030340603551d25042d302b06082b0601050507030106082b06010505070302060a2b0601040182370a030306096086480186f8420401304f0603551d2004483046303a060b2b06010401b23101020207302b302906082b06010505070201161d68747470733a2f2f7365637572652e636f6d6f646f2e636f6d2f4350533008060667810c010201303b0603551d1f043430323030a02ea02c862a687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f457373656e7469616c53534c43412e63726c306e06082b0601050507010104623060303806082b06010505073002862c687474703a EAP-Message = 0x2f2f6372742e636f6d6f646f Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202c118299b748d2a13b260fd9 Waking up in 0.9 seconds. rad_recv: Access-Request packet from host 198.18.15.246 port 38170, id=161, length=206 User-Name = "590006471604" NAS-IP-Address = 198.18.15.246 NAS-Identifier = "AP01-EXPLAB-5FLOOR-521" NAS-Port = 0 Called-Station-Id = "00-01-7A-F7-96-18:TESTING DOM.RU AUTO" Calling-Station-Id = "2C-B4-3A-E5-95-EE" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 0Mbps 802.11" EAP-Message = 0x020200061900 State = 0x2d139b202c118299b748d2a13b260fd9 Message-Authenticator = 0x54d34556c8cef6db245dbb45ea6d600e Sending Access-Challenge of id 161 to 198.18.15.246 port 38170 EAP-Message = 0x010303fc194063612e636f6d2f457373656e7469616c53534c43415f322e637274302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d302b0603551d1104243022820d776966692e646f6d72752e727582117777772e776966692e646f6d72752e7275300d06092a864886f70d010105050003820101005276556d9ed745c3e02ababc09696109c199d6261339c4d3b63007e41cbe6002214125ed4d25808d5acc5a22548ae2cd15e7863e359e18a7e6cbb514f5260e6a890558f7bbe12e7fe202b3c4009834df873a836ec0bf22592c8a759fb82ebbdfcb86c14cdf50f074a70f387e089efe1eea93fd9309 EAP-Message = 0xe4c49c3fabe9824800a244ac9de49865c1ee3cb6b92063c3949c771c7cfb3cd0bc8e2a0657777c12d77ea3217f0ff247982fd9e98ac36a6325c39c937afcdb42a288e72d6233cf7fec6a2cf633547d975eb7ba72683c1ed30a0a470068d3bf7d1c413c7762ffedeab0171cb1529bde594f924fd046bc8ac1d42dba9a3a8e61d99ca7c59bbb77b92ef02cc300050730820503308203eba003020102021018b2cbbaa304f1a00fc1f2f326462a4a300d06092a864886f70d0101050500308181310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a EAP-Message = 0x3018060355040a1311434f4d4f444f204341204c696d69746564312730250603550403131e434f4d4f444f2043657274696669636174696f6e20417574686f72697479301e170d3036313230313030303030305a170d3139313233313233353935395a3072310b3009060355040613024742311b30190603550408131247726561746572204d616e636865737465723110300e0603550407130753616c666f7264311a3018060355040a1311434f4d4f444f204341204c696d69746564311830160603550403130f457373656e7469616c53534c20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100adf008b072 EAP-Message = 0xc6ab83123117708985a92012d4986aed80d4d1dfe48e592dd396218d76d23f180b4619630bc720f3e50bdd801af15aa0bd1d76cdb7233a745e611b75aa9bd485f4e17891d32de1affc982e06d2793d5ac01f212d1cae2153c63aa7217ebeed676f751d1a9f6a5b06b36ae3b10baa6a0ee76d6cc3ca958c37ce211f35907ddbda1a5ca88814b20fc812205fc5d37fe8e138e0dbbcf91fa1aad61b900721fa4524505d272aa02841455b7dbca0a22faa9b7e5b53c5f10516577e11d73bb4d90176dcdf7d10cf51a9e538f27b14007559f9f059db173ef7afe6022da479c15da21cc39ac8a7a80b480a6a2e7f2d9765f6c5049c44c899967e7ea4dd2f0203 EAP-Message = 0x010001a382018330 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x2d139b202f108299b748d2a13b260fd9 Waking up in 0.9 seconds. Waking up in 3.9 seconds. WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! WARNING: !! EAP session for state 0x2d139b202f108299 did not finish! WARNING: !! Please read http://wiki.freeradius.org/Certificate_Compatibility WARNING: !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

2 1

Version 2.2.3 has been released
by Alan DeKok 11 Dec '13

11 Dec '13

We've just released version 2.2.3. This release fixes all known problems in the 2.2.x release series. Alan DeKok. ChangeLog: Feature improvements * Added dictionary.efficientip, dictionary.alcatel-lucent-aaa * Allow zero length DN strings in rlm_ldap. * If Password-With-Header has no header, assume it is Cleartext-Password. Bug fixes * Make the server build when DHCP is enabled * Don't crash if there's no Post-Proxy-Type Reject. * Use correct fields for X509 attributes in certificates * Install threads.h making it possible to link against the installed headers again. * Initialize SSL once in "main", instead of rlm_eap_tls. Some client libraries may need SSL.

1 0

cisco device enable authentication via radius/ldap
by Les Stott 10 Dec '13

10 Dec '13

Hi, I have a Freeradius Server in front of a FreeIPA backend configured to do LDAP Authentication via group. This works fine. I can login to my cisco switch as an ordinary user (who belongs to an ldap group cisco_admins) in user exec mode. Users in this group are assigned privilege level 15. /etc/raddb/users DEFAULT Ldap-Group == "cn=cisco_admins,cn=groups,cn=accounts,dc=mydomain,dc=com" Reply-Message="You have been authenticated", Auth-Type := System, Service-Type = "NAS-Prompt-User", Cisco-AVPair = "shell:priv-lvl=15", Fall-Through = No I figured out that I'd need to rewrite $enab15$ to have enable passwords authenticated via ldap also. This is working fine too. /etc/raddb/modules/attr_rewrite # Rewrite Usernames for enable mode on Cisco attr_rewrite rewriteenablemodeuser { attribute = User-Name searchin = packet searchfor = ".enab15." replacewith = "admin" append = no However this means that, for this configuration, I need to use the "admin" user password in ldap to enter enable mode. While I can authenticate as admin to access enable mode I was hoping for a way to be able to authenticate via an ordinary user for enable mode. i.e. normal user uses the same password for user mode and enable mode. Is there a way that the attr_rewrite can be something like... Repalcewith = "current_id_of_user" Or is there another way? Thanks, Les

1 1

how to change the radius default "testing123" password
by Clint Petty 10 Dec '13

10 Dec '13

I changed all instances of the password "testing123", to a random password on both the StrongSwan server and the Radius server, and restarted the strongswan and radiusd services. However, this broke the connection to authenticate to the LDAP server, so I had to put it back to "testing123" to get it to work again. How can I change the radius default "testing123" password? Is there a command I need to run to do this? Thanks for any help with this.

8 29

freeradius like proxy radius
by JEAN-JACQUES SIQUET 09 Dec '13

09 Dec '13

3 3

sqlippool duplicated IP assignments
by Antonio Modesto Amaral Sousa 09 Dec '13

09 Dec '13

Hi everyone, I'm using freeradius-2.1.12_1 with MySQL 5.1 and sqlippool configured to assign IP's to my PPPoE clients, I redistribute these routes with iBGP, until yesterday it was working fine, the problem started after a blackout that happened last night. I have a lot of clients that are being assigned duplicated IP addresses and I just don't know why, I've configured a long lease time for each assignment so that the NAS has a good time frame to transmit the interim updates, my radippool table is using the engine InnoDB and I think the select lock should be working fine. Any suggestions?

3 3

Combining EAP, MSCHAP and LDAP
by David Hartburn 09 Dec '13

09 Dec '13

Hi, Can anyone help advise if FreeRADIUS is suitable without any other changes to the existing infrastructure at my institution? If so, any advice on the best way to implement would be appreciated. I am looking at options for replacing MS NPS with basically something better that works and is debuggable. FreeRadius looks the best option. Our setup is a little complicated. Wireless users authenticate with EAP type PEAP, the inner authentication being done via MSCHAPv2. At the backend, we have a *nix based LDAP server with a particular attribute set for if a user is permitted to access the wireless network. Passwords are stored in an encrypted format. When a user binds, they can not see the resource attribute saying if they are permitted to use wireless. The LDAP information is pushed into active directory, where a wireless user group is created and populated by those who have the wireless flag set. Currently NPS authenticates against AD and checks this group. My preference would be to leave any windows stuff out of the equation. I followed a couple of online guides and have had FreeRadius successfully authenticate users against AD, however I then found something saying if I wanted to check groups I would have to use LDAP. Following the information in the Dirk van der Walt book, it states that you can bind to LDAP as a user but are limited to PAP authentication or you can read the userPassword attribute which must be plain text if MSCHAP is needed. Neither sounds suitable for what I need. Is it possible for FreeRadius to use EAP, MSCHAP, check a LDAP attribute and an encrypted password? As the password is encrypted and of little use, our LDAP expert suggested that we bind using a system account to check the account exists and has rights for wireless (I have this bit working), then to authenticate a bind is made as the user. Does this sound reasonable? Would binding to the AD server as an LDAP server offer any better avenue? As this is currently a proof-of-concept lab exercise, we do not want to make any changes to our existing infrastructure if possible. If that is required, giving users permission to see their wireless attribute in LDAP seems like the least painful. Sorry for the rambling posts, I'm in the newbie situation of being faced with many paths open to me, and not really knowing the best one to take. Yours DaveH

4 4

diffrent services from same IP
by SkyDiablo 07 Dec '13

07 Dec '13

hi, i have running a freeradius, all works fine... but now, i need to handle two diffrent services from the same IP in diffrent virtual server. in detail: i have a VPN server and one or more coova chilli systeme. all this freeradius clients will running on the same system (localhost) but if i load the client configs, it throws the error "Failed to add duplicate client". of course, all client will have the same IP, all client running under localhost. it is possible to handle this ? diffrent services/clients on the same IP ? greez & thx, volker...

3 3