- Freeradius-Users - lists.freeradius.org

Question on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device.
by Milton Volz 21 Nov '13

21 Nov '13

Hi, We are looking for help or guidance on what AAA attribute is available in the FreeRadius for responses back to a Cisco HA request for "chap password" & "chap challenge" from a Mobile device. Currently installed: freeradius-server-2.1.12, running on Linux Cent OS 6.4 - x64, Cisco HA 5.3 running on a Cisco SAMI blade in a 7604 Brief Background: Our application is providing a "proxy" alternative Cisco HOME AGENT and DAY PASS service for the Carriers that have subscribers that do not have roaming agreements with the Home Carrier they are attempting to register too, that are currently not served & dropped with no service, today. We have completed live production test with a Tier 2 Carrier and found out from lab testing to live testing that we would not be able to ignore the MN-AAA key and "hotline" the user with a AAA profile using a "local" config with the Cisco as stated in the Cisco HA 5.3 documentation (Typical Cisco document). We now have to use the "remote" capabilities of the Cisco HA for authentication and authorization, versus local Cisco HA config. Question: We now need to use the FreeRadius to manage both the MN-HA and MN-AAA keys and respond back to the Cisco HA properly to complete the device registration back to the Cisco HA. We have used the "3gpp2-mn-ha-shared-key" for the MN-HA attribute and response to the Cisco HA & tested this successfully, but are not able to find or determine what attribute to use for the response back to the Cisco HA for the "chap password" & "chap challenge" for the MN-AAA, which we are receiving from the Cisco HA. We are trying to determine if such an attribute exist and if so, which one will do the trick. I hope this is enough information and understandable in such a short write up. Please let me know if you have any suggestions or can point us in the right direction for the resources to resolve this. Thanks, Milton

3 2

MIgrating ACS to Freeradius
by Zafar Pravaiz 20 Nov '13

20 Nov '13

Dear Community, I am in process to replace our Cisco ACS to Freeradius for our wireless authentication and trying to achieve same functionality as ACS. Here is what i need. 1. It should authenticate against AD. 2. User should be checked in specific group in AD and have specific Called-Station-id ( If Users in AD group == Students and Called-Station-ID== *SSID then Accept-Accept). 3. There is should be multiple policy for various condition match like above. 4. Default should be Reject. 5. All user auth (pass/fail) should be logged in file/syslog with rejection reason. I have achieve only 1st point. Any one has done same ? is it possible in Freeradius? can someone point me to right direction or share config. I will really appreciate the help Thank you -- Zafar Pravaiz Senior Systems Engineer Information Technology Department Tel +971 6 515 2164 Fax +971 6 515 2112 American University of Sharjah PO Box 26666, Sharjah United Arab Emirates http://www.aus.edu zpravaiz(a)aus.edu

2 1

Everything is now fine
by Alan DeKok 20 Nov '13

20 Nov '13

The freeradius.org domain expired, sorry. The registrar hadn't notified me it was going to expire. It's all fixed now. Alan DeKok.

2 1

Cleanup of the "id" between NAS and radius server
by John Douglass 20 Nov '13

20 Nov '13

I have a question about any settings that may effect the timing of the re-use of the "Identifier" as per the RFC: *Identifier * The Identifier field is /one octet/, and aids in matching requests and replies. The RADIUS server can detect a duplicate request if it has the same client source IP address and source UDP port and Identifier within a short span of time. I am currently running radius 2.2.0 and in my radiusd.conf I have: # max_request_time: The maximum time (in seconds) to handle a request. # # Useful range of values: 5 to 120 # max_request_time = 5 # cleanup_delay: The time to wait (in seconds) before cleaning up # a reply which was sent to the NAS. # # The RADIUS request is normally cached internally for a short period # of time, after the reply is sent to the NAS. The reply packet may be # lost in the network, and the NAS will not see it. The NAS will then # re-send the request, and the server will respond quickly with the # cached reply. # # If this value is set too low, then duplicate requests from the NAS # MAY NOT be detected, and will instead be handled as seperate requests. # # If this value is set too high, then the server will cache too many # requests, and some new requests may get blocked. (See 'max_requests'.) # # Useful range of values: 2 to 10 # cleanup_delay = 2 # max_requests: The maximum number of requests which the server keeps # track of. This should be 256 multiplied by the number of clients. # e.g. With 4 clients, this number should be 1024. # # If this number is too low, then when the server becomes busy, # it will not respond to any new requests, until the 'cleanup_delay' # time has passed, and it has removed the old requests. # # If this number is set too high, then the server will use a bit more # memory for no real benefit. # # If you aren't sure what it should be set to, it's better to set it # too high than too low. Setting it to 1000 per client is probably # the highest it should be. # # Useful range of values: 256 to infinity # max_requests = 8500 I have posted my wireshark screen at: http://johnd.oit.gatech.edu/wp-content/uploads/2013/11/wireshark-discarding… When I am looking at my TCPdumps (debugging duplicate requests) I see a duplicate request come in at Frame 6963 Frame 5475 at 10:20:07 - Access-Request id 76 Frame 5482 at 10:20:07 - Access Challenge response to 5475 id 76 Frame 6963 at 10:20:13 - Duplicate Request says response to this request id 76 is in frame 5482 Now, Frame 6963 is a full 5 seconds past the Access-Challenge of Frame 5482. My question is, is it the "cleanup_delay" setting that cleans up old identifiers for re-use? Does the "max_requests" value have any effect on when the identifiers are ready for re-use? Thanks, - John Douglass, Sr. Systems IT/Architect

3 2

checking an atribute in multiple entries of default/outer tunnel
by Rui Ribeiro 19 Nov '13

19 Nov '13

Dears, If I have an outer tunnel like in freeradius 2.2.2 like the following, why should Stripped-User-Name be known in the following interactions that visit the outer tunnel, and the whole if block is executed each time? I think it was supposed to have Stripped-User-Name set on the first entry, and then have it available to the next interactions. Regards, Rui Ribeiro authorize { auth_log if (!(Stripped-User-Name)) { if (!(User-Name =~ /^([^@]*)@(.+)$/)) { update reply { Reply-Message := "malformed username" } reject } else { update request { Stripped-User-Name := "%{1}" Realm := "%{2}" } if (Realm == "MyDomain") { update control { Proxy-To-Realm := LOCAL } } else { update control { Proxy-To-Realm := TO_EDUROAM } } } } eap { ok = return } }

2 1

SQLIppool and multiple NAS IPs
by Victor Rodriguez 19 Nov '13

19 Nov '13

Hello, I'm trying to implement Freeradius v2.1.10 to provide a different IP Pool depending on the IP address of the NAS (Mikrotik PPPoE) the request comes from. I'm using radgroupcheck in this way and it works: '300', 'grp_test', 'Pool-Name', ':=', 'pool_Test' '301', 'grp_test', 'NAS-IP-Address', '==', '192.168.1.1' '302', 'grp_test', 'Simultaneous-Use', ':=', '1' '303', 'grp_test2', 'Pool-Name', ':=', 'pool_Test2' '304', 'grp_test2', 'NAS-IP-Address', '==', '192.168.1.2' '302', 'grp_test2', 'Simultaneous-Use', ':=', '1' (username belongs to both groups) The problem is that I would like to group some NAS and provide the same IP Pool: '310', 'grp_test3', 'Pool-Name', ':=', 'pool_Test2' '311', 'grp_test3', 'NAS-IP-Address', '==', '192.168.1.1' '312', 'grp_test3', 'NAS-IP-Address', '==', '192.168.1.2' '313', 'grp_test3', 'Simultaneous-Use', ':=', '1' This doesn't work, FR doesn't get an IP pool when checking radgroupcheck and so the client doesn't get an IP. Am I missing something? Do I a need to implement huntgroups in SQL? Thanks!

2 1

Freeradius with LDAP on embedded
by petr＠baranov.fi 19 Nov '13

19 Nov '13

Hello, I am configuring freeradius to use openldap-backend for authentication. My setup runs on an embedded system built with Yoctoproject. To test my setup I run radtest from ubuntu image. From the debuggin messages of the FR I can see that LDAP back-end is in use but it always complains about invalid credentials: ... Found Auth-Type = LDAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group LDAP {...} [ldap] login attempt by "john" with password "?=K?)J��???Q$?��" [ldap] user DN: uid=john,ou=People,dc=my-domain,dc=com [ldap] (re)connect to 192.168.122.158:389, authentication 1 [ldap] bind as uid=john,ou=People,dc=my-domain,dc=com/?=K?)J��???Q$?�� to 192.168.122.158:389 [ldap] waiting for bind result ... [ldap] Bind failed with invalid credentials ++[ldap] returns reject ... (Notice, password looks wierd!) I belive that my configurations are correct, because when I setup FR on ubuntu to use LDAP from my embedded image, authentication passes successfully. The password is visible in clear text The FR in ubuntu and in my embedded image are compiled with --enable-developer flag. Can there be some limitation in my embedded environment that causes such behaviour? For example, busybox? Kind Regards, Petr

3 2

EAP Question
by Russell Mike 19 Nov '13

19 Nov '13

Dear List Please forgive me if my question is not good but i tried my best. IEEE 802.1X and EAP The IEEE 802.1X protocol provides access control in OSI Layer 2 (the MAC Layer). IEEE.802.1X supports the authentication of clients while establishing a connection to the network before the client is assigned as IP address via DHCP ( Dynamic Host Configuration Protocol) Among other things. i am using CoovaChilli with FR and i need to authenticate users before ip address & VLAN is assigned. i wish to check if Freeradius EAP would work this way. Thanks / Regards RM--

3 4

FR 3.0.0 / UnixODBC / Segmentation Fault
by Grant Spradling 19 Nov '13

19 Nov '13

I have been running FreeRADIUS 2.x using a custom Microsoft SQL Server database using UnixODBC. I compiled version 3.0.0 on a new server, read the migration documentation, and configured freeTDS and UnixODBC. I verified that UnixODBC was working using the iSQL tool, connecting to the freeradius datasource. I copied mods-available/sql to mods-enabled/sql and configured it as such: sql { driver="rlm_sql_unixodbc" dialect="mssql" server = "freeradius" login = "xxx" password = "xxx" radius_db = "radiusdb" } In addition, I specified the tables and left the other values as default. I then configured my queries.conf file in the mssql directory. When starting FreeRADIUS in debug, the following lines are output prior to the segmentation fault: sql { driver = "rlm_sql_unixodbc" server = "freeradius" port = "" login = "xxx" password = "xxx" radius_db = "radiusdb" read_groups = yes read_clients = no delete_stale_sessions = yes . . . } (sql): Driver rlm_sql_unixodbc (module rlm_sql_unixodbc) loaded and linked. (sql): Attempting to connect to database "radiusdb" rlm_sql (sql): Initialising connection pool pool { start = 5 min = 4 max = 10 spare = 3 uses = 0 lifetime = 0 cleanup_delay = 5 idle_timeout = 60 spread = no } (sql): Opening additional connection (0) Segmentation fault If I modify sql and set the driver = "rlm_sql_null" then FreeRADIUS starts up without error. Any ideas? Grant Spradling

2 1

Re: strangeness with Meru Controller
by Rui Ribeiro 18 Nov '13

18 Nov '13

On 13 November 2013 17:07, <freeradius-users-request(a)lists.freeradius.org>wrote: > > > Message: 6 > Date: Wed, 13 Nov 2013 17:01:25 +0000 > From: Phil Mayers <p.mayers(a)imperial.ac.uk> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: strangeness with Meru Controller > Message-ID: <5283B065.1070900(a)imperial.ac.uk> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > On 13/11/13 16:43, Rui Ribeiro wrote: > > Dear all, > > > > We have are switching to Meru here, using a FreeRadius 2.12 Debian stock > > with EDUROAM/EAP-TTLS-MSCHAPv2 + AD authentication, just for the sake of > > completeness. > > Do you mean TTLS/MSCHAP here, or TTLS/EAP-MSCHAPv2? They're different, > and in particular since the latter is an EAP inner, it sends a reply > User-Name, whereas the former does not, and it gets left to the EAP outer. > > Thank you Phil, it is indeed the question of being an inner protocol. Regards, Rui

1 0