- Freeradius-Users - lists.freeradius.org

lifetime of dynamic clients
by steve＠comitcon.be 02 Oct '13

02 Oct '13

Dear all, I have rebuild freeradius on debian 7.0. I have added rlm_raw and have a working dynamic client configuration where I use Called_Station_ID to authenticate / validate that a NAS is allowed to use this radius server. I test using the following command on client A echo "NAS-IP-Address=10.1.2.236, Called-Station-Id=00:40:96:aa:bb:ee,User-Name='testradius',User-Password='test'," | radclient -c '1' -n '3' -r '3' -t '3' -x '46.18.36.232:1812' 'auth' 'mysecret' I can see in the logs that is is checking the first time I log on and it is properly giving the message adding client xxx.xxx.xxx.xxx with shared secret. Now, when I executed the same command on a different machine Client B, it runs through it again. (Same command, I only had 1 nas added to it ) It adds the new 'client' to the dynamic clients. I wait for a couple of minutes and I executed the following command of client A: echo "NAS-IP-Address=10.1.2.236, Called-Station-Id=00:40:96:aa:bb:cc,User-Name='testradius',User-Password='test'," | radclient -c '1' -n '3' -r '3' -t '3' -x '46.18.36.232:1812' 'auth' 'mysecret' This has a faulty Called-Station-Id in it. I would assume that it would not allow me to connect. But this appears to still work. I am wondering - The first time the IP address of client A is added to the list of known client - So the second time , it will check first in the list if the IP is known, if so it won't go checking using the process defined in dynamic clients? But no matter how long I wait, it appears that the cache if not cleared. I have added a lifetime of 60 in the dynamic client conf, so I would assume that if I wait for a minute, the IP of client A would not be known, and it would go through checking again. Am I wrong in this? If not can I read the cache to find out why it is keeping that record? Kind regards Steve

3 11

Digest Authentication with a Cisco device
by Philip Walenta 02 Oct '13

02 Oct '13

I'm trying to do what might be an odd configuration. I'm attempting to digest auth users without caring about their "User-name" attribute. So in other words I want to auth on the "Digest-User-Name = "testuser"" that comes in as part of the Digest-Attributes and a password. So in the users file I have "DEFAULT Cleartext-password := "password"" I created a partial digest file but it appears to be ignored on every test: Digest-User-Name = "testuser" Digest-Algorithm = "MD5" Digest-QOP = "auth" In the debug I see: [digest] A1 = testuser:sp.eng:passwod I can change to username to anything I want and as long as the password is correct the user will auth. Am I attempting something impossible or doing it incorrectly?

2 1

Password gets changed while proxying
by JB 02 Oct '13

02 Oct '13

Hi! We're proxying auth requests to another RADIUS service and encounter the following problem: The password seems to get changed somewhere along the way. In our case, a 9 character password arrives as 16 character garbage at the home server, which then -of course- rejects the access request. Unfortunately, we don't have direct access to the home server, but the provider is convinced that the password gets mangled on our side. I can see the correct password in our FreeRADIUS debug logs. Other than preprocess, there's no module, which theoretically could change the password, before the proxy realm . My guess is that this is some sort of double encoding problem… Or maybe that the password doesn't get decoded properly on their side? Has anyone encountered a similar situation? Thanks! JB

4 5

HTTP; JMS Access
by George Innocent 02 Oct '13

02 Oct '13

I seek your support and advice to resolve this incidence relating to the Radius server used for authentification. There is a user created on the Radius that is used by Netcool for the synch with the SAM server. The user authenticates successfully but there is failure of connection on the JMS and http with the error message below when RADIUS is used. · george (admin account) : Found message of type FATALERROR: Probe failed to subscribe for notifications. Caused by: javax.jms.JMSSecurityException: SAM-O Access Violation - knoll (SAM-O account) : Exception in NSHeadResyncIntervalThread - Failed to establish HTTP connection for resync The user created on Radius as below: knoll Cleartext-Password :="airtel!23" Service-Type = Framed-User, Framed-Protocol = PPP, Sam-security-group-name = "SAM-O" Is there any parameters that have to be enabled or assigned for this user to be able to have the functions assigned to it. -- Regards: George Innocent.

2 1

Active Directory Group Membership filtering query
by Simon Grierson 01 Oct '13

01 Oct '13

Hi there, I'm new to freeradius, and am setting it up purely in a test environment before deploying live. We're using Freeradius 2.2.0 and Ubuntu server 12.04 .3 lts with Active Directory and Fortinet Fortigate based APs We're trying to achieve the following: Authentication via Active Directory, but with access granted depending on AD Group membership. EG: User A Is allowed Wifi access, as they are in Wifi-Users group User B is not as they do not have membership of this group. So we have the Freeradius server up and running, and it can authenticate against AD fine, but I cant figure out the group filtering portion of the setup. The documentation points to configuring the modules/ldap file to point to our LDAP server (I.E. our AD server0, and to configure the /users file with the following line DEFAULT Ldap-Group == "CN=sec-eduroam-users,OU=Access,OU=SecurityGroups,OU=Groups,DC=testres,DC=org" DEFAULT Auth-Type = Reject When I run freeradius in debug mode, we get all the usual output but no ldap modules mentioned It dues include modules/ldap but little else. FYI I have built this 3 times, 1. With 13.04 Ubuntu Server and Freeradius 2.2.0 from source 2. With 12.04 lts with FR 2.2.1 from source 3. With 12.04 lts with FR from the Launchpad based package ppa:freeradius/stable which is from 2.2.0 I can authenticate against LDAP and pull down group information using command line queries, so I know that LDAP is installed correctly and working in the linux build. What I cant get is LDAP to work through free radius. Am I doing something wrong, is there a better way to do this? Any help appreciated! NOTICE AND DISCLAIMER This e-mail (including any attachments) is intended for the above-named person(s). If you are not the intended recipient, notify the sender immediately, delete this email from your system and do not disclose or use for any purpose. We may monitor all incoming and outgoing emails in line with current legislation. We have taken steps to ensure that this email and attachments are free from any virus, but it remains your responsibility to ensure that viruses do not adversely affect you. Cancer Research UK Registered charity in England and Wales (1089464), Scotland (SC041666) and the Isle of Man (1103) A company limited by guarantee. Registered company in England and Wales (4325234) and the Isle of Man (5713F). Registered Office Address: Angel Building, 407 St John Street, London EC1V 4AD.

3 2

No EAP session matching the State variable (and other various messages)
by John Douglass 30 Sep '13

30 Sep '13

What exactly do error messages like: Sep 30 12:56:36 newdvlanb radiusd[10152]: rlm_eap: No EAP session matching the State variable. Sep 30 12:00:21 dvlanc radiusd[16053]: WARNING: Child is hung for request 782076 in component authenticate module peap. Sep 30 12:57:08 newdvlanb radiusd[10152]: Discarding duplicate request from client resnet1-WiSM-A port 32770 - ID: 126 due to unfinished request 187554 Sep 30 12:58:24 newdvlanb radiusd[10152]: Discarding conflicting packet from client Rich-core-WiSM-E port 32769 - ID: 155 due to recent request 207181. mean? I have attmpted to rectify by seeing if modifying the following configuration options within eap.conf get rid of these. # A list is maintained to correlate EAP-Response # packets with EAP-Request packets. After a # configurable length of time, entries in the list # expire, and are deleted. # timer_expire = 120 # # Help prevent DoS attacks by limiting the number of # sessions that the server is tracking. Most systems # can handle ~30 EAP sessions/s, so the default limit # of 4096 should be OK. max_sessions = 16384 I have even gotten EAP caching (using the Cached-Session-Policy) to two hours now. These error messages especially appear to occur en masse at or near the hour and then seem to abruptly stop: Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 12:59:30 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. [ SNIPPED ] Sep 30 13:01:37 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 13:01:37 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 13:01:37 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 13:01:38 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 13:01:38 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 13:01:38 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Sep 30 13:01:38 newdvlana radiusd[18407]: rlm_eap: No EAP session matching the State variable. Which appear in conjunction with: Sep 30 12:57:08 newdvlanb radiusd[10152]: Discarding duplicate request from client resnet1-WiSM-A port 32770 - ID: 126 due to unfinished request 187554 Sep 30 12:58:24 newdvlanb radiusd[10152]: Discarding conflicting packet from client Rich-core-WiSM-E port 32769 - ID: 155 due to recent request 207181. Sep 30 12:58:52 newdvlanb radiusd[10152]: Discarding conflicting packet from client Rich-core-WiSM-E port 32769 - ID: 234 due to recent request 213661. As well as sometimes: Sep 30 12:00:21 dvlanc radiusd[16053]: WARNING: Child is hung for request 782076 in component authenticate module peap. Sep 30 12:01:04 dvlanc radiusd[16053]: WARNING: Child is hung for request 789836 in component authenticate module peap. Sep 30 12:01:07 dvlanc radiusd[16053]: WARNING: Child is hung for request 789836 in component authenticate module peap. An oddity is that the issues appear cross server at about the same times: Sep 30 11:57:25 dvlanc radiusd[16053]: WARNING: Child is hung for request 754502 in component authenticate module peap. Sep 30 11:57:36 newdvlanb radiusd[11924]: WARNING: Child is hung for request 828962 in component authenticate module peap. Any one have any similar battle scars that I can learn from (server performance tweaks, optimizations, etc?). I've optimized as best I can the SQL component. This all seems related to the samba/winbind/ntlm_auth. - John Douglass, Sr. Systems IT/Architect, Georgia Institute of Technology

4 3

LDAP password in log files
by Matthew Ceroni 30 Sep '13

30 Sep '13

Is there any way to prevent FreeRadius from showing the password in logs (debug logs) when authentication is done via LDAP? Current I see : rad_recv: Access-Request packet from host 192.168.100.2 port 31011, id=13, length=129 User-Name = "username" User-Password = "XXXXXX" NAS-IP-Address = 192.168.100.2 NAS-Port = 268 NAS-Port-Type = Virtual Cisco-AVPair = "ip:source-ip=192.168.21.145" Calling-Station-Id = "ip:source-ip=192.168.21.145" Plus it will show it in other spots as well (accounting section, etc). Thanks

3 2

Access Request from HA rejected
by Suryalakshmi Annadurai 30 Sep '13

30 Sep '13

Hi all, I am using FreeRadius 2.1.12 for WIMAX authentication. My initial authentication between ASN-GW and AAA is successful. Keys are generated and received in Access-Accept. But when HA sends Access-Request to AAA, the Request is rejected.The SPI values are all correct. All the AVP values are valid (because I checked with a workaround and it was successful). There looks like a problem in the authorize section when username is checked for in the 'Users' file. Can you please tell me if I am missing something in the configuration? I have added the inner identity in the 'users' file. Clients are defined in the 'clients.conf'. Below is a portion from log file. rad_recv: Access-Request packet from host 172.16.10.10 port 52511, id=1, length=165 User-Name = "01-01-01-03-01-01(a)abc.com" NAS-IP-Address = 172.16.10.10 NAS-Identifier = "HA1" Message-Authenticator = 0x930277dfe340d323eb58e3ecf7588f30 WiMAX-Release = "1.2" WiMAX-Accounting-Capabilities = No-Accounting WiMAX-hHA-IP-MIP4 = 172.16.10.10 WiMAX-MN-hHA-MIP4-SPI = 1185754294 WiMAX-HA-RK-SPI = 123123 Thu Jan 1 05:53:35 1970 : Info: # Executing section authorize from file /etc/raddb/sites-enabled/default Thu Jan 1 05:53:35 1970 : Info: +- entering group authorize {...} Thu Jan 1 05:53:35 1970 : Info: ++[preprocess] returns ok Thu Jan 1 05:53:35 1970 : Info: ++[chap] returns noop Thu Jan 1 05:53:35 1970 : Info: ++[mschap] returns noop Thu Jan 1 05:53:35 1970 : Info: [suffix] Looking up realm "abc.com" for User-Name = "01-01-01-03-01-01(a)abc.com" Thu Jan 1 05:53:35 1970 : Info: [suffix] Found realm "abc.com" Thu Jan 1 05:53:35 1970 : Info: [suffix] Adding Stripped-User-Name = "01-01-01-03-01-01" Thu Jan 1 05:53:35 1970 : Info: [suffix] Adding Realm = "abc.com" Thu Jan 1 05:53:35 1970 : Info: [suffix] Authentication realm is LOCAL. Thu Jan 1 05:53:35 1970 : Info: ++[suffix] returns ok Thu Jan 1 05:53:35 1970 : Info: [eap] No EAP-Message, not doing EAP Thu Jan 1 05:53:35 1970 : Info: ++[eap] returns noop Thu Jan 1 05:53:35 1970 : Info: ++[files] returns noop Thu Jan 1 05:53:35 1970 : Info: ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Thu Jan 1 05:53:35 1970 : Info: Failed to authenticate the user. Thu Jan 1 05:53:35 1970 : Info: Using Post-Auth-Type Thu Jan 1 05:53:35 1970 : Info: # Executing group from file /etc/raddb/sites-enabled/default Thu Jan 1 05:53:35 1970 : Info: +- entering group REJECT {...} Thu Jan 1 05:53:35 1970 : Info: [attr_filter.access_reject] expand: %{User-Name} -> 01-01-01-03-01-01(a)abc.com Thu Jan 1 05:53:35 1970 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jan 1 05:53:35 1970 : Info: ++[attr_filter.access_reject] returns updated Thu Jan 1 05:53:35 1970 : Info: Delaying reject of request 5 for 1 seconds Thu Jan 1 05:53:35 1970 : Debug: Going to the next request Thu Jan 1 05:53:35 1970 : Debug: Waking up in 0.9 seconds. Thu Jan 1 05:53:36 1970 : Info: Sending delayed reject for request 5 Sending Access-Reject of id 1 to 172.16.10.10 port 52511 -Thanks

3 2

Post a question on freeradius
by Suryalakshmi Annadurai 30 Sep '13

30 Sep '13

Email id: <suryalakshmi.annadurai(a)carc.co.in<mailto:suryalakshmi.annadurai@carc.co.in>> Or ritu.glaces(a)gmail.com<mailto:ritu.glaces@gmail.com>

1 0

Comp128-1,2,3 support in EAP-SIM
by Arran Cudbard-Bell 29 Sep '13

29 Sep '13

Looking for someone to test some new code (in master branch). Someone [1] has claimed to of decompiled a SIM validation program to figure out the algorithms for Comp128-2 and Comp128-3. The reason why this is particularly useful, is because Comp128-1 is horribly broken, and versions 2 and 3 which are meant to be more secure were not released to the public domain. The only way you could properly (with a randomly generated challenge) authenticate SIMs using Comp128-2 and Comp128-3 was with a commercial AuC (Authentication centre) which cost $$$$$/$$$$$$. To try out the code, you need to know the Ki of a SIM. You can then set attributes: control:EAP-Sim-Ki to the 64bit Ki value and control:EAP-Sim-Algo-Version (to 1, 2 or 3). which rlm_eap_sim will then use in preference to the normal triplets. As part of these changes, the other SIM triplets will now be looked for in the control list, whereas they were previously looked for in the reply list. update control { EAP-Sim-RAND1 := &reply:EAP-Sim-RAND1 EAP-Sim-RAND2 := &reply:EAP-Sim-RAND2 EAP-Sim-RAND3 := &reply:EAP-Sim-RAND3 EAP-Sim-SRES1 := &reply:EAP-Sim-SRES1 EAP-Sim-SRES2 := &reply:EAP-Sim-SRES2 EAP-Sim-SRES3 := &reply:EAP-Sim-SRES3 EAP-Sim-Kc1 := &reply:EAP-Sim-Kc1 EAP-Sim-Kc2 := &reply:EAP-Sim-Kc2 EAP-Sim-Kc3 := &reply:EAP-Sim-Kc3 } Will fix up any existing configurations if you want to use the code from the master branch (which will become 3.1). If no one comes forward for testing, then i'll buy the hardware and do it myself, just if someone works at a telecoms provider, id imagine it'd be pretty easy to get hold of a test SIM, and Ki. Note: Comp128-4 (milenage) is still unknown (please contact one of the developers if you have access to it's specification), but just algorithms 1-3 are still useful. [1] http://www.hackingprojects.net/2013/04/secrets-of-sim.html Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

2 3