- Freeradius-Users - lists.freeradius.org

message freeradius
by María Teresa Mondragón Reyes 24 Sep '13

24 Sep '13

Hi everybody I need some help I'm new in this topic and I'm traying to configure a freeradius serve. I followed the instructions to configure freeradius plus remote mysql server and when put in debug mode freeradius -f -X i get this message. rad_recv: Accounting-Request packet from host 192.168.4.224 port 32769, id=157, length=285 Invalid packet code 4 sent to a proxy port from home server 192.168.4.224 port 32769 - ID 157 : IGNORED Ready to process requests. Im getting the connection, there is no problem, my user is reaching a ip from the private network 192.168.6.xxx and can access to internet. My freeradius server is in the same machine that shorewall, DNS and gateway... my shorewall rules . . . ACCEPT loc $FW:192.168.4.254 udp 1812,1814,18120 . . . Thanks in advanced tere mondragón

3 2

EAP-TLS Authentication
by arvind132 . 24 Sep '13

24 Sep '13

Hi, I am facing some issues with 802.1x EAP-TLS Authentication. Please suggest any document which can help in better understanding on TLS Authentication. Thanks.

2 1

Re: Freeradius-Users Digest, Vol 101, Issue 52
by Rui Ribeiro 23 Sep '13

23 Sep '13

After some version of windows (which I don't really know because I don't use it), by default what is sent is the name of the machine. You have to configure it on purpose to send the username, under 802.1X auth tab, changing machine name by default to user name. Regards ----------------------------- Message: 2 Date: Mon, 23 Sep 2013 14:14:26 -0400 (EDT) From: paul trader <fliptop(a)igolinux.com> To: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org> Subject: Re: Freeradius-Users Digest, Vol 101, Issue 50 Message-ID: <alpine.DEB.2.02.1309231409260.7633(a)soundgarden.localdomain.local> Content-Type: text/plain; charset="windows-1252" On Mon, 23 Sep 2013 at 18:49, Rui Ribeiro opined: RR:Your not crazy for sure. The problem authenticating with Windows boxen RR:is that they only support MSCHAPv2? kudos to Microsoft. hi rui - thanks for that, although my family and co workers may disagree! according to this wiki faq entry: http://wiki.freeradius.org/guide/faq#How-do-I-make-Windows-XP-clients-use-o… it's possible to force ms to use pap. somehow, though, after reading another reply to my post, i'm getting the feeling ms clients are munging something in the username because it's not being found in the users file. regards, paul On 23 September 2013 21:23, <freeradius-users-request(a)lists.freeradius.org>wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: pap always returns noop for windows dialup authentication > (paul trader) > 2. Re: Freeradius-Users Digest, Vol 101, Issue 50 (paul trader) > 3. Re: pap always returns noop for windows dialup authentication > (Alan DeKok) > 4. Re: pap always returns noop for windows dialup authentication > (John Dennis) > 5. Re: EAP + SSL + Certificate chains (Trevor Jennings) > 6. Re: pap always returns noop for windows dialup authentication > (paul trader) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 23 Sep 2013 14:07:21 -0400 (EDT) > From: paul trader <fliptop(a)igolinux.com> > To: John Dennis <jdennis(a)redhat.com> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: pap always returns noop for windows dialup authentication > Message-ID: > <alpine.DEB.2.02.1309231357120.7633(a)soundgarden.localdomain.local> > Content-Type: TEXT/PLAIN; charset=US-ASCII > > On Mon, 23 Sep 2013 at 13:31, John Dennis opined: > > JD:You still haven't sent the full debug. > > hi john - thanks for your reply. i sent the output from running radiusd > -X, are you saying i need to run -Xxx and send that instead? > > or are you looking for the startup output as well? i only included the > output for the particular requests. > > JD:Also, you said you were moving from v1 to v2, you can't just copy v1 > JD:configs over, they're different, hope you weren't doing that. > > i used a default v2 install and only changed the users and clients.conf > files. everything else was left alone. > > regards, paul > > > ------------------------------ > > Message: 2 > Date: Mon, 23 Sep 2013 14:14:26 -0400 (EDT) > From: paul trader <fliptop(a)igolinux.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: Freeradius-Users Digest, Vol 101, Issue 50 > Message-ID: > <alpine.DEB.2.02.1309231409260.7633(a)soundgarden.localdomain.local> > Content-Type: text/plain; charset="windows-1252" > > On Mon, 23 Sep 2013 at 18:49, Rui Ribeiro opined: > > RR:Your not crazy for sure. The problem authenticating with Windows boxen > RR:is that they only support MSCHAPv2? kudos to Microsoft. > > hi rui - thanks for that, although my family and co workers may disagree! > > according to this wiki faq entry: > > > http://wiki.freeradius.org/guide/faq#How-do-I-make-Windows-XP-clients-use-o… > > it's possible to force ms to use pap. somehow, though, after reading > another reply to my post, i'm getting the feeling ms clients are munging > something in the username because it's not being found in the users file. > > regards, paul > > ------------------------------ > > Message: 3 > Date: Mon, 23 Sep 2013 14:21:22 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: pap always returns noop for windows dialup authentication > Message-ID: <524086A2.9030708(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > paul trader wrote: > > i used a default v2 install and only changed the users and clients.conf > > files. everything else was left alone. > > Well, there's no magic. If the "users" file entry doesn't match, it's > because the User-Name isn't "test". > > Alan DeKok. > > > ------------------------------ > > Message: 4 > Date: Mon, 23 Sep 2013 14:42:35 -0400 > From: John Dennis <jdennis(a)redhat.com> > To: paul trader <fliptop(a)igolinux.com> > Cc: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: pap always returns noop for windows dialup authentication > Message-ID: <52408B9B.2060701(a)redhat.com> > Content-Type: text/plain; charset=ISO-8859-1 > > On 09/23/2013 02:07 PM, paul trader wrote: > > On Mon, 23 Sep 2013 at 13:31, John Dennis opined: > > > > JD:You still haven't sent the full debug. > > > > hi john - thanks for your reply. i sent the output from running radiusd > > -X, are you saying i need to run -Xxx and send that instead? > > No. It means all the output from radiusd -X. Yes, that might seem like a > lot but it contains useful information. But before you do send it to > this list see below. > > > > or are you looking for the startup output as well? i only included the > > output for the particular requests. > > That's not the full debug is it? :-) > > > > > JD:Also, you said you were moving from v1 to v2, you can't just copy v1 > > JD:configs over, they're different, hope you weren't doing that. > > > > i used a default v2 install and only changed the users and clients.conf > > files. everything else was left alone. > > You have all the information you need to debug your problem. It does > require reading the debug output carefully. But you should really try to > do that yourself first. As a said earlier, verify you're reading the > exact same users file in both cases (the debug output will tell you what > files are being read), If they are then look at your users file and > determine why the user name is not matching, there is nothing magic > about it, it should be straight forward. Still stumped? Then come back > to the list for help. > > > -- > John > > > ------------------------------ > > Message: 5 > Date: Mon, 23 Sep 2013 16:18:55 -0400 > From: Trevor Jennings <Trevor(a)simple101.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: EAP + SSL + Certificate chains > Message-ID: > < > CAHNBdEJUdmUCQG+uW+dfXUDnDdYKuvCdQnstWwsjusiM3+afjQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hey I wanted to say thanks for the tips! I convinced the peers that it was > not a good idea to allow auto certificate acceptance and to just have the > clients accept it when the new certificate went online. > > Cheers, > > - Trevor > > > > On Thu, Sep 12, 2013 at 3:46 PM, Brian Julin <BJulin(a)clarku.edu> wrote: > > > > Mathieu wrote: > > > At least from that side there is hope for improvements with Android 4.3 > > > onwards there > > > are API calls for enterprise wireless configuration. > > > > > > Maybe "someone" steps up by making an application that can manage > > > profiles or something like this. > > > > That is promising, but I hope this does not become a case of > > "Oh, there's an app for that basic system function" versus it being in > the > > core UI. Because nobody will have it pre-installed. > > > > -- > > Brian > > - > > List info/subscribe/unsubscribe? See > > http://www.freeradius.org/list/users.html > > >

1 0

Re: Freeradius-Users Digest, Vol 101, Issue 50
by Rui Ribeiro 23 Sep '13

23 Sep '13

------------------------------ Message: 5 Date: Mon, 23 Sep 2013 12:33:10 -0400 (EDT) From: paul trader <fliptop(a)igolinux.com> To: freeradius-users(a)lists.freeradius.org Subject: pap always returns noop for windows dialup authentication Message-ID: <alpine.DEB.2.02.1309231213040.7006(a)soundgarden.localdomain.local> Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII hi all - i've recently tried upgrading from v1 to v2. on a centos 6.4 box w/ all latest updates, i installed freeradius v2, added one username and password to /etc/raddb/users: test Cleartext-Password := "testing" and the radtest command-line authentication works. i then added one client for our blade server to /etc/raddb/clients.conf: client x.x.x.x { secret = xxxxx shortname = 3coms } substituting the correct ip and secret for the x's. testing from my linux box w/ a modem, authentication works. output from radiusd -X shows all is well, my linux box receives an ip address and dns servers. relavant -X debug output shows: ++[pap] returns updated Found Auth-Type = PAP # Executing group from file /etc/raddb/sites-enabled/default +- entering group PAP {...} [pap] login attempt with password "testing" [pap] Using clear text password "testing" [pap] User authenticated successfully ++[pap] returns ok however, when trying to authenticate from a windows box, authentication fails. every time. i've tried it from a windows xp machine and 2 windows 7 machines. the debug output always says: [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type Reject i've been over and over everything a dozen times, have tried changing the windows dialup security settings to use pap only, and also have tried adding the following line to the users file: Auth-Type = PAP even though everything i've read said not to do that. still doesn't work. the only changes i've made to the default installation are to the users and clients.conf files. i have spent hours searching the internet for a similar problem/solution and come up empty. windows boxes will not authenticate, pap always returns noop, and the user is rejected. am i doing something glaringly wrong, or just going plain crazy? regards, paul ------------------------------ Hi Paul, Your not crazy for sure. The problem authenticating with Windows boxen is that they only support MSCHAPv2… kudos to Microsoft. Regards, Rui On 23 September 2013 18:17, <freeradius-users-request(a)lists.freeradius.org>wrote: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > http://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports (Alan DeKok) > 2. FreeRadius Error " Access Rejected" Only On Some CISCO Switch > Ports (Daniel Baker) > 3. Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports (Daniel Baker) > 4. EAP-TLS Authentication (arvind132 .) > 5. pap always returns noop for windows dialup authentication > (paul trader) > 6. Re: pap always returns noop for windows dialup authentication > (Phil Mayers) > 7. Re: pap always returns noop for windows dialup authentication > (paul trader) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Mon, 23 Sep 2013 09:18:28 -0400 > From: Alan DeKok <aland(a)deployingradius.com> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Subject: Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports > Message-ID: <52403FA4.5090808(a)deployingradius.com> > Content-Type: text/plain; charset=ISO-8859-1 > > Daniel Baker wrote: > > [ldap] performing search in dc=citlao,dc=local, with filter (uid=root) > > [ldap] object not found > > [ldap] search failed > > What part of that is unclear? > > > What can I try to fix the authentication issues so that all ports are > being successfully authenticated ? > > Ensure that the people logging in have accounts in ldap. > > Alan DeKok. > > > ------------------------------ > > Message: 2 > Date: Mon, 23 Sep 2013 20:39:44 +0700 > From: Daniel Baker <info(a)collisiondetection.biz> > To: freeradius-users(a)lists.freeradius.org > Subject: FreeRadius Error " Access Rejected" Only On Some CISCO Switch > Ports > Message-ID: <524044A0.8000800(a)collisiondetection.biz> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > > > Hi Guys, we are trying to get Free Radius to authenticate our users who > connect through a Cisco Small Business POE switch. > > > When testing authentication with a shutdown / no shutdown command on > port fa/17 which has an IP phone connected to it we receive the > following errors: > > FREE RADIUS : > > [ldap] expand: %{User-Name} -> root > [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=root) > [ldap] expand: dc=citlao,dc=local -> dc=citlao,dc=local > [ldap] ldap_get_conn: Checking Id: 0 > [ldap] ldap_get_conn: Got Id: 0 > [ldap] performing search in dc=citlao,dc=local, with filter (uid=root) > [ldap] object not found > [ldap] search failed > [ldap] ldap_release_conn: Release Id: 0 > ++[ldap] returns notfound > ++[expiration] returns noop > ++[logintime] returns noop > [pap] WARNING! No "known good" password found for the user. > Authentication may fail because of this. > ++[pap] returns noop > ERROR: No authenticate method (Auth-Type) found for the request: > Rejecting the user > Failed to authenticate the user. > Login incorrect ( [ldap] User not found): [root/trash] (from client > LTC-ROUTER port 2) > Using Post-Auth-Type Reject > # Executing group from file /etc/freeradius/sites-enabled/default > +- entering group REJECT {...} > [attr_filter.access_reject] expand: %{User-Name} -> root > attr_filter: Matched entry DEFAULT at line 11 > ++[attr_filter.access_reject] returns updated > Delaying reject of request 12 for 1 seconds > Going to the next request > Waking up in 0.9 seconds. > Sending delayed reject for request 12 > Sending Access-Reject of id 31 to 192.168.1.1 port 1645 > Waking up in 4.9 seconds. > Cleaning up request 12 ID 31 with timestamp +10922 > Ready to process requests. > > CISCO POE SWITCH: > > > SW-BN3-PoE(config-if)#shutdown > SW-BN3-PoE(config-if)#23-Sep-2013 14:17:22 %LINK-W-Down: fa17 > > SW-BN3-PoE(config-if)# > SW-BN3-PoE(config-if)#no shutdown > SW-BN3-PoE(config-if)#23-Sep-2013 14:17:42 %STP-W-PORTSTATUS: fa17: STP > status Forwarding > 23-Sep-2013 14:17:42 %LINK-I-Up: fa17 > 23-Sep-2013 14:17:43 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC > 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or > password in Radius server > 23-Sep-2013 14:18:07 %LINK-W-Down: fa17, aggregated (3) > 23-Sep-2013 14:18:09 %STP-W-PORTSTATUS: fa17: STP status Forwarding, > aggregated (3) > 23-Sep-2013 14:18:09 %LINK-I-Up: fa17, aggregated (3) > 23-Sep-2013 14:18:18 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC > 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or > password in Radius server, aggregated (1) > > > > > However when we try the same test on a port that has a PC connected to > it we do not receive such an error. > > The CISCO switch says that we have the wrong user name and the Free > Radius log says access rejected. Why would this only be the case when > a CISCO IP phone tries to authenticate? > > The Cisco switch port configurations are exactly the same and are as > follows : > > dot1x max-req 1 > dot1x reauthentication > dot1x timeout quiet-period 30 > dot1x mac-authentication mac-only > dot1x port-control auto > storm-control broadcast enable > storm-control broadcast level 10 > storm-control include-multicast > spanning-tree portfast > macro description "no_ip_phone_desktop | ip_phone_desktop" > switchport trunk allowed vlan add 100 > macro auto smartport type ip_phone_desktop > > What can I try to fix the authentication issues so that all ports are > being successfully authenticated ? > > > Thanks for your assistance, > > Dan > > > > > > > > > > > > > > > > ------------------------------ > > Message: 3 > Date: Mon, 23 Sep 2013 21:01:49 +0700 > From: Daniel Baker <info(a)collisiondetection.biz> > To: freeradius-users(a)lists.freeradius.org > Subject: Re: FreeRadius Error " Access Rejected" Only On Some CISCO > Switch Ports > Message-ID: <524049CD.6030303(a)collisiondetection.biz> > Content-Type: text/plain; charset=ISO-8859-1; format=flowed > > Thank you Alan I will pursue that line of inquiry further. > > > On 9/23/2013 8:18 PM, Alan DeKok wrote: > > Daniel Baker wrote: > >> [ldap] performing search in dc=citlao,dc=local, with filter > (uid=root) > >> [ldap] object not found > >> [ldap] search failed > > What part of that is unclear? > > > >> What can I try to fix the authentication issues so that all ports are > being successfully authenticated ? > > Ensure that the people logging in have accounts in ldap. > > > > Alan DeKok. > > - > > List info/subscribe/unsubscribe? See > http://www.freeradius.org/list/users.html > > > > > > > > ------------------------------ > > Message: 4 > Date: Mon, 23 Sep 2013 20:15:14 +0530 > From: "arvind132 ." <arvindnb1(a)gmail.com> > To: freeradius-users(a)lists.freeradius.org > Subject: EAP-TLS Authentication > Message-ID: > <CABNrktRU1J02n-yAmcpYj8rxq5Sg79NtUf= > syrYXnj06ANk3UQ(a)mail.gmail.com> > Content-Type: text/plain; charset="iso-8859-1" > > Hi, > I am facing some issues with 802.1x EAP-TLS Authentication. > Please suggest any document which can help in better understanding on TLS > Authentication. > Thanks. >

2 1

FreeRadius Error " Access Rejected" Only On Some CISCO Switch Ports
by Daniel Baker 23 Sep '13

23 Sep '13

Hi Guys, we are trying to get Free Radius to authenticate our users who connect through a Cisco Small Business POE switch. When testing authentication with a shutdown / no shutdown command on port fa/17 which has an IP phone connected to it we receive the following errors: FREE RADIUS : [ldap] expand: %{User-Name} -> root [ldap] expand: (uid=%{%{Stripped-User-Name}:-%{User-Name}}) -> (uid=root) [ldap] expand: dc=citlao,dc=local -> dc=citlao,dc=local [ldap] ldap_get_conn: Checking Id: 0 [ldap] ldap_get_conn: Got Id: 0 [ldap] performing search in dc=citlao,dc=local, with filter (uid=root) [ldap] object not found [ldap] search failed [ldap] ldap_release_conn: Release Id: 0 ++[ldap] returns notfound ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Login incorrect ( [ldap] User not found): [root/trash] (from client LTC-ROUTER port 2) Using Post-Auth-Type Reject # Executing group from file /etc/freeradius/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> root attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 12 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 12 Sending Access-Reject of id 31 to 192.168.1.1 port 1645 Waking up in 4.9 seconds. Cleaning up request 12 ID 31 with timestamp +10922 Ready to process requests. CISCO POE SWITCH: SW-BN3-PoE(config-if)#shutdown SW-BN3-PoE(config-if)#23-Sep-2013 14:17:22 %LINK-W-Down: fa17 SW-BN3-PoE(config-if)# SW-BN3-PoE(config-if)#no shutdown SW-BN3-PoE(config-if)#23-Sep-2013 14:17:42 %STP-W-PORTSTATUS: fa17: STP status Forwarding 23-Sep-2013 14:17:42 %LINK-I-Up: fa17 23-Sep-2013 14:17:43 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or password in Radius server 23-Sep-2013 14:18:07 %LINK-W-Down: fa17, aggregated (3) 23-Sep-2013 14:18:09 %STP-W-PORTSTATUS: fa17: STP status Forwarding, aggregated (3) 23-Sep-2013 14:18:09 %LINK-I-Up: fa17, aggregated (3) 23-Sep-2013 14:18:18 %SEC-W-SUPPLICANTUNAUTHORIZED: MAC 58:bf:ea:11:13:93 was rejected on port fa17 due to wrong user name or password in Radius server, aggregated (1) However when we try the same test on a port that has a PC connected to it we do not receive such an error. The CISCO switch says that we have the wrong user name and the Free Radius log says access rejected. Why would this only be the case when a CISCO IP phone tries to authenticate? The Cisco switch port configurations are exactly the same and are as follows : dot1x max-req 1 dot1x reauthentication dot1x timeout quiet-period 30 dot1x mac-authentication mac-only dot1x port-control auto storm-control broadcast enable storm-control broadcast level 10 storm-control include-multicast spanning-tree portfast macro description "no_ip_phone_desktop | ip_phone_desktop" switchport trunk allowed vlan add 100 macro auto smartport type ip_phone_desktop What can I try to fix the authentication issues so that all ports are being successfully authenticated ? Thanks for your assistance, Dan

2 3

Authentication
by Free-Radius 23 Sep '13

23 Sep '13

Dear, I wonder if the Freeradius to authenticate a client by IP number, without using login and password, only the IP. If possible, how to do? thank you ----------------------------------------------------------- Marcelo

4 3

Facing Problem in Asterisk peer Authentication with Freeradius.
by Husnain Taseer 23 Sep '13

23 Sep '13

Hi, I want to authenticate asterisk peer using freeradius I am using asterisk 12.0.0 and Freeradius 2.2.1. I have configured freeradius correctly as I am able to authenticate user saved in users file from the terminal by using "radclient" command from the terminal. but when I try to register peer in asterisk the freeradius authentication doesn't work. Even I don't get any request from asterisk server in radius logs. My sip.conf configuration is : [1000] type=friend context=test auth_type=radius host=dynamic and user credentials are placed in /usr/local/etc/raddb/users as: 1000 Cleartext-Password := "password" Please Help me in this regard.

3 3

can not initiate sim, no RAND1 attribute [eap] ERROR - Default EAP type sim failed in initiate [eap]
by ken.farrington 23 Sep '13

23 Sep '13

Hi All, I really do try to read the forums in full before I post, but I have seen much out there on this, but just cant find out why this is happening. Please see below. The only think I dont have is "sim_files" entry in the sites-enabled/default, as I assume this is now covered in the radiusd.conf file. Also, in the simtriplets files at the bottom, I have tried the entries with a 1 at the beiging of the IMSI, and without and with the word SIM there also. On packet captures over the air, I get P1 - eap identity request P2 - eap identity response P3 - eap-failure So I beleive the radius server is not sending an eap-start <module> and is my configuration issue. Could anyone be so kind to help me please? Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on command file /usr/local/var/run/radiusd/radiusd.sock Listening on proxy address * port 1814 Ready to process requests. rad_recv: Access-Request packet from host 10.53.1.200 port 45261, id=5, length=257 User-Name = "1234159143465084(a)wlan.mnc015.mcc234.3gppnetwork.org" NAS-IP-Address = 192.168.21.1 Called-Station-Id = "5C-D9-98-BF-C0-9E:tt" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "5C-F8-A1-8B-35-BA" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "524016AE-00000005" Framed-MTU = 1400 EAP-Message = 0x02ba0038013132333431353931343334363530383440776c616e2e6d6e633031352e6d63633233342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x25cd862fe8110e13ab54321c37032d00 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc015.mcc234.3gppnetwork.org" for User-Name = "1234159143465084(a)wlan.mnc015.mcc234.3gppnetwork.org" [suffix] No such realm "wlan.mnc015.mcc234.3gppnetwork.org" ++[suffix] returns noop [eap] EAP packet type response id 186 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity ================================================================ [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] returns invalid ================================================================ Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1234159143465084(a)wlan.mnc015.mcc234.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 0 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 0 Sending Access-Reject of id 5 to 10.53.1.200 port 45261 EAP-Message = 0x04ba0004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 0 ID 5 with timestamp +8 Ready to process requests. rad_recv: Access-Request packet from host 10.53.1.200 port 45261, id=6, length=257 User-Name = "1234159143465084(a)wlan.mnc015.mcc234.3gppnetwork.org" NAS-IP-Address = 192.168.21.1 Called-Station-Id = "5C-D9-98-BF-C0-9E:tt" NAS-Port-Type = Wireless-802.11 NAS-Port = 1 Calling-Station-Id = "5C-F8-A1-8B-35-BA" Connect-Info = "CONNECT 54Mbps 802.11g" Acct-Session-Id = "524016AE-00000006" Framed-MTU = 1400 EAP-Message = 0x02f20038013132333431353931343334363530383440776c616e2e6d6e633031352e6d63633233342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0xac6eea11e5915f4e4e5bbc06a7ed3e72 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] Looking up realm "wlan.mnc015.mcc234.3gppnetwork.org" for User-Name = "1234159143465084(a)wlan.mnc015.mcc234.3gppnetwork.org" [suffix] No such realm "wlan.mnc015.mcc234.3gppnetwork.org" ++[suffix] returns noop [eap] EAP packet type response id 242 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim can not initiate sim, no RAND1 attribute [eap] Default EAP type sim failed in initiate [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type Reject # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1234159143465084(a)wlan.mnc015.mcc234.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 6 to 10.53.1.200 port 45261 EAP-Message = 0x04f20004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 4.9 seconds. Cleaning up request 1 ID 6 with timestamp +20 Ready to process requests. ^C root@bt:/usr/local/etc/raddb# more simtriplets.dat #IMSI RAND SRES Kc SIM,1234159143465084,A0C88079662D465cA02777F9A9CEAEC7,6C395da1,F0dacca9391dcf1b SIM,1234159143465084,4BB4C256A0774a408FD55659713827BA,68623684,20fa6eaa8F1cefa1 SIM,1234159143465084,36FD7F72064B4edaB48CDF26CB7DC630,90af525c,3B7a3d5b7Bac2ed2 SIM,1234159143465084,DD9B118ACF17444f82DA268FA39687AC,D110c907,7Cd8c9ca1Af0dc27 SIM,1234159143465084,80F0D38CD406486f9F725CBC36FABBB1,EC775db7,A756b22b0B143f0f root@bt:/usr/local/etc/raddb#

2 3

DHCP Relay Invalid type "dhcp" in listen section
by bayu setiawan 23 Sep '13

23 Sep '13

Hi, i have problem when i configured for dhcp relay, i have configured ./sites-enabled/dhcp-relay according to https://github.com/FreeRADIUS/freeradius-server/blob/master/raddb/sites-ava… and i have included dictionary.dhcp in ./dictionary config file, but i still got error *Debug: listen {* *Debug: type = "dhcp"* *Error: /etc/raddb/sites-enabled/dhcp.relay[12]: Invalid type "dhcp" in listen section.* listen type dhcp is not recognize, can anybody help me? Thanks before

2 5

Expiration and EAP verification question
by WorkingMan 23 Sep '13

23 Sep '13

In strongswan for ikev1 it uses xauth-eap that I use to do validation with RADIUS (that's the only way for ikev1 clients with strongswan). My design is that I don't actually care about secondary authentication with RADIUS since it's already doing certificate validation from strongswan side before doing secondary authentication. All is good if I was only need secondary authentication since I can bypass with verify_eap from strongswan side but I want to make use of the Expiration module on freeradius side (works great). I have few questions so it can help me determine next course of action: 1) is there a way to configure freeradius for Accounting only and also does the user expiration check? 2) is it possible for me in any way to reject expired user but accept eap based authentication (from configuration or code modification)? 3) when connection is rejected does the strongswan side (xauth-eap plugin in particular) receive information that can differentiate this logic (send attribute that it can handle maybe? I have no idea how that work)? Thanks

2 3