- Freeradius-Users - lists.freeradius.org

PPTP and IPSEC/IKE1/2
by WorkingMan 23 Sep '13

23 Sep '13

I am wondering is it possible to configure one server using a single IP to handle PPTP/IPSEC <---> freeradius? Does it make sense (or possible) to create a virtual servers against PPTP and IPSEC separately? I am just wondering what's the best practice. I don't want to increase number of hardware so things can be segregated either. Thanks,

3 4

The Operation of SQL module
by Mehdi Ravanbakhsh 22 Sep '13

22 Sep '13

Hi All * * *for some reason (change database structure and limitation on sql module for sql connection and ...) i need to develop something like SQL module to exchange check data in all section on my database .* * * *so in need to know what exactly sql module do in each section ( such as authorize , authenticate, accounting , ...).* * * *i can not find any detailed document on this.* * * *i just know that i should read all check data and fill them in related attribute (control attribute) in authorize section and for accounting section i need to update database by request attribute that received .* * * *i think that i miss something but i can not find ....* * * * * *can any one help on this ?* * * *do we have any list of attribute that i should fill in any section ? specially in authenticate section that other module need information from database (check attribute).* * * * * *Best ergards.*

3 3

acct_unique ID algorithm
by Mehdi Ravanbakhsh 20 Sep '13

20 Sep '13

Hi all I need the algorithm that use to create acct_unique ID that use in radacct table. any one can help on this ? Best regards.

2 2

eap-ttls with SMD5-Password
by Nasser Heidari 20 Sep '13

20 Sep '13

Hi, I'm trying to setup eap-ttls with freeradius, all my tests in LAB was successful. I've test it with both users file and sql and it was working. Now I'm going to prepare it for real setup, my only problem is that all my User-Passwords is database is stored with SMD5-Password attribute and when I'm trying it with EAP authentications fails and I get these messages in debug: Fri Sep 20 08:58:47 2013 : Info: [eap] Request found, released from the list Fri Sep 20 08:58:47 2013 : Info: [eap] EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] processing type md5 Fri Sep 20 08:58:47 2013 : Debug: rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication Fri Sep 20 08:58:47 2013 : Info: [eap] Handler failed in EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] Failed in EAP select Fri Sep 20 08:58:47 2013 : Info: ++[eap] returns invalid Fri Sep 20 08:58:47 2013 : Info: Failed to authenticate the user. Is there any possibility to make it work without changing password attribute? Kind Regards, Nasser

2 1

eap-ttls with SMD5-Password
by Nasser Heidari 20 Sep '13

20 Sep '13

Hi, I'm trying to setup eap-ttls with freeradius, all my tests in LAB was successful. I've test it with both users file and sql and it was working. Now I'm going to prepare it for real setup, my only problem is that all my User-Passwords is database is stored with SMD5-Password attribute and when I'm trying it with EAP authentications fails and I get these messages in debug: Fri Sep 20 08:58:47 2013 : Info: [eap] Request found, released from the list Fri Sep 20 08:58:47 2013 : Info: [eap] EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] processing type md5 Fri Sep 20 08:58:47 2013 : Debug: rlm_eap_md5: Cleartext-Password is required for EAP-MD5 authentication Fri Sep 20 08:58:47 2013 : Info: [eap] Handler failed in EAP/md5 Fri Sep 20 08:58:47 2013 : Info: [eap] Failed in EAP select Fri Sep 20 08:58:47 2013 : Info: ++[eap] returns invalid Fri Sep 20 08:58:47 2013 : Info: Failed to authenticate the user. Is there any possibility to make it work without changing password attribute? Kind Regards, Nasser

1 0

ubuntu postgresql unknown client
by rich carroll 19 Sep '13

19 Sep '13

I am having problems getting freeradius with ubuntu and postgres to work. I have set up this setup on freebsd several time successfully. I believe that it is not checking the database at all. Below is my radtest command and my debug command. My configs are identical to my configs on a working freebsd server. I would be happy to share what ever ones would be helpfull. I can uncomment the client.conf file out of the radiusd.conf and set my nas in it and get a password error. Which you would expect if it wasn't reading from accounts from the db also. I installed freeraduis-postgresql normally I would have just installed freeradius and configured it to use postgres. my sql.conf radtest command root@radius1:/etc/freeradius# radtest test test 127.0.0.1 1812 test Sending Access-Request of id 158 to 127.0.0.1 port 1812 User-Name = "test" User-Password = "test" NAS-IP-Address = 127.0.1.1 NAS-Port = 1812 Server Debug: root@radius1:/etc/init.d# freeradius -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Sep 24 2012 at 17:53:32 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/freeradius/radiusd.conf including files in directory /etc/freeradius/modules/ including configuration file /etc/freeradius/modules/policy including configuration file /etc/freeradius/modules/sradutmp including configuration file /etc/freeradius/modules/smbpasswd including configuration file /etc/freeradius/modules/always including configuration file /etc/freeradius/modules/mac2vlan including configuration file /etc/freeradius/modules/passwd including configuration file /etc/freeradius/modules/smsotp including configuration file /etc/freeradius/modules/expr including configuration file /etc/freeradius/modules/sql_log including configuration file /etc/freeradius/modules/ldap including configuration file /etc/freeradius/modules/mschap including configuration file /etc/freeradius/modules/krb5 including configuration file /etc/freeradius/modules/files including configuration file /etc/freeradius/modules/dynamic_clients including configuration file /etc/freeradius/modules/detail.example.com including configuration file /etc/freeradius/modules/expiration including configuration file /etc/freeradius/modules/radutmp including configuration file /etc/freeradius/modules/attr_filter including configuration file /etc/freeradius/modules/opendirectory including configuration file /etc/freeradius/modules/perl including configuration file /etc/freeradius/modules/wimax including configuration file /etc/freeradius/modules/inner-eap including configuration file /etc/freeradius/modules/preprocess including configuration file /etc/freeradius/modules/sqlcounter_expire_on_login including configuration file /etc/freeradius/modules/attr_rewrite including configuration file /etc/freeradius/modules/counter including configuration file /etc/freeradius/modules/echo including configuration file /etc/freeradius/modules/ippool including configuration file /etc/freeradius/modules/logintime including configuration file /etc/freeradius/modules/unix including configuration file /etc/freeradius/modules/pap including configuration file /etc/freeradius/modules/linelog including configuration file /etc/freeradius/modules/otp including configuration file /etc/freeradius/modules/exec including configuration file /etc/freeradius/modules/chap including configuration file /etc/freeradius/modules/cui including configuration file /etc/freeradius/modules/realm including configuration file /etc/freeradius/modules/ntlm_auth including configuration file /etc/freeradius/modules/detail.log including configuration file /etc/freeradius/modules/mac2ip including configuration file /etc/freeradius/modules/checkval including configuration file /etc/freeradius/modules/etc_group including configuration file /etc/freeradius/modules/pam including configuration file /etc/freeradius/modules/digest including configuration file /etc/freeradius/modules/acct_unique including configuration file /etc/freeradius/modules/detail including configuration file /etc/freeradius/eap.conf including configuration file /etc/freeradius/sql.conf including configuration file /etc/freeradius/sql/postgresql/dialup.conf including configuration file /etc/freeradius/sql/postgresql/counter.conf including configuration file /etc/freeradius/policy.conf including files in directory /etc/freeradius/sites-enabled/ including configuration file /etc/freeradius/sites-enabled/default including configuration file /etc/freeradius/sites-enabled/inner-tunnel main { user = "freerad" group = "freerad" allow_core_dumps = no } including dictionary file /etc/freeradius/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/freeradius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/freeradius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/freeradius/freeradius.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = yes auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### radiusd: #### Loading Clients #### radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/freeradius/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/freeradius/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/freeradius/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/freeradius/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/freeradius/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/freeradius/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/freeradius/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/freeradius/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/freeradius/modules/unix unix { radwtmp = "/var/log/freeradius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/freeradius/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/freeradius/certs" pem_file_type = yes private_key_file = "/etc/freeradius/certs/server.key" certificate_file = "/etc/freeradius/certs/server.pem" CA_file = "/etc/freeradius/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/freeradius/certs/dh" random_file = "/dev/urandom" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" make_cert_command = "/etc/freeradius/certs/bootstrap" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/freeradius/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/freeradius/modules/files files { usersfile = "/etc/freeradius/users" acctusersfile = "/etc/freeradius/acct_users" preproxy_usersfile = "/etc/freeradius/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/freeradius/modules/radutmp radutmp { filename = "/var/log/freeradius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/freeradius/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/freeradius/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/freeradius/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/freeradius/modules/preprocess preprocess { huntgroups = "/etc/freeradius/huntgroups" hints = "/etc/freeradius/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/freeradius/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/freeradius/modules/detail detail { detailfile = "/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/freeradius/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/freeradius/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = * port = 0 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address * port 1812 Listening on accounting address * port 1813 Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1814 Ready to process requests. Ignoring request to authentication address * port 1812 from unknown client 127.0.0.1 port 52834 Ready to process requests. -- Richard Carroll richcarroll(a)gmail.com

3 3

Active Directory authentication question
by Roberto Carna 19 Sep '13

19 Sep '13

Dear, I have several Windows 7 clients over WiFi autheticating throug EAP-TLS to a Freeradius 2.1 service against a local MySQL database, it works OK. Now I have to change the authentication from MySQL to a remote Active Directory on a Windows 2012 server. Because I don't know so much about Windows world, I need to know if I have to use NTLM, LDAP or Kerberos in order to authenticate against the remote AD. Thanks a lot !!! Roberto

5 8

Looking for help with DHCP
by Alan DeKok 19 Sep '13

19 Sep '13

Not many people know that FreeRADIUS implements DHCP. I'd like to change that. I'm therefore offering to pay for some work on the feature. As background, the current version does DHCP, and DHCP relaying. It allocates IPs from an SQL pool. The git "master" branch has a script to import an ISC lease file into the SQL database. We need more. I'm looking for the following: - detailed documentation on how to get it working. Ideally a step-by-step guide, in the style of the EAP docs on http://deployingradius.com/ - the documentation should include examples of an ISC configuration, and how it maps to a FreeRADIUS configuration - the documentation should include simple tests, and common problems to check - it should include any new scripts, etc. necessary to get it working. - any code / configuration will become part of the main FreeRADIUS releases - the documentation and worked examples will get hosted on the FreeRADIUS web site, and prominently linked from the main page - your name will go on everything - since my company is paying for it, all copyright will belong to Network RADIUS SARL. This is a request for *paid* work. I'm prepared to pay reasonable rates for this. And not the "$100 bounty for 6 days work" kind of nonsense, either. Please send email to me with your proposal, background, and price. I'll pick someone in the next week, and work behind the scenes to get this done. The hope is to crush that pesky ISC server. It's been frustrating people world-wide for years. :) Alan DeKok.

1 0

DHCP relaying
by Nikolaos Milas 19 Sep '13

19 Sep '13

Hi, I would like to ask how we can direct FR dhcp server (using an ldap backend) to relay to another dhcp server. The idea is that we have a db of known MAC addresses which have an associated VLAN (assigned during MAC Auth) and a static IP address (assigned through FR dhcp server). If a MAC address is unknown, we would like to be able to relay to another dhcp server which will be responsible for dynamic IP address allocation (because, as I understand, FR does not support dynamic IP address allocation) on a private IP address range, with limited access. What will be the "command" to use for relaying? Thanks in advance, Nick

2 3

ipad ssl error in free radius
by val john 19 Sep '13

19 Sep '13

hi guys we are getting follwong error in our radius log when ipad trying to connect to our WIFI network , our WIFI network using EAP-TTLS + LDAP authentication , All other devices (linux , windows, mac os 10.8 , Suse , android ) are working fine apart from ipads .. Error === Tue Sep 17 13:36:25 2013 : Error: TLS Alert read:warning:close notify Tue Sep 17 13:36:25 2013 : Error: TLS_accept: failed in SSLv3 read client certificate A Tue Sep 17 13:36:25 2013 : Error: rlm_eap: SSL error error:140940E5:SSL routines:SSL3_READ_BYTES:ssl handshake failure Tue Sep 17 13:36:25 2013 : Error: SSL: SSL_read failed in a system call (-1), TLS session fails. Tue Sep 17 13:36:25 2013 : Auth: Login incorrect (TLS Alert read:warning:close notify): [user(a)ihk.com] (from client ManagementAPs port 1 cli 00-88-65-42-50-88) Do you guys any idea what cause this issue Thank you John

4 3