- Freeradius-Users - lists.freeradius.org

range of mac addresses
by Dan Letkeman 29 Aug '13

29 Aug '13

If you wanted to do mac authentication, is there a way to add a range of mac addresses to the users list. eg: #Normal mac username: 002710de63a4 Cleartext-Password := "002710de63a4" e806882925ce Cleartext-Password := "e806882925ce" #Range of mac addresses: 94ebcd****** Cleartext-Password := "94ebcd******" Dan.

3 3

EAP-Peap-MSchapv2 proxy from innertunnel
by Robert Roll 29 Aug '13

29 Aug '13

I'm trying to do a proxy from the inner-tunnel over to another radius server. The primary reason for this is that we need to strip off the realm before passing to the proxy. I'm getting an EAP error response from the other server about it not liking the id number "Supplicant sent unmatched EAP response packet identifier" ( This is an EAP-PEAP-MSCHAPv2 scenerio) The EAP.conf file is configured with: proxy_tunneled_request_as_eap = yes I've included a TCP dump of the main freeradius server below WC -- Wireless controller FR-2.10 -- Freeradius server ISE-proxy -- The server FR-2.10 is sending proxy requests to: It does appear that FR-2.10 is beginning a conversation with ISE-proxy and id: 0xde It seem that ISE-proxy responds ok, but then the next message from FR-2.10 to ISE-proxy has id: 0xa8, but I'm thinking that ISE-proxy is expecting 0xdf ?.. I'll admit I'm still pretty confused about much of the EAP, stuff.. but maybe I'm missing something simple in the config ? Any ideas would be greatly appreciated.. Thanks, Robert 07:03:51.286831 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x82 length: 227 07:03:51.287639 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x82 length: 64 07:03:51.289921 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x83 length: 354 07:03:51.300931 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x83 length: 1090 07:03:51.304143 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x84 length: 238 07:03:51.304640 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x84 length: 1086 07:03:51.307583 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x85 length: 238 07:03:51.314568 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x85 length: 1086 07:03:51.317658 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x86 length: 238 07:03:51.324409 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x86 length: 923 07:03:51.335322 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x87 length: 440 07:03:51.337658 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x87 length: 123 07:03:51.339867 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x88 length: 238 07:03:51.344424 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x88 length: 101 07:03:51.346564 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x89 length: 328 --- Begin proxy ? 07:03:51.354527 IP FR-2.10.1814 > ISE-proxy.radius: RADIUS, Access Request (1), id: 0xde length: 246 07:03:51.371848 IP ISE-proxy.radius > FR-2.10.1814: RADIUS, Access Challenge (11), id: 0xde length: 132 07:03:51.372108 IP FR-2.10.radius > WC.32769: RADIUS, Access Challenge (11), id: 0x89 length: 101 07:03:51.374137 IP WC.32769 > FR-2.10.radius: RADIUS, Access Request (1), id: 0x8a length: 312 07:03:51.384449 IP FR-2.10.1814 > ISE-proxy.radius: RADIUS, Access Request (1), id: 0xa8 length: 306 07:03:51.386386 IP ISE-proxy.radius > FR-2.10.1814: RADIUS, Access Reject (3), id: 0xa8 length: 49 07:03:52.387589 IP FR-2.10.radius > WC.32769: RADIUS, Access Reject (3), id: 0x8a length: 101 --End proxy

4 13

Different groups to access services.
by Luiz Alberto Avelino 29 Aug '13

29 Aug '13

I installed FreeRADIUS Version 2.1.12 on a centos 6.4 and configured the ldap module for authentication of my users. Also configured my users files with 2 specific groups where only the users who are in these groups can authenticate. Until there alright. What I need your help and the following: There are two groups in Active Directory: CISCO and WIRELESS. I'm using freeradius to authenticate my switches and my wireless network with these groups. All users in the group CISCO will authenticate in my swiths ALL users in the group WIRELESS will authenticate on my wireless base. What this happening and that all users of the group CISCO E group wirelless are accessing in my switchs and at the base wireless. How do I configure this restriction? Thanks.

2 1

Checking TLS-Cert-* and and accept/reject based on them
by Axel Thimm 29 Aug '13

29 Aug '13

Dear all, 1-2 years ago this topic was discussed and there was a patch by Matthew Newton that was approved for the master branch. I'm now facing the difficulty of accepting/rejecting requests based on the contents of the TLS-Client-Cert for 2.1.12 which does not contain this patch. This is done in an exec module script in the authorize section which needs to decide on the request information and the certificate data whether to allow or disallow access. Other than applying this patch to 2.1.12 or switching to master, is there any other way to use the binaries of 2.1.12 and still be able to use the client cerficate date in the exec script? The reason I'm not simply applying the patch is that this system is covered by support by Red Hat and replacing the vendor shipped freeradius (2.1.12) with a self-compiled one voids the support. So any other solution that would allow me to keep the system under support and still be able to check the certs Subject/CN would be great! Some more details for anyone interested: The RADIUS client is an AP and the devices are Wifi clients like Android, iPads, laptops etc with Client certificates. Some devices should be allowed to access some SSIDs and others are not. freeradius gets the certificate and needs to extract the embedded username (which is just the device's serial number and displayed in the logs as BUF-name) for checking whether this device is allowed to connect to this SSID. The decision is made in an exec module in the authorize section, but I cannot pass any certificate information to it for checking. Thanks, Axel. -- Axel.Thimm at ATrpms.net

4 9

Re: EAP logging
by Alan Buxey 29 Aug '13

29 Aug '13

Your reference is wrong/unknown which means that there's a noop. This means no operation which means no fticks output alan

5 4

(was) RE: how to limit the repeating ldap lookups
by Brian Julin 28 Aug '13

28 Aug '13

Arran wrote: > and wow did they get rid of the 802.1X profile configuration GUI interface in > OSX 10.8? That sucks. If you think that sucks, wait till you see the horrible things you have to do to generate a .mobileconfig without access to an OSX server license. -- Brian S. Julin

4 4

how to limit the repeating ldap lookups
by Martin Kraus 28 Aug '13

28 Aug '13

Hi. Is it possible to limit the repeating ldap lookups that happen during mschap and tls negotiations? Like having an attribute that I could test for which would tell me that the negotiation is completed? thanks martin

8 24

CISCO ASA VPN3000 dictionary
by Arran Cudbard-Bell 28 Aug '13

28 Aug '13

Were trying to put together a dictionary for the Cisco ASA VPN3000 box. They have a list of attributes here: http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/ref_… In that list they have type 'boolean', but RADIUS can't encode attributes smaller than a byte. For boolean does anyone know if they really mean a standard 32bit integer with the values 0/1, or if they're wanting a single byte with the values 0/1, or whether it's some other cisco craziness? -Arran Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> FreeRADIUS Development Team

3 2

RE: CISCO ASA VPN3000 dictionary
by Angel Elena 28 Aug '13

28 Aug '13

Hi Arran. The cisco asa v9.0 and vpn 3000 aren't the same appliance ( different S.O., functions, etc..) The correct guide with attributes: http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server… Bye -----Mensaje original----- De: Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> Enviado: Mier 28-08-2013 16:15 Asunto: CISCO ASA VPN3000 dictionary Para: FreeRadius users mailing list <freeradius-users(a)lists.freeradius.org>; > Were trying to put together a dictionary for the Cisco ASA VPN3000 box. > > They have a list of attributes here: > http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/ref_… > rver.html#wp1802187 > > In that list they have type 'boolean', but RADIUS can't encode attributes > smaller than a byte. > > For boolean does anyone know if they really mean a standard 32bit integer with > the values 0/1, or > if they're wanting a single byte with the values 0/1, or whether it's some > other cisco craziness? > > -Arran > > Arran Cudbard-Bell <a.cudbardb(a)freeradius.org> > FreeRADIUS Development Team > > - > List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html >

1 0

brocade dictionnary on freeradius 2-2.1.7
by Stephane Branchoux 28 Aug '13

28 Aug '13

Hello, I recently upgraded my freeradius from 1.1.7 to 2-2.1.7 but i can't load my brocade dictionnary. I tried a new version of this file , like this : http://www.brocade.com/downloads/documents/html_product_manuals/NOS_AG_301/… But when i start radiusd, i have this error : including dictionary file /etc/raddb/dictionary Errors reading dictionary: dict_init: /usr/share/freeradius/dictionary.brocade[8]: unknown option "Brocade" Any idea ? Many thanks -- stephane BRANCHOUX Centre de Ressources Informatiques de l'Université de Perpignan. Systèmes/Réseaux mailto:stephane.branchoux@univ-perp.fr 04 68 66 21 24

2 1