- Freeradius-Users - lists.freeradius.org

Selecting authentication based on NAS-IP-Address or Client IP Address
by Jeremiah Peterson 22 May '13

22 May '13

I see that it is possible to create realms and have each realm use a different proxy, but what I am more interested in is having the authentication method be selected based on client. For example: If the request comes from IP 10.10.10.10 and user bob then use home_server_pool xxx (and return attribute "blah blah blah") If the request comes from IP 10.20.20.20 and user bob then use home_server_pool yyy (and return attribute "yadda yadda yadda") If the request comes from IP 10.30.30.30 and user bob then use home_server_pool zzz (and return results from SQL query "xxxxx") I can see how this is done when making the user enter a realm name or prefix or suffix to the username, but I don't want to do that for every authentication. I want the authentication method to be selected based on the client. I have been searching for details on all the configuration files but I am not finding anything very conclusive or explanatory on how to build custom sites. Any help would be appreciated. Thanks for your help. JerLasVegas

2 4

AW: RE: Help with chap
by Matthias Nagel 21 May '13

21 May '13

Hello, actually this behaviour is totally correct. The switch tries to authenticate a client, when the switch learns the clients MAC address. As the MAC address is extracted from the ethernet header there must be some packages sent from the client in order to do so. If the client is quiet, the switch cannot do anything about it. Matthias Matthias Nagel Willy-Andreas-Allee 1, Zimmer 506 76131 Karlsruhe Telefon: +49-721-8695-1506 Mobil: +49-151-15998774 ICQ: 499797758 Skype: nagmat84"Franks Andy (RLZ) IT Systems Engineer" <Andy.Franks(a)sath.nhs.uk> hat geschrieben:..Just an update.. might be interesting for people - rebooted the switch and not all clients were authenticated, but it seems all those that weren't have 0 bytes for all statistics, tx, rx etc. So I guess they are switched off and the switch seems to need some packets to flow for it to "detect" that the client needs authenticating. Otherwise it looks like it will sit with the port in an up state unathenticated all day long. I guess this sort of makes sense, but in my simple view of how things this isn't intuitive. Also HP manuals don't seem to mention it.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 21 May 2013 22:27 To: FreeRadius users mailing list Subject: RE: Help with chap Thanks Phil. I'll keep that up my sleeve for future use. We tend to separate admin / wireless / mac-based auth off on to different radius boxes. Keeps things a bit easier. Not sure what cisco do, but a lot of their stuff tends to be pap or eap. HP doing chap here seems to limit quite a lot of backend options. It's still also the only protocol, or so it seems, chosen for iscsi authentication which is an interesting choice consider it's vulnerabilites. Guess ipsec gets used instead where it needs to be secure. Now to work out the useraccountcontrol setting. Seems to be different in users and computers than in an ldap viewer, but the ldap is probably a decimal conversion or something. Thanks again Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 21 May 2013 08:06 To: freeradius-users(a)lists.freeradius.org Subject: Re: Help with chap On 05/21/2013 07:55 AM, Franks Andy (RLZ) IT Systems Engineer wrote: > Can I just use the authorize section to set the password to be the > same as the username, i.e. the mac address, after checking some basics > like whether the user exists in ldap and perhaps the > useraccountcontrol value, then in the authorize section just let the > chap bit work on the assigned password? Yes. In fact that's the best approach. Something like: authorize { ... if (some condition) { update control { Cleartext-Password := "%{User-Name}" } } ... } "some condition" would normally be some sort of check to ensure it was a macauth-via-CHAP request - obviously you wouldn't want to force password==username for a PPP/EAP/other "real" user request. On the other hand if your server / virtual server only receives this traffic, you can omit the condition. I really dislike vendors who do macauth as CHAP. It seems to completely lack value, and adds complexity. Le sigh.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Help with chap
by Franks Andy (RLZ) IT Systems Engineer 21 May '13

21 May '13

..Just an update.. might be interesting for people - rebooted the switch and not all clients were authenticated, but it seems all those that weren't have 0 bytes for all statistics, tx, rx etc. So I guess they are switched off and the switch seems to need some packets to flow for it to "detect" that the client needs authenticating. Otherwise it looks like it will sit with the port in an up state unathenticated all day long. I guess this sort of makes sense, but in my simple view of how things this isn't intuitive. Also HP manuals don't seem to mention it.. Thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Franks Andy (RLZ) IT Systems Engineer Sent: 21 May 2013 22:27 To: FreeRadius users mailing list Subject: RE: Help with chap Thanks Phil. I'll keep that up my sleeve for future use. We tend to separate admin / wireless / mac-based auth off on to different radius boxes. Keeps things a bit easier. Not sure what cisco do, but a lot of their stuff tends to be pap or eap. HP doing chap here seems to limit quite a lot of backend options. It's still also the only protocol, or so it seems, chosen for iscsi authentication which is an interesting choice consider it's vulnerabilites. Guess ipsec gets used instead where it needs to be secure. Now to work out the useraccountcontrol setting. Seems to be different in users and computers than in an ldap viewer, but the ldap is probably a decimal conversion or something. Thanks again Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 21 May 2013 08:06 To: freeradius-users(a)lists.freeradius.org Subject: Re: Help with chap On 05/21/2013 07:55 AM, Franks Andy (RLZ) IT Systems Engineer wrote: > Can I just use the authorize section to set the password to be the > same as the username, i.e. the mac address, after checking some basics > like whether the user exists in ldap and perhaps the > useraccountcontrol value, then in the authorize section just let the > chap bit work on the assigned password? Yes. In fact that's the best approach. Something like: authorize { ... if (some condition) { update control { Cleartext-Password := "%{User-Name}" } } ... } "some condition" would normally be some sort of check to ensure it was a macauth-via-CHAP request - obviously you wouldn't want to force password==username for a PPP/EAP/other "real" user request. On the other hand if your server / virtual server only receives this traffic, you can omit the condition. I really dislike vendors who do macauth as CHAP. It seems to completely lack value, and adds complexity. Le sigh.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Help with chap
by Franks Andy (RLZ) IT Systems Engineer 21 May '13

21 May '13

Thanks Phil. I'll keep that up my sleeve for future use. We tend to separate admin / wireless / mac-based auth off on to different radius boxes. Keeps things a bit easier. Not sure what cisco do, but a lot of their stuff tends to be pap or eap. HP doing chap here seems to limit quite a lot of backend options. It's still also the only protocol, or so it seems, chosen for iscsi authentication which is an interesting choice consider it's vulnerabilites. Guess ipsec gets used instead where it needs to be secure. Now to work out the useraccountcontrol setting. Seems to be different in users and computers than in an ldap viewer, but the ldap is probably a decimal conversion or something. Thanks again Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 21 May 2013 08:06 To: freeradius-users(a)lists.freeradius.org Subject: Re: Help with chap On 05/21/2013 07:55 AM, Franks Andy (RLZ) IT Systems Engineer wrote: > Can I just use the authorize section to set the password to be the > same as the username, i.e. the mac address, after checking some basics > like whether the user exists in ldap and perhaps the > useraccountcontrol value, then in the authorize section just let the > chap bit work on the assigned password? Yes. In fact that's the best approach. Something like: authorize { ... if (some condition) { update control { Cleartext-Password := "%{User-Name}" } } ... } "some condition" would normally be some sort of check to ensure it was a macauth-via-CHAP request - obviously you wouldn't want to force password==username for a PPP/EAP/other "real" user request. On the other hand if your server / virtual server only receives this traffic, you can omit the condition. I really dislike vendors who do macauth as CHAP. It seems to completely lack value, and adds complexity. Le sigh.. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

RE: Limit ADSL speed using radius?
by Parham Beheshti 21 May '13

21 May '13

Tom, When you receive radius packets, you can pretty much tell what it is from the headers them selves. Usually there are some hints in the attribute or the way they format stuff. Can you post one of the packets with all attributes NAS is sending you? Maybe I can guess what it is. But for sure mikrotik attributes will not work. 450k user is nothing for freeradius ... Regards, Parham

4 3

Does freeradius support EAP PEAP/TLS or EAP PEAP/EAP-TLS ?
by Robert 21 May '13

21 May '13

Hi I use freeradius v2.1.10 in Debian Squeeze 6.0.1. I want to know if freeradius supports the following methods : l EAP PEAP/TLS l EAP PEAP/EAP-TLS ? The client I use is wpa_supplicant v0.6.9. Regards, Robert

4 7

RE: Does freeradius support EAP PEAP/TLS or EAP PEAP/EAP-TLS ?
by Franks Andy (RLZ) IT Systems Engineer 21 May '13

21 May '13

Just confirming that I've tested this in the past and it works, but I believe the poster of the article is dubious about a production environment. When I tried it on wifi it took a second or so more to authenticate for some reason, so we eventually went with eap-tls instead because of this and because it was simpler. I did also get quite a few "The EAP message did not complete" but that could be coincidental. -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Phil Mayers Sent: 20 May 2013 10:51 To: freeradius-users(a)lists.freeradius.org Subject: Re: Does freeradius support EAP PEAP/TLS or EAP PEAP/EAP-TLS ? On 20/05/13 09:02, Robert wrote: > Hi > > I use freeradius v2.1.10 in Debian Squeeze 6.0.1. > > I want to know if freeradius supports the following methods : See here: http://notes.asd.me.uk/2012/01/20/freeradius-with-peap-eap-tls-for-micro soft-soh/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

RE: Help with chap
by Franks Andy (RLZ) IT Systems Engineer 21 May '13

21 May '13

Hi again, Hmm, I'll need to keep my eye on it then. It may have just been having a good day. The vm host is pretty gutsy, so I doubt processing power would cause such an issue for it as a host. The switch is as from the factory, just with upgraded software (to try and get rid of the issues). A reply to the original email said they have a similar setup working ok. Maybe I should power cycle the thing and see how long that takes to do all the clients... Sorry for the long sentence; midnight ramblings. In summary, the question was: Can I just use the authorize section to set the password to be the same as the username, i.e. the mac address, after checking some basics like whether the user exists in ldap and perhaps the useraccountcontrol value, then in the authorize section just let the chap bit work on the assigned password? I guess it would work but is it a bad idea? Just trying to extend my knowledge/proper use of the tool in case i need to use chap in the future. thanks Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 21 May 2013 00:21 To: FreeRadius users mailing list Subject: Re: Help with chap Franks Andy (RLZ) IT Systems Engineer wrote: > Thanks for the help. > Anecdotally, before I get into serious discovery, I've been running > the freeradius process in extra debugging mode -xx. I'd read somewhere > that -X makes it run single threaded, but along those lines of > thinking I wondered if -xx and the extra debug was causing any > performance issues. I may be off at completely the wrong tangent, but > the problem is interesting and I like the odd tangent.. Single-threaded versus multiple threads doesn't usually make a big difference. > Anyway, anecdotally as I said, with the server running in fresh from a > reboot, no debugging, and upping the vm to 4 core instead of 1 (just > playing), the problem seems vastly reduced. Nearly all clients are > authenticated within 10 seconds, Any modern CPU should be able to do 100's of EAP sessions per second. If yours can't do that, it was under-provisioned. That's why adding more CPUs helped: you gave it more CPU power. > the consistent off ones are some > ancient mitel voip phones with pcs running off the back, which the > switch simply doesn't "see" for ages. It just sits there and > eventually just sends an auth request. In many cases the switch "sec" > debug doesn't even report the mac address or any activity for this > weird phone, but the FR linelog shows it authenticated fine. Really strange. Well, that's a switch problem. > By the way, if I was to do chap, since I'm running ldap against AD - > no available plaintext or other passwords, but I'm running mac-based > auth, can I just use the authorize process to check for "notfound" and > check the useraccountcontrol setting is correct from an attribute > mapping (or just use the useraccountcontrol in an ldap filter and rely > on not found), then just set the cleartext-password attribute to be > %{username} using some more unlang , then do nothing special in the > chap authentication bit, just let it "ok" with the plaintext password > or is that just all wrong? I figure I don't *really* need a password > for mac-based auth, since it's always going to be == to the username? That's one huge sentence. I can't make heads or tails of it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1

Limit ADSL speed using radius?
by Cooper, Tom 21 May '13

21 May '13

Hi all, How can one limit the ADSL speed on a per customer basis using freeradius? I have been trying a radiusReplyItem: Microtik-Rate-Limit += 512k/1024k, which people recommend, but it does not look like it is working. I have been surfing the freeradius wiki for days now but no luck. I am using freeradius2-2.1.12-3.el5. Regards, To read FirstRand Bank's Disclaimer for this email click on the following address or copy into your Internet browser: https://www.fnb.co.za/disclaimer.html If you are unable to access the Disclaimer, send a blank e-mail to firstrandbankdisclaimer(a)fnb.co.za and we will send you a copy of the Disclaimer.

9 11

RE: Help with chap
by Franks Andy (RLZ) IT Systems Engineer 20 May '13

20 May '13

Thanks for the help. Anecdotally, before I get into serious discovery, I've been running the freeradius process in extra debugging mode -xx. I'd read somewhere that -X makes it run single threaded, but along those lines of thinking I wondered if -xx and the extra debug was causing any performance issues. I may be off at completely the wrong tangent, but the problem is interesting and I like the odd tangent.. Anyway, anecdotally as I said, with the server running in fresh from a reboot, no debugging, and upping the vm to 4 core instead of 1 (just playing), the problem seems vastly reduced. Nearly all clients are authenticated within 10 seconds, the consistent off ones are some ancient mitel voip phones with pcs running off the back, which the switch simply doesn't "see" for ages. It just sits there and eventually just sends an auth request. In many cases the switch "sec" debug doesn't even report the mac address or any activity for this weird phone, but the FR linelog shows it authenticated fine. Really strange. Any else got any reports of the procurve switches just sitting there waiting for something to happen? The failure of the responses seemed previously to have kicked the switch into waiting ages then retrying later (the retry is set to 30 seconds but it was way longer). Anyway, the lack of debug seems to have helped quite a bit. By the way, if I was to do chap, since I'm running ldap against AD - no available plaintext or other passwords, but I'm running mac-based auth, can I just use the authorize process to check for "notfound" and check the useraccountcontrol setting is correct from an attribute mapping (or just use the useraccountcontrol in an ldap filter and rely on not found), then just set the cleartext-password attribute to be %{username} using some more unlang , then do nothing special in the chap authentication bit, just let it "ok" with the plaintext password or is that just all wrong? I figure I don't *really* need a password for mac-based auth, since it's always going to be == to the username? Thanks for the input Andy -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradiu s.org] On Behalf Of Alan DeKok Sent: 20 May 2013 14:01 To: FreeRadius users mailing list Subject: Re: Help with chap Franks Andy (RLZ) IT Systems Engineer wrote: > Thanks Alan, > It takes literary a second or so for a single client auth, but > problems arise with multiple clients. I'll reset a card on the switch > and capture the logs and see what's happening. Nothing as far as I > remember pointed towards the ntlm_auth being the issue, it was the > failure to complete the eap transaction that seemed to be the problem, > but then I didn't scan each and every line to be honest. See http://deployingradius.com/ It has instructions for testing PEAP via eapol_test. That lets you do some limited performance checks. An alternative is to configure a static user/password. Do performance checks using that user. If it's a lot faster than ntlm_auth, then the problem is likely ntlm_auth. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

2 1