- Freeradius-Users - lists.freeradius.org

(no subject)
by Yashaswini Sathyanarayana 14 Jan '13

14 Jan '13

Hi all, I want to configure the free radius to return access- reject based on the value of a particular column in database . How do i do that ??? please help.... Thanks & Regards, Yashaswini | Prod Engg | Tech Mahindra Ltd. 9 / 7 Hosur Road, Bangalore - 560029, India. (Office: +91 80 40243000, Extn: 3478 Mobile: +91 9611591177 www.techmahindra.com <http://www.techmahindra.com/> ============================================================================================================================ Disclaimer: This message and the information contained herein is proprietary and confidential and subject to the Tech Mahindra policy statement, you may review the policy at <a href="http://www.techmahindra.com/Disclaimer.html">http://www.techmahindra.com/Disclaimer.html</a> externally and <a href="http://tim.techmahindra.com/tim/disclaimer.html">http://tim.techmahindra.com/tim/disclaimer.html</a> internally within Tech Mahindra. ============================================================================================================================

2 1

EAP-SIM Authentication Failure-FreeRadius-V2.2.0
by Ratnesh Sinha 13 Jan '13

13 Jan '13

Hi, I am trying to test EAP-SIM Authentication using 802.1x Access Node and a Wifi enabled phone with EAP-SIM support. I have configured Radius Server 2.2.0 based on instructions. I am getting the following error: [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT ############################################################################ ############################### The full trace below: ############################################################################ ############################### Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=7, length=244 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013134303434353030313234373839333540776c616e2e6d6e633034352e6d6363 3430342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x558781ab0d6f653bc2fcf8af9ee61260 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 245 ++[eap] returns handled Sending Access-Challenge of id 7 to 10.0.0.1 port 1047 EAP-Message = 0x01f50014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf445757cf4b067d13eec4c46dac51c4a Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=8, length=294 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f50058120a00000705000021846d8ebd5ce97d1b79c5501a95ac64100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0xf445757cf4b067d13eec4c46dac51c4a Message-Authenticator = 0xe1d4bbed7648690e15b0720f9277206c # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 245 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f50058120a00000705000021846d8ebd5ce97d1b79c5501a95ac64100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0xf445757cf4b067d13eec4c46dac51c4a Message-Authenticator = 0xe1d4bbed7648690e15b0720f9277206c EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x000021846d8ebd5ce97d1b79c5501a95ac64 EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333134303434353030313234373839333540776c616e2e6d6e633034352e6d6363343034 2e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 246 ++[eap] returns handled Sending Access-Challenge of id 8 to 10.0.0.1 port 1047 EAP-Message = 0x01f60050120b0000010d000030000000000000000000000000000000310000000000000000 00000000000000320000000000000000000000000000000b050000bb28c3433b5a561015daaf 0ea141811e Message-Authenticator = 0x00000000000000000000000000000000 State = 0xf445757cf5b367d13eec4c46dac51c4a Finished request 1. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=9, length=218 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02f6000c120e000016010000 State = 0xf445757cf5b367d13eec4c46dac51c4a Message-Authenticator = 0xca05315c11be75a0938baf8f708367e2 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 246 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 2 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 2 Sending Access-Reject of id 9 to 10.0.0.1 port 1047 EAP-Message = 0x04f60004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.9 seconds. Cleaning up request 0 ID 7 with timestamp +19 Cleaning up request 1 ID 8 with timestamp +19 Waking up in 4.0 seconds. Cleaning up request 2 ID 9 with timestamp +22 Ready to process requests. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=10, length=244 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02000038013134303434353030313234373839333540776c616e2e6d6e633034352e6d6363 3430342e336770706e6574776f726b2e6f7267 Message-Authenticator = 0x74523b39f4caeb2704555e3a35630534 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 56 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] EAP Identity [eap] processing type sim [eap] Underlying EAP-Type set EAP ID to 255 ++[eap] returns handled Sending Access-Challenge of id 10 to 10.0.0.1 port 1047 EAP-Message = 0x01ff0014120a00000f0200020001000011010100 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x067ab3ff0685a127aaec9be0764c9b76 Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=11, length=294 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02ff0058120a000007050000f3c0d40d24735995cd2aa194ccc3e9ae100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0x067ab3ff0685a127aaec9be0764c9b76 Message-Authenticator = 0x4e16bb97083e9c782af073721b309c20 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 255 length 88 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim +++> EAP-sim decoded packet: User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x02ff0058120a000007050000f3c0d40d24735995cd2aa194ccc3e9ae100100010e0e003331 34303434353030313234373839333540776c616e2e6d6e633034352e6d63633430342e336770 706e6574776f726b2e6f726700 State = 0x067ab3ff0685a127aaec9be0764c9b76 Message-Authenticator = 0x4e16bb97083e9c782af073721b309c20 EAP-Type = SIM EAP-Sim-Subtype = Start EAP-Sim-NONCE_MT = 0x0000f3c0d40d24735995cd2aa194ccc3e9ae EAP-Sim-SELECTED_VERSION = 0x0001 EAP-Sim-IDENTITY = 0x00333134303434353030313234373839333540776c616e2e6d6e633034352e6d6363343034 2e336770706e6574776f726b2e6f726700 [eap] Underlying EAP-Type set EAP ID to 0 ++[eap] returns handled Sending Access-Challenge of id 11 to 10.0.0.1 port 1047 EAP-Message = 0x01000050120b0000010d000030000000000000000000000000000000310000000000000000 00000000000000320000000000000000000000000000000b0500008ed118746ac218cc6ea072 1d59d42518 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x067ab3ff077aa127aaec9be0764c9b76 Finished request 4. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 10.0.0.1 port 1047, id=12, length=218 User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" NAS-IP-Address = 10.0.0.1 NAS-Port = 0 Called-Station-Id = "0A-09-0F-E9-1C-A2:fortinet" Calling-Station-Id = "44-A7-CF-BC-A0-67" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x0200000c120e000016010000 State = 0x067ab3ff077aa127aaec9be0764c9b76 Message-Authenticator = 0x9a08d17e00177ea24b2a90933b12d4c0 # Executing section authorize from file /usr/local/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] Looking up realm "wlan.mnc045.mcc404.3gppnetwork.org" for User-Name = "1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org" [suffix] No such realm "wlan.mnc045.mcc404.3gppnetwork.org" ++[suffix] returns noop rlm_sim_files: authorized user/imsi 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org rlm_sim_files: Adding EAP-Type: eap-sim ++[sim_files] returns ok [eap] EAP packet type response id 0 length 12 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/sim [eap] processing type sim [eap] Handler failed in EAP/sim [eap] Failed in EAP select ++[eap] returns invalid Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /usr/local/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 5 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 5 Sending Access-Reject of id 12 to 10.0.0.1 port 1047 EAP-Message = 0x04000004 Message-Authenticator = 0x00000000000000000000000000000000 Waking up in 0.9 seconds. Cleaning up request 3 ID 10 with timestamp +29 Cleaning up request 4 ID 11 with timestamp +29 Waking up in 4.0 seconds. Cleaning up request 5 ID 12 with timestamp +32 Ready to process requests. ############################################################################ ############################### simtriplets.dat content below ############################################################################ ############################### 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,300000000000000000000000 00000000,30112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,310000000000000000000000 00000000,31112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,320000000000000000000000 00000000,32112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,330000000000000000000000 00000000,33112233,445566778899AABB 1404450012769612(a)wlan.mnc045.mcc404.3gppnetwork.org,340000000000000000000000 00000000,34112233,445566778899AABB ############################################################################ ############################### Regards, Ratnesh

1 0

dhcp sqlippool reauthenticate users every minute
by Ethan Hayon 12 Jan '13

12 Jan '13

Hi, I'm trying to set up FreeRADIUS 2.2 to act as an authentication and accounting system as well as a DHCP server. (I'm relaying DHCP requests from a pfSense box). I am trying to use sqlippools on FreeRADIUS, but I have noticed that my ippools are filling up quickly (I am only testing with two devices). I have pfSense configured to reauthenticate user every minute, so I believe that FreeRADIUS is running post-auth dhcp leasing each time the user is reauthenticated. FreeRADIUS is serving the same client a new IP address each minute. I have adjusted my policy conf to the below. I may be approaching this the wrong way, but this is essentially what I am trying to do: I want to have multiple pools on different subnets. When a new client connects to the network (they don't yet have a radius account) they are sent to a default (pending) pool. This may be on the 192.168.1/24 subnet. After they have set up their account and have been added to the RADIUS database, they will be given a pool-name, maybe `pool2`. `pool2` will be on a different subnet, for example, 192168.2/24. The pfsense box knows how to route these subnets, so that is not a problem. I only want clients to receive a different IP address if their pool-name changes for whatever reason, if there are no changes to their account, they shouldn't be leased a new IP every time they reauthenticate (every minute). Eventually I will disable the reauthenticate every minute feature as the production system would not be able to handle this many requests. Am I approaching this problem correctly? I have written some un-lang in the policy.conf file for handling some of this. I am getting hung up on this problem. The pool is getting exhausted in minutes since each client is leased a new ip every minute. Any help is appreciated! Thanks, Ethan …. dhcp_sqlippool.post-auth { # Do some minor hacks to the request so that it looks # like a RADIUS request to the SQL IP Pool module. # check whether the requester is a user or not, if they do not have a pool-name, send them to pfpriv by default if("%{sql: SELECT COUNT(*) FROM radcheck where username='%{DHCP-Client-Hardware-Address}' AND attribute='Pool-Name'}" != "0") { update control { Pool-Name := "%{sql: SELECT `value` FROM radcheck WHERE username = '%{DHCP-Client-Hardware-Address}' AND attribute='Pool-Name'}" } } else { update control { Pool-Name := "pfpriv" # default pool if the user doesn't have an account } } update reply { DHCP-Domain-Name-Server = "192.168.1.1" # we will ultimately create a mysql table `radpoolinfo` to store per-pool attributes DHCP-Router-Address = "192.168.0.1" # this will also be in `radpoolinfo` eventually } update request { User-Name = "DHCP-%{DHCP-Client-Hardware-Address}" Calling-Station-Id = "%{DHCP-Client-Hardware-Address}" NAS-IP-Address = "%{%{DHCP-Gateway-IP-Address}:-127.0.0.1}" Acct-Status-Type = Start } # Call the actual module # # Uncomment this in order to really call it! dhcp_sqlippool #fail # Convert Framed-IP-Address to DHCP, but only if we # actually allocated an address. if (ok) { update reply { DHCP-Your-IP-Address = "%{reply:Framed-IP-Address}" } } } …

2 5

C External Program
by Ali Majdzadeh 11 Jan '13

11 Jan '13

Hi I wrote the following code to accept any user/pass in a C external program: Main() { fprintf (stdout, "Auth-Type := Accept\n"); return 0; } It works well with PAP but does not work in CHAP/MSCHAP. I know I should return Cleartext-Password but I want to permit any user/pass to loggin in. So how can I do that?

1 0

rlm_perl changing User-Name and proxy requests
by Ti Leggett 11 Jan '13

11 Jan '13

I have an issue with rlm_perl changing the request User-Name attribute but the proxy request not honoring it. First I'll describe what I'm trying to accomplish and why and then what I'm doing. I'm running a branch of 2.2.1 that has some krb5 realm fixes in it. I have multiple realms that users can authenticate against: our division has replayable password (handled by kerberos) and one time passwords (handled by both YubiKeys and Crypto Card), our lab has replayable passwords (handled by AD) and a separate one time password system (handled by Crypto Card). For services that we want to allow replayable passwords (like IMAP access for instance), we want to allow the user to choose which service to use (division or lab). For services requiring OTP we want the user to choose which OTP token they want to use (some people have multiple because of external requirements). We want users to be able to change these auth preferences on their own and not have this require changing the RADIUS configuration (a.k.a., the users file) to do this. Our account information is kept in LDAP. This is all well and good except that usernames between the division and the lab aren't guaranteed to match - User A might have lastname as their division name, but lastnamefirst as their lab username. For the kerberos and AD request the RADIUS server can handle the request directly using rlm_krb5, but for all the OTP requests the server must proxy to the correct OTP server to handle the request. Here's my plan for accomplishing this. During authorization, rlm_ldap is used to make sure if the user is in LDAP. If not the request is rejected outright (this should help with brute force attempts bogging down all the servers for bogus attempts). Next an rlm_perl module is called to get the user's preferred realm and what username to use in that realm from LDAP. An example would be leggett@ yubi.division.example.com (signifying that I want to use YubiKey from my division). The rlm_perl module updates the request User-Name to be this preference and Auth-Type to be System (see http://pastie.org/5670077) Lastly rlm_realm checks the request to determine if it should be proxied or not. The problem is this: Everything works if the username doesn't change. For instance, if I'm leggett(a)yubi.division.example.com and leggett(a)crypto.example.com, things work. The User-Name change being done by rlm_perl is being recognized by rlm_realm and rlm_realm is routing to the proper realm; however, rlm_realm seems to want to clobber User-Name in its own way, so that by the time proxying happens User-Name is set to whatever the initial username was - if I started the process as leggett and wanted my username to eventually be ti.leggett(a)crypto.example.com, by the time it reaches the proxy phase my User-Name attribute has been reset back to leggett even if I rerun the rlm_perl module after rlm_realm (see http://pastie.org/5670076) I notice that rlm_suffix doesn't overwrite the Stripped-User-Name rlm_perl adds, but appends another entry. This is fine for my purposes since the rlm_perl one is added first subsequent calls use that value. I'm afraid the same is happening with User-Name in that rlm_perl is appending another entry instead of overwriting the ones there. So is there any way around this or am I completely insane with this approach?

4 10

Different IP addresses from home radius server
by Greg Rutz 11 Jan '13

11 Jan '13

We are using FreeRadius 2.1.12 as a proxy to a remote radius server. The remote server (not under our direct control) receives RADIUS request messages on one IP address, but sends the response out a different interface (and thus has a diffferent IP). FreeRadius is rejecting the response since the IP does not match that of the request. Is there a way to configure FreeRadius to allow this? Greg

2 2

Re: LDAP Reply Attributes
by Alan Buxey 11 Jan '13

11 Jan '13

Switch config issue? Ensure your switch is configured to authorize over RADIUS as well as to authenticate over RADIUS. (sounds like its doing the latter but not the former) alan

2 1

LDAP Reply Attributes
by Tyler Brady 11 Jan '13

11 Jan '13

I'm sure this is an easy issue to solve, but my simple brain can't seem to put the pieces together. Any help would be greatly appreciated. I'm trying to authorize a login into a Cisco switch with admin privileges. Users: DEFAULT = LDAP-Group == Radius-Users" Reply-Message = "Welcome Message Test", Cisco-AVPair = "shell:priv-lvl=15" Note: I've tried many different combinations of attributes with no luck. (Service-Type = Administrative-User, Service-Type = NAS-Prompt-User) Output: Sending Access-Accept of id 61 to 172.28.64.3 port 1645 Reply-Message = "Welcome Message Test" Cisco-AVPair = "shell:priv-lvl=15" The switch login successfully shows "Welcome Message Test," but still kicks into user exec mode without applying the Cisco-AVPair = "shell:priv-lvl=15" I noticed that there is a mapping for the Reply-Message found in ldap.attrmap, but none for Cisco-AVPair. Is this why it's not working? If so, I have not been able to find the correct syntax for adding it to ldap.attrmap. Thanks in advance, T. Brady

1 0

Trying other authentication methods when the first is invalid
by Meyers, Dan 11 Jan '13

11 Jan '13

Sorry for the wall of tet, I'd rather give too much info than not enough. Our FreeRADIUS server (version 2.1.8 running on Ubuntu 10.04 LTS x64, installed from packages) currently does mac-based authentication of hosts onto edge switches using perl scripts (rlm_perl) talking to the API for our network access control system. I would like to extend this to also be able to support 802.1x based authentication, but only for certain specific networks (ones with access to more important servers or similar. For example the finance network should need 802.1x to auth, but our student residence network shouldn't as then no games consoles and the like would work). The initial method I had set up was to look for the presence of an EAP-Message in the request in the authorize section, and call the eap module if EAP-Message was present to set Auth-Type to EAP and then do authentication using eap (tls or peap) (and then expect to hand off to perl in post_auth just for the VLAN assignment) or to call the perl module to set Auth-Type as Perl if there was no EAP-Message, and handle it in authenticate as a simple MAC auth using perl. (The reason for not just calling eap then perl all the time is that the rlm_perl module, despite my authorize subroutine containing simply "$RAD_CHECK{'Auth-Type'} = 'Perl'; return RLM_MODULE_OK;", seems to alter the value of User-Name such that calling eap in authenticate *always* fails with the error "Identity does not match User-Name, setting from EAP Identity." and rejects the user if perl has been called in authorize, even if it is called after eap and the eap stanza reads "eap { ok = return }"). This worked fine on our HP Procurve switches. Anyway, we have got some Juniper EX2200 switches. The problem with these is that they do mac-auth as a 'fake' 802.1x auth. The request has the User-Name attribute set to the MAC address correctly, but also has an EAP-Message present, it just doesn't contain anything we want to have to care about (It actually contains, once the eap header has been decoded, the md5 of the mac-address). This causes the eap module, if called in authorize, to think the request should be handled by itself and set Auth-Type to EAP and expect to do eap-md5 (even if the default-auth-type in eap.conf is set to something else, like peap). However, as we do not actually want to do an eap-md5 auth we have no Cleartext-Password anywhere for the tens of thousands of MAC addresses (with new ones every day, which we auth onto a special 'unregistered' network with limited access instead of rejecting) on our network. The eap module in this case returns 'invalid' in authentication, rather than 'reject'. I was hoping I could detect this and tell it to move on to perl if this happened. I can't seem to make that work. As soon as eap returns invalid, all further processing is halted for that request and FreeRADIUS jumps straight to the Post-Auth REJECT section. Can anyone suggest a way around this? I was originally thinking that I could use the perl module after eap in authorize to check if the decoded eap data was simply an md5 hash of the MAC, and set Auth-Type to Perl even though there was an EAP-Message in that case, but of course if I ever then do that check on a valid 802.1x auth EAP breaks (as I mentioned above). Thanks for any help anyone can offer -- Dan Meyers Lancaster University

3 2

Compilling error
by Черкендов Александр Арма исович 11 Jan '13

11 Jan '13

Cann’t compile for CYGWIN version 2.2.1 & 2.2.0(stable) gcc -I/cygdrive/d/fr/freeradius-server-2.2.1 -I/cygdrive/d/fr/freeradius-server-2.2.1/src -g -O2 -Wall -D_GNU_SOURCE -D_REENTRANT -D_POSIX_PTHREAD_SEMANTICS -DNDEBUG -I/cygdrive/d/fr/freeradius-server-2.2.1/libltdl -I/cygdrive/d/fr/freeradius-server-2.2.1/src -I/cygdrive/d/fr/freeradius-server-2.2.1/libltdl radeapclient.c -o radeapclient radeapclient.c:40:23: фатальная ошибка: eap_types.h: No such file or directory Компиляция прервана. <builtin>: recipe for target `radeapclient' failed make[6]: *** [radeapclient] Error 1 File eap_types.h is situated in src/modules/rlm_eap/lib_eap dir. If I launch gcc -I lib_eap, I get: ... /tmp/ccD7XqGk.o: In function `debug_packet': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:182: undefined reference to `_fr_packet_codes' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:195: undefined reference to `_vp_prints' /tmp/ccD7XqGk.o: In function `send_packet': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:212: undefined reference to `_rad_send' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:268: undefined reference to `_rad_verify' /tmp/ccD7XqGk.o: In function `process_eap_challenge': /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:502: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:503: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:521: undefined reference to `_pairfind' /cygdrive/d/fr/freeradius-server-2.2.1/src/modules/rlm_eap/radeapclient.c:522: undefined reference to `_pairfind' ... As I found_pairfind is defined in xlat.c. How can I compile it?

1 0