- Freeradius-Users - lists.freeradius.org

Wiki requires email?
by Phil Mayers 27 Dec '12

27 Dec '12

I can no longer log into the wiki with my github account - seems the wiki now requires that I expose an email publicly in my github profile (something I am not going to do). Is this intentional? What's the rationale?

2 1

Re: 802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

@Phil, Thanks for the info - appreciate the professional response....I'll do some additional research. On Thu, 27 Dec 2012 10:13:43 -0500 "Phil Mayers" <p.mayers(a)imperial.ac.uk> wrote: >On 12/27/2012 02:32 PM, spartan1833(a)hushmail.com wrote: > >> I played around with the users file in FreeRADIUS but it didn't >> seem to have any effect unless I put a DEFAULT Auth-Type Reject >in >> the file which blocked everyone regardless of what else I had in >> the users file. I've Googled around a bit but haven't found any >> definitive guides on how I would do a FreeRADIUS analog to >Windows >> IAS/NPS policies other than having to include ldap servers >and/or >> other types of external authentication systems which I'm not >really >> interested (at this point) in doing. > >LDAP is not an authentication system (not really). It's a >directory, >which is a form of database. > >You are, obviously, going to need some form of "database" in which >your >policy "memberships" are stored; FreeRADIUS provides several built- >in >modules (LDAP, SQL, files, passwd-style) that can do this. > >However - you're going to run into the fact that EAP-TLS as >implemented >in the 2.x branch doesn't offer very much in the way of >authorization - >the only place you can run a database lookup and be sure you have >the >TLS cert details is post-auth (a virtual server step was added in >master/3.x). > >Basically: > > 1. Define a local attribute in raddb/dictionary to hold your >groups. >Note carefully the stuff in the default dictionary file about >local >attribute numbers. > > 2. Configure one of the various data lookup modules (passwd and >files >are the simplest but least flexible) to lookup the groups based on >the >TLS cert attributes (see below) > > 3. Run this module in the post-auth section, and act on the >result. > >raddb/sites-available/default contains comments to this effect in >post-auth - search for "TLS-Client" in that file, which also tells >you >the various TLS cert attributes you can use. > >About the only difficult bit is step 2; I thought I'd written >something >in the wiki about this, but I can't find it (and I can't log in >anymore). > >If you've got a more specific question, I'll try to reply, but >you'll >need to do a bit of research into the various "database" modules >and >decide which one you want to use first. >- >List info/subscribe/unsubscribe? See >http://www.freeradius.org/list/users.html

1 0

802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

Hi, First post and new to FreeRadius though have been using RADIUS in the Windows world for many years. I have a small network with a Linux server and a mix of Windows XP and Windows 7 laptops that I am trying to run 802.1x authentication on. I only want to use computer/machine auth (user auth handled elsewhere) so I have FreeRADIUS set up to use EAP-TLS. I have the CA cert and the appropriate client certs installed on the laptops and appropriate client configurations for the switch and AP. I've also config'd the laptops to use machine auth only. 802.1x appears to be working; any laptop with the certs/config is able to access the wired and/or wireless network and any laptop without is denied access. However, in my previous experience with RADIUS (IAS/NPS in the Windows world), I am able to control access at a policy level as well; any machine not part of a specific group is denied access, regardless of what certificate is installed and what configuration is present on the laptop. I played around with the users file in FreeRADIUS but it didn't seem to have any effect unless I put a DEFAULT Auth-Type Reject in the file which blocked everyone regardless of what else I had in the users file. I've Googled around a bit but haven't found any definitive guides on how I would do a FreeRADIUS analog to Windows IAS/NPS policies other than having to include ldap servers and/or other types of external authentication systems which I'm not really interested (at this point) in doing. Guessing that I'm missing something so hoping that someone elss has done this or can guide me in how to do local (to the RADIUS server) machine policies - I just want to be able to say "laptop1234...", etc are part of a local group and are authorized (provided that they are properly provisioned with certs, etc). Any thoughts - thanks in advance :)

3 2

Question about the behavior of sql.conf
by ichiro tanaka 27 Dec '12

27 Dec '12

Hello I'm using freeradius 2.1.12. I'm trying to set up sql.conf. But there is one question. I made a set of 'safe-character' connection config of the sql.conf. However,the safe-character's being used in connection is the last(B) (When I use the A.but B will be used in this case) Do you think there is a reason what is this? Please tell me if you like... ========(debug log) Thu Dec 27 11:55:42 2012 : Debug: Module: Instantiating module "A" from file /usr/local/radius/etc/raddb/sql.conf Thu Dec 27 11:55:42 2012 : Debug: A { . . . Thu Dec 27 11:55:42 2012 : Debug: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:/!#$%+()=~^[]><{}?&`*\"" Thu Dec 27 11:55:42 2012 : Debug: } . . . Thu Dec 27 11:55:42 2012 : Debug: Module: Instantiating module "B" from file /usr/local/radius/etc/raddb/sql.conf Thu Dec 27 11:55:42 2012 : Debug: B { . . . Thu Dec 27 11:55:43 2012 : Debug: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Thu Dec 27 11:55:43 2012 : Debug: } ========

3 3

Fwd: FW:
by Arpit Jain 27 Dec '12

27 Dec '12

Hi, I am sending an Access-Request packet using radeapclient without password,** ** I am giving the following attributes in radeapclient:**** User-Name= "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** ** ** ** ** But server is sending Access-Reject to the request.**** Following are the logs of radeapclient:**** ** ** User-Name= "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = "testuser"**** Message-Authenticator = 0x00**** ** ** ** ** +++> About to send encoded packet:**** User-Name = "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = "testuser"**** Message-Authenticator = 0x00**** <+++ EAP decoded packet:**** EAP-Message = 0x01d3001604107b44069aa80b67319a536bfd4f8ac713**** Message-Authenticator = 0xb4499f3ee54742d9dd8469980720dcf6**** State = 0x8a52e3488a81e7f33f4b54075fcd3936**** EAP-Id = 211**** EAP-Code = Request**** EAP-Type-MD5 = 0x107b44069aa80b67319a536bfd4f8ac713**** ** ** +++> About to send encoded packet:**** User-Name = "testuser"**** EAP-Code = Response**** EAP-Id = 211**** Message-Authenticator = 0x00000000000000000000000000000000**** EAP-Type-MD5 = 0x10d2c45d5e328b2b2db8bd66c7d171635d**** State = 0x8a52e3488a81e7f33f4b54075fcd3936**** <+++ EAP decoded packet:**** EAP-Message = 0x04d30004**** Message-Authenticator = 0xf6f7e2707ef22ea86a660a4ddce7fb30**** EAP-Id = 211**** EAP-Code = Failure**** ** ** On further investigation, i found an example to test eap-md5 in the source code{ freeradius-2.1.8 } in src/tests**** ** ** Example is :**** ** ** echo 'User-Name = "eapmd5"'**** echo 'Cleartext-Password = "md5md5"'**** echo 'NAS-IP-Address = marajade.sandelman.ottawa.on.ca'**** echo 'EAP-Code = Response'**** echo 'EAP-Id = 210'**** echo 'EAP-Type-Identity = "eapsim'**** echo 'Message-Authenticator = 0'**** echo 'NAS-Port = 0' )**** ** ** ** ** But EAP RFC3579 and RFC2869 states that User-Password should not be part of a radius packet containing EAP-Message attribute,**** ** ** **** it written that “An Access-Request that contains either a User-Password or** ** CHAP-Password or ARAP-Password or one or more EAP-Message attributes**** MUST NOT contain more than one type of those four attributes. If it**** does not contain any of those four attributes, it SHOULD contain a**** Message-Authenticator. If any packet type contains an EAP-Message**** attribute it MUST also contain a Message-Authenticator.”**** ** ** ** ** Please let me know if any specific configuration need to be done on the server so that server sends Access-Accept.**** **** ** ** Thanks in advance. Arpit

2 1

(no subject)
by Arpit Jain 27 Dec '12

27 Dec '12

Hi, can we send accounting request using radeapclient ??**** **** I am getting the following error:**** ** ** radeapclient -x 172.168.200.15 acct testing123**** User-Name= " testuser "**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** ** ** ** ** +++> About to send encoded packet:**** User-Name = " testuser "**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** rlm_eap: EAP-Message not found**** <+++ EAP decoded packet:**** ** Regards, Arpit

2 1

Lost user
by Dmitry Korzhevin 27 Dec '12

27 Dec '12

Hi, Can you please give advice in next situation: mysql> SELECT * FROM `radpostauth` WHERE `username` LIKE '{E6395348-49C3-C12A-2998-B60329D0CA5C}'; +-------+----------------------------------------+------+---------------+---------------------+ | id | username | pass | reply | authdate | +-------+----------------------------------------+------+---------------+---------------------+ | 24825 | {E6395348-49C3-C12A-2998-B60329D0CA5C} | | Access-Accept | 2012-12-16 04:20:59 | +-------+----------------------------------------+------+---------------+---------------------+ 1 row in set (0.00 sec) mysql> SELECT * FROM `radacct` WHERE `username` LIKE '{E6395348-49C3-C12A-2998-B60329D0CA5C}'; Empty set (0.00 sec) mysql> I have user in table radpostauth, but i can't find same user in table radacct. How could it be? http://dpaste.com/852738/ Nothing in logs: grep -r "{E6395348-49C3-C12A-2998-B60329D0CA5C}" /var/log/freeradius/ Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

4 6

how to read db files?
by Periko Support 26 Dec '12

26 Dec '12

Hi guys. Exist a way to read freeradius db files? db.daily, etc, etc. This are berkeley db files or what type of are those? I'm using flat files not sql settings. FR 2.x, thanks!!!

1 0

Re: Lost user
by Alan Buxey 26 Dec '12

26 Dec '12

As Alan has said, your radpostauth table has an entry because the RADIUS server dealt with an auth request...your radact table entry has no entry likely because no accounting packet was received. Run in debug mode and see what occurs alan

1 0

radusergroup without primary key
by Efi merdler 26 Dec '12

26 Dec '12

Hello, I'm using radius 2.1.12 with postgresql as a backend. I've noticed that radusergroup does not contain any key column. There is a complaint on the subject posted back in 2007 (http://lists.freeradius.org/pipermail/freeradius-devel/2007-August/003239.h…) however nobody addressed it. We are accessing the table from an external process and it requires a primary key to be successful, how would you recommend handling it ? Cheers

3 4