- Freeradius-Users - lists.freeradius.org

802.1x computer authentication config issue/question
by spartan1833＠hushmail.com 27 Dec '12

27 Dec '12

Hi, First post and new to FreeRadius though have been using RADIUS in the Windows world for many years. I have a small network with a Linux server and a mix of Windows XP and Windows 7 laptops that I am trying to run 802.1x authentication on. I only want to use computer/machine auth (user auth handled elsewhere) so I have FreeRADIUS set up to use EAP-TLS. I have the CA cert and the appropriate client certs installed on the laptops and appropriate client configurations for the switch and AP. I've also config'd the laptops to use machine auth only. 802.1x appears to be working; any laptop with the certs/config is able to access the wired and/or wireless network and any laptop without is denied access. However, in my previous experience with RADIUS (IAS/NPS in the Windows world), I am able to control access at a policy level as well; any machine not part of a specific group is denied access, regardless of what certificate is installed and what configuration is present on the laptop. I played around with the users file in FreeRADIUS but it didn't seem to have any effect unless I put a DEFAULT Auth-Type Reject in the file which blocked everyone regardless of what else I had in the users file. I've Googled around a bit but haven't found any definitive guides on how I would do a FreeRADIUS analog to Windows IAS/NPS policies other than having to include ldap servers and/or other types of external authentication systems which I'm not really interested (at this point) in doing. Guessing that I'm missing something so hoping that someone elss has done this or can guide me in how to do local (to the RADIUS server) machine policies - I just want to be able to say "laptop1234...", etc are part of a local group and are authorized (provided that they are properly provisioned with certs, etc). Any thoughts - thanks in advance :)

3 2

Question about the behavior of sql.conf
by ichiro tanaka 27 Dec '12

27 Dec '12

Hello I'm using freeradius 2.1.12. I'm trying to set up sql.conf. But there is one question. I made a set of 'safe-character' connection config of the sql.conf. However,the safe-character's being used in connection is the last(B) (When I use the A.but B will be used in this case) Do you think there is a reason what is this? Please tell me if you like... ========(debug log) Thu Dec 27 11:55:42 2012 : Debug: Module: Instantiating module "A" from file /usr/local/radius/etc/raddb/sql.conf Thu Dec 27 11:55:42 2012 : Debug: A { . . . Thu Dec 27 11:55:42 2012 : Debug: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_:/!#$%+()=~^[]><{}?&`*\"" Thu Dec 27 11:55:42 2012 : Debug: } . . . Thu Dec 27 11:55:42 2012 : Debug: Module: Instantiating module "B" from file /usr/local/radius/etc/raddb/sql.conf Thu Dec 27 11:55:42 2012 : Debug: B { . . . Thu Dec 27 11:55:43 2012 : Debug: safe-characters = "@abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789.-_: /" Thu Dec 27 11:55:43 2012 : Debug: } ========

3 3

Fwd: FW:
by Arpit Jain 27 Dec '12

27 Dec '12

Hi, I am sending an Access-Request packet using radeapclient without password,** ** I am giving the following attributes in radeapclient:**** User-Name= "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** ** ** ** ** But server is sending Access-Reject to the request.**** Following are the logs of radeapclient:**** ** ** User-Name= "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = "testuser"**** Message-Authenticator = 0x00**** ** ** ** ** +++> About to send encoded packet:**** User-Name = "testuser"**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = "testuser"**** Message-Authenticator = 0x00**** <+++ EAP decoded packet:**** EAP-Message = 0x01d3001604107b44069aa80b67319a536bfd4f8ac713**** Message-Authenticator = 0xb4499f3ee54742d9dd8469980720dcf6**** State = 0x8a52e3488a81e7f33f4b54075fcd3936**** EAP-Id = 211**** EAP-Code = Request**** EAP-Type-MD5 = 0x107b44069aa80b67319a536bfd4f8ac713**** ** ** +++> About to send encoded packet:**** User-Name = "testuser"**** EAP-Code = Response**** EAP-Id = 211**** Message-Authenticator = 0x00000000000000000000000000000000**** EAP-Type-MD5 = 0x10d2c45d5e328b2b2db8bd66c7d171635d**** State = 0x8a52e3488a81e7f33f4b54075fcd3936**** <+++ EAP decoded packet:**** EAP-Message = 0x04d30004**** Message-Authenticator = 0xf6f7e2707ef22ea86a660a4ddce7fb30**** EAP-Id = 211**** EAP-Code = Failure**** ** ** On further investigation, i found an example to test eap-md5 in the source code{ freeradius-2.1.8 } in src/tests**** ** ** Example is :**** ** ** echo 'User-Name = "eapmd5"'**** echo 'Cleartext-Password = "md5md5"'**** echo 'NAS-IP-Address = marajade.sandelman.ottawa.on.ca'**** echo 'EAP-Code = Response'**** echo 'EAP-Id = 210'**** echo 'EAP-Type-Identity = "eapsim'**** echo 'Message-Authenticator = 0'**** echo 'NAS-Port = 0' )**** ** ** ** ** But EAP RFC3579 and RFC2869 states that User-Password should not be part of a radius packet containing EAP-Message attribute,**** ** ** **** it written that “An Access-Request that contains either a User-Password or** ** CHAP-Password or ARAP-Password or one or more EAP-Message attributes**** MUST NOT contain more than one type of those four attributes. If it**** does not contain any of those four attributes, it SHOULD contain a**** Message-Authenticator. If any packet type contains an EAP-Message**** attribute it MUST also contain a Message-Authenticator.”**** ** ** ** ** Please let me know if any specific configuration need to be done on the server so that server sends Access-Accept.**** **** ** ** Thanks in advance. Arpit

2 1

(no subject)
by Arpit Jain 27 Dec '12

27 Dec '12

Hi, can we send accounting request using radeapclient ??**** **** I am getting the following error:**** ** ** radeapclient -x 172.168.200.15 acct testing123**** User-Name= " testuser "**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** ** ** ** ** +++> About to send encoded packet:**** User-Name = " testuser "**** EAP-Code = Response**** EAP-Id = 210**** EAP-Type-Identity = " testuser "**** Message-Authenticator = 0x00**** rlm_eap: EAP-Message not found**** <+++ EAP decoded packet:**** ** Regards, Arpit

2 1

Lost user
by Dmitry Korzhevin 27 Dec '12

27 Dec '12

Hi, Can you please give advice in next situation: mysql> SELECT * FROM `radpostauth` WHERE `username` LIKE '{E6395348-49C3-C12A-2998-B60329D0CA5C}'; +-------+----------------------------------------+------+---------------+---------------------+ | id | username | pass | reply | authdate | +-------+----------------------------------------+------+---------------+---------------------+ | 24825 | {E6395348-49C3-C12A-2998-B60329D0CA5C} | | Access-Accept | 2012-12-16 04:20:59 | +-------+----------------------------------------+------+---------------+---------------------+ 1 row in set (0.00 sec) mysql> SELECT * FROM `radacct` WHERE `username` LIKE '{E6395348-49C3-C12A-2998-B60329D0CA5C}'; Empty set (0.00 sec) mysql> I have user in table radpostauth, but i can't find same user in table radacct. How could it be? http://dpaste.com/852738/ Nothing in logs: grep -r "{E6395348-49C3-C12A-2998-B60329D0CA5C}" /var/log/freeradius/ Best Regards, Dmitry --- Dmitry KORZHEVIN System Administrator STIDIA S.A. - Luxembourg e: dmitry.korzhevin(a)stidia.com m: +38 093 874 5453 w: http://www.stidia.com

4 6

how to read db files?
by Periko Support 26 Dec '12

26 Dec '12

Hi guys. Exist a way to read freeradius db files? db.daily, etc, etc. This are berkeley db files or what type of are those? I'm using flat files not sql settings. FR 2.x, thanks!!!

1 0

Re: Lost user
by Alan Buxey 26 Dec '12

26 Dec '12

As Alan has said, your radpostauth table has an entry because the RADIUS server dealt with an auth request...your radact table entry has no entry likely because no accounting packet was received. Run in debug mode and see what occurs alan

1 0

radusergroup without primary key
by Efi merdler 26 Dec '12

26 Dec '12

Hello, I'm using radius 2.1.12 with postgresql as a backend. I've noticed that radusergroup does not contain any key column. There is a complaint on the subject posted back in 2007 (http://lists.freeradius.org/pipermail/freeradius-devel/2007-August/003239.h…) however nobody addressed it. We are accessing the table from an external process and it requires a primary key to be successful, how would you recommend handling it ? Cheers

3 4

Enforcing use of Eap-TLS or PEAP
by kjonca＠o2.pl 24 Dec '12

24 Dec '12

I try to set up radius authentication in my WiFi network. I want to have: 1. one user (samsung phone) should be authenticated with PEAP 2. others should be authenticated with EAP-TLS. Naive approach is to use Auth-Type but its treated as "misuse" at http://deployingradius.com/documents/configuration/auth_type.html But example is only for ms-chap, and I don't know which attribute(?) use to force PEAP /EAP-TLS Any help? Am I missing something? KJ -- http://blogdebart.pl/2009/12/22/mamy-chorych-dzieci/ QOTD: "It's been real and it's been fun, but it hasn't been real fun."

2 1

Re:Re: Is there a way to renew pptp user information of a user connected mikrotik?
by 조명산 24 Dec '12

24 Dec '12

2 1