- Freeradius-Users - lists.freeradius.org

Re: Newbie question about rlm_exec usage
by Alan Buxey 24 Nov '12

24 Nov '12

What EAP type? eg if using PEAP, the client never sends a password, instead its challenge-response which works because the SQL contains a copy of the password so MSCHAP can derive an agreement. Gmhow dies your curl do this? Are you trying thus in the authenticate section and feeding an authorization method? radiusd -X is your and our friend alan

3 3

Duplicate NAS name
by Lorenzo Milesi 24 Nov '12

24 Nov '12

Hi. I'm performing some test upgrades from 1.1.x and ran into the nas table problem: in FR1 I had a list of NASes with duplicate names, maybe because we had several hotspots with different shortnames NAT'ed on the same ip. I see now FR complains at startup for duplicate name. How can I deal with such situation, where two nas share the same ip? thanks -- Lorenzo Milesi - lorenzo.milesi(a)yetopen.it GPG/PGP Key-Id: 0xE704E230 - http://keyserver.linux.it

2 2

Re: problem with test aaa-server in ciscoasa
by studyfordo 24 Nov '12

24 Nov '12

firstly, thanks Mathew Newton and alan buxey. I run freeradius -X and run test in ciso asa5520. details as follows. rad_recv: Access-Request packet from host 192.168.30.254 port 1025, id=72, length=61 User-Name = "tsb" User-Password = "123456" NAS-IP-Address = 192.168.30.254 NAS-Port = 64 NAS-Port-Type = Virtual # Executing section authorize from file /opt/freeadius/etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "tsb", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop ERROR: No authenticate method (Auth-Type) found for the request: Rejecting the user Failed to authenticate the user. Using Post-Auth-Type REJECT # Executing group from file /opt/freeadius/etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> tsb attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 72 to 192.168.30.254 port 1025 Waking up in 4.9 seconds. Cleaning up request 1 ID 72 with timestamp +430 Ready to process requests. I have add user such as following format cat users | sed -n '/^[^#]/p' tsb Cleartext-Password := "123456" DEFAULT Framed-Protocol == PPP Framed-Protocol = PPP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "CSLIP" Framed-Protocol = SLIP, Framed-Compression = Van-Jacobson-TCP-IP DEFAULT Hint == "SLIP" Framed-Protocol = SLIP So I still problem with user fomat in file users? pls give me some advice. thanks

2 1

Re: problem with test aaa-server in ciscoasa
by Alan Buxey 24 Nov '12

24 Nov '12

...oh, and make sure you are editing the CORRECT users file ;) alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

1 0

Re: problem with test aaa-server in ciscoasa
by Alan Buxey 24 Nov '12

24 Nov '12

As previously mentioned, only add that user/pass to the users file... nothing else. Don't add all that stuff that you did alan

1 0

dhcp/bootp server filename
by Lev Bronshtein 24 Nov '12

24 Nov '12

FreeRadius 2.2.0 Redhat Linux 6.2 Please forgive me in advance if some of the things I say seem to be generalities and not per RFC, the firm where I work has recently decided to start using freeradius DHCP as DHCP server and I am the programmer/integrator/project lead for the entire thing. Our preliminary tests were very successful, we were able to hand out leases to various clients and also various options as well. However when it came to PXE Boot we sem to have run afoul of either my lack of knowledge or Microsoft going out of their way to "help" network admins. Here is the problem, as expected I have set option 66 -- DHCP-TFTP-Server-Name and option 67 DHCP-Boot-File-Name, however tge PXE boot process has not been completed and we get an error message PXE-E32 and according to this article http://www.bootix.com/support/problems_solutions/pxe_e32_tftp_open_timeout.… we have to set option 066 next server. However this is not what option 66 is. Looking at the tcp dump that was produced on the freeradius server I can see that "next server" field is the same as the "DHCP-Server-Identifier", and while changing this value to the one of the TFTP server also changed the next server field as expected it also broke dhcp. Also the people who have successfully booted their PXE hardware in the lab sent me a a pcap where clearly the next server and Identifier are clearly different and also the boot-file-name is set as well, where as in my pcap I only see it in the dhcp options not in boot options header (I must clarify at this point that I am using ethereal to decode and read packets). Which is why I am thinking that options 66 and 67 are not used for PXE boot, but microsoft dhcp seeing those options also takes care of backword compatibility, and so as far as everyone in windows land is concerned they need to set options 66 and 67. Can anyone help please? Regards, Lev Bronshtein P.S. I figured out that I ned to set both DHCP-Server-Identifier and DHCP-Server-IP-Address, which gave me the next-address. However I still can't figure out the boot file option

1 1

what about mac spoofing
by pideil matthew 23 Nov '12

23 Nov '12

Hello all ! Please tell me, does radius auth over wifi (wpa2) affected by mac spoofing attack ? I think not because after successfull auth, exchange key mechanism is performed and all traffic become crypted. But my wifi laptop can already be disconnected by spoofed packet ? Regards, Matt

2 1

Git master branch & Debian build
by Olivier Beytrison 23 Nov '12

23 Nov '12

Hello, Just a quick question, before I loose too much time on this. Is the debian build system on the master repository working ? I'm getting hard time to build the deb packages. git clone from yesterday, ubuntu 12.04 LTS Olivier -- Olivier Beytrison Network & Security Engineer, HES-SO Fribourg Mobile: +41 (0)78 619 73 53 Mail: olivier(a)heliosnet.org

5 38

Newbie question about rlm_exec usage
by Hoggins! 23 Nov '12

23 Nov '12

Hello everyone, We're facing an issue with rlm_exec, or at least Ithink our problem comes from there. We use FreeRADIUS for a Wifi access point. We userlm_sql, and our clients authenticate using 802.1x, with a certificate and a pair of login/password credentials. Everything works just fine, and we just had to customize a little bit the SQL queries to match our shared tables. Now, we would like to use another way of authorizing our users on our Wifi network. Basically, a script should be called by FreeRADIUS, and the result of the script would determine whether the user is granted access or not.To be precise, the script uses a curl callwith POST parameters (over an SSL connexion), andthe returned result happens to be the authentication request result. The script works perfectly, exiting with the correct error code, according to what it should return. Yay ! So we just replaced the line "sql" in the authorize { } with a "curl" line, "curl" being a module we created, copying the "echo" module. Alas, it does not work, and mschap complains about the absence of Cleartext-Password. So before posting a lotof debug info and our scripts, does this procedure seem ok to you ? Thanks in advance, Hoggins!

1 0

Re: what about mac spoofing
by Alan Buxey 23 Nov '12

23 Nov '12

802.1X authentication ? (WPA2-RADIUS) If so , system is authenticated by user/pass and/or a certificate and the client and AP have a unique encryption key.. no other device can just come along with the same MAC and just start using the network. For WPA2 PSK, another client would need to know the shared key to authenticate and associate with the AP. you could have MAC control ...and so if the attacker knows the PSK then yes, they could get online by spoofing the MAC of an allowed client alan

1 0