- Freeradius-Users - lists.freeradius.org

(no subject)
by QASIM RAO 31 Aug '12

31 Aug '12

sir,actual problem is when i run with 'radiusd' log file save on location i defined in radiusd.conf prefix = /usr/localexec_prefix = ${prefix}sysconfdir = ${prefix}/etclocalstatedir = ${prefix}/varsbindir = ${exec_prefix}/sbinlogdir = ${localstatedir}/log/radius but when i run radius with 'radiusd -X' i save on location defined in radiusd.dat echo -n $"Starting $prog:" cd $binfolder daemon ./radiusd > /var/log/radius`date '+%Y%m%d'`.log & RETVAL=$? sleep 2 i want to save log file on same location in both cases... please help me in this Thanx..

2 1

rlm_perl and dynamic_clients
by Steven Eksteen 31 Aug '12

31 Aug '12

Hi, I was wondering how would I use "Packet-Src-IP-Address" using Perl for Dynamic Clients. I thought it might be part of the RAD_REQUEST hash. If some direction could be made as to setting "FreeRADIUS-Client-Shortname", "FreeRADIUS-Client-Secret", etc. too I would be very grateful. I already have Perl working for the normal AAA functions. This just doesn't appear to work the same way. I am not a Perl developer in the slightest so apologies in advance if this is a monumentally stupid question. Thank you --- FreeRADIUS Version 2.1.10, for host x86_64-redhat-linux-gnu --- client dynamic { ipaddr = 0.0.0.0 netmask = 0 dynamic_clients = dynamic_client_server lifetime = 3600 } server dynamic_client_server { authorize { dynamic-clients-pl } } --- use strict; use Data::Dumper; use vars qw(%RAD_REQUEST); use constant RLM_MODULE_REJECT => 0; use constant RLM_MODULE_FAIL => 1; use constant RLM_MODULE_OK => 2; use constant RLM_MODULE_HANDLED => 3; use constant RLM_MODULE_INVALID => 4; use constant RLM_MODULE_USERLOCK => 5; use constant RLM_MODULE_NOTFOUND => 6; use constant RLM_MODULE_NOOP => 7; use constant RLM_MODULE_UPDATED => 8; use constant RLM_MODULE_NUMCODES => 9; sub authorize { &log_request_attributes; return RLM_MODULE_FAIL; } sub log_request_attributes { for (keys %RAD_REQUEST) { &radiusd::radlog(1, "RAD_REQUEST: $_ = $RAD_REQUEST{$_}"); } } --- rad_recv: Access-Request packet from host 41.132.69.140 port 51951, id=31, length=212 server dynamic_client_server { } # server dynamic_client_server Ignoring request to authentication address * port 1812 as server r9 from unknown client 41.132.69.140 port 51951 Ready to process requests. ---

2 4

rlm_radutmp Logout entry for NAS has wrong ID
by Robertson, Joshua A. 30 Aug '12

30 Aug '12

I recently setup two FreeRADIUS servers and have them set as primary/secondary on Cisco WiSM2 wireless controllers. On one of the two FreeRADIUS servers everything's going great and I see the logins flying by in the logs, however on the other FreeRADIUS server I keep seeing the following in the logs: rlm_radutmp: Logout entry for NAS <wireless controller name> port 13 has wrong ID I checked the list and I saw others posting about this error, but no concrete fixes. Any ideas on a resolution? Thanks. Josh Robertson Network Systems Senior Engineer Old Dominion University Office of Computing & Communications Services j2robert(a)odu.edu<mailto:j2robert@odu.edu> http://occs.odu.edu/

2 3

Windows 7 answers LAN based EAP-TLS with EAP-NAK and PEAP
by PENZ Robert 30 Aug '12

30 Aug '12

Hi! I've a problem with 802.1x and EAP-TLS where I'm not quite sure who is responsible for this problem and how to work around it. I hope someone can help me - I couldn't find anything with Google and I just can't believe I'm the first guy with this problem. The setup is following. - Windows 7 SP1 Client with 802.1x and EAP-TLS configurated - Extreme Networks 450e Switches --> LAN based 802.1x - Freeradius 2.1.12-3.el5 on RHEL5 only TLS as EAP type configured/allowed The problem now is that in 1/3 of the clients boots (done over 40 times with a tap devices running as sniffer) the Windows Client sends an response: Legacy Nak (Response only) [RFC3748] with the wish for PEAP. After this the freeradius Server sends a reject ([eap] NAK asked for unsupported type PEAP). With the next identity request the Client does an clean EAP-TLs handshake, but the switch already put the client into the reject network. Here is the communication flow in these cases (Wireshark): Line 5 / Packet 54 is the problem No. Time Source Destination Protocol Length Info 9 27.371093 switch --> client EAP 60 Request, Identity [RFC3748] 51 43.669530 switch --> client EAP 60 Request, Identity [RFC3748] 52 43.693510 client --> switch EAP 60 Response, Identity [RFC3748] 53 43.699498 switch --> client EAP 60 Request, EAP-TLS [RFC5216] [Aboba] 54 43.700496 client --> switch EAP 60 Response, Legacy Nak (Response only) [RFC3748] 84 44.639980 switch --> client EAP 60 Request, Identity [RFC3748] 85 44.646980 client --> switch EAP 60 Response, Identity [RFC3748] 86 44.652974 switch --> client EAP 60 Request, EAP-TLS [RFC5216] [Aboba] 87 44.758887 client --> switch TLSv1 123 Client Hello 88 44.765875 switch --> client TLSv1 1042 Server Hello, Certificate, Certificate Request, Server Hello Done 89 44.766875 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 90 44.772880 switch --> client TLSv1 1042 Server Hello, Certificate, Certificate Request, Server Hello Done 91 44.772892 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 92 44.778868 switch --> client TLSv1 1042 Server Hello, Certificate, Certificate Request, Server Hello Done 93 44.779865 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 94 44.784859 switch --> client TLSv1 177 Server Hello, Certificate, Certificate Request, Server Hello Done 95 44.787862 client --> switch TLSv1 1510 Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message 96 44.793854 switch --> client EAP 60 Request, EAP-TLS [RFC5216] [Aboba] 97 44.793861 client --> switch TLSv1 530 Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Message 98 44.807887 switch --> client TLSv1 87 Change Cipher Spec, Encrypted Handshake Message 102 44.818881 client --> switch EAP 60 Response, EAP-TLS [RFC5216] [Aboba] 103 44.855827 switch --> client EAP 60 Success It seems to be a timing issue .... anyway: - Windows 7 is configured to EAP-TLS with GPOs - I've uninstalled anti-virus, behavior detection software In the 2/3 of the cases it works the Client does not send a NAK, so I believe it is a client problem but it's Windows 7 ... there must be thousands of installs with Windows 7 and 802.1x EAP/TLS. Would it help if freeradius ignores the EAP-NAK packets? Any help appreciated! Mit freundlichen Grüßen Robert Penz -------------------------------------------------------------- Dipl.Inf. Robert Penz DVT - Daten-Verarbeitung-Tirol GmbH Adamgasse 22, 6020 Innsbruck Tel: +43 (0)512 508 3334 / Fax: +43 (0)512 508 3355 E-Mail: robert.penz(a)tirol.gv.at

2 3

RE: Integration with CISCO Router for PEAP requests
by Andras Ionut 30 Aug '12

30 Aug '12

Hi Phil, Thanks a lot for the quick response. I need this for PEAP with EAP protocol inside the tunnel, like EAP-MSCHAPv2. Again, The device MUST reject the connection as EAP is not completed, but the ROUTER needs that Access-Accept, in order to be able to redirect user to portal. Can this be done? Thanks in advance. Andras On 30/08/12 11:12, Andras Ionut wrote: > Thanks a lot for the quick answer Arran. > > That is exactly wahat I need - sending an Access-Accept and maybe > EAP-Success if possible. I don't care if the device will not connect. > I only need Access-Accept in order for the CISCO router to assign an > IP to the client and redirect it to portal using L4_Redirect. You're not understanding what Arran said. This is an FAQ: http://wiki.freeradius.org/FAQ#How-do-I-permit-access-to-any-user-regardles… In short: many (most?) devices will drop the connection if auth fails, including a missing or invalid final response in the inner challenge-response auth. So, forcing an accept might work for the router. But the client will probably disconnect. > > Can this be done? If yes, can you please be more explicit on how to do > this in freeradius? See the FAQ entry above.

2 1

(no subject)
by QASIM RAO 30 Aug '12

30 Aug '12

Hi, i new bie in Freeradius i am facing problem that when i run radiusd with 'radiusd -X' command it it is genrating log of it in log file but when i run radiusd with 'radiusd' command it is not genrating it log in log file.. anyone please help me in this :( Regards, Rao

3 2

Re: Integration with CISCO Router for PEAP requests
by Andras Ionut 30 Aug '12

30 Aug '12

Thanks a lot for the quick answer Arran. That is exactly wahat I need - sending an Access-Accept and maybe EAP-Success if possible. I don't care if the device will not connect. I only need Access-Accept in order for the CISCO router to assign an IP to the client and redirect it to portal using L4_Redirect. Can this be done? If yes, can you please be more explicit on how to do this in freeradius? Thanks in advance, Andras ---------------------------------------------------------- On 30 Aug 2012, at 09:40, Andras Ionut <ionut.andras(a)gmail.com> wrote: > How can I configure FreeRADIUS to work with a CISCO Router and a > captive portal in the following case... > > 1. User tries to access WiFi network with good user and wrong password > 2. FreeRADIUS should send Access-Accept with Filter-Id set to portal > redirect policy and not Access-Reject > 3. User is presented login page, bla, bla, bla > > My problem is that i have to send an Access-Accept on failed login for > PEAP (For TTLS I've managed to do it from config, but this is another > story) You can't fake an Accept that the PEAP supplicant will accept because MSCHAPv2 requires that you actually provide the correct credentials. You can send an Access-Accept back to the access point, and even force an EAP-Success but the supplicant will probably refuse to connect because it only cares about the success notification from the MSCHAPv2 inner. Your only option is to run a separate open ssid with something like macauth. TTLS works because you're using a PAP inner method, and IIRC the keying material for WPA2 is derived from the SSL tunnel which can be estsblished without knowledge of the users password. If you tried TTLS-MSCHAPv2 it would fail. -Arran

2 1

Integration with CISCO Router for PEAP requests
by Andras Ionut 30 Aug '12

30 Aug '12

How can I configure FreeRADIUS to work with a CISCO Router and a captive portal in the following case... 1. User tries to access WiFi network with good user and wrong password 2. FreeRADIUS should send Access-Accept with Filter-Id set to portal redirect policy and not Access-Reject 3. User is presented login page, bla, bla, bla My problem is that i have to send an Access-Accept on failed login for PEAP (For TTLS I've managed to do it from config, but this is another story) Thanks in advance, Andras

2 1

RE: Simple attribute question!
by Franks Andy (RLZ) IT Systems Engineer 29 Aug '12

29 Aug '12

Ok, that makes sense, would work better I think if I had an include file similar to the users file in a sense, which I assume I can do but not tried in the middle of a section, I could then ditch the users file. Problem is "users" is kind of nice, plus it's marginally easier to read for the less experienced of the network team here than unlang would be, so undecided there. I've tried the operator syntax again, and it seems from playing around a little more that I need a value following the !* operator, i.e. Reply-Message !* "". Is this correct? Thanks again, and I'll consider your suggestion Alan. Andy. -----Original Message----- From: freeradius-users-bounces+andy.franks=sath.nhs.uk(a)lists.freeradius.org [mailto:freeradius-users-bounces+andy.franks=sath.nhs.uk@lists.freeradius.org] On Behalf Of alan buxey Sent: 29 August 2012 21:44 To: FreeRadius users mailing list Subject: Re: Simple attribute question! Hi, > Any ideas? why not just put the required stuff into the post-auth - either still using the files entries.... or using unlang eg something like if("%{User-Name}% =~ /[frankdsa|everdstons|kirddksa|kefls]/ && NAS-IP-Address =~ /192\.168\.104\./ ){ update reply { Reply-Message += "Welcome %{User-Name}\n", Reply-Message += "Admin access", Cisco-AVPair := "shell:priv-lvl=15" } } ? alan - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html

1 0

Simple attribute question!
by Franks Andy (RLZ) IT Systems Engineer 29 Aug '12

29 Aug '12

Hi I have a seemingly simple thing I need to do, however it doesn't seem to be working. In the users file I do a quick match to see if a user is in the regex list I put in (this is for overrides of an ldap group, determining higher privileges, but still basic access for the group users), and then another regex checking against a certain ip range : DEFAULT User-Name =~ "frankdsa|everdstons|kirddksa|kefls", NAS-IP-Address=~"192.168.104.*" Reply-Message += "Welcome %{User-Name}\n", Reply-Message += "Admin access", Cisco-AVPair := "shell:priv-lvl=15" This adds a couple of reply messages when the user logs in. Of course the users file is pre-auth so it doesn't care if the ultimate request gets rejected or not based on authorization or some other check. Therefore I've added this to the post-auth-type reject section of the default virtual server: Post-Auth-Type REJECT { update reply { Reply-Message := "Authentication failed}" } It may be wiser to return nothing, i.e. Reply-Message := "" for security reasons, but the point is that the reply-messages set in the users file still pass through, so I get Welcome (username) Admin Access Authentication Failed All together. Am I doing something wrong? I also tried Reply-Message !* , but this stopped the service firing up ( version 2.10 - I see this was talked about being fixed in 2.8?), or Reply-Message -= "%{reply:Reply-Message}" Which didn't work either. Any ideas? Thanks Andy

2 1