- Freeradius-Users - lists.freeradius.org

EAP-TLS WinXP, default_md MD5, default_eap_type
by Si St 15 Jul '12

15 Jul '12

The following questions about changing default_md and default_eap_type is solely for the matter that I should have RADIUS work on some Linux-machines and some Windows-machines all of them hopefully with TLS client sertificates mainly. There are some diversities as to MD5 and post SP1 WinXP: http://freeradius.org/doc/EAP-MD5.html QUOTE: Windows XP (before SP1) Note: since WindowsXP SP1 you can't use EAP-MD5 for wireless devices!!! EAP-MD5 is only available for wired devices. Go to the Network Connections window. Right-click the connection corresponding to the adapter which is going to use EAP authentication. Go to the "Authentication" tab. If it doesn’t appear (yes, it’s weird sometimes) try to unplug and plug your adapter till it does (if PCMCIA...) Otherwise, download the software for the adapter configuration like e.g. ACU for the Cisco adapters and try to de- and reactivate the card. In the Authentication dialog, assure the box "Use IEEE802.1X network authentication" is checked. Set your EAP type there (EAP/MD5 Challenge). That’s all. Now deactivate and reactivate your LAN-connection on this adapter and it should work. ENDQUOTE. This recommendation is put forth in the etc/raddb/certs/README: QUOTE: MD5 has known weaknesses and is discouraged in favor of SHA1 (see http://www.kb.cert.org/vuls/id/836068 for details). If your network equipment supports the SHA1 signature algorithm, we recommend that you change the "ca.cnf", "server.cnf", and "client.cnf" files to specify the use of SHA1 for the certificates. To do this, change the 'default_md' entry in those files from 'md5' to 'sha1'. ENDQUOTE. In the eap.conf this is put forth: QUOTE: # We do NOT recommend using EAP-MD5 authentication # for wireless connections. It is insecure, and does # not provide for dynamic WEP keys. # md5 { } ENDQUOTE. QUESTIONS: ->Should I stick only to the changes of default_md in ca.*,server.*, and client.cnf and leave the eap.conf unchanged, or should I add a module like: sha1 { } or change the md5{} to sha1{} or should it be done differently? . I count for the postulate in eap.conf that: QUOTE: # If the EAP-Type attribute is set by another module, # then that EAP type takes precedence over the # default type configured here. ENDQUOTE and therefore I do no not need to change so much in eap.conf ->Should I by all means keep winXP-userclient to a PEAP solution because the nice doc in: http://freeradius.org/doc/EAPTLS.pdf for Windows is outdated or wont work today? It could be that I complicate the matter here by mixing together parts that do not belong to each other, but I have to ask.... -- Si St sigbj-st(a)operamail.com -- http://www.fastmail.fm - The professional email service

2 2

status server: IPv6 support?
by Tobias Hachmer 14 Jul '12

14 Jul '12

Hello list, is there a way to gather statistics for an IPv6 Socket with the status server? For example my radius server has the following listen sections: udp 0 0 127.0.0.1:18120 0.0.0.0:* 2355/radiusd udp 0 0 0.0.0.0:1645 0.0.0.0:* 2355/radiusd udp 0 0 0.0.0.0:1646 0.0.0.0:* 2355/radiusd udp 0 0 0.0.0.0:1812 0.0.0.0:* 2355/radiusd udp 0 0 0.0.0.0:1813 0.0.0.0:* 2355/radiusd udp 0 0 ::1:18120 :::* 2355/radiusd udp 0 0 :::1812 :::* 2355/radiusd udp 0 0 :::1813 :::* 2355/radiusd I am able to gather statistics for the IPv4 Sockets like: # echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 67, FreeRADIUS-Stats-Server-IP-Address = 192.168.1.14, FreeRADIUS-Stats-Server-Port = 1812" | radclient localhost:18120 status adminsecret Received response ID 52, code 2, length = 248 FreeRADIUS-Stats-Server-IP-Address = 192.168.1.14 FreeRADIUS-Stats-Server-Port = 1812 FreeRADIUS-Total-Access-Requests = 0 FreeRADIUS-Total-Access-Accepts = 0 FreeRADIUS-Total-Access-Rejects = 0 FreeRADIUS-Total-Access-Challenges = 0 FreeRADIUS-Total-Auth-Responses = 0 FreeRADIUS-Total-Auth-Duplicate-Requests = 0 FreeRADIUS-Total-Auth-Malformed-Requests = 0 FreeRADIUS-Total-Auth-Invalid-Requests = 0 FreeRADIUS-Total-Auth-Dropped-Requests = 0 FreeRADIUS-Total-Auth-Unknown-Types = 0 FreeRADIUS-Total-Accounting-Requests = 0 FreeRADIUS-Total-Accounting-Responses = 0 FreeRADIUS-Total-Acct-Duplicate-Requests = 0 FreeRADIUS-Total-Acct-Malformed-Requests = 0 FreeRADIUS-Total-Acct-Invalid-Requests = 0 FreeRADIUS-Total-Acct-Dropped-Requests = 0 FreeRADIUS-Total-Acct-Unknown-Types = 0 1. How can I gather statistics for the IPv6 sockets, I didn't find any IPv6 attributes like "FreeRADIUS-Stats-Server-IPv6-Address". 2. Is there a way to query the IPv6 localhost socket for status server? echo "Message-Authenticator = 0x00, FreeRADIUS-Statistics-Type = 67, FreeRADIUS-Stats-Server-IP-Address = 192.168.1.14, FreeRADIUS-Stats-Server-Port = 1812" | radclient [::1]:18120 status adminsecret did not work. Regards, Tobias Hachmer

2 1

Basic freeradius set up problem
by Mik J 13 Jul '12

13 Jul '12

Platform: OpenBSD 5.1 Version: 2.1.12 Hello, I have a problem setting up freeradius and I think it's related to the domain stripping Here's what I did for my configuration 1) Imported the scripts schema.sql, admin.sql, ippool.sql, nas.sql in my MySQL radiusdb database 2) Inserted a user: INSERT INTO radcheck (UserName, Attribute, Value) VALUES ('testuser', 'Password', 'passsecret'); 3) Configured clients.conf client localhost { ipaddr = 127.0.0.1 secret = testing123 require_message_authenticator = no nastype = other # localhost isn't usually a NAS... } 4) Uncommented in radiusd.conf $INCLUDE ${confdir}/sql.conf $INCLUDE ${confdir}/sql/mysql/counter.conf 5) In /etc/raddb/sites-enabled/default uncommented authorize { sql } accounting { sql sql_log } 6) Configured /etc/raddb/sql.conf sql { database = "mysql" driver = "rlm_sql_${database}" #socket= var/run/mysql/mysql.sock server = "localhost" port = 3306 login = "radiususer" password = "passradius" radius_db = "radius" acct_table1 = "radacct" acct_table2 = "radacct" postauth_table = "radpostauth" authcheck_table = "radcheck" authreply_table = "radreply" groupcheck_table = "radgroupcheck" groupreply_table = "radgroupreply" usergroup_table = "radusergroup" deletestalesessions = yes sqltrace = no sqltracefile = ${logdir}/sqltrace.sql num_sql_socks = 5 connect_failure_retry_delay = 60 lifetime = 0 max_queries = 0 nas_table = "nas" $INCLUDE sql/${database}/dialup.conf } 7) In /etc/raddb/sql/mysql/dialup.conf added sql_user_name = '%{Stripped-User-Name}' 8) I start the radius server # /usr/local/sbin/radiusd -X And make a test on the local machine $ radtest testuser passsecret 127.0.0.1 1812 testing123 And I receive an access reject: rad_recv: Access-Reject packet from host 127.0.0.1 port 1812, id=222, length=20 9) Le debug says rad_recv: Access-Request packet from host 127.0.0.1 port 10251, id=122, length=78 User-Name = "testuser" User-Password = "passsecret" NAS-IP-Address = 192.168.1.1 NAS-Port = 1812 Message-Authenticator = 0xf16b463a77e5dfefbd9385915a307e88 # Executing section authorize from file /etc/raddb/sites-enabled/default +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop ++[digest] returns noop [suffix] No '@' in User-Name = "testuser", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop [eap] No EAP-Message, not doing EAP ++[eap] returns noop ++[files] returns noop [sql] expand: %{Stripped-User-Name} -> [sql] sql_set_user escaped user --> '' rlm_sql (sql): Reserving sql socket id: 3 [sql] expand: -> [sql] Error generating query; rejecting user rlm_sql (sql): Released sql socket id: 3 ++[sql] returns fail Invalid user: [testuser] (from client localhost port 1812) Using Post-Auth-Type Reject # Executing group from file /etc/raddb/sites-enabled/default +- entering group REJECT {...} [attr_filter.access_reject] expand: %{User-Name} -> testuser attr_filter: Matched entry DEFAULT at line 11 ++[attr_filter.access_reject] returns updated Delaying reject of request 1 for 1 seconds Going to the next request Waking up in 0.9 seconds. Sending delayed reject for request 1 Sending Access-Reject of id 122 to 127.0.0.1 port 10251 Waking up in 4.9 seconds. Cleaning up request 1 ID 122 with timestamp +74 Ready to process requests. 10) I can see that something goes wrong with this message [sql] Error generating query; rejecting user But I don't understand why Thank you to those who can point the right direction. Regards

4 8

Re: PEAP Password
by Alan Buxey 13 Jul '12

13 Jul '12

No (i'm not even going to ask 'why would you want to do that?') alan

2 1

Re: Help needed configuring MAB on FreeRADIUS and Cisco switch
by Alan Buxey 13 Jul '12

13 Jul '12

If you get no output to screen then it doesn't matter if the RADIUS server config is wrong as you've got problem elsewhere. Ha e you checked your firewall on the server, I don't give answers to be randomly skipped over. To verify you can send radius requests from another computer..eg using radtest, eapol_test or JRADIUSSimulator etc alan -- This sma rtphone uses free WiFi around the world with eduroam, now that's what I call smart.

2 1

PEAP Password
by Carl Pierre 13 Jul '12

13 Jul '12

Hello: I would like to have FreeRADIUS check the user's submitted credentials before it even allows the Tunnel to even be set up. Is this a possibility? Regards, Carl

2 2

Re: Help needed configuring MAB on FreeRADIUS and Cisco switch
by Alan Buxey 13 Jul '12

13 Jul '12

Hi, The very last line of startup output will say Ready to process requests If you get NOTHING else then the server is not getting any packets through to it...which is either something simple such as the built in firewall of cents (edit the firewall using your favourite method to allow UDP 1812 through for RADIUS auth packets), a network issue, (routing, ACLs etc) or a switch configuration issue. alan -- This smartphone uses free WiFi around the world with eduroam, now that's what I call smart.

3 2

Re: Help needed configuring MAB on FreeRADIUS and Cisco switch
by Alan Buxey 13 Jul '12

13 Jul '12

radiusd -X ...will print all output to the terminal it wad run in. That will show you the workings.... alan

2 1

EAP-SIM configuration on v2.1.12
by Tony Phung 13 Jul '12

13 Jul '12

Hi experts, I am trying to configure eap-sim on and when I start the radiusd process I get the following error: --- Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /usr/local/etc/raddb/eap.conf eap { default_eap_type = "sim" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Ignoring EAP-Type/tls because we do not have OpenSSL support. Ignoring EAP-Type/ttls because we do not have OpenSSL support. Ignoring EAP-Type/peap because we do not have OpenSSL support. Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no send_error = no } Module: Linked to sub-module rlm_eap_sim Module: Instantiating eap-sim Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /usr/local/etc/raddb/modules/preprocess preprocess { huntgroups = "/usr/local/etc/raddb/huntgroups" hints = "/usr/local/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /usr/local/etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } /usr/local/etc/raddb/radiusd.conf[698]: Failed to link to module 'rlm_sim_files': ld.so.1: radiusd: fatal: rlm_sim_files.so: open failed: No such file or directory /usr/local/etc/raddb/sites-enabled/default[157]: Failed to load module "sim_files". /usr/local/etc/raddb/sites-enabled/default[69]: Errors parsing authorize section. --- Are there anything that I have missed? I have setup the config as follows: The eap modules are present # pwd /usr/local/lib # ls rlm_eap* rlm_eap_gtc-2.1.12.la rlm_eap_leap-2.1.12.so rlm_eap_md5.a rlm_eap_mschapv2.la rlm_eap_sim.so rlm_eap_gtc-2.1.12.so rlm_eap_leap.a rlm_eap_md5.la rlm_eap_mschapv2.so rlm_eap-2.1.12.la rlm_eap_gtc.a rlm_eap_leap.la rlm_eap_md5.so rlm_eap_sim-2.1.12.la rlm_eap-2.1.12.so rlm_eap_gtc.la rlm_eap_leap.so rlm_eap_mschapv2-2.1.12.la rlm_eap_sim-2.1.12.so rlm_eap.a rlm_eap_gtc.so rlm_eap_md5-2.1.12.la rlm_eap_mschapv2-2.1.12.so rlm_eap_sim.a rlm_eap.la rlm_eap_leap-2.1.12.la rlm_eap_md5-2.1.12.so rlm_eap_mschapv2.a rlm_eap_sim.la rlm_eap.so Config files: /usr/local/etc/raddb/radiusd.conf modules { sim_files { simtriplets = "/usr/local/etc/raddb/simtriplets.dat" } /usr/local/etc/raddb/eap.conf eap { sim { } default_eap_type = sim } /usr/local/etc/raddb/sites-enabled/default authorize { sim_files eap { ok = return } } The simtriplets.dat files are located in /usr/local/etc/raddb/ Are there anything that I missed out? Thanks, Tony

2 1

One session per username
by Ali Jawad 12 Jul '12

12 Jul '12

Hi All I have pptpd running with freeradius 2.0, all is fine but I want to limit each client to one session per username. Currently a user can logon using his username and password multiple times. Regards

1 0