- Freeradius-Users - lists.freeradius.org

working with vouchers
by anmeyer＠anup.de 10 Jul '12

10 Jul '12

Hello! Without considering any security is it possible to hand out a voucher to a client with just the ESSID, the username and the password written down and this client can authenticate to the radiusserver over the authenticator? Please be patient with me! Andreas

5 7

(no subject)
by Stephane Brodeur 10 Jul '12

10 Jul '12

http://testfartu.yoyo.pl/pscda.html?utkk=qqapeu

1 0

Re: working with vouchers
by Alan Buxey 09 Jul '12

09 Jul '12

Yrs, if you don't care about security and verification of server cert, then just username and password will work with PEAP. Some clients will throw up warning messages (that users ignore)..messages can be reduced by using a CA that is known by the clients. The above is not best practice under any security front alan

3 2

Debug/Freeradius help
by Justin Huckabay 09 Jul '12

09 Jul '12

Hello, I'm setting up freeradius for the first time and I am having an issue with the "radtest testing password localhost 0 testing123" I am getting "radclient: no response from server for ID 2 socket 3" I have ran the freeradius debugging output and below are the 2 highlighted errors it shows as well as the full debug, I'm unsure on how to fix these 2 errors so we can move forward.... and yes I know next to nothing so if i'm doing anything obviously wrong feel free to bash me about it! "reject_delay = 1" is what is showing as the error the rest is for context. } security { max_attributes = 200 reject_delay = 1 status_server = yes } Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" root@localhost administrator]# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jul 19 2011 at 10:16:18 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/filesroot@localhost administrator]# radiusd -X FreeRADIUS Version 2.1.10, for host i686-pc-linux-gnu, built on Jul 19 2011 at 10:16:18 Copyright (C) 1999-2009 The FreeRADIUS server project and contributors. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. You may redistribute copies of FreeRADIUS under the terms of the GNU General Public License v2. Starting - reading configuration files ... including configuration file /etc/raddb/radiusd.conf including configuration file /etc/raddb/proxy.conf including configuration file /etc/raddb/clients.conf including files in directory /etc/raddb/modules/ including configuration file /etc/raddb/modules/attr_filter including configuration file /etc/raddb/modules/always including configuration file /etc/raddb/modules/mschap including configuration file /etc/raddb/modules/preprocess including configuration file /etc/raddb/modules/mac2ip including configuration file /etc/raddb/modules/realm including configuration file /etc/raddb/modules/smsotp including configuration file /etc/raddb/modules/echo including configuration file /etc/raddb/modules/etc_group including configuration file /etc/raddb/modules/linelog including configuration file /etc/raddb/modules/sql_log including configuration file /etc/raddb/modules/otp including configuration file /etc/raddb/modules/smbpasswd including configuration file /etc/raddb/modules/mac2vlan including configuration file /etc/raddb/modules/sradutmp including configuration file /etc/raddb/modules/policy including configuration file /etc/raddb/modules/dynamic_clients including configuration file /etc/raddb/modules/radutmp including configuration file /etc/raddb/modules/ippool including configuration file /etc/raddb/modules/perl including configuration file /etc/raddb/modules/sqlcounter_expire_on_login including configuration file /etc/raddb/modules/counter including configuration file /etc/raddb/modules/cui including configuration file /etc/raddb/modules/ntlm_auth including configuration file /etc/raddb/modules/pam including configuration file /etc/raddb/modules/exec including configuration file /etc/raddb/modules/opendirectory including configuration file /etc/raddb/modules/inner-eap including configuration file /etc/raddb/modules/passwd including configuration file /etc/raddb/modules/logintime including configuration file /etc/raddb/modules/expr including configuration file /etc/raddb/modules/detail.log including configuration file /etc/raddb/modules/unix including configuration file /etc/raddb/modules/expiration including configuration file /etc/raddb/modules/attr_rewrite including configuration file /etc/raddb/modules/pap including configuration file /etc/raddb/modules/files including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 1645 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address 127.0.0.1 port 1645 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1313 Ready to process requests. including configuration file /etc/raddb/modules/detail including configuration file /etc/raddb/modules/detail.example.com including configuration file /etc/raddb/modules/wimax including configuration file /etc/raddb/modules/acct_unique including configuration file /etc/raddb/modules/chap including configuration file /etc/raddb/modules/digest including configuration file /etc/raddb/modules/checkval including configuration file /etc/raddb/eap.conf including configuration file /etc/raddb/policy.conf including files in directory /etc/raddb/sites-enabled/ including configuration file /etc/raddb/sites-enabled/default including configuration file /etc/raddb/sites-enabled/control-socket including configuration file /etc/raddb/sites-enabled/inner-tunnel main { user = "radiusd" group = "radiusd" allow_core_dumps = no } including dictionary file /etc/raddb/dictionary main { prefix = "/usr" localstatedir = "/var" logdir = "/var/log/radius" libdir = "/usr/lib/freeradius" radacctdir = "/var/log/radius/radacct" hostname_lookups = no max_request_time = 30 cleanup_delay = 5 max_requests = 1024 pidfile = "/var/run/radiusd/radiusd.pid" checkrad = "/usr/sbin/checkrad" debug_level = 0 proxy_requests = yes log { stripped_names = no auth = no auth_badpass = no auth_goodpass = no } security { max_attributes = 200 reject_delay = 1 status_server = yes } } radiusd: #### Loading Realms and Home Servers #### proxy server { retry_delay = 5 retry_count = 3 default_fallback = no dead_time = 120 wake_all_if_all_dead = no } home_server localhost { ipaddr = 127.0.0.1 port = 1812 type = "auth" secret = "testing123" response_window = 20 max_outstanding = 65536 require_message_authenticator = yes zombie_period = 40 status_check = "status-server" ping_interval = 30 check_interval = 30 num_answers_to_alive = 3 num_pings_to_alive = 3 revive_interval = 120 status_check_timeout = 4 irt = 2 mrt = 16 mrc = 5 mrd = 30 } home_server_pool my_auth_failover { type = fail-over home_server = localhost } realm example.com { auth_pool = my_auth_failover } realm LOCAL { } radiusd: #### Loading Clients #### client localhost { ipaddr = 127.0.0.1 require_message_authenticator = no secret = "testing123" nastype = "other" } radiusd: #### Instantiating modules #### instantiate { Module: Linked to module rlm_exec Module: Instantiating module "exec" from file /etc/raddb/modules/exec exec { wait = no input_pairs = "request" shell_escape = yes } Module: Linked to module rlm_expr Module: Instantiating module "expr" from file /etc/raddb/modules/expr Module: Linked to module rlm_expiration Module: Instantiating module "expiration" from file /etc/raddb/modules/expiration expiration { reply-message = "Password Has Expired " } Module: Linked to module rlm_logintime Module: Instantiating module "logintime" from file /etc/raddb/modules/logintime logintime { reply-message = "You are calling outside your allowed timespan " minimum-timeout = 60 } } radiusd: #### Loading Virtual Servers #### server inner-tunnel { # from file /etc/raddb/sites-enabled/inner-tunnel modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_pap Module: Instantiating module "pap" from file /etc/raddb/modules/pap pap { encryption_scheme = "auto" auto_header = no } Module: Linked to module rlm_chap Module: Instantiating module "chap" from file /etc/raddb/modules/chap Module: Linked to module rlm_mschap Module: Instantiating module "mschap" from file /etc/raddb/modules/mschap mschap { use_mppe = yes require_encryption = no require_strong = no with_ntdomain_hack = no } Module: Linked to module rlm_unix Module: Instantiating module "unix" from file /etc/raddb/modules/unix unix { radwtmp = "/var/log/radius/radwtmp" } Module: Linked to module rlm_eap Module: Instantiating module "eap" from file /etc/raddb/eap.conf eap { default_eap_type = "md5" timer_expire = 60 ignore_unknown_eap_types = no cisco_accounting_username_bug = no max_sessions = 4096 } Module: Linked to sub-module rlm_eap_md5 Module: Instantiating eap-md5 Module: Linked to sub-module rlm_eap_leap Module: Instantiating eap-leap Module: Linked to sub-module rlm_eap_gtc Module: Instantiating eap-gtc gtc { challenge = "Password: " auth_type = "PAP" } Module: Linked to sub-module rlm_eap_tls Module: Instantiating eap-tls tls { rsa_key_exchange = no dh_key_exchange = yes rsa_key_length = 512 dh_key_length = 512 verify_depth = 0 CA_path = "/etc/raddb/certs" pem_file_type = yes private_key_file = "/etc/raddb/certs/server.pem" certificate_file = "/etc/raddb/certs/server.pem" CA_file = "/etc/raddb/certs/ca.pem" private_key_password = "whatever" dh_file = "/etc/raddb/certs/dh" random_file = "/etc/raddb/certs/random" fragment_size = 1024 include_length = yes check_crl = no cipher_list = "DEFAULT" cache { enable = no lifetime = 24 max_entries = 255 } verify { } } Module: Linked to sub-module rlm_eap_ttls Module: Instantiating eap-ttls ttls { default_eap_type = "md5" copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" include_length = yes } Module: Linked to sub-module rlm_eap_peap Module: Instantiating eap-peap peap { default_eap_type = "mschapv2" copy_request_to_tunnel = no use_tunneled_reply = no proxy_tunneled_request_as_eap = yes virtual_server = "inner-tunnel" } Module: Linked to sub-module rlm_eap_mschapv2 Module: Instantiating eap-mschapv2 mschapv2 { with_ntdomain_hack = no } Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_realm Module: Instantiating module "suffix" from file /etc/raddb/modules/realm realm suffix { format = "suffix" delimiter = "@" ignore_default = no ignore_null = no } Module: Linked to module rlm_files Module: Instantiating module "files" from file /etc/raddb/modules/files files { usersfile = "/etc/raddb/users" acctusersfile = "/etc/raddb/acct_users" preproxy_usersfile = "/etc/raddb/preproxy_users" compat = "no" } Module: Checking session {...} for more modules to load Module: Linked to module rlm_radutmp Module: Instantiating module "radutmp" from file /etc/raddb/modules/radutmp radutmp { filename = "/var/log/radius/radutmp" username = "%{User-Name}" case_sensitive = yes check_with_nas = yes perm = 384 callerid = yes } Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load Module: Linked to module rlm_attr_filter Module: Instantiating module "attr_filter.access_reject" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.access_reject { attrsfile = "/etc/raddb/attrs.access_reject" key = "%{User-Name}" } } # modules } # server server { # from file /etc/raddb/radiusd.conf modules { Module: Checking authenticate {...} for more modules to load Module: Linked to module rlm_digest Module: Instantiating module "digest" from file /etc/raddb/modules/digest Module: Checking authorize {...} for more modules to load Module: Linked to module rlm_preprocess Module: Instantiating module "preprocess" from file /etc/raddb/modules/preprocess preprocess { huntgroups = "/etc/raddb/huntgroups" hints = "/etc/raddb/hints" with_ascend_hack = no ascend_channels_per_line = 23 with_ntdomain_hack = no with_specialix_jetstream_hack = no with_cisco_vsa_hack = no with_alvarion_vsa_hack = no } Module: Checking preacct {...} for more modules to load Module: Linked to module rlm_acct_unique Module: Instantiating module "acct_unique" from file /etc/raddb/modules/acct_unique acct_unique { key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port" } Module: Checking accounting {...} for more modules to load Module: Linked to module rlm_detail Module: Instantiating module "detail" from file /etc/raddb/modules/detail detail { detailfile = "/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d" header = "%t" detailperm = 384 dirperm = 493 locking = no log_packet_header = no } Module: Instantiating module "attr_filter.accounting_response" from file /etc/raddb/modules/attr_filter attr_filter attr_filter.accounting_response { attrsfile = "/etc/raddb/attrs.accounting_response" key = "%{User-Name}" } Module: Checking session {...} for more modules to load Module: Checking post-proxy {...} for more modules to load Module: Checking post-auth {...} for more modules to load } # modules } # server radiusd: #### Opening IP addresses and Ports #### listen { type = "auth" ipaddr = 127.0.0.1 port = 1645 } listen { type = "acct" ipaddr = * port = 0 } listen { type = "control" listen { socket = "/var/run/radiusd/radiusd.sock" } } listen { type = "auth" ipaddr = 127.0.0.1 port = 18120 } Listening on authentication address 127.0.0.1 port 1645 Listening on accounting address * port 1813 Listening on command file /var/run/radiusd/radiusd.sock Listening on authentication address 127.0.0.1 port 18120 as server inner-tunnel Listening on proxy address * port 1313 Ready to process requests.

2 1

"Manual" certificate checking
by Sven Dreyer 09 Jul '12

09 Jul '12

Hi List, at work, I have the following requirements for IP phones which should be authenticated before joining the network: - Root CA --> Sub CA --> Device certificates - The phones have the Sub CA certificate locally installed as "trustworthy" (NOT the Root CA certificate!) - The RADIUS server must only send its server certificate (not the whole chain) - The phones only send their device certificate to the RADIUS server I tried to build this scenario with FreeRADIUS (2.1.10, on Debian), but got stuck at the following points: - I only put the RADIUS server certificate to certificate_file. But as soon as CA_path or CA_file are set, FreeRADIUS sends the whole certficiate chain to the phone. - As soon as I unset CA_path and CA_file, FreeRADIUS sends only the content of certificate_file to the phone, which is what I want. Of course, phone certificate checking then doesn't work anymore. - So I thought that I implement phone certificate checking using the "verify" block. But this only seems to work "on top" of the built-in certificate checking. Does anybody have a hint? Thanks, Sven

2 5

How to Disable on Iphone and MAC OSX Clients use of Certificates
by Nedi 09 Jul '12

09 Jul '12

Hi, I use on Bufallo Router the Freeradius Server future and all works well with Certificates, but sometimes after router reboot some clients can’t login in the Network if Certificate used. If I disable the certificate check on windows I can login without Certificate but on new Macbook and Iphone I can’t disable Certificate check. Has anyone idea what I can do? and is this dangerous to communicate in Wlan without Certificate check activated? Can the Wlan without use of Certificate easy be hacked? Best Regards Nedi -

2 1

problem with multiple ldap
by Prateek Kumar 09 Jul '12

09 Jul '12

Hi, I have configured freeradius to select ldap modules according to NAS-IP-Address so clients (using PEAP/MSCHAPv2) associating to particular AP should only get authenticated. For that I did changes as: 1. modules/ldap file -------------------------- ldap HR { ou=HR,dc=prateek,dc=com ... } ldap dev { ou=dev,dc=prateek,dc=com ... } 2. In ldap.attrmap ------------------- checkItem Cleartext-Password userPassword := 3. In both sites-available/default & sites-available/inner-tunnel ------------------------------ -------------------------------------- a. in authorize section if (NAS-IP-Address == 127.0.0.1) { HR } else { dev } b. in authenticate section have uncommented Auth-Type MS-CHAP { mschap } Now when I use eapol_test to test I get Success.. It first checks HR which returns search failed as there is no user in ou=HR but when freeradius processes the inner-tunnel I get the message ++? if (NAS-IP-Address == 127.0.0.1) (Attribute NAS-IP-Address was not found) ++- entering else else {...} And after that user "dave" is getting authenticated who should not get authenticated. I want to know that why it didn't get NAS-IP-Adderss. Is there some thing I have missed ? Regards, Prateek radiusd -X ( Deleating some EAP messages ) rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=0, length=116 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000090164617665 Message-Authenticator = 0x1eb24decc31fcd482762d37920cb6f5d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=Administrator,dc=prateek,dc=com/mypass to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 0: Preceding "if" was taken [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type tls [tls] Requiring client certificate [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 0 to 127.0.0.1 port 46032 EAP-Message = 0x010100060d20 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a099cf6a77937551a6a21d9f Finished request 0. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=1, length=131 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020100060319 State = 0xa098c2e9a099cf6a77937551a6a21d9f Message-Authenticator = 0xb0f144be9973b7716b25f5b7a09ffd9c +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 1: Preceding "if" was taken [eap] EAP packet type response id 1 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_counter: Entering module authorize code rlm_counter: Could not find Check item value pair ++[daily] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] WARNING! No "known good" password found for the user. Authentication may fail because of this. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP NAK [eap] EAP-NAK asked for EAP-Type/peap [eap] processing type tls [tls] Initiate [tls] Start returned 1 ++[eap] returns handled Sending Access-Challenge of id 1 to 127.0.0.1 port 46032 EAP-Message = 0x010200061920 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a19adb6a77937551a6a21d9f Finished request 1. Going to the next request rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=2, length=242 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = some long value State = 0xa098c2e9a19adb6a77937551a6a21d9f Message-Authenticator = 0xabcfe03ec5688a184e25c56589ea8e2a +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 2: Preceding "if" was taken [eap] EAP packet type response id 2 length 117 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 107 [peap] Length Included [peap] eaptls_verify returned 11 [peap] (other): before/accept initialization [peap] TLS_accept: before/accept initialization [peap] <<< TLS 1.0 Handshake [length 0066], ClientHello [peap] TLS_accept: SSLv3 read client hello A [peap] >>> TLS 1.0 Handshake [length 0035], ServerHello [peap] TLS_accept: SSLv3 write server hello A [peap] >>> TLS 1.0 Handshake [length 0870], Certificate [peap] TLS_accept: SSLv3 write certificate A [peap] >>> TLS 1.0 Handshake [length 020d], ServerKeyExchange [peap] TLS_accept: SSLv3 write key exchange A [peap] >>> TLS 1.0 Handshake [length 0004], ServerHelloDone [peap] TLS_accept: SSLv3 write server done A [peap] TLS_accept: SSLv3 flush data [peap] TLS_accept: Need to read more data: SSLv3 read client certificate A In SSL Handshake Phase In SSL Accept mode [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 2 to 127.0.0.1 port 46032 EAP-Message = some value EAP-Message = " EAP-Message = " EAP-Message = " EAP-Message = 0xb70064119cfc40adfde72ecc Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a29bdb6a77937551a6a21d9f Finished request 2. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=3, length=131 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020300061900 State = 0xa098c2e9a29bdb6a77937551a6a21d9f Message-Authenticator = 0xc7a295a94c264c2b101dabae43ad8557 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 3: Preceding "if" was taken [eap] EAP packet type response id 3 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 3 to 127.0.0.1 port 46032 EAP-Message = EAP-Message = EAP-Message = EAP-Message = EAP-Message = 0x30c3456c19147657 Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a39cdb6a77937551a6a21d9f Finished request 3. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=4, length=131 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400061900 State = 0xa098c2e9a39cdb6a77937551a6a21d9f Message-Authenticator = 0x64a3ceaa178064f424d2830f6d59ade4 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 4: Preceding "if" was taken [eap] EAP packet type response id 4 length 6 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] Received TLS ACK [peap] ACK handshake fragment handler [peap] eaptls_verify returned 1 [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 4 to 127.0.0.1 port 46032 EAP-Message = EAP-Message = EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a49ddb6a77937551a6a21d9f Finished request 4. Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=5, length=333 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = State = 0xa098c2e9a49ddb6a77937551a6a21d9f Message-Authenticator = 0xa3cadaf5d585e4499d7e2d587f9924ae +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 5: Preceding "if" was taken [eap] EAP packet type response id 5 length 208 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS TLS Length 198 [peap] Length Included [peap] eaptls_verify returned 11 [peap] <<< TLS 1.0 Handshake [length 0086], ClientKeyExchange [peap] TLS_accept: SSLv3 read client key exchange A [peap] <<< TLS 1.0 ChangeCipherSpec [length 0001] [peap] <<< TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 read finished A [peap] >>> TLS 1.0 Handshake [length 00aa]??? [peap] TLS_accept: SSLv3 write session ticket A [peap] >>> TLS 1.0 ChangeCipherSpec [length 0001] [peap] TLS_accept: SSLv3 write change cipher spec A [peap] >>> TLS 1.0 Handshake [length 0010], Finished [peap] TLS_accept: SSLv3 write finished A [peap] TLS_accept: SSLv3 flush data [peap] (other): SSL negotiation finished successfully SSL Connection Established [peap] eaptls_process returned 13 [peap] EAPTLS_HANDLED ++[eap] returns handled Sending Access-Challenge of id 5 to 127.0.0.1 port 46032 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a59edb6a77937551a6a21d9f Finished request 5. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=6, length=131 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020600061900 State = 0xa098c2e9a59edb6a77937551a6a21d9f Message-Authenticator = 0x7aeef64b2758737cbc8720c0dafbeca6 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=0, length=116 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020000090164617665 Message-Authenticator = 0x1eb24decc31fcd482762d37920cb6f5d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=Administrator,dc=prateek,dc=com/mypass to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 0: Preceding "if" was taken [eap] EAP packet type response id 0 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[unix] returns notfound ++[files] returns noop rlm_counter: Entering module authorize code Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = State = 0xa098c2e9a69fdb6a77937551a6a21d9f Message-Authenticator = 0x91d0e9b22d3e6b84caf5e58aeae97b9b +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 7: Preceding "if" was taken [eap] EAP packet type response id 7 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Identity - dave [peap] Got tunneled request EAP-Message = 0x020700090164617665 server { PEAP: Got tunneled identity of dave PEAP: Setting default EAP type for tunneled EAP session. PEAP: Setting User-Name to dave Sending tunneled request EAP-Message = 0x020700090164617665 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "dave" server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop ++? if (NAS-IP-Address == 127.0.0.1) (Attribute NAS-IP-Address was not found) <----------------------------------------------------------------- ++- entering else else {...} [dev] performing user authorization for dave [dev] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [dev] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [dev] expand: ou=development,dc=prateek,dc=com -> ou=development,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: attempting LDAP reconnection rlm_ldap: (re)connect to 127.0.0.1:389, authentication 0 rlm_ldap: bind as cn=Administrator,dc=prateek,dc=com/mypass to 127.0.0.1:389 rlm_ldap: waiting for bind result ... rlm_ldap: Bind was successful rlm_ldap: performing search in ou=development,dc=prateek,dc=com, with filter (uid=dave) [dev] No default NMAS login sequence [dev] looking for check items in directory... rlm_ldap: userPassword -> Cleartext-Password := "davesecret" [dev] looking for reply items in directory... [dev] user dave authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[dev] returns ok ++- else else returns ok [eap] EAP packet type response id 7 length 9 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] EAP Identity [eap] processing type mschapv2 rlm_eap_mschapv2: Issuing Challenge ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1b9d7bc71b9561595ab9d2c73552e623 [peap] Got tunneled reply RADIUS code 11 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1b9d7bc71b9561595ab9d2c73552e623 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 7 to 127.0.0.1 port 46032 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a790db6a77937551a6a21d9f Finished request 7. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=8, length=269 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = State = 0xa098c2e9a790db6a77937551a6a21d9f Message-Authenticator = 0x5b313677254c02c3556f0d2067e4922d +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 8: Preceding "if" was taken [eap] EAP packet type response id 8 length 144 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = server { PEAP: Setting User-Name to dave Sending tunneled request EAP-Message = FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "dave" State = 0x1b9d7bc71b9561595ab9d2c73552e623 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop ++? if (NAS-IP-Address == 127.0.0.1) (Attribute NAS-IP-Address was not found) <------------------------------------------------------------------------------------------- ++- entering else else {...} [dev] performing user authorization for dave [dev] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [dev] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [dev] expand: ou=development,dc=prateek,dc=com -> ou=development,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=development,dc=prateek,dc=com, with filter (uid=dave) [dev] No default NMAS login sequence [dev] looking for check items in directory... rlm_ldap: userPassword -> Cleartext-Password := "davesecret" [dev] looking for reply items in directory... [dev] user dave authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[dev] returns ok ++- else else returns ok [eap] EAP packet type response id 8 length 63 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [mschapv2] +- entering group MS-CHAP {...} [mschap] Told to do MS-CHAPv2 for dave with NT-Password [mschap] adding MS-CHAPv2 MPPE keys ++[mschap] returns ok MSCHAP Success ++[eap] returns handled } # server inner-tunnel [peap] Got tunneled reply code 11 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1b9d7bc71a9461595ab9d2c73552e623 [peap] Got tunneled reply RADIUS code 11 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0x1b9d7bc71a9461595ab9d2c73552e623 [peap] Got tunneled Access-Challenge ++[eap] returns handled Sending Access-Challenge of id 8 to 127.0.0.1 port 46032 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a891db6a77937551a6a21d9f Finished request 8. Going to the next request Waking up in 4.9 seconds. rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=9, length=205 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = Message-Authenticator = 0x1e2153de29daf702780bb061ae5a1281 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 9: Preceding "if" was taken [eap] EAP packet type response id 9 length 80 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type peap [peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] EAP type mschapv2 [peap] Got tunneled request EAP-Message = 0x020900061a03 server { PEAP: Setting User-Name to dave Sending tunneled request EAP-Message = 0x020900061a03 FreeRADIUS-Proxied-To = 127.0.0.1 User-Name = "dave" State = 0x1b9d7bc71a9461595ab9d2c73552e623 server inner-tunnel { +- entering group authorize {...} ++[chap] returns noop ++[mschap] returns noop ++[unix] returns notfound [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++[control] returns noop ++? if (NAS-IP-Address == 127.0.0.1) (Attribute NAS-IP-Address was not found) <----------------------------------------------------------------------------------------------------- ++- entering else else {...} [dev] performing user authorization for dave [dev] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [dev] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [dev] expand: ou=development,dc=prateek,dc=com -> ou=development,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=development,dc=prateek,dc=com, with filter (uid=dave) [dev] No default NMAS login sequence [dev] looking for check items in directory... rlm_ldap: userPassword -> Cleartext-Password := "davesecret" [dev] looking for reply items in directory... [dev] user dave authorized to use remote access rlm_ldap: ldap_release_conn: Release Id: 0 +++[dev] returns ok ++- else else returns ok [eap] EAP packet type response id 9 length 6 [eap] No EAP Start, assuming it's an on-going EAP conversation ++[eap] returns updated ++[files] returns noop ++[expiration] returns noop ++[logintime] returns noop [pap] Found existing Auth-Type, not changing it. ++[pap] returns noop Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/mschapv2 [eap] processing type mschapv2 [eap] Freeing handler ++[eap] returns ok } # server inner-tunnel [peap] Got tunneled reply code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "dave" [peap] Got tunneled reply RADIUS code 2 EAP-Message = 0x03090004 Message-Authenticator = 0x00000000000000000000000000000000 User-Name = "dave" [peap] Tunneled authentication was successful. [peap] SUCCESS ++[eap] returns handled Sending Access-Challenge of id 9 to 127.0.0.1 port 46032 EAP-Message = Message-Authenticator = 0x00000000000000000000000000000000 State = 0xa098c2e9a992db6a77937551a6a21d9f Finished request 9 rad_recv: Access-Request packet from host 127.0.0.1 port 46032, id=10, length=221 User-Name = "dave" NAS-IP-Address = 127.0.0.1 Calling-Station-Id = "02-00-00-00-00-01" Framed-MTU = 1400 NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = Message-Authenticator = 0x8ab3c117c8c59031dd6294781bd2de68 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop [suffix] No '@' in User-Name = "dave", looking up realm NULL [suffix] No such realm "NULL" ++[suffix] returns noop ++? if (NAS-IP-Address == 127.0.0.1) ? Evaluating (NAS-IP-Address == 127.0.0.1) -> TRUE ++? if (NAS-IP-Address == 127.0.0.1) -> TRUE ++- entering if (NAS-IP-Address == 127.0.0.1) {...} [HR] performing user authorization for dave [HR] WARNING: Deprecated conditional expansion ":-". See "man unlang" for details [HR] expand: (uid=%{Stripped-User-Name:-%{User-Name}}) -> (uid=dave) [HR] expand: ou=HR,dc=prateek,dc=com -> ou=HR,dc=prateek,dc=com rlm_ldap: ldap_get_conn: Checking Id: 0 rlm_ldap: ldap_get_conn: Got Id: 0 rlm_ldap: performing search in ou=HR,dc=prateek,dc=com, with filter (uid=dave) rlm_ldap: object not found [HR] search failed rlm_ldap: ldap_release_conn: Release Id: 0 +++[HR] returns notfound ++- if (NAS-IP-Address == 127.0.0.1) returns notfound ++ ... skipping else for request 10: Preceding "if" was taken [eap] EAP packet type response id 10 length 96 [eap] Continuing tunnel setup. ++[eap] returns ok Found Auth-Type = EAP +- entering group authenticate {...} [eap] Request found, released from the list [eap] EAP/peap [eap] processing type p[peap] processing EAP-TLS [peap] eaptls_verify returned 7 [peap] Done initial handshake [peap] eaptls_process returned 7 [peap] EAPTLS_OK [peap] Session established. Decoding tunneled attributes. [peap] Received EAP-TLV response. [peap] Success [eap] Freeing handler ++[eap] returns ok +- entering group post-auth {...} ++[exec] returns noop Sending Access-Accept of id 10 to 127.0.0.1 port 46032eap

2 2

2 Factor Authetication and EAP-GTC
by Carl Pierre 09 Jul '12

09 Jul '12

Hello: I have recently been made a part of a project in which we intend to use freeradius. So far, FR seems to be the ideal tool except for one small issue: 2-Factor Authentication. Try as I might, I cannot seem to find any way to set up a multi-factor solution using PEAP. So I suppose my question is this: has anyone had any luck using EAP and challenging the user to enter some sort of OTP? I know that EAP-GTC is meant to do this, but the meager documentation I have on it does not give too much detail. Regards

2 1

Re: problem with multiple ldap
by Alan Buxey 07 Jul '12

07 Jul '12

You don't have the preprocess module listed in inner-tunnel alan

1 0

IPv6 sql ippool
by Josip Almasi 06 Jul '12

06 Jul '12

Hi all, ippool can't handle IPv6 addresses, but sql ippool should be able to, right? At least in postgres, inet data type accepts both v4 and v6 addresses. Anyone using it? Any handy tools to fill the database/generate pool addresses? Any other hints? Regards...

1 0