Re: How to forward MAC-authentiation-requests over a FreeRADIUS-proxy to a FreeRADIUS-server?

8 Oct 2008

      Hello again,

here is the info I collected concerning the “It still doesn’t work” section:

***** FreeRADIUS-proxy ************************************************

***** users:

Standard entry of localhost and

DEFAULT Proxy-To-Realm := "RADIUS_REALM"

***** clients.conf:

client 192.168.1.58 {

secret = testing123

}

***** debug:

main {

prefix = "/usr"

localstatedir = "/var"

logdir = "/var/log/freeradius"

libdir = "/usr/lib/freeradius"

radacctdir = "/var/log/freeradius/radacct"

hostname_lookups = no

max_request_time = 30

cleanup_delay = 5

max_requests = 1024

allow_core_dumps = no

pidfile = "/var/run/freeradius/freeradius.pid"

user = "freerad"

group = "freerad"

checkrad = "/usr/sbin/checkrad"

debug_level = 0

proxy_requests = yes

security {

max_attributes = 200

reject_delay = 1

status_server = yes

}

}

client localhost {

ipaddr = 127.0.0.1

require_message_authenticator = no

secret = "testing123"

nastype = "other"

}

client 192.168.1.58 {

require_message_authenticator = no

secret = "testing123"

}

radiusd: #### Loading Realms and Home Servers ####

proxy server {

retry_delay = 5

retry_count = 3

default_fallback = no

dead_time = 120

wake_all_if_all_dead = no

}

home_server RADIUS_SERVER {

ipaddr = 192.168.1.61

port = 1812

type = "auth"

secret = "testing123"

response_window = 20

max_outstanding = 65536

zombie_period = 40

status_check = "request"

ping_check = "none"

ping_interval = 30

check_interval = 30

num_answers_to_alive = 3

num_pings_to_alive = 3

revive_interval = 120

status_check_timeout = 4

}

home_server_pool RADIUS_SERVER_POOL {

type = fail-over

home_server = RADIUS_SERVER

}

realm RADIUS_REALM {

auth_pool = RADIUS_SERVER_POOL

}

radiusd: #### Instantiating modules ####

instantiate {

Module: Linked to module rlm_exec

Module: Instantiating exec

exec {

wait = yes

input_pairs = "request"

shell_escape = yes

}

Module: Linked to module rlm_expr

Module: Instantiating expr

Module: Linked to module rlm_expiration

Module: Instantiating expiration

expiration {

reply-message = "Password Has Expired "

}

Module: Linked to module rlm_logintime

Module: Instantiating logintime

logintime {

reply-message = "You are calling outside your allowed timespan "

minimum-timeout = 60

}

}

radiusd: #### Loading Virtual Servers ####

server inner-tunnel {

modules {

Module: Checking authenticate {...} for more modules to load

Module: Linked to module rlm_pap

Module: Instantiating pap

pap {

encryption_scheme = "auto"

auto_header = no

}

Module: Linked to module rlm_chap

Module: Instantiating chap

Module: Linked to module rlm_mschap

Module: Instantiating mschap

mschap {

use_mppe = yes

require_encryption = no

require_strong = no

with_ntdomain_hack = no

}

Module: Linked to module rlm_unix

Module: Instantiating unix

unix {

radwtmp = "/var/log/freeradius/radwtmp"

}

Module: Linked to module rlm_eap

Module: Instantiating eap

eap {

default_eap_type = "md5"

timer_expire = 60

ignore_unknown_eap_types = no

cisco_accounting_username_bug = no

}

Module: Linked to sub-module rlm_eap_md5

Module: Instantiating eap-md5

Module: Linked to sub-module rlm_eap_leap

Module: Instantiating eap-leap

Module: Linked to sub-module rlm_eap_gtc

Module: Instantiating eap-gtc

gtc {

challenge = "Password: "

auth_type = "PAP"

}

rlm_eap: Ignoring EAP-Type/tls because we do not have OpenSSL support.

rlm_eap: Ignoring EAP-Type/ttls because we do not have OpenSSL support.

rlm_eap: Ignoring EAP-Type/peap because we do not have OpenSSL support.

Module: Linked to sub-module rlm_eap_mschapv2

Module: Instantiating eap-mschapv2

mschapv2 {

with_ntdomain_hack = no

}

Module: Checking authorize {...} for more modules to load

Module: Linked to module rlm_realm

Module: Instantiating suffix

realm suffix {

format = "suffix"

delimiter = "@"

ignore_default = no

ignore_null = no

}

Module: Linked to module rlm_files

Module: Instantiating files

files {

usersfile = "/etc/freeradius/users"

acctusersfile = "/etc/freeradius/acct_users"

preproxy_usersfile = "/etc/freeradius/preproxy_users"

compat = "no"

}

Module: Checking session {...} for more modules to load

Module: Linked to module rlm_radutmp

Module: Instantiating radutmp

radutmp {

filename = "/var/log/freeradius/radutmp"

username = "%{User-Name}"

case_sensitive = yes

check_with_nas = yes

perm = 384

callerid = yes

}

Module: Checking post-proxy {...} for more modules to load

Module: Checking post-auth {...} for more modules to load

Module: Linked to module rlm_attr_filter

Module: Instantiating attr_filter.access_reject

attr_filter attr_filter.access_reject {

attrsfile = "/etc/freeradius/attrs.access_reject"

key = "%{User-Name}"

}

}

}

server {

modules {

Module: Checking authenticate {...} for more modules to load

Module: Checking authorize {...} for more modules to load

Module: Linked to module rlm_preprocess

Module: Instantiating preprocess

preprocess {

huntgroups = "/etc/freeradius/huntgroups"

hints = "/etc/freeradius/hints"

with_ascend_hack = no

ascend_channels_per_line = 23

with_ntdomain_hack = no

with_specialix_jetstream_hack = no

with_cisco_vsa_hack = no

Module: Linked to module rlm_preprocess

Module: Instantiating preprocess

preprocess {

huntgroups = "/etc/freeradius/huntgroups"

hints = "/etc/freeradius/hints"

with_ascend_hack = no

ascend_channels_per_line = 23

with_ntdomain_hack = no

with_specialix_jetstream_hack = no

with_cisco_vsa_hack = no

with_alvarion_vsa_hack = no

}

Module: Checking preacct {...} for more modules to load

Module: Linked to module rlm_acct_unique

Module: Instantiating acct_unique

acct_unique {

key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, 
NAS-Port"

}

Module: Checking accounting {...} for more modules to load

Module: Linked to module rlm_detail

Module: Instantiating detail

detail {

detailfile = 
"/var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d"

header = "%t"

detailperm = 384

dirperm = 493

locking = no

log_packet_header = no

}

Module: Instantiating attr_filter.accounting_response

attr_filter attr_filter.accounting_response {

attrsfile = "/etc/freeradius/attrs.accounting_response"

key = "%{User-Name}"

}

Module: Checking session {...} for more modules to load

Module: Checking post-proxy {...} for more modules to load

Module: Checking post-auth {...} for more modules to load

}

}

radiusd: #### Opening IP addresses and Ports ####

listen {

type = "proxy"

ipaddr = 192.168.1.80

port = 1812

}

main {

snmp = no

smux_password = ""

snmp_write_access = no

}

Listening on proxy address 192.168.1.80 port 1812

Ready to process requests.

radtest:

Local on the proxy: radtest 00-3F-08-27-10-11 00-3f-08-27-10-11 
192.168.1.80 1812 testing123

Logfile of proxy: Error: Invalid packet code 1 sent to a proxy port from 
home server 192.168.1.80 port 40341 - ID 96 : IGNORED

 From FR-server to proxy: 00-3F-08-27-10-11 00-3f-08-27-10-11 
192.168.1.80 1812 testing123

Logfile of proxy: Error: Invalid packet code 1 sent to a proxy port from 
home server 192.168.1.61 port 42477 - ID 19 : IGNORED

***** FreeRADIUS-server ************************************************

***** users:

Standard entry of localhost

***** clients.conf:

client 192.168.1.80 {

secret = testing123

}

The FreeRADIUS-Server runs fine.

I tested it with radtest and with some clients connected to my switch.

***** Comment to the proxy.conf 
************************************************

The switch was not configured as home server as you can see – that’s the 
weird thing.

You said that the proxy port is 1814 but the authentication port 1812 is 
not used by the proxy, correct?

Is it incorrect to use port 1812 to receive proxy requests when the 
switch sends it to 1812, too?

Thank you for your help!

Best regards,

Raphael Brüngel