FW: Need help with EAP-AKA configuration
Hello, I am trying to configure EAP-AKA virtual-server in FreeRADIUS to perform authentication of multiple sim cards we own. We have followed the documentation and configured below in sites-enabled/eap-aka-sim and able to authenticate successful with EAPOL_TEST tool using same Ki and OPc: <<<<<<<<<<<<<<<<<<<<<<<<<<<< send Challenge-Request { &control.SIM-Ki := 0x465b5ce8b199b49faa5f0a2ee238a6bc &control.SIM-Opc := 0xcd63cb71954a9f4e48a5994e37a02baf &control.SIM-SQN := 3 }
>>>>>>>>>>>>>>>>>>>>>>>>>
However, this helps in authenticating only the imsi with above Ki/OPc. But our requirement is to authenticate multiple such IMSIs/SIMs with their Ki/OPc whose values we are aware of. May I know how to specify the list of imsi/Users and make it work instead of hardcoding like above? We tried adding following line in 'users' file in raddb/ folder and removed above hardcoding in Challenge-Response part of eap-aka-sim virtual-server configuration : "315010000000002@wlan.mnc010.mcc315.3gppnetwork.org<mailto:315010000000002@wlan.mnc010.mcc315.3gppnetwork.org> SIM-Ki := 770db7f9275c47eb3d12b2024caa3548, SIM-Opc := 6245aedadf3ebbb82b0f62df52e0de12, SIM-SQN := 3" But it's not working. I have attached the radiusd Logs with the mail. Where I see following error - """ (0.0) eap-aka-sim - WARNING: Could not find or derive data for UMTS vector (0.0) eap-aka-sim - ERROR: Failed retrieving UMTS vectors """ Summary of my setup: * FreeRadius version4 - Configured, compiled and installed from master Branch * wpa_supplicant version 2.10 * Ubuntu 20.04 LTS Any help would be greatly appreciated. Thank you in advance. Best regards, Mrudul Dighe.
On Apr 26, 2023, at 2:11 PM, Mrudul Dighe <mdighe@highway9networks.com> wrote:
I am trying to configure EAP-AKA virtual-server in FreeRADIUS to perform authentication of multiple sim cards we own. We have followed the documentation and configured below in sites-enabled/eap-aka-sim and able to authenticate successful with EAPOL_TEST tool using same Ki and OPc:
<<<<<<<<<<<<<<<<<<<<<<<<<<<<
send Challenge-Request { &control.SIM-Ki := 0x465b5ce8b199b49faa5f0a2ee238a6bc &control.SIM-Opc := 0xcd63cb71954a9f4e48a5994e37a02baf &control.SIM-SQN := 3 }
Note those attributes go into the "control" list.
May I know how to specify the list of imsi/Users and make it work instead of hardcoding like above?
The server has many, many ways to select user information from a variety of sources. LDAP, SQL, etc. are all supported.
We tried adding following line in 'users' file in raddb/ folder and removed above hardcoding in Challenge-Response part of eap-aka-sim virtual-server configuration :
315010000000002@wlan.mnc010.mcc315.3gppnetwork.org SIM-Ki := 770db7f9275c47eb3d12b2024caa3548, SIM-Opc := 6245aedadf3ebbb82b0f62df52e0de12, SIM-SQN := 3"
That's adding the SIM-Ki attributes to the reply. See the documentation for the "users" file.
But it's not working.
I have attached the radiusd Logs with the mail. Where I see following error -
Read the debug output. *All* of it. The "send Challenge-Request" section you posted above shows you adding the SM information there. You put the user information into the "files" module. The debug output shows that you're not running the "files" module in the "send Challenge-Request" section. So look up the user in the "send Challenge-Request" section, and then add the attributes there. if you use the "files" module, it will add attributes to the reply by default. But that's fine, because you can copy them from the reply to the control list if necessary: send Challenge-Request { files if (ok) { &control.SIM-Ki := &reply.SIM-Ki &control.SIM-OPc := &reply.SIM-Opc &control.SIM-SQN := &reply.SIM-SQN } ... } That should work, I think. But I don't use EAP-AKA myself. Alan DeKok.
participants (2)
-
Alan DeKok -
Mrudul Dighe