Freeradius-Users Digest, Vol 30, Issue 106
Maribel Hernandez
mhernandezl at yahoo.com
Tue Oct 30 18:56:33 CET 2007
Hola
freeradius-users-request at lists.freeradius.org wrote: Send Freeradius-Users mailing list submissions to
freeradius-users at lists.freeradius.org
To subscribe or unsubscribe via the World Wide Web, visit
http://lists.freeradius.org/mailman/listinfo/freeradius-users
or, via email, send a message with subject or body 'help' to
freeradius-users-request at lists.freeradius.org
You can reach the person managing the list at
freeradius-users-owner at lists.freeradius.org
When replying, please edit your Subject line so it is more specific
than "Re: Contents of Freeradius-Users digest..."
Today's Topics:
1. Re: SSL certificate problems (Walter Gould)
2. Re: web based admin (Peter Nixon)
3. ??? Re: freeRADIUS + Openldap with TLS (Hangjun He)
4. Re: freeRADIUS + Openldap with TLS [sec=unclassified]
(Ranner, Frank MR)
5. ??? Re: freeRADIUS + Openldap with TLS [sec=unclassified]
(Hangjun He)
----------------------------------------------------------------------
Message: 1
Date: Mon, 29 Oct 2007 10:50:17 -0600
From: Walter Gould
Subject: Re: SSL certificate problems
To: FreeRadius users mailing list
Message-ID: <47260F49.8020909 at auburn.edu>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Alan DeKok wrote:
> Walter Gould wrote:
>
>> I am following the document "FreeRADIUS Active Directory Integration
>> HOWTO" from the freeradius Wiki. I am having problems with creating
>> SSL certificates. When I follow the instructions at the bottom of this
>> doc and run the CA.all script, I see the following errors:
>>
>
> Ugh.
>
> Download CVS head (see the web page for CVS instructions).
>
> $ cd raddb/certs
> $ vi *.cnf ca.cnf, server.cnf to set your local parameters
> $ ./bootstrap
>
> And you will have certificates than can be used in 1.1.x.
>
> Alan DeKok.
> -
> List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
>
Alan & list,
Sorry to bother you guys again - I created new SSL certificates per
your above instructions... After the certs were created, I then:
1. copied them to the /etc/raddb/certs directory
2. updated /etc/raddb/eap.conf with the certificate names & private key
password
3. copied and installed the new certificate (server.pem) onto my XP
laptop and
4. started radiusd in debug mode, below is the output
It is acting as you describe in the FAQ -
"the client sends a series of Access-Request messages, the server sends
an series of Access-Challenge responses, and then... nothing happens.
After a little wait, it all starts again."
So, I am wondering will I need to install the hotfix as listed in the
FAQ - and, will this have to be done on ALL Windows machines? I am
thinking that I still do not have something configured right on my
side. If I uncheck the "validate server certs" box on the XP client, I
can connect and authenticate successfully.
Thanks again -
Walter
Starting - reading configuration files ...
reread_config: reading radiusd.conf
Config: including file: /etc/raddb/proxy.conf
Config: including file: /etc/raddb/clients.conf
Config: including file: /etc/raddb/snmp.conf
Config: including file: /etc/raddb/eap.conf
main: prefix = "/usr"
main: localstatedir = "/var"
main: logdir = "/var/log/radius"
main: libdir = "/usr/lib"
main: radacctdir = "/var/log/radius/radacct"
main: hostname_lookups = no
main: snmp = no
main: max_request_time = 30
main: cleanup_delay = 5
main: max_requests = 1024
main: delete_blocked_requests = 0
main: port = 0
main: allow_core_dumps = no
main: log_stripped_names = no
main: log_file = "/var/log/radius/radius.log"
main: log_auth = yes
main: log_auth_badpass = no
main: log_auth_goodpass = no
main: pidfile = "/var/run/radiusd/radiusd.pid"
main: user = "radiusd"
main: group = "radiusd"
main: usercollide = no
main: lower_user = "no"
main: lower_pass = "no"
main: nospace_user = "no"
main: nospace_pass = "no"
main: checkrad = "/usr/sbin/checkrad"
main: proxy_requests = yes
proxy: retry_delay = 5
proxy: retry_count = 3
proxy: synchronous = no
proxy: default_fallback = yes
proxy: dead_time = 120
proxy: post_proxy_authorize = no
proxy: wake_all_if_all_dead = no
security: max_attributes = 200
security: reject_delay = 1
security: status_server = no
main: debug_level = 0
read_config_files: reading dictionary
read_config_files: reading naslist
Using deprecated naslist file. Support for this will go away soon.
read_config_files: reading clients
read_config_files: reading realms
radiusd: entering modules setup
Module: Library search path is /usr/lib
Module: Loaded exec
exec: wait = yes
exec: program = "(null)"
exec: input_pairs = "request"
exec: output_pairs = "(null)"
exec: packet_type = "(null)"
rlm_exec: Wait=yes but no output defined. Did you mean output=none?
Module: Instantiated exec (exec)
Module: Loaded expr
Module: Instantiated expr (expr)
Module: Loaded MS-CHAP
mschap: use_mppe = yes
mschap: require_encryption = no
mschap: require_strong = no
mschap: with_ntdomain_hack = yes
mschap: passwd = "(null)"
mschap: ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key
--username=%{mschap:User-Name} --challenge=%{mschap:Challenge:-00}
--nt-response=%{mschap:NT-Response:-00}"
Module: Instantiated mschap (mschap)
Module: Loaded eap
eap: default_eap_type = "peap"
eap: timer_expire = 60
eap: ignore_unknown_eap_types = no
eap: cisco_accounting_username_bug = no
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/etc/raddb/certs/server.pem"
tls: certificate_file = "/etc/raddb/certs/server.pem"
tls: CA_file = "/etc/raddb/certs/ca.pem"
tls: private_key_password = "whatever"
tls: dh_file = "/etc/raddb/certs/dh"
tls: random_file = "/etc/raddb/certs/random"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
tls: cipher_list = "DEFAULT"
tls: check_cert_issuer = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
peap: default_eap_type = "mschapv2"
peap: copy_request_to_tunnel = no
peap: use_tunneled_reply = no
peap: proxy_tunneled_request_as_eap = yes
rlm_eap: Loaded and initialized type peap
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/etc/raddb/huntgroups"
preprocess: hints = "/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded CHAP
Module: Instantiated chap (chap)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/etc/raddb/users"
files: acctusersfile = "/etc/raddb/acct_users"
files: preproxy_usersfile = "/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address,
Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile =
"/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded System
unix: cache = no
unix: passwd = "(null)"
unix: shadow = "/etc/shadow"
unix: group = "(null)"
unix: radwtmp = "/var/log/radius/radwtmp"
unix: usegroup = no
unix: cache_reload = 600
Module: Instantiated unix (unix)
Module: Loaded radutmp
radutmp: filename = "/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication *:1812
Listening on accounting *:1813
Ready to process requests.
rad_recv: Access-Request packet from host 131.204.xx.xx:1645, id=60,
length=221
User-Name = "testuser"
Framed-MTU = 1400
Called-Station-Id = "0011.2059.66f0"
Calling-Station-Id = "0016.ce3a.fe00"
Service-Type = Login-User
Message-Authenticator = 0xfa42a088611ca8553c138461a5e37da9
EAP-Message =
0x0203005019800000004616030100410100003d03014725fcbbd1cb646792d9608deda83403db296d7cd4d986561c01f5831c20acc500001600040005000a000900640062000300060013001200630100
NAS-Port-Type = Wireless-802.11
NAS-Port = 1409
State = 0x727730e02c5807c72421f7f8e37c09ef
NAS-IP-Address = 131.204.xx.xx
NAS-Identifier = "RadiusTest"
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
rlm_realm: No '@' in User-Name = "testuser", looking up realm NULL
rlm_realm: No such realm "NULL"
modcall[authorize]: module "suffix" returns noop for request 1
rlm_eap: EAP packet type response id 3 length 80
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 1
modcall[authorize]: module "files" returns notfound for request 1
modcall: leaving group authorize (returns updated) for request 1
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 1
rlm_eap: Request found, released from the list
rlm_eap: EAP/peap
rlm_eap: processing type peap
rlm_eap_peap: Authenticate
rlm_eap_tls: processing TLS
rlm_eap_tls: Length Included
eaptls_verify returned 11
(other): before/accept initialization
TLS_accept: before/accept initialization
rlm_eap_tls: <<< TLS 1.0 Handshake [length 0041], ClientHello
TLS_accept: SSLv3 read client hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 004a], ServerHello
TLS_accept: SSLv3 write server hello A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 079c], Certificate
TLS_accept: SSLv3 write certificate A
rlm_eap_tls: >>> TLS 1.0 Handshake [length 0004], ServerHelloDone
TLS_accept: SSLv3 write server done A
TLS_accept: SSLv3 flush data
TLS_accept:error in SSLv3 read client certificate A
rlm_eap: SSL error error:00000000:lib(0):func(0):reason(0)
In SSL Handshake Phase
In SSL Accept mode
eaptls_process returned 13
rlm_eap_peap: EAPTLS_HANDLED
modcall[authenticate]: module "eap" returns handled for request 1
modcall: leaving group authenticate (returns handled) for request 1
Sending Access-Challenge of id 60 to 131.204.xx.xx port 1645
EAP-Message =
0x0104040a19c0000007f9160301004a0200004603014725fd713883c033611cb8b22760eadd8dc008b3777cee4deeb42e53a23e662c203b8004b2a236f218a339af08991fe4da34e9a6afbdf745661c23ec631dd524d6000400160301079c0b0007980007950003bd308203b9308202a1a003020102020101300d06092a864886f70d01010405003081a8310b30090603550406130255533110300e06035504081307416c6162616d61311a30180603550407131141756275726e20556e69766572736974793120301e060355040a13174f4954202d2041756275726e20556e69766572736974793121301f06092a864886f70d0109011612676f756c64
EAP-Message =
0x77704061756275726e2e656475312630240603550403131d4578616d706c6520436572746966696361746520417574686f72697479301e170d3037313032363138343132335a170d3038313032353138343132335a307e310b30090603550406130255533110300e06035504081307416c6162616d613120301e060355040a13174f4954202d2041756275726e20556e6976657273697479311830160603550403130f726164322e61756275726e2e6564753121301f06092a864886f70d0109011612676f756c6477704061756275726e2e65647530820122300d06092a864886f70d01010105000382010f003082010a0282010100cce2a7fd4a1386
EAP-Message =
0xfc43465e2bdba907a0d05c91d17eddb51fde1e39d67ac9253e45d03b5a1d726807f29a41b4ffd828fd4a6a68ae665f1d23ff5ee598ed1c9733a5dc52e149a884d0683b09d90626c47e1346882b4a3758062bfbc81d11014cafdd8ae5fe5b6fbbf2f0cdbe876c626436c3c596b09a179763a3a67d5876dae7ec67bc7df8c61d9307a46597d0cd673673b1b614badfa12eb3fc44c3f9aaa29a355d8e0bf01e386616ee92b8d1a4e97d58a3ef509b08cc1e20390631cf6d744f7c76ffc560388f152c2e4e6eddd46c114f9e06711f04e9efc62138b7b37f13585063d3dcfd5c769a41c37927b033bbb8131904039cc7a611c4510b280b2b36bdbf02030100
EAP-Message =
0x01a317301530130603551d25040c300a06082b06010505070301300d06092a864886f70d0101040500038201010074cb061838250e4537f80ee16b67a74169886627eae00e18f6a7e8f3e72350d94f286b0599abd0fbd9748b70e2b3d9d044ff342a8f77de5fa4b0b227fc3c453b624d48840b9f2637280592ac20c1a5697a23eb72af6b3fe9ca0ca7bdd7f44a9eb98b8844677107006919a9c7131deca44312d1897c3091564ff915e3f688231ba6207a77e824c3225b3b7e46e1d19d5e4cd7106fcc5a26a0ae848083af27b415d7c419f6d5ecab383d015148f51464464efc8fc248e02a3c341f2011b476100c25c61b18878b7f8b29923bbf6f1cfb
EAP-Message = 0x8af640e1e0303b4951607ff084645a1042980ebec1af
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x91c30afa94d34c8fd79ff73e842f10d2
Finished request 1
Going to the next request
Waking up in 6 seconds...
------------------------------
Message: 2
Date: Mon, 29 Oct 2007 20:19:09 +0200
From: Peter Nixon
Subject: Re: web based admin
To: FreeRadius users mailing list
Message-ID: <200710292019.09827.listuser at peternixon.net>
Content-Type: text/plain; charset="iso-8859-1"
On Mon 29 Oct 2007, Hawkins, Michael wrote:
> Peter,
>
> Yes, I was comparing TACACS+ to RADIUS - my mistake.
>
> Any recommendations on the most appropriate web front end for FreeRadius
> when managing a Cisco network that is pointing at a FreeRadius AAA
> server?
It kind of depends on your backend to be honest. If you use an LDAP backend
phpLDAPadmin is pretty good..
--
Peter Nixon
http://peternixon.net/
------------------------------
Message: 3
Date: Tue, 30 Oct 2007 10:38:35 +0800 (CST)
From: Hangjun He
Subject: ??? Re: freeRADIUS + Openldap with TLS
To: FreeRadius users mailing list
Message-ID: <163678.99683.qm at web15106.mail.cnb.yahoo.com>
Content-Type: text/plain; charset="gb2312"
Hi,
Yes. eap.conf is part of radiusd.conf.
But I can not find a variable to set key-file-password in rlm_ldap section.
# Lightweight Directory Access Protocol (LDAP)
ldap {
server = "ldap.your.domain"
# identity = "cn=admin,o=My Org,c=UA"
# password = mypass
basedn = "o=My Org,c=UA"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
# base_filter = "(objectclass=radiusprofile)"
# set this to 'yes' to use TLS encrypted connections
# to the LDAP database by using the StartTLS extended
# operation.
# The StartTLS operation is supposed to be used with normal
# ldap connections instead of using ldaps (port 689) connections
start_tls = no
# tls_cacertfile = /path/to/cacert.pem
# tls_cacertdir = /path/to/ca/dir/
# tls_certfile = /path/to/radius.crt
# tls_keyfile = /path/to/radius.key
# tls_randfile = /path/to/rnd
# tls_require_cert = "demand"
# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
# profile_attribute = "radiusProfileDn"
access_attr = "dialupAccess"
tnt at kalik.co.yu ???
You already have. eap.conf is a part of radiusd.conf.
Ivan Kalik
Kalik Informatika ISP
Dana 29/10/2007, "Hangjun He" pi?:
>Hi,
>
> I use freeradius 1.1.6 and Openldap 2.3.32. And now It can authenticate success( freeRADIUS + Openldap with TLS TLS encrypt.)
>
> My question is how to set private-key password in radiusd.conf? Is there a related variable to set, just like "private_key_password" in eap.conf .
>
> Thanks.
> John
>
>
>---------------------------------
>??????????
>
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
---------------------------------
??????????
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
------------------------------
Message: 4
Date: Tue, 30 Oct 2007 13:52:02 +1100
From: "Ranner, Frank MR"
Subject: Re: freeRADIUS + Openldap with TLS [sec=unclassified]
To: "FreeRadius users mailing list"
Message-ID:
<3497E314EE23D54EACE26B5CFFD8969802B56964 at drnrxm01.drn.mil.au>
Content-Type: text/plain; charset="us-ascii"
Yes. eap.conf is part of radiusd.conf.
But I can not find a variable to set key-file-password in
rlm_ldap section.
# Lightweight Directory Access Protocol (LDAP)
ldap {
server = "ldap.your.domain"
# identity = "cn=admin,o=My Org,c=UA"
# password = mypass
basedn = "o=My Org,c=UA"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
# base_filter = "(objectclass=radiusprofile)"
# set this to 'yes' to use TLS encrypted connections
# to the LDAP database by using the StartTLS extended
# operation.
# The StartTLS operation is supposed to be used with normal
# ldap connections instead of using ldaps (port 689)
connections
start_tls = no
# tls_cacertfile = /path/to/cacert.pem
# tls_cacertdir = /path/to/ca/dir/
# tls_certfile = /path/to/radius.crt
# tls_keyfile = /path/to/radius.key
# tls_randfile = /path/to/rnd
# tls_require_cert = "demand"
# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
# profile_attribute = "radiusProfileDn"
access_attr = "dialupAccess"
So use openssl to remove the password from the key and put the key in a
secure directory. The key itself should have 400 permissions and be
owned
by the ldap user. What's the problem?
Regards,
Frank Ranner
------------------------------
Message: 5
Date: Tue, 30 Oct 2007 12:48:50 +0800 (CST)
From: Hangjun He
Subject: ??? Re: freeRADIUS + Openldap with TLS [sec=unclassified]
To: FreeRadius users mailing list
Message-ID: <476711.12276.qm at web15108.mail.cnb.yahoo.com>
Content-Type: text/plain; charset="gb2312"
Thanks.
So key-file-password do not set in radiusd.conf/rlm_ldap section.
I still donot know how to configure key-password in Openldap, Where I can get any document or Wiki ? Thanks.
John.
"Ranner, Frank MR" ???
Yes. eap.conf is part of radiusd.conf.
But I can not find a variable to set key-file-password in
rlm_ldap section.
# Lightweight Directory Access Protocol (LDAP)
ldap {
server = "ldap.your.domain"
# identity = "cn=admin,o=My Org,c=UA"
# password = mypass
basedn = "o=My Org,c=UA"
filter = "(uid=%{Stripped-User-Name:-%{User-Name}})"
# base_filter = "(objectclass=radiusprofile)"
# set this to 'yes' to use TLS encrypted connections
# to the LDAP database by using the StartTLS extended
# operation.
# The StartTLS operation is supposed to be used with normal
# ldap connections instead of using ldaps (port 689)
connections
start_tls = no
# tls_cacertfile = /path/to/cacert.pem
# tls_cacertdir = /path/to/ca/dir/
# tls_certfile = /path/to/radius.crt
# tls_keyfile = /path/to/radius.key
# tls_randfile = /path/to/rnd
# tls_require_cert = "demand"
# default_profile = "cn=radprofile,ou=dialup,o=My Org,c=UA"
# profile_attribute = "radiusProfileDn"
access_attr = "dialupAccess"
So use openssl to remove the password from the key and put the key in a
secure directory. The key itself should have 400 permissions and be
owned
by the ldap user. What's the problem?
Regards,
Frank Ranner
-
List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
---------------------------------
??????????
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
------------------------------
=== message truncated ===
CON CARIÑO
MARIBEL HERNÁNDEZ LÓPEZ
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20071030/a93cc49a/attachment.html>
More information about the Freeradius-Users
mailing list