August 2008 - Freeradius-Devel - lists.freeradius.org

{Filename?} eap-tls certificate in freeradius
by Chanthearith HUON 20 Aug '08

20 Aug '08

ATTENTION !!! Au moins une piÃ¨ce jointe Ã ce message ne vous a pas Ã©tÃ© transmise (server.cnf, client.cnf, ca.cnf). SVP lire la piÃ¨ce jointe Â«AlerteVirus.txtÂ» pour plus d'informations. --- Warning: This message has had one or more attachments removed Warning: (server.cnf, client.cnf, ca.cnf). Warning: Please read the "INT-Attachment-Warning.txt" attachment(s) for more information. Hello everyone, I am currently experimenting eap-tls for delay comparison. I am using wpa_supplicant radius's client and freeradius server. I am now having problem dealing with certificates. I used the script provided in the freeradius package to create those certificates successfully however, during the authentication the freeradius just denied the certificate and send "eap failure, code Failure (4)" (showed from Wireshark) to client. I am using fedora 8 (kernel 2.6.23.9-85.fc8) to host both freeradius and wpa_supplicant. Freeradius 1.1.6 (for host i686-pc-linux-gnu, built on Jun 1 2007) wpa_supplicant v0.5.7 (also tried with v0.5.8 but still same problem ) I am not sure if the configurations for creating certificates are correct. Here is the configuration scripts to create CA, server and client certifcates (also attached in the mail): -------------------------- CA ------------------------------ [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/ca.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/ca.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 365 default_crl_days = 30 default_md = md5 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = certificate_authority default_bits = 2048 input_password = whatever output_password = whatever x509_extensions = v3_ca [certificate_authority] countryName = FR stateOrProvinceName = Evry localityName = Evry organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "Example Certificate Authority" [v3_ca] subjectKeyIdentifier = hash authorityKeyIdentifier = keyid:always,issuer:always basicConstraints = CA:true -------------------------- end of CA ------------------------------ -------------------------- Server ------------------------------ [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 365 default_crl_days = 30 default_md = md5 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = server default_bits = 2048 input_password = whatever output_password = whatever [server] countryName = FR stateOrProvinceName = Evry localityName = Evry organizationName = Example Inc. emailAddress = admin(a)example.com commonName = "Example Server Certificate" -------------------------- end of Server ------------------------------ -------------------------- client ------------------------------ [ ca ] default_ca = CA_default [ CA_default ] dir = ./ certs = $dir crl_dir = $dir/crl database = $dir/index.txt new_certs_dir = $dir certificate = $dir/server.pem serial = $dir/serial crl = $dir/crl.pem private_key = $dir/server.key RANDFILE = $dir/.rand name_opt = ca_default cert_opt = ca_default default_days = 365 default_crl_days = 30 default_md = md5 preserve = no policy = policy_match [ policy_match ] countryName = match stateOrProvinceName = match organizationName = match organizationalUnitName = optional commonName = supplied emailAddress = optional [ policy_anything ] countryName = optional stateOrProvinceName = optional localityName = optional organizationName = optional organizationalUnitName = optional commonName = supplied emailAddress = optional [ req ] prompt = no distinguished_name = client default_bits = 2048 input_password = whatever output_password = whatever [client] countryName = FR stateOrProvinceName = Evry localityName = Evry organizationName = Example Inc. emailAddress = user(a)example.com commonName = root@localhost -------------------------- end of client ------------------------------ Best regards, Thierry

1 0

GIT Log for 2008-08-19 23:33 GMT
by aland＠deployingradius.com 19 Aug '08

19 Aug '08

commit 4a4f1f79da432d194e9771ccd768725f9f9bac98 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 19 18:50:43 2008 +0200 As posted to the list Files changed: share/dictionary | 1 - share/dictionary.utstarcom | 40 ---------------------------------------- 2 files changed, 0 insertions(+), 41 deletions(-) ====================================================================== commit 1578c10c3a23ec0ed377228881270a69e4c40d7c Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 19 18:44:49 2008 +0200 Script to convert funk to fr dictionaries Files changed: share/dct2fr | 30 ------------------------------ 1 files changed, 0 insertions(+), 30 deletions(-) ====================================================================== commit 2c3fb8e2c359ce8b75aa425d01ec04b6f48253ed Author: Alan T. DeKok <aland(a)freeradius.org> Date: Tue Aug 19 14:10:54 2008 +0200 Un-document %{exec:foo}, as the documentation was wrong Files changed: man/man5/unlang.5 | 21 +++++++++++++++++++++ 1 files changed, 21 insertions(+), 0 deletions(-) ====================================================================== commit 3421211b0e904ca3b64e770093c3f142a514842b Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 18 08:50:39 2008 +0200 Cleaned up debug messages Files changed: src/modules/rlm_eap/eap.c | 44 ++++++++++++++++++++++++-------------------- 1 files changed, 24 insertions(+), 20 deletions(-) ====================================================================== commit 9178aafacf481d20ce7fc3645b330fb926ecf668 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 18 08:50:25 2008 +0200 Added radlog_request function Files changed: src/modules/rlm_eap/radeapclient.c | 11 ----------- 1 files changed, 0 insertions(+), 11 deletions(-) ======================================================================

1 0

Consult about NAS
by Seguridad ISL 18 Aug '08

18 Aug '08

Hello everybody I'm implementing a freeradius server, with some NAS, that have pppoe server that validate their users in that Freeradius server, but I have a little problem!! IF some NAS turn off, the radius doesn't disconnect the users that was login in that NAS. The radius clean that client, when the NAS turn on again, and in that time the clients can't reconnect. Someone know how to have an attribute, like time-out, for the NAS, that check if NASs are working, and if not kill all the users connect in that dead NAS? Thanks Rafael Lore

2 1

GIT Log for 2008-08-18 23:33 GMT
by aland＠deployingradius.com 18 Aug '08

18 Aug '08

commit cabe0a0e04c141017b32d114418ab83d1d752c20 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 18 08:39:36 2008 +0200 Cleaned up && clarified debugging messages Files changed: src/main/auth.c | 58 ++++++++++++++++++++++++++++-------------------------- 1 files changed, 30 insertions(+), 28 deletions(-) ====================================================================== commit 4ef03d029c4130fb589af5036b59f2894de393cf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Mon Aug 18 08:39:12 2008 +0200 Minor changes to debug messages Files changed: src/main/modcall.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit 53a2d1e5a937e730166cf7feecc41bb54df06b03 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 18:20:12 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_eap/libeap/eap_tls.c | 24 +++++++++++------------- 1 files changed, 11 insertions(+), 13 deletions(-) ====================================================================== commit 1647c81e9972e50e939e518b08d82ae14dd33bbf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 18:12:45 2008 +0200 Minor optimization Files changed: src/modules/rlm_sqlippool/rlm_sqlippool.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit bbede736d27ecf622d8fdef6ad141a3f03e7161f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 18:12:13 2008 +0200 Note dynamic clients on NAS-Identifier Files changed: raddb/sites-available/dynamic-clients | 6 ------ 1 files changed, 0 insertions(+), 6 deletions(-) ====================================================================== commit 30e1d99a5987944a5e1d15ad54746589a35ade41 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 18:11:49 2008 +0200 Document recent changes Files changed: doc/ChangeLog | 12 ++---------- 1 files changed, 2 insertions(+), 10 deletions(-) ====================================================================== commit b4045dd940db77a2be665078e7a2902fb75fd44f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 18:11:36 2008 +0200 Build process uses git now, not CVS Files changed: Makefile | 14 +++++++++----- 1 files changed, 9 insertions(+), 5 deletions(-) ======================================================================

1 0

Re: radiusd process just dies after EAP State issue....(2.0.3)
by James Nedila 18 Aug '08

18 Aug '08

Hi Alan, Just a note to say I also see this on my server in the latest 2.0.5. I have tried to catch it, but unfortunately my server is far too busy to leave in gdb. I'll keep trying, but for now, I'm using monit to keep my server running. The error occurs approx. twice a day for me, and takes down the server each time. From what I can tell, the majority of errors happen when a Mac OSX client is attempting to connect, if that helps. If I can grab a gdb trace, i'll post to this list. James

1 0

GIT Log for 2008-08-17 23:33 GMT
by aland＠deployingradius.com 17 Aug '08

17 Aug '08

commit 1c1b63e19c582d6824cd090de663e9ff9a1e8fbc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 10:17:50 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_eap2/rlm_eap2.c | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) ====================================================================== commit c4b469952aab3a3f0e98021112a863d84f40ea25 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 10:16:28 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_sqlippool/rlm_sqlippool.c | 70 +++++++++++++++++++++------- 1 files changed, 52 insertions(+), 18 deletions(-) ====================================================================== commit 59a0239cbaaa57d3f6e8ac2d153153037d1efcd9 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 10:10:44 2008 +0200 DEBUG -> RDEBUG, and related changes Files changed: src/modules/rlm_sql/rlm_sql.c | 210 +++++++++++++++++++++++------------------ 1 files changed, 118 insertions(+), 92 deletions(-) ====================================================================== commit 06d0dbd8b46f26a93dbd425a3002ded98d128691 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 09:50:06 2008 +0200 Use new debugging functions (RDEBUG, radlog_request) Files changed: src/modules/rlm_sql_log/rlm_sql_log.c | 66 +++++++++++++++++++++----------- 1 files changed, 43 insertions(+), 23 deletions(-) ====================================================================== commit db61d415ff81fe57db4fe2c642616cb7f30842d2 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 09:45:28 2008 +0200 We don't use pthread functions, so delete them. Files changed: src/modules/rlm_sql_log/rlm_sql_log.c | 17 +++++++++++++++++ 1 files changed, 17 insertions(+), 0 deletions(-) ====================================================================== commit 8260701a8cbeffc73b29ae147aa4ac534680d799 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 08:53:21 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_ippool/rlm_ippool.c | 40 +++++++++++++++++----------------- 1 files changed, 20 insertions(+), 20 deletions(-) ====================================================================== commit 104c76bbc3dc52c858d0a8ea480615f3c57e0bec Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 08:52:00 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_expiration/rlm_expiration.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit 710270eac846183a08c10fef962582b1137b8b69 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 08:49:13 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_passwd/rlm_passwd.c | 12 ++++++------ 1 files changed, 6 insertions(+), 6 deletions(-) ====================================================================== commit 38dad6f9ef03a4b238ed9e9a5b65f45624d1aa50 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 08:47:01 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_expr/rlm_expr.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) ====================================================================== commit 20e400e3bb18a45dd796517a10aca00c7520974f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 08:46:06 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_exec/rlm_exec.c | 14 +++++++------- 1 files changed, 7 insertions(+), 7 deletions(-) ====================================================================== commit 8fc15e6a41b57fdf526a8c5fb35cc6cd3db05d60 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 08:44:49 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_example/rlm_example.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit a96e5a6b7e99eb8f658231ab7598abbb27de3650 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Aug 17 08:43:54 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_acct_unique/rlm_acct_unique.c | 6 +++--- 1 files changed, 3 insertions(+), 3 deletions(-) ======================================================================

1 0

GIT Log for 2008-08-16 23:33 GMT
by aland＠deployingradius.com 16 Aug '08

16 Aug '08

commit 7c313a83ea4b82a0b93af4963768bb6452b50ef1 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sat Aug 16 11:01:05 2008 +0200 Added dBCSPwd == LM-Password As noted on http://msdn.microsoft.com/en-us/library/ms675480(VS.85).aspx Files changed: raddb/ldap.attrmap | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit 2d90d6e42fd465e864e97caa60419d4c8836d6ad Author: Alan T. DeKok <aland(a)freeradius.org> Date: Thu Aug 14 17:17:45 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_ldap/rlm_ldap.c | 96 ++++++++++++++++++++------------------- 1 files changed, 50 insertions(+), 46 deletions(-) ====================================================================== commit 6743a2537ea90882ccb87aa1baa1335331ca5447 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 14:37:50 2008 +0200 DEBUG -> RDEBUG Files changed: src/modules/rlm_unix/rlm_unix.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) ====================================================================== commit a9224bc2fe79ddf66ed94631e1382fe820627a42 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 14:36:48 2008 +0200 Use new radlog_request function Files changed: src/modules/rlm_unix/rlm_unix.c | 15 +++++++-------- 1 files changed, 7 insertions(+), 8 deletions(-) ======================================================================

1 0

perlembed and PERL_SYS_INIT3
by Stephen Gran 14 Aug '08

14 Aug '08

Hi there all, Recently we got a bug report on freeradius that is not yet confirmed, but seems likely to be right. The short version is that rlm_perl does not use the recommended perl macros to set up the environment correctly, resulting in perl_parse() hanging in a futex lock on at least hppa. The slightly longer version is viewable at http://bugs.debian.org/495073 and the bug report linked from there. There are tentative patches in our git tree viewable at http://git.debian.org/?p=collab-maint/freeradius.git;a=commitdiff;h=e651a5b… and http://git.debian.org/?p=collab-maint/freeradius.git;a=commitdiff;h=4eca65e… (the second one cleans up the compiler complaints the first introduced). Thanks, -- -------------------------------------------------------------------------- | Stephen Gran | Blue paint today. [Funny to Jack | | steve(a)lobefin.net | Slingwine, Guy Harris and Hal Pierson. | | http://www.lobefin.net/~steve | Ed.] | --------------------------------------------------------------------------

2 3

pam_radius-1.3.17 ruser implementation
by HORSTMAN, MARK A (ATTSI) 14 Aug '08

14 Aug '08

I don't use the 'ruser' option to pam_radius.so, but while porting pam_radius-1.3.17 to Mac OS X 10.5.4 I noticed the following warning: cc -Wall -fPIC -arch i386 -c pam_radius_auth.c -o pam_radius_auth.o ... pam_radius_auth.c:1112: warning: assignment from incompatible pointer type Which equates to the following assignment: user = userinfo; Oddly enough these are locally defined as: CONST char *user; CONST char **userinfo; So I don't know that the 'user = userinfo' assignment is doing what was intended. Additionally, userinfo is assigned a few lines above that with the call: retval = pam_get_item(pamh, PAM_RUSER, (CONST void **)&userinfo); So a *** is being passed and cast as a **? That doesn't seem right. I would think that the ruser feature is not working, but I don't use it. Mark Horstman

1 0

GIT Log for 2008-08-13 23:33 GMT
by aland＠deployingradius.com 13 Aug '08

13 Aug '08

commit 84575124e6224d6f966b689b40fb575e2ce51147 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 12:07:49 2008 +0200 Set request->username to be Stripped-User-Name Files changed: src/modules/rlm_expr/paircmp.c | 1 - 1 files changed, 0 insertions(+), 1 deletions(-) ====================================================================== commit b98eeccc2b8b83fe8ff11c9cf655648e84a9cbbf Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 11:31:01 2008 +0200 More examples for Acct-Status-Type Files changed: raddb/modules/linelog | 22 +++------------------- 1 files changed, 3 insertions(+), 19 deletions(-) ====================================================================== commit 3818d963b92c77ec47c6279d3e990965530e62fc Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 11:29:20 2008 +0200 Allow suppression of more log messages Files changed: src/modules/rlm_linelog/rlm_linelog.c | 5 ----- 1 files changed, 0 insertions(+), 5 deletions(-) ====================================================================== commit 179b9ff2df981db53db1b0cbbc83b1ce182b8c9f Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 11:23:13 2008 +0200 Increase buffer size for log messages Files changed: src/modules/rlm_acctlog/rlm_acctlog.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit c1ccc3b626e188854451e5c7f4a1fd0202677b51 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 11:02:19 2008 +0200 Fixed typo Files changed: raddb/sites-available/dynamic-clients | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) ====================================================================== commit f5309300da50e2d21613d4e936fad8423baacd66 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Wed Aug 13 11:02:01 2008 +0200 More comments Files changed: raddb/clients.conf | 24 +++++++++++++----------- 1 files changed, 13 insertions(+), 11 deletions(-) ======================================================================

1 0