March 2009 - Freeradius-Devel - lists.freeradius.org

Missing TLS Change Cipher Spec and TLS Finished in EAP-TLS exchanges
by arno＠natisbad.org 09 Jul '11

09 Jul '11

Hi, I upgraded an internal freeradius server (Linux, Debian unstable, libssl 0.9.8) used for EAP-TLS (802.11 WPA2 access) from 2.0.5 to 2.1.3. With 2.1.3, client authentication fails in the following way (wpasupplicant on Debian unstable, working with 2.0.5): - the TLS exchange is completed from freeradius point of view. It even sends the Access-Accept message to the NAS. - from the clients point of view, the TLS exchange is not over, it expects some more data from the server which are never sent. I took two pcap traces (sent to you privately, Alan), one with 2.0.5, one with 2.1.3. It looks like the TLS Change Cipher and TLS Tinished elements of the TLS exchange are not in the EAP encapsulated TLS packets sent by the server. Compare packet #23 of 2.1.3 trace with packet #27 of 2.0.5 trace. If you use wireshark, you will notice that the SSL layer is dissected; this is because #27 has a small brother: #29. It is not sent by 2.1.3. Alan, if you have an idea or a patch, I can test it on monday. Cheers, a+

5 15

eap2 in freeradius
by Chanthearith HUON 04 Apr '11

04 Apr '11

Hi everyone, I am testing eap2 in freeradius. I run "radiusd -X", I got following error message " radiusd: symbol lookup error: /usr/lib/rlm_eap2-2.1.0.so: undefined symbol: eap_server_register_methods " Anyone, have any idea what might be wrong with the configuration? Thank in advance, Thierry

5 10

Re: vmps request: long attribute VQP-Ethernet-Frame
by Hermann Lauer 05 Jan '10

05 Jan '10

Alan DeKok wrote: > > 0x0c05 is VQP-Ethernet-Frame, which can of course be longer than 253 bytes, > > so there is a design issue here. One idea would be to cut the attribute to > > 253 bytes in vqp_recv(). Could this be done there without memory issues ? > > Yes, if you're not interested in the rest of the data. appended is a patch which implemeted the cutting. Seems to work. Please tell me if anybody sees any pitfall in it. Otherwise it should be cleaned up, which I probably will do in a week or so. Thanks, Hermann -- Netzwerkadministration/Zentrale Dienste, Interdiziplinaeres Zentrum fuer wissenschaftliches Rechnen der Universitaet Heidelberg IWR; INF 368; 69120 Heidelberg; Tel: (06221)54-8236 Fax: -5224 Email: Hermann.Lauer(a)iwr.uni-heidelberg.de

2 5

FreeRadius + EAP-AKA support
by Kumar, Sunil 26 Nov '09

26 Nov '09

Hi, We are trying to use FreeRadius1.1.4 as authentication server for EAP-AKA implementation with our product toolkit. As per the RFC 4187 AT_RES The value field of this attribute begins with the 2-byte RES Length, which identifies the exact length of the RES in bits. The RES length is followed by the AKA RES parameter. According to [TS33.105], the length of the AKA RES can vary between 32 and 128 bits. Because the length of the AT_RES attribute must be a multiple of 4 bytes, the sender pads the RES with zero bits where necessary. In the freeradius1.1.4 implementation, for EAP-AKA the value of RES length is always considered as constant EAPSIM_RES_SIZE (16). It doesn't take care of the values other than 16 bytes. We in our toolkit needs to support all the variable length of RES values from 32 bits (4 bytes) to 128 bits (16 bytes). So I have modified the FreeRadius implementation for the same support. The intention of writing such mail is to get the information that if somebody has already noticed and fixed this issue in the latest releases, so please share that information as well. In case it's not been fixed as yet, then may be I could contribute my patch for freeradius 1.1.4 version to support all variable length RES value varying from 32 bits to 128 bits. Thanks. Warm regards. Sunil Kumar The information contained in this electronic mail transmission may be privileged and confidential, and therefore, protected from disclosure. If you have received this communication in error, please notify us immediately by replying to this message and deleting it from your computer without copying or disclosing it.

4 5

GnuTLS and FreeRADIUS
by Carolin Latze 08 May '09

08 May '09

Hi everybody, I was searching for some time now and I found a lot of messages from people who wanted to replace the OpenSSL dependencies in FreeRADIUS with GnuTLS. But so far it seems, that nobody really did that, is that right? Or has there been work on that and it failed for some reason? To be honest I have absolutely no idea how complicated that will be but at least I don't expect it to be easy. :) Regards Carolin

5 6

Does freeradius-client library support CHAP protocol?
by Tarkshya 21 Apr '09

21 Apr '09

Hi all, I was trying to figure out whether CHAP protocol is supported by freeradius-client library or not. I am reaching two contradictory conclusions using my own dubious analysis. Hence the request for help. If my understanding is correct, (and I might be totally wrong here), then the PAP protocol sends the user passwords in clear text over the wire. On the other hand, CHAP protocol uses a shared secret between the client and server to encrypt the passwords being sent over the wire. Since I do see the use of shared secret in freeradius-client library configuration file, I assume that the library does support CHAP. However, in the source code of the library, I notice that the section doing the CHAP processing is turned off using the #if 0 directive. Meaning CHAP is not being used. What gives? Also, after wading through the archives of this mailing list, I came across the post of one user who had asked exactly the same question, that is to say, whether CHAP is supported or not. The answer he got was that, "at this stage, better not use CHAP". This is an ambiguous reply as far as I am concerned because it evades a direct answer. Please reply Tarkshya

3 10

Re :freeRadius PAM -- handling reply attributes
by krishna Mohan 31 Mar '09

31 Mar '09

krishna Mohan wrote:> I wrote my PAM module (to authenticate a user against Sun AM) for> freeRadius and that part is working fine. Now, the PAM module will> receive few response attributes from the authenticating application for> each user, for whom the authentication is success.> > How to receive this kind of application specific attributes and how to> insert them in Radius-Accept packet? This is an urgent requirement for me.> The server has an API for creating attributes. Use that.>> Alan DeKok.Where is the API available? Pls provide any resource/link?I receive an xml with authorization information from the authenticating app in response to a successful authentication.My PAM module should read that xml and get the required authorization information and pass it in ACCESS-ACCEPT.Thanks in advance.Sri

2 1

GIT Log for 2009-03-29 23:33 GMT
by aland＠deployingradius.com 31 Mar '09

31 Mar '09

commit aa40f81af40a5f5b46ced1351692a8fcd738f862 Author: Alan T. DeKok <aland(a)freeradius.org> Date: Sun Mar 29 13:52:15 2009 -0700 Add support for !* filtering. All attributes will be deleted man/man5/unlang.5 | 30 +++++++++++++----------------- src/main/evaluate.c | 8 ++++++++ 2 files changed, 21 insertions(+), 17 deletions(-)

4 6

Re: pam -- how to handle reply attributes
by Alan DeKok 31 Mar '09

31 Mar '09

krishna Mohan wrote: > I wrote my PAM module (to authenticate a user against Sun AM) for > freeRadius and that part is working fine. Now, the PAM module will > receive few response attributes from the authenticating application for > each user, for whom the authentication is success. > > How to receive this kind of application specific attributes and how to > insert them in Radius-Accept packet? This is an urgent requirement for me. The server has an API for creating attributes. Use that. Alan DeKok.

1 0

freeRadius PAM -- handling reply attributes
by krishna Mohan 30 Mar '09

30 Mar '09

Hi,      I wrote my PAM module (to authenticate a user against Sun AM) for freeRadius and that part is working fine. Now, the PAM module will receive few response attributes from the authenticating application for each user, for whom the authentication is success.How to receive this kind of application specific attributes and how to insert them in Radius-Accept packet? This is an urgent requirement for me.Appreciating your help.Thanks,Sri.

1 0