- Freeradius-Devel - lists.freeradius.org

Help: PAP with Sha1
by vishal_nitr 20 Apr '12

20 Apr '12

Hi,    I am using free-radius-2.1.12. I see that radius uses MD5 for encoding/decoding passwords. I am using PAP authentication.    In my radius client I changed encoding to SHA1; due to which radius started rejecting auth requests saying password mismatch from rlm_pap which is obvious.     I tried changing few things in lib/radius.c to SHA1 but with no success. I ran radiusd with -X option and I saw following:With MD5 from client:        User-Name = "vishal"        Calling-Station-Id = "00-23-68-0F-1A-E6"        NAS-Port = 0        NAS-Port-Type = Wireless-802.11        Framed-MTU = 1400        Service-Type = Framed-User        NAS-IP-Address = 127.0.0.1        NAS-Identifier = "ap7131-0F1AE6"        NAS-Port-Id = "0"        User-Password = "vishal123" With SHA1 from client:        User-Name = "vishal"        Calling-Station-Id = "00-23-68-0F-1A-E6"        NAS-Port = 0        NAS-Port-Type = Wireless-802.11        Framed-MTU = 1400        Service-Type = Framed-User        NAS-IP-Address = 127.0.0.1        NAS-Identifier = "ap7131-0F1AE6"        NAS-Port-Id = "0"        User-Password = "\356Ew\2310\347\326\367h\r1\223,\224\024\352\027\241>5" Alan Dekok just informed me that RADIUS uses MD5 and it can't be changed (thanks ALAN). And I don't want to go against protocol. But as I have spent almost a week in finding a location where RADIUS decodes the password received from client. Please can somebody point me the place where this happens. Thanks and Regards, Vishal Kotalwar, Bangalore-35. 09900055647.

3 2

Is it possible to log the Dial-In user password?
by Henrik Karlsson 19 Apr '12

19 Apr '12

Hi, I need to log the Dial-In users Password and I wonder if it is possible to do that in a freeRADIUS server? I'm using freeRadius and MySQL server to store information such as userinfo and traffic logs. If it is possible can someone please describe how? Regards Henrik Henrik Karlsson Projektledare Direkt: +46 (0)8-601 66 57 Mobil: +46 (0)76-104 65 87 Fax: +46 (0)19-10 19 45 Generic Mobile Systems Sweden AB Drottninggatan 10 702 10 ÖREBRO henrik.karlsson(a)generic.se<mailto:henrik.karlsson@generic.se> www.genericmobile.se<http://www.genericmobile.se/> Kommunikation via SMS, fax, e-post, Minicall, webb - välj det som passar ditt företag bäst [cid:image001.jpg@01CD1D6C.4E0275F0]

4 3

Fwd: Upgraded freeradius to 2.1.12 with openssl 0.9.8n - Error: No SSL info available. Waiting for more SSL data.
by Winson Fernandes 16 Apr '12

16 Apr '12

Hi, I upgraded freeradius version from 2.0.2 to 2.1.12 and also the openssl version from 0.9.7 to 0.9.8n. The issue I am facing now is with peap mschapv2 windows client not able to authenticate with my radius server. The error is [peap] No SSL info available. Waiting for more SSL data. I added few more logs and I could see the callback function cbtls_msg returning due to the arg (state) being NULL in freeradius-server-2.1.12/src/modules/rlm_eap/libeap/cb.c void cbtls_msg /* * Work around bug #298, where we may be called with a NULL * argument. We should really log a serious error */ if (!arg) return; Not sure what the bug298 is all about and also what could be the possible reason for the arg (state) to be NULL? Regards, Winson

2 3

few small bugfixes
by Matthew Newton 11 Apr '12

11 Apr '12

Hi, Three small bugs fixed over the Easter holiday: commit 98e44bb638aa0656e823e42f6bab37e33910c8b9 This one's my fault. You shouldn't try and change the group of the linelog file if you're using syslog. Moved the chgrp inside the block that does file-related non-syslog stuff. commit 45a0c370ad73384fbbe1fa8e5f7c8337b99423c1 I noticed that if FR started up and some eap sub-modules couldn't be loaded (weren't there, or on initial timeout the cert generation takes too long), it segfaulted. This fixes the test where the pointer had been set to NULL, and the if was trying to check the contents. commit ca706b82e6b0a8b774e97077e5e01489cd3bbefc Another one I missed before - there is now no need for EAP-TLS to be present for PEAP or TTLS to work, so no need for the check & error if it's not there. All three at https://github.com/mcnewton/freeradius-server/tree/smallfixes Cheers, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 1

Using %{User-Password} in sql query for mschapv2
by Oliver 01 Apr '12

01 Apr '12

Hi everybody, I use FreeRADIUS Version 2.1.10 on Debian with OpenVPN and xl2tp/openswan and the rlm_sql module. I want to use the user password in a sql query in dialup.conf. This works fine with ssh and openvpn logins but not with mschapv2. I don't know if the password is really not submitted or just not replaced in the sql query. Is there a simple way to make this work? Thanks in advance

3 6

Re: Using %{User-Password} in sql query for mschapv2
by Alan Buxey 01 Apr '12

01 Apr '12

It can be stored as nthash alan

2 1

New Developer Intro / Help with building RPM
by Jason Rohm 27 Mar '12

27 Mar '12

Hello. I'm new to the community. I'm getting involved primarily out of interest in radsec improvements. My background is in networking, mostly Cisco stuff. I've been doing quite a bit of development around Cisco phone system automation. Primarily in PHP and Java, but I have some C experience in another life. I consider myself a linux 'power user' but not an expert. I've been successful in downloading the repo from git and compiling it locally. I was able to use the locally compiled code to begin testing but would like to roll it out to other hosts, most of which are not (and cannot) be setup for local compiling. I have NOT been successful in building an RPM directly from the git repo. I'm using the following Mandriva wiki page as a guide: 'http://wiki.mandriva.com/en/Rpmbuild_and_git' I am developing and testing on CentOS 6.2 64-bit. Most information I've found by consulting with Mr. Google describes only how to create them from and existing SRPM. I'd like some assistance in the form of a cheat sheet, wiki, or whatever you have to point me in the right direction. The current output of my 'rpmbuild' is attached below my signature. Jason Rohm Communication Architect SRC Technologies [xxxxx@freeradiusdev rpmbuild]$ rpmbuild -ba ~/rpmbuild/SPECS/freeradius.spec Executing(%prep): /bin/sh -e /var/tmp/rpm-tmp.udSl3C + umask 022 + cd /home/xxxxxx/rpmbuild/BUILD + LANG=C + export LANG + unset DISPLAY + cd /home/xxxxxx/rpmbuild/BUILD + rm -rf freeradius-server-2.2.0 + /usr/bin/bzip2 -dc /home/jtrohm/rpmbuild/SOURCES/freeradius-server-2.2.0.tar.bz2 + /bin/tar -xf - + STATUS=0 + '[' 0 -ne 0 ']' + cd freeradius-server-2.2.0 + /bin/chmod -Rf a+rX,u+w,g-w,o-w . + echo 'Patch #1 (freeradius-cert-config.patch):' Patch #1 (freeradius-cert-config.patch): + /bin/cat /home/xxxxx/rpmbuild/SOURCES/freeradius-cert-config.patch + /usr/bin/patch -s -p1 -b --suffix .cert-config --fuzz=0 1 out of 1 hunk FAILED -- saving rejects to file raddb/certs/ca.cnf.rej 1 out of 1 hunk FAILED -- saving rejects to file raddb/certs/client.cnf.

3 4

[patch] Don't dereference a null pointer.
by Jonh Wendell 16 Mar '12

16 Mar '12

hi, folks. attached is a patch to fix a crash when the radiusclient.conf file doesn't have certain keys. it's applied against alandekok's github master tree. cheers, -- Jonh Wendell www.vexcorp.com

1 0

Spare threads not exiting
by Matt Ezell 08 Mar '12

08 Mar '12

Hello- I was originally running FreeRADIUS 2.1.10 that came with CentOS 6.2, but I've since compiled my own 2.1.12. It looks like the thread management isn't quite working like I expect it to. If I flood the server with a ton of concurrent requests, it will spawn new threads up to "max_servers". Then, if I slowly hit the server with requests (to allow the cleanup mechanism time to work), the number of threads does not go down to "max_spare_servers". Has anyone else seen this? I instrumented threads.c, and it appears that a thread's "request" field doesn't get set to NULL after it handles a requests*. This is a problem, because the thread reaper uses the condition (handle->request == NULL) to mark a thread as THREAD_CANCELLED. I tested a small patch that appears to allow threads to cleanup, but I'm not sure if it's the right way to proceed with this. I tried to setup a pull request on github, but it looks like it tired to push my entire 2.1.x branch onto master (https://github.com/alandekok/freeradius-server/pull/51) I understand that you normally request that people provide the output of "radiusd -X", but "single server" mode handles threading differently (i.e. I don't see the problem). Basically, I'm using the default "thread pool" settings, but all my requests go through an rlm_perl "authorize" module that sets Auth-Type to 'Accept' (for testing). Let me know if you still want this output to see some of my settings. I also understand that some of this code has been re-worked for MASTER. I understand if you don't plan on releasing another 2.1.x, but I would appreciate it if you let me know if this is an appropriate fix on 2.1.x. We are probably going to stick with this series for a while. Thanks for your time- ~Matt * I added the following code in threads.c in thread_pool_manage() if (handle->request != NULL) { DEBUG2("Threads: thread %d NOT canceled, processing %i\n",handle->thread_num,handle->request->number); }

2 1

TLS configuration
by Matthew Newton 06 Mar '12

06 Mar '12

Hi, We've been struggling a bit with the TLS config - not actually configuring it, but how it appears in the config file. The basic thoughts go something along the lines of: PEAP uses TLS EAP-TTLS uses TLS EAP-TLS uses TLS ... so why is the TLS config all inside EAP-TLS, and mysteriously PEAP and TTLS use EAP-TLS's config? When you go to configure PEAP/EAP-TLS things get more interesting, as you actually have to configure EAP-TLS+PEAP (outer), and then EAP-TLS (inner). To be honest, configuring PEAP/MS-CHAPv2 a year or so ago for the first time felt wierd too - "but I don't want EAP-TLS" :) This it not from a programming point of view - I can see why it's done like that. It's more for ease of understanding the configuration. There are other places where TLS crops up too, such as RADSEC and LDAP. The RADSEC one specifically says it's the same config as EAP-TLS (but at least it doesn't *use* EAP-TLS's config!) We wondered whether something like the following would be feasable, or worth trying to implement? In the main top-level config in radiusd.conf, have a new 'tls' section, that might look something like this: tls { outer-peap { certificate_file = ${certdir}/server.pem ... } inner-eap { private_key_file = ${certdir}/server.pem certificate_file = ${certdir}/server.pem CA_file = ${cadir}/ca.pem ... } outer-tls { ... } radsec { ... } ldap { ... } } where the sub-headings are just labels - instantiations of the 'tls' config. Then wherever a TLS configuration is required, we can have just "tls = outer-peap". For example, modules: eap { tls { tls = outer-tls fragment_size = 1200 ... } peap { tls = outer-peap default_eap_type = mschapv2 copy_request_to_tunnel = no use_tunneled_reply = no virtual_server = "inner-tunnel" ... } } eap inner-eap { tls { tls = inner-tls cache { ... } fragment_size = 1024 verify { ... } } } This then makes it quite clear which TLS config belongs to which section, and allows sharing of TLS configs if really desired. The only potential problem I can see is if the TLS on EAP comes up first, before the EAP type is determined, but having looked at the protocol I don't believe that is the case - so the server should always know that it's the PEAP tls= config that is being used, as the EAP type was code 25, for example. I think we were thinking "hang on a sec, TLS is a generic server thing, nothing really to specifically do with EAP-TLS or PEAP, etc, so why is the config just in EAP-TLS - that's confusing". As a start, I guess the modules could keep their current TLS settings, but have an additional tls= option that would pull global config in at instantiation time. I'm not sure it needs to be any more difficult than that - except maybe in the PEAP/TTLS sections which don't have their own settings already. Are there any thoughts on this - is it worth persuing? I'm not sure if I'll have time to work on it or not, but thought it was worth throwing the idea out anyway. :) Thanks, Matthew -- Matthew Newton, Ph.D. <mcn4(a)le.ac.uk> Systems Architect (UNIX and Networks), Network Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp(a)le.ac.uk>

2 11