October 2005 - Freeradius-Users - lists.freeradius.org

help with config files for wireless EAP-TTLS
by Michael Wang 31 Oct '05

31 Oct '05

Hi, I am trying to set up my FreeRadius 1.0.4 to do wireless EAP-TTLS. I got it working for EAP-TLS and EAP-PEAP, so I know my config is basically correct. The problem I am having is that I would like to use the same userid for the "outer" and "inner" EAP identity string. So in my user's file, I have a line that looks like: "qa" Auth-Type := EAP, User-Password == "qa" Now when my client tries to authenticate, the TLS tunnel is set up OK, but when we get to the inner MSCHAP protocol, FreeRadius still thinks we are doing EAP and rejects the authentication attempt. Here is a snippet from the output of radiusd -A -X (other): SSL negotiation finished successfully <--- (so far so good) SSL Connection Established eaptls_process returned 13 modcall[authenticate]: module "eap" returns handled for request 3 modcall: group authenticate returns handled for request 3 Sending Access-Challenge of id 3 to 10.222.0.18:1025<http://10.222.0.18:1025/> EAP-Message = 0x0104004515800000003b140301000 10116030100303e6bb07c9ba8bcdd94b7f0ee66d43b439d87b89b99025c1310aa4dc9bf7491555d4d0888ef91a0c7f628b79868ced090 Message-Authenticator = 0x00000000000000000000000000000000 State = 0x3d987f832d6f6ed2f7e42b0fe6b2d77b Finished request 3 Going to the next request Waking up in 2 seconds... rad_recv: Access-Request packet from host 10.222.0.18:1025<http://10.222.0.18:1025/>, id=4, length=353 Message-Authenticator = 0x1d82927ff8e036beeb0aca3ee45c1608 Service-Type = Framed-User User-Name = "qa" Framed-MTU = 1488 State = 0x3d987f832d6f6ed2f7e42b0fe6b2d77b Called-Station-Id = "00-03-7F-04-03-F6:TomAP48" Calling-Station-Id = "00-03-7D-00-06-32" NAS-Port-Type = Wireless-802.11 Connect-Info = "CONNECT 11Mbps 802.11b" EAP-Message = 0x020400b015001703010020fb074fcc5e5f2df2d24fcee30e4d18a4638a526f045e84651467daae520e2f4417030100809d045521172337970b871775afd53193cae98494128c873dd3786f75c340f7c4992c0f7aa2c4fdecdf595ec0ec65a9692e448c5f7df7b9bff4d975bd7fb112a1cec89c01ea8aba0c328d087ffee23a6637970e1dab1fc959838cbf8e42dae0832c35f409b77a61229991f6ee238292239bec74fc6d5f09a16979aa6f5af4a3c9 NAS-IP-Address = 10.222.0.18 <http://10.222.0.18/> NAS-Port = 1 NAS-Port-Id = "STA port # 1" Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 modcall[authorize]: module "mschap" returns noop for request 4 rlm_realm: No '@' in User-Name = "qa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: EAP packet type response id 4 length 176 rlm_eap: No EAP Start, assuming it's an on-going EAP conversation modcall[authorize]: module "eap" returns updated for request 4 users: Matched entry qa at line 104 modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns updated for request 4 rad_check_password: Found Auth-Type EAP auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: Request found, released from the list rlm_eap: EAP/ttls rlm_eap: processing type ttls rlm_eap_ttls: Authenticate rlm_eap_tls: processing TLS eaptls_verify returned 7 rlm_eap_tls: Done initial handshake eaptls_process returned 7 rlm_eap_ttls: Session established. Proceeding to decode tunneled attributes. Processing the authorize section of radiusd.conf modcall: entering group authorize for request 4 modcall[authorize]: module "preprocess" returns ok for request 4 modcall[authorize]: module "chap" returns noop for request 4 rlm_mschap: Found MS-CHAP attributes. Setting 'Auth-Type = MS-CHAP' <--- (At this point, freeradius correctly sets auth-type MSCHAP) modcall[authorize]: module "mschap" returns ok for request 4 rlm_realm: No '@' in User-Name = "qa", looking up realm NULL rlm_realm: No such realm "NULL" modcall[authorize]: module "suffix" returns noop for request 4 rlm_eap: No EAP-Message, not doing EAP modcall[authorize]: module "eap" returns noop for request 4 users: Matched entry qa at line 104 <---- (Uh, oh, we matched that qa line again, and now.....) modcall[authorize]: module "files" returns ok for request 4 modcall: group authorize returns ok for request 4 rad_check_password: Found Auth-Type EAP <----- (auth-type is set to EAP again, which is not what I want.) auth: type "EAP" Processing the authenticate section of radiusd.conf modcall: entering group authenticate for request 4 rlm_eap: EAP-Message not found rlm_eap: Malformed EAP Message modcall[authenticate]: module "eap" returns fail for request 4 modcall: group authenticate returns fail for request 4 auth: Failed to validate the user. TTLS: Got tunneled Access-Reject rlm_eap: Handler failed in EAP/ttls rlm_eap: Failed in EAP select I can get around the problem by putting two lines in my users file: "outerqa" Auth-Type := EAP, User-Password == "qa" "innerqa" Auth-Type := MS-CHAP, User-Password == "qa" But I would like to avoid the complexity of setting up two user identities, one for the outter and one for the inner. Is there any way to configure FreeRadius so that a single EAP identity can be used for EAP-TTLS? Thanks in advance for any help you can give. Michael

2 1

radwtmp
by King, Michael 31 Oct '05

31 Oct '05

So what is the radwtmp and what is it's purpose? Mine's at 500 megs, and growing. I'm wondering if I should get concerned, since I might have misconfigured something.

2 1

Installation of freeradius on cobalt raq3
by Shaun Krok [MTNNS - Durban] 31 Oct '05

31 Oct '05

Hi there, I am trying to install freeradius-0.9.1 using a tar on a Cobalt Raq 3 box. Some reading I have done it says their should be no issue. It keeps on failing at the end of the make and make install .... Is their anything special I should be doing ... <<< ls.c: In function `load_dh_params': tls.c:38: too many arguments to function `PEM_read_bio_DHparams' tls.c: In function `init_tls_ctx': tls.c:111: warning: implicit declaration of function `SSL_CTX_set_default_passwd_cb_userdata' tls.c:112: warning: passing arg 2 of `SSL_CTX_set_default_passwd_cb' from incompatible pointer type tls.c:179: warning: implicit declaration of function `RAND_load_file' tls.c: In function `new_tls_session': tls.c:220: warning: implicit declaration of function `SSL_set_msg_callback' tls.c:221: warning: implicit declaration of function `SSL_set_msg_callback_arg' gmake[10]: *** [tls.o] Error 1 Shaun Krok -- No virus found in this outgoing message. Checked by AVG Free Edition. Version: 7.1.362 / Virus Database: 267.12.6/151 - Release Date: 10/28/2005

1 0

Freeradius 1.0.5 installation on Suse 64 biut platform
by Ashwin Gobind 31 Oct '05

31 Oct '05

Good day. I am having a problem installing freeradius on Suse Linux. I am using a 64 bit AMD dual core platform. Please see the log below : -module -export-dynamic \ -o rlm_counter.la -rpath /usr/local/lib rlm_counter.lo -lgdbm -lssl -lcrypto -lnsl -lresolv -lpthread rm -fr .libs/rlm_counter.la .libs/rlm_counter.* .libs/rlm_counter-1.0.5.* gcc -shared rlm_counter.lo /usr/lib/libgdbm.so -lssl -lcrypto -lnsl -lresolv -lpthread -Wl,-soname -Wl,rlm_counter-1.0.5.so -o .libs/rlm_counter-1.0.5.so /usr/lib/libgdbm.so: could not read symbols: Invalid operation collect2: ld returned 1 exit status gmake[6]: *** [rlm_counter.la] Error 1 gmake[6]: Leaving directory `/usr/software/freeradius-1.0.5/src/modules/rlm_counter' gmake[5]: *** [common] Error 2 gmake[5]: Leaving directory `/usr/software/freeradius-1.0.5/src/modules' gmake[4]: *** [all] Error 2 gmake[4]: Leaving directory `/usr/software/freeradius-1.0.5/src/modules' gmake[3]: *** [common] Error 2 gmake[3]: Leaving directory `/usr/software/freeradius-1.0.5/src' gmake[2]: *** [all] Error 2 gmake[2]: Leaving directory `/usr/software/freeradius-1.0.5/src' gmake[1]: *** [common] Error 2 gmake[1]: Leaving directory `/usr/software/freeradius-1.0.5' make: *** [all] Error 2 �This e-mail is sent on the Terms and Conditions that can be accessed by Clicking on this link http://www.vodacom.net/legal/email.aspx "

2 1

Proxy Forwarding on User-Name attribute
by Christian Meutes 31 Oct '05

31 Oct '05

Hello, i have the demand to forward some auth-requests to some further radius servers, but only in the case when a specific User-Name is for authorization requested. The User-Name attributes look like this "+493265352354(a)realm.com" and the userpart is always changing but the realm is always the same. How can i accomplish this without defining every user which is to forward in "proxy.conf"? Is there no way to do this in the authorization backend(sql) for a more dynamic procedure? I have thousands of users which are to forward and others which are not, i think this wont scale inside of proxy.conf and further more i think that there is no part of the User-Name which could be match in proxy.conf to proxy some user requests to different radius servers. I would be happy if anybody could point me to an option to realize this. regards, -christian

4 4

Timezone support
by Gunther 31 Oct '05

31 Oct '05

I'm using FreeRadius 1.0.5 with MySQL 4.1.10. I am looking for a solution for timezone support over several timezones. There are probably several ways of doing this: 1. Set server with FreeRadius to the particular fixed timezone e.g. GMT 2. Set MySQL to a fixed timezone (my.cnf timezone= ...) 3. others ... Where are timezones used: - System - MySQL - PHP Application - FreeRadius I do not like to change the server timezone as other applications are using the same server. Same thing for setting MySQL to a fixed timezone, which is not my normal timezone, as other applications are using other DBs on the MySQL server. I thought I can use the MySQL session specific timezone settings, but I do not see anyhwere a place where I can set that in FreeRadius. I can set everything in PHP, but when it comes to radacct updates from a NAS ... I only have the MySQL specific timezone. It looks like that FreeRadius is always using the System specific time and does not care about the MySQL timezone settings. My goal: I like to have all radacct date&time in e.g. GMT and then convert in my application to the NAS specific timezone. Right now I can only achieve this by setting the MySQL timezone to GMT and ALL DB's are then in that timezone. Or I run a separate instance of MySQL with different port to do this? Any thoughts? Is there maybe a variable in FreeRadius telling to store time information in another timezone? Do I have to switch from MySQL tp Postgresql ... there are probably many people using FreeRadius with NAS' spreaded over several timezones. Thx!

1 0

freeradius and machine account authentication
by Norbert Wegener 30 Oct '05

30 Oct '05

To restrict access to a lan the network shall be equipped with switches, that are capable of 802.1x authentication on a per port basis. Only client machines with a valid machine account in a central active directory shall get access. As I have never had to do with active directory, I am unsure, whether freeradius is suited to be used for the authentication process. googling around I found the following assertion: FreeRADIUS at this time cannot perform machine account authentications, but it supports proxying them off to another RADIUS server (for example, IAS, or FUNK) see: http://listserv.educause.edu/cgi-bin/wa.exe?A2=ind0505&L=wireless-lan&T=0&F… Is this true? If not, is there any documentation available, that describes the setup? Which credentials are used by that kind of authentication: account names/passwords , certificates,...? Thanks Norbert Wegener

2 3

v 1.05 and %{Cisco-AVPair[ ]}
by Velikanov 30 Oct '05

30 Oct '05

Good day. What must i do to use "%{Cisco-AVPair[ ]}" with FreeRadius v 1.05 Thanks.

3 2

Post authentication Bandwidth control
by Alex M 30 Oct '05

30 Oct '05

How can I use Post authentication to control the user's bandwidth??? Thanks!

1 0

changing "invalid username or password" message - how to do?
by Westweb Tech 29 Oct '05

29 Oct '05

Hi folks - I am in need of a way to get a message to non-paying customers when they try to login. Is it possible to change the "invalid username or password" message to read something else? Or, is it possible using radius to force a dial-in customer to redirect to one web page only (a non-payment notice page?) I can provide more info if needed. I am currently not using freeradius but will use it if this will work somehow. Thanks, AW

1 0